joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403f6d50
Capabilities:
Encode data using xor

Disassembly:
push rbx
test ecx, ecx
je 0x1403f6da2
test edx, edx
je 0x1403f6e45
movzx eax, byte [0x1405bb14b]
cmp al, 7
je 0x1403f6f0f
mov cl, 0x42
nop
mov al, 0x67
lock cmpxchg byte [0x1405bb14b], cl
je 0x1403f6ea9
movzx edx, byte [0x1405bc3bc]
mov r8d, edx
xor r8b, 0xaf
and dl, 0x2f
add dl, dl
add dl, r8b
add dl, 4
cmp al, dl
jne 0x1403f6d70
jmp 0x1403f6f0f
mov eax, 0xac65a43e
add eax, dword [0x1405bc3b8]
cmp edx, eax
jne 0x1403f6e79
movzx eax, byte [0x1405bb223]
nop dword [rax]
cmp al, 0x98
je 0x1403f6f90
movzx ecx, byte [0x1405bc3bc]
lea eax, [rcx + 0x7d]
add cl, 0xef
lock cmpxchg byte [0x1405bb223], cl
jne 0x1403f6dc0
xor eax, eax
lea rcx, [0x1405bb210]
lea rdx, [0x1404b0e90]
mov r8d, 0xac65a451
nop word cs:[rax + rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
not r11b
xor r9b, r11b
and r9b, r10b
xor r9b, r11b
and r11b, r10b
or r9b, r11b
not r9b
or r9b, r11b
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405bc3b8]
add r10d, r8d
cmp r9d, r10d
jge 0x1403f6f88
inc rax
jmp 0x1403f6e00
movzx eax, byte [0x1405bb01d]
cmp al, 0x83
je 0x1403f6f7f
mov cl, 0x3a
nop word cs:[rax + rax]
mov al, 0x7e
lock cmpxchg byte [0x1405bb01d], cl
je 0x1403f6f18
cmp al, 0x83
jne 0x1403f6e60
jmp 0x1403f6f7f
movzx eax, byte [0x1405bb652]
cmp al, 0x4c
je 0x1403f6fe1
mov cl, 0x45
nop word [rax + rax]
mov al, 0x6c
lock cmpxchg byte [0x1405bb652], cl
je 0x1403f6f99
cmp al, 0x4c
jne 0x1403f6e90
jmp 0x1403f6fe1
xor eax, eax
lea rcx, [0x1405bb140]
lea rdx, [0x1404b0dc0]
mov r8d, 0xac65a449
nop
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
not r11b
mov ebx, r11d
xor bl, r10b
not r10b
and r9b, r10b
or r9b, bl
not r9b
xor r11b, r10b
and r11b, r10b
or r11b, r9b
mov byte [rax + rcx], r11b
lea r9d, [rax + 1]
mov r10d, dword [0x1405bc3b8]
add r10d, r8d
cmp r9d, r10d
jge 0x1403f6f07
inc rax
jmp 0x1403f6ec0
mov al, 7
xchg byte [0x1405bb14b], al
lea rax, [0x1405bb140]
pop rbx
ret
xor eax, eax
lea rcx, [0x1405bb010]
lea rdx, [0x1404b0cb0]
nop dword [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r9d
not r10b
mov r11d, r8d
and r11b, r10b
xor r10b, r8b
not r8b
mov ebx, r8d
xor bl, r9b
or r11b, bl
not r11b
and r8b, r9b
or r8b, r10b
not r8b
or r8b, r11b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x1403f6f77
inc rax
jmp 0x1403f6f30
mov al, 0x83
xchg byte [0x1405bb01d], al
lea rax, [0x1405bb010]
pop rbx
ret
mov al, 0x98
xchg byte [0x1405bb223], al
lea rax, [0x1405bb210]
pop rbx
ret
xor edx, edx
lea rax, [0x1405bb650]
lea rcx, [0x1404b1290]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
not edx
and edx, 0x7ffffffe
or edx, r8d
not edx
lea edx, [r8 + rdx*2]
cmp edx, 2
jl 0x1403f6fb0
mov al, 0x4c
xchg byte [0x1405bb652], al
lea rax, [0x1405bb650]
pop rbx
ret
Function at 0x1403f6ff0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403f704a
test edx, edx
je 0x1403f707c
movzx eax, byte [0x1405bb186]
cmp al, 0x43
je 0x1403f7042
nop word [rax + rax]
movzx ecx, byte [0x1405bc3bc]
lea eax, [rcx - 0x1b]
mov edx, ecx
xor dl, 0x89
and cl, 9
add cl, cl
add cl, dl
lock cmpxchg byte [0x1405bb186], cl
je 0x1403f7131
movzx ecx, byte [0x1405bc3bc]
add cl, 0xef
cmp al, cl
jne 0x1403f7010
lea rax, [0x1405bb180]
ret
test edx, edx
je 0x1403f70ec
movzx eax, byte [0x1405bb7a8]
cmp al, 0x67
je 0x1403f7074
mov cl, 0x5f
nop
mov al, 0x87
lock cmpxchg byte [0x1405bb7a8], cl
je 0x1403f717f
cmp al, 0x67
jne 0x1403f7060
lea rax, [0x1405bb790]
ret
movzx eax, byte [0x1405bae72]
nop word cs:[rax + rax]
cmp al, 0xc1
je 0x1403f71d7
movzx ecx, byte [0x1405bc3bc]
lea eax, [rcx + 0xe]
add cl, 2
lock cmpxchg byte [0x1405bae72], cl
jne 0x1403f7090
xor eax, eax
lea rcx, [0x1405bae70]
lea rdx, [0x1404b0b20]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x1403f71cf
inc rax
jmp 0x1403f70c0
movzx eax, byte [0x1405bae6a]
cmp al, 0xd8
je 0x1403f7129
nop word [rax + rax]
movzx ecx, byte [0x1405bc3bc]
lea eax, [rcx + 0x4a]
add cl, 0x25
lock cmpxchg byte [0x1405bae6a], cl
je 0x1403f71df
movzx ecx, byte [0x1405bc3bc]
add cl, 0x84
cmp al, cl
jne 0x1403f7100
lea rax, [0x1405bae60]
ret
xor edx, edx
lea rax, [0x1405bb180]
lea rcx, [0x1404b0e00]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 6
jl 0x1403f7150
mov al, 0x43
xchg byte [0x1405bb186], al
lea rax, [0x1405bb180]
ret
xor edx, edx
lea rax, [0x1405bb790]
lea rcx, [0x1404b13b0]
nop
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x18
jl 0x1403f7190
mov al, 0x67
xchg byte [0x1405bb7a8], al
lea rax, [0x1405bb790]
ret
mov al, 0xc1
xchg byte [0x1405bae72], al
lea rax, [0x1405bae70]
ret
xor eax, eax
lea rcx, [0x1405bae60]
lea rdx, [0x1404b0b10]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 9
jg 0x1403f7218
inc rax
jmp 0x1403f71f0
mov al, 0xd8
xchg byte [0x1405bae6a], al
lea rax, [0x1405bae60]
ret
Function at 0x1403f7fa0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x28]
xor rcx, rdx
movabs rdx, 0x100000001b3
imul rcx, rdx
movzx r8d, byte [r8 + 0x17]
mov r10, r8
not r10
mov r11, rcx
and r11, r10
xor r10, rcx
not rcx
and r10, rcx
xor rcx, r8
or r11, rcx
mov rcx, r11
not rcx
or r10, r8
mov r8, rcx
xor r8, r10
and r8, rcx
xor rcx, r11
and rcx, r10
xor rcx, r11
or rcx, r8
imul rcx, rdx
mov rdx, qword [r9]
mov r8, rcx
not r8
mov r9, r8
and r9, rdx
mov r10, rcx
and rcx, rdx
not rdx
and r10, rdx
or r10, r9
xor rdx, r8
or rcx, rdx
not rcx
or rcx, r10
not rcx
mov qword [rax], rcx
ret
Function at 0x1403fed80
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1403fedbc
test edx, edx
je 0x1403fedec
movzx eax, byte [0x1405bd292]
movzx ecx, byte [0x1405bdb88]
add cl, 0x81
cmp al, cl
je 0x1403fedb4
mov cl, 0xfa
nop
mov al, 0x3d
lock cmpxchg byte [0x1405bd292], cl
je 0x1403fee5c
cmp al, 0x91
jne 0x1403feda0
lea rax, [0x1405bd280]
ret
test edx, edx
je 0x1403fee26
movzx eax, byte [0x1405bd3cb]
cmp al, 0xea
je 0x1403fede4
mov cl, 0x8a
nop dword [rax]
mov al, 0xd5
lock cmpxchg byte [0x1405bd3cb], cl
je 0x1403feeb1
cmp al, 0xea
jne 0x1403fedd0
lea rax, [0x1405bd3b0]
ret
movzx eax, byte [0x1405bd26d]
cmp al, 0x2b
je 0x1403fee1e
mov cl, 0x4e
nop dword [rax]
mov al, 0xf0
lock cmpxchg byte [0x1405bd26d], cl
je 0x1403feee8
movzx edx, byte [0x1405bdb88]
add dl, 0x1b
cmp al, dl
jne 0x1403fee00
lea rax, [0x1405bd260]
ret
movzx eax, byte [0x1405bd48d]
cmp al, 0xbf
je 0x1403fee54
mov cl, 0xf4
nop word cs:[rax + rax]
mov al, 0xab
lock cmpxchg byte [0x1405bd48d], cl
je 0x1403fef60
cmp al, 0xbf
jne 0x1403fee40
lea rax, [0x1405bd470]
ret
xor eax, eax
lea rcx, [0x1405bd280]
lea rdx, [0x1404b1640]
mov r8d, 0x1d234b5b
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1405bdb80]
add r10d, r8d
cmp r9d, r10d
jge 0x1403feea1
inc rax
jmp 0x1403fee80
mov al, 0x91
xchg byte [0x1405bd292], al
lea rax, [0x1405bd280]
ret
xor eax, eax
lea rcx, [0x1405bd3b0]
lea rdx, [0x1404b1750]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x1a
jg 0x1403fef50
inc rax
jmp 0x1403feed0
xor edx, edx
lea rax, [0x1405bd260]
lea rcx, [0x1404b1620]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
not edx
and edx, 0x7ffffffe
or edx, r8d
not edx
lea edx, [r8 + rdx*2]
cmp edx, 0xd
jl 0x1403fef00
mov al, 0x2b
xchg byte [0x1405bd26d], al
lea rax, [0x1405bd260]
ret
mov al, 0xea
xchg byte [0x1405bd3cb], al
lea rax, [0x1405bd3b0]
ret
xor edx, edx
lea rax, [0x1405bd470]
lea rcx, [0x1404b17e0]
movsxd r8, edx
movzx edx, byte [r8 + rcx]
xor byte [r8 + rax], dl
lea edx, [r8 + r8]
sub edx, r8d
inc edx
cmp edx, 0x1d
jl 0x1403fef70
mov al, 0xbf
xchg byte [0x1405bd48d], al
lea rax, [0x1405bd470]
ret
Function at 0x140405db0
Capabilities:
Encode data using xor

Disassembly:
push rbx
test ecx, ecx
je 0x140405df3
test edx, edx
je 0x140405e61
movzx eax, byte [0x1405be055]
cmp al, 0x46
je 0x140405f00
mov cl, 0x80
nop
mov al, 0x3d
lock cmpxchg byte [0x1405be055], cl
je 0x140405ec9
movzx edx, byte [0x1405bed38]
add dl, 0x64
cmp al, dl
jne 0x140405dd0
jmp 0x140405f00
mov eax, 0x2085a020
add eax, dword [0x1405bed34]
cmp edx, eax
jne 0x140405e95
movzx eax, byte [0x1405be030]
movzx ecx, byte [0x1405bed38]
add cl, 7
cmp al, cl
je 0x140405ff2
nop
movzx ecx, byte [0x1405bed38]
mov edx, ecx
xor dl, 0xd
mov eax, ecx
and al, 0xd
add al, al
add al, dl
add cl, 0x69
lock cmpxchg byte [0x1405be030], cl
je 0x140405f59
movzx ecx, byte [0x1405bed38]
mov edx, ecx
xor dl, 7
and cl, 7
add cl, cl
add cl, dl
cmp al, cl
jne 0x140405e20
jmp 0x140405ff2
movzx eax, byte [0x1405bdffb]
cmp al, 0xb2
je 0x140405f50
mov cl, 0x13
nop word cs:[rax + rax]
mov al, 0x8c
lock cmpxchg byte [0x1405bdffb], cl
je 0x140405f09
cmp al, 0xb2
jne 0x140405e80
jmp 0x140405f50
movzx eax, byte [0x1405be11d]
cmp al, 0xb7
je 0x140405fe1
mov cl, 0x6b
nop word cs:[rax + rax]
mov al, 0x25
lock cmpxchg byte [0x1405be11d], cl
je 0x140405fac
cmp al, 0xb7
jne 0x140405eb0
jmp 0x140405fe1
xor eax, eax
lea rcx, [0x1405be040]
lea rdx, [0x1404b1c10]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x140405ef8
inc rax
jmp 0x140405ee0
mov al, 0x46
xchg byte [0x1405be055], al
lea rax, [0x1405be040]
pop rbx
ret
xor edx, edx
lea rax, [0x1405bdfc0]
lea rcx, [0x1404b1ba0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x1405bed34]
add edx, r8d
add edx, 0x2085a021
add r8d, 0x2085a05b
cmp edx, r8d
jl 0x140405f20
mov al, 0xb2
xchg byte [0x1405bdffb], al
lea rax, [0x1405bdfc0]
pop rbx
ret
xor eax, eax
lea rcx, [0x1405be020]
lea rdx, [0x1404b1c00]
mov r8d, 0x2085a030
nop
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
mov r11d, r9d
not r11b
mov ebx, r10d
xor bl, r11b
and r11b, r10b
not bl
and bl, r9b
or bl, r11b
mov byte [rax + rcx], bl
lea r9d, [rax + 1]
mov r10d, dword [0x1405bed34]
add r10d, r8d
cmp r9d, r10d
jge 0x140405fea
inc rax
jmp 0x140405f70
xor eax, eax
lea rcx, [0x1405be110]
lea rdx, [0x1404b1ce0]
nop dword [rax]
cdqe
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc eax
cmp eax, 0xd
jl 0x140405fc0
movzx eax, byte [0x1405bed38]
add al, 0xd5
xchg byte [0x1405be11d], al
lea rax, [0x1405be110]
pop rbx
ret
mov al, 0xe9
xchg byte [0x1405be030], al
lea rax, [0x1405be020]
pop rbx
ret
Function at 0x140407ed0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x140407f18
movzx eax, byte [0x1405bef42]
movzx ecx, byte [0x1405beffc]
mov edx, ecx
xor dl, 0xef
not cl
and cl, 0x10
or cl, dl
not cl
add cl, cl
add cl, dl
cmp al, cl
je 0x140407f10
mov cl, 0x72
nop word [rax + rax]
mov al, 0x82
lock cmpxchg byte [0x1405bef42], cl
je 0x140407f56
cmp al, 0x3f
jne 0x140407f00
lea rax, [0x1405bef30]
ret
movzx eax, byte [0x1405bef0b]
cmp al, 0x1f
je 0x140407f4e
mov cl, 0x8d
nop word cs:[rax + rax]
mov al, 0x80
lock cmpxchg byte [0x1405bef0b], cl
je 0x140407fc6
movzx edx, byte [0x1405beffc]
add dl, 0xcf
cmp al, dl
jne 0x140407f30
lea rax, [0x1405bef00]
ret
xor edx, edx
lea rax, [0x1405bef30]
lea rcx, [0x1404b1f60]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
add r8b, 0x7c
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, r8b
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
add r8b, 0x84
mov byte [rdx + rax], r8b
mov r8d, dword [0x1405beff8]
add edx, r8d
add edx, 0x3fa6f792
cmp edx, 0x12
jl 0x140407f70
mov al, 0x3f
xchg byte [0x1405bef42], al
lea rax, [0x1405bef30]
ret
xor eax, eax
lea rcx, [0x1405bef00]
lea rdx, [0x1404b1f30]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
add r8b, 0x8b
mov r10d, r8d
xor r10b, r9b
and r8b, r9b
add r8b, r8b
add r8b, r10b
add r8b, 0x75
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x140408014
inc rax
jmp 0x140407fe0
mov al, 0x1f
xchg byte [0x1405bef0b], al
lea rax, [0x1405bef00]
ret
Function at 0x14040dc30
Capabilities:
Encrypt data using speck

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov esi, edx
mov rax, qword [0x1405c08a0]
xor rax, rsp
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [0x1404b6f30]
movaps xmmword [rsp + 0x30], xmm0
movabs rax, 0x1716151413121110
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0x1918
mov byte [rsp + 0x4a], 0x1a
mov edi, 0x1a
nop dword [rax]
mov r10d, dword [0x1405c0cf8]
lea ecx, [rdi + r10]
add ecx, 0x371aeda5
mov eax, esi
xor edx, edx
div ecx
lea rax, [rsp + rdi]
add rax, 0x30
movzx r8d, byte [rsp + rdi + 0x30]
lea rcx, [rsp + rdx]
add rcx, 0x30
lea r9d, [r10 + 0x3be110e0]
add r10d, 0x9c9f3ceb
mov dword [rsp + 0x20], r10d
mov rdx, rax
call fcn.14040e2b0
mov r8d, dword [0x1405c0cf8]
lea edx, [r8 + 0xf581a20]
add r8d, 0xb37c7b50
mov rcx, rdi
call fcn.14040e200
test al, 1
je 0x14040dd06
imul eax, esi, 0x6255
add eax, 0x3619
mov esi, eax
xor esi, 0xffff0000
and esi, eax
dec rdi
jmp 0x14040dc80
movabs r14, 0xba4de53d68fd3935
xor r12d, r12d
lea rbp, [0x1405d54c0]
xor r13d, r13d
jmp 0x14040de2b
movzx ecx, byte [0x1405c0cfc]
mov eax, ecx
xor al, 0x15
and cl, 0x15
add cl, cl
add cl, al
mov r8d, r13d
not r8b
mov eax, r13d
xor al, r8b
and al, cl
xor al, r8b
mov esi, eax
not sil
xor al, r13b
and sil, r8b
mov r8d, r13d
not r8d
mov r9d, r13d
xor r9d, 7
mov ecx, r13d
xor ecx, 0xfffffff8
and ecx, r8d
or ecx, r9d
not ecx
mov r8d, 0xffffffff
shl r8d, cl
or sil, al
not sil
add ecx, edx
mov eax, dword [0x1405c0cf8]
mov r9d, eax
xor r9d, 0x371aeda3
and eax, 0x371aeda3
lea ebx, [r9 + rax*2]
shl ebx, cl
lea r15d, [rdx + r13]
not ebx
mov eax, ebx
and eax, r8d
or ebx, r8d
not ebx
or ebx, eax
shr r13d, 3
mov ecx, r13d
lea rdx, [rsp + 0x2c]
mov r8d, 0x505eef1d
mov r9d, 0xf8c80dcc
call fcn.140146ac0
movzx eax, byte [rsp + 0x2c]
mov byte [rbp + rdi*4], al
mov byte [rbp + rdi*4 + 3], sil
mov byte [rbp + rdi*4 + 1], bl
mov byte [rbp + rdi*4 + 2], bh
movabs rcx, 0xf731df68deae20a
mov rax, rcx
xor rax, r14
and rcx, r14
lea rax, [rax + rcx*2]
add rax, qword [0x1405c0d00]
movabs rcx, 0x9b9b6f13972024a3
add rax, rcx
sub rax, r14
sub rax, rcx
add r12, rax
mov r13d, r15d
cmp r12, 0x1b
je 0x14040deae
movzx edi, byte [rsp + r12 + 0x30]
mov edx, 6
cmp rdi, 0xf
ja 0x14040dd30
mov ecx, edi
mov edx, 0x1b9956eb
mov r8d, 0x4df3a6ab
call fcn.14040e2a0
mov edx, 5
test al, 1
jne 0x14040dd30
mov edx, 4
cmp dil, 3
ja 0x14040dd30
mov ecx, edi
mov edx, 0x7c439f1e
mov r8d, 0x82cda445
call fcn.14040e280
mov edx, 3
test al, 1
jne 0x14040dd30
mov ecx, edi
lea rdx, [rsp + 0x2c]
mov r8d, 0xa6b469cd
mov r9d, 0x6077d9f2
call fcn.14040e1e0
mov edx, dword [rsp + 0x2c]
jmp 0x14040dd30
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1404448f0
nop
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140001bc0
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x14004dd08], rbx
je 0x140001c27
cmp rax, rbx
jne 0x140001c1a
mov edi, 1
mov esi, edi
jmp 0x140001c2c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x140001bff
mov edi, 1
mov eax, dword [0x14004dd10]
cmp eax, edi
jne 0x140001c44
mov ebx, 0x1f
mov ecx, ebx
call sub.msvcrt.dll__amsg_exit
jmp 0x140001cba
mov eax, dword [0x14004dd10]
test eax, eax
jne 0x140001caf
mov dword [0x14004dd10], edi
lea r15, [0x140045358]
lea rbx, [0x140045340]
mov qword [rsp + 0x30], rbx
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rbx, r15
jae 0x140001ca1
test eax, eax
jne 0x140001ca5
cmp qword [rbx], r14
je 0x140001c96
movabs r10, 0xd30527475e523070
mov rax, qword [rbx]
mov rcx, qword [vtable.H_MA8HI.0]
call rcx
mov dword [rsp + 0x24], eax
add rbx, 8
mov qword [rsp + 0x30], rbx
jmp 0x140001c6e
test eax, eax
je 0x140001cb5
mov eax, 0xff
jmp 0x140001e1b
mov dword [0x14004d384], edi
mov ebx, 0x1f
mov eax, dword [0x14004dd10]
cmp eax, edi
jne 0x140001ce1
lea rdx, [0x140045338]
lea rcx, [0x140045308]
call sub.msvcrt.dll__initterm
mov dword [0x14004dd10], 2
test esi, esi
jne 0x140001cef
mov rax, r14
xchg qword [0x14004dd08], rax
cmp qword [0x14004dd28], r14
je 0x140001d2c
lea rcx, [0x14004dd28]
call fcn.140002280
test eax, eax
je 0x140001d2c
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14004dd28]
mov r9, qword [vtable.H_MA8HI.0]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x140001d45
mov eax, 0xff
jmp 0x140001e1b
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x140001dcc
test ax, ax
je 0x140001d60
test edx, edx
jne 0x140001dcc
sub ax, di
cmp ax, bx
ja 0x140001d76
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x140001d60
test byte [rsp + 0x7c], dil
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140005044
mov dword [0x14004d380], eax
cmp dword [0x14004d3a0], r14d
jne 0x140001db5
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14004d384], r14d
jne 0x140001dca
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14004d380]
jmp 0x140001e1b
cmp ax, 0x22
jne 0x140001de0
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x140001d4e
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.1400e1000
add rsp, 0x28
jmp 0x140001bc0
Function at 0x14000216c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400021b8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400021b0
cmp dword [rcx + 0x3c], edx
jl 0x1400021b0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400021b0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400021b8
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1400022e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140002308
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140002308
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140003b68
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x10], edx
push rsi
push rdi
push r14
sub rsp, 0x30
mov rdi, rcx
mov ebx, 1
mov rsi, qword [0x14004d200]
mov rax, qword [0x14004d208]
jmp 0x140003c38
test ebx, ebx
js 0x140003d6a
mov r14, qword [rsi]
test r14, r14
je 0x140003c34
and qword [rsp + 0x50], 0
cmp qword [r14 + 0x10], 0
jne 0x140003bb9
xor ebx, ebx
jmp 0x140003c34
movabs r10, 0x804916e15a52a070
lea r8, [rsp + 0x50]
lea rdx, [0x140045bd0]
mov rcx, qword [r14 + 0x18]
mov rax, qword [r14 + 0x10]
call qword [vtable.H_MA8HI.0]
mov ebx, eax
test eax, eax
js 0x140003c0c
lea rax, [r14 + 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 5
lea r8d, [r9 - 1]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [r14]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoRegisterClassObject]
nop dword [rax + rax]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140003c2d
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [vtable.H_MA8HI.0]
mov rax, qword [0x14004d208]
add rsi, 8
cmp rsi, rax
jb 0x140003b94
test ebx, ebx
js 0x140003d6a
jne 0x140003d66
cmp byte [rdi + 0x60], 0
je 0x140003d10
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
nop dword [rax + rax]
mov qword [rdi + 0x50], rax
test rax, rax
je 0x140003d09
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
mov r9, rdi
lea r8, [0x1400039c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_CreateThread]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x140003cbd
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
test rsi, rsi
je 0x140003d09
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoResumeClassObjects]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x140003cf8
mov rcx, qword [rdi + 0x50]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
nop dword [rax + rax]
mov edx, dword [rdi + 0x58]
add edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
jmp 0x140003d1e
mov ebx, 0x80004005
jmp 0x140003d22
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoResumeClassObjects]
nop dword [rax + rax]
mov ebx, eax
test ebx, ebx
jns 0x140003d6a
xor eax, eax
mov rdi, qword [0x14004d200]
mov rcx, qword [0x14004d208]
jmp 0x140003d5f
test eax, eax
jne 0x140003d6a
mov rdx, qword [rdi]
test rdx, rdx
je 0x140003d5b
cmp dword [rdx + 0x28], eax
je 0x140003d5b
mov ecx, dword [rdx + 0x28]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoRevokeClassObject]
nop dword [rax + rax]
mov rcx, qword [0x14004d208]
add rdi, 8
cmp rdi, rcx
jb 0x140003d34
jmp 0x140003d6a
mov byte [rdi + 0x60], 0
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret