joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53b36c
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x180
mov eax, dword [0x005553e4]
cmp eax, 0
je 0x53b38d
lea rax, [0x00558430]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov eax, dword [0x005552e0]
cmp eax, 0
je 0x53b3c2
mov eax, dword [0x005553e4]
cmp eax, 0
je 0x53b3bd
lea rax, [0x00558430]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
jmp 0x53b5bb
mov eax, dword [0x005552dc]
mov dword [rbp - 4], eax
mov eax, 1
mov dword [0x005552e0], eax
mov eax, dword [0x005552d8]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
jbe 0x53b446
mov eax, dword [rbp - 0xc]
shl rax, 3
mov r8, rax
lea rax, [0x00555198]
mov r11, rax
lea rax, [rbp - 0x150]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov eax, 0
mov dword [0x005552d8], eax
mov eax, dword [rbp - 0xc]
shl rax, 3
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [0x00555198]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, dword [0x005553e4]
cmp eax, 0
je 0x53b467
lea rax, [0x00558430]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
mov eax, dword [0x005552fc]
cmp eax, 0
je 0x53b485
mov r11, qword [0x00554db0]
call r11
jmp 0x53b48d
mov eax, 0
mov dword [rbp - 4], eax
mov eax, dword [rbp - 0xc]
cmp eax, 0
jbe 0x53b4bc
mov eax, dword [rbp - 0xc]
mov r11, rax
lea rax, str.Found__u_leaked_objects:_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0053fe44
mov eax, 1
mov dword [rbp - 4], eax
mov eax, 0
mov dword [rbp - 8], eax
mov eax, dword [rbp - 8]
mov ecx, dword [rbp - 0xc]
cmp eax, ecx
jae 0x53b52a
jmp 0x53b4e4
mov eax, dword [rbp - 8]
mov ecx, eax
add eax, 1
mov dword [rbp - 8], eax
jmp 0x53b4c4
mov eax, dword [rbp - 8]
shl rax, 3
lea rcx, [rbp - 0x150]
add rcx, rax
mov rax, qword [rcx]
mov qword [rbp - 0x158], rax
mov rax, qword [rbp - 0x158]
mov r10, rax
mov rcx, r10
mov r11, qword [fcn.005279d8]
call r11
mov rax, qword [rbp - 0x158]
mov r10, rax
mov rcx, r10
call fcn.005360b9
jmp 0x53b4d7
mov eax, dword [rbp - 4]
cmp eax, 0
je 0x53b56e
lea rax, str.GC_ABORT_ON_LEAK
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_getenv
cmp rax, 0
je 0x53b56e
lea rax, str.Leaked_or_smashed_objects_encountered
mov r10, rax
mov rcx, r10
mov r11, qword [0x00555380]
call r11
call sub.kernel32.dll_DebugBreak
mov eax, dword [0x005553e4]
cmp eax, 0
je 0x53b58f
lea rax, [0x00558430]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov eax, 0
mov dword [0x005552e0], eax
mov eax, dword [0x005553e4]
cmp eax, 0
je 0x53b5bb
lea rax, [0x00558430]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
leave
ret
Function at 0x53c4dd
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0
mov dword [rbp - 0x3c], eax
mov eax, dword [0x00555314]
cmp eax, 2
jne 0x53c50f
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x3c], eax
mov eax, 0
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov ecx, dword [0x005552f8]
cmp eax, ecx
jae 0x53c681
jmp 0x53c53a
mov eax, dword [rbp - 0xc]
mov ecx, eax
add eax, 1
mov dword [rbp - 0xc], eax
jmp 0x53c517
mov eax, dword [rbp - 0xc]
shl rax, 5
lea rcx, [0x00554f68]
add rcx, rax
mov qword [rbp - 0x28], rcx
mov rax, qword [rbp - 0x28]
add rax, 8
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov rax, qword [rbp - 0x30]
cmp rax, 0
jne 0x53c571
jmp 0x53c52d
movabs rax, 1
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0x80
ja 0x53c67c
jmp 0x53c5a6
mov rax, qword [rbp - 8]
mov rcx, rax
add rax, 1
mov qword [rbp - 8], rax
jmp 0x53c57f
mov rax, qword [rbp - 8]
shl rax, 3
mov rcx, qword [rbp - 0x30]
add rcx, rax
mov qword [rbp - 0x38], rcx
mov rax, qword [rbp - 0x38]
mov rcx, qword [rax]
mov qword [rbp - 0x20], rcx
cmp rcx, 0
je 0x53c677
mov rax, qword [rbp + 0x10]
cmp rax, 0
je 0x53c5fe
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x48], rax
mov r11, qword [rbp - 0x48]
call r11
cmp eax, 0
je 0x53c5fe
mov eax, 0
jmp 0x53c6c5
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call fcn.005286ac
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rcx]
mov qword [rax], rdx
mov eax, dword [rbp + 0x18]
cmp eax, 0
je 0x53c64a
mov rax, qword [rbp - 0x18]
add rax, 0x1a
movzx ecx, word [rax]
mov rax, qword [0x00554cf8]
sub rax, 1
cmp rcx, rax
jne 0x53c672
mov rax, qword [rbp - 0x18]
add rax, 0x20
mov ecx, 0
mov r8, rcx
mov rcx, qword [rax]
mov r11, rcx
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0053ba93
jmp 0x53c5b9
jmp 0x53c595
jmp 0x53c52d
mov eax, dword [0x00555314]
cmp eax, 2
jne 0x53c6c0
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x4c], eax
mov eax, dword [rbp - 0x4c]
mov ecx, dword [rbp - 0x3c]
sub eax, ecx
mov ecx, 0
mov r8, rcx
mov r11, rax
lea rax, str.Disposing_of_reclaim_lists_took__lu_ms__lu_ns_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0053fee2
mov eax, 1
leave
ret
Function at 0x53c4e8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov eax, 0
mov dword [rbp - 0x3c], eax
mov eax, dword [0x00555314]
cmp eax, 2
jne 0x53c50f
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x3c], eax
mov eax, 0
mov dword [rbp - 0xc], eax
mov eax, dword [rbp - 0xc]
mov ecx, dword [0x005552f8]
cmp eax, ecx
jae 0x53c681
jmp 0x53c53a
mov eax, dword [rbp - 0xc]
mov ecx, eax
add eax, 1
mov dword [rbp - 0xc], eax
jmp 0x53c517
mov eax, dword [rbp - 0xc]
shl rax, 5
lea rcx, [0x00554f68]
add rcx, rax
mov qword [rbp - 0x28], rcx
mov rax, qword [rbp - 0x28]
add rax, 8
mov rcx, qword [rax]
mov qword [rbp - 0x30], rcx
mov rax, qword [rbp - 0x30]
cmp rax, 0
jne 0x53c571
jmp 0x53c52d
movabs rax, 1
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
cmp rax, 0x80
ja 0x53c67c
jmp 0x53c5a6
mov rax, qword [rbp - 8]
mov rcx, rax
add rax, 1
mov qword [rbp - 8], rax
jmp 0x53c57f
mov rax, qword [rbp - 8]
shl rax, 3
mov rcx, qword [rbp - 0x30]
add rcx, rax
mov qword [rbp - 0x38], rcx
mov rax, qword [rbp - 0x38]
mov rcx, qword [rax]
mov qword [rbp - 0x20], rcx
cmp rcx, 0
je 0x53c677
mov rax, qword [rbp + 0x10]
cmp rax, 0
je 0x53c5fe
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x48], rax
mov r11, qword [rbp - 0x48]
call r11
cmp eax, 0
je 0x53c5fe
mov eax, 0
jmp 0x53c6c5
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
call fcn.005286ac
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rcx]
mov qword [rax], rdx
mov eax, dword [rbp + 0x18]
cmp eax, 0
je 0x53c64a
mov rax, qword [rbp - 0x18]
add rax, 0x1a
movzx ecx, word [rax]
mov rax, qword [0x00554cf8]
sub rax, 1
cmp rcx, rax
jne 0x53c672
mov rax, qword [rbp - 0x18]
add rax, 0x20
mov ecx, 0
mov r8, rcx
mov rcx, qword [rax]
mov r11, rcx
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0053ba93
jmp 0x53c5b9
jmp 0x53c595
jmp 0x53c52d
mov eax, dword [0x00555314]
cmp eax, 2
jne 0x53c6c0
call sub.kernel32.dll_GetTickCount
mov dword [rbp - 0x4c], eax
mov eax, dword [rbp - 0x4c]
mov ecx, dword [rbp - 0x3c]
sub eax, ecx
mov ecx, 0
mov r8, rcx
mov r11, rax
lea rax, str.Disposing_of_reclaim_lists_took__lu_ms__lu_ns_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.0053fee2
mov eax, 1
leave
ret
Function at 0x53fa3e
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x180
mov eax, 0
mov dword [rbp - 0x14], eax
lea rax, [rbp - 0x128]
mov qword [rbp - 0x10], rax
mov eax, 0x105
mov r8, rax
lea rax, [rbp - 0x128]
mov r11, rax
lea rax, str.GC_LOG_FILE
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetEnvironmentVariableA
sub eax, 1
cmp eax, 0x104
jae 0x53fa9f
mov eax, 1
mov dword [rbp - 0x14], eax
jmp 0x53fb47
mov eax, 0x105
mov r8, rax
lea rax, [rbp - 0x128]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetModuleFileNameA
mov dword [rbp - 0x12c], eax
mov eax, dword [rbp - 0x12c]
cmp eax, 4
jle 0x53fb0f
mov eax, dword [rbp - 0x12c]
sub eax, 4
movsxd rax, eax
lea rcx, [rbp - 0x128]
add rcx, rax
movsx eax, byte [rcx]
cmp eax, 0x2e
jne 0x53fb0f
mov eax, dword [rbp - 0x12c]
sub eax, 4
mov dword [rbp - 0x12c], eax
mov eax, dword [rbp - 0x12c]
movsxd rax, eax
lea rcx, [rbp - 0x128]
add rcx, rax
movabs rax, 8
mov r8, rax
lea rax, str..gc.log
mov r11, rax
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov eax, dword [rbp - 0x14]
cmp eax, 0
je 0x53fb58
jmp 0x53fb62
mov eax, 2
jmp 0x53fb67
mov eax, 4
mov ecx, dword [0x00555314]
cmp ecx, 2
mov dword [rbp - 0x130], eax
jne 0x53fb81
jmp 0x53fb8b
mov eax, 0x80000080
jmp 0x53fb90
mov eax, pe_nt_image_headers64
movabs rcx, 0
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x130]
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 1
mov r8, rax
mov eax, 0x40000000
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateFileA
mov qword [rbp - 8], rax
mov eax, dword [rbp - 0x14]
cmp eax, 0
je 0x53fc33
mov rax, qword [rbp - 8]
cmp rax, 0xffffffffffffffff
je 0x53fc33
mov eax, 0
mov dword [rbp - 0x134], eax
mov eax, 2
mov r9, rax
lea rax, [rbp - 0x134]
mov r8, rax
mov eax, 0
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SetFilePointer
mov rax, qword [rbp - 8]
leave
ret
Function at 0x53fa49
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x180
mov eax, 0
mov dword [rbp - 0x14], eax
lea rax, [rbp - 0x128]
mov qword [rbp - 0x10], rax
mov eax, 0x105
mov r8, rax
lea rax, [rbp - 0x128]
mov r11, rax
lea rax, str.GC_LOG_FILE
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetEnvironmentVariableA
sub eax, 1
cmp eax, 0x104
jae 0x53fa9f
mov eax, 1
mov dword [rbp - 0x14], eax
jmp 0x53fb47
mov eax, 0x105
mov r8, rax
lea rax, [rbp - 0x128]
mov r11, rax
movabs rax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetModuleFileNameA
mov dword [rbp - 0x12c], eax
mov eax, dword [rbp - 0x12c]
cmp eax, 4
jle 0x53fb0f
mov eax, dword [rbp - 0x12c]
sub eax, 4
movsxd rax, eax
lea rcx, [rbp - 0x128]
add rcx, rax
movsx eax, byte [rcx]
cmp eax, 0x2e
jne 0x53fb0f
mov eax, dword [rbp - 0x12c]
sub eax, 4
mov dword [rbp - 0x12c], eax
mov eax, dword [rbp - 0x12c]
movsxd rax, eax
lea rcx, [rbp - 0x128]
add rcx, rax
movabs rax, 8
mov r8, rax
lea rax, str..gc.log
mov r11, rax
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memcpy
mov eax, dword [rbp - 0x14]
cmp eax, 0
je 0x53fb58
jmp 0x53fb62
mov eax, 2
jmp 0x53fb67
mov eax, 4
mov ecx, dword [0x00555314]
cmp ecx, 2
mov dword [rbp - 0x130], eax
jne 0x53fb81
jmp 0x53fb8b
mov eax, 0x80000080
jmp 0x53fb90
mov eax, pe_nt_image_headers64
movabs rcx, 0
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x130]
mov qword [rsp + 0x20], rax
movabs rax, 0
mov r9, rax
mov eax, 1
mov r8, rax
mov eax, 0x40000000
mov r11, rax
mov rax, qword [rbp - 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_CreateFileA
mov qword [rbp - 8], rax
mov eax, dword [rbp - 0x14]
cmp eax, 0
je 0x53fc33
mov rax, qword [rbp - 8]
cmp rax, 0xffffffffffffffff
je 0x53fc33
mov eax, 0
mov dword [rbp - 0x134], eax
mov eax, 2
mov r9, rax
lea rax, [rbp - 0x134]
mov r8, rax
mov eax, 0
mov r11, rax
mov rax, qword [rbp - 8]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_SetFilePointer
mov rax, qword [rbp - 8]
leave
ret
Function at 0x53fc39
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x18]
cmp rax, 0
jne 0x53fc64
mov eax, 0
jmp 0x53fd58
mov eax, dword [0x005553e4]
cmp eax, 0
je 0x53fc85
lea rax, [0x00558730]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_EnterCriticalSection
mov rax, qword [0x00555370]
cmp rax, 0
jne 0x53fca2
call fcn.0053fa3e
mov qword [0x00555370], rax
mov rax, qword [0x00555370]
cmp rax, 0xffffffffffffffff
jne 0x53fcde
mov eax, dword [0x005553e4]
cmp eax, 0
je 0x53fcd4
lea rax, [0x00558730]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
mov eax, 0xffffffff
jmp 0x53fd58
movabs rax, 0
mov qword [rsp + 0x20], rax
lea rax, [rbp - 8]
mov r9, rax
mov eax, dword [rbp + 0x18]
mov r8, rax
mov rax, qword [rbp + 0x10]
mov r11, rax
mov rax, qword [0x00555370]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_WriteFile
mov dword [rbp - 4], eax
mov eax, dword [0x005553e4]
cmp eax, 0
je 0x53fd3a
lea rax, [0x00558730]
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_LeaveCriticalSection
mov eax, dword [rbp - 4]
cmp eax, 0
je 0x53fd4b
jmp 0x53fd55
mov eax, 0xffffffff
jmp 0x53fd58
mov eax, dword [rbp - 8]
leave
ret
Function at 0x543400
Capabilities:
Resume thread
Suspend thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x510
mov qword [rbp + 0x10], rcx
mov eax, 0
mov dword [rbp - 8], eax
mov rax, qword [rbp + 0x10]
add rax, 0x10
lea rcx, [rbp - 4]
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetExitCodeThread
cmp eax, 0
je 0x543458
mov eax, dword [rbp - 4]
cmp eax, 0x103
je 0x543458
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
call fcn.00542b50
jmp 0x5435bf
mov rax, qword [rbp + 0x10]
add rax, 0x10
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
call sub.kernel32.dll_SuspendThread
cmp eax, 0xffffffff
je 0x543527
mov eax, 0x100003
mov dword [rbp - 0x4b0], eax
mov rax, qword [rbp + 0x10]
add rax, 0x10
lea rcx, [rbp - 0x4e0]
mov r11, rcx
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
mov rdx, r11
call sub.kernel32.dll_GetThreadContext
cmp eax, 0
je 0x5434ec
mov rax, qword [rbp + 0x10]
add rax, 0x40
mov rcx, qword [rbp + 0x10]
add rcx, 0x48
lea rdx, [rbp - 0x4e0]
mov r11, rdx
mov r10, rcx
mov qword [rbp - 0x4e8], rax
mov rcx, r10
mov rdx, r11
call fcn.00543a30
mov rcx, qword [rbp - 0x4e8]
mov qword [rcx], rax
jmp 0x543579
mov rax, qword [rbp + 0x10]
add rax, 0x10
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
call sub.kernel32.dll_ResumeThread
cmp eax, 0xffffffff
jne 0x543527
lea rax, str.ResumeThread_failed_in_suspend_loop
mov r10, rax
mov rcx, r10
mov r11, qword [0x00555380]
call r11
call sub.kernel32.dll_DebugBreak
mov eax, dword [rbp - 8]
cmp eax, 1
jle 0x543543
mov eax, 0
mov r10, rax
mov rcx, r10
call sub.kernel32.dll_Sleep
mov eax, dword [rbp - 8]
add eax, 1
mov dword [rbp - 8], eax
cmp eax, 0xf4240
jl 0x543574
lea rax, str.SuspendThread_loop_failed
mov r10, rax
mov rcx, r10
mov r11, qword [0x00555380]
call r11
call sub.kernel32.dll_DebugBreak
jmp 0x54340c
mov rax, qword [rbp + 0x10]
add rax, 0x3b
mov ecx, 1
mov byte [rax], cl
mov rax, qword [0x00555388]
cmp rax, 0
je 0x5435bf
mov rax, qword [rbp + 0x10]
add rax, 0x10
mov rcx, qword [rax]
mov r11, rcx
mov eax, 0xa
mov r10, rax
mov rcx, r10
mov rdx, r11
mov r11, qword [0x00555388]
call r11
leave
ret
Function at 0x5436e9
Capabilities:
Resume thread

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
jmp 0x5437cf
mov eax, 0
mov dword [rbp - 0x1c], eax
mov eax, dword [rbp - 0x1c]
cmp eax, 0x100
jge 0x5438d7
jmp 0x5437f8
mov eax, dword [rbp - 0x1c]
mov ecx, eax
add eax, 1
mov dword [rbp - 0x1c], eax
jmp 0x5437d7
mov eax, dword [rbp - 0x1c]
movsxd rax, eax
shl rax, 3
lea rcx, [0x00586d20]
add rcx, rax
mov rax, qword [rcx]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
cmp rax, 0
je 0x5438d2
jmp 0x543833
mov rax, qword [rbp - 0x18]
mov rcx, qword [rax]
mov qword [rbp - 0x18], rcx
jmp 0x543813
mov rax, qword [rbp - 0x18]
add rax, 0x3b
movzx ecx, byte [rax]
cmp ecx, 0
je 0x5438cd
mov rax, qword [rbp - 0x18]
add rax, 0x10
mov rcx, qword [rax]
mov r10, rcx
mov rcx, r10
call sub.kernel32.dll_ResumeThread
cmp eax, 0xffffffff
jne 0x543882
lea rax, str.ResumeThread_failed
mov r10, rax
mov rcx, r10
mov r11, qword [0x00555380]
call r11
call sub.kernel32.dll_DebugBreak
mov rax, qword [rbp - 0x18]
add rax, 0x3b
mov ecx, 0
mov byte [rax], cl
mov rax, qword [0x00555388]
cmp rax, 0
je 0x5438c8
mov rax, qword [rbp - 0x18]
add rax, 0x10
mov rcx, qword [rax]
mov r11, rcx
mov eax, 0xb
mov r10, rax
mov rcx, r10
mov rdx, r11
mov r11, qword [0x00555388]
call r11
jmp 0x5438cd
jmp 0x543826
jmp 0x5437eb
leave
ret
Function at 0x1400451c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
cmp dword [rcx], 2
jne 0x140045256
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
pshufd xmm2, xmm0, 0xee
pxor xmm2, xmmword [0x1401fb270]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmmword [rsp + 0x40], xmm2
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rsi, qword [rdx]
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14004c3e0
test rdi, rdi
je 0x1400452e5
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x1400452fe
mov rcx, qword [rdx]
mov r8, qword [rcx]
xor edx, edx
test r8, r8
setne dl
movabs rax, 0xcbf29ce484222325
xor rax, rdx
movabs rdx, 0x1efac7090aef4a21
imul rax, rdx
test r8, r8
je 0x1400453f6
mov r9, qword [rcx + 0x10]
test r9, r9
je 0x140045478
mov rcx, qword [rcx + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x140045403
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x1400452c0
cmp r9, 8
jae 0x14004540c
jmp 0x140045478
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14004c3e0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x140045478
movzx ecx, byte [rcx + 8]
xor rax, rcx
imul rax, rdx
jmp 0x140045478
mov r8, rcx
cmp r9, 8
jb 0x140045478
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x140045410
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x140045490
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x140045526
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x1401fb270]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14004c3e0
test rdi, rdi
je 0x1400455b5
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x1400455ce
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x1400456c6
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x140045748
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x1400456d3
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x140045590
cmp r9, 8
jae 0x1400456dc
jmp 0x140045748
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.14004c3e0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x140045748
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x140045748
mov r8, rcx
cmp r9, 8
jb 0x140045748
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x1400456e0
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret