joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001008
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140001069
lea rcx, str.Windows_original_main_args:_n
call fcn.14000114c
xor ebx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp dword [rax], ebx
jle 0x140001069
xor edi, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov edx, ebx
lea rcx, str.wwwd_args__d____s_n
mov r8, qword [rax]
mov r8, qword [rdi + r8]
call fcn.14000114c
inc ebx
lea rdi, [rdi + 8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp ebx, dword [rax]
jl 0x14000103e
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
test edi, edi
jle 0x1400010b5
xor edx, edx
mov r9d, edi
mov rcx, qword [rax]
lea rax, [rax + 0x10]
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x1400010a2
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010cc
mov rcx, qword [rbx]
mov rax, qword [section..data]
test rax, rax
jne 0x1400010db
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
lea r9, str._J_ms8m
mov byte [rsp + 0x60], 0
mov r8d, 2
mov byte [rsp + 0x58], 0
mov rdx, rbx
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov ecx, edi
mov qword [rsp + 0x40], rax
lea rax, [0x14000232c]
mov qword [rsp + 0x38], rax
lea rax, [0x140002330]
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 3
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x1400018f8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001942
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001942
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001942
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001942
cmp dword [rcx + 0x84], 0xe
jbe 0x140001942
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001944
xor al, al
add rsp, 0x28
ret
Function at 0x1402d8241
Capabilities:
Encode data using base64

Disassembly:
jle 0x140585e73
sete bpl
and rbp, rsi
test esi, 0x256e40b1
mov dword [rsp + 0x28], edi
jg 0x140348f61

Function at 0x1402ea733
Capabilities:
Execute anti-debugging instructions

Disassembly:
movabs r9, 0x18a1792a687319de
movzx r9w, byte [rsp + 0x33]
mov rdx, qword [rsp + 8]
not byte [rsp + 8]
not r9b
call fcn.14040adfd
cmp r12w, word [rsp + 0x12]
jo 0x14058bbb1
neg qword [rsp + 0x10]
lea rdx, [r12 + r13*2 + 0x678201a7]
add qword [rsp], 0xffffffffffd89d2b
movsx dx, r13w
add byte [rsp + 0x10], 0xfb
neg dx
xor r12w, 0x1a53
cmovae r13w, r12w
mov byte [rsp + 0x10], 0xcb
call fcn.1402f2472
add ebx, 0x11391e45
not bx
push r12
movabs r12, 0x7af971b42eba0b75
xor r12d, ebx
or r12b, 0xdc
add ebx, 0x484c1e09
sets r12b
push rdx
setb r12b
mov r12w, 0x74be
push rbx
neg rbx
bswap ebx
pop rdx
seta r12b
sub r12w, 0x2ff3
or r12d, 0x4fda488a
xor r12w, 0x68d0
lea r12, [r12 + r12*2 + 0x1d4130ab]
not edx
mov rbx, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0x39ee82d2
not dx
push r13
setae r12b
mov r13, rdx
not edx
test r13b, 0xbf
jbe 0x14058bc42
xor edx, 0x5900a94
test dl, 0xcb
push rdx
bswap r13d
jb 0x1402ea77c
not dx
and r12w, dx
mov word [rsp], 0x37b1
xor byte [rsp], 0x9c
or r12w, r13w
neg r12d
and r12, qword [rsp]
xor r12, 0x542d09c0
add rdx, 0x858148b
mov edx, dword [rsp + 1]
jb 0x1403159e9
bswap r12
push r14
mov r14, qword [rsp + 8]
xor r12, r14
mov r14, qword [rsp]
mov dx, word [rsp + 0xb]
mov r12d, dword [rsp + 0xb]
sub r13, qword [rsp + 8]
xor edx, 0x7fe34a2
not r12d
call 0x1402ea755
popfq
rdtsc
nop
call fcn.140411eef
push rsi
pushfq
movabs rsi, 0x289254b228f83f66
test sil, 0x56
push r15
push r9
movabs r15, 0x552a205333393511
movabs r9, 0x6a72785b39b23364
setb r9b
movsx r9, r15b
push r13
Function at 0x1402ea755
Capabilities:
Execute anti-debugging instructions

Disassembly:
movabs r9, 0x18a1792a687319de
movzx r9w, byte [rsp + 0x33]
mov rdx, qword [rsp + 8]
not byte [rsp + 8]
not r9b
call fcn.14040adfd
cmp r12w, word [rsp + 0x12]
jo 0x14058bbb1
neg qword [rsp + 0x10]
lea rdx, [r12 + r13*2 + 0x678201a7]
add qword [rsp], 0xffffffffffd89d2b
movsx dx, r13w
add byte [rsp + 0x10], 0xfb
neg dx
xor r12w, 0x1a53
cmovae r13w, r12w
mov byte [rsp + 0x10], 0xcb
call fcn.1402f2472
add ebx, 0x11391e45
not bx
push r12
movabs r12, 0x7af971b42eba0b75
xor r12d, ebx
or r12b, 0xdc
add ebx, 0x484c1e09
sets r12b
push rdx
setb r12b
mov r12w, 0x74be
push rbx
neg rbx
bswap ebx
pop rdx
seta r12b
sub r12w, 0x2ff3
or r12d, 0x4fda488a
xor r12w, 0x68d0
lea r12, [r12 + r12*2 + 0x1d4130ab]
not edx
mov rbx, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0x39ee82d2
not dx
push r13
setae r12b
mov r13, rdx
not edx
test r13b, 0xbf
jbe 0x14058bc42
xor edx, 0x5900a94
test dl, 0xcb
push rdx
bswap r13d
jb 0x1402ea77c
not dx
and r12w, dx
mov word [rsp], 0x37b1
xor byte [rsp], 0x9c
or r12w, r13w
neg r12d
and r12, qword [rsp]
xor r12, 0x542d09c0
add rdx, 0x858148b
mov edx, dword [rsp + 1]
jb 0x1403159e9
bswap r12
push r14
mov r14, qword [rsp + 8]
xor r12, r14
mov r14, qword [rsp]
mov dx, word [rsp + 0xb]
mov r12d, dword [rsp + 0xb]
sub r13, qword [rsp + 8]
xor edx, 0x7fe34a2
not r12d
call 0x1402ea755
popfq
rdtsc
nop
call fcn.140411eef
push rsi
pushfq
movabs rsi, 0x289254b228f83f66
test sil, 0x56
push r15
push r9
movabs r15, 0x552a205333393511
movabs r9, 0x6a72785b39b23364
setb r9b
movsx r9, r15b
push r13
Function at 0x1402f9f3f
Capabilities:
Encode data using base64

Disassembly:
mov r11, qword [rsp + 0x28]
xor qword [rsp + 0x28], 0x21410e38
or rcx, r11
lea r8, [r15 + r15*2 + 0x232a04ce]
add word [rsp + 0x28], 0x39c7
jo 0x1402d4207
or r8b, byte [rsp + 0x2a]
jle 0x14033939b

Function at 0x140302ce8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsi, [rsi + 0x67ed5e5d]
not r13w
bswap r13
mov sil, r13b
mov r13, qword [rsp + 0x18]
movabs rdi, 0x3e06055d0846006c
movsx edi, sil
je 0x14034df0e
and rsi, rsi
neg esi
movzx rdi, si
and sil, 0x94
test si, 0x60a4
lea rdi, [rsi + rdi*2 + 0x6b310566]
not r13b
call fcn.140327c50
or r13w, 0x2cb2
call fcn.140354343

Function at 0x14032db0b
Capabilities:
Encode data using xor

Disassembly:
sub word [rsp + 0x38], r15w
setle dl
neg byte [rsp + 0x30]
xor ebp, dword [rsp + 0x34]
lea rbp, [r13*8 + 0x23c26a28]
cmp r13w, word [rsp + 0x39]
not dword [rsp + 0x38]
mov r15, qword [rsp + 0x48]
bswap r13
setne byte [rsp + 0x38]
movsx r13w, dx
neg byte [rsp + 0x30]
call fcn.140342586
sub r13, rbp
seta r15b
not edx
not word [rsp + 0x38]
xor ebp, ebp
add qword [rsp + 0x28], 0x52a20
xor edx, 0x15902471
or dx, word [rsp + 0x39]
cmp bp, word [rsp + 0x3b]
setg dl
cmp dword [rsp + 0x38], 0x759a5c1c
je 0x140401353
sub r13w, 0x5e55
in eax, dx
push rbp
pop rsi
add qword [rsp + 8], 0xffffffffbfc1904e
xor ebp, 0x45003076
jae 0x1402f6a3c
sbb esi, dword [rcx + 0x2c294d31]
out dx, al
fstp dword [0x13cdb15e4]
sbb al, 0x17
jns 0x14032db48
iretd
popfq
call 0x140333088
not r15d
call fcn.14032db0b
jle 0x14033510a
Function at 0x140332e4b
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rdi
movabs rdi, 0x1da932724bdf08ab
pushfq
sub rdi, rdi
test rdi, rdi
call 0x140332ea3
adc dword [rbp - 0x69572d27], edx
loopne 0x1402e0753
shr cl, cl
fdivr qword [rdx - 0x35]
sub eax, 0xcc194dad
rcl dword [rsi], cl
invalid
xchg dword [rdi - 0x6bd3ce5f], ecx
pop rbp
pop rbx
cmp ebp, dword [rax + rbx*2]
invalid
mov dx, 0x6872
not dil
sets dil
movzx r15d, cl
add rdi, 0x3a985ef6
add qword [rsp + 8], 0x8ea46
cmp r9b, 0xe2
sets r12b
mov rcx, qword [rsp + 0x78]
add di, 0x45dc
and r8, 0x175d33ff
jo 0x14036c38b
xor edx, r12d
jge 0x14058bb62
test r15w, 0x6319
bswap r9
mov r15d, r9d
call fcn.140312c4e
ja 0x1402e06f7
test edi, edi
push rsi
push rcx
movabs rcx, 0x310f50b61dcf6a4c
jno 0x14036bdc9
jae 0x14036833f
invalid
setg dil
movsxd rcx, r14d
push r8
movabs rbp, 0x33ff0f72771559aa
movsx cx, bpl
cmp rdi, 0x2d4a3ad7
push rdx
jae 0x1403266c8
jo 0x1403682d4
stosd dword [rdi], eax
ret 0x4037
mov dl, 0x6a
cmp eax, 0x741d08cc
ret 0x17cf
push r14
push r12
movabs rsi, 0x74e264800b7411da
push r13
mov rdi, qword [rsp + 0x38]
mov qword [rsp + 0x38], 0xffffffffb446a712
movabs r13, 0x418d2f7b31457f17
movabs r14, 0x93c1c3d71f770c1
lea r14, [r14*8 + 0x218c761d]
movsxd r14, esi
movabs rcx, 0xb1525e90ee7756d
sub esi, 0x54a25f3d
sets r14b
bswap rsi
jns 0x140403690
sub rcx, r13
add r14b, 7
movabs r12, 0x674407ed0689315f
cmp r14d, r13d
not r14d
push r13
bswap rcx
push r11
not rsi
push rdx
mov r12, qword [rsp + 0x20]
mov r11, r13
call fcn.140320dc3
mov ecx, 0x5a776d86
not r12d
not r12w
ja 0x14036830e
cmp al, 0x41
push rdi
push r8
push rbx
movabs r15, 0x7ce54a723ffd603a
movabs rbx, 0x714b23cc7c3f4eb0
pushfq
test rbx, rbx
call fcn.140350f37
or dl, byte [rbx + 0x48]
mov ebx, 0x71723510
invalid

Function at 0x1403376ae
Capabilities:
Encode data using xor

Disassembly:
call fcn.140350a5d
jl 0x14030898f
jbe 0x1402ffd38

Function at 0x1403670bb
Capabilities:
Encode data using base64

Disassembly:
jle 0x140403f79
setg byte [rsp + 0x30]
jge 0x140353e6a
push rbp
push rdi
movabs rdi, 0x306c1ec45f397351
pushfq
sub dil, 0x83
mov rbp, rdi
bswap edi
jl 0x140585ef9
movabs rbp, 0x330d1bfe67cc29f3
push rcx
not dil
cmp edi, ebp

Function at 0x140371d81
Capabilities:
Encode data using xor

Disassembly:
mov r13, r11
sub r11, 0x500d2af8
jl 0x14058bd25
push 0x437b5c0a
push r12
not r11w
add qword [rsp + 0x28], 0x304d4
mov r11, qword [rsp + 0x20]
mov r12, r13
sub r13b, 0x36
mov r13, qword [rsp + 0x18]
mov r12, qword [rsp]
lea rsp, [rsp + 0x28]
ret

Function at 0x140382c0c
Capabilities:
Encode data using base64

Disassembly:
xor byte [rsp + 8], 0x42
push rbp
add qword [rsp + 8], 0xfffffffffff9c0b3
movzx r9w, sil
not r9b
movabs rbp, 0x66ad17c064f20449
push r13
mov byte [rsp + 0x18], dil
neg word [rsp + 0x18]
movabs r13, 0x550b45265bb329de
mov r9, qword [rsp + 0x28]
xor ebp, edi
Function at 0x14038411b
Capabilities:
Encode data using xor

Disassembly:
cmp qword [rsp + 0x48], 0x178d3f27
movzx ecx, word [rsp + 0x3a]
jns 0x140411cc1
add byte [rax], al
add byte [rdi + 0x6c], al
outsd dx, dword [rsi]
invalid
jo 0x140316fe3
add r12d, dword [rsp + 0x41]
mov rsi, qword [rsp + 0x80]
xor qword [rsp + 0x48], 0x7dea32f9
not dword [rsp + 0x38]
and dx, word [rsp + 0x6c]
or cx, word [rsp + 0x6e]
seta byte [rsp + 0x38]
jg 0x14040adcf

Function at 0x1403fff34
Capabilities:
Encode data using xor

Disassembly:
leave
sbb al, 0xef
invalid
setle r10b
sub dword [rsp + 0x10], 0x350c1fa8
mov r10, qword [rsp + 0x20]
neg edi
or dil, 0xa
cmp word [rsp + 0x10], 0x24ad
call fcn.14057acc0
insb byte [rdi], dx
add eax, 0xaef35e7d
loop 0x1403fffc7
pop rsi
scasb al, byte [rdi]
mov esi, dword [rcx]
and dword [rcx + 0x6c39087d], 0xc727b5e
outsb dx, byte [rsi]
pop rsi
push 0xffffffffa187131e
jnp 0x1403fff70
invalid
loop 0x1403fff14
movabs eax, dword [0x287289a18454e149]
jo 0x1403fffe1
invalid
xor byte [rcx], ah
adc al, 0xb2
movabs dword [0xcbfa7c095e633c61], eax
xchg edi, eax
movsb byte [rdi], byte [rsi]
inc ch
adc eax, dword [rcx]
add byte [rax], al
mov al, 0xeb
invalid
mov dl, 0xa3
invalid
push rcx
je 0x140400057
cmp dword [rdi - 0x2e], esp
cli
sbb dword [rcx + rbp*8], esi
add edi, dword [rbp + 0x14]
jno 0x1403fffc3
fldenv [rdx + 0x11]
mov edi, 0x84d2ee3d
in al, dx
test byte [rsp + riz*4 + 0x62], 0xee
movabs byte [0x6458311b04b80248], al
push rax
invalid
movabs byte [0xf75e0dbdb6f6a1e4], al
invalid

Function at 0x14056a490
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
lea rbp, [r10*2 + 0x4d94271d]
mov qword [rsp + 0x18], rbp
jns 0x1403235f2
add byte [rax], al
add byte [rdi + 0x77], bl
jb 0x140382ccd
je 0x140382ccb
add byte [rbx + 0x6a], cl
jle 0x140382ca8
call 0x102c33570
mov ch, 0xbc
invalid
pop rax
mov ch, 0x6b
cmp eax, 0x73ec6d33
ret 0x94b4
invalid
fnstcw word [rax - 0x3f]
mov esi, dword [rbx + rax*2 + 0x3003068a]
sti
xchg cl, al
test eax, 0xa802c289
invalid
xor r10b, 0xdd
xor ebp, 0x3762234d
setge dil
not r10
or r13w, si
and di, word [rsp + 0x23]
add rbp, 0x47442301
lea r13, [r10 + rdi*2 + 0x5065191c]
mov r13, qword [rsp + 8]
mov r10d, ebp
test esi, esi
jl 0x140382c4a
add byte [rsp + 0x20], 0x3e
mov rdi, rbp
and rbp, qword [rsp + 0x20]
test qword [rsp + 0x20], 0x1ca12623
call fcn.1402d8241
Function at 0x14057a8bb
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], 0xffffffffb446a712
movabs rbp, 0xa3706c30b0b389e
mov bp, 0x34d4
and bpl, 0x6e
setbe bpl
movsx ebp, bp
add rbp, rbp
push 0x63d1286b
jge 0x1403089f8
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x40]
call fcn.140598afb
add byte [rax], al
jae 0x14057a93f
jb 0x14057a944
add byte [rax - 0x75], cl
insb byte [rdi], dx
and al, 0x28
mov rsi, qword [rsp + 8]
je 0x14057a91f
cmp qword [rsp + 8], 0x72db2528
mov byte [rsp + 8], 0xe1
jg 0x140308a2f
ja 0x1402f98d5
sub r13b, byte [rsp + 0x22]
sub qword [rsp + 8], 0x57f85a73
sub dword [rsp + 0x20], 0x4ce9745b
cmp byte [rsp + 8], 0x18
setne sil
and si, r13w
add byte [rsp + 0x20], sil
neg r13d
call fcn.140363b1e
mov r10, qword [rsp + 0x18]
lea rsp, [rsp + 0x30]
ret 8
je 0x14057a965
and byte [rbp + 0x24648d48], bl
ret
lea esp, [rsp + 0x40]
ret
lea rbp, [rbp + rbp*2 + 0x77cd6aed]
call fcn.14058014c

Function at 0x14057d6b4
Capabilities:
Encode data using xor

Disassembly:
sub r14d, r14d
xor r14b, r14b
or r14d, 0x1516651
mov r14, qword [rsp + 0x10]
movabs r12, 0x19636fa469313fcb
xor r12b, 0xd9
jb 0x1402fec5d
cmp r12, 0x2e0c6a67
setle r12b
test r12b, r12b
movsx r12d, r12b
sete r12b
xor r12, 0x20326160
sub r12w, 0x6d85
movzx r12w, r12b
movsxd r12, r12d
pop r12
popfq
lea rsp, [rsp + 8]
call fcn.14062c6b6
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x28], 0xffffffffd3de9cd7
add r14w, 0x4ea0
lea r14, [r10*4 + 0x2b92e6c]
movzx r10w, r10w
and r14w, 0x2c3
lea r10, [r10 + r14*4 + 0x40b271c7]
or r10, r10
and r10w, r14w
lea r10, [r10 + r14*4 + 0x78f42e9b]
movsx r14d, r10b
mov r10, qword [rsp + 0x10]
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x18]
ret
not r14w
cmp r10d, 0x29cd0176
jae 0x1402fec60
jno 0x140317cc0
jp 0x14057d6ea
xchg esi, eax
invalid
inc dword [rax + 0x27302464]
mov dword [rsp + 0x40], 0x597a3cec
ret 8

Function at 0x14057d7d0
Capabilities:
Encode data using xor

Disassembly:
jbe 0x140583996
and r11, r11
mov r11w, 0x3ccc
movsxd r11, r11d
setae r11b
mov r11w, 0x4014
js 0x14043e408
cmp r11d, 0x579a7fd2
not r11w
bswap r11
mov r11, qword [rsp + 0x50]
call fcn.1402d9461
or byte [rax], ch
cmc
ret 0x6d5

Function at 0x140588d09
Capabilities:
Encode data using xor

Disassembly:
not cx
not bpl
jl 0x14032c58e
call fcn.14032c581
Function at 0x140130000
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x20], r9
leave
cmp eax, 0xff000096
shr cl, 1
hlt
mov ebx, 0x49fffff9
test edx, edi
lea edx, [rbp - 0xe57d]
lea esi, [rbx - 0x8791]
jmp 0x140131a50
and al, 0x53
jbe 0x14013164a
add byte [rax - 0x73], cl
test dword [rsi], esi
add dword [rax], eax
add byte [rbx + rbp - 0x40], cl
mov rax, r15
nop dword [rax]
nop dword [rax + rax]
jne 0x140131943
je 0x140131943
cmp r15d, 0x85e79441
rcr esi, 0x29
rol r12d, 0xb3
pause
jmp rax
jmp 0x140131ad2
cmp dword [rbx], 0x44000005
lea ecx, [rdi - 0xf711]
or r15d, 0x67e56bb8
ret
nop
mov byte [rsp + r15 + 0x36], 0
inc r15
cmp r15, 5
jmp 0x140131bdd
and al, 0x7e
div dh
div dh
mov byte [rbp + rax - 0x67], r15b
inc rax
cmp rax, 0x26
jb 0x140131ad2
jmp 0x140131a11
jb 0x140131bf5
mov r9d, 0x10
lea r8, [rsp + 0x36]
lea rdx, [rbp - 0x67]
xor ecx, ecx
call rbx
jne 0x140131b8e
je 0x140131b8e
rcl edx, 0x67
lea r8d, [rbp + 0x3ba9]
or r12d, 0x92061c96
inc r8
call rcx
jmp rcx
jmp 0x140131905
Function at 0x140132dae
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
loope 0x14013164a
mov ebx, 0xfffe60e9
inc dword [rdi]
cmp al, 0x31
test rbp, rdi
cmp edx, 0xc8702fe4
ret
ficom dword [rcx - 0x332f008a]
je 0x1401325e1
call fcn.140132b83
test edx, ecx
ret
mov rcx, 0xffffffffffffffff
lea r8, [rsp + 0x30]
xchg rbx, rax
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x20], ebx
xchg rbx, rax
jmp 0x140132ae0
lea rdx, [rsp + 0x40]
call r12
cmp eax, 0xc0000096
jne 0x140132a8b
jmp 0x140132e93
lea esi, [rbp - 0x6a86]
rcl edx, 0xf0
jbe 0x1401320c5
jne 0x140132a60
jmp 0x140132d9a
nop
jmp rax
loope 0x140132d64
invalid
nop
cmp r13, rdx
mov r12d, 0x19a4138d
jb 0x140132fbc
jmp 0x1401330d3
jmp rcx
lea r8d, [rbp - 0x54d8]
jmp rcx
call rcx
syscall
cmp r10d, 0x3a442df0
call fcn.1401327b3
jmp 0x140133198
pushfq
jae 0x1401315ff
lea edx, [rdi + 0x3c]
lea ebx, [rbp - 0x5ed5]
call rcx
jmp 0x140133051

Function at 0x140133f40
Capabilities:
Execute syscall
Resolve function by parsing pe exports

Disassembly:
xchg r9, r11
mov qword [rsp + 0x20], r11
xchg r9, r11
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
xchg r14, rcx
mov qword [rsp + 8], r14
jmp 0x140133fd6
xchg rcx, rax
mov qword [rsp + 0x10], rcx
xchg rcx, rax
jmp fcn.140133ff0
xchg r8, rax
mov dword [rsp + 8], 0
xchg r10, rax
mov r10, qword [rsp + 0x30]
xchg r10, rax
je 0x140133fb7
jne 0x140133fb7
int3
jmp 0x140133f61
xchg rcx, r14
sub rsp, 0x28
lea rax, [0x140134260]
xchg r8, rax
mov qword [rsp + 0x18], r8
and al, 0x18
jmp 0x140133f6f
Function at 0x180002010
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov rbx, rcx
call fcn.180001fe0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1800022a0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx]
mov rbx, rcx
cmp eax, 0x270
jne 0x1800022b9
call fcn.180002500
jmp 0x1800022c5
cmp eax, 0x4e0
jb 0x1800022c5
call fcn.180002410
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret
jmp 0x1800022a0
mov rcx, qword [rcx]
jmp 0x180002310

Function at 0x1800023d0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx]
mov rbx, rcx
cmp eax, 0x270
jne 0x1800022b9
call fcn.180002500
jmp 0x1800022c5
cmp eax, 0x4e0
jb 0x1800022c5
call fcn.180002410
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret
jmp 0x1800022a0
mov rcx, qword [rcx]
jmp 0x180002310

Function at 0x180002410
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
lea r10, [rcx + 0x9c4]
mov r9, rcx
mov r11d, dword [r10]
mov ebx, 0xe3
nop word [rax + rax]
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x180002430
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x180002480
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
mov dword [r9], ebx
mov rbx, qword [rsp + 8]
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
ret
Function at 0x180002500
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
lea rax, [rcx + 8]
mov r9d, 0x270
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x180002510
ret

Function at 0x180002570
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r10d, r10d
mov r11, rcx
test r9, r9
je 0x180002655
cmp r9, 0x40
jb 0x180002633
movsx eax, byte [rcx]
lea rcx, [rdx - 1]
add rcx, r9
movd xmm2, eax
lea rax, [r8 - 1]
punpcklbw xmm2, xmm2
add rax, r9
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
cmp rdx, rax
ja 0x1800025bd
cmp rcx, r8
jae 0x180002633
cmp rdx, r11
ja 0x1800025c7
cmp rcx, r11
jae 0x180002633
mov rcx, r9
mov qword [rsp + 0x10], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp], rdi
mov rbx, r8
lea rax, [rdx + 0x10]
sub rbx, rdx
movdqu xmm0, xmmword [rbx + rax - 0x10]
add r10, 0x40
movdqu xmm1, xmmword [rbx + rax]
lea rax, [rax + 0x40]
xorps xmm0, xmm2
xorps xmm1, xmm2
movdqu xmmword [rax - 0x50], xmm0
movdqu xmm0, xmmword [rbx + rax - 0x30]
movdqu xmmword [rax - 0x40], xmm1
xorps xmm0, xmm2
movdqu xmm1, xmmword [rbx + rax - 0x20]
movdqu xmmword [rax - 0x30], xmm0
xorps xmm1, xmm2
movdqu xmmword [rax - 0x20], xmm1
cmp r10, rcx
jb 0x1800025e1
mov rbx, qword [rsp + 0x10]
mov rdi, qword [rsp]
cmp r10, r9
jae 0x180002655
sub r8, rdx
lea rax, [r10 + rdx]
sub r9, r10
nop dword [rax]
movzx ecx, byte [r8 + rax]
lea rax, [rax + 1]
xor cl, byte [r11]
mov byte [rax - 1], cl
sub r9, 1
jne 0x180002640
add rsp, 8
ret

Function at 0x180002b00
Capabilities:
Encode data using xor

Disassembly:
mov dword [rcx + 4], edx
lea r10, [rcx + 8]
mov eax, 1
nop dword [rax]
mov r9d, edx
lea r10, [r10 + 4]
shr r9d, 0x1e
xor edx, r9d
imul edx, r8d
add edx, eax
inc rax
mov dword [r10 - 4], edx
cmp rax, 0x270
jb 0x180002b10
mov dword [rcx], 0x270
ret

Function at 0x1800089d0
Capabilities:
Hash data using fnv

Disassembly:
movsx eax, dl
xor eax, ecx
imul eax, eax, 0x1000193
ret