joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c4cc0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc0
vmovups xmmword [rsp + 0x40], xmm6
vmovups xmmword [rsp + 0x50], xmm7
vmovups xmmword [rsp + 0x60], xmm8
vmovups xmmword [rsp + 0x70], xmm9
vmovups xmmword [rsp + 0x80], xmm10
vmovups xmmword [rsp + 0x90], xmm11
vmovups xmmword [rsp + 0xa0], xmm12
vmovups xmmword [rsp + 0xb0], xmm13
mov r12, rcx
mov rbx, r8
test dl, 0x3f
jne 0x1400c4e5a
lea rbp, [r8 + rdx]
vmovdqu xmm9, xmmword [rcx]
vmovdqu xmm8, xmmword [rcx + 0x10]
vmovdqu xmm7, xmmword [rcx + 0x20]
vmovdqu xmm6, xmmword [rcx + 0x30]
cmp r8, rbp
jae 0x1400c4df5
vmovdqu xmm13, xmmword [0x140171dc0]
lea rdi, [rsp + 0x20]
vmovdqu xmm12, xmmword [0x140171dd0]
lea rsi, [rsp + 0x30]
vmovdqu xmm11, xmmword [0x140171de0]
vmovdqu xmm10, xmmword [0x140171df0]
nop word [rax + rax]
mov rdx, rdi
mov rcx, rsi
vmovdqu xmmword [rsp + 0x20], xmm13
add rbx, 0x40
vmovdqu xmmword [rsp + 0x30], xmm9
call dbg.soft_aesdec(long long __vector(2), long long __vector(2))
mov rdx, rdi
mov rcx, rsi
vmovdqa xmm9, xmm0
vmovdqu xmmword [rsp + 0x20], xmm12
vmovdqu xmmword [rsp + 0x30], xmm8
call dbg.soft_aesenc(long long __vector(2), long long __vector(2))
mov rdx, rdi
mov rcx, rsi
vmovdqa xmm8, xmm0
vmovdqu xmmword [rsp + 0x30], xmm7
vmovdqu xmmword [rsp + 0x20], xmm11
call dbg.soft_aesdec(long long __vector(2), long long __vector(2))
mov rdx, rdi
mov rcx, rsi
vmovdqa xmm7, xmm0
vmovdqu xmmword [rsp + 0x30], xmm6
vmovdqu xmmword [rsp + 0x20], xmm10
call dbg.soft_aesenc(long long __vector(2), long long __vector(2))
vmovdqu xmmword [rbx - 0x40], xmm9
vmovdqa xmm6, xmm0
vmovdqu xmmword [rbx - 0x30], xmm8
vmovdqu xmmword [rbx - 0x20], xmm7
vmovdqu xmmword [rbx - 0x10], xmm0
cmp rbx, rbp
jb 0x1400c4d68
vmovdqu xmmword [r12], xmm9
vmovdqu xmmword [r12 + 0x10], xmm8
vmovdqu xmmword [r12 + 0x20], xmm7
vmovdqu xmmword [r12 + 0x30], xmm6
vmovups xmm6, xmmword [rsp + 0x40]
vmovups xmm7, xmmword [rsp + 0x50]
vmovups xmm8, xmmword [rsp + 0x60]
vmovups xmm9, xmmword [rsp + 0x70]
vmovups xmm10, xmmword [rsp + 0x80]
vmovups xmm11, xmmword [rsp + 0x90]
vmovups xmm12, xmmword [rsp + 0xa0]
vmovups xmm13, xmmword [rsp + 0xb0]
add rsp, 0xc0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rdx, str.RandomX_src_aes_hash.cpp
mov r8d, 0x86
lea rcx, str.outputSize___64__0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__assert]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400c4e80
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x88
vmovups xmmword [rsp + 0x20], xmm6
vmovups xmmword [rsp + 0x30], xmm7
vmovups xmmword [rsp + 0x40], xmm8
vmovups xmmword [rsp + 0x50], xmm9
vmovups xmmword [rsp + 0x60], xmm10
vmovups xmmword [rsp + 0x70], xmm11
test dl, 0x3f
jne 0x1400c4fb5
add rdx, r8
vmovdqu xmm11, xmmword [rcx]
vmovdqu xmm10, xmmword [rcx + 0x10]
vmovdqu xmm1, xmmword [rcx + 0x20]
vmovdqu xmm0, xmmword [rcx + 0x30]
cmp r8, rdx
jae 0x1400c4f89
vmovdqu xmm9, xmmword [0x140171e00]
vmovdqu xmm8, xmmword [0x140171e10]
vmovdqu xmm7, xmmword [0x140171e20]
vmovdqu xmm6, xmmword [0x140171e30]
vmovdqu xmm5, xmmword [0x140171e40]
vmovdqu xmm4, xmmword [0x140171e50]
vmovdqu xmm3, xmmword [0x140171e60]
vmovdqu xmm2, xmmword [0x140171e70]
nop dword [rax + rax]
vaesdec xmm11, xmm11, xmm9
vaesenc xmm10, xmm10, xmm9
vaesdec xmm1, xmm1, xmm8
vaesenc xmm0, xmm0, xmm8
vaesdec xmm11, xmm11, xmm7
vaesenc xmm10, xmm10, xmm7
vaesdec xmm1, xmm1, xmm6
add r8, 0x40
vaesenc xmm0, xmm0, xmm6
vaesdec xmm11, xmm11, xmm5
vaesenc xmm10, xmm10, xmm5
vaesdec xmm1, xmm1, xmm4
vaesenc xmm0, xmm0, xmm4
vaesdec xmm11, xmm11, xmm3
vaesenc xmm10, xmm10, xmm3
vaesdec xmm1, xmm1, xmm2
vaesenc xmm0, xmm0, xmm2
vmovdqu xmmword [r8 - 0x40], xmm11
vmovdqu xmmword [r8 - 0x30], xmm10
vmovdqu xmmword [r8 - 0x20], xmm1
vmovdqu xmmword [r8 - 0x10], xmm0
cmp r8, rdx
jb 0x1400c4f18
vmovups xmm6, xmmword [rsp + 0x20]
vmovups xmm7, xmmword [rsp + 0x30]
vmovups xmm8, xmmword [rsp + 0x40]
vmovups xmm9, xmmword [rsp + 0x50]
vmovups xmm10, xmmword [rsp + 0x60]
vmovups xmm11, xmmword [rsp + 0x70]
add rsp, 0x88
ret
lea rdx, str.RandomX_src_aes_hash.cpp
mov r8d, 0xbd
lea rcx, str.outputSize___64__0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__assert]
nop
Function at 0x1400c5340
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x28
test dl, 0x3f
jne 0x1400c53ec
add rdx, rcx
vmovdqu xmm0, xmmword [str._f__nc]
vmovdqu xmm1, xmmword [0x140171d70]
vmovdqu xmm2, xmmword [0x140171d80]
vmovdqu xmm3, xmmword [0x140171d90]
cmp rcx, rdx
jae 0x1400c5398
nop dword [rax]
vaesenc xmm3, xmm3, xmmword [rcx]
vaesdec xmm2, xmm2, xmmword [rcx + 0x10]
vaesenc xmm1, xmm1, xmmword [rcx + 0x20]
vaesdec xmm0, xmm0, xmmword [rcx + 0x30]
add rcx, 0x40
cmp rcx, rdx
jb 0x1400c5378
vmovdqu xmm4, xmmword [0x140171da0]
vaesenc xmm3, xmm3, xmm4
vaesdec xmm2, xmm2, xmm4
vaesenc xmm1, xmm1, xmm4
vaesdec xmm0, xmm0, xmm4
vmovdqu xmm4, xmmword [0x140171db0]
vaesenc xmm3, xmm3, xmm4
vaesdec xmm2, xmm2, xmm4
vaesenc xmm1, xmm1, xmm4
vaesdec xmm0, xmm0, xmm4
vmovdqu xmmword [r8], xmm3
vmovdqu xmmword [r8 + 0x10], xmm2
vmovdqu xmmword [r8 + 0x20], xmm1
vmovdqu xmmword [r8 + 0x30], xmm0
add rsp, 0x28
ret
lea rdx, str.RandomX_src_aes_hash.cpp
mov r8d, 0x3e
lea rcx, str.inputSize___64__0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__assert]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1400c5690
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x60
vmovups xmmword [rsp], xmm6
vmovups xmmword [rsp + 0x10], xmm7
vmovups xmmword [rsp + 0x20], xmm8
vmovups xmmword [rsp + 0x30], xmm9
vmovups xmmword [rsp + 0x40], xmm10
vmovups xmmword [rsp + 0x50], xmm11
vmovdqu xmm4, xmmword [str._f__nc]
vmovdqu xmm5, xmmword [0x140171d70]
vmovdqu xmm3, xmmword [r9]
vmovdqu xmm2, xmmword [r9 + 0x10]
vmovdqu xmm1, xmmword [r9 + 0x20]
vmovdqu xmm0, xmmword [r9 + 0x30]
mov rax, rdx
mov r11, rcx
vmovdqu xmm6, xmmword [0x140171d80]
lea rdx, [rcx + 0x1000]
vmovdqu xmm7, xmmword [0x140171d90]
mov r10, r11
lea rcx, [rcx + rax - 0x1000]
vmovdqu xmm11, xmmword [0x140171dc0]
vmovdqu xmm10, xmmword [0x140171dd0]
lea rbx, [rcx + 0x2000]
vmovdqu xmm9, xmmword [0x140171de0]
vmovdqu xmm8, xmmword [0x140171df0]
mov rax, r10
cmp r10, rcx
jae 0x1400c57a1
nop word cs:[rax + rax]
vaesenc xmm7, xmm7, xmmword [rax]
vaesdec xmm6, xmm6, xmmword [rax + 0x10]
vaesdec xmm3, xmm3, xmm11
vaesenc xmm5, xmm5, xmmword [rax + 0x20]
vmovdqu xmmword [rax], xmm3
vaesdec xmm4, xmm4, xmmword [rax + 0x30]
vaesenc xmm2, xmm2, xmm10
vaesdec xmm1, xmm1, xmm9
vmovdqu xmmword [rax + 0x10], xmm2
vaesenc xmm0, xmm0, xmm8
add rax, 0x40
prefetcht0 byte [rdx]
vmovdqu xmmword [rax - 0x20], xmm1
add rdx, 0x40
vmovdqu xmmword [rax - 0x10], xmm0
cmp rax, rcx
jb 0x1400c5740
mov rax, rcx
sub rax, r10
sub rax, 1
and rax, 0xffffffffffffffc0
lea r10, [r10 + rax + 0x40]
add rcx, 0x1000
cmp rcx, rbx
je 0x1400c57b8
mov rdx, r11
jmp 0x1400c572e
vmovdqu xmmword [r9 + 0x30], xmm0
vmovdqu xmm0, xmmword [0x140171da0]
vmovdqu xmmword [r9], xmm3
vmovups xmm8, xmmword [rsp + 0x20]
vaesenc xmm7, xmm7, xmm0
vaesdec xmm6, xmm6, xmm0
vaesenc xmm5, xmm5, xmm0
vaesdec xmm4, xmm4, xmm0
vmovdqu xmm0, xmmword [0x140171db0]
vmovdqu xmmword [r9 + 0x10], xmm2
vmovdqu xmmword [r9 + 0x20], xmm1
vmovups xmm9, xmmword [rsp + 0x30]
vaesenc xmm7, xmm7, xmm0
vaesdec xmm6, xmm6, xmm0
vmovdqu xmmword [r8], xmm7
vmovups xmm10, xmmword [rsp + 0x40]
vmovdqu xmmword [r8 + 0x10], xmm6
vmovups xmm7, xmmword [rsp + 0x10]
vaesenc xmm5, xmm5, xmm0
vaesdec xmm4, xmm4, xmm0
vmovups xmm6, xmmword [rsp]
vmovdqu xmmword [r8 + 0x20], xmm5
vmovups xmm11, xmmword [rsp + 0x50]
vmovdqu xmmword [r8 + 0x30], xmm4
add rsp, 0x60
pop rbx
ret

Function at 0x1400c8190
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
add rdx, qword [rcx + 0x9e8]
nop dword [rax]
mov rcx, qword [rdx + rax]
xor qword [r8 + rax], rcx
add rax, 8
cmp rax, 0x40
jne 0x1400c81a0
ret
Function at 0x1400c8730
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
add rdx, qword [rcx + 0x9e8]
nop dword [rax]
mov rcx, qword [rdx + rax]
xor qword [r8 + rax], rcx
add rax, 8
cmp rax, 0x40
jne 0x1400c8740
ret
Function at 0x1400c8cd0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
add rdx, qword [rcx + 0x9e8]
nop dword [rax]
mov rcx, qword [rdx + rax]
xor qword [r8 + rax], rcx
add rax, 8
cmp rax, 0x40
jne 0x1400c8ce0
ret
Function at 0x1400c9270
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
add rdx, qword [rcx + 0x9e8]
nop dword [rax]
mov rcx, qword [rdx + rax]
xor qword [r8 + rax], rcx
add rax, 8
cmp rax, 0x40
jne 0x1400c9280
ret
Function at 0x1400caf40
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rcx
mov rcx, rdx
mov edx, 0x200000
mov r8, qword [rax + 0x9f0]
jmp dbg.void fillAes1Rx4<false>(void*, unsigned long long, void*)

Function at 0x1400caf60
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, rcx
mov rcx, rdx
mov edx, 0x880
add r8, 0x40
jmp dbg.void fillAes4Rx4<false>(void*, unsigned long long, void*)

Function at 0x1400caf80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rsi
push rbx
sub rsp, 0x28
cmp qword [rcx + 0x9f8], 0
mov rbx, rcx
je 0x1400cafc0
vmovdqu xmm0, xmmword [0x1401bbd40]
mov ecx, 0x200000
vaesenc xmm0, xmm0, xmm0
vmovdqu xmmword [0x1401bbd40], xmm0
call dbg.randomx::AlignedAllocator<64ull>::allocMemory(unsigned long long)
mov qword [rbx + 0x9f0], rax
add rsp, 0x28
pop rbx
pop rsi
ret
mov ecx, 0x10
call sym.__cxa_allocate_exception
lea rdx, str.Cache_Dataset_not_set
mov rcx, rax
mov rbx, rax
call method.std::invalid_argument.invalid_argument_char_const_
lea r8, [method.std::invalid_argument.invalid_argument__]
mov rcx, rbx
lea rdx, [0x14018a110]
call sym.__cxa_throw
mov rsi, rax
mov rcx, rbx
vzeroupper
call sym.__cxa_free_exception
mov rcx, rsi
call sym._Unwind_Resume
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400cb200
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rcx
mov rcx, rdx
mov edx, 0x200000
mov r8, qword [rax + 0x9f0]
jmp dbg.void fillAes1Rx4<true>(void*, unsigned long long, void*)

Function at 0x1400cb220
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, rcx
mov rcx, rdx
mov edx, 0x880
add r8, 0x40
jmp dbg.void fillAes4Rx4<true>(void*, unsigned long long, void*)

Function at 0x1400cb4b0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rcx
mov rcx, rdx
mov edx, 0x200000
mov r8, qword [rax + 0x9f0]
jmp dbg.void fillAes1Rx4<false>(void*, unsigned long long, void*)

Function at 0x1400cb4d0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, rcx
mov rcx, rdx
mov edx, 0x880
add r8, 0x40
jmp dbg.void fillAes4Rx4<false>(void*, unsigned long long, void*)
Function at 0x1400cb4f0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rsi
push rbx
sub rsp, 0x28
cmp qword [rcx + 0x9f8], 0
mov rbx, rcx
je 0x1400cb530
vmovdqu xmm0, xmmword [0x1401bbd40]
mov ecx, 0x200000
vaesenc xmm0, xmm0, xmm0
vmovdqu xmmword [0x1401bbd40], xmm0
call dbg.randomx::LargePageAllocator::allocMemory(unsigned long long)
mov qword [rbx + 0x9f0], rax
add rsp, 0x28
pop rbx
pop rsi
ret
mov ecx, 0x10
call sym.__cxa_allocate_exception
lea rdx, str.Cache_Dataset_not_set
mov rcx, rax
mov rbx, rax
call method.std::invalid_argument.invalid_argument_char_const_
lea r8, [method.std::invalid_argument.invalid_argument__]
mov rcx, rbx
lea rdx, [0x14018a110]
call sym.__cxa_throw
mov rsi, rax
mov rcx, rbx
vzeroupper
call sym.__cxa_free_exception
mov rcx, rsi
call sym._Unwind_Resume
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400cb770
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rcx
mov rcx, rdx
mov edx, 0x200000
mov r8, qword [rax + 0x9f0]
jmp dbg.void fillAes1Rx4<true>(void*, unsigned long long, void*)

Function at 0x1400cb790
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, rcx
mov rcx, rdx
mov edx, 0x880
add r8, 0x40
jmp dbg.void fillAes4Rx4<true>(void*, unsigned long long, void*)
Function at 0x1400cbdd0
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp byte [0x14016e5e0], 0
jne 0x1400cbed6
mov byte [0x14016e5e0], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x1400cbeac
mov rbx, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [rbx], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add rbx, rax
mov rcx, rbx
call sym.__cxa_demangle
mov ecx, 2
mov rsi, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rdi, rax
call rsi
mov edx, 1
lea rcx, str.terminate_called_after_throwing_an_instance_of_
mov r8d, 0x30
mov r9, rax
call sym.fwrite
mov edx, dword [rsp + 0x2c]
mov ecx, 2
test edx, edx
je 0x1400cbe9d
call rsi
mov rcx, rbx
mov rdx, rax
call sym.fputs
mov ecx, 2
call rsi
mov r8d, 2
mov edx, 1
lea rcx, [0x140181601]
mov r9, rax
call sym.fwrite
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x1400cbe98
mov rcx, rdi
call sym.free
call sym.__cxa_rethrow
call rsi
mov rcx, rdi
mov rdx, rax
call sym.fputs
jmp 0x1400cbe67
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x2d
mov edx, 1
lea rcx, str.terminate_called_without_an_active_exception_n
mov r9, rax
call sym.fwrite
call sym.abort
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8d, 0x1d
mov edx, 1
lea rcx, str.terminate_called_recursively_n
mov r9, rax
call sym.fwrite
call sym.abort
sub rdx, 1
mov rcx, rax
jne 0x1400cbf6b
call sym.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sym.fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
jmp 0x1400cbed1
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x1400cbed1

Function at 0x1401367b0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x1401367d8
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x140136820
cdqe
add rsi, rax
sub rbx, rax
jne 0x1401367f0
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x14013682c
call rbp
cmp dword [rax], 4
je 0x1401367f0
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140165e40
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
xor edx, edx
lea rcx, [0x14016ce60]
movabs rdi, 0x2e78786362696c67
movabs r12, 0x6c6f6f705f68652e
call sym.pthread_mutex_init
pxor xmm0, xmm0
lea rcx, str.GLIBCXX_TUNABLES
mov qword [0x14016ce78], 0
movups xmmword [0x14016ce68], xmm0
call sym.getenv
mov dword [rsp + 0x40], 0
mov rbx, rax
lea rax, str.obj_size
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], rax
lea rax, str.obj_count
mov qword [rsp + 0x48], 9
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x100
test rbx, rbx
jne 0x140165ef5
jmp 0x140165f9f
mov rcx, rbx
mov edx, 0x3a
call sym.strchr
mov rbx, rax
test rax, rax
je 0x140165f50
xor eax, eax
cmp byte [rbx], 0x3a
sete al
add rbx, rax
cmp qword [rbx], rdi
jne 0x140165ee0
cmp qword [rbx + 7], r12
jne 0x140165ee0
cmp byte [rbx + 0xf], 0x2e
jne 0x140165ee0
add rbx, 0x10
lea rbp, [rsp + 0x30]
lea r13, [rsp + 0x60]
mov rsi, qword [rbp]
mov rcx, qword [rbp + 8]
test rsi, rsi
je 0x140165f3b
mov r8, rsi
mov rdx, rbx
call sym.memcmp
test eax, eax
jne 0x140165f45
cmp byte [rbx + rsi], 0x3d
je 0x140165fd5
add rbp, 0x18
cmp rbp, r13
jne 0x140165f1f
jmp 0x140165ee0
mov eax, dword [rsp + 0x58]
mov edx, 0x1000
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [rsp + 0x40]
test eax, eax
cmove eax, ecx
movsxd rbx, eax
movsxd rax, edx
add rbx, 0x26
imul rbx, rax
shl rbx, 3
mov qword [0x14016ce78], rbx
jne 0x140165faf
lea rcx, [sym.__tcf_0_1]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp dbg.atexit
mov qword [0x14016ce78], 0x16000
mov ebx, 0x16000
mov rcx, rbx
call sym.malloc
mov qword [0x14016ce70], rax
test rax, rax
je 0x14016600c
xor edx, edx
mov qword [0x14016ce68], rax
mov qword [rax], rbx
mov qword [rax + 8], rdx
jmp 0x140165f87
lea rdx, [rsp + 0x28]
lea rcx, [rbx + rsi + 1]
xor r8d, r8d
call sym.strtoul
mov rbx, qword [rsp + 0x28]
movzx edx, byte [rbx]
cmp dl, 0x3a
je 0x140165ffc
test dl, dl
jne 0x140165ee0
test eax, eax
js 0x140165ee0
mov dword [rbp + 0x10], eax
jmp 0x140165ee0
xor ecx, ecx
mov qword [0x14016ce78], rcx
jmp 0x140165f87
Function at 0x140001010
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140228900]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov rbx, rcx
mov ecx, 8
call fcn.14000d470
test rax, rax
je 0x140001041
mov qword [rax], rdi
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140001440]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14000108e
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14000d980
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x140001300
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rdx + 0x3f], 0
mov rbx, rcx
je 0x140001326
xor eax, eax
lea r8d, [rax - 0x2b]
xor byte [rdx + rax], r8b
inc rax
cmp rax, 0x3e
jb 0x140001311
mov byte [rdx + 0x3f], 0
call fcn.1400010a0
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140001d40
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x40
mov rcx, qword [0x14022a3d0]
xor ebx, ebx
mov eax, dword [0x140228a1c]
mov dword [0x140228a18], eax
test rcx, rcx
jne 0x140001eea
mov rax, qword gs:[0x60]
mov r11d, 0xf4d8b55
mov qword [rsp + 0x60], rbp
mov ebp, ebx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x38], rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov r12, qword [rcx + 0x10]
mov rsi, r12
nop
movups xmm0, xmmword [rsi + 0x58]
movd eax, xmm0
sub ax, 8
test ebp, ebp
je 0x140001dec
psrldq xmm0, 8
mov edx, 0x811c9dc5
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x140001de4
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x140001dd0
cmp edx, ebp
jne 0x140001eb3
mov r9, qword [rsi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rcx, qword [rax + r9 + 0x88]
mov r15, rcx
mov r10d, ecx
shr r15, 0x20
add r10, r9
cmp r10, r9
je 0x140001eb3
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x140001eb3
mov r14d, dword [r10 + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [r14 + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140001e67
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140001e50
cmp edx, r11d
je 0x140001e73
test r8d, r8d
jne 0x140001e30
jmp 0x140001eb3
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov ecx, dword [rcx + rdx*4]
add rcx, r9
cmp rcx, r10
jbe 0x140001ec5
lea rax, [r15 + r10]
cmp rcx, rax
jae 0x140001ec5
mov ebp, 0x811c9dc5
mov rsi, r12
mov dword [rsp + 0x58], ebp
mov dword [rsp + 0x5c], ebp
mov r11, qword [rsp + 0x58]
shr r11, 0x20
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r12
jne 0x140001da0
mov rcx, rbx
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov qword [0x14022a3d0], rcx
call rcx
mov ecx, dword [0x140228a18]
mov dword [0x140228a1c], eax
test ecx, ecx
je 0x140001f4b
sub eax, ecx
cmp eax, 0x1770
jbe 0x140001f4b
mov dword [rsp + 0x50], 0xbdbabf81
mov word [rsp + 0x54], 0x100
nop dword [rax]
nop dword [rax + rax]
lea eax, [rbx - 0x2b]
xor byte [rsp + rbx + 0x50], al
inc rbx
cmp rbx, 4
jb 0x140001f20
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x55], 0
call fcn.140004850
mov qword [0], 1
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x140001f60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140001f83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x2b]
xor byte [rcx + rax], dl
inc rax
cmp rax, 4
jb 0x140001f70
mov byte [rcx + 5], 0
mov rax, rcx
ret
Function at 0x140004640
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x14022a410]
test rax, rax
jne 0x140004825
xor r10d, r10d
mov dword [rsp + 0x28], r10d
mov eax, 0xfaba0065
mov dword [rsp + 0x24], eax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov r11, qword [rcx + 0x10]
mov qword [rsp + 0x48], r11
mov r15, r11
mov qword [rsp + 0x50], r11
mov rcx, r11
nop dword [rax + rax]
movups xmm0, xmmword [rcx + 0x58]
movups xmmword [rsp + 0x58], xmm0
movd ecx, xmm0
sub cx, 8
mov word [rsp + 0x58], cx
test r10d, r10d
je 0x1400046f6
mov rdx, qword [rsp + 0x60]
movzx ecx, cx
shr rcx, 1
lea r9, [rdx + rcx*2]
mov r8d, 0x811c9dc5
mov qword [rsp + 0x38], rdx
cmp rdx, r9
je 0x1400046ed
movsx ecx, byte [rdx]
xor ecx, r8d
imul r8d, ecx, 0x1000193
add rdx, 2
jmp 0x1400046d0
cmp r8d, r10d
jne 0x140004805
mov rbx, qword [r11 + 0x30]
mov qword [rsp + 0x68], rbx
movsxd rcx, dword [rbx + 0x3c]
mov r14, qword [rcx + rbx + 0x88]
mov qword [rsp + 0xa8], r14
mov r9d, r14d
add r9, rbx
mov qword [rsp + 0x70], r9
shr r14, 0x20
mov dword [rsp + 0x78], r14d
cmp r9, rbx
je 0x140004805
mov edi, dword [r9 + 0x18]
mov dword [rsp + 0x20], edi
nop dword [rax + rax]
mov ecx, edi
dec edi
mov dword [rsp + 0x20], edi
test ecx, ecx
je 0x140004805
mov edx, dword [r9 + 0x20]
add rdx, rbx
mov r8d, dword [rdx + rdi*4]
add r8, rbx
mov qword [rsp + 0x40], r8
mov edx, 0x811c9dc5
nop dword [rax + rax]
movsx ecx, byte [r8]
inc r8
mov qword [rsp + 0x40], r8
test cl, cl
jne 0x1400047f8
cmp edx, eax
jne 0x1400047f3
mov ecx, dword [r9 + 0x1c]
add rcx, rbx
mov eax, dword [r9 + 0x24]
add rax, rbx
movzx eax, word [rax + rdi*2]
mov edx, dword [rcx + rax*4]
add rdx, rbx
cmp rdx, r9
jbe 0x14000481b
lea rax, [r9 + r14]
cmp rdx, rax
jae 0x14000481b
mov r10d, 0x811c9dc5
mov dword [rsp + 0xa0], r10d
mov eax, r10d
mov dword [rsp + 0xa4], eax
mov qword [rsp + 0x30], rdx
cmp byte [rdx], 0x2e
je 0x1400047d1
inc rdx
jmp 0x1400047c2
inc rdx
mov qword [rsp + 0x30], rdx
cmp byte [rdx], 0
je 0x1400047e0
jmp 0x1400047d1
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x28], r10d
mov r11, r15
mov qword [rsp + 0x48], r15
jmp 0x140004805
jmp 0x140004740
xor ecx, edx
imul edx, ecx, 0x1000193
jmp 0x140004770
mov r11, qword [r11]
mov rcx, r11
mov qword [rsp + 0x48], r11
cmp r11, r15
jne 0x1400046a0
xor edx, edx
mov qword [0x14022a410], rdx
mov rax, rdx
mov ecx, 0x13333337
call rax
jmp 0x140004830
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret