joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140580752
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x1405f4ce8]
test eax, eax
je 0x1405807ea
lea rax, [0x1405f4cc0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x1405f4cf0]
mov qword [rbp - 8], rax
jmp 0x1405807ce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x1405807c2
cmp qword [rbp - 0x10], 0
je 0x1405807c2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140580788
lea rax, [0x1405f4cc0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x1405807eb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x1405808f0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140580918
mov eax, 0
jmp 0x140580966
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140580941
mov eax, 0
jmp 0x140580966
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140580961
mov eax, 0
jmp 0x140580966
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x14058096c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x1405809ea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x1405809e1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x1405809e1
mov rax, qword [rbp - 8]
jmp 0x1405809ff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x1405809b4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140041a52
Capabilities:
Encode data using base64

Disassembly:
xor dword [rsp + rcx - 0x1cbf31a5], eax
lea rdx, [rsi + rcx*4 - 0x63d0174e]
push rcx
shr rdx, cl
mov rdi, qword [rsp + rbx*2 - 0x40d8]
movsxd rax, eax
call fcn.140071caa
not ebp
lea rax, [rdx + rdx*4 - 0x12d7b642]
movzx r10d, r8b
lea r10, [r8 + r10*4 + 0x14190918]
ror ebp, 2
cwde
xor ebp, 0xe8c9035
not ebp
btc r9, 0xb1
mov qword [rsp + r8*2 - 0xdfa251a], rdi
setb dl
jae 0x14007f909
mov qword [rsp + 0x38], 0xffffffffdc2a29a6
push 0xfffffffff82a0b86
mov r11, qword [rsp + 0x78]
push 0x5fb1e19f
push 0xffffffff850e1b8b
call fcn.14006f45b
xor ecx, 0xaf988011
shr word [rsp + rbp*2 - 0x55], 0x87
imul ax
bswap ecx
cwde
jae 0x14004bfd4
mov qword [rsp + r10 - 0x225c1ff0], rdi
sar r8w, 0xca
cbw
lea rax, [r8 - 0x705c6666]
xor dword [rsp + r10 - 0x225c1ff0], ecx
neg bp
bts r10d, 0x2b
pop rdi
btc rbp, r8
not r8d
movsxd rcx, ecx
sub bpl, dl
cbw
adc r11, rcx
dec r8b
movsx ecx, r8b
js fcn.14002c5af
and r8d, r8d
xor dword [rsp + r8 - 0x6fd128d], ebp
lea rdx, [r10 + 0x682dd68d]
cbw
pop rdi
movzx ecx, r10b
movsxd rbp, ebp
cwd
add r11, rbp
bts eax, ecx
lea rcx, [r10 + rdx*8 - 0x7e7a7277]
dec dx
mov rdx, qword [rbx + r8*2 - 0xdfa251a]
not r10d
xchg r8d, r10d
mov cl, byte [rbx + rax - 0x200fff1]
inc r8d
push r8
lea rbx, [rax + rbx - 0x200fff7]
jno 0x140037f2d
mov edx, 0x50bc09b9
movzx eax, dx
mov rax, qword [r8 + rax*2 - 0x1372]
movsx esi, dl
mov cl, byte [rdx + r8 - 0x50bc09b1]
mov r11d, edx
push rsi
movsx ebp, word [rsp + r11 - 0x50bc09b8]
lea r8, [r8 + rdx - 0x50bc09b7]
imul bp, bp
xor word [rsp + rdx - 0x50bc09b6], 0x8382
shl rax, cl
btr bp, 0x9b
movsx ecx, byte [rsp + rdx - 0x50bc09b7]
lea rbx, [r11 + rbp + 0x52a43596]
mov qword [r11 + r8 - 0x50bc09b9], rax
setb byte [rsp + rdx - 0x50bc09b4]
xadd byte [rsp + rdx - 0x50bc09b4], sil
lea r9, [rdx + r9 - 0x50bc09bd]
not byte [rsp + rdx - 0x50bc09b4]
mov esi, dword [rdx + r9 - 0x50bc09b9]
btr dx, r11w
xor esi, edi
xchg qword [rsp + rdx - 0x50bc09b9], rbx
movsx eax, bl
cbw
lea esi, [rsi + rdx*2 - 0x68dd4e55]
rol al, 0x63
xor rbx, 0x66890f34
call fcn.140065d84
Function at 0x140053276
Capabilities:
Encode data using base64

Disassembly:
xor eax, 0x88257008
not eax
mov qword [rsp + r11 - 0xffbb], rsi
neg word [rsp + r11*2 - 0x1ff75]
imul r11d, ebp
adc eax, edx
push rdx
movsx ebx, r11b
xchg dword [rsp + rdx*2 + 2], ebx
neg eax
mov qword [rsp + rdx*2 + 8], rdi
xor dword [rsp + rdx + 8], eax
mov rdi, qword [rsp + rdx*2 + 8]
movsxd rax, eax
sar r11b, 0xc2
jb 0x1400477bd
xor dword [rsp + rcx*4], r8d
sal r9w, 0xa4
xchg r10b, dl
pop rdi
movsxd r8, r8d
adc r11, r8
jmp r11

Function at 0x140054fb1
Capabilities:
Encode data using base64

Disassembly:
movzx ecx, r11b
rol ebp, 1
sub si, 0x3e8b
mov qword [rsp + rdx - 0x36ad3d20], rax
lea ebp, [rdx + rbp + 0x500406e1]
xor qword [rsp + rdx*2 - 0x6d5a7a40], rax
sal si, 0x81
xadd dword [rsp + rdx - 0x36ad3d16], edx
not ebp
setne al
mov qword [rsp + rdx + 8], rdi
ja 0x1400330c4

Function at 0x14006fec7
Capabilities:
Encode data using base64

Disassembly:
jg 0x14004388d
bswap eax
push rdi
mov edi, r8d
btr r8, 0x87
sub r8, rdi
xor dword [rsp + rdx - 0x6937a1ec], eax
not r9b
sub r10b, dil
dec r9
pop rdi
jp 0x140067d7c
mov edx, 0x530c0a3b
lea rsi, [rdx*2 + 0x42988206]
lea r9, [r9 + rdx - 0x530c0a3f]
mov ebx, edx
call fcn.140047a98
mov ecx, 0xb402cca0
mov r8, qword [rbx + riz]
mov edx, dword [rbx + riz + 8]
movzx r10d, cx
call fcn.14005a925
sub dx, dx
neg eax
shl rdx, cl
mov qword [rsp + rbp - 0x619fe7b7], rdi
mov edi, ecx
xor dword [rsp + rdx*2 + 8], eax
mov rdi, qword [rsp + rbp - 0x619fe7b7]
movsxd rax, eax
mov qword [rsp + rdx], rbp
sar cl, 0x21
add r10, rax
mov qword [rsp + rdx*4 + 8], rsi
jmp 0x14007ec68
mov r11, qword [r8 + rdx*2]
xor dword [rsp + rbp - 0x619fe7b5], 0x2fbad03d
jp 0x140067c0b
mov bx, word [rbp + r11 - 0x619fe7bf]
jnp 0x14005cf49
Function at 0x1400021d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140009740]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400021f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400021f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400021f0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000224d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002244
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400021f0
add rax, 0x28
cmp rax, r9
jne 0x140002230
xor eax, eax
ret

Function at 0x140002250
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140009740]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000226f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002278
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000226f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002310
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140009740]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000232f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002338
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140007b30
Capabilities:
Get session user name

Disassembly:
push rbx
mov ecx, 0xff
sub rsp, 0x30
call sub.msvcrt.dll_malloc
mov dword [rsp + 0x2c], 0xff
lea rdx, [rsp + 0x2c]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
add rsp, 0x30
mov rax, rbx
pop rbx
ret
Function at 0x140005910
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x1040
call fcn.140019490
sub rsp, rax
mov rax, qword [0x14009b080]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov rbp, qword [rsp + 0x1080]
mov rsi, r9
mov rbx, r8
mov rdi, rcx
test r8, r8
je 0x1400059cc
mov rdx, rbx
call fcn.140003560
test rax, rax
je 0x1400059cc
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov rdx, rax
mov rcx, rdi
call fcn.140003780
test eax, eax
je 0x1400059cc
movsxd rax, dword [rsp + 0x6c]
lea rcx, [rsp + 0x30]
add rcx, rax
xor r8d, r8d
movzx eax, word [rcx + 0x14]
lea r11, [rcx + 0x18]
movzx r9d, word [rcx + 6]
add r11, rax
test r9d, r9d
je 0x1400059cc
mov r10d, dword [str.PAGE]
lea rcx, [r8 + r8*4]
cmp dword [r11 + rcx*8], r10d
lea rdx, [r11 + rcx*8]
jne 0x1400059c4
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], 0
jne 0x1400059b5
cmp rax, 4
je 0x1400059f1
inc r8d
cmp r8d, r9d
jb 0x1400059a0
xor eax, eax
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.1400187d0
mov rbx, qword [rsp + 0x1068]
add rsp, 0x1040
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x1400059cc
mov r8d, dword [rdx + 8]
mov edx, eax
lea rax, [rsp + 0x30]
add rax, rdx
je 0x1400059cc
test r8d, r8d
je 0x1400059cc
add rdx, rbx
je 0x1400059cc
mov r9, rsi
mov qword [rsp + 0x20], rbp
mov rcx, rdi
call fcn.140004660
jmp 0x1400059ce
Function at 0x140007420
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x2e0], rbx
mov rax, qword [0x14009b080]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x68], rdx
xor edx, edx
mov r8d, 0x20a
lea rcx, [rbp - 0x70]
call fcn.14001ec00
lea rdx, [rbp - 0x70]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
xor esi, esi
cmp eax, 0x104
ja 0x1400074c7
lea rcx, [rbp - 0x70]
mov rax, 0xffffffffffffffff
lea rax, [rax + 1]
cmp word [rcx + rax*2], si
jne 0x140007496
cmp word [rbp + rax*2 - 0x72], 0x5c
jne 0x1400074c1
lea rax, [rax*2 - 2]
cmp rax, 0x20a
jae 0x140007680
mov word [rbp + rax - 0x70], si
lea rdx, [rbp - 0x70]
jmp 0x1400074ce
lea rdx, [0x14009392c]
lea rcx, [rsp + 0x70]
call fcn.140007890
nop
cmp qword [rbp - 0x80], 0
jne 0x140007539
lea rdx, [0x14009392c]
mov rcx, rdi
call fcn.140007890
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14000764f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000764a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000767a
jmp 0x14000764a
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140007300
mov rbx, rax
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.140009d50
nop
mov r8, rbx
mov rdx, rax
mov rcx, rdi
call fcn.14000ba80
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400075aa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400075a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007686
call fcn.1400187f4
movdqa xmm0, xmmword [0x1400946f0]
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x20], si
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400075ff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400075fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000768c
call fcn.1400187f4
movdqa xmm0, xmmword [0x1400946f0]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], si
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x14000764f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000764a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007674
call fcn.1400187f4
mov rax, rdi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.1400187d0
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2b0
pop rdi
pop rsi
pop rbp
ret
call fcn.140023b54
int3
call fcn.140023b54
int3
call fcn.140018f70
nop
call fcn.140023b54
nop
call fcn.140023b54
int3
Function at 0x140007f40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
je 0x140007fda
mov rbx, r8
test r8, r8
jle 0x140007fd2
mov rcx, rdi
call fcn.140009610
test rax, rax
jle 0x140007fb0
mov rcx, qword [rdi + 0x40]
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov r8, rsi
mov rcx, qword [rcx]
call fcn.14001e7a0
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x140007fca
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140007fd2
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x140007f72
sub r14, rbx
mov rax, r14
jmp 0x140008051
mov rax, qword [rcx + 0x40]
mov rsi, r14
mov r9, qword [rax]
test r9, r9
je 0x140007ff1
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140007ff3
xor ecx, ecx
movsxd rbx, ecx
test r14, r14
jle 0x14000804b
test ecx, ecx
jle 0x140008027
cmp r14, rbx
mov rcx, r9
cmovl rbx, r14
mov r8, rbx
call fcn.14001e7a0
mov rax, qword [rdi + 0x58]
add rbp, rbx
sub r14, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x40]
movsxd rax, ebx
add qword [rcx], rax
test r14, r14
jle 0x14000804b
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000804b
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.140022e78
sub r14, rax
sub rsi, r14
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140008070
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rsi, rdx
mov rbx, rcx
je 0x14000810b
mov rdi, r8
test r8, r8
jle 0x140008100
mov rcx, rbx
call fcn.140009630
test rax, rax
jle 0x1400080e0
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.14001e7a0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400080f8
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140008100
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1400080a2
sub r14, rdi
mov rax, r14
jmp 0x1400081ba
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140008122
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140008124
xor ecx, ecx
movsxd rdi, ecx
test r14, r14
jle 0x1400081b4
test ecx, ecx
jle 0x14000815c
cmp r14, rdi
mov rcx, rsi
cmovl rdi, r14
mov r8, rdi
call fcn.14001e7a0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub r14, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
test r14, r14
jle 0x1400081b4
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x1400081b4
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400081a1
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov r9, qword [rbx + 0x80]
mov r8, r14
mov edx, 1
mov rcx, rsi
call fcn.140023640
sub r14, rax
sub rbp, r14
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140008630
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14009b080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000865d
xor eax, eax
jmp 0x1400087a3
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140008697
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140008697
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400087a3
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140008796
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400086da
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400086e9
movsx ecx, dil
jmp 0x14000873d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x140008796
cmp eax, 1
jle 0x140008757
cmp eax, 3
jne 0x140008796
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.140020c38
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000879b
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140008784
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.140022e78
cmp rsi, rax
jne 0x140008796
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14000879b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400187d0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14000b910
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, rdx
mov qword [rsp + 0x28], rcx
mov rdi, rcx
call fcn.1400157c0
lea r15, [rdi + 0x40]
mov rcx, r15
mov qword [rsp + 0x30], r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r13, qword [rsi + 0x18]
mov r8, rsi
mov r14, qword [rsi + 0x10]
cmp r13, 0x10
jb 0x14000b95a
mov r8, qword [rsi]
xor ebp, ebp
movabs rdx, 0xcbf29ce484222325
mov ecx, ebp
test r14, r14
je 0x14000b994
movabs r9, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + r8]
inc rcx
xor rdx, rax
imul rdx, r9
cmp rcx, r14
jb 0x14000b980
mov rax, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x30]
mov rdi, qword [rdi + 8]
and rcx, rdx
shl rcx, 4
mov r12, qword [rcx + rax]
add rax, 8
add rax, rcx
mov rbx, r12
mov qword [rsp + 0x20], rax
nop word [rax + rax]
cmp r12, rdi
jne 0x14000b9ca
mov rax, rdi
jmp 0x14000b9d0
mov rax, qword [rax]
mov rax, qword [rax]
cmp rbx, rax
je 0x14000ba46
lea rcx, [rbx + 0x10]
mov rdx, rsi
cmp r13, 0x10
jb 0x14000b9e5
mov rdx, qword [rsi]
mov r15, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
cmp r15, 0x10
jb 0x14000b9f6
mov rcx, qword [rcx]
cmp rbp, r14
jne 0x14000ba07
mov r8, rbp
call fcn.14001ee40
test eax, eax
je 0x14000ba11
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x20]
jmp 0x14000b9c0
lea rdx, [rbx + 0x10]
cmp r15, 0x10
jb 0x14000ba1e
mov rdx, qword [rdx]
cmp r13, 0x10
jb 0x14000ba27
mov rsi, qword [rsi]
cmp r14, rbp
jne 0x14000ba46
mov r8, r14
mov rcx, rsi
call fcn.14001ee40
test eax, eax
jne 0x14000ba46
mov rdi, qword [rsp + 0x28]
mov rdi, qword [rdi + 8]
jmp 0x14000ba49
mov rbx, rdi
cmp rbx, rdi
je 0x14000ba54
mov rbp, qword [rbx + 0x30]
jmp 0x14000ba56
xor ebp, ebp
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x90]
mov rax, rbp
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400143e0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x40
mov rdi, rcx
mov qword [rsp + 0x60], rbx
movzx ecx, byte [rdx]
mov r9, rdx
movabs rdx, 0x100000001b3
mov qword [rsp + 0x68], rsi
movabs rax, 0xcbf29ce484222325
mov r8, qword [rdi + 0x30]
xor rcx, rax
movzx eax, byte [r9 + 1]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [r9 + 2]
imul rcx, rdx
xor rcx, rax
movzx eax, byte [r9 + 3]
imul rcx, rdx
xor rcx, rax
imul rcx, rdx
mov rdx, qword [rdi + 8]
and r8, rcx
mov rcx, qword [rdi + 0x18]
add r8, r8
mov r10, qword [rcx + r8*8]
lea r11, [rcx + r8*8]
mov rax, r10
cmp r10, rdx
jne 0x14001445f
mov rcx, rdx
jmp 0x140014466
mov rcx, qword [r11 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x14001447d
mov ecx, dword [r9]
cmp dword [rax + 0x10], ecx
je 0x140014478
mov rax, qword [rax]
jmp 0x140014455
cmp rax, rdx
jne 0x1400144e3
mov rbx, qword [rdx]
lea rax, [rsp + 0x30]
mov rdx, rbx
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x20], rax
mov rsi, qword [rbx + 8]
mov r8, rsi
call fcn.140014d50
mov rdx, rax
movabs rcx, 0x666666666666665
mov rax, qword [rdi + 0x10]
sub rcx, rax
cmp rcx, 1
jb 0x1400144f7
inc rax
mov rcx, rdi
mov qword [rdi + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rsi], rdx
lea rdx, [rsp + 0x30]
mov r9, qword [rdi + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.140014b20
mov rax, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x68]
add rax, 0x14
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
lea rcx, str.list_T__too_long
call fcn.140017730
int3
Function at 0x140014950
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x138
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x1400149c2
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
nop dword [rax]
nop word [rax + rax]
mov edx, dword [r8 - 8]
xor edx, dword [r8]
lea r8, [r8 + 8]
btr edx, 0x1f
xor rdx, qword [r8 - 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x140014980
mov ecx, dword [r10]
jmp 0x140014ac3
cmp ecx, 0x270
jb 0x140014ac3
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
mov rdx, rax
lea r8, [rbx + 8]
xor rdx, qword [r8]
btr edx, 0x1f
xor rdx, rax
movzx eax, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx + 0x4e0]
xor rcx, rdx
mov qword [rbx - 0x9c0], rcx
lea rbx, [r8]
sub rdi, 1
jne 0x1400149f0
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov rax, qword [rbx]
nop dword [rax]
mov rdx, rax
lea r8, [rbx + 8]
xor rdx, qword [r8]
btr edx, 0x1f
xor rdx, rax
movzx eax, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx - 0xea0]
xor rcx, rdx
mov qword [rbx - 0x9c0], rcx
lea rbx, [r8]
sub rdi, 1
jne 0x140014a40
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 8]
mov rdi, qword [rsp]
btr edx, 0x1f
xor rdx, qword [r10 + 0x1380]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret