joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014af0
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x290
mov rsi, rcx
mov rax, qword [0x140091028]
xor rax, rsp
mov qword [rsp + 0x288], rax
lea rdi, [rsp + 0x70]
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
add eax, 0xffffffff
cmp eax, 0x102
jbe 0x140014b30
xor esi, esi
jmp 0x140014b95
mov qword [rsp + 0x20], rdi
cmp word [rsp + 0x70], 0
je 0x140014b4e
xor eax, eax
nop
cmp word [rsp + rax*2 + 0x72], 0
lea rax, [rax + 1]
jne 0x140014b40
jmp 0x140014b50
xor eax, eax
mov qword [rsp + 0x28], rax
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140010ea0
lea rbx, [rsp + 0x50]
mov rcx, rdi
mov rdx, rbx
call fcn.140013c10
mov rcx, rsi
mov rdx, rbx
call fcn.140011030
mov rcx, rbx
call fcn.140010f50
mov rcx, rdi
call fcn.140010f50
mov sil, 1
mov rcx, qword [rsp + 0x288]
xor rcx, rsp
call fcn.140051fd0
mov eax, esi
add rsp, 0x290
pop rbx
pop rdi
pop rsi
ret

Function at 0x140015100
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov esi, r8d
mov rbx, rdx
mov rax, qword [0x140091028]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [rcx + 0x18], 7
jbe 0x140015126
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x40], 0
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.1400155a0
mov rcx, qword [rsp + 0x40]
mov edi, 0xffffffff
lea rax, [rcx + 1]
cmp rax, 2
jb 0x1400151ac
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
mov rdx, rbx
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb eax, eax
cmp dword [rsp + 0x3c], esi
mov edi, 0xffffffff
cmove edi, esi
or edi, eax
mov rcx, qword [rsp + 0x40]
add rcx, 1
cmp rcx, 2
jb 0x1400151e5
call fcn.1400299a0
mov r8, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x40]
mov r9, rax
call fcn.140029a20
mov rcx, qword [rsp + 0x40]
call fcn.1400299b0
mov qword [rsp + 0x40], 0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140051fd0
mov eax, edi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400153b0
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x578
mov r15d, r8d
mov r14, rdx
mov rax, rcx
mov rcx, qword [0x140091028]
xor rcx, rsp
mov qword [rsp + 0x570], rcx
mov qword [rsp + 0x20], rdx
xor ebp, ebp
lea rsi, [rsp + 0x2a0]
xor r8d, r8d
mov r9d, 3
mov rcx, rsi
mov rdx, rax
call fcn.140028bc0
lea rdi, [rsp + 0x280]
mov rcx, rsi
mov rdx, rdi
call fcn.140028d50
cmp qword [rsp + 0x290], 0
je 0x140015554
lea rsi, [rsp + 0x2a0]
lea rbx, [rsp + 0x30]
mov r12, qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor r13d, r13d
nop word [rax + rax]
mov rcx, rsi
mov rdx, rbx
call fcn.140028cc0
mov edx, dword [rsp + 0x30]
test dl, 1
je 0x140015488
test r15b, r15b
jne 0x140015469
mov rcx, rbx
call fcn.140028950
test al, al
jne 0x140015488
mov edx, dword [rsp + 0x30]
and edx, 0xfffffffe
cmp qword [rsp + 0x298], 7
mov rcx, rdi
jbe 0x140015482
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov rcx, rbx
call fcn.140028950
test al, al
je 0x1400154e0
xor ebp, ebp
test r15b, r15b
je 0x140015515
mov r8b, 1
mov rcx, rdi
mov rdx, r14
call fcn.1400153b0
mov ebp, eax
test eax, eax
jne 0x140015515
cmp qword [rsp + 0x298], 7
mov rcx, rdi
jbe 0x1400154c5
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ebp, 0
test eax, eax
jne 0x140015515
jmp 0x1400154ff
cmp qword [rsp + 0x298], 7
mov rcx, rdi
jbe 0x1400154f6
mov rcx, qword [rsp + 0x280]
call r12
xor ebp, ebp
test eax, eax
jne 0x140015515
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
or eax, 1
cmp eax, 3
mov eax, 0
cmove ebp, eax
test r13d, r13d
cmovne ebp, r13d
mov rcx, rbx
call fcn.14000b290
mov rcx, rsi
mov rdx, rbx
call fcn.140028d50
mov rcx, rdi
mov rdx, rbx
call fcn.140011030
mov rcx, rbx
call fcn.140010f50
cmp qword [rsp + 0x290], 0
mov r13d, ebp
jne 0x140015440
lea rcx, [rsp + 0x280]
call fcn.140010f50
lea rcx, [rsp + 0x2a0]
call fcn.140028bf0
mov rcx, qword [rsp + 0x570]
xor rcx, rsp
call fcn.140051fd0
mov eax, ebp
add rsp, 0x578
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400155a0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x140015623
mov rdi, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
add rax, 1
cmp rax, 2
jb 0x1400155ee
call fcn.1400299a0
mov r8, qword [rsp + 0x38]
mov rcx, qword [rsi]
mov rdx, rsi
mov r9, rax
call fcn.140029a20
mov rcx, qword [rsi]
call fcn.1400299b0
mov qword [rsi], 0
lea rax, [rdi + 1]
cmp rax, 2
jb 0x140015613
mov qword [rsi], rdi
call fcn.1400299a0
mov r8, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
mov r9, rax
call fcn.1400299e0
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140015e10
Capabilities:
Delete file

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov r14, rcx
mov rax, qword [0x140091028]
xor rax, rbp
mov qword [rbp], rax
call fcn.14000d910
mov rdi, rax
lea rbx, [0x140078d70]
mov rcx, rax
mov rdx, rbx
call fcn.14000dd30
test al, al
jne 0x140015e6d
lea rdx, str.vmodule
mov rcx, rdi
call fcn.14000dd30
test al, al
je 0x140015f7a
cmp qword [0x140091e08], 0
jne 0x14001607d
mov rax, qword [0x140091e10]
mov qword [0x140091e08], rax
mov ecx, 0x20
call fcn.140051f60
mov rsi, rax
lea rcx, str.vmodule
mov qword [rbp - 0x50], rcx
call fcn.140062e60
mov qword [rbp - 0x48], rax
lea r15, [rbp - 0x20]
lea r8, [rbp - 0x50]
mov rcx, rdi
mov rdx, r15
call fcn.14000de30
mov qword [rbp - 0x60], rbx
mov rcx, rbx
call fcn.140062e60
mov qword [rbp - 0x58], rax
lea rbx, [rbp - 0x40]
lea r8, [rbp - 0x60]
mov rcx, rdi
mov rdx, rbx
call fcn.14000de30
lea r9, [0x140091e18]
mov rcx, rsi
mov rdx, rbx
mov r8, r15
call fcn.14002a040
mov qword [0x140091e10], rsi
mov rax, qword [rbp - 0x28]
cmp rax, 0x10
jb 0x140015f3b
mov rcx, qword [rbp - 0x40]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140015f36
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140016084
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.140051fb0
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x140015f7a
mov rcx, qword [rbp - 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140015f75
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140016084
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.140051fb0
mov eax, dword [r14]
mov dword [section..data], eax
mov bl, 1
test al, 1
je 0x14001605f
mov rcx, qword [0x140091e68]
test rcx, rcx
je 0x140015faa
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140091e68], 0
mov rdi, qword [0x140091e20]
test rdi, rdi
jne 0x140015fe3
mov ecx, 0x20
call fcn.140051f60
mov rdi, rax
mov eax, 7
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rdi + 0x10], xmm0
mov word [rdi], 0
mov qword [0x140091e20], rdi
mov rsi, qword [r14 + 8]
mov rcx, rsi
call fcn.140063970
mov rbx, rax
mov rax, qword [rdi + 0x18]
cmp rax, rbx
jae 0x140016012
mov rcx, rdi
mov rdx, rbx
mov r9, rsi
call fcn.14000f850
cmp dword [r14 + 0x14], 0
jne 0x140016058
jmp 0x140016041
mov r15, rdi
cmp rax, 8
jb 0x14001601e
mov r15, qword [rdi]
mov qword [rdi + 0x10], rbx
mov r8, rbx
add r8, rbx
mov rcx, r15
mov rdx, rsi
call fcn.140056460
mov word [r15 + rbx*2], 0
cmp dword [r14 + 0x14], 0
jne 0x140016058
mov rcx, qword [0x140091e20]
cmp qword [rcx + 0x18], 7
jbe 0x140016052
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.140016090
mov ebx, eax
mov rcx, qword [rbp]
xor rcx, rbp
call fcn.140051fd0
mov eax, ebx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
int3
call fcn.14005ca40
ud2
Function at 0x14001c520
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov esi, r9d
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x140091028]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x50]
call fcn.1400242c0
call fcn.140034a60
test al, al
je 0x14001c56e
movsxd r9, esi
lea rdx, str.File::Write
lea rcx, [rsp + 0x50]
mov r8, rbx
call fcn.140034b00
mov rax, rdi
shr rax, 0x20
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], eax
mov rcx, qword [rbx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2c]
mov rdx, r14
mov r8d, esi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sbb esi, esi
or esi, dword [rsp + 0x2c]
lea rcx, [rsp + 0x50]
call fcn.140034ad0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140051fd0
mov eax, esi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14001c5e0
Capabilities:
Get file size

Disassembly:
push rsi
sub rsp, 0x40
mov rsi, rcx
mov rax, qword [0x140091028]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x28]
call fcn.1400242c0
call fcn.140034a60
test al, al
je 0x14001c621
lea rdx, str.File::GetLength
lea rcx, [rsp + 0x28]
xor r9d, r9d
mov r8, rsi
call fcn.140034b00
mov rcx, qword [rsi]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb rsi, rsi
or rsi, qword [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.140034ad0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140051fd0
mov rax, rsi
add rsp, 0x40
pop rsi
ret

Function at 0x14001c660
Capabilities:
Clear file content

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140091028]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x28]
call fcn.1400242c0
call fcn.140034a60
test al, al
je 0x14001c6a6
lea rdx, str.File::SetLength
lea rcx, [rsp + 0x28]
mov r8, rsi
mov r9, rdi
call fcn.140034b00
mov rcx, qword [rsi]
xor ebx, ebx
lea r8, [rsp + 0x20]
xor edx, edx
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001c704
mov rcx, qword [rsi]
xor ebx, ebx
xor r8d, r8d
xor r9d, r9d
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14001c704
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x14001c702
mov rdx, qword [rsp + 0x20]
mov rcx, qword [rsi]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
setne bl
jmp 0x14001c704
xor ebx, ebx
lea rcx, [rsp + 0x28]
call fcn.140034ad0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140051fd0
mov eax, ebx
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x14001d680
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rax, qword [0x140091028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, qword [rcx + 8]
cmp rdi, 4
jb 0x14001d701
mov rsi, rcx
mov r12, qword [rcx]
lea rax, [r12 + rdi]
add rax, 0xfffffffffffffffd
cmp r12, rax
jae 0x14001d701
add rsi, 0x10
add rdi, 0xfffffffffffffffd
xor ebx, ebx
lea r14, [rsp + 0x28]
lea r15, [rsp + 0x38]
mov eax, dword [r12 + rbx]
imul rcx, rax, 0x36
mov rdx, rax
shr rdx, 0x11
add rdx, rcx
shr rax, 0x17
xor rax, rdx
mov qword [rsp + 0x38], rax
mov rcx, rsi
mov rdx, r14
mov r8, r15
call fcn.14001dc30
inc rbx
cmp rdi, rbx
jne 0x14001d6cd
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140051fd0
nop
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14001d7a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r15, rdx
mov rax, qword [0x140091028]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, qword [r8 + 8]
cmp rbx, 4
jb 0x14001d850
mov rbp, qword [r8]
lea rax, [rbx + rbp]
add rax, 0xfffffffffffffffd
cmp rbp, rax
jae 0x14001d84c
mov qword [rsp + 0x28], r8
lea rsi, [r15 + 0x10]
add rbx, 0xfffffffffffffffd
xor r14d, r14d
lea r12, [rsp + 0x30]
lea r13, [rsp + 0x38]
xor edi, edi
mov eax, dword [rbp + r14]
imul rcx, rax, 0x36
mov rdx, rax
shr rdx, 0x11
add rdx, rcx
shr rax, 0x17
xor rax, rdx
mov qword [rsp + 0x38], rax
mov rcx, rsi
mov rdx, r12
mov r8, r13
call fcn.14001e050
mov rax, qword [rsp + 0x30]
xor ecx, ecx
cmp rax, qword [r15 + 0x18]
sete cl
add rdi, rcx
inc r14
cmp rbx, r14
jne 0x14001d7fc
test rdi, rdi
mov r8, qword [rsp + 0x28]
jne 0x14001d86e
mov rbx, qword [r8 + 8]
cmp qword [r15 + 8], rbx
jne 0x14001d86c
mov rdx, qword [r8]
mov rcx, qword [r15]
mov r8, rbx
call fcn.140056360
xor edi, edi
test eax, eax
jne 0x14001d86e
jmp 0x14001d871
xor edi, edi
inc rdi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140051fd0
mov rax, rdi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14001dc30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rdx
mov r15, rcx
movabs rbx, 0xcbf29ce484222325
xor eax, eax
movabs rcx, 0x100000001b3
movzx edx, byte [r8 + rax]
xor rbx, rdx
imul rbx, rcx
inc rax
cmp rax, 8
jne 0x14001dc59
and rbx, qword [r15 + 0x30]
mov rax, qword [r15 + 8]
mov rcx, qword [r15 + 0x18]
mov rdx, rbx
shl rdx, 4
mov rdi, qword [rcx + rdx]
mov rsi, rax
cmp rdi, rax
je 0x14001dca0
lea rdx, [rbx + rbx]
shl rdx, 3
or rdx, 8
mov rcx, qword [rcx + rdx]
mov rsi, qword [rcx]
lea r12, [r15 + 8]
mov rcx, qword [r8]
cmp rdi, rsi
je 0x14001dcbd
mov rsi, qword [rsi + 8]
cmp rcx, qword [rsi + 0x10]
jne 0x14001dca7
xor eax, eax
mov r12, rsi
jmp 0x14001dd23
mov rdx, qword [rax]
mov rcx, r12
call fcn.14001de40
mov rax, qword [r12]
mov r12, qword [rax]
mov rax, qword [r12]
cmp rax, rdi
je 0x14001dd08
mov rcx, qword [r12 + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r12
mov rcx, qword [rdi + 8]
mov rdx, qword [rax + 8]
mov qword [rdi + 8], rdx
mov rdx, qword [r12 + 8]
mov qword [rax + 8], rdx
mov qword [r12 + 8], rcx
mov rcx, r15
mov rdx, r12
mov r8, rsi
mov r9, rbx
call fcn.14001dd40
mov rcx, r15
call fcn.14001dda0
mov al, 1
mov qword [r14], r12
mov byte [r14 + 8], al
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x14001df40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, r9
mov r14, rdx
mov rbx, rcx
movabs r9, 0xcbf29ce484222325
xor eax, eax
movabs rcx, 0x100000001b3
movzx edx, byte [r8 + rax]
xor r9, rdx
imul r9, rcx
inc rax
cmp rax, 8
jne 0x14001df68
and r9, qword [rbx + 0x30]
mov rsi, qword [rbx + 8]
mov rcx, qword [rbx + 0x18]
mov rax, r9
shl rax, 4
mov rax, qword [rcx + rax]
cmp rax, rsi
je 0x14001dfac
lea rdx, [r9 + r9]
shl rdx, 3
or rdx, 8
mov rcx, qword [rcx + rdx]
mov rsi, qword [rcx]
mov rcx, qword [r8]
cmp rax, rsi
je 0x14001dfeb
mov rsi, qword [rsi + 8]
cmp rcx, qword [rsi + 0x10]
jne 0x14001dfaf
mov rax, qword [rdi]
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rax, qword [rdi]
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
dec qword [rbx + 0x10]
mov edx, 0x18
mov rcx, rdi
call fcn.140051fb0
xor eax, eax
mov rdi, rsi
jmp 0x14001e038
mov rcx, qword [rdi]
cmp rcx, rax
je 0x14001e020
mov rdx, qword [rdi + 8]
mov qword [rdx], rcx
mov rdx, qword [rcx + 8]
mov qword [rdx], rax
mov rdx, qword [rax + 8]
mov qword [rdx], rdi
mov r8, qword [rax + 8]
mov rdx, qword [rcx + 8]
mov qword [rax + 8], rdx
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
mov qword [rdi + 8], r8
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call fcn.14001dd40
mov rcx, rbx
call fcn.14001dda0
mov al, 1
mov qword [r14], rdi
mov byte [r14 + 8], al
mov rax, r14
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14001e050
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
movabs rax, 0xcbf29ce484222325
xor esi, esi
movabs r9, 0x100000001b3
movzx edi, byte [r8 + rsi]
xor rax, rdi
imul rax, r9
inc rsi
cmp rsi, 8
jne 0x14001e068
and rax, qword [rcx + 0x30]
mov r9, qword [rcx + 8]
mov r10, qword [rcx + 0x18]
mov rcx, rax
shl rcx, 4
mov r11, qword [r10 + rcx]
lea rdi, [rax + rax]
add rdi, 1
mov rax, qword [r8]
mov rcx, r11
jmp 0x14001e0ad
cmp qword [rcx + 0x10], rax
je 0x14001e0c5
mov rcx, qword [rcx]
cmp r11, r9
je 0x14001e0bb
mov rsi, qword [r10 + rdi*8]
mov rsi, qword [rsi]
jmp 0x14001e0be
mov rsi, r9
cmp rsi, rcx
jne 0x14001e0a4
jmp 0x14001e0c8
mov r9, rcx
mov qword [rdx], r9
mov rax, rdx
pop rdi
pop rsi
ret

Function at 0x140027770
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov rax, qword [0x140091028]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x80], 0
je 0x1400277f0
cmp qword [rsi + 0x68], 0
je 0x14002782a
cmp byte [rsi + 0x71], 0
je 0x14002782a
mov rax, qword [rsi]
mov edx, 0xffffffff
mov rcx, rsi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140027826
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea rbx, [rsp + 0x28]
mov qword [rsp + 0x20], rbx
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
test eax, eax
je 0x1400277f4
cmp eax, 1
je 0x1400277f8
cmp eax, 3
jne 0x140027826
jmp 0x14002782a
xor edi, edi
jmp 0x140027841
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x140027820
mov r9, qword [rsi + 0x80]
lea rcx, [rsp + 0x30]
mov edx, 1
mov r8, rbx
call fcn.14005f3f0
cmp rbx, rax
jne 0x140027826
cmp byte [rsi + 0x71], 0
je 0x14002782a
xor ebx, ebx
jmp 0x14002782d
mov rbx, rsi
mov rcx, qword [rsi + 0x80]
call fcn.14005e1b0
xor edi, edi
test eax, eax
cmove rdi, rbx
mov byte [rsi + 0x7c], 0
mov byte [rsi + 0x71], 0
lea rax, [rsi + 8]
mov qword [rsi + 0x18], rax
lea rax, [rsi + 0x10]
mov qword [rsi + 0x20], rax
lea rax, [rsi + 0x28]
mov qword [rsi + 0x38], rax
lea rax, [rsi + 0x30]
mov qword [rsi + 0x40], rax
lea rax, [rsi + 0x48]
mov qword [rsi + 0x50], rax
lea rax, [rsi + 0x4c]
mov qword [rsi + 0x58], rax
mov qword [rsi + 0x48], 0
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
movups xmmword [rsi + 0x28], xmm0
mov qword [rsi + 0x80], 0
mov rax, qword [0x140092098]
mov qword [rsi + 0x74], rax
mov qword [rsi + 0x68], 0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140051fd0
mov rax, rdi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
Function at 0x14002cfc0
Capabilities:
Query environment variable

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x80
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140091028]
xor rax, rsp
mov qword [rsp + 0x78], rax
movdqu xmm0, xmmword [rcx]
movdqa xmmword [rsp + 0x40], xmm0
lea rbx, [rsp + 0x58]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140026090
cmp qword [rsp + 0x70], 7
jbe 0x14002d00b
mov rbx, qword [rsp + 0x58]
xor edx, edx
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebp, eax
mov rax, qword [rsp + 0x70]
cmp rax, 8
jb 0x14002d063
mov rcx, qword [rsp + 0x58]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14002d05e
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x14002d226
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.140051fb0
test ebp, ebp
je 0x14002d12e
mov r14b, 1
test rsi, rsi
je 0x14002d208
mov ecx, ebp
add rcx, rcx
call fcn.140054670
mov rbx, rax
movdqu xmm0, xmmword [rdi]
movdqa xmmword [rsp + 0x30], xmm0
lea rdi, [rsp + 0x58]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140026090
cmp qword [rsp + 0x70], 7
jbe 0x14002d0ad
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
mov rdx, rbx
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov rax, qword [rsp + 0x70]
cmp rax, 8
jb 0x14002d104
mov rcx, qword [rsp + 0x58]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jb 0x14002d0ff
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x14002d226
add rax, rax
add rax, 0x29
mov rdx, rax
call fcn.140051fb0
mov qword [rsp + 0x20], rbx
cmp word [rbx], 0
je 0x14002d136
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax + rax]
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14002d120
jmp 0x14002d138
xor r14d, r14d
jmp 0x14002d208
xor eax, eax
mov qword [rsp + 0x28], rax
lea rdi, [rsp + 0x58]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400260f0
mov rax, qword [rsi + 0x18]
cmp rdi, rsi
je 0x14002d1bf
cmp rax, 0x10
jb 0x14002d192
mov rcx, qword [rsi]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14002d18d
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14002d226
add rax, 0x28
mov rdx, rax
mov rcx, rbp
call fcn.140051fb0
movups xmm0, xmmword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov eax, 0xf
movq xmm0, rax
pslldq xmm0, 8
movdqu xmmword [rsp + 0x68], xmm0
mov byte [rsp + 0x58], 0
jmp 0x14002d1f7
cmp rax, 0x10
jb 0x14002d1f7
mov rcx, qword [rsp + 0x58]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14002d1f2
mov rbp, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbp
cmp rcx, 0x20
jae 0x14002d226
add rax, 0x28
mov rdx, rax
mov rcx, rbp
call fcn.140051fb0
mov qword [rsp + 0x70], 0xf
mov rcx, rbx
call fcn.140051fb0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140051fd0
mov eax, r14d
add rsp, 0x80
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
call fcn.14005ca40
ud2
Function at 0x140033f00
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r12, r8
mov r14, rdx
mov rbx, rcx
mov rsi, qword [rcx + 8]
mov rdi, qword [rsi + 8]
cmp byte [rdi + 0x19], 0
je 0x140033f2a
mov r15, rsi
jmp 0x140033f6f
mov r15, rsi
mov r8, qword [r12]
mov rdx, qword [rdi + 0x20]
mov rcx, rbx
call fcn.140030f60
test al, al
je 0x140033f47
add rdi, 0x10
jmp 0x140033f66
cmp byte [rsi + 0x19], 0
je 0x140033f63
mov r8, qword [rdi + 0x20]
mov rdx, qword [r12]
mov rcx, rbx
call fcn.140030f60
test al, al
cmovne rsi, rdi
mov r15, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x140033f2d
cmp byte [rsi + 0x19], 0
je 0x140033f7f
mov rax, qword [rbx + 8]
add rax, 8
jmp 0x140033f82
mov rax, rsi
mov rdi, qword [rax]
cmp byte [rdi + 0x19], 0
jne 0x140033fb9
xor ebp, ebp
mov r8, qword [rdi + 0x20]
mov rdx, qword [r12]
mov rcx, rbx
call fcn.140030f60
mov ecx, eax
xor cl, 1
movzx ecx, cl
shl rcx, 4
test al, al
cmovne rsi, rdi
mov rdi, qword [rdi + rcx]
cmp byte [rdi + 0x19], bpl
je 0x140033f8d
mov qword [r14], r15
mov qword [r14 + 8], rsi
mov rax, r14
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140033fe0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r12, r8
mov r14, rdx
mov rbx, rcx
mov rsi, qword [rcx + 8]
mov rdi, qword [rsi + 8]
cmp byte [rdi + 0x19], 0
je 0x14003400a
mov r15, rsi
jmp 0x14003405b
mov r15, rsi
mov rax, qword [r12]
mov rcx, qword [rdi + 0x20]
mov r8, qword [rax]
mov rdx, qword [rcx]
mov rcx, rbx
call fcn.14002fea0
test al, al
je 0x14003402d
add rdi, 0x10
jmp 0x140034052
cmp byte [rsi + 0x19], 0
je 0x14003404f
mov rax, qword [rdi + 0x20]
mov rcx, qword [r12]
mov r8, qword [rax]
mov rdx, qword [rcx]
mov rcx, rbx
call fcn.14002fea0
test al, al
cmovne rsi, rdi
mov r15, rdi
mov rdi, qword [rdi]
cmp byte [rdi + 0x19], 0
je 0x14003400d
cmp byte [rsi + 0x19], 0
je 0x14003406b
mov rax, qword [rbx + 8]
add rax, 8
jmp 0x14003406e
mov rax, rsi
mov rdi, qword [rax]
cmp byte [rdi + 0x19], 0
jne 0x1400340ab
xor ebp, ebp
mov rax, qword [rdi + 0x20]
mov rcx, qword [r12]
mov r8, qword [rax]
mov rdx, qword [rcx]
mov rcx, rbx
call fcn.14002fea0
mov ecx, eax
xor cl, 1
movzx ecx, cl
shl rcx, 4
test al, al
cmovne rsi, rdi
mov rdi, qword [rdi + rcx]
cmp byte [rdi + 0x19], bpl
je 0x140034079
mov qword [r14], r15
mov qword [r14 + 8], rsi
mov rax, r14
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret