joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400876a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1402e8018]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1402f0ba8]
mov edi, ecx
cmp byte [rbx + 0x42cd], 0
jne 0x140087701
cmp byte [rbx + 0x42ce], 0
jne 0x140087701
movsx r9d, word [rbx + 0x53b2]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.14007ab00
test dil, 1
je 0x140087828
jmp 0x14008778a
movss xmm1, dword [rbx + 0x38b0]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x53b2]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1402b861c]
mulss xmm1, dword [0x1402b85f0]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xd94]
addss xmm1, dword [rbx + 0xd98]
mov qword [rbx + 0x4048], rax
mov dword [rbx + 0x4034], 1
movss dword [rbx + 0x4040], xmm0
movss dword [rbx + 0x4044], xmm1
movss xmm0, dword [rbx + 0x390c]
mulss xmm0, dword [0x1402b81e8]
or dword [rbx + 0x4030], 0x41
movss dword [rbx + 0x4090], xmm0
call fcn.14007ab00
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x1400877e0
lea r11, [0x1402a56c0]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x1400877c3
cmp byte [r8], r9b
jne 0x1400877c3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400877b0
not ecx
call fcn.140081080
test rax, rax
je 0x140087828
cmp byte [rax + 0x96], 0
je 0x140087828
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x53b2]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x53b2]
call fcn.14007ab00
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.1400837b0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140220090
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x14008c3d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5460], 0
lea rbx, [rcx + 0x5468]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14008c477
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14008c42a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14008e2c0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.14007b1c0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5460]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5470]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1402f0b19]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14008c47f
mov rcx, rbx
call fcn.14007b1c0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14008c9f0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1402f0ba8]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14008ca53
mov qword [rsp], rbx
lea rbx, [0x1402a56c0]
nop dword [rax]
cmp r9b, 0x23
jne 0x14008ca33
cmp byte [r8], r9b
jne 0x14008ca33
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14008ca20
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5410]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x14008ca87
mov r10, qword [r10 + 0x5418]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14008ca8e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x14008ca74
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x1400ab450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x1400ab484
cmp ecx, r10d
jge 0x1400ab472
mov rcx, rbx
call fcn.1400aac50
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x1400ab4be
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x14], ecx
movzx r9d, cl
test eax, eax
jg 0x1400ab4a0
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x1400ab4e6
mov rax, qword gs:[0x58]
mov edx, Ordinal_41
mov rcx, qword [rax]
lea rax, str.zlib_corrupt
mov qword [rdx + rcx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x1400ab515
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r8
jb 0x1400ab4ff
xor dl, dl
jmp 0x1400ab508
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x1400ab4f6
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x1400ab4c2
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x1400ab57f
mov rax, qword gs:[0x58]
mov edx, Ordinal_41
mov rcx, qword [rax]
lea rax, str.read_past_buffer
mov qword [rdx + rcx], rax
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x1400ab599
mov rcx, rbx
call fcn.1400aada0
test eax, eax
je 0x1400ab572
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x1400bdc00
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rsi, rcx
mov ecx, 0x24
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov rbx, qword [rsi + 0x50]
cmp rbx, qword [rsi + 0x58]
je 0x1400bdcb6
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r15
lea r15, [rbx + 0x2d0]
nop word [rax + rax]
mov rdx, rbx
mov rcx, rsi
call fcn.1400beb80
test al, al
jne 0x1400bdc93
mov rbp, qword [rsi + 0x58]
mov rdi, r15
cmp r15, rbp
je 0x1400bdc79
mov r14, rbx
sub r14, r15
lea rcx, [r14 + rdi]
mov rdx, rdi
call fcn.1400c22e0
add rdi, 0x2d0
cmp rdi, rbp
jne 0x1400bdc61
mov rcx, qword [rsi + 0x58]
sub rcx, 0x2d0
call fcn.1400c0e70
add qword [rsi + 0x58], 0xfffffffffffffd30
jmp 0x1400bdca1
add rbx, 0x2d0
add r15, 0x2d0
cmp rbx, qword [rsi + 0x58]
jne 0x1400bdc40
mov r15, qword [rsp + 0x68]
mov r14, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
cmp byte [rsi + 0x6c], 0
je 0x1400bdd6e
movss xmm0, dword [rsi + 0x70]
ucomiss xmm0, dword [0x1402f1148]
jp 0x1400bdcf0
jne 0x1400bdcf0
movss xmm0, dword [rsi + 0x74]
ucomiss xmm0, dword [0x1402f114c]
jp 0x1400bdcf0
jne 0x1400bdcf0
movss xmm0, dword [rsi + 0x78]
ucomiss xmm0, dword [0x1402f1150]
jp 0x1400bdcf0
je 0x1400bdd6e
mov rax, qword [rsi + 0xb0]
cmp byte [rax + 0x2b2], 0
je 0x1400bdd6e
cmp byte [0x1402f0ad9], 0
jne 0x1400bdde5
cmp byte [0x1402f0ad8], 0
jne 0x1400bdde5
call fcn.140139a10
mov dl, 1
mov rcx, rax
call fcn.1400b9b70
call fcn.140139ee0
mov ecx, dword [rsi + 0x78]
lea rdx, [rsp + 0x20]
movsd xmm0, qword [rsi + 0x70]
mov dword [rsp + 0x28], ecx
mov rcx, rax
movsd qword [rsp + 0x20], xmm0
call fcn.140069490
call fcn.140139a10
xor edx, edx
mov rcx, rax
call fcn.1400b9b70
mov rax, qword [0x1402f0c20]
mov word [rax + 0x198], 0
jmp 0x1400bdd90
cmp byte [0x1402f0ad9], 0
jne 0x1400bdde5
cmp byte [0x1402f0ad8], 0
jne 0x1400bdde5
mov rax, qword [0x1402f0c20]
mov word [rax + 0x198], 0x101
mov rcx, rsi
call fcn.1400bf530
mov rdi, qword [rsi + 0x58]
mov rbx, qword [rsi + 0x50]
cmp rbx, rdi
je 0x1400bdde5
nop word [rax + rax]
mov rdx, qword [0x1402f0cc0]
lea rcx, [rbx + 0x228]
add rdx, 8
call fcn.1400b9ca0
test al, al
jne 0x1400bddd9
cmp byte [rbx + 0x2c9], al
je 0x1400bddd9
mov byte [rbx + 0x2c8], al
add rbx, 0x2d0
cmp rbx, rdi
jne 0x1400bddb0
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400c9bf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rcx, qword [0x1402f0cc0]
mov rbx, rdx
movsxd rax, dword [rcx + 0x3e8]
cmp eax, 1
jge 0x1400c9c2a
xorps xmm0, xmm0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
movss xmm0, dword [rcx + 0x70]
cvtps2pd xmm0, xmm0
mov dword [rbp - 0x60], 0x43af0000
mov dword [rbp - 0x5c], 0x43fa0000
mov dword [rbp - 0x58], 0x44228000
movss xmm1, dword [rbp + rax*4 - 0x64]
addss xmm1, dword [rcx + 0x60]
mulsd xmm0, qword [0x1402b8330]
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm7
cvtps2pd xmm2, xmm1
addsd xmm2, xmm0
cvtpd2ps xmm2, xmm2
call fcn.14006ab70
mov edx, 0xe00c22e0
mov dword [rbp - 0x60], 0x65727a65
lea rcx, [rbp - 0x5f]
mov dword [rbp - 0x5c], 0x61776c61
movaps xmm7, xmm0
mov dword [rbp - 0x58], 0x63617474
xorps xmm6, xmm6
mov word [rbp - 0x54], 0x68
mov byte [rbp - 0x52], 0
call fcn.140033860
mov rcx, qword [rbx + 0x180]
mov rdx, qword [rbx + 0x188]
cmp rcx, rdx
je 0x1400c9d3e
nop
cmp dword [rcx + 0x30], eax
je 0x1400c9cd0
add rcx, 0x50
cmp rcx, rdx
jne 0x1400c9cc0
jmp 0x1400c9d3e
mov rcx, qword [0x1402f0cc0]
movsxd rax, dword [rcx + 0x318]
cmp eax, 1
jl 0x1400c9d3e
movaps xmm1, xmmword [0x1402b97b0]
mov rdx, rbx
movaps xmm0, xmmword [0x1402b9890]
movups xmmword [rbp - 0x38], xmm0
mov dword [rbp - 0x40], 0x42b40000
movups xmmword [rbp - 0x50], xmm1
mov dword [rbp - 0x28], 0x43960000
movss xmm0, dword [rbp + rax*4 - 0x54]
mulss xmm0, dword [rcx + 0x70]
addss xmm0, dword [rbp + rax*4 - 0x3c]
cvtps2pd xmm1, xmm0
movss xmm0, dword [rcx + 0x60]
cvtps2pd xmm0, xmm0
mulsd xmm0, qword [0x1402b82f8]
addsd xmm1, xmm0
cvtpd2ps xmm2, xmm1
call fcn.14006ab70
movaps xmm6, xmm0
mov rbx, qword [rsp + 0x90]
addss xmm6, xmm7
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rbp
ret
Function at 0x1400e0250
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov eax, dword [r8 + 0x90]
mov rbp, r8
mov r15, rdx
test eax, eax
je 0x1400e02b3
movzx ecx, word [r8 + 0x14]
xor r9d, r9d
add rcx, 0x18
mov r10d, eax
add rcx, r8
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x1400e02b3
mov edx, dword [rcx + 0xc]
cmp r10, rdx
jb 0x1400e02a7
mov eax, dword [rcx + 8]
add eax, edx
cmp r10, rax
jb 0x1400e02ce
inc r9d
add rcx, 0x28
cmp r9d, r8d
jl 0x1400e0295
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov r8d, dword [rcx + 0x14]
sub r8, rdx
add r8, r10
add r8, r15
je 0x1400e02b3
cmp dword [r8 + 0x10], 0
lea r14, [r8 + 0x10]
je 0x1400e02b3
nop dword [rax + rax]
movzx edx, word [rbp + 0x14]
xor r8d, r8d
movzx r11d, word [rbp + 6]
add rdx, 0x18
mov r10d, dword [r14 - 4]
add rdx, rbp
mov rcx, rdx
test r11d, r11d
je 0x1400e02b3
nop
mov r9d, dword [rcx + 0xc]
cmp r10, r9
jb 0x1400e0324
mov eax, dword [rcx + 8]
add eax, r9d
cmp r10, rax
jb 0x1400e0332
inc r8d
add rcx, 0x28
cmp r8d, r11d
jl 0x1400e0310
jmp 0x1400e02b3
mov esi, dword [rcx + 0x14]
sub rsi, r9
add rsi, r10
add rsi, r15
je 0x1400e02b3
mov r9d, dword [r14]
xor ecx, ecx
nop dword [rax]
mov r8d, dword [rdx + 0xc]
cmp r9, r8
jb 0x1400e0368
mov eax, dword [rdx + 8]
add eax, r8d
cmp r9, rax
jb 0x1400e03f5
inc ecx
add rdx, 0x28
cmp ecx, r11d
jl 0x1400e0350
xor edi, edi
mov r9, qword [rdi]
test r9, r9
je 0x1400e03e2
nop dword [rax]
movzx eax, word [rbp + 0x14]
xor edx, edx
movzx r10d, word [rbp + 6]
add rax, 0x18
add rax, rbp
test r10d, r10d
je 0x1400e03b6
mov r8d, dword [rax + 0xc]
cmp r9, r8
jb 0x1400e03ab
mov ecx, dword [rax + 8]
add ecx, r8d
cmp r9, rcx
jb 0x1400e0406
inc edx
add rax, 0x28
cmp edx, r10d
jl 0x1400e0397
xor ebx, ebx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x1400e0414
lea rdx, [rbx + 2]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rdi], rax
add rdi, 8
mov r9, qword [rdi]
test r9, r9
jne 0x1400e0380
add r14, 0x14
cmp dword [r14], 0
jne 0x1400e02f0
jmp 0x1400e02b3
mov edi, dword [rdx + 0x14]
sub rdi, r8
add rdi, r9
add rdi, r15
jmp 0x1400e0375
mov ebx, dword [rax + 0x14]
sub rbx, r8
add rbx, r9
add rbx, r15
jmp 0x1400e03b8
jmp 0x1400e02b5
Function at 0x1400e0420
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rdi
push r14
push r15
mov eax, dword [r8 + 0xb0]
mov r14, r9
mov rdi, r8
mov r15, rdx
test eax, eax
je 0x1400e0475
movzx ecx, word [r8 + 0x14]
xor r9d, r9d
add rcx, 0x18
mov r10d, eax
add rcx, r8
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x1400e0475
mov edx, dword [rcx + 0xc]
cmp r10, rdx
jb 0x1400e0469
mov eax, dword [rcx + 8]
add eax, edx
cmp r10, rax
jb 0x1400e047e
inc r9d
add rcx, 0x28
cmp r9d, r8d
jl 0x1400e0457
xor al, al
pop r15
pop r14
pop rdi
pop rsi
ret
mov esi, dword [rcx + 0x14]
mov rax, rdx
sub rsi, rdx
add rsi, r10
add rsi, r15
je 0x1400e0475
mov qword [rsp + 0x30], rbp
xor ebp, ebp
cmp dword [rdi + 0xb4], ebp
jbe 0x1400e0570
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x38], r12
mov r12d, 0xf000
mov qword [rsp + 0x40], r13
mov r13d, 0xa000
nop dword [rax]
mov ebx, dword [rsi + 4]
lea r10, [rsi + 8]
movzx eax, word [rdi + 0x14]
sub rbx, 8
movzx r9d, word [rdi + 6]
add rax, 0x18
mov r11d, dword [rsi]
add rax, rdi
shr rbx, 1
xor edx, edx
test r9d, r9d
je 0x1400e050f
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp r11, r8
jb 0x1400e0504
mov ecx, dword [rax + 8]
add ecx, r8d
cmp r11, rcx
jb 0x1400e057c
inc edx
add rax, 0x28
cmp edx, r9d
jl 0x1400e04f0
xor r9d, r9d
xor ecx, ecx
test rbx, rbx
je 0x1400e054f
nop dword [rax]
movzx eax, word [r10]
movzx edx, ax
and ax, r12w
cmp ax, r13w
jne 0x1400e0542
and edx, 0xfff
mov rax, r14
sub rax, qword [rdi + 0x30]
add qword [rdx + r9], rax
inc ecx
add r10, 2
mov eax, ecx
cmp rax, rbx
jb 0x1400e0520
add ebp, dword [rsi + 4]
mov rsi, r10
cmp ebp, dword [rdi + 0xb4]
jb 0x1400e04c0
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
pop r15
pop r14
pop rdi
pop rsi
ret
mov r9d, dword [rax + 0x14]
sub r9, r8
add r9, r11
add r9, r15
jmp 0x1400e0512
Function at 0x14010aed0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1402e8018]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r15, rcx
mov qword [rsp + 0x58], rdx
lea rdi, [rdx + 0x10]
mov rcx, rdi
mov rsi, qword [rdi + 0x18]
cmp rsi, 0x10
jb 0x14010af0b
mov rcx, qword [rdi]
mov rbx, qword [rdi + 0x10]
mov qword [rsp + 0x20], 8
lea r9, str.Kindred_
xor r8d, r8d
mov rdx, rbx
call fcn.140078c30
cmp rax, 0xffffffffffffffff
je 0x14010b0a8
mov rcx, rdi
cmp rsi, 0x10
jb 0x14010af40
mov rcx, qword [rdi]
mov qword [rsp + 0x20], 9
lea r9, str._E_stack_
xor r8d, r8d
mov rdx, rbx
call fcn.140078c30
cmp rax, 0xffffffffffffffff
je 0x14010b0a8
mov rdx, rdi
cmp rsi, 0x10
jb 0x14010af71
mov rdx, qword [rdi]
mov r8, 0xffffffffffffffff
test rbx, rbx
je 0x14010afa5
lea rax, [rbx - 1]
mov rcx, r8
cmp rax, r8
cmovb rcx, rax
add rcx, rdx
cmp byte [rcx], 0x5f
je 0x14010afa0
cmp rcx, rdx
je 0x14010afa5
dec rcx
cmp byte [rcx], 0x5f
jne 0x14010af93
sub rcx, rdx
jmp 0x14010afa8
mov rcx, r8
inc rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
cmp rbx, rcx
jb 0x14010b0d1
sub rbx, rcx
cmp rbx, r8
cmovb r8, rbx
mov rax, rdi
cmp rsi, 0x10
jb 0x14010afdb
mov rax, qword [rdi]
lea rdx, [rcx + rax]
lea rcx, [rsp + 0x38]
call fcn.140034050
nop
mov r8d, 0xa
lea rcx, [rsp + 0x38]
call fcn.14010c410
mov r14d, eax
lea rcx, [rsp + 0x38]
call fcn.1400341f0
call fcn.140139aa0
mov rbx, qword [rax]
mov rbp, qword [rax + 8]
cmp rbx, rbp
je 0x14010b0a8
mov rsi, qword [0x1402f0cc0]
mov eax, dword [rsi + 0x1c]
cmp dword [rbx + 0x1c], eax
je 0x14010b08e
cmp byte [rbx + 0xa7], 0
je 0x14010b08e
movdqa xmm0, xmmword [str.kindredecharge]
movdqu xmmword [rsp + 0x58], xmm0
movd eax, xmm0
test al, al
jne 0x14010b051
mov eax, 0x811c9dc5
jmp 0x14010b069
movzx eax, al
xor eax, 0x811c9dc5
imul edx, eax, 0x1000193
lea rcx, [rsp + 0x59]
call fcn.140033860
mov rcx, qword [rbx + 0x180]
mov rdx, qword [rbx + 0x188]
cmp rcx, rdx
je 0x14010b08e
nop dword [rax]
cmp dword [rcx + 0x30], eax
je 0x14010b09c
add rcx, 0x50
cmp rcx, rdx
jne 0x14010b080
add rbx, 0x5f0
cmp rbx, rbp
je 0x14010b0a8
jmp 0x14010b023
lea eax, [r14 - 1]
mov dword [r15 + 0x10], eax
mov qword [r15 + 8], rbx
mov rcx, rdi
call fcn.1400341f0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140220090
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140040340
nop
int3
Function at 0x14011b050
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, qword [rcx + 0x98]
mov rdi, rcx
mov rsi, qword [rcx + 0xa0]
cmp rbx, rsi
je 0x14011b11c
mov qword [rax + 0x10], rbp
movabs rbp, 0x2ffd433a0694ed8
mov qword [rax + 0x18], r14
movabs r14, 0xa2d93f50727d96c
mov qword [rax + 0x20], r15
movabs r15, 0xa2df8966e73b723
nop
mov qword [rsp + 0x20], r14
lea r8, [rsp + 0x30]
mov rax, qword [rsp + 0x20]
mov rcx, rdi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rbp
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], r15
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rbp
mov rax, qword [rsp + 0x20]
movdqa xmm0, xmmword [rsp + 0x30]
mov rdx, qword [rbx]
mov qword [rsp + 0x48], rax
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.140128790
add rbx, 8
cmp rbx, rsi
jne 0x14011b0a0
mov r15, qword [rsp + 0x88]
mov r14, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14011b130
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rbx, qword [rcx + 0x98]
mov rdi, rcx
mov rsi, qword [rcx + 0xa0]
cmp rbx, rsi
je 0x14011b1fc
mov qword [rax + 0x10], rbp
movabs rbp, 0x2ffd433a0694ed8
mov qword [rax + 0x18], r14
movabs r14, 0xa2d8ff71c37d96c
mov qword [rax + 0x20], r15
movabs r15, 0xa2df8966e73b723
nop
mov qword [rsp + 0x20], r14
lea r8, [rsp + 0x30]
mov rax, qword [rsp + 0x20]
mov rcx, rdi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rbp
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], r15
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x20], rbp
mov rax, qword [rsp + 0x20]
movdqa xmm0, xmmword [rsp + 0x30]
mov rdx, qword [rbx]
mov qword [rsp + 0x48], rax
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.140128790
add rbx, 8
cmp rbx, rsi
jne 0x14011b180
mov r15, qword [rsp + 0x88]
mov r14, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14013bc90
Capabilities:
Execute command
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 0x28]
call fcn.140220300
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14013bcb8
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdx, rdi
call fcn.14003f200
lea rdx, [0x14003f3d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
movabs rcx, 0x2ffd433a0694ed8
movabs rax, 0xa2df8f31d06d653
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
movabs rax, 0xa2df8966e73b723
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x20]
movdqa xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x48], rax
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140158600
Capabilities:
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x90
movaps xmmword [r11 - 0x18], xmm6
mov rax, qword [0x1402e8018]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rdx
mov rsi, rcx
mov qword [r11 - 0x68], rdx
mov rax, qword [rdx]
mov r8d, dword [rax + 0x18]
mov dword [r11 - 0x60], r8d
mov eax, r8d
shr eax, 8
movzx edx, al
movzx eax, r8b
movabs rcx, 0xcbf29ce484222325
xor rax, rcx
movabs r9, 0x100000001b3
imul rax, r9
xor rdx, rax
imul rdx, r9
mov eax, r8d
shr eax, 0x10
movzx ecx, al
xor rdx, rcx
imul rdx, r9
mov eax, r8d
shr rax, 0x18
xor rdx, rax
imul rdx, r9
mov rcx, qword [rsi + 0x38]
and rcx, rdx
add rcx, rcx
mov r9, qword [rsi + 0x20]
mov rax, qword [r9 + rcx*8 + 8]
mov rdx, qword [rsi + 0x10]
cmp rax, rdx
je 0x1401586c1
mov rcx, qword [r9 + rcx*8]
cmp r8d, dword [rax + 0x10]
je 0x1401586c3
nop
cmp rax, rcx
je 0x1401586c1
mov rax, qword [rax + 8]
cmp r8d, dword [rax + 0x10]
jne 0x1401586b0
jmp 0x1401586c3
xor eax, eax
test rax, rax
cmove rax, rdx
cmp rax, rdx
je 0x140158839
movss xmm6, dword [0x1402f0ad4]
add rsi, 8
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140158c50
mov rcx, qword [rax]
movss dword [rcx + 0x20], xmm6
movzx ebx, byte [rdi + 0x2c]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140158c50
mov rcx, qword [rax]
mov byte [rcx + 0x30], bl
cmp byte [rdi + 0x2c], 0
je 0x1401587aa
movsd xmm6, qword [rdi + 8]
mov ebx, dword [rdi + 0x10]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140158c50
mov rcx, qword [rax]
movsd qword [rcx + 0x34], xmm6
mov dword [rcx + 0x3c], ebx
movsd xmm6, qword [rdi + 0x14]
mov ebx, dword [rdi + 0x1c]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140158c50
mov rcx, qword [rax]
movsd qword [rcx + 0x40], xmm6
mov dword [rcx + 0x48], ebx
movss xmm6, dword [rdi + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140158c50
mov rcx, qword [rax]
movss dword [rcx + 0x50], xmm6
movss xmm6, dword [0x1402f0ad4]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140158c50
mov rcx, qword [rax]
movss dword [rcx + 0x4c], xmm6
movsd xmm0, qword [rdi + 0x14]
movsd qword [rsp + 0x40], xmm0
mov eax, dword [rdi + 0x1c]
mov dword [rsp + 0x48], eax
movss xmm0, dword [rdi + 0x28]
cvtps2pd xmm0, xmm0
movss xmm1, dword [rdi + 0x20]
cvtps2pd xmm1, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_atan2
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
cvtps2pd xmm2, xmm1
mulsd xmm2, qword [0x1402b84f8]
cvtpd2ps xmm0, xmm2
movss dword [rsp + 0x4c], xmm0
movss xmm1, dword [0x1402f0ad4]
movss dword [rsp + 0x50], xmm1
lea rdx, [rdi + 0x48]
lea rcx, [rsp + 0x58]
call fcn.14005c350
nop
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140158c50
mov rcx, qword [rax]
lea rdx, [rsp + 0x40]
mov rcx, qword [rcx + 0x28]
call fcn.140158a70
nop
lea rcx, [rsp + 0x58]
call fcn.140032370
nop
lea rcx, [rdi + 0x48]
call fcn.140032370
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140220090
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rdi
ret