joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400038e0
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
push rbp
push rsi
push r14
lea rbp, [r11 - 0x5f]
sub rsp, 0xc0
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov r14, qword [rcx + 0x10]
mov rsi, rcx
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 3
jb 0x140003b08
cmp qword [rsi + 0x18], 0xf
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r15
jbe 0x140003937
mov rsi, qword [rsi]
lea r15, [r14 + 3]
mov ebx, 0xf
lea rdi, [rbp + 0x1f]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rbp + 0x1f], xmm0
movdqu xmmword [rbp + 0x2f], xmm1
cmp r15, rbx
jbe 0x1400039d1
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x140003994
movabs rax, 0x8000000000000000
mov rbx, rcx
add rax, 0x27
mov rcx, rax
call fcn.1400087e0
test rax, rax
je 0x140003aca
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400039cd
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x1400039ad
xor edi, edi
jmp 0x1400039cd
cmp rcx, 0x1000
jb 0x1400039c5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003b0e
jmp 0x140003975
call fcn.1400087e0
mov rdi, rax
mov qword [rbp + 0x1f], rdi
mov ecx, dword [0x14000a438]
mov r8, r14
mov qword [rbp + 0x2f], r15
mov rdx, rsi
mov qword [rbp + 0x37], rbx
mov word [rdi], cx
movzx ecx, byte [0x14000a43a]
mov byte [rdi + 2], cl
lea rcx, [rdi + 3]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r15], 0
lea rax, str.cmd.exe
cmp qword [rbp + 0x37], 0xf
lea rcx, [rbp - 0x59]
xorps xmm0, xmm0
movups xmmword [rbp - 0x49], xmm0
mov qword [rbp - 0x41], rax
lea rax, [rbp + 0x1f]
cmova rax, qword [rbp + 0x1f]
movups xmmword [rbp - 0x59], xmm0
mov dword [rbp - 0x59], 0x70
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x39], rax
movups xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x55], 0x40
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 0x49], 0
movups xmmword [rbp - 9], xmm0
mov dword [rbp - 0x29], 0
movups xmmword [rbp + 7], xmm0
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x140003a6e
mov ebx, 0xffffffff
jmp 0x140003a98
mov rcx, qword [rbp + 0xf]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0xf]
lea rdx, [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 0x17]
mov rdx, qword [rbp + 0x37]
cmp rdx, 0xf
jbe 0x140003ad6
mov rcx, qword [rbp + 0x1f]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ad1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003ad1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140008a64
mov rdi, qword [rsp + 0xf0]
mov eax, ebx
mov rbx, qword [rsp + 0xe8]
mov r15, qword [rsp + 0xf8]
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.1400087c0
add rsp, 0xc0
pop r14
pop rsi
pop rbp
ret
call fcn.140001200
int3
call fcn.140001160
int3
Function at 0x140007290
Capabilities:
Create thread
Hide graphical window
Log keystrokes via application hook

Disassembly:
sub rsp, 0x98
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x80], rax
call fcn.140001240
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 8
call fcn.1400087e0
lea rcx, [0x140004a80]
mov qword [rax], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140007f60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000740f
cmp dword [rsp + 0x38], 0
je 0x140007403
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140007403
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140006cf0]
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x14000c7e0], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140006e60]
mov ecx, 0xe
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x14000c800], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x1400073c0
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_DispatchMessageA]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x140007393
mov rcx, qword [0x14000c7e0]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov rcx, qword [0x14000c800]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
nop
cmp dword [rsp + 0x38], 0
je 0x1400073e9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400087c0
add rsp, 0x98
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140009304
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000934e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000934e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000934e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000934e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000934e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140009350
xor al, al
add rsp, 0x28
ret
Function at 0x68cbd292
Capabilities:
Hash data with crc32

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov dword [rbp - 4], 0xffffffff
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
call method.QByteArray.begin___const
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x18]
mov rcx, rax
call method.QByteArray.end___const
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbp - 0x20]
je 0x68cbd318
mov rax, qword [rbp - 0x10]
movzx eax, byte [rax]
mov byte [rbp - 0x21], al
mov eax, dword [rbp - 4]
shr eax, 8
mov ecx, eax
mov eax, dword [rbp - 4]
movzx edx, al
movzx eax, byte [rbp - 0x21]
movzx eax, al
xor eax, edx
mov eax, eax
lea rdx, [rax*4]
lea rax, [0x68d76840]
mov eax, dword [rdx + rax]
xor eax, ecx
mov dword [rbp - 4], eax
add qword [rbp - 0x10], 1
jmp 0x68cbd2cd
not dword [rbp - 4]
mov eax, dword [rbp - 4]
add rsp, 0x50
pop rbp
ret
Function at 0x68cbd324
Capabilities:
Authenticate hmac

Disassembly:
push rbp
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x30], rcx
mov dword [rbp + 0x38], edx
mov qword [rbp + 0x40], r8
mov qword [rbp + 0x48], r9
mov edx, dword [rbp + 0x38]
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [method.QCryptographicHash.QCryptographicHash_QCryptographicHash::Algorithm_]
call rax
mov dword [rbp + 4], 0x40
mov rax, qword [rbp + 0x40]
mov rcx, rax
call method.QByteArray.size___const
mov edx, 0x40
sub edx, eax
lea rax, [rbp - 0x38]
mov r8d, 0
mov rcx, rax
mov rax, qword [method.QByteArray.QByteArray_int__char_]
call rax
lea rax, [rbp - 0x48]
lea rcx, [rbp - 0x38]
mov rdx, qword [rbp + 0x40]
mov r8, rcx
mov rcx, rax
call sym.operator_QByteArray_const__QByteArray_const_
lea rax, [rbp - 0x38]
mov rcx, rax
call method.QByteArray.QByteArray__
lea rax, [rbp - 0x50]
mov rcx, rax
call fcn.68cfd590
mov dword [rbp + 0xc], 0
cmp dword [rbp + 0xc], 0x3f
jg 0x68cbd3fd
lea rax, [rbp - 0x30]
mov ecx, dword [rbp + 0xc]
lea rdx, [rbp - 0x48]
mov r8d, ecx
mov rcx, rax
call method.QByteArray.operator___int_
lea rax, [rbp - 0x30]
mov rcx, rax
call method.QByteRef.operator_char___const
xor eax, 0x5c
movsx edx, al
lea rax, [rbp - 0x50]
mov rcx, rax
call method.QByteArray.operator_char_
add dword [rbp + 0xc], 1
jmp 0x68cbd3bd
lea rax, [rbp - 0x58]
mov rcx, rax
call fcn.68cfd590
mov dword [rbp + 8], 0
cmp dword [rbp + 8], 0x3f
jg 0x68cbd450
lea rax, [rbp - 0x20]
mov ecx, dword [rbp + 8]
lea rdx, [rbp - 0x48]
mov r8d, ecx
mov rcx, rax
call method.QByteArray.operator___int_
lea rax, [rbp - 0x20]
mov rcx, rax
call method.QByteRef.operator_char___const
xor eax, 0x36
movsx edx, al
lea rax, [rbp - 0x58]
mov rcx, rax
call method.QByteArray.operator_char_
add dword [rbp + 8], 1
jmp 0x68cbd410
lea rdx, [rbp - 0x58]
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [method.QCryptographicHash.addData_QByteArray_const_]
call rax
mov rdx, qword [rbp + 0x48]
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [method.QCryptographicHash.addData_QByteArray_const_]
call rax
lea rax, [rbp - 8]
lea rdx, [rbp - 0x40]
mov rcx, rax
mov rax, qword [method.QCryptographicHash.result___const]
call rax
lea rdx, [rbp - 8]
lea rax, [rbp - 0x50]
mov rcx, rax
call method.QByteArray.operator_QByteArray_const_
lea rax, [rbp - 8]
mov rcx, rax
call method.QByteArray.QByteArray__
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [method.QCryptographicHash.reset__]
call rax
lea rdx, [rbp - 0x50]
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [method.QCryptographicHash.addData_QByteArray_const_]
call rax
mov rcx, qword [rbp + 0x30]
lea rax, [rbp - 0x40]
mov rdx, rax
mov rax, qword [method.QCryptographicHash.result___const]
call rax
nop
lea rax, [rbp - 0x58]
mov rcx, rax
call method.QByteArray.QByteArray__
lea rax, [rbp - 0x50]
mov rcx, rax
call method.QByteArray.QByteArray__
lea rax, [rbp - 0x48]
mov rcx, rax
call method.QByteArray.QByteArray__
lea rax, [rbp - 0x40]
mov rcx, rax
mov rax, qword [method.QCryptographicHash.QCryptographicHash__]
call rax
jmp 0x68cbd585
mov rax, qword [rbp + 0x30]
add rsp, 0x98
pop rbx
pop rbp
ret
Function at 0x68cf97f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x68de76c4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x68cf9978
mov rax, qword [0x68de76c8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x68cf983c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x68cf98c5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x68cf9820
mov rcx, rbx
call sym.unk_10125
test rax, rax
mov r12, rax
je 0x68cf99ad
mov rax, qword [0x68de76c8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym.unk_10128
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x68de76c8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x68cf9990
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x68cf98be
sub eax, 0x40
and eax, 0xffffffbf
jne 0x68cf9920
add dword [0x68de76c4], 1
cmp edi, 8
jae 0x68cf98f3
test dil, 4
jne 0x68cf9964
test edi, edi
je 0x68cf98e8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x68cf997f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x68cf98e8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x68cf990c
jmp 0x68cf98e8
add rsi, qword [0x68de76c8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x68cf98be
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.unk_10111
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x68cf98e8
xor esi, esi
jmp 0x68cf9847
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x68cf98e8
mov rax, qword [0x68de76c8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.unk_10111
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.unk_10111
nop
nop dword [rax]

Function at 0x68cfa100
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x68de79a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x68de7980]
test rbx, rbx
je 0x68cfa154
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x68cfa14b
test rsi, rsi
je 0x68cfa14b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x68cfa130
lea rcx, [0x68de79a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x68cfa390
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x68cfa3a0
xor eax, eax
ret
jmp sym.unk_10121

Function at 0x68cfa3b0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x68cfa3f1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x68cfa3e8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x68cfa3f3
add rax, 0x28
cmp rax, r9
jne 0x68cfa3d4
xor eax, eax
ret

Function at 0x68cfa490
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x68d96f30]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x68cfa4fd
mov rcx, r8
call sym.unk_10121
test eax, eax
je 0x68cfa4fd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x68cfa4fd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x68cfa4f4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x68cfa4ff
add rax, 0x28
cmp rax, r9
jne 0x68cfa4e0
xor eax, eax
add rsp, 0x28
ret

Function at 0x68cfa600
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x68d96f30]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x68cfa620
add rsp, 0x28
ret
mov rcx, r8
call sym.unk_10121
test eax, eax
je 0x68cfa618
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x68cfa67d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x68cfa674
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x68cfa684
add rax, 0x28
cmp rax, r9
jne 0x68cfa660
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x68cfa6a0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x68d96f30]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x68cfa70e
mov rcx, r11
call sym.unk_10121
test eax, eax
je 0x68cfa70e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x68cfa70e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x68cfa70e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x68cfa705
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x68cfa715
add rcx, 0x28
cmp rcx, rax
jne 0x68cfa6f0
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x68cfa728
jmp 0x68cfa70e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x68cfa736
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x68cfa70e
test r9d, r9d
jg 0x68cfa720
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x68d75410
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.unk_10138
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.unk_10138
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140001c20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp byte [0x140158b34], 0
movzx esi, dl
mov rdi, r8
setne al
add dl, 2
add al, dl
movzx ebp, al
mov ecx, ebp
call fcn.1400d3350
cmp byte [0x140158b34], 0
mov rbx, rax
je 0x140001cb3
movzx r8d, sil
movzx r9d, sil
or r8b, 0x80
mov byte [rax], 0x51
mov byte [rax + 1], r8b
xor r8b, 0x3f
lea ecx, [r9 + 2]
mov r10d, ecx
mov byte [rcx + rax], r8b
test sil, sil
je 0x140001ca5
lea rcx, [rax + 2]
sub rdi, rax
nop dword [rax]
movzx eax, byte [rdi + rcx - 2]
mov byte [rcx], al
lea rcx, [rcx + 1]
xor byte [r10 + rbx], al
sub r9, 1
jne 0x140001c90
mov r9, rbx
movzx r8d, bpl
call fcn.140002470
jmp 0x140001d01
movzx edx, sil
movzx r8d, sil
or dl, 0x80
mov byte [rax], dl
xor dl, 0x3f
lea eax, [r8 + 1]
mov r9d, eax
mov byte [rax + rbx], dl
test sil, sil
je 0x140001cf5
lea rcx, [rbx + 1]
sub rdi, rbx
nop dword [rax]
movzx eax, byte [rdi + rcx - 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
xor byte [r9 + rbx], al
sub r8, 1
jne 0x140001ce0
mov r9, rbx
movzx r8d, bpl
call fcn.140001f70
mov rcx, rbx
mov edi, eax
call fcn.1400d3330
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140009680
Capabilities:
Set console window title

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14014e110]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov byte [0x14015a458], 1
call qword [sym.imp.KERNEL32.dll_AllocConsole]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_AttachConsole]
mov ecx, 1
call fcn.1400ce900
mov r9, rax
lea r8, [0x140129734]
lea rdx, str.CONOUT_
lea rcx, [rsp + 0x20]
call fcn.1400d989c
mov ecx, 2
call fcn.1400ce900
mov r9, rax
lea r8, [0x140129734]
lea rdx, str.CONOUT_
lea rcx, [rsp + 0x20]
call fcn.1400d989c
lea rcx, str.RLA_Utility_Console
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400ab460
add rsp, 0x38
ret
Function at 0x14000e200
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14014e110]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, rcx
cmp qword [rcx + 0x68], 0
je 0x14000e3d0
cmp byte [rcx + 0x71], 0
je 0x14000e3d0
mov rax, qword [rcx]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.1400029f0]
or edx, 0xffffffff
mov rcx, r15
call rbx
cmp eax, 0xffffffff
jne 0x14000e26c
xor al, al
jmp 0x14000e3d2
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x20], 0
mov byte [rbp - 0x30], 0
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp - 0x30]
call fcn.14000d9b0
nop
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x18]
nop dword [rax]
lea r9, [rbp - 0x30]
cmp rdx, 0x10
cmovae r9, rcx
lea r14, [rbp - 0x30]
cmovae r14, rcx
mov rsi, qword [r15 + 0x68]
mov rdx, qword [rsi]
mov rbx, qword [rbp - 0x20]
add rbx, r9
mov rdi, qword [rdx + 0x40]
mov rcx, rdi
call qword [fcn.1400029f0]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, r14
lea rdx, [r15 + 0x74]
mov rcx, rsi
call rdi
test eax, eax
je 0x14000e2f2
sub eax, 1
jne 0x14000e368
jmp 0x14000e2f7
mov byte [r15 + 0x71], 0
lea rax, [rbp - 0x30]
mov rcx, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
cmovae rax, rcx
mov rbx, qword [rbp - 0x38]
sub rbx, rax
je 0x14000e344
lea rax, [rbp - 0x30]
cmp rdx, 0x10
cmovae rax, rcx
mov r9, qword [r15 + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, rax
call fcn.1400d8860
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
cmp rbx, rax
jne 0x14000e375
cmp byte [r15 + 0x71], 0
je 0x14000e379
test rbx, rbx
jne 0x14000e2a0
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rbp - 0x30]
call fcn.14000dce0
jmp 0x14000e291
sub eax, 2
mov rdx, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x30]
je 0x14000e379
xor bl, bl
jmp 0x14000e37b
mov bl, 1
cmp rdx, 0x10
jb 0x14000e3cb
lea rax, [rdx + 1]
cmp rax, 0x1000
jb 0x14000e3c6
test byte [rbp - 0x30], 0x1f
je 0x14000e399
call fcn.1400d853c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14000e3a8
call fcn.1400d853c
int3
sub rcx, rax
cmp rcx, 8
jae 0x14000e3b7
call fcn.1400d853c
int3
cmp rcx, 0x27
jbe 0x14000e3c3
call fcn.1400d853c
int3
mov rcx, rax
call fcn.1400abe38
movzx eax, bl
jmp 0x14000e3d2
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400ab460
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140017ad0
Capabilities:
Hash data using fnv

Disassembly:
mov byte [rsp + 0x20], r9b
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x14014e110]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x20], rcx
movzx ecx, byte [r8]
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
movzx eax, byte [r8 + 1]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [r8 + 2]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [r8 + 3]
xor rcx, rax
imul rcx, rdx
mov r15, qword [rsi + 0x30]
and r15, rcx
shl r15, 4
mov rbx, qword [rsi + 0x18]
mov rax, qword [rbx + r15]
cmp rax, qword [rsi + 8]
jne 0x140017b65
mov rbx, qword [rsi + 8]
jmp 0x140017b6d
mov rbx, qword [rbx + r15 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x140017b95
mov ecx, dword [r8]
mov rbx, qword [rbx + 8]
cmp ecx, dword [rbx + 0x10]
je 0x140017b85
cmp rbx, rax
jne 0x140017b75
jmp 0x140017b95
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x140017c7d
mov rax, qword [rsi + 8]
mov rdi, qword [rax]
mov r9, r8
mov r8, qword [rdi + 8]
mov rdx, rdi
call fcn.14001bc80
mov rdx, rax
movabs rcx, 0xaaaaaaaaaaaaaa9
sub rcx, qword [rsi + 0x10]
cmp rcx, 1
jae 0x140017bcf
lea rcx, str.list_T__too_long
call fcn.140088d58
int3
inc qword [rsi + 0x10]
mov qword [rdi + 8], rdx
mov rax, qword [rax + 8]
mov qword [rax], rdx
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
mov qword [rsp + 0x38], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x140017c1f
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rcx, qword [rsi + 0x18]
add rcx, r15
mov rax, qword [rcx]
cmp rax, qword [rsi + 8]
jne 0x140017c3d
mov qword [rcx], rdi
mov rax, qword [rsi + 0x18]
mov qword [rax + r15 + 8], rdi
jmp 0x140017c69
cmp rax, rbx
jne 0x140017c47
mov qword [rcx], rdi
jmp 0x140017c69
mov rax, qword [rcx + 8]
mov rdx, qword [rax]
mov qword [rcx + 8], rdx
cmp rdx, rdi
je 0x140017c69
mov r8, qword [rsi + 0x18]
mov rax, qword [r8 + r15 + 8]
mov rdx, qword [rax + 8]
mov qword [r8 + r15 + 8], rdx
mov rcx, rsi
call fcn.140019e30
nop
mov qword [r14], rdi
mov byte [r14 + 8], 1
mov rax, r14
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400ab460
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret