joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008b6e0
Capabilities:
Persist via run registry key

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1400dc3e8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rcx, qword [0x1400dc258]
lea rdx, [rsp + 0x40]
and qword [rsp + 0x40], 0
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov qword [rsp + 0x28], rdx
xor r9d, r9d
mov rdx, 0xffffffff80000001
mov dword [rsp + 0x20], 0xf003f
mov rax, qword [rcx]
mov rax, qword [rax + 0x108]
call qword [case.0x14006f593.0]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400502c0
mov rcx, qword [0x1400dc258]
lea r8, [0x1400b0490]
mov rdx, qword [rsp + 0x40]
mov rax, qword [rcx]
mov rax, qword [rax + 0x478]
call qword [case.0x14006f593.0]
mov rcx, qword [0x1400dc258]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
mov rdx, qword [rcx]
cmovle ebx, eax
mov rax, qword [rdx + 0x100]
mov rdx, qword [rsp + 0x40]
call qword [case.0x14006f593.0]
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140092030
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1400dc3e8]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edi, edi
mov qword [rsp + 0x40], rdi
movdqa xmm0, xmmword [0x1400b8430]
movdqu xmmword [rsp + 0x50], xmm0
mov word [rsp + 0x40], di
lea rcx, [rsp + 0x40]
call fcn.1400527c8
mov ebx, eax
test eax, eax
js 0x14005b7bd
mov rcx, qword [0x1400dc258]
mov rax, qword [rcx]
mov r10, qword [rax + 0xd0]
mov eax, dword [rsp + 0x50]
lea eax, [rax*2 + 2]
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 1
lea r9, [0x1400b0490]
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rdx, 0xffffffff80000001
mov rax, r10
call qword [case.0x14006f593.0]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
lea rcx, [rsp + 0x40]
call fcn.140007f4c
mov eax, ebx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140092030
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
test cl, cl
jne 0x14005b710
jmp 0x14005020c
mov cl, dl
jmp 0x14005d25c

Function at 0x14008ba3c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rdx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [r8 + rcx]
movabs r9, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, r9
cmp r8, 2
jb 0x14008ba49
mov rax, rdx
ret
Function at 0x14008f840
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1400dc3e8]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r14b, r8b
mov esi, edx
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov qword [rcx], r15
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 7
mov word [rcx], r15w
mov dword [rsp + 0x30], 1
call fcn.14006be98
mov rcx, rax
mov rax, qword [rax]
mov rax, qword [rax + 0x358]
call qword [case.0x14006f593.0]
mov dil, al
test al, al
jne 0x14008f972
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x104
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14008f972
lea rdx, str.FileSyncConfig.exe
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_wcsstr
test rax, rax
je 0x14008f972
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x14008f91b
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140016628
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], 9
lea r9, str._allusers
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
call fcn.14003c004
cmp rax, 0xffffffffffffffff
setne dil
lea rcx, [rsp + 0x40]
call fcn.140007f4c
mov rdx, rbx
mov cl, dil
call fcn.14005492c
mov r8d, 1
lea rdx, [0x1400b0634]
mov rcx, rbx
call fcn.140024870
mov dl, r14b
mov ecx, esi
call fcn.14008fbbc
mov edx, eax
lea rcx, [rsp + 0x40]
call fcn.14003da9c
mov dword [rsp + 0x30], 3
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
mov rcx, rbx
call fcn.140024870
nop
lea rcx, [rsp + 0x40]
call fcn.140007f4c
mov rax, rbx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140092030
mov rbx, qword [rsp + 0x2c8]
add rsp, 0x280
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140091460
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov rax, qword [0x1400dc3e8]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15, r9
mov rsi, r8
mov rbx, rdx
mov dword [rbp - 0x39], 1
cmp qword [rdx + 0x18], 8
jb 0x14009149f
mov rdx, qword [rdx]
xor r12d, r12d
mov qword [rbp - 0x31], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x21], xmm0
or rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp word [rdx + r8*2], r12w
jne 0x1400914b5
lea rcx, [rbp - 0x31]
call fcn.140016628
nop
mov r9, r15
mov r8, rsi
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x31]
call fcn.14009164c
mov r14d, eax
lea rcx, [rbp - 0x31]
call fcn.140007f4c
mov dword [rbp - 0x39], 2
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400914fc
mov rdx, qword [rbx]
mov qword [rbp - 0x31], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x21], xmm0
mov r8, rdi
inc r8
cmp word [rdx + r8*2], r12w
jne 0x14009150b
lea rcx, [rbp - 0x31]
call fcn.140016628
nop
mov r9, r15
mov r8, rsi
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x31]
call fcn.14009164c
nop
lea rcx, [rbp - 0x31]
call fcn.140007f4c
mov rdx, qword [str.SoftwareMicrosoftWindowsCurrentVersionExplorerDesktopNameSpace_]
mov qword [rbp - 9], r12
xorps xmm0, xmm0
movdqu xmmword [rbp + 7], xmm0
inc rdi
cmp word [rdx + rdi*2], r12w
jne 0x14009154f
mov r8, rdi
lea rcx, [rbp - 9]
call fcn.140016628
nop
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140091573
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rbp - 9]
call fcn.140024870
lea rdx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rdx, qword [rbp - 9]
xor r9d, r9d
mov edi, 0x1010b
mov r8d, edi
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
mov rdx, qword [str.SoftwareMicrosoftWindowsCurrentVersionExplorerHideDesktopIconsNewStartPanel]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
js 0x140091610
cmp qword [rbx + 0x18], 8
jb 0x1400915eb
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140091708
test esi, esi
cmovne edi, esi
test r14d, r14d
cmovne edi, r14d
lea rcx, [rbp - 9]
call fcn.140007f4c
mov eax, edi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140092030
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x140092b90
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push r14
push r15
sub r12, r12
add r12, 0x60
mov r14, qword gs:[r12]
push r11
Function at 0x14009305c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400930a6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400930a6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400930a6
mov eax, SHFlushSFCache
cmp word [rcx + 0x18], ax
jne 0x1400930a6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400930a6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400930a8
xor al, al
add rsp, 0x28
ret
Function at 0x6d9c89e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d9e95e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d9c8b68
mov rax, qword [0x6d9e95e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d9c8a2c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d9c8ab5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d9c8a10
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d9c8b9d
mov rax, qword [0x6d9e95e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d9e95e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d9c8b80
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d9c8aae
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d9c8b10
add dword [0x6d9e95e4], 1
cmp edi, 8
jae 0x6d9c8ae3
test dil, 4
jne 0x6d9c8b54
test edi, edi
je 0x6d9c8ad8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d9c8b6f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d9c8ad8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d9c8afc
jmp 0x6d9c8ad8
add rsi, qword [0x6d9e95e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d9c8aae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d9c8ad8
xor esi, esi
jmp 0x6d9c8a37
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d9c8ad8
mov rax, qword [0x6d9e95e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d9c92f0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d9e98c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d9e98a0]
test rbx, rbx
je 0x6d9c9344
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d9c933b
test rsi, rsi
je 0x6d9c933b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d9c9320
lea rcx, [0x6d9e98c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d9c9580
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d9c9590
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d9c95a0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d9c95e1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d9c95d8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d9c95e3
add rax, 0x28
cmp rax, r9
jne 0x6d9c95c4
xor eax, eax
ret

Function at 0x6d9c9680
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d9e61f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d9c96ed
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d9c96ed
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d9c96ed
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d9c96e4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d9c96ef
add rax, 0x28
cmp rax, r9
jne 0x6d9c96d0
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d9c97f0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d9e61f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d9c9810
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d9c9808
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d9c986d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d9c9864
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d9c9874
add rax, 0x28
cmp rax, r9
jne 0x6d9c9850
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d9c9890
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d9e61f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d9c98fe
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d9c98fe
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d9c98fe
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d9c98fe
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d9c98f5
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d9c9905
add rcx, 0x28
cmp rcx, rax
jne 0x6d9c98e0
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d9c9918
jmp 0x6d9c98fe
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d9c9926
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d9c98fe
test r9d, r9d
jg 0x6d9c9910
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d9c9c60
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140a610b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140a61237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140a610e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a610c7
add dl, dl
jne 0x140a610ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a6114e
xor eax, eax
add dl, dl
jne 0x140a610fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a61205
add dl, dl
jne 0x140a6110e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a6111b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a61128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a61135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140a61142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140a610d6
mov eax, 1
add dl, dl
jne 0x140a6115e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a6116b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a61153
sub eax, ebx
mov ebx, 1
jne 0x140a611a4
mov ecx, 1
add dl, dl
jne 0x140a61186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a61193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a6117b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a610d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140a611c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a611cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a611b5
cmp eax, 0x7d00
jae 0x140a611f3
cmp eax, 0x500
jb 0x140a611ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a610d6
cmp eax, 0x7f
ja 0x140a611f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a610d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140a6122a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140a610d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1400011b0
Capabilities:
Encode data using xor

Disassembly:
push r15
mov eax, 0x32808
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.1400021c0
sub rsp, rax
movaps xmmword [rsp + 0x327d0], xmm6
movaps xmmword [rsp + 0x327e0], xmm7
movaps xmmword [rsp + 0x327f0], xmm8
lea r14, [0x140003040]
lea r15, [0x140003060]
movabs rdx, 0x610042006c0065
movq xmm3, r15
movq xmm8, r14
movabs rdi, 0x72006500730075
movabs rbp, 0x64002e00320033
lea rax, [rsp + 0x44]
mov qword [rsp + 0xa8], rdx
lea r12, [rsp + 0x7d0]
movabs rdx, 0x6c006c0064
movq xmm2, rax
movq xmm7, r12
mov qword [rsp + 0x68], rbp
lea rax, [0x140003070]
movq xmm6, rax
lea rax, [r14 + 0x10]
mov qword [rsp + 0xb6], rdx
movabs rdx, 0x2e00740065006e
movq xmm4, rax
punpcklqdq xmm7, xmm2
movabs rax, 0x6e00720065004b
mov dword [rsp + 0x44], 0
punpcklqdq xmm6, xmm3
mov qword [rsp + 0xa0], rax
movabs rax, 0x2e006500730061
punpcklqdq xmm8, xmm4
mov qword [rsp + 0xae], rax
movabs rax, 0x69006e00690077
mov qword [rsp + 0x80], rax
movabs rax, 0x6c006c0064
mov qword [rsp + 0x88], rdx
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x6e], rax
call fcn.1400021fd
invalid
Function at 0x140001c90
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea r11, [0x140003840]
mov rax, qword [rcx + 8]
mov rbx, qword [rcx]
mov rcx, rax
mov rsi, rax
shr rcx, 0x20
shr rsi, 0x38
mov byte [rsp + 0x1e], cl
mov rcx, rax
lea r14, [rdx + 0x10]
shr rcx, 0x28
mov qword [rdx], rbx
mov byte [rsp + 0x18], cl
mov rcx, rax
shr rcx, 0x30
mov qword [rdx + 8], rax
mov byte [rsp + 0x1f], cl
mov qword [rsp + 0x10], rsi
lea rsi, [0x1400357e1]
nop dword [rax]
movzx ecx, byte [rsp + 0x1e]
movzx r9d, byte [rsp + 0x10]
movzx r8d, byte [rsp + 0x1f]
movzx edx, byte [rsp + 0x18]
movzx ecx, byte [r11 + rcx]
movzx r9d, byte [r11 + r9]
movzx r8d, byte [r11 + r8]
movzx edx, byte [r11 + rdx]
shl ecx, 8
xor dl, byte [rsi]
or ecx, r9d
movzx edx, dl
shl ecx, 8
or ecx, r8d
shl ecx, 8
or ecx, edx
xor ecx, ebx
shr rbx, 0x20
xor ebx, ecx
mov r13d, ecx
mov r12d, ecx
mov edx, ebx
mov r15d, ebx
mov r9d, ebx
shr r13d, 0x18
shr edx, 0x18
shr r15d, 0x10
xor r9d, eax
movzx r13d, r13b
movzx edx, dl
movzx r15d, r15b
shr rax, 0x20
mov edi, r9d
shl rdx, 8
mov r8d, eax
shr r12d, 0x10
mov ebp, r9d
or rdx, r15
xor r8d, r9d
movzx r12d, r12b
shr edi, 0x10
mov qword [rsp], rdx
movzx edx, bh
movzx ebx, bl
mov eax, r8d
mov r15, rdx
mov rdx, qword [rsp]
movzx eax, ah
mov r10d, r8d
mov dword [rsp + 0x18], eax
mov eax, r8d
shr r10d, 0x10
movzx edi, dil
shl rdx, 8
shr eax, 0x18
mov byte [rsp + 0x1f], r10b
movzx r10d, r10b
or rdx, r15
mov byte [rsp + 0x10], al
movzx eax, al
shr ebp, 0x18
shl rdx, 8
mov byte [rsp + 0x1e], r8b
movzx ebp, bpl
or rdx, rbx
movzx ebx, ch
movzx ecx, cl
shl rdx, 8
or rdx, r13
shl rdx, 8
or rdx, r12
shl rdx, 8
or rdx, rbx
shl rax, 8
mov ebx, r8d
movzx r8d, r8b
or rax, r10
movzx ebx, bh
shl rdx, 8
add rsi, 1
shl rax, 8
or rdx, rcx
add r14, 0x10
or rax, rbx
mov ebx, r9d
movzx r9d, r9b
mov qword [rsp], rdx
shl rax, 8
or rax, r8
shl rax, 8
or rax, rbp
shl rax, 8
or rax, rdi
movzx edi, bh
mov rbx, qword [rsp]
shl rax, 8
or rax, rdi
lea rdi, [0x1400357eb]
shl rax, 8
or rax, r9
mov qword [rsp + 8], rax
movdqa xmm0, xmmword [rsp]
movups xmmword [r14 - 0x10], xmm0
cmp rsi, rdi
jne 0x140001cf0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140002527
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x88]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x1c]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x24]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x20]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x38], rax
mov dword [rbp - 4], 0
jmp 0x140002611
mov eax, dword [rbp - 4]
lea rdx, [rax*4]
mov rax, qword [rbp - 0x38]
add rax, rdx
mov eax, dword [rax]
mov edx, eax
mov rax, qword [rbp + 0x10]
add rdx, rax
mov rax, qword [rbp + 0x18]
mov rcx, rax
call fcn.1400024c0
test eax, eax
jne 0x14000260d
mov rax, qword [rbp + 0x10]
mov edx, dword [rbp - 4]
lea rcx, [rdx + rdx]
mov rdx, qword [rbp - 0x30]
add rdx, rcx
movzx edx, word [rdx]
movzx edx, dx
lea rcx, [rdx*4]
mov rdx, qword [rbp - 0x28]
add rdx, rcx
mov edx, dword [rdx]
mov edx, edx
add rax, rdx
jmp 0x140002622
add dword [rbp - 4], 1
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x18]
cmp dword [rbp - 4], eax
jb 0x1400025b0
mov eax, 0
add rsp, 0x60
pop rbp
ret
Function at 0x140011055
Capabilities:
Hash data using djb2

Disassembly:
jmp 0x140011e50
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x140028129]
call fcn.140011424
mov dword [rbp + 4], 0x1505
mov dword [rbp + 0x24], 0
mov rax, qword [rbp + 0x120]
movzx eax, word [rax]
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x24]
mov dword [rbp + 0xf4], eax
mov rax, qword [rbp + 0x120]
add rax, 2
mov qword [rbp + 0x120], rax
cmp dword [rbp + 0xf4], 0
je 0x140011ebf
mov eax, dword [rbp + 4]
shl eax, 5
add eax, dword [rbp + 4]
add eax, dword [rbp + 0x24]
mov dword [rbp + 4], eax
jmp 0x140011e7d
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140011113
Capabilities:
Resolve function by djb2 hash

Disassembly:
jmp 0x1400125c0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x1400282db]
call fcn.140011424
mov ecx, 0x6ddb9555
call fcn.140011023
mov rcx, qword [rbp + 0xe0]
mov qword [rcx], rax
mov edx, 0x5fbff0fb
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call fcn.1400111bd
mov rcx, qword [rbp + 0xe0]
mov qword [rcx + 0x10], rax
mov edx, 0xe19e5fe
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call fcn.1400111bd
mov rcx, qword [rbp + 0xe0]
mov qword [rcx + 8], rax
mov edx, 0x382c0f97
mov rax, qword [rbp + 0xe0]
mov rcx, qword [rax]
call fcn.1400111bd
mov rcx, qword [rbp + 0xe0]
mov qword [rcx + 0x18], rax
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x14001111d
Capabilities:
Hash data using djb2

Disassembly:
jmp 0x140011db0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x140028129]
call fcn.140011424
mov dword [rbp + 4], 0x1505
mov dword [rbp + 0x24], 0
mov rax, qword [rbp + 0x120]
movsx eax, byte [rax]
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x24]
mov dword [rbp + 0xf4], eax
mov rax, qword [rbp + 0x120]
inc rax
mov qword [rbp + 0x120], rax
cmp dword [rbp + 0xf4], 0
je 0x140011e1e
mov eax, dword [rbp + 4]
shl eax, 5
add eax, dword [rbp + 4]
add eax, dword [rbp + 0x24]
mov dword [rbp + 4], eax
jmp 0x140011ddd
mov eax, dword [rbp + 4]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret