joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140017320
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp byte [rcx + 0x1c], 0
jne 0x140017366
mov r15, qword [r14 + 0x20]
lea rcx, [0x14003bc50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp byte [r14 + 0x1c], 0
jne 0x140017366
xor ecx, ecx
cmp r15, rax
sete cl
bts rcx, 0x20
mov qword [r14 + 0x18], rcx
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov r9, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.14000d900
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x140037386
mov rsi, r9
mov rdi, r8
mov r14, rdx
and rcx, 0xfffffffffffffffc
call fcn.1400373a0
test al, al
je 0x140037386
mov rcx, qword [rbx + 0x20]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140037386
mov r14, rax
mov rcx, rax
call fcn.1400373a0
test al, al
je 0x140037386
mov rcx, rbx
mov rdx, r14
mov r8, rdi
mov r9, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x140017320
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140017390
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140042028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x140043f34]
mov ecx, dword [0x1400421a8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400173e0
mov esi, dword [0x140043f30]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14001bce0
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x140043f34]
call fcn.14001aa38
cmp dword [0x140043f34], 0xffffffff
jne 0x1400173c5
lea rsi, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsi + 4]
mov dword [0x140043f30], eax
lea rcx, [0x140043f34]
call fcn.14001a9d8
jmp 0x1400173c5

Function at 0x140017420
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140042028]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x140043f44]
mov ecx, dword [0x1400421a8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140017470
mov esi, dword [0x140043f40]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14001bce0
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x140043f44]
call fcn.14001aa38
cmp dword [0x140043f44], 0xffffffff
jne 0x140017455
lea rsi, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsi + 0x28]
mov dword [0x140043f40], eax
lea rcx, [0x140043f44]
call fcn.14001a9d8
jmp 0x140017455
Function at 0x14001e4e0
Capabilities:
Query environment variable

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x140042028]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, str.MOZ_ENABLE_HANDLE_VERIFIER
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14001e532
call fcn.14001e640
mov rcx, qword [rax]
mov rdx, qword [rcx + 0x18]
mov rcx, rax
mov rax, rdx
call qword [0x140047010]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14001bce0
nop
add rsp, 0x60
pop rsi
ret
movaps xmm0, xmmword [str.kernel32_]
movaps xmmword [rsp + 0x30], xmm0
movabs rax, 0x6c006c0064002e
mov qword [rsp + 0x40], rax
mov word [rsp + 0x48], 0
cmp qword [0x140043ec0], 0
jne 0x14001e570
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x140043ec0], rax
lea r9, [rsp + 0x28]
mov qword [r9], 0
lea rax, [0x140043f10]
lea r8, [rsp + 0x30]
mov qword [r8], rax
lea rsi, [0x140043ea0]
mov qword [r8 + 8], rsi
lea rax, [0x14003ab4e]
mov qword [r8 + 0x10], rax
lea rax, [0x140038290]
mov qword [r8 + 0x18], rax
mov byte [r8 + 0x20], 0
lea rcx, [0x140043f18]
lea rdx, [0x1400372e0]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x14001e506
cmp qword [rsp + 0x28], 0
je 0x14001e506
lea r9, [rsp + 0x28]
mov qword [r9], 0
lea rax, [0x140043f20]
lea r8, [rsp + 0x30]
mov qword [r8], rax
mov qword [r8 + 8], rsi
lea rax, [0x14003ab3e]
mov qword [r8 + 0x10], rax
lea rax, [0x1400382d0]
mov qword [r8 + 0x18], rax
mov byte [r8 + 0x20], 0
lea rcx, [0x140043f28]
lea rdx, [0x1400372e0]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x14001e506
cmp qword [rsp + 0x28], 0
jne 0x14001e51e
jmp 0x14001e506
Function at 0x140021d30
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
sub rsp, 0x140
mov rax, qword [0x140042028]
xor rax, rsp
mov qword [rsp + 0x138], rax
mov edx, 0x10
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x140021d72
mov rcx, qword [rsp + 0x138]
xor rcx, rsp
call fcn.14001bce0
nop
add rsp, 0x140
pop rsi
ret
lea rsi, [rsp + 0x28]
mov dword [rsi - 8], 3
mov rcx, rsi
call fcn.140017820
lea rax, str._builds_worker_checkouts_gecko_security_sandbox_chromium_base_rand_util_win.cc
mov qword [rsi + 0xf0], rax
mov dword [rsi + 0xf8], 0x20
lea rcx, [rsp + 0x130]
call fcn.140021dc0
lea rcx, [rsp + 0x20]
call fcn.14001fad0
jmp 0x140021d58

Function at 0x1400232d0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140042038]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140023300
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x140023300
mov rax, qword [rax + rcx]
jmp 0x140023302
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x140023690
Capabilities:
Parse pe header

Disassembly:
movzx eax, word [rcx]
cmp eax, 0x5a4d
jne 0x1400236c2
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax], 0x4550
jne 0x1400236c2
movzx edx, word [rcx + rax + 0x14]
cmp edx, 0xf0
jne 0x1400236c2
movzx eax, word [rcx + rax + 0x18]
cmp eax, 0x20b
sete al
ret
xor eax, eax
jmp 0x1400236c1

Function at 0x14002ac60
Capabilities:
Create pipe

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov r14, qword [rsp + 0xc8]
mov rax, qword [0x140042028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov qword [r14], 0xffffffffffffffff
mov esi, 5
cmp ecx, 3
jne 0x14002ad44
mov edi, dword [rsp + 0xc0]
mov r11d, dword [rsp + 0xb8]
mov ecx, dword [rsp + 0xb0]
mov eax, dword [rsp + 0xa8]
mov r10d, dword [rsp + 0xa0]
cmp qword [r8 + 0x18], 8
jb 0x14002acc6
mov r8, qword [r8]
mov rsi, qword [rdx]
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], r11d
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x38], 0
mov rcx, r8
mov edx, r9d
mov r8d, r10d
mov r9d, eax
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
cmp rax, 0xffffffffffffffff
je 0x14002ad5f
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r15d, r15d
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
mov dword [rsp + 0x30], 3
lea rbx, [rsp + 0x40]
mov rcx, rax
mov rdx, rdi
mov r8, rsi
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
cmp eax, 1
sbb r15, r15
or r15, qword [rbx]
mov qword [r14], r15
xor eax, eax
cmp r15, 0xffffffffffffffff
sete al
lea esi, [rax + rax*4]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14001bce0
mov eax, esi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov r15, 0xffffffffffffffff
jmp 0x14002ad35
Function at 0x14002cae0
Capabilities:
Read file via mapping

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov edi, edx
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov dword [rsp + 0x20], edx
mov qword [rsp + 0x28], 0
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8d, 0x8000004
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rsi
mov rdx, rax
call fcn.1400083f0
mov rcx, qword [rsi]
lea rax, [rcx + 1]
cmp rax, 2
jb 0x14002cb4a
mov eax, edi
mov qword [rsp + 0x20], rax
mov edx, 6
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rsi + 8], rax
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x14002f8e0
Capabilities:
Create process on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
mov edi, ecx
mov rax, qword [0x140042028]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea eax, [rdi - 7]
mov ebp, 5
cmp eax, 0xfffffffe
jae 0x14002f93a
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14001bce0
mov eax, ebp
add rsp, 0xc8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r14, r8
mov r15, rdx
mov r12, qword [rsp + 0x130]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0x80], xmm0
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x60], xmm0
xor r13d, r13d
mov qword [rsp + 0xb0], r13
mov dword [rsp + 0x50], 0x68
cmp qword [r9 + 0x18], 8
jb 0x14002f98f
mov r9, qword [r9]
mov rcx, r9
call qword [sym.imp.mozglue.dll__wcsdup]
mov rsi, rax
mov rax, qword [r12 + 0x10]
cmp qword [r12 + 0x18], 8
jb 0x14002f9ac
mov r12, qword [r12]
mov rbx, qword [rsp + 0x138]
test rax, rax
cmove r12, rax
cmp qword [r14 + 0x18], 8
jb 0x14002f9c5
mov r14, qword [r14]
mov r15, qword [r15]
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
mov rcx, r14
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ebp, 5
test eax, eax
je 0x14002fa9b
cmp edi, 6
mov r12d, 0x1fffff
mov r13d, 0x101c01
cmove r13d, r12d
mov r14, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, r14
mov r8, r15
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x14002fab2
cmp edi, 6
mov ebp, 0x100c43
cmove ebp, r12d
mov rdi, qword [rbx + 8]
add rbx, 8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0
mov rcx, rax
mov rdx, rdi
mov r8, r15
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea ebp, [rcx + rcx*4]
test rsi, rsi
je 0x14002f914
mov rcx, rsi
call qword [sym.imp.mozglue.dll_free]
jmp 0x14002f914
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002fa9b
Function at 0x14002fac0
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rax, r8
mov r8, rdx
mov rdi, rcx
mov rsi, qword [rsp + 0x88]
mov edx, dword [rsp + 0x80]
xor r14d, r14d
mov qword [rsi], r14
mov rcx, qword [rcx]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], r9
xor edx, edx
mov r9, rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x14002fb4c
mov rbx, rax
mov rdi, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
mov dword [rsp + 0x30], 3
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
xor ecx, ecx
test eax, eax
sete cl
lea eax, [rcx + rcx*4]
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x140036b60
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140043e90]
test rax, rax
je 0x140036ba3
mov rax, qword [0x140043e90]
test rax, rax
je 0x140036bf0
mov rcx, qword [0x140043e90]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsi], rax
test rax, rax
je 0x140036bf3
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x140039fb0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x140036bf6
movsxd rax, dword [rcx + 0x3c]
cmp dword [rcx + rax], 0x4550
jne 0x140036bf6
movzx edx, word [rcx + rax + 0x14]
cmp edx, 0xf0
jne 0x140036bf6
movzx eax, word [rcx + rax + 0x18]
cmp eax, 0x20b
jne 0x140036bf6
xor eax, eax
lock cmpxchg qword [0x140043e90], rcx
jmp 0x140036b78
int3
int3
int3

Function at 0x140037320
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
cmp byte [rcx + 0x1c], 0
jne 0x140017366
mov r15, qword [r14 + 0x20]
lea rcx, [0x14003bc50]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp byte [r14 + 0x1c], 0
jne 0x140017366
xor ecx, ecx
cmp r15, rax
sete cl
bts rcx, 0x20
mov qword [r14 + 0x18], rcx
mov rcx, r14
mov rdx, rbx
mov r8, rdi
mov r9, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.14000d900
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x140037386
mov rsi, r9
mov rdi, r8
mov r14, rdx
and rcx, 0xfffffffffffffffc
call fcn.1400373a0
test al, al
je 0x140037386
mov rcx, qword [rbx + 0x20]
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140037386
mov r14, rax
mov rcx, rax
call fcn.1400373a0
test al, al
je 0x140037386
mov rcx, rbx
mov rdx, r14
mov r8, rdi
mov r9, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp 0x140017320
xor eax, eax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140037d80
Capabilities:
Get system information on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [0x140042028]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov eax, dword [0x140043f34]
mov ecx, dword [0x1400421a8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140037e23
mov r14, qword [rsi + 0x10]
test r14, r14
je 0x140037dff
mov r15, qword [rsi + 8]
shl r14, 4
add r14, r15
mov edi, dword [0x140043f30]
lea rbx, [rsp + 0x20]
mov r12, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [r15]
mov rcx, qword [r15 + 8]
mov rdx, rdi
mov r9, rbx
call r12
add r15, 0x10
cmp r15, r14
jne 0x140037de6
mov qword [rsi + 0x10], 0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14001bce0
nop
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rcx, [0x140043f34]
call fcn.14001aa38
cmp dword [0x140043f34], 0xffffffff
jne 0x140037dc0
lea rdi, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rdi + 4]
mov dword [0x140043f30], eax
lea rcx, [0x140043f34]
call fcn.14001a9d8
jmp 0x140037dc0

Function at 0x140037e60
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov r14, qword [rcx + 8]
lea rbx, [r14 + 2]
call fcn.140017390
mov r8d, eax
mov rax, r14
xor edx, edx
div r8
mov rcx, rax
mov rax, rbx
xor edx, edx
div r8
cmp rcx, rax
je 0x140037ea3
mov rcx, rbx
call fcn.1400373a0
test al, al
je 0x140037ef6
mov rdx, qword [rdi]
mov r8, qword [rdi + 8]
add r8, 2
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [rsi + 0x10], 8
xor eax, eax
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x30], 0x20
lea rax, [rsi + 0x38]
mov qword [rsi + 0x20], rax
mov byte [rsi + 0x58], 1
add rsi, 0x60
mov r9d, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1400110a0
mov rax, qword [rdi]
mov qword [rsi], rax
xor ecx, ecx
mov qword [rsi + 0x28], rcx
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov qword [rsi + 0x18], rcx
mov qword [rsi + 0x30], 0x20
lea rdx, [rsi + 0x38]
mov qword [rsi + 0x20], rdx
mov byte [rsi + 0x58], 0
mov qword [rsi + 0x60], rax
mov qword [rsi + 0x70], rcx
mov qword [rsi + 0x78], 2
lea rax, [rsi + 0x80]
mov qword [rsi + 0x68], rax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140005160
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rdx
movabs r9, 0xcbf29ce484222325
mov rdx, rcx
xor r10d, r10d
movzx eax, byte [r10 + r8]
movabs rcx, 0x100000001b3
xor r9, rax
inc r10
imul r9, rcx
cmp r10, 0x10
jb 0x140005173
mov rcx, qword [rdx + 0x30]
and rcx, r9
mov r9, qword [rdx + 0x18]
mov rdx, qword [rdx + 8]
mov rax, rcx
add rax, rax
lea r10, [rcx + rcx]
mov rax, qword [r9 + rax*8]
cmp qword [r9 + r10*8], rdx
jne 0x1400051ba
mov rcx, rdx
jmp 0x1400051c2
mov rcx, qword [r9 + r10*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400051fc
mov rcx, qword [rax + 0x10]
cmp rcx, qword [r8]
jne 0x1400051da
mov rcx, qword [rax + 0x18]
cmp rcx, qword [r8 + 8]
je 0x1400051df
mov rax, qword [rax]
jmp 0x1400051af
mov rcx, qword [r8]
sub rcx, qword [rax + 0x10]
jne 0x1400051f0
mov rcx, qword [r8 + 8]
sub rcx, qword [rax + 0x18]
test rcx, rcx
cmovne rax, rdx
mov qword [r11], rax
jmp 0x1400051ff
mov qword [r11], rdx
mov rax, r11
ret

Function at 0x140005204
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
mov rax, r8
movabs rcx, 0xcbf29ce484222325
mov rdi, rdx
xor r10d, r10d
movzx r8d, byte [rax + r10 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, r8
inc r10
imul rcx, rdx
cmp r10, 0x10
jb 0x140005224
mov r8, qword [r9 + 0x30]
mov rdx, qword [r9 + 0x18]
and r8, rcx
add r8, r8
cmp qword [rdx + r8*8 + 8], rax
jne 0x14000527c
cmp qword [rdx + r8*8], rax
jne 0x140005271
mov rcx, qword [r9 + 8]
mov qword [rdx + r8*8], rcx
mov rdx, qword [r9 + 0x18]
mov rcx, qword [r9 + 8]
jmp 0x140005275
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
jmp 0x140005289
cmp qword [rdx + r8*8], rax
jne 0x140005289
mov rcx, qword [rax]
mov qword [rdx + r8*8], rcx
mov rcx, qword [rax + 8]
mov edx, 1
mov rbx, qword [rax]
mov qword [rcx], rbx
mov r8, qword [rax]
mov rcx, qword [rax + 8]
mov qword [r8 + 8], rcx
lea r8d, [rdx + 0x27]
dec qword [r9 + 0x10]
mov rcx, rax
call fcn.1400020a4
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140005350
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, qword [r8]
mov r14, rcx
mov rcx, rbx
mov r13, r8
mov r12, rdx
call qword [sym.imp.OLEAUT32.dll_SysAllocStringByteLen]
xor ecx, ecx
mov edx, eax
movabs r9, 0xcbf29ce484222325
test eax, eax
je 0x1400053b0
movzx eax, byte [rcx + rbx]
movabs r8, 0x100000001b3
xor r9, rax
inc rcx
imul r9, r8
cmp rcx, rdx
jb 0x140005393
mov r15, qword [r14 + 0x30]
mov rbx, qword [r14 + 0x18]
and r15, r9
add r15, r15
mov rbx, qword [rbx + r15*8]
mov rcx, qword [r14 + 0x18]
mov rax, qword [r14 + 8]
cmp qword [rcx + r15*8], rax
je 0x1400053d8
mov rax, qword [rcx + r15*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x140005464
mov rsi, qword [r13]
mov rbp, qword [rbx + 0x10]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov rcx, rbp
mov edi, eax
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov r9d, edi
mov dword [rsp + 0x20], 1
mov edx, eax
mov r8, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringOrdinal]
cmp eax, 2
je 0x140005420
mov rbx, qword [rbx]
jmp 0x1400053c2
mov rsi, qword [rbx + 0x10]
mov rbp, qword [r13]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov rcx, rbp
mov edi, eax
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov r9d, edi
mov dword [rsp + 0x20], 1
mov edx, eax
mov r8, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_core_string_l1_1_0.dll_CompareStringOrdinal]
cmp eax, 2
je 0x14000545e
mov rbx, qword [r14 + 8]
mov qword [r12], rbx
jmp 0x14000546c
mov rax, qword [r14 + 8]
mov qword [r12], rax
mov rbx, qword [rsp + 0x60]
mov rax, r12
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1400055d4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, rcx
mov rax, r8
movabs rcx, 0xcbf29ce484222325
mov rdi, rdx
xor r10d, r10d
movzx r8d, byte [rax + r10 + 0x10]
movabs rdx, 0x100000001b3
xor rcx, r8
inc r10
imul rcx, rdx
cmp r10, 0x10
jb 0x1400055f4
mov r8, qword [r9 + 0x30]
mov rdx, qword [r9 + 0x18]
and r8, rcx
add r8, r8
cmp qword [rdx + r8*8 + 8], rax
jne 0x14000564c
cmp qword [rdx + r8*8], rax
jne 0x140005641
mov rcx, qword [r9 + 8]
mov qword [rdx + r8*8], rcx
mov rdx, qword [r9 + 0x18]
mov rcx, qword [r9 + 8]
jmp 0x140005645
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
jmp 0x140005659
cmp qword [rdx + r8*8], rax
jne 0x140005659
mov rcx, qword [rax]
mov qword [rdx + r8*8], rcx
mov rcx, qword [rax + 8]
mov edx, 1
mov rbx, qword [rax]
mov qword [rcx], rbx
mov r8, qword [rax]
mov rcx, qword [rax + 8]
mov qword [r8 + 8], rcx
lea r8d, [rdx + 0x1f]
dec qword [r9 + 0x10]
mov rcx, rax
call fcn.1400020a4
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140009038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rbx + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000905c
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400090b3
cmp qword [rcx + rdx*8], rbx
jne 0x1400090a8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400090ac
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400090c0
cmp qword [rcx + rdx*8], rbx
jne 0x1400090c0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x1400090f5
mov rcx, qword [rbx + 0x18]
inc rdx
mov r8d, 2
call fcn.1400020a4
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x37]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b51c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400148a0], eax
call fcn.14000b2a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
cmp dword [0x1400148a0], 0
jne case.default.0x14000b572
mov ecx, 1
call fcn.14000b2a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
or eax, 0x142e5848
add ah, byte [rdi - 0x7f]
or eax, 0x49b00c90
rol byte [rbx], 1
sbb al, byte [rdx + riz - 0x6a44b362]
rcr byte [rbp - 0x4c], 0xd2
fstp qword [rbp + 0xd]
pop rax
sbb eax, 0x777ba6e7
idiv edx
xor ecx, dword [rdi + rsi*4]
test byte [rcx], al
push rsp
fisubr dword [rcx + 0x2e]
and bl, byte [rax + rax*2 - 0x4e]
cmp edx, esi
and bl, byte cs:[rdx]
test byte [rbx], dh
pushfq
pop rsi
iretd