joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400648a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x1400648ba
mov qword [r8], 0
lea rdx, [0x1400a25a8]
call fcn.140064780
mov rbx, rax
test rax, rax
jne 0x1400648da
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x1400649b1
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400649b1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1400649b1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400649b1
cmp rdi, 0xffffffffffffffff
je 0x1400649b1
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x14006494e
inc dword [rax + 0x9b8]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1400649b1
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14006499e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1400b2e50]
test rax, rax
je 0x140064993
dec dword [rax + 0x9b8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400649ba
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x1400649ac
mov qword [r14], rdi
mov rax, rsi
jmp 0x1400649bc
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140070bd0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x1400b2e50]
mov r8d, ecx
mov rbx, qword [rax + 0x2210]
add rbx, 0xc8
movzx eax, r8b
lea r8, [0x14009ce80]
movsxd rdx, dword [rbx]
mov r9, qword [rbx + 8]
mov edi, dword [r9 + rdx*4 - 4]
not edi
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x140070c90
lea ecx, [rdx + 1]
test r8d, r8d
je 0x140070c76
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x140070c7b
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.140062950
mov edx, dword [rbx]
mov r9, qword [rbx + 8]
movsxd rax, edx
mov dword [r9 + rax*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140071c00
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400b2010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400b2e50]
mov edi, edx
cmp byte [rbx + 0x254d], 0
jne 0x140071c60
cmp byte [rbx + 0x254e], 0
jne 0x140071c60
mov r9d, dword [rbx + 0x35f8]
lea r8, str.Tooltip__02d
mov edx, Ordinal_20
lea rcx, [rsp + 0x20]
call fcn.1400645c0
test dil, 1
je 0x140071d78
jmp 0x140071ce2
movss xmm1, dword [rbx + 0x1c14]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400a2fcc]
xor eax, eax
mulss xmm1, dword [0x1400a2fb8]
addss xmm0, dword [rbx + 0x14]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0x18]
mov qword [rbx + 0x22c8], rax
mov dword [rbx + 0x22b4], 1
movss dword [rbx + 0x22c0], xmm0
movss dword [rbx + 0x22c4], xmm1
movss xmm0, dword [rbx + 0x1c70]
mulss xmm0, dword [0x1400a2e90]
or dword [rbx + 0x22b0], 0x41
mov r9d, dword [rbx + 0x35f8]
movss dword [rbx + 0x2310], xmm0
call fcn.1400645c0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140071d32
lea r11, [0x14009ce80]
cmp r9b, 0x23
jne 0x140071d15
cmp byte [r8], r9b
jne 0x140071d15
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140071d02
not ecx
call fcn.14006b920
test rax, rax
je 0x140071d78
cmp byte [rax + 0x8e], 0
je 0x140071d78
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x35f8]
mov edx, Ordinal_20
mov r9d, dword [rbx + 0x35f8]
call fcn.1400645c0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14006df50
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14008f590
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140076820
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3698], 0
lea rbx, [rcx + 0x36a0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400768c3
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test ecx, ecx
jns 0x140076876
mov eax, ecx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.140062610
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400650c0
mov eax, dword [rbx]
lea rcx, [0x1400b2e44]
mov r9, qword [rdi + 0x3698]
test eax, eax
lea edx, [rax - 1]
mov rax, qword [rdi + 0x36a8]
cmove edx, r14d
test rax, rax
movsxd r8, edx
mov edx, 1
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x1400768cb
mov rcx, rbx
call fcn.1400650c0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14008d7a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov rbx, r8
mov ecx, Ordinal_20
mov rdi, rdx
call qword [sym.imp.USER32.dll_GetKeyState]
mov r9, qword [rdi + 0xbc8]
mov ecx, Ordinal_20
shr eax, 0xf
and al, 1
mov byte [r9 + 0x29], al
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, qword [rdi + 0xbc8]
shr eax, 0xf
and al, 1
mov byte [rcx + 0x28], al
mov ecx, Ordinal_20
call qword [sym.imp.USER32.dll_GetKeyState]
mov rcx, qword [rdi + 0xbc8]
shr eax, 0xf
and al, 1
mov byte [rcx + 0x2a], al
mov rax, qword [rdi + 0xbc8]
movzx ecx, byte [rsp + 0x50]
mov dword [rax + rbx*4 + 0x2c], ecx
mov rax, qword [rdi + 0xbc8]
cmp byte [rax + 0x995], 0
jne 0x14008d855
mov eax, dword [rdi + 0xbb0]
sub eax, 1
movsxd rbx, eax
js 0x14008d855
mov rax, qword [rdi + 0xbb8]
mov rdx, rsi
mov r8, qword [rdi + 0xbc8]
mov rcx, qword [rax + rbx*8]
mov rax, qword [rcx]
call qword [rax]
sub rbx, 1
jns 0x14008d835
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140006960
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x1400069c1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140006980
mov ecx, dword [r10]
jmp 0x140006aaa
cmp ecx, 0x4e0
jb 0x140006aaa
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400069e0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140006a30
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140006b70
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x70
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
xor r14d, r14d
mov qword [rcx], r14
mov dword [rcx + 8], r14d
lea ecx, [r14 + 0x18]
call fcn.1408d6ed8
mov rbp, rax
mov qword [rsp + 0xa8], rax
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
mov rcx, qword [rdi]
mov qword [rax + 0x10], rcx
mov dword [rsp + 0xa8], r14d
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
mov r9, rbp
lea r8, [0x140006d70]
xor edx, edx
xor ecx, ecx
call fcn.1408de56c
mov rbx, rax
test rax, rax
je 0x140006bf9
mov edi, dword [rsp + 0xa8]
jmp 0x140006bff
mov rbx, r14
mov edi, r14d
lea rax, [rsp + 0x30]
cmp rsi, rax
je 0x140006c20
mov rax, rbx
mov rbx, r14
mov rcx, qword [rsi]
mov qword [rsi], rax
test rcx, rcx
je 0x140006c20
call qword [0x14091b3d8]
mov dword [rsi + 8], edi
test rbx, rbx
je 0x140006c31
mov rcx, rbx
call qword [0x14091b3d8]
cmp qword [rsi], 0
je 0x140006c4f
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov edx, 0x18
mov rcx, rbp
call fcn.1401ea580
call fcn.1400123d0
mov rbx, rax
call fcn.1408de28c
mov r8, rbx
mov edx, dword [rax]
lea rcx, [rsp + 0x40]
call fcn.140008b30
lea rdx, [0x14110ebf0]
lea rcx, [rsp + 0x40]
call fcn.1408d838c
int3

Function at 0x1402142f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
movzx r8d, dl
movzx edi, dl
xor r8b, 1
mov edx, 0x3b
call fcn.14020eb90
movzx edx, dil
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140214330
Function at 0x14029eab0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x14111a7d8]
xor rax, rsp
mov qword [rbp - 0x10], rax
movsx rax, byte [rcx]
mov r8, rcx
mov rcx, qword [rdx]
and eax, 0xf
mov dword [rbp - 0x30], 0x310030
mov dword [rbp - 0x2c], 0x330032
mov dword [rbp - 0x28], 0x350034
mov dword [rbp - 0x24], 0x370036
mov dword [rbp - 0x20], 0x390038
mov dword [rbp - 0x1c], 0x620061
mov dword [rbp - 0x18], 0x640063
mov dword [rbp - 0x14], 0x660065
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
movzx eax, byte [r8]
mov rcx, qword [rdx]
shr rax, 4
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
movsx rax, byte [r8 + 1]
mov rcx, qword [rdx]
and eax, 0xf
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
movzx eax, byte [r8 + 1]
mov rcx, qword [rdx]
shr rax, 4
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
movsx rax, byte [r8 + 2]
mov rcx, qword [rdx]
and eax, 0xf
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
movzx eax, byte [r8 + 2]
mov rcx, qword [rdx]
shr rax, 4
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
movsx rax, byte [r8 + 3]
mov rcx, qword [rdx]
and eax, 0xf
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
movzx eax, byte [r8 + 3]
mov rcx, qword [rdx]
shr rax, 4
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1408d7570
add rsp, 0x30
pop rbp
ret
Function at 0x1402a0600
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x14111a7d8]
xor rax, rsp
mov qword [rbp - 0x10], rax
movsx rax, byte [rcx]
mov r8, rcx
mov rcx, qword [rdx]
and eax, 0xf
mov dword [rbp - 0x30], 0x310030
mov dword [rbp - 0x2c], 0x330032
mov dword [rbp - 0x28], 0x350034
mov dword [rbp - 0x24], 0x370036
mov dword [rbp - 0x20], 0x390038
mov dword [rbp - 0x1c], 0x620061
mov dword [rbp - 0x18], 0x640063
mov dword [rbp - 0x14], 0x660065
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
movzx eax, byte [r8]
mov rcx, qword [rdx]
shr rax, 4
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
movsx rax, byte [r8 + 1]
mov rcx, qword [rdx]
and eax, 0xf
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
movzx eax, byte [r8 + 1]
mov rcx, qword [rdx]
shr rax, 4
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
movsx rax, byte [r8 + 2]
mov rcx, qword [rdx]
and eax, 0xf
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
movzx eax, byte [r8 + 2]
mov rcx, qword [rdx]
shr rax, 4
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
movsx rax, byte [r8 + 3]
mov rcx, qword [rdx]
and eax, 0xf
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
movzx eax, byte [r8 + 3]
mov rcx, qword [rdx]
shr rax, 4
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
movsx rax, byte [r8 + 4]
mov rcx, qword [rdx]
and eax, 0xf
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
movzx eax, byte [r8 + 4]
mov rcx, qword [rdx]
shr rax, 4
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
movsx rax, byte [r8 + 5]
mov rcx, qword [rdx]
and eax, 0xf
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
movzx eax, byte [r8 + 5]
mov rcx, qword [rdx]
shr rax, 4
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
movsx rax, byte [r8 + 6]
mov rcx, qword [rdx]
and eax, 0xf
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
movzx eax, byte [r8 + 6]
mov rcx, qword [rdx]
shr rax, 4
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
movsx rax, byte [r8 + 7]
mov rcx, qword [rdx]
and eax, 0xf
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
movzx eax, byte [r8 + 7]
mov rcx, qword [rdx]
shr rax, 4
movzx eax, word [rbp + rax*2 - 0x30]
mov word [rcx], ax
add qword [rdx], 2
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1408d7570
add rsp, 0x30
pop rbp
ret
Function at 0x140503100
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x50
mov r10, qword [rcx]
movabs rax, 0x6666666666666667
mov rbx, r9
movsxd r15, r8d
mov rdi, rcx
sub rdx, qword [r10 + 0x10]
sub rdx, r10
imul rdx
mov rsi, rdx
sar rsi, 4
mov rax, rsi
shr rax, 0x3f
add rsi, rax
test r8d, r8d
je 0x14050326b
mov rdx, rbx
mov qword [rsp + 0x60], r14
lea rcx, [rsp + 0x20]
call fcn.14049efd0
mov eax, dword [rbx + 8]
movzx ecx, byte [rbx + 0xc]
mov dword [rsp + 0x28], eax
movzx eax, byte [rsp + 0x2c]
xor cl, al
and cl, 3
xor al, cl
mov byte [rsp + 0x2c], al
mov eax, dword [rbx + 0x10]
mov dword [rsp + 0x30], eax
mov rax, qword [rbx + 0x18]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x20]
mov qword [rsp + 0x40], rax
mov rax, qword [rdi]
mov ecx, dword [rax]
mov rdx, qword [rdi]
cmp ecx, 1
ja 0x1405031b3
mov ecx, dword [rdx + 4]
mov eax, dword [rdx + 8]
add ecx, r15d
btr eax, 0x1f
cmp ecx, eax
jle 0x1405031ca
mov edx, dword [rdx + 4]
mov r8d, 8
add edx, r15d
mov rcx, rdi
call fcn.140503290
mov rdx, qword [rdi]
mov rax, qword [rdx + 0x10]
lea rcx, [rsi + rsi*4]
lea r14, [rax + rcx*8]
movsxd rax, dword [rdx + 4]
add r14, rdx
lea rcx, [r15 + r15*4]
sub rax, rsi
mov rdx, r14
lea rbx, [r14 + rcx*8]
lea r8, [rax + rax*4]
mov rcx, rbx
shl r8, 3
call fcn.1408d9100
cmp rbx, r14
je 0x140503252
lea rcx, [rbx - 0x28]
lea rdx, [rsp + 0x20]
call fcn.14049efd0
mov eax, dword [rsp + 0x28]
mov dword [rbx - 0x20], eax
movzx eax, byte [rbx - 0x1c]
xor al, byte [rsp + 0x2c]
and al, 1
xor byte [rbx - 0x1c], al
movzx ecx, byte [rbx - 0x1c]
xor cl, byte [rsp + 0x2c]
and cl, 2
xor byte [rbx - 0x1c], cl
mov eax, dword [rsp + 0x30]
mov dword [rbx - 0x18], eax
mov rax, qword [rsp + 0x38]
mov qword [rbx - 0x10], rax
mov rax, qword [rsp + 0x40]
mov qword [rbx - 8], rax
sub rbx, 0x28
cmp rbx, r14
jne 0x140503200
mov rax, qword [rdi]
lea rcx, [rsp + 0x20]
add dword [rax + 4], r15d
call fcn.1404ea200
mov r10, qword [rdi]
mov r14, qword [rsp + 0x60]
mov rax, qword [r10 + 0x10]
lea rcx, [rsi + rsi*4]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
lea rax, [rax + rcx*8]
add rax, r10
add rsp, 0x50
pop r15
ret
Function at 0x140503290
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
push rsi
push r13
push r14
sub rsp, 0x28
mov rax, qword [rcx]
mov r9d, r8d
movsxd rbx, edx
mov rsi, rcx
mov edx, 8
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x68], r12
mov r8d, dword [rax]
cmp r8d, 1
mov r8, rbx
mov qword [rsp + 0x20], r15
lea ecx, [rdx + 0x20]
seta r13b
call fcn.1406e4920
mov rdx, qword [rsi]
mov r14, rax
mov r15, qword [rax + 0x10]
mov ecx, dword [rdx + 4]
add r15, rax
mov dword [rax + 4], ecx
mov r9, qword [rsi]
mov r8, qword [r9 + 0x10]
movsxd rcx, dword [r9 + 4]
lea rbp, [r8 + r9]
lea rdx, [rcx + rcx*4]
lea r12, [r8 + rdx*8]
add r12, r9
test r13b, r13b
je 0x14050337e
cmp rbp, r12
je 0x1405033af
mov qword [rsp + 0x60], rdi
nop dword [rax]
nop dword [rax + rax]
mov rdi, r15
mov rbx, rbp
mov rdx, rbx
mov rcx, rdi
add r15, 0x28
add rbp, 0x28
call fcn.14049efd0
mov eax, dword [rbx + 8]
mov dword [rdi + 8], eax
movzx eax, byte [rdi + 0xc]
xor al, byte [rbx + 0xc]
and al, 1
xor byte [rdi + 0xc], al
movzx ecx, byte [rdi + 0xc]
xor cl, byte [rbx + 0xc]
and cl, 2
xor byte [rdi + 0xc], cl
mov eax, dword [rbx + 0x10]
mov dword [rdi + 0x10], eax
mov rax, qword [rbx + 0x18]
mov qword [rdi + 0x18], rax
mov rax, qword [rbx + 0x20]
mov qword [rdi + 0x20], rax
cmp rbp, r12
jne 0x140503320
mov ebx, dword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
jmp 0x1405033af
sub r12, rbp
movabs rax, 0x6666666666666667
imul r12
mov rcx, r15
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea r8, [rdx + rdx*4]
mov rdx, rbp
shl r8, 3
call fcn.1408d9100
mov rax, qword [rsi]
mov r15, qword [rsp + 0x20]
mov r12, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x50]
mov ecx, dword [rax + 8]
xor ecx, dword [r14 + 8]
btr ecx, 0x1f
xor ecx, dword [rax + 8]
mov dword [r14 + 8], ecx
mov rcx, qword [rsi]
mov eax, dword [rcx]
test eax, eax
je 0x1405033ef
cmp eax, 0xffffffff
je 0x140503422
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x140503422
test ebx, ebx
je 0x140503417
test r13b, r13b
jne 0x140503417
mov rcx, qword [rsi]
mov edx, 0x28
lea r8d, [rdx - 0x20]
call fcn.1406e4ad0
mov qword [rsi], r14
add rsp, 0x28
pop r14
pop r13
pop rsi
pop rbx
ret
mov rdx, qword [rsi]
mov rcx, rsi
call fcn.140502eb0
mov qword [rsi], r14
add rsp, 0x28
pop r14
pop r13
pop rsi
pop rbx
ret
Function at 0x14056b060
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 8]
mov rdi, rcx
mov rcx, qword [rbx + 0x58]
add rcx, 0xa8
call fcn.1404fe300
mov rcx, qword [rbx + 0x58]
mov r8d, eax
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14063afb0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov r9d, dword [rcx + 0x8c]
mov r14d, r8d
mov rbp, rdx
mov rsi, rcx
lea eax, [r9 + 1]
mov dword [rcx + 0x8c], eax
test r9d, r9d
jne 0x14063afed
inc dword [rcx + 0x80]
mov rcx, rbp
call fcn.14056a920
mov edx, eax
lea rcx, [rsi + 0xa8]
mov ebx, eax
call fcn.1404ff610
mov r8d, r14d
lea rcx, [rsi + 0xa8]
mov edx, ebx
mov r15d, eax
call fcn.140500e80
mov rdx, rbp
lea rcx, [0x140e63160]
call fcn.1407179f0
test rax, rax
je 0x14063b036
mov rcx, qword [rax + 8]
call fcn.14056a6e0
mov rdx, rbp
lea rcx, [0x140e63190]
call fcn.1407179f0
mov rdi, rax
test rax, rax
je 0x14063b076
mov rcx, rax
call fcn.14056a4f0
mov rcx, rdi
mov ebx, eax
call fcn.14056a050
mov rcx, rdi
sub ebx, eax
call fcn.14056a050
mov r8d, ebx
mov edx, eax
mov rcx, rsi
call fcn.14063c2f0
xor edx, edx
mov byte [rsp + 0x28], 1
cmp dword [rsi + 0x8c], edx
mov eax, 8
mov word [rsp + 0x20], ax
mov eax, edx
setne al
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x24], eax
lea rdx, [rsp + 0x20]
mov rax, qword [rbp + 8]
mov dword [rsp + 0x2c], r15d
mov ecx, dword [rax + 0x60]
xor eax, eax
mov dword [rsp + 0x38], ecx
mov rcx, rsi
mov qword [rsp + 0x3c], rax
call fcn.14063abb0
mov rcx, rsi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
jmp fcn.14063c450
Function at 0x1406952b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rsi
push r12
push r15
sub rsp, 0x48
mov rax, qword [0x14111a7d8]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r15d, edx
mov r8d, edx
xor edx, edx
mov r12, rcx
mov esi, 0x811c9dc5
call fcn.140698380
mov ebp, eax
cmp eax, r15d
jae 0x1406954a0
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x40], r14
nop
mov ecx, ebp
mov edx, r15d
add rcx, r12
sub edx, ebp
movsx edi, byte [rcx]
cmp dil, 0x7f
jbe 0x140695415
movzx eax, dil
and al, 0xe0
cmp al, 0xc0
jne 0x140695355
cmp edx, 1
jbe 0x140695415
movsx edx, byte [rcx + 1]
movzx eax, dl
and al, 0xc0
cmp al, 0x80
jne 0x140695415
mov ebx, edi
mov eax, edx
and ebx, 0x1f
and eax, 0x3f
shl ebx, 6
mov r14d, 2
or ebx, eax
jmp 0x14069541d
movzx eax, dil
and al, 0xf0
cmp al, 0xe0
jne 0x1406953ae
cmp edx, 2
jbe 0x140695415
movsx edx, byte [rcx + 1]
movzx eax, dl
and al, 0xc0
cmp al, 0x80
jne 0x140695415
movsx r8d, byte [rcx + 2]
movzx eax, r8b
and al, 0xc0
cmp al, 0x80
jne 0x140695415
mov ebx, edi
mov eax, edx
and ebx, 0xf
and eax, 0x3f
shl ebx, 6
mov r14d, 3
or ebx, eax
mov eax, r8d
and eax, 0x3f
shl ebx, 6
or ebx, eax
jmp 0x14069541d
movzx eax, dil
and al, 0xf8
cmp al, 0xf0
jne 0x140695415
cmp edx, 3
jbe 0x140695415
movsx edx, byte [rcx + 1]
movzx eax, dl
and al, 0xc0
cmp al, 0x80
jne 0x140695415
movsx r8d, byte [rcx + 2]
movzx eax, r8b
and al, 0xc0
cmp al, 0x80
jne 0x140695415
movsx r9d, byte [rcx + 3]
movzx eax, r9b
and al, 0xc0
cmp al, 0x80
jne 0x140695415
mov ebx, edi
mov eax, edx
and ebx, 7
and eax, 0x3f
shl ebx, 6
mov r14d, 4
or ebx, eax
mov eax, r8d
and eax, 0x3f
shl ebx, 6
or ebx, eax
mov eax, r9d
and eax, 0x3f
shl ebx, 6
or ebx, eax
jmp 0x14069541d
mov r14d, 1
mov ebx, edi
mov ecx, ebx
call fcn.140694e10
test eax, eax
jne 0x14069546a
cmp dil, 0xd
je 0x14069546a
cmp dil, 0xa
je 0x14069546a
lea rdx, [rsp + 0x20]
mov ecx, ebx
call fcn.140692930
movsxd rdx, dword [rsp + 0x2c]
xor ecx, ecx
shl rdx, 2
test rdx, rdx
je 0x140695465
movzx eax, byte [rsp + rcx + 0x20]
inc rcx
xor eax, esi
imul esi, eax, 0x1000193
cmp rcx, rdx
jb 0x140695450
add ebp, r14d
jmp 0x140695482
xor esi, 0x20
mov r8d, r15d
imul esi, esi, 0x502c3f11
mov edx, ebp
mov rcx, r12
call fcn.140698380
mov ebp, eax
cmp ebp, r15d
jb 0x140695300
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
mov eax, esi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1408d7570
add rsp, 0x48
pop r15
pop r12
pop rsi
pop rbp
ret