joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400830d0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x140083101
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x1417320d8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1417320e8]
lea rdx, [rdi + rdi]
call fcn.14007f110
mov rax, qword [0x1417320d8]
lea r9, [rdi - 1]
mov qword [0x141732100], r9
mov qword [0x141732108], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1400832a2
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x14]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x15]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x16]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x17]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x1417320e8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1400831ec
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140083263
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x140083229
mov r10, qword [rdx]
cmp r10, rax
je 0x140083223
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140083263
cmp r9, rdx
je 0x14008323f
nop
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x140083277
cmp r9, rdx
jne 0x140083230
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x14008329d
mov r9, qword [0x141732100]
jmp 0x140083171
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140083263
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14009dc30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x10]
mov rbx, rcx
mov r10d, edx
mov ecx, edx
and r10d, 7
je 0x14009dc96
mov r8d, dword [rbx + 0x14]
cmp edx, r10d
jge 0x14009dc84
mov r9, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r9
jb 0x14009dc60
xor cl, cl
jmp 0x14009dc69
movzx ecx, byte [rax]
inc rax
mov qword [rbx], rax
movzx eax, cl
mov ecx, edx
shl eax, cl
add edx, 8
or eax, r8d
mov dword [rbx + 0x10], edx
mov dword [rbx + 0x14], eax
mov r8d, eax
cmp edx, 0x18
jle 0x14009dc54
mov ecx, r10d
shr r8d, cl
sub edx, r10d
mov dword [rbx + 0x14], r8d
mov dword [rbx + 0x10], edx
mov ecx, edx
xor r9d, r9d
test edx, edx
jle 0x14009dcce
mov edx, dword [rbx + 0x14]
lea r8, [rsp + 0x30]
nop word [rax + rax]
movzx eax, byte [rbx + 0x14]
inc r9d
shr edx, 8
sub ecx, 8
mov byte [r8], al
lea r8, [r8 + 1]
mov dword [rbx + 0x14], edx
test ecx, ecx
jg 0x14009dcb0
mov dword [rbx + 0x10], ecx
movsxd rcx, r9d
cmp rcx, 4
jge 0x14009dd02
mov r8, qword [rbx + 8]
nop dword [rax + rax]
mov rax, qword [rbx]
cmp rax, r8
jb 0x14009dcec
xor dl, dl
jmp 0x14009dcf5
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x14009dce0
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov qword [rsp + 0x38], rdi
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x14009dd83
mov rcx, qword [rbx]
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
ja 0x14009dd83
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x14009dd5d
mov rcx, rbx
call fcn.1400a29f0
test eax, eax
je 0x14009dd91
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
lea rax, str.Corrupt_PNG
mov qword [0x1402c30e0], rax
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1400a33b0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
jmp 0x1400a7350
push rbx
sub rsp, 0x50
mov rax, qword [0x14013a700]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1400a73aa
lea rdx, str.Failed_to_open_the_Win32_clipboard.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000dbb0
mov rcx, rax
lea rdx, [0x14007f3d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400b2990
add rsp, 0x50
pop rbx
ret
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x1400a73bd
lea rdx, str.Failed_to_empty_the_Win32_clipboard.
jmp 0x1400a737b
mov qword [rsp + 0x68], rsi
mov rcx, rbx
mov qword [rsp + 0x70], rdi
call fcn.1400b0e90
mov ecx, 2
lea rsi, [rax*2 + 2]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x1400a747e
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400b1630
mov rbx, rax
cmp qword [rax + 0x18], 8
jb 0x1400a740b
mov rbx, qword [rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400a7467
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a7462
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a7462
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b2e24
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400b2990
add rsp, 0x50
pop rbx
ret
Function at 0x1400a3410
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x1400a7530
sub rsp, 0x28
test ecx, ecx
je 0x1400a75c3
sub ecx, 1
je 0x1400a75a1
sub ecx, 1
je 0x1400a758c
sub ecx, 1
je 0x1400a7577
cmp ecx, 1
je 0x1400a7562
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
mov ecx, 6
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
mov ecx, 5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
mov ecx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
mov ecx, 0x17
call qword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb ecx, ecx
add ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
mov ecx, 0x17
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
test eax, eax
setne cl
inc ecx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
Function at 0x1400a7350
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
jmp 0x1400a7350
push rbx
sub rsp, 0x50
mov rax, qword [0x14013a700]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x1400a73aa
lea rdx, str.Failed_to_open_the_Win32_clipboard.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000dbb0
mov rcx, rax
lea rdx, [0x14007f3d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400b2990
add rsp, 0x50
pop rbx
ret
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x1400a73bd
lea rdx, str.Failed_to_empty_the_Win32_clipboard.
jmp 0x1400a737b
mov qword [rsp + 0x68], rsi
mov rcx, rbx
mov qword [rsp + 0x70], rdi
call fcn.1400b0e90
mov ecx, 2
lea rsi, [rax*2 + 2]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x1400a747e
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1400b1630
mov rbx, rax
cmp qword [rax + 0x18], 8
jb 0x1400a740b
mov rbx, qword [rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x1400a7467
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a7462
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400a7462
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b2e24
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400b2990
add rsp, 0x50
pop rbx
ret
Function at 0x1400a7530
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x1400a7530
sub rsp, 0x28
test ecx, ecx
je 0x1400a75c3
sub ecx, 1
je 0x1400a75a1
sub ecx, 1
je 0x1400a758c
sub ecx, 1
je 0x1400a7577
cmp ecx, 1
je 0x1400a7562
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
mov ecx, 6
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
mov ecx, 5
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
mov ecx, 4
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
mov ecx, 0x17
call qword [sym.imp.USER32.dll_GetSystemMetrics]
neg eax
sbb ecx, ecx
add ecx, 2
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
mov ecx, 0x17
call qword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
test eax, eax
setne cl
inc ecx
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
Function at 0x1400b1ac0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
mov rbx, rcx
mov rsi, qword [rax]
mov rax, qword [rcx + 0x40]
mov rdi, qword [rax]
cmp rsi, rdi
je 0x1400b1b28
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
sub edi, esi
mov edx, 1
mov r9, rax
movsxd r8, edi
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rax, qword [rbx + 0x58]
mov rdx, qword [rbx + 0x40]
movsxd r8, dword [rax]
mov rax, qword [rbx + 0x20]
add r8, qword [rdx]
mov rcx, qword [rax]
mov qword [rdx], rcx
sub r8d, ecx
mov rax, qword [rbx + 0x58]
mov dword [rax], r8d
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400b1c20
Capabilities:
Check for time delay via queryperformancecounter
Check os version

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rdi, rcx
mov edx, dword [0x1402c6180]
mov rax, qword gs:[0x58]
mov ecx, 4
mov rbx, qword [rax + rdx*8]
add rbx, rcx
mov eax, dword [rbx]
cmp dword [0x1402c5b90], eax
jg 0x1400b1d10
cmp byte [0x1402c5b94], 0
je 0x1400b1c9b
mov eax, dword [rbx]
cmp dword [0x1402c5ba0], eax
jg 0x1400b1cd1
lea rdx, [0x1402c5b98]
lea rcx, [rsp + 0x48]
call fcn.1400b1810
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x48]
call fcn.1400b1830
jmp 0x1400b1ca6
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
imul rax, qword [rsp + 0x40], 0xf4240
cqo
idiv qword [0x1402c5b88]
mov rdx, rax
mov rcx, rdi
call fcn.1400b0920
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
lea rcx, [0x1402c5ba0]
call fcn.1400b2a58
cmp dword [0x1402c5ba0], 0xffffffff
jne 0x1400b1c73
lea rcx, [0x1402c5b98]
call fcn.1400b1780
lea rcx, [0x1400bc210]
call fcn.1400b2e04
nop
lea rcx, [0x1402c5ba0]
call fcn.1400b29ec
jmp 0x1400b1c73
lea rcx, [0x1402c5b90]
call fcn.1400b2a58
cmp dword [0x1402c5b90], 0xffffffff
jne 0x1400b1c60
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x48]
mov qword [0x1402c5b88], rax
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
setb byte [0x1402c5b94]
lea rcx, [0x1402c5b90]
call fcn.1400b29ec
jmp 0x1400b1c60
Function at 0x1400b1eb8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400b1ef2
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400b1ef7
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400b1f40
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400c22f0]
cmp byte [rcx + rax], 0
je 0x1400b1f40
dec r8
sub rdx, 1
jne 0x1400b1f26
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400b3780
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400b37ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400b37ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400b37ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400b37ca
cmp dword [rcx + 0x84], 0xe
jbe 0x1400b37ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400b37cc
xor al, al
add rsp, 0x28
ret
Function at 0x140001220
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov dword [rbp - 0x2a], 0x6c6c64
mov dword [rbp - 0x30], 0x6c64746e
mov word [rbp - 0x2c], 0x2e6c
mov byte [rbp - 0x26], 0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
xor r15d, r15d
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400012e8
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400012e8
mov edi, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400012e3
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1400012c0
cmp edx, 0x53b2070f
je 0x1400013eb
test r8d, r8d
jne 0x1400012a0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x1400012fd
cmp qword [rax + 0x30], r15
jne 0x140001270
mov rax, r15
lea rcx, [rbp - 0x30]
call rax
mov r14, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000143d
movdqa xmm0, xmmword [0x14000a020]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0xa], 0x737365
mov dword [rbp - 0x10], 0x72506e6f
mov word [rbp - 0xc], 0x636f
mov byte [rbp - 6], r15b
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1400013d4
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400013d4
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400013cf
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400013b0
cmp edx, 0xf8f45725
je 0x140001407
test r8d, r8d
jne 0x140001390
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x140001421
cmp qword [rax + 0x30], r15
jne 0x140001360
jmp 0x140001421
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140001300
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov r15d, dword [rcx + rdx*4]
add r15, r9
lea rdx, [rbp - 0x20]
mov rcx, r14
call r15
test rax, rax
je 0x14000143d
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov eax, 1
jmp 0x14000143f
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rbp
ret
Function at 0x140001460
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140001528
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140001528
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140001523
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140001500
cmp edx, 0x6dd8a845
je 0x1400015eb
test r8d, r8d
jne 0x1400014e0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x14000153d
cmp qword [rax + 0x30], r14
jne 0x1400014b0
mov rbp, r14
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400015d4
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400015d4
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400015cf
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400015b0
cmp edx, 0x4cfe97c1
je 0x140001607
test r8d, r8d
jne 0x140001590
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x14000161f
cmp qword [rax + 0x30], r14
jne 0x140001560
jmp 0x14000161f
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov ebp, dword [rcx + rdx*4]
add rbp, r9
jmp 0x140001540
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov r14d, dword [rcx + rdx*4]
add r14, r9
call rbp
mov rcx, rax
lea rdx, [rsp + 0x20]
call r14
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140007170
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x140001660
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x500
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140001738
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140001738
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140001733
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140001710
cmp edx, 0x9bc5a608
je 0x14000185e
test r8d, r8d
jne 0x1400016f0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x14000174e
cmp qword [rax + 0x30], 0
jne 0x1400016c0
xor eax, eax
call rax
mov dword [rsp + 0x50], 0x100010
mov rbp, rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x1400017f8
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x1400017f8
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400017f3
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400017d0
cmp edx, 0x85cca27e
je 0x14000187a
test r8d, r8d
jne 0x1400017b0
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x14000180e
cmp qword [rax + 0x30], 0
jne 0x140001780
xor eax, eax
lea rdx, [rsp + 0x20]
mov rcx, rbp
call rax
test eax, eax
je 0x140001898
cmp qword [rsp + 0x68], 0
jne 0x140001857
cmp qword [rsp + 0x70], 0
jne 0x140001857
cmp qword [rsp + 0x78], 0
jne 0x140001857
cmp qword [rsp + 0x80], 0
jne 0x140001857
cmp qword [rsp + 0x88], 0
jne 0x140001857
cmp qword [rsp + 0x90], 0
je 0x140001898
mov eax, 1
jmp 0x14000189a
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140001750
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140001810
xor eax, eax
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.140007170
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret