joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400047bc
Capabilities:
Connect socket
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rax - 0x48]
sub rsp, 0x130
movzx r15d, r8w
mov r12d, edx
mov rsi, rcx
call fcn.140003ce4
mov r14d, eax
cmp eax, 0xffffffff
je 0x1400048dd
xor r8d, r8d
lea r13d, [r8 + 2]
mov ecx, r13d
lea edx, [r8 + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140004822
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x1400048dd
movzx ecx, word [rsi + 0x30]
mov dword [rsp + 0x24], r14d
call qword [sym.imp.WS2_32.dll_htons]
mov r8d, reloc.WS2_32.dll_recv
mov word [rsp + 0x20], r13w
lea rdx, [rsp + 0x20]
mov word [rsp + 0x22], ax
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_connect]
xor esi, esi
test eax, eax
jne 0x1400048ce
xor edx, edx
lea rcx, [rsp + 0x38]
mov r8d, 0xf8
call fcn.140004dec
movzx ecx, r15w
mov word [rsp + 0x30], 0x104
mov dword [rsp + 0x34], r12d
call qword [sym.imp.WS2_32.dll_htons]
xor r9d, r9d
lea r8d, [rsi + 9]
lea rdx, [rsp + 0x30]
mov word [rsp + 0x32], ax
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1400048ce
mov r8d, 0x100
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140004aa4
cmp eax, 8
jne 0x1400048d4
cmp byte [rsp + 0x31], 0x5a
jne 0x1400048d4
cmp dword [rsp + 0x34], esi
je 0x1400048d4
cmp word [rsp + 0x32], si
je 0x1400048d4
mov rax, rdi
jmp 0x1400048e1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
or rax, 0xffffffffffffffff
lea r11, [rsp + 0x130]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140004904
Capabilities:
Connect socket
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
lea rbp, [rax - 0x48]
sub rsp, 0x130
movzx r15d, r8w
mov r12d, edx
mov rsi, rcx
call fcn.140003ce4
mov r14d, eax
cmp eax, 0xffffffff
je 0x140004a7c
xor r8d, r8d
lea r13d, [r8 + 2]
mov ecx, r13d
lea edx, [r8 + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000496a
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x140004a7c
movzx ecx, word [rsi + 0x30]
mov dword [rsp + 0x24], r14d
call qword [sym.imp.WS2_32.dll_htons]
mov r8d, reloc.WS2_32.dll_recv
mov word [rsp + 0x20], r13w
lea rdx, [rsp + 0x20]
mov word [rsp + 0x22], ax
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_connect]
xor esi, esi
test eax, eax
jne 0x140004a6d
xor edx, edx
lea rcx, [rsp + 0x32]
mov r8d, 0xfe
call fcn.140004dec
xor r9d, r9d
mov word [rsp + 0x30], 0x105
lea r8d, [rsi + 3]
mov rcx, rdi
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x140004a6d
mov r14d, 0x100
lea rdx, [rsp + 0x30]
mov r8d, r14d
mov rcx, rdi
call fcn.140004aa4
cmp eax, r13d
jne 0x140004a73
cmp byte [rsp + 0x30], 5
jne 0x140004a73
cmp byte [rsp + 0x31], sil
jne 0x140004a73
movzx ecx, r15w
mov dword [rsp + 0x30], 0x1000105
mov dword [rsp + 0x34], r12d
call qword [sym.imp.WS2_32.dll_htons]
xor r9d, r9d
lea r8d, [rsi + 0xa]
lea rdx, [rsp + 0x30]
mov word [rsp + 0x38], ax
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x140004a6d
mov r8d, r14d
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140004aa4
cmp eax, 0xa
jne 0x140004a73
cmp byte [rsp + 0x30], 5
jne 0x140004a73
cmp byte [rsp + 0x31], sil
jne 0x140004a73
cmp dword [rsp + 0x34], esi
je 0x140004a73
cmp word [rsp + 0x38], si
je 0x140004a73
mov rax, rdi
jmp 0x140004a80
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
or rax, 0xffffffffffffffff
lea r11, [rsp + 0x130]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140004aa4
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x450
and dword [r11 + 0x20], 0
lea r9, [rsp + 0x30]
mov eax, 1
mov qword [r11 - 0x210], rcx
mov dword [rsp + 0x240], eax
mov rsi, rdx
mov dword [rsp + 0x30], eax
lea rdx, [r11 - 0x218]
lea rax, [r11 + 0x20]
movsxd rdi, r8d
mov rbx, rcx
mov qword [rsp + 0x38], rcx
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov dword [r11 + 0x24], 0x2710
call qword [sym.imp.WS2_32.dll_select]
cmp eax, 0xffffffff
je 0x140004b61
test eax, eax
jle 0x140004b67
lea rdx, [rsp + 0x30]
mov rcx, rbx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
jne 0x140004b67
lea rdx, [rsp + 0x240]
mov rcx, rbx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x140004b67
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.140004dec
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
je 0x140004b61
test eax, eax
jne 0x140004b6a
jmp 0x140004b67
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
or eax, 0xffffffff
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140004b80
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
test r8d, r8d
jle 0x140004bf7
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov rdi, rdx
movsxd rbx, r8d
mov r11, rcx
mov r10b, byte [r11 + 0x100]
inc r10b
movzx r8d, r10b
movzx edx, byte [r8 + r11]
mov r9b, dl
add r9b, byte [r11 + 0x101]
movzx ecx, r9b
mov al, byte [rcx + r11]
mov byte [r8 + r11], al
mov byte [rcx + r11], dl
movzx ecx, byte [r8 + r11]
add rcx, rdx
movzx eax, cl
mov cl, byte [rax + r11]
xor byte [rdi], cl
inc rdi
mov byte [r11 + 0x100], r10b
mov byte [r11 + 0x101], r9b
sub rbx, 1
jne 0x140004b98
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x180002e80
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str._AntiCheatEMU__DllMain
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, 1
add rsp, 0x28
ret

Function at 0x180003f74
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x180003fae
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x180003fb3
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x180003ffc
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1800062a0]
cmp byte [rcx + rax], 0
je 0x180003ffc
dec r8
sub rdx, 1
jne 0x180003fe2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140003830
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x30
mov rdx, qword [rcx + 8]
mov rbx, rcx
and qword [rbp + 0x30], 0
lea rcx, [rbp - 0x10]
xorps xmm0, xmm0
mov r8d, 0x10
movups xmmword [rbp - 0x10], xmm0
call fcn.1400059c0
test al, al
je 0x140003a51
and qword [rbp + 0x38], 0
movabs rsi, 0xcbf29ce484222325
mov rax, qword [0x140008068]
movabs r14, 0x100000001b3
test rax, rax
jne 0x140003925
mov rdx, qword [0x1400081a8]
test rdx, rdx
jne 0x1400038ab
mov rdx, qword [0x1400080e8]
mov qword [0x1400081a8], rdx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov r10d, dword [rcx + 0x1c]
mov r8d, dword [rcx + 0x20]
add r10, rdx
mov r11d, dword [rcx + 0x24]
add r8, rdx
mov edi, dword [rcx + 0x18]
add r11, rdx
xor edx, edx
test edi, edi
je 0x14000391b
mov ecx, dword [r8]
mov r9, rsi
add rcx, qword [0x1400081a8]
mov al, byte [rcx]
test al, al
je 0x140003911
inc rcx
movsx rax, al
xor r9, rax
imul r9, r14
mov al, byte [rcx]
test al, al
jne 0x1400038ea
movabs rax, 0x8a9495b5004b3e52
cmp r9, rax
je 0x140003a2a
inc edx
add r8, 4
cmp edx, edi
jb 0x1400038d7
int3
mov qword [0x140008068], rax
mov ecx, dword [rbp - 0x10]
lea rdx, [rbp + 0x38]
call qword [0x140007080]
test eax, eax
js 0x140003a51
mov rcx, qword [rbp + 0x38]
lea r9, [rbp + 0x40]
add rcx, 0x28
lea rdx, [rbp + 0x30]
call fcn.140003a70
mov rcx, qword [rbp + 0x30]
test rcx, rcx
jne 0x140003974
mov rcx, qword [rbp + 0x38]
lea r9, [rbp + 0x40]
add rcx, 0x388
lea rdx, [rbp + 0x30]
call fcn.140003a70
mov rcx, qword [rbp + 0x30]
mov rax, qword [rbx + 8]
mov qword [rax + 8], rcx
mov rax, qword [0x140008170]
test rax, rax
jne 0x140003a1c
mov rdx, qword [0x1400081a8]
test rdx, rdx
jne 0x1400039a6
mov rdx, qword [0x1400080e8]
mov qword [0x1400081a8], rdx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov r10d, dword [rcx + 0x1c]
mov r8d, dword [rcx + 0x20]
add r10, rdx
mov r11d, dword [rcx + 0x24]
add r8, rdx
mov ebx, dword [rcx + 0x18]
add r11, rdx
xor edx, edx
test ebx, ebx
je 0x140003a12
mov ecx, dword [r8]
mov r9, rsi
add rcx, qword [0x1400081a8]
mov al, byte [rcx]
test al, al
je 0x140003a08
inc rcx
movsx rax, al
xor r9, rax
imul r9, r14
mov al, byte [rcx]
test al, al
jne 0x1400039e5
movabs rax, 0xb61941b7eb2f33e5
cmp r9, rax
je 0x140003a3f
inc edx
add r8, 4
cmp edx, ebx
jb 0x1400039d2
int3
mov qword [0x140008170], rax
mov rcx, qword [rbp + 0x38]
call qword [0x140007080]
xor eax, eax
jmp 0x140003a56
movzx ecx, word [r11 + rdx*2]
mov eax, dword [r10 + rcx*4]
add rax, qword [0x1400081a8]
jmp 0x14000391e
movzx ecx, word [r11 + rdx*2]
mov eax, dword [r10 + rcx*4]
add rax, qword [0x1400081a8]
jmp 0x140003a15
mov eax, 0xc0000001
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140003a70
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x30
mov rax, qword [0x140008078]
mov rsi, r9
mov rbp, rdx
test rax, rax
jne 0x140003b43
mov r8, qword [0x1400081a8]
test r8, r8
jne 0x140003ab9
mov r8, qword [0x1400080e8]
mov qword [0x1400081a8], r8
movsxd rax, dword [r8 + 0x3c]
mov edx, dword [rax + r8 + 0x88]
add rdx, r8
mov r11d, dword [rdx + 0x1c]
mov r9d, dword [rdx + 0x20]
add r11, r8
mov ebx, dword [rdx + 0x24]
add r9, r8
mov edi, dword [rdx + 0x18]
add rbx, r8
xor r8d, r8d
test edi, edi
je 0x140003b39
mov edx, dword [r9]
movabs r10, 0xcbf29ce484222325
add rdx, qword [0x1400081a8]
mov al, byte [rdx]
test al, al
je 0x140003b2d
inc rdx
movsx rax, al
xor r10, rax
movabs r14, 0x100000001b3
imul r10, r14
mov al, byte [rdx]
test al, al
jne 0x140003b00
movabs rax, 0x306328ee8e049a39
cmp r10, rax
je 0x140003b79
inc r8d
add r9, 4
cmp r8d, edi
jb 0x140003ae6
int3
mov qword [0x140008078], rax
mov r9d, 2
mov qword [rsp + 0x20], rsi
mov rdx, rcx
mov rcx, rbp
lea r8d, [r9 + 6]
call qword [0x140007080]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
movzx edx, word [rbx + r8*2]
mov eax, dword [r11 + rdx*4]
add rax, qword [0x1400081a8]
jmp 0x140003b3c
Function at 0x140003ba0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rax, qword [0x140008028]
mov r14, r9
mov rbx, r8
mov rdi, rdx
movabs r15, 0xcbf29ce484222325
movabs r12, 0x100000001b3
test rax, rax
jne 0x140003c7d
mov r9, qword [0x1400081a8]
test r9, r9
jne 0x140003c04
mov r9, qword [0x1400080e8]
mov qword [0x1400081a8], r9
movsxd rax, dword [r9 + 0x3c]
xor r8d, r8d
mov edx, dword [rax + r9 + 0x88]
add rdx, r9
mov r11d, dword [rdx + 0x1c]
mov r10d, dword [rdx + 0x20]
add r11, r9
mov esi, dword [rdx + 0x24]
add r10, r9
mov ebp, dword [rdx + 0x18]
add rsi, r9
test ebp, ebp
je 0x140003c73
mov edx, dword [r10]
mov r9, r15
add rdx, qword [0x1400081a8]
mov al, byte [rdx]
test al, al
je 0x140003c67
inc rdx
movsx rax, al
xor r9, rax
imul r9, r12
mov al, byte [rdx]
test al, al
jne 0x140003c44
movabs rax, 0x2be3b7dda50ff6fe
cmp r9, rax
je 0x140003c9e
inc r8d
add r10, 4
cmp r8d, ebp
jb 0x140003c31
int3
mov qword [0x140008028], rax
mov r8d, 4
mov rdx, rbx
call qword [0x140007080]
mov r10, rax
test rax, rax
jne 0x140003cb0
mov eax, 0xc0000001
jmp 0x140003d7c
movzx edx, word [rsi + r8*2]
mov eax, dword [r11 + rdx*4]
add rax, qword [0x1400081a8]
jmp 0x140003c76
mov rdx, rbx
mov rcx, r10
test rbx, rbx
je 0x140003ccc
sub rdi, r10
mov al, byte [rdi + rcx]
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140003cbe
mov rax, qword [0x1400080c8]
mov qword [r14], rbx
test rax, rax
jne 0x140003d6e
mov rdx, qword [0x1400081a8]
test rdx, rdx
jne 0x140003cf9
mov rdx, qword [0x1400080e8]
mov qword [0x1400081a8], rdx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov r11d, dword [rcx + 0x1c]
mov r8d, dword [rcx + 0x20]
add r11, rdx
mov edi, dword [rcx + 0x24]
add r8, rdx
mov esi, dword [rcx + 0x18]
add rdi, rdx
xor edx, edx
test esi, esi
je 0x140003d64
mov ecx, dword [r8]
mov r9, r15
add rcx, qword [0x1400081a8]
mov al, byte [rcx]
test al, al
je 0x140003d5a
inc rcx
movsx rax, al
xor r9, rax
imul r9, r12
mov al, byte [rcx]
test al, al
jne 0x140003d37
movabs rax, 0x47e1ca0e288956c0
cmp r9, rax
je 0x140003d9b
inc edx
add r8, 4
cmp edx, esi
jb 0x140003d24
int3
mov qword [0x1400080c8], rax
mov rdx, rbx
mov rcx, r10
call qword [0x140007080]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
movzx ecx, word [rdi + rdx*2]
mov eax, dword [r11 + rcx*4]
add rax, qword [0x1400081a8]
jmp 0x140003d67
Function at 0x140003dc0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x140008078]
mov rsi, r9
mov rbp, r8
mov r14, rdx
test rax, rax
jne 0x140003e95
mov r10, qword [0x1400081a8]
test r10, r10
jne 0x140003e0b
mov r10, qword [0x1400080e8]
mov qword [0x1400081a8], r10
movsxd rax, dword [r10 + 0x3c]
xor r8d, r8d
mov edx, dword [rax + r10 + 0x88]
add rdx, r10
mov r11d, dword [rdx + 0x1c]
mov r9d, dword [rdx + 0x20]
add r11, r10
mov ebx, dword [rdx + 0x24]
add r9, r10
mov edi, dword [rdx + 0x18]
add rbx, r10
test edi, edi
je 0x140003e8b
mov edx, dword [r9]
movabs r10, 0xcbf29ce484222325
add rdx, qword [0x1400081a8]
mov al, byte [rdx]
test al, al
je 0x140003e7f
inc rdx
movsx rax, al
xor r10, rax
movabs r15, 0x100000001b3
imul r10, r15
mov al, byte [rdx]
test al, al
jne 0x140003e52
movabs rax, 0x306328ee8e049a39
cmp r10, rax
je 0x140003ec8
inc r8d
add r9, 4
cmp r8d, edi
jb 0x140003e38
int3
mov qword [0x140008078], rax
mov rdx, rcx
mov qword [rsp + 0x20], rsi
mov rcx, r14
mov r9d, 1
mov r8, rbp
call qword [0x140007080]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
movzx edx, word [rbx + r8*2]
mov eax, dword [r11 + rdx*4]
add rax, qword [0x1400081a8]
jmp 0x140003e8e
Function at 0x1400046d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub rsp, 0x38
movzx eax, word [0x140007148]
lea r9, [rsp + 0x20]
movsd xmm0, qword [str._TSF__]
xor r8d, r8d
mov word [rsp + 0x28], ax
mov al, byte [0x14000714a]
mov byte [rsp + 0x2a], al
movsd qword [rsp + 0x20], xmm0
mov eax, 0xa0a0a0a1
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x33
mov al, r8b
inc r8d
sub al, cl
add al, 0x30
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x140004700
lea rcx, [rsp + 0x20]
call fcn.140005550
test rax, rax
je 0x14000476c
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x54494e49
mov rcx, rax
mov byte [rsp + 0x44], 0
call fcn.140005e50
lea rcx, [rax - 0x30]
lea rax, [rcx - 0x30]
mov qword [0x1400080d0], rcx
test rcx, rcx
mov qword [0x1400080d8], rax
setne al
add rsp, 0x38
ret
Function at 0x1400052c0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, qword [0x140008168]
xor r13d, r13d
mov r15, r8
mov rbp, rdx
mov r14, rcx
movabs rdi, 0xcbf29ce484222325
movabs rsi, 0x100000001b3
test rax, rax
jne 0x1400053a7
mov r9, qword [0x1400081a8]
test r9, r9
jne 0x14000532a
mov r9, qword [0x1400080e8]
mov qword [0x1400081a8], r9
movsxd rax, dword [r9 + 0x3c]
mov r8d, r13d
mov ecx, dword [rax + r9 + 0x88]
add rcx, r9
mov r10d, dword [rcx + 0x1c]
mov edx, dword [rcx + 0x20]
add r10, r9
mov r11d, dword [rcx + 0x24]
add rdx, r9
mov ebx, dword [rcx + 0x18]
add r11, r9
test ebx, ebx
je 0x14000539c
mov ecx, dword [rdx]
mov r9, rdi
add rcx, qword [0x1400081a8]
mov al, byte [rcx]
test al, al
je 0x140005390
inc rcx
movsx rax, al
xor r9, rax
imul r9, rsi
mov al, byte [rcx]
test al, al
jne 0x140005369
movabs rax, 0x30e36d1e897986ef
cmp r9, rax
je 0x14000551b
inc r8d
add rdx, 4
cmp r8d, ebx
jb 0x140005357
int3
mov qword [0x140008168], rax
xor edx, edx
mov rcx, r14
call qword [0x140007080]
or rdi, 0xffffffffffffffff
mov rsi, rdi
inc rsi
cmp word [rbp + rsi*2], r13w
jne 0x1400053b9
inc rdi
cmp word [r15 + rdi*2], r13w
jne 0x1400053c4
mov rax, qword [0x140008060]
lea rbx, [rdi + rsi]
test rax, rax
jne 0x140005491
mov rdx, qword [0x1400081a8]
test rdx, rdx
jne 0x1400053fc
mov rdx, qword [0x1400080e8]
mov qword [0x1400081a8], rdx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov r10d, dword [rcx + 0x1c]
mov r8d, dword [rcx + 0x20]
add r10, rdx
mov r11d, dword [rcx + 0x24]
add r8, rdx
mov r12d, dword [rcx + 0x18]
add r11, rdx
mov edx, r13d
test r12d, r12d
je 0x140005486
mov ecx, dword [r8]
movabs r9, 0xcbf29ce484222325
add rcx, qword [0x1400081a8]
mov al, byte [rcx]
test al, al
je 0x14000547b
movabs r15, 0x100000001b3
inc rcx
movsx rax, al
xor r9, rax
imul r9, r15
mov al, byte [rcx]
test al, al
jne 0x14000544f
mov r15, qword [rsp + 0x60]
movabs rax, 0x48b8617d81fdd475
cmp r9, rax
je 0x140005533
inc edx
add r8, 4
cmp edx, r12d
jb 0x14000542b
int3
mov qword [0x140008060], rax
lea rdx, [rbx*2 + 2]
xor ecx, ecx
call qword [0x140007080]
mov qword [r14 + 8], rax
mov rcx, rax
test rax, rax
je 0x1400054fb
add bx, bx
mov word [r14], bx
add bx, 2
add rsi, rsi
mov word [r14 + 2], bx
mov rdx, rsi
je 0x1400054d6
mov al, byte [rbp]
inc rbp
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1400054c5
mov rdx, qword [r14 + 8]
lea rcx, [rdi*2 + 2]
add rdx, rsi
test rcx, rcx
je 0x1400054fb
mov al, byte [r15]
inc r15
mov byte [rdx], al
inc rdx
sub rcx, 1
jne 0x1400054ea
mov rbx, qword [rsp + 0x50]
mov rax, r14
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, r8d
movzx ecx, word [r11 + rax*2]
mov eax, dword [r10 + rcx*4]
add rax, qword [0x1400081a8]
jmp 0x1400053a0
mov eax, edx
movzx ecx, word [r11 + rax*2]
mov eax, dword [r10 + rcx*4]
add rax, qword [0x1400081a8]
jmp 0x14000548a
Function at 0x140005cb0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x140008080]
mov rbx, rcx
test rax, rax
jne 0x140005d73
mov rdx, qword [0x1400081a8]
test rdx, rdx
jne 0x140005cec
mov rdx, qword [0x1400080e8]
mov qword [0x1400081a8], rdx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov r10d, dword [rcx + 0x1c]
mov r8d, dword [rcx + 0x20]
add r10, rdx
mov r11d, dword [rcx + 0x24]
add r8, rdx
mov edi, dword [rcx + 0x18]
add r11, rdx
xor edx, edx
test edi, edi
je 0x140005d69
mov ecx, dword [r8]
movabs r9, 0xcbf29ce484222325
add rcx, qword [0x1400081a8]
mov al, byte [rcx]
test al, al
je 0x140005d5f
inc rcx
movsx rax, al
xor r9, rax
movabs rsi, 0x100000001b3
imul r9, rsi
mov al, byte [rcx]
test al, al
jne 0x140005d32
movabs rax, 0xce03cf29aaff16c0
cmp r9, rax
je 0x140005d80
inc edx
add r8, 4
cmp edx, edi
jb 0x140005d18
int3
mov qword [0x140008080], rax
call qword [0x140007080]
test rax, rax
jne 0x140005d92
jmp 0x140005da8
movzx ecx, word [r11 + rdx*2]
mov eax, dword [r10 + rcx*4]
add rax, qword [0x1400081a8]
jmp 0x140005d6c
mov rcx, qword [rax + 0x98]
mov rax, qword [rcx + 0x20]
mov qword [rcx + 0x20], rbx
mov rcx, qword [rbx + 0x28]
mov cr3, rcx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140005dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, qword [0x1400080e8]
test r9, r9
je 0x140005e21
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x140005e21
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x140005e21
lea rbx, [r9 + rcx]
xor r11d, r11d
mov r10d, dword [rbx + 0x20]
mov edi, dword [rbx + 0x18]
add r10, r9
test edi, edi
je 0x140005e21
mov ecx, dword [r10]
add rcx, r9
call fcn.140005fd0
test eax, eax
je 0x140005e2e
inc r11d
add r10, 4
cmp r11d, edi
jb 0x140005e06
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 0x24]
mov ecx, dword [rbx + 0x1c]
add rax, r9
add rcx, r9
movzx edx, word [rax + r11*2]
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140005e23

Function at 0x140005e50
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
movsxd r8, dword [rcx + 0x3c]
lea r14, [rcx + 0x18]
add r14, r8
xor r11d, r11d
mov rbp, rdx
mov rbx, rcx
movzx eax, word [r8 + rcx + 0x14]
movzx esi, word [r8 + rcx + 6]
add r14, rax
test esi, esi
je 0x140005eaf
lea rcx, [r11 + r11*4]
mov rdx, rbp
lea rdi, [r14 + rcx*8]
mov rcx, rdi
call fcn.140006060
test eax, eax
je 0x140005ecc
inc r11d
cmp r11d, esi
jb 0x140005e90
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov eax, dword [rdi + 0xc]
add rax, rbx
jmp 0x140005eb1