joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c774
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x140039010]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rbx, rcx
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memset
movsd xmm0, qword [str._CRhTV_]
movsd qword [rsp + 0x38], xmm0
mov eax, dword [0x14002edc0]
mov dword [rsp + 0x40], eax
mov al, byte [0x14002edc4]
mov byte [rsp + 0x44], al
xor r8d, r8d
lea r9, [rsp + 0x38]
mov eax, 0x4ec4ec4f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x34
mov al, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 0xd
jl 0x14000c7d3
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.140022dec
nop
cmp qword [rbp - 0x28], 0
je 0x14000c8d4
call fcn.1400059a8
mov eax, dword [str.cr_r]
mov dword [rsp + 0x30], eax
movzx eax, word [0x14002e994]
mov word [rsp + 0x34], ax
mov al, byte [0x14002e996]
mov byte [rsp + 0x36], al
xor r8d, r8d
lea r9, [rsp + 0x30]
mov eax, 0x4ec4ec4f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x34
mov al, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 7
jl 0x14000c842
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140025508
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x14000c886
mov rbx, qword [rbx]
mov rdx, rbx
mov rcx, rax
call fcn.140027250
lea rdx, [0x14002589c]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
call fcn.1400059a8
lea rcx, [rsp + 0x58]
call fcn.140024798
test rax, rax
jne 0x14000c8d4
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x50]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool____ptr64]
nop
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x50], rax
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x4c], edx
lea rcx, [rsp + 0x58]
call fcn.140022d80
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp - 8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.140029500
mov rbx, qword [rsp + 0x188]
add rsp, 0x170
pop rbp
ret
Function at 0x14000e030
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r9, qword [rax + 0x30]
movsxd rdx, dword [r9 + 0x3c]
mov r10d, dword [rdx + r9 + 0x88]
add r10, r9
cmp r10, r9
je 0x14000e0b8
mov edx, dword [r10 + 0x18]
test edx, edx
je 0x14000e0b8
mov ebx, dword [r10 + 0x20]
dec edx
mov r11d, 0xfe5a543e
lea rcx, [rbx + rdx*4]
mov r8d, dword [rcx + r9]
add r8, r9
mov cl, byte [r8]
inc r8
test cl, cl
je 0x14000e0b4
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r8]
inc r8
test cl, cl
jne 0x14000e094
cmp r11d, 0x78e2bfb4
je 0x14000e0bd
test edx, edx
jne 0x14000e077
mov rax, qword [rax]
jmp 0x14000e053
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
mov rdx, rsi
add rax, r9
lea rcx, [0x14000de80]
call rax
mov rbx, qword [rsp + 0x30]
test eax, eax
mov rsi, qword [rsp + 0x38]
sete al
add rsp, 0x20
pop rdi
ret
Function at 0x14000f73c
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov ecx, dword [rax + 0xbc]
and ecx, 0x70
cmp cl, 0x70
jne 0x14000f7f8
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14000f7d7
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x14000f7d7
mov edi, dword [r9 + 0x20]
dec edx
mov r11d, 0xcf5b641b
lea rcx, [rdi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x14000f7d3
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x14000f7b3
cmp r11d, 0xc901bdeb
je 0x14000f7dc
test edx, edx
jne 0x14000f796
mov rax, qword [rax]
jmp 0x14000f772
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r8
call rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000f804
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
test rax, rax
je 0x14000f9eb
cmp byte [rax + 2], 0
je 0x14000f9eb
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x14000f8a0
mov edx, dword [r10 + 0x18]
test edx, edx
je 0x14000f8a0
mov ebx, dword [r10 + 0x20]
dec edx
mov r11d, 0x64b974e2
lea rcx, [rbx + rdx*4]
mov r9d, dword [rcx + r8]
add r9, r8
mov cl, byte [r9]
inc r9
test cl, cl
je 0x14000f89c
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r9]
inc r9
test cl, cl
jne 0x14000f87c
cmp r11d, 0x517953a
je 0x14000f8a5
test edx, edx
jne 0x14000f85f
mov rax, qword [rax]
jmp 0x14000f83b
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14000f937
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x14000f937
mov ebx, dword [r9 + 0x20]
dec edx
mov r11d, 0x796c97d2
lea rcx, [rbx + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x14000f933
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x14000f913
cmp r11d, 0x93d35404
je 0x14000f93c
test edx, edx
jne 0x14000f8f6
mov rax, qword [rax]
jmp 0x14000f8d2
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14000f9cc
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x14000f9cc
mov edi, dword [r9 + 0x20]
dec edx
mov r11d, 0x55475aa2
lea rcx, [rdi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x14000f9c8
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x14000f9a8
cmp r11d, 0x92912076
je 0x14000f9d1
test edx, edx
jne 0x14000f98b
mov rax, qword [rax]
jmp 0x14000f967
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000f9f8
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov dword [rsp + 0x30], 0
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
test rcx, rcx
je 0x14000fbeb
cmp byte [rcx + 2], 0
je 0x14000fbeb
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x14000faa0
mov edx, dword [r10 + 0x18]
test edx, edx
je 0x14000faa0
mov ebx, dword [r10 + 0x20]
dec edx
mov r11d, 0x86fd523
lea rcx, [rbx + rdx*4]
mov r9d, dword [rcx + r8]
add r9, r8
mov cl, byte [r9]
inc r9
test cl, cl
je 0x14000fa9c
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r9]
inc r9
test cl, cl
jne 0x14000fa7c
cmp r11d, 0x43930553
je 0x14000faa5
test edx, edx
jne 0x14000fa5f
mov rax, qword [rax]
jmp 0x14000fa3b
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14000fb37
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x14000fb37
mov ebx, dword [r9 + 0x20]
dec edx
mov r11d, 0x21961b25
lea rcx, [rbx + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x14000fb33
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x14000fb13
cmp r11d, 0xcc4971d9
je 0x14000fb3c
test edx, edx
jne 0x14000faf6
mov rax, qword [rax]
jmp 0x14000fad2
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14000fbcc
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x14000fbcc
mov edi, dword [r9 + 0x20]
dec edx
mov r11d, 0x304934a3
lea rcx, [rdi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x14000fbc8
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x14000fba8
cmp r11d, 0xfb23202b
je 0x14000fbd1
test edx, edx
jne 0x14000fb8b
mov rax, qword [rax]
jmp 0x14000fb67
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14001140c
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov ecx, 0xbeef
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001142a
test ebx, ebx
je 0x14001154e
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1400114a0
mov edx, dword [r10 + 0x18]
test edx, edx
je 0x1400114a0
mov ebx, dword [r10 + 0x20]
dec edx
lea rcx, [rbx + rdx*4]
mov r9d, dword [rcx + r8]
add r9, r8
mov r11d, 0x60822836
jmp 0x140011489
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r9]
inc r9
test cl, cl
jne 0x14001147c
cmp r11d, 0x39e00c9e
je 0x1400114a5
test edx, edx
jne 0x140011467
mov rax, qword [rax]
jmp 0x140011443
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
xor ecx, ecx
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14001152f
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x14001152f
mov edi, dword [r9 + 0x20]
dec edx
lea rcx, [rdi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov r11d, 0xbb4826c4
jmp 0x140011518
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x14001150b
cmp r11d, 0x4adf19e
je 0x140011534
test edx, edx
jne 0x1400114f6
mov rax, qword [rax]
jmp 0x1400114d2
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400129f4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x140039010]
xor rax, rsp
mov qword [rbp + 0x50], rax
mov rbx, rcx
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [0x14002f308]
mov qword [rsp + 0x30], rax
cmp byte [0x14002f30f], 0
je 0x140012a6d
xor r8d, r8d
lea r9, [rsp + 0x30]
mov eax, 0x4ec4ec4f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x34
mov al, r8b
sub al, cl
add al, 0x33
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 8
jl 0x140012a46
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140022dec
nop
cmp qword [rbp - 0x38], 0
je 0x140012add
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 8
jb 0x140012a92
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140027250
lea rdx, [0x14002589c]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rcx, [rsp + 0x48]
call fcn.140024798
test rax, rax
jne 0x140012add
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x40]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::setstate_int__bool____ptr64]
nop
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x40], rax
mov rax, qword [rsp + 0x40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x3c], edx
lea rcx, [rsp + 0x48]
call fcn.140022d80
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp - 0x18]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
mov rcx, qword [rbp + 0x50]
xor rcx, rsp
call fcn.140029500
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rbp
ret
Function at 0x14001cfc8
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, r8
call fcn.14001c694
test al, al
je 0x14001d1ac
mov rax, qword [rbx]
mov byte [rax], 1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x14001d061
mov edx, dword [r10 + 0x18]
test edx, edx
je 0x14001d061
mov ebx, dword [r10 + 0x20]
dec edx
mov r11d, 0x8ffb7742
lea rcx, [rbx + rdx*4]
mov r9d, dword [rcx + r8]
add r9, r8
mov cl, byte [r9]
inc r9
test cl, cl
je 0x14001d05d
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r9]
inc r9
test cl, cl
jne 0x14001d03d
cmp r11d, 0x2a37a89a
je 0x14001d066
test edx, edx
jne 0x14001d020
mov rax, qword [rax]
jmp 0x14001cffc
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14001d0f8
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x14001d0f8
mov ebx, dword [r9 + 0x20]
dec edx
mov r11d, 0xbb16b8a6
lea rcx, [rbx + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x14001d0f4
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x14001d0d4
cmp r11d, 0x4250c7f0
je 0x14001d0fd
test edx, edx
jne 0x14001d0b7
mov rax, qword [rax]
jmp 0x14001d093
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x14001d18d
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x14001d18d
mov edi, dword [r9 + 0x20]
dec edx
mov r11d, 0xcbb0e70a
lea rcx, [rdi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x14001d189
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x14001d169
cmp r11d, 0xd9196e0e
je 0x14001d192
test edx, edx
jne 0x14001d14c
mov rax, qword [rax]
jmp 0x14001d128
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
add rcx, 8
jmp 0x14001cfc8
Function at 0x14001f50c
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140039010]
xor rax, rsp
mov qword [rbp - 0x10], rax
and dword [rbp - 0x38], 0
mov r8d, edx
mov eax, ecx
mov dword [rbp - 0x24], 1
cdq
idiv dword [0x140039048]
mov dword [rbp - 0x30], eax
mov eax, r8d
cdq
idiv dword [0x140039048]
mov dword [rbp - 0x2c], eax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x14001f5ca
mov r9d, dword [r10 + 0x18]
test r9d, r9d
je 0x14001f5ca
mov edi, dword [r10 + 0x20]
dec r9d
mov r11d, 0x16001b86
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r8]
add rdx, r8
mov cl, byte [rdx]
inc rdx
test cl, cl
je 0x14001f5c5
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [rdx]
inc rdx
test cl, cl
jne 0x14001f5a6
cmp r11d, 0x6be3f2b0
je 0x14001f5cf
test r9d, r9d
jne 0x14001f589
mov rax, qword [rax]
jmp 0x14001f564
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + r9*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
lea rdx, [rbp - 0x38]
add rax, r8
mov r8d, 0x28
lea ecx, [r8 - 0x27]
call rax
mov eax, dword [rbp - 0x24]
test al, 1
je 0x14001f605
and eax, 0xfffffffe
mov dword [rbp - 0x24], eax
mov ecx, 0xfffffffd
test al, 2
je 0x14001f613
and eax, ecx
mov dword [rbp - 0x24], eax
test al, 0x10
je 0x14001f61d
and eax, 0xffffffef
mov dword [rbp - 0x24], eax
test al, 2
je 0x14001f626
and eax, ecx
mov dword [rbp - 0x24], eax
movsxd rax, dword [0x14003904c]
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x40], rax
call fcn.140004604
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140029500
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140021854
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x140021885
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1400218f8
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x14002189c
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14002189e
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400218f2
test ecx, ecx
jle 0x1400218d2
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
add r14, rbp
test rbx, rbx
jle 0x1400218f2
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400218f2
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140021914
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140021939
xor eax, eax
jmp 0x140021a34
cmp qword [rcx + 0x68], 0
je 0x14002194b
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140021a34
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x140021962
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140021964
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140021994
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebx
mov rcx, rsi
add r14, rbx
sub rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov r8, rbp
cmp qword [rsi + 0x80], 0
je 0x140021a2e
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x1400219cf
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
mov rbx, r8
cmp r8, r15
jbe 0x140021a08
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbp, rax
add r14, rax
mov rbx, rbp
cmp rax, r15
jne 0x140021a45
cmp rbp, r15
ja 0x1400219dd
mov r8, rbx
test rbx, rbx
je 0x140021a2e
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rbx
sub r8, rax
sub rdi, r8
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
sub rdi, rbp
jmp 0x140021a31