joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1445f3344
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rcx - 0x5e2ef3a5], rcx
mov rcx, qword [rcx + r10 - 0x5e2ef39d]
rol dword [rsp], 0xfb
and rbx, rcx
not rbx
mov r8d, 0x6827cd38
mov edi, dword [rsp + r8 - 0x6827cd36]
mov qword [r10 + rdi - 0x2ae9], rbx
sub r8b, dil
mov ebp, dword [r8 + r11 - 0x6827cd47]
push rdi
cmovno r8, rdi
lea r11, [r11 + r8 - 0x2aed]
xor dword [rsp + rdi - 0x2aeb], r8d
xor ebp, esi
lea rax, [rdi + rdi*4 + 0x60830600]
sub ebp, 0xc403b8af
pop rdi
inc word [rsp + r8*2 - 0x55e2]
xor ebp, 0x6a2d8418
lea rdx, [rax*8 + 0x598866b4]
rol qword [rsp + r8*2 - 0x55e2], 0x19
pop rdi
not ebp
ror ax, 0xa1
rol ebp, 3
push rsi
lea r8, [r8 + r8*8 + 0x2d05ca99]
xor dword [rsp + r8 - 0x2d074d12], ebp
push rax
rol word [rsp + r8*2 - 0x5a0e9a1e], 0x8b
pop rax
pop rsi
call fcn.1445d60df

Function at 0x1445fa37d
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
add dx, dx
shr edx, cl
push rsi
not rdx
sub r8b, 0x3f
bswap edi
xor dword [rsp + rbx*2 - 0x154888], eax
call fcn.1445dca13
or cl, r8b
add bp, 0x386
mov edx, dword [r11 + 1]
lea rbx, [rcx*8 + 0x348fb899]
cmovl ecx, r8d
sbb r11, 0xfffffffffffffffb
movsx edi, bx
ror rbx, 0x11
movzx eax, bx
xor edx, esi
shr r8, 0xf7
inc edx
call fcn.1445fcb66
call fcn.1445b85ff
mov r8d, dword [r10]
mov edi, 0x8933459d
mov ebx, edi
ror bl, 0xe1
mov ebp, dword [r10 + 4]
mov ecx, ebx
sar rbx, 0x4b
mov cl, byte [r10 + rbx*2 - 0x224cc8]
lea rax, [rdi + rdi + 0x1704bbbf]
sbb bl, al
lea r10, [r10 + rbx - 0x112668]
shl ebx, 0x96
shrd r8d, ebp, cl
neg bx
mov ecx, edi
neg edi
mov dword [r10 + rdi - 0x76ccba63], r8d
mov edi, dword [r11 + rdi - 0x76ccba63]
sub bx, cx
mov edx, 0xb02c4b3c
add r11, 4
lea rdx, [rdx + rdx*2 - 0x5f4a5a68]
sal cx, 0x45
neg dx
xor edi, esi
lea edi, [rbx + rdi - 0x7b572e59]
neg edi
lea rbp, [rbx + rdx*2 + 0x3a225d35]
lea edi, [rbx + rdi - 0x7c40e3b6]
neg rbp
bswap edi
inc rbp
jle 0x1445fe8fa
mov rsi, qword [rsp + rdi*2 - 0x4de4ead8]
mov qword [rsp + rdi*2 - 0x4de4eae0], 0xffffffffd630df8a
dec qword [rsp + rdi*2 - 0x4de4eae0]
movsxd r8, r8d
jno 0x144628e06
movsx ecx, bpl
sal edx, 5
not eax
jns 0x1445a2158

Function at 0x1445fb6e7
Capabilities:
Manually build aes constants

Disassembly:
mov qword [rsp + rdi*2], 0xffffffff818b1e1c
mov qword [r10 + rbp - 0x810280a], rax
dec bpl
mov eax, dword [rbp + r11 - 0x8102811]
lea rbx, [rbp + r8*4 - 0x71fd794e]
lea r11, [r11 + rbp - 0x810280d]
xchg byte [rsp + rbp - 0x810280f], bl
movzx edx, r8b
xor eax, esi
not ebx
movzx ecx, di
and qword [rsp + rbp - 0x8102811], rbp
bswap eax
xor rbp, rcx
lea eax, [rbp + rax + 0x34ae1fa6]
bswap rdx
sar edx, 0xdd
bswap eax
neg word [rsp + rbp*2 - 0x10205021]
jle 0x1445ffe6d
xor eax, 0x88ae1b0d
shr byte [rsp + rbp - 0x810280f], 2
and r8w, cx
shr rdi, 0xbe
rol eax, 3
xadd cx, dx
or dl, dil
lea eax, [rax + rbx*2 + 0x172b2d49]
adc byte [rsp + rbp - 0x8102811], 0x81
call fcn.1445bdb34
Function at 0x14460287c
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
lea ecx, [rcx + rbp - 0x1b82b558]
mov qword [rsp + rdx*2], rax
and al, bpl
rol ecx, 3
lea rbx, [rdi*8 - 0x4f00d6b]
call fcn.1445e298d

Function at 0x14460289a
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
mov qword [rsp + 8], r8
mov qword [rax], rbx
call fcn.1445ff15b
call fcn.1445dbd98

Function at 0x144602900
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
mov qword [rsp + rbp*2 - 0x566e], 0x6191b61a
xadd dx, di
xor r8d, esi
xadd byte [rsp + rbp - 0x2b29], bpl
sbb r8d, 0xa4125203
not r8d
lea rax, [rdi + rdx + 0x793d2c10]
sub eax, edi
rol r8d, 1
sub r8d, 0xb3077da3
not r8d
pop rdi
mov qword [rsp + rdi - 0x6191b61a], rsi
or dx, dx
ja 0x1445c8aa5

Function at 0x144602eaf
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step

Disassembly:
inc eax
not eax
sal cl, 0xa1
seta bpl
jb 0x144636aea
lea eax, [rcx + rax + 0x3c05da23]
bswap r8d
bswap eax
push rsi
xor dword [rsp + rcx*2 - 0x10], eax
pop rsi
shr rbx, cl
jne 0x1445daf2c
movsxd rax, eax
ror ebp, cl
adc r9, rax
jmp 0x14460bf28
ror edx, 1
shr rbx, 0x8c
dec word [rsp + rbp*8 - 0x620]
rol byte [rsp + rbp - 0xbc], 0xe4
bswap edx
movsx edi, byte [rsp + rbp - 0xbc]
inc edx
mov qword [rsp + rbp - 0xc6], rcx
xor edx, 0x92c6481
call fcn.1445f78bb
movzx ecx, dil
mov qword ss:[r8 + rcx*8 - 0x28], rbx
mov eax, dword [r11 + rcx*4 - 0x14]
lea rdx, [rcx + rdi*2 - 0x54d555d]
dec cl
mov ebp, edx
add r11, rcx
lea r8, [rdx + rdi - 0xf4ee3c5]
xor eax, esi
and cl, cl
lea rbx, [rbp + r8*8 + 0x6281edac]
jns 0x1445c8525
lea rax, [rsp + rcx + 0x68]
xadd bl, dl
mov bx, word [rax + rcx*2 - 0x10]
mov word [r10 + rcx*8 - 0x32], bx
jnp 0x1445a71b6
Function at 0x14460624a
Capabilities:
Authenticate hmac

Disassembly:
movsxd rdi, edi
bswap r8d
jne 0x1446135f1
mov r8d, ebx
movzx ebp, byte [r11 + rbx - 0x5b9fbfba]
jb 0x1445e355d
mov qword [rsp + rax*2 - 0xfffffe], r9
ret 8
sal cx, 0x4d
movzx edi, cl
lea r11, [r11 + rcx*2 - 0x253dfffa]
sub dil, 0x19
xadd edx, ebx
rol r8b, 0x82
xor bpl, sil
inc bpl
rol r8d, 0x90
neg bpl
neg bl
neg rdi
jle 0x14462e38b
rol ax, 0xcc
lea ebp, [rbp + rbx*2 + 0x42807b97]
adc r8, rdx
xchg bl, dl
ja 0x1445fa3b6
mov eax, 0x2fbb97a4
call fcn.14460e9b6
dec r8b
pop rcx
pop rcx
rol r8b, 1
movsx ebx, dl
lea rcx, [rax*4 + 0x129fbd07]
xor sil, r8b
xadd ebp, ebx
sar cl, 0x43
or rax, rbp
adc r8, rsp
ror bx, 1
xadd al, ah
mov qword [r8 + rbx - 0x4b1426bd], rdi
or ebx, ecx
or bl, bh
mov rax, qword [r10 + rbp - 0x4b144ddf]
shl bp, 0x46
lea r10, [r10 + rbx - 0x5b9fbfa7]
jp 0x1445db5e0
sal al, 6
not r8d
push rax
xadd cl, bpl
neg r8d
xor ebp, 0x2810ee20
movzx ebx, bp
mov qword [rsp + rcx - 0x1d468812], rsi
call fcn.1445f11bd
xor edi, r8d
push rsi
sbb dl, 0x8e
push rdx
xor dword [rsp + rax - 0x498e], ecx
pop r8
shr rdx, 0xd6
pop rsi
movsxd rcx, ecx
dec rdx
shr di, 0x4e
sete r8b
adc r9, rcx
neg di
dec dx
neg bl
movzx edx, word [r11 + r8 - 0xca01]
movzx ecx, bl
lea r11, [r11 + r8*2 - 0x19400]
add rdi, 0x2905760f
inc bl
xor dx, si
rol dx, 1
neg dx
jmp 0x14459ee0b
lea rdx, [rbx + rbp*4 - 0x62e003de]
or dl, bpl
mov rsi, qword [rsp + rax*8 - 0x3fffff0]
jg 0x144631313
mov qword [rsp + rax - 0x7fffff], rcx
jae 0x1445ab520
mov qword [rsp + rax - 0x7ffff7], 0xffffffffc698050e
adc r9, rdi
mov r8, qword [r10 + rax - 0x7fffff]
mov rbp, qword ss:[r8 + rax*4 - 0x1fffffc]
movzx edi, al
mov qword [r10 + rbx*2 - 0x28316346], rbp
jmp 0x1445dcf3e
jmp 0x1445fbe64

Function at 0x144606416
Capabilities:
Authenticate hmac

Disassembly:
lea r11, [r11 + r8*4 - 0x3fbf3]
sal dx, 0xa9
xor edi, esi
lea edi, [rdi + r8*2 - 0x59c5e04]
inc bl
xadd dword [rsp + r8*4 - 0x3fbf7], r8d
lea rax, [rbx + rdx + 0x638f7316]
ror edi, 1
sub rbp, qword [rsp + r8 + 8]
mov qword [rsp + r8*8], rbx
sub edi, 0xc10f621a
inc ax
shr word [rsp + r8 + 8], 0xec
rol dx, 0xa2
xor edi, 0xcdb13e86
call fcn.1445d2b29
Function at 0x144617999
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
pop rdx
pop r8
pop rdx
pop r8
pop rax
pop rdi
jno fcn.14459f190

Function at 0x1446179a7
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
test ebx, ebx
lea rsp, [rsp + 8]
je 0x1445a42c1

Function at 0x1446179e7
Capabilities:
Authenticate hmac

Disassembly:
call fcn.14460bf41
mov ebp, dword [r11]
mov edi, 0xec2787b2
movzx eax, dil
xor ebp, esi
jmp 0x14459f836

Function at 0x14461af12
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step
Parse pe header

Disassembly:
lea r10, [rax + r10 + 4]
inc r8w
and edx, eax
add r8w, r8w
or ebx, edi
not ebx
shr rbp, 0x97
mov dword [r10 + rax*2], ebx
call fcn.1445c08b9
xor dword [rsp + rax*2], ecx
shl r8d, 0x19
pop rsi
inc bpl
movsxd rcx, ecx
add r9, rcx
sar bx, 4
rol rax, 0x61
mov ebx, dword [r10 + rax*2]
mov ecx, eax
mov edi, dword [r10 + rax + 4]
lea r8, [rdx - 0x24c65c6f]
sal rbp, 0xc4
jne 0x1445ba2ef
mov word [r10 + 8], bx
mov ecx, dword [r11]
lea rbp, [r8 + 0x17b3bd0f]
pop rdi
call fcn.1445bb9bc
mov qword [rsp + r8 - 0x790fd9b7], rdx
lea rbp, [rsp + rbp + 0x10]
or word [rsp + rbx - 0x790fd934], r8w
sbb edx, 0x7aa6635
lea r8, [r8*4 + 0x2d0a1097]
mov dword [rbx + rbp - 0x790fd93c], edi
dec eax
movzx ecx, word [rsp + rbx - 0x790fd93c]
mov eax, dword [r11 + rbx - 0x790fd93c]
lea r11, [r11 + rbx - 0x790fd938]
xor eax, esi
call fcn.1445fb65e
add r11, 4
shr bp, 0xa
setae bpl
movsx r8d, bpl
xor ecx, esi
not ecx
dec ecx
xor ecx, 0x7f8feebc
dec ecx
rol al, 7
ror ecx, 2
lea rbx, [r8*8 + 0x2bb69795]
inc ecx
bswap r8d
movsx edx, bx
xadd r8, rax
push rsi
jae 0x1445c9321

Function at 0x14461c307
Capabilities:
Manually build aes constants

Disassembly:
bswap r8d
mov qword [rsp + rax - 0xca89], 0x3fa5b29b
or bp, 0x6804
call fcn.1445d93b3
call fcn.1446268f5

Function at 0x144622500
Capabilities:
Authenticate hmac
Parse pe header

Disassembly:
mov r8w, word [rbx + rdi - 8]
add qword [rsp + rbx*8 - 0x3b], 0xffffffffe4299325
mov word [rbp + r10 - 0x62c91100], r8w
lea r10, [r10 + rbx*8 - 0x38]
movsx edx, word [rsp + rbx + 0xc]
mov edx, dword [r11 + rbx*8 - 0x3f]
rol ecx, 0x69
sbb ecx, ebp
call fcn.14461b038
mov r8d, dword [r10]
lea rax, [rsp + 0x8c]
mov ebp, 0x9984d4af
ror bp, 0xa8
mov dword [rax], r8d
movsx ebx, bp
mov ebp, dword [r11]
sar bl, 0x23
movsx eax, bx
lea rbx, [rbx*4 + 0x48bb4736]
add r11, 4
xor ebp, esi
dec ebp
mov edi, 0x268a560a
push rdi
bswap ebp
jmp 0x144634d1c
pop rdx
xor sil, dil
ror byte [rsp + rbp - 0x49c910f4], 1
movzx ebx, bpl
lea rdi, [rsp + rdi + 0x18]
adc ebp, dword [rsp + rbx*4 - 0x13]
jg 0x1445fe521
rol ebp, 1
xchg dword [rsp + rdi*2 - 0x4d14ac12], edi
sub ebp, 0x9e09fcba
movsx ecx, bl
pop rbx
lea rdx, [rdi*2 - 0x32e667fa]
ror ebp, 2
push rsi
xor dword [rsp + rdi*2 - 0x4d14], ebp
pop rsi
not ebx
lea rbx, [rdi*8 - 0x5f8fe1]
movsxd rbp, ebp
add r9, rbp
neg dl
call fcn.1445cec80

Function at 0x144623094
Capabilities:
Authenticate hmac

Disassembly:
xor edx, 0x13232eb4
and word [rsp + r8 - 0x440d1a8c], bx
mov qword [rsp + r8 - 0x440d1a91], rsi
xor dword [rsp + r8 - 0x440d1a91], edx
push rbp
mov rsi, qword [rsp + r8 - 0x440d1a89]
movsxd rdx, edx
add r9, rdx
call fcn.1445cef0b
Function at 0x144624d4b
Capabilities:
Encrypt data using aes mixcolumns step

Disassembly:
ret
dec eax
add bx, 0x8c37
not bx
mov qword [rsp + 8], 0xffffffff9235129f
lea rcx, [rax*2 - 0x3b4caee5]
mov qword [rsp], rdx
inc bx
ror bx, 1
xor si, bx
xchg dword [rsp + 2], eax
ror cl, 0x83
lea rbx, [rsp + rbx + 0x10]
jb 0x144619362
mov bp, word [rbx + rax*2 - 0xd3fe2]
xchg rcx, rax
jae 0x144613107
mov edx, 0xffb8c51e
movsx r8d, dl
movzx edi, dl
mov edi, dword [r11 + r8*2 - 0x3c]
call fcn.1445af2eb
Function at 0x144626dd8
Capabilities:
Encode data using xor

Disassembly:
call fcn.144631c49
jmp 0x14462c0c6
mov rcx, qword [r10]
mov r8d, 0x15151e87
movsx ebx, r8b
movzx r8d, byte [r11 + r8*2 - 0x2a2a3d0e]
push rbx
xchg dword [rsp], ebx
call fcn.14461897b
sar cx, 0x4f
xor edi, ecx
movzx eax, bpl
sal eax, 0xac
sbb cx, cx
or edx, edi
push rbp
call fcn.1445f4f14
add word [rsp + rbx - 0x9a9a], 0x7a92
dec r8d
not r8d
xchg qword [rsp + rbx*2 - 0x1355e], rbx
movsx ebp, al
ror r8d, 1
movsx edi, word [rsp + rbx*2 - 0x6a]
sar byte [rsp + rbx - 0x26], 1
not r8d
xchg word [rsp + rbx*2 - 0x7a], di
xor rdi, 0x15a16a82
xor ax, di
mov qword [rsp + rbx - 0x27], rsi
lea rdx, [rbx + rbp*8 - 0x744d7b4c]
mov qword [rsp + rbx - 0x37], rax
pop rcx
xor dword [rsp + rbx*4 - 0xec], r8d
jmp fcn.1445a0f41

Function at 0x14462d4ad
Capabilities:
Authenticate hmac

Disassembly:
sar rbx, 0x43
xor sil, bpl
mov qword [rsp + rdi - 0xb667], r8
mov qword [rsp + rdi*8 - 0x5b320], rdi
lea rbp, [rsp + rbp + 0x38]
and eax, dword [rsp + rdi*2 - 0x16cac]
not rdi
mov di, word [rbp + rdi*2 + 0x16cd0]
sbb qword [rsp + r8*2 - 0x139ffb], rbx
call fcn.14462333c

Function at 0x144631e8c
Capabilities:
Authenticate hmac

Disassembly:
lea rax, [rbp + rbp*8 + 0x101ae008]
mov ax, word es:[rcx]
xadd dword [rsp + 0x10], r8d
call fcn.1445c30f1

Function at 0x1446342bd
Capabilities:
Authenticate hmac
Encrypt data using aes mixcolumns step

Disassembly:
mov byte ss:[r8 + rbp - 0x9113], dl
movzx r8d, dil
or rbx, r9
jmp rbx
push 0xffffffffa090b485
jmp 0x1445e2876
cmp ebx, 4
lea rsp, [rsp + 8]
jne 0x1446045ef
push 0x631dff98
mov r9d, dword [rsp + 1]
mov r9, rax
jmp 0x144634ef2
push 0xffffffff893d2c84
lea rsp, [rsp + 0x18]
jne 0x1445daa37
mov r8d, 0xfbb3131e
mov r8, rax
call fcn.144607872
pop rsi
bswap rdx
movzx ebp, r8w
shr bpl, 0x62
movsxd rcx, ecx
inc dx
add r9, rcx
and r8, rbp
mov ebx, edx
mov r8, qword [r10 + r8*4 - 0x24408]
xor rbx, rbx
mov dl, byte [r10 + rbp*2 - 0x1221e]
lea rax, [rbp + rdi*8 - 0x11c3266d]
adc dil, 1
lea r10, [rbp + r10 - 0x9109]
jae 0x1445ab441
lea rsp, [rsp + 8]
jmp 0x1445cb365

Function at 0x144634d5a
Capabilities:
Authenticate hmac

Disassembly:
xor dl, sil
push rcx
mov qword [rsp + rdi*4 - 0x1b700], rdi
add dl, 0x22
not di
call fcn.1445ae445
Function at 0x144635c0f
Capabilities:
Authenticate hmac

Disassembly:
inc al
xor dword [rsp + rbp*2 - 0x7e472c52], ecx
mov edi, ebp
movsx r8d, ax
pop rsi
movsxd rcx, ecx
inc rax
neg al
add r9, rcx
xor r8w, r8w
movzx ebx, r8w
movzx r8d, byte [rbp + r11 - 0x3f239629]
je 0x1445b1848
lea r11, [rbp + r11 - 0x3f239628]
or bp, bp
neg dil
mov edx, ebx
xor r8b, sil
add ebp, ebx
sub ax, di
jbe 0x1445d1dba
dec r8b
mov ecx, 0x72b4b232
xchg dil, cl
or rcx, rdi
xor r8b, 0x1b
xor edi, ebx
rol r8b, 1
bswap rbp
call fcn.1445e93d0
xor dword [rsp + r8*4 - 0x1af14], ebx
mov rsi, qword [rsp + r8*2 - 0xd786]
movsxd rbx, ebx
add r9, rbx
mov qword [rsp + r8 - 0x6bbf], 0xffffffffb3180da0
mov rbp, qword [r10 + r8*2 - 0xd786]
shl word [rsp + r8 - 0x6bbc], 0x45
mov cl, byte [r10 + r8 - 0x6bb7]
xor r8b, al
shr rbp, cl
lea rax, [r8 - 0x435ce3c5]
mov qword [r8 + r10 - 0x6af6], rbp
lea r10, [r10 + r8 - 0x6af6]
mov qword [rsp + rax + 0x435c78c5], r9
ret 8
sub ecx, 0xcb80b791
movsx eax, bp
mov qword [rsp + rbp - 0x3f239629], 0x48bd2586
xor word [rsp + rbp - 0x3f239624], bp
ror ecx, 2
not ecx
mov byte [rsp + rbp*2 - 0x7e472c4e], 0x85
mov qword [rsp + rbp*2 - 0x7e472c52], rsi
jmp 0x1445a1f4e
Function at 0x14011c780
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15, rdx
lea r14, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov rsi, r12
mov rbp, r12
test r14, r14
je 0x14011c996
mov rdx, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx + 0xff]
shl rsi, cl
add rsi, rsi
nop dword [rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x14011c844
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14011c800
mov ecx, dword [r10]
jmp 0x14011c927
cmp ecx, 0x4e0
jb 0x14011c927
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [r11 + 0x634]
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14011c860
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14011c8b0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
mov r8, qword [rdi + 0x10]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
cmp rax, r8
ja 0x14011c7e0
mov rdx, qword [rdi + 8]
or rsi, rax
lea ecx, [rdx + 0xff]
shl rbp, cl
add rbp, rbp
or rbp, r8
cmp rbp, r14
jb 0x14011c7d0
xor edx, edx
mov rax, rbp
div r15
mov rcx, rax
mov r8, rdx
xor edx, edx
mov rax, rsi
div r15
cmp rax, rcx
jb 0x14011c9ba
cmp r8, r14
jne 0x14011c7b0
mov rbx, qword [rsp + 0x20]
mov rax, rsi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15
mov rax, rdx
pop r15
pop r14
pop r12
ret
Function at 0x140145a90
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, rcx
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QFileInfo::constructor_class_QString_const____ptr64____ptr64]
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_class_QString___cdecl_QFileInfo::absolutePath_void____ptr64]
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_static_class_QString___cdecl_QDir::toNativeSeparators_class_QString_const____ptr64_]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_unsigned_short_int_const____ptr64___cdecl_QString::utf16_void_const___ptr64]
mov r8, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea rdx, str.explore
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp rax, 0x20
setg bl
lea rcx, [rsp + 0x48]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QString::destructor_void____ptr64]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.Qt5Core.dll_public:_void___cdecl_QFileInfo::destructor_void____ptr64]
movzx eax, bl
add rsp, 0x30
pop rbx
ret
Function at 0x14015e550
Capabilities:
Accept command line arguments

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x70
xor ebx, ebx
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov qword [rsp + 0x50], rax
mov rdi, rax
test rax, rax
jne 0x14015e58d
lea rax, [rbx - 1]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x40]
mov r15, 0xffffffffffffffff
inc eax
mov qword [rsp + 0x98], rsi
movsxd rcx, eax
mov eax, 8
mul rcx
mov qword [rsp + 0x60], r14
cmovo rax, r15
mov rcx, rax
call fcn.14015e7a0
mov r14, rax
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x14015e68c
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xa0], r12
mov r12, r14
mov qword [rsp + 0x68], r13
mov r13, rdi
sub r13, r14
mov r14d, ebx
nop dword [rax]
nop word [rax + rax]
mov rbp, qword [r12 + r13]
mov r9d, r15d
mov qword [rsp + 0x38], rbx
mov r8, rbp
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdi, eax
mov rcx, rdi
call fcn.14015e7a0
mov qword [rsp + 0x38], rbx
mov r9d, r15d
mov qword [rsp + 0x30], rbx
mov r8, rbp
mov dword [rsp + 0x28], edi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov qword [r12], rsi
lea r12, [r12 + 8]
mov eax, dword [rsp + 0x40]
inc r14d
cmp r14d, eax
jne 0x14015e600
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x90]
cdqe
mov rcx, rdi
mov qword [r14 + rax*8], rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [rsp + 0x40]
mov rdx, r14
call fcn.140005b10
mov esi, eax
cmp dword [rsp + 0x40], ebx
je 0x14015e6cb
mov rdi, r14
mov rcx, qword [rdi]
test rcx, rcx
je 0x14015e6cb
call fcn.1401592f0
inc ebx
add rdi, 8
cmp ebx, dword [rsp + 0x40]
jne 0x14015e6b2
mov rcx, r14
call fcn.1401592f0
mov r14, qword [rsp + 0x60]
mov eax, esi
mov rsi, qword [rsp + 0x98]
add rsp, 0x70
pop r15
pop rdi
pop rbx
ret
Function at 0x140008b9c
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [rcx + 0x1e8]
mov r10, r8
movsxd r9, dword [rcx + 0x1e0]
mov r11, rdx
mov rcx, r11
mov r8d, dword [rax + r9*4 - 4]
mov eax, r10d
sub eax, edx
neg r10
sbb edx, edx
and edx, eax
jmp fcn.1400095b8

Function at 0x140009248
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r15, r9d
mov rsi, r8
test r8, r8
je 0x14000926f
and qword [r8], 0
call fcn.140009384
mov rbx, rax
test rax, rax
je 0x140009368
xor edx, edx
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000935f
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000935f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000935f
mov rax, qword [0x140049e60]
mov rbp, rdi
test rax, rax
je 0x1400092d7
inc dword [rax + 0x3c8]
mov rdx, qword [0x140049e70]
lea rcx, [r15 + rdi]
call qword [section..data]
mov rdi, rax
test rax, rax
je 0x14000935f
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rbp
je 0x140009336
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140049e60]
test rax, rax
je 0x140009324
dec dword [rax + 0x3c8]
mov rdx, qword [0x140049e70]
mov rcx, rdi
call qword [0x140048008]
jmp 0x140009368
test r15d, r15d
jle 0x140009349
lea rcx, [rdi + rbp]
mov r8, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x14000935a
mov qword [rsi], rbp
mov rax, rdi
jmp 0x14000936a
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400095b8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
cmp dword [0x140049e94], 0
lea rsi, [0x140049e90]
mov ebx, r8d
mov edi, edx
mov r10, rcx
jne 0x14000961f
xor r9d, r9d
mov r11, rsi
mov r8d, r9d
mov edx, 8
mov ecx, r8d
mov eax, r8d
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov r8d, ecx
xor r8d, eax
sub rdx, 1
jne 0x1400095ed
mov dword [r11], r8d
inc r9d
add r11, 4
cmp r9d, 0x100
jb 0x1400095e5
not ebx
mov edx, ebx
test edi, edi
jle 0x140009641
movzx eax, byte [r10]
inc r10
movzx ecx, dl
xor rcx, rax
shr edx, 8
xor edx, dword [rsi + rcx*4]
sub edi, 1
jne 0x140009627
jmp 0x14000967b
mov r8b, byte [r10]
inc r10
test r8b, r8b
je 0x14000967b
mov r9b, 0x23
cmp r8b, r9b
jne 0x140009660
cmp byte [r10], r9b
jne 0x140009660
cmp byte [r10 + 1], r9b
cmove edx, ebx
movzx ecx, dl
movzx eax, r8b
mov r8b, byte [r10]
xor rcx, rax
shr edx, 8
inc r10
xor edx, dword [rsi + rcx*4]
test r8b, r8b
jne 0x14000964f
mov rbx, qword [rsp + 8]
not edx
mov rsi, qword [rsp + 0x10]
mov eax, edx
mov rdi, qword [rsp + 0x18]
ret
Function at 0x14000e854
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x140049e60]
mov rbx, rcx
and dword [rax + 0x2d9c], 0
test rcx, rcx
je 0x14000e8bd
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.14000e8c8
lea rdx, [0x14003cad4]
mov rcx, rbx
mov rdi, rax
call fcn.140009384
mov rbx, rax
test rax, rax
je 0x14000e8bd
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret