joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140052cd0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140052cf4
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140052d37
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x140052d37
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x140052e68
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140052d7a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140052da5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x140052e6d
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140052e1a
sub eax, 1
je 0x140052e1a
cmp eax, 2
jne 0x140052e68
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x140052e6d
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x140052e4b
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140052e68
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140052e6d
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140054e80
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140054f49
cmp byte [rcx + 0x71], 0
je 0x140054f49
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140054f3c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140054ef8
sub eax, 1
je 0x140054efc
cmp eax, 2
jne 0x140054f3c
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x140054f2a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140054f3c
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret
Function at 0x140062850
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push r14
sub rsp, 0xb0
mov eax, dword [rcx + 8]
mov r14, rcx
test eax, eax
je 0x1400629de
test rdx, rdx
je 0x1400629de
mov dword [rsp + 0x40], eax
xorps xmm0, xmm0
xor eax, eax
mov qword [r11 - 0x70], rdx
mov qword [r11 - 0x68], r8
mov qword [r11 - 0x60], r9
movups xmmword [rsp + 0x60], xmm0
mov qword [r11 + 0x10], rbp
xor ebp, ebp
movups xmmword [rsp + 0x70], xmm0
mov qword [r11 - 0x18], rax
mov rax, qword [0x1401d6340]
movups xmmword [r11 - 0x38], xmm0
movups xmmword [r11 - 0x28], xmm0
test rax, rax
jne 0x14006298b
mov rax, qword gs:[0x60]
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140062954
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140062954
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x14006294f
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140062930
cmp edx, 0xb04cce94
je 0x1400629c5
test r8d, r8d
jne 0x140062910
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x140062969
cmp qword [rax + 0x30], rbp
jne 0x1400628e0
mov rax, rbp
mov rdi, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xd0]
mov rbx, qword [rsp + 0xc0]
mov qword [0x1401d6340], rax
mov rcx, qword [r14]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x38], rbp
mov r9d, 0x68
mov qword [rsp + 0x30], rbp
mov edx, 0x221810
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call rax
mov rbp, qword [rsp + 0xc8]
add rsp, 0xb0
pop r14
ret
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x14006296c
xor eax, eax
add rsp, 0xb0
pop r14
ret
Function at 0x1400629f0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbp
push r14
sub rsp, 0x1a0
mov r10, qword [0x1401d62f0]
xor r14d, r14d
mov ebp, dword [0x1401d5efc]
test r10, r10
jne 0x140062aef
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop dword [rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x140062ab8
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x140062ab8
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140062ab3
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140062a90
cmp edx, 0xbdcac9ce
je 0x140062c17
test r8d, r8d
jne 0x140062a70
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x140062acd
cmp qword [rax + 0x30], r14
jne 0x140062a40
mov r10, r14
mov rdi, qword [rsp + 0x1c0]
mov rsi, qword [rsp + 0x1b8]
mov rbx, qword [rsp + 0x1b0]
mov qword [0x1401d62f0], r10
movabs rcx, 0x573720cb1c07fa79
movabs rax, 0x9af1bfd8a4e4e03
mov qword [rsp + 0x40], rax
xorps xmm2, xmm2
movabs rax, 0x45fd4bb6d660125f
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x118]
mov qword [rsp + 0x68], rcx
mov ecx, 2
mov qword [rax - 8], r14
mov qword [rax], r14
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x140062b31
movaps xmm1, xmmword [rsp + 0x140]
lea rcx, [rsp + 0x80]
movdqa xmm0, xmmword [rsp + 0x40]
xor r9d, r9d
xorps xmm0, xmmword [rsp + 0x60]
xor r8d, r8d
movaps xmmword [rsp + 0x80], xmm0
mov edx, 0xc0000000
movaps xmm0, xmmword [rsp + 0x130]
movaps xmmword [rsp + 0xa0], xmm0
movaps xmm0, xmmword [rsp + 0x150]
movaps xmmword [rsp + 0xc0], xmm0
movaps xmm0, xmmword [rsp + 0x170]
movaps xmmword [rsp + 0xb0], xmm1
movaps xmm1, xmmword [rsp + 0x160]
movaps xmmword [rsp + 0xe0], xmm0
movaps xmm0, xmmword [rsp + 0x190]
movaps xmmword [rsp + 0xd0], xmm1
movaps xmm1, xmmword [rsp + 0x180]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0x90], xmm2
movaps xmmword [rsp + 0xf0], xmm1
mov dword [rsp + 0x20], 3
call r10
mov dword [0x1401d6738], ebp
mov rbp, qword [rsp + 0x1c8]
mov qword [0x1401d6730], rax
add rsp, 0x1a0
pop r14
ret
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov r10d, dword [rcx + rdx*4]
add r10, r9
jmp 0x140062ad0
Function at 0x140062c40
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x58
mov eax, dword [0x1401d6738]
mov dword [rsp + 0x40], eax
xor eax, eax
mov qword [rsp + 0x48], rax
mov rax, qword [0x1401d6340]
test rax, rax
jne 0x140062d36
mov rax, qword gs:[0x60]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x50], rdi
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140062d08
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140062d08
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140062d03
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140062ce0
cmp edx, 0xb04cce94
je 0x140062d84
test r8d, r8d
jne 0x140062cc0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x140062d1e
cmp qword [rax + 0x30], 0
jne 0x140062c90
xor eax, eax
mov rdi, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov qword [0x1401d6340], rax
mov qword [rsp + 0x38], 0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], 0
lea r8, [rsp + 0x40]
mov dword [rsp + 0x28], 0x10
mov r9d, 0x10
mov qword [rsp + 0x20], rcx
mov edx, 0x221820
mov rcx, qword [0x1401d6730]
call rax
mov rax, qword [rsp + 0x48]
mov qword [0x1401d6750], rax
add rsp, 0x58
ret
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140062d20
Function at 0x140063630
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports
Terminate process

Disassembly:
sub rsp, 0x48
lea rdx, [0x1401d5fa8]
mov ecx, 0x20
call qword [sym.imp.d3d9.dll_Direct3DCreate9Ex]
test eax, eax
jns 0x140063656
mov ecx, 3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, dword [0x1401d6110]
lea rdx, [0x1401d6038]
mov rcx, qword [0x1401d5fa8]
mov r9, qword [0x1401d5f60]
mov qword [rsp + 0x38], rdx
lea rdx, [0x1401d5ff0]
mov dword [0x1401d5ff0], eax
mov eax, dword [0x1401d6090]
mov qword [0x1401d6008], 1
mov dword [0x1401d6018], 1
mov qword [0x1401d6010], r9
mov dword [0x1401d5ff8], 0x15
mov dword [0x1401d5ff4], eax
mov dword [0x1401d601c], 1
mov dword [0x1401d6020], 0x50
mov dword [0x1401d602c], 0x80000000
mov qword [rsp + 0x58], rbp
xor ebp, ebp
mov qword [0x1401d5ffc], rbp
mov qword [0x1401d6024], rbp
mov dword [0x1401d6004], ebp
mov rax, qword [rcx]
lea r8d, [rbp + 1]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rdx
xor edx, edx
mov dword [rsp + 0x20], 0x40
call qword [rax + 0xa0]
test eax, eax
jns 0x140063809
mov rcx, qword [0x1401d5fa8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rax, qword [0x1401d6278]
test rax, rax
jne 0x140063802
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x40], rdi
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400637d4
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400637d4
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400637cf
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1400637b0
cmp edx, 0xcded1a85
je 0x140063834
test r8d, r8d
jne 0x140063790
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x1400637e9
cmp qword [rax + 0x30], rbp
jne 0x140063760
mov rax, rbp
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov qword [0x1401d6278], rax
mov ecx, 4
call rax
call fcn.1400067d0
mov rax, qword [0x1401d5ec0]
mov qword [rax + 0x20], rbp
call fcn.140063450
call fcn.14002c0b0
call fcn.14002ba10
mov rbp, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x48
ret
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x1400637ec
Function at 0x140063850
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov eax, dword [0x1401d5efc]
mov dword [rsp + 0x28], eax
mov rax, qword [0x1401d63a8]
mov qword [rsp + 0x20], 0
test rax, rax
jne 0x140063937
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140063918
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140063918
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140063913
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400638f0
cmp edx, 0x6d15bbbd
je 0x140063a36
test r8d, r8d
jne 0x1400638d0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x14006392e
cmp qword [rax + 0x30], 0
jne 0x1400638a0
xor eax, eax
mov qword [0x1401d63a8], rax
lea rdx, [rsp + 0x20]
lea rcx, [0x140063c90]
call rax
test eax, eax
jne 0x140063a24
mov rax, qword [0x1401d6398]
test rax, rax
jne 0x140063a13
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400639f4
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400639f4
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400639ef
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1400639d0
cmp edx, 0x5056df37
je 0x140063a52
test r8d, r8d
jne 0x1400639b0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x140063a0a
cmp qword [rax + 0x30], 0
jne 0x140063980
xor eax, eax
mov qword [0x1401d6398], rax
call rax
cmp eax, 0xffffffff
jne 0x140063a24
mov rax, qword [rsp + 0x20]
test rax, rax
jne 0x140063a26
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140063930
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140063a0c
Function at 0x140063e90
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x48
mov r10, qword [0x1401d6268]
xor r11d, r11d
test r10, r10
jne 0x140063f8b
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x40], rdi
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rsi, rbp
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rsi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov edi, dword [rax + r9 + 0x88]
add rdi, r9
cmp rdi, r9
je 0x140063f58
mov r8d, dword [rdi + 0x18]
test r8d, r8d
je 0x140063f58
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rbx + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140063f53
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140063f30
cmp edx, 0xe05299f3
je 0x140064107
test r8d, r8d
jne 0x140063f10
mov rax, qword [rsi]
mov rsi, rax
cmp rax, rbp
je 0x140063f6d
cmp qword [rax + 0x30], r11
jne 0x140063ee0
mov r10, r11
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov qword [0x1401d6268], r10
cmp dword [0x14012e090], 2
movups xmm3, xmmword [str.QQW_wO_IPG_]
movzx eax, word [0x140118428]
movsd xmm0, qword [0x140118420]
movups xmmword [rsp + 0x20], xmm3
mov word [rsp + 0x38], ax
movsd qword [rsp + 0x30], xmm0
jl 0x1400640a8
movdqa xmm2, xmmword [0x1401190b0]
mov r11d, 8
movdqa xmm4, xmmword [0x140119370]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1401190d0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movq xmm1, xmm3
movdqa xmm3, xmmword [0x1401190c0]
paddw xmm2, xmmword [str.33333333]
movdqa xmm0, xmm3
xorps xmm2, xmm1
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movq qword [rsp + 0x20], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1401190d0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rsp + 0x28]
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmmword [str.33333333]
xorps xmm2, xmm0
movq qword [rsp + 0x28], xmm2
movsxd rax, r11d
lea r8, [rsp + 0x20]
lea r8, [r8 + rax*2]
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x8d3dcb09
lea r8, [r8 + 2]
imul r11d
add edx, r11d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x3a
movzx eax, r11w
inc r11d
sub ax, cx
add ax, 0x33
xor word [r8 - 2], ax
cmp r11d, 0xd
jl 0x1400640c0
lea rdx, [rsp + 0x20]
xor ecx, ecx
call r10
add rsp, 0x48
ret
mov ecx, dword [rdi + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r9
mov r10d, dword [rcx + rdx*4]
add r10, r9
jmp 0x140063f70
Function at 0x140076470
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x48
call fcn.14002c030
call fcn.14002bb00
call fcn.14002c2a0
call fcn.1400068b0
mov rcx, qword [0x1401d6038]
xor edx, edx
movss xmm0, dword [0x140118cf4]
xor r8d, r8d
mov dword [rsp + 0x30], edx
movss dword [rsp + 0x28], xmm0
mov rax, qword [rcx]
lea r9d, [rdx + 1]
mov dword [rsp + 0x20], edx
call qword [rax + 0x158]
mov rcx, qword [0x1401d6038]
lea rdx, [0x1401d5f20]
mov rax, qword [rcx]
call qword [rax + 0x80]
mov rcx, qword [0x1401d5f60]
test rcx, rcx
je 0x1400764e0
call qword [sym.imp.USER32.dll_DestroyWindow]
call fcn.140063ca0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140077bc0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.1400e73d4
mov qword [rax], rbx
mov qword [rsp + 0x40], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140078d70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x140077c1d
mov rax, rdi
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140078490
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, r8
mov rdi, rcx
mov ecx, 0x10
call fcn.1400e73d4
mov rdx, qword [rbx]
mov qword [rax], rdx
lea rcx, [0x14006f7f0]
mov qword [rax + 8], rcx
mov qword [rsp + 0x48], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140078d40]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x1400784fd
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140078510
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.1400e73d4
mov qword [rax], rbx
mov qword [rsp + 0x40], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140078d70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x14007856a
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3