joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019c30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x48
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp r8, 0x80
jb 0x140019e4d
movdqu xmm4, xmmword [rdx]
movdqu xmm3, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movdqu xmm1, xmmword [rdx + 0x30]
not ecx
movd xmm0, ecx
pxor xmm0, xmm4
add rdx, 0x40
add r8, 0xffffffffffffffc0
movabs rax, 0x154442bd4
movq xmm4, rax
movdqa xmm5, xmmword [0x1401959e0]
nop word cs:[rax + rax]
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm7, xmm0
pclmulqdq xmm7, xmm5, 0x11
movdqu xmm0, xmmword [rdx]
pxor xmm0, xmm6
pxor xmm0, xmm7
movdqu xmm6, xmmword [rdx + 0x10]
movdqu xmm7, xmmword [rdx + 0x20]
movdqu xmm8, xmmword [rdx + 0x30]
movdqa xmm9, xmm3
pclmulqdq xmm9, xmm4, 0
pxor xmm9, xmm6
pclmulqdq xmm3, xmm5, 0x11
pxor xmm3, xmm9
movdqa xmm6, xmm2
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm7
pclmulqdq xmm2, xmm5, 0x11
pxor xmm2, xmm6
movdqa xmm6, xmm1
pclmulqdq xmm6, xmm4, 0
pxor xmm6, xmm8
pclmulqdq xmm1, xmm5, 0x11
pxor xmm1, xmm6
add rdx, 0x40
add r8, 0xffffffffffffffc0
cmp r8, 0x3f
ja 0x140019ca0
movabs rax, 0x1751997d0
movq xmm4, rax
movdqa xmm6, xmm0
pclmulqdq xmm6, xmm4, 0
movdqa xmm5, xmmword [0x1401959f0]
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm6
pxor xmm0, xmm3
movdqa xmm3, xmm0
pclmulqdq xmm3, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm3
pxor xmm0, xmm2
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
pxor xmm0, xmm1
cmp r8, 0x10
jb 0x140019dca
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rdx]
add r8, 0xfffffffffffffff0
add rdx, 0x10
movdqa xmm2, xmm0
pclmulqdq xmm2, xmm4, 0
pxor xmm2, xmm1
pclmulqdq xmm0, xmm5, 0x11
pxor xmm0, xmm2
cmp r8, 0xf
ja 0x140019da0
movdqa xmm1, xmmword [0x1401959f0]
pclmulqdq xmm1, xmm0, 1
psrldq xmm0, 8
pxor xmm0, xmm1
pxor xmm1, xmm1
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
movabs rax, 0x163cd6124
movq xmm3, rax
pclmulqdq xmm3, xmm2, 0
psrldq xmm0, 4
pxor xmm0, xmm3
pxor xmm2, xmm2
pblendw xmm2, xmm0, 3
pclmulqdq xmm2, xmmword [0x140195a00], 0x10
pblendw xmm2, xmm1, 0xfc
movabs rax, 0x1db710641
movq xmm1, rax
pclmulqdq xmm1, xmm2, 0
pxor xmm1, xmm0
pextrd ecx, xmm1, 1
not ecx
test r8, r8
je 0x140019e6b
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
jmp fcn.1400197c0
mov eax, ecx
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x140020b50
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140020b92
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x140020b9a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x140020bab
jmp 0x140020bc2
xor r10d, r10d
jmp 0x140020c4d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140020bc2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140020bd9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140020bf9
add r11, r8
jmp 0x140020d2a
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140020cc2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140020c70
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140020ce0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140020cf2
jmp 0x140020d0c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140020d0c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140020d26
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140033ef0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x140033f86
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [0x1401974a0]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x1401974b0]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140020b50
test rdi, rdi
je 0x140034015
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14003402e
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x140034126
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x1400341a8
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x140034133
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x140033ff0
cmp r9, 8
jae 0x14003413c
jmp 0x1400341a8
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140020b50
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x1400341a8
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x1400341a8
mov r8, rcx
cmp r9, 8
jb 0x1400341a8
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x140034140
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x140037f40
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rcx, rcx
je 0x140037fef
mov rbx, rdx
mov rdi, rcx
lea rsi, [rcx + 0x10]
mov rcx, rsi
call sub.kernel32.dll_AcquireSRWLockExclusive
movzx eax, byte [rdi + 0x18]
test al, al
jne 0x140038186
cmp dword [rdi + 0x58], 0x3b9aca00
je 0x140038054
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_QueryPerformanceCounter
test eax, eax
je 0x140038181
mov r14, qword [rsp + 0x20]
mov rcx, qword [0x1402050d8]
test rcx, rcx
jne 0x140037fd9
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_QueryPerformanceFrequency
test eax, eax
je 0x140038181
mov rcx, qword [rsp + 0x20]
mov qword [0x1402050d8], rcx
test rcx, rcx
je 0x140038186
mov rax, r14
or rax, rcx
shr rax, 0x20
je 0x140037ff9
mov rax, r14
xor edx, edx
div rcx
jmp 0x140038000
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov eax, r14d
xor edx, edx
div ecx
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x140038024
xor edx, edx
div rcx
mov rcx, rax
jmp 0x14003802a
xor edx, edx
div ecx
mov ecx, eax
add rcx, r8
mov rax, rcx
shr rax, 9
movabs rdx, 0x44b82fa09b5a53
mul rdx
shr rdx, 0xb
imul eax, edx, 0x3b9aca00
sub ecx, eax
mov qword [rdi + 0x50], rdx
mov dword [rdi + 0x58], ecx
cmp dword [rdi + 0x48], 0x3b9aca00
jne 0x140038086
lea rcx, [rdi + 0x20]
cmp qword [rcx], 0
je 0x140038170
add qword [rdi + 0x28], rbx
cmp dword [rdi + 0x38], 0x3b9aca00
jne 0x140038170
call fcn.140038190
jmp 0x140038170
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_QueryPerformanceCounter
test eax, eax
je 0x140038181
mov r14, qword [rsp + 0x20]
mov rcx, qword [0x1402050d8]
test rcx, rcx
jne 0x1400380e2
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_QueryPerformanceFrequency
test eax, eax
je 0x140038181
mov rcx, qword [rsp + 0x20]
mov qword [0x1402050d8], rcx
test rcx, rcx
je 0x140038186
mov rax, r14
or rax, rcx
shr rax, 0x20
je 0x1400380f8
mov rax, r14
xor edx, edx
div rcx
jmp 0x1400380ff
mov eax, r14d
xor edx, edx
div ecx
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x140038123
xor edx, edx
div rcx
mov rcx, rax
jmp 0x140038129
xor edx, edx
div ecx
mov ecx, eax
add rcx, r8
mov rax, rcx
shr rax, 9
movabs rdx, 0x44b82fa09b5a53
mul rdx
shr rdx, 0xb
imul rax, rdx, 0x3b9aca00
sub rcx, rax
cmp rdx, qword [rdi + 0x40]
jb 0x140038170
jne 0x14003815b
cmp dword [rdi + 0x48], ecx
ja 0x140038170
mov dword [rdi + 0x48], 0x3b9aca00
lea rcx, [rdi + 0x20]
cmp qword [rcx], 0
jne 0x14003806b
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1401152a4
call sub.kernel32.dll_GetLastError
ud2
Function at 0x14003ad40
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14003ad60
test al, 1
je 0x14003aec6
test al, 2
jne 0x14003aec6
test al, 8
jne 0x14003ada4
mov rdi, qword [rsi + 0x20]
xor ecx, ecx
call fcn.140101510
test rax, rax
je 0x14003adbe
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
jmp 0x14003adc1
test al, 0x10
je 0x14003ae24
mov rax, qword [rsi + 0x60]
test rax, rax
je 0x14003aec6
mov rcx, qword [rsi + 0x68]
call qword [rax + 0x10]
jmp 0x14003ae24
xorps xmm6, xmm6
lea rdi, [rsi + 0x28]
mov rcx, qword [rsi + 0x28]
add rcx, 0xfffffffffffffffe
cmp rcx, 3
mov eax, 1
cmovb rax, rcx
cmp rax, 1
je 0x14003ae05
test rax, rax
jne 0x14003ae0d
mov r8, qword [rsi + 0x30]
test r8, r8
je 0x14003ae0d
cmp qword [rsi + 0x38], 0
je 0x14003ae0d
mov rcx, qword [0x140205100]
xor edx, edx
call sub.kernel32.dll_HeapFree
jmp 0x14003ae0d
mov rcx, rdi
call fcn.14003ab40
mov qword [rdi], 4
xor ecx, ecx
call fcn.140101510
test rax, rax
je 0x14003ae24
movups xmmword [rax + 0x20], xmm6
mov rax, 0xffffffffffffffc0
lock xadd qword [rsi], rax
cmp rax, 0x3f
jbe 0x14003aec6
and rax, 0xffffffffffffffc0
cmp rax, 0x40
jne 0x14003ae84
mov rcx, qword [rsi + 0x28]
add rcx, 0xfffffffffffffffe
cmp rcx, 3
mov eax, 1
cmovb rax, rcx
cmp rax, 1
je 0x14003ae90
test rax, rax
jne 0x14003ae99
mov r8, qword [rsi + 0x30]
test r8, r8
je 0x14003ae99
cmp qword [rsi + 0x38], 0
je 0x14003ae99
mov rcx, qword [0x140205100]
xor edx, edx
call sub.kernel32.dll_HeapFree
jmp 0x14003ae99
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [rsi + 0x28]
call fcn.14003ab40
mov rax, qword [rsi + 0x60]
test rax, rax
je 0x14003aea9
mov rcx, qword [rsi + 0x68]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140205100]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
ud2
Function at 0x14005cbe0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x208
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14005cbf0
test al, 1
je 0x14005ccd6
test al, 2
jne 0x14005ccd6
test al, 8
jne 0x14005cc2b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 7
lea rdx, [rsp + 0x20]
call fcn.1400974e0
jmp 0x14005cc49
test al, 0x10
je 0x14005cc49
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x14005ccd6
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400fee10
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x14005ccd6
jne 0x14005cccb
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14005cc91
mov rcx, rdi
call fcn.140092b80
lea rcx, [rsi + 0x30]
call fcn.14005b5a0
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x14005ccb0
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140205100]
xor edx, edx
add rsp, 0x208
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x208
pop rdi
pop rsi
ret
ud2

Function at 0x14005cce0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14005ccf0
test al, 1
je 0x14005cd91
test al, 2
jne 0x14005cd91
test al, 8
jne 0x14005cd2a
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x98], 4
lea rdx, [rsp + 0x28]
call fcn.1400972d0
jmp 0x14005cd44
test al, 0x10
je 0x14005cd44
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x14005cd91
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400ff130
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x14005cd91
jne 0x14005cd87
mov rcx, rsi
add rsp, 0xa0
pop rsi
jmp fcn.14005ca60
nop
add rsp, 0xa0
pop rsi
ret
ud2

Function at 0x14005cda0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14005cdb0
test al, 1
je 0x14005ce51
test al, 2
jne 0x14005ce51
test al, 8
jne 0x14005cdea
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x98], 4
lea rdx, [rsp + 0x28]
call fcn.1400972d0
jmp 0x14005ce04
test al, 0x10
je 0x14005ce04
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x14005ce51
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400fee10
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x14005ce51
jne 0x14005ce47
mov rcx, rsi
add rsp, 0xa0
pop rsi
jmp fcn.14005cb20
nop
add rsp, 0xa0
pop rsi
ret
ud2
Function at 0x14005ce60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14005ce70
test al, 1
je 0x14005cf40
test al, 2
jne 0x14005cf40
test al, 8
jne 0x14005cea7
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x40], 5
lea rdx, [rsp + 0x20]
call fcn.140097890
jmp 0x14005cebf
test al, 0x10
je 0x14005cebf
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x14005cf40
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400fee10
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x14005cf40
jne 0x14005cf38
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14005cf07
mov rcx, rdi
call fcn.140092b80
lea rcx, [rsi + 0x30]
call fcn.14005b340
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x14005cf20
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140205100]
xor edx, edx
add rsp, 0x48
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x48
pop rdi
pop rsi
ret
ud2

Function at 0x14005cf50
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xfa8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14005cf60
test al, 1
je 0x14005d046
test al, 2
jne 0x14005d046
test al, 8
jne 0x14005cf9b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 4
lea rdx, [rsp + 0x28]
call fcn.140097c50
jmp 0x14005cfb9
test al, 0x10
je 0x14005cfb9
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x14005d046
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400fee10
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x14005d046
jne 0x14005d03b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14005d001
mov rcx, rdi
call fcn.140092b80
lea rcx, [rsi + 0x30]
call fcn.14005a970
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x14005d020
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140205100]
xor edx, edx
add rsp, 0xfa8
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0xfa8
pop rdi
pop rsi
ret
ud2
Function at 0x14005d050
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xfa8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14005d060
test al, 1
je 0x14005d146
test al, 2
jne 0x14005d146
test al, 8
jne 0x14005d09b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 4
lea rdx, [rsp + 0x28]
call fcn.140097c50
jmp 0x14005d0b9
test al, 0x10
je 0x14005d0b9
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x14005d146
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400ff130
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x14005d146
jne 0x14005d13b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14005d101
mov rcx, rdi
call fcn.1400921b0
lea rcx, [rsi + 0x30]
call fcn.14005a970
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x14005d120
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140205100]
xor edx, edx
add rsp, 0xfa8
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0xfa8
pop rdi
pop rsi
ret
ud2

Function at 0x14005d150
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14005d160
test al, 1
je 0x14005d230
test al, 2
jne 0x14005d230
test al, 8
jne 0x14005d197
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x40], 5
lea rdx, [rsp + 0x20]
call fcn.140097890
jmp 0x14005d1af
test al, 0x10
je 0x14005d1af
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x14005d230
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400ff130
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x14005d230
jne 0x14005d228
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14005d1f7
mov rcx, rdi
call fcn.1400921b0
lea rcx, [rsi + 0x30]
call fcn.14005b340
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x14005d210
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140205100]
xor edx, edx
add rsp, 0x48
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x48
pop rdi
pop rsi
ret
ud2
Function at 0x14005d240
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14005d250
test al, 1
je 0x14005d323
test al, 2
jne 0x14005d323
test al, 8
jne 0x14005d28a
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x30], 0x3b9aca01
lea rdx, [rsp + 0x28]
call fcn.1400988b0
jmp 0x14005d2a2
test al, 0x10
je 0x14005d2a2
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x14005d323
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400fee10
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x14005d323
jne 0x14005d31b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14005d2ea
mov rcx, rdi
call fcn.140092b80
lea rcx, [rsi + 0x30]
call fcn.14005a0a0
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x14005d303
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140205100]
xor edx, edx
add rsp, 0x58
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x58
pop rdi
pop rsi
ret
ud2

Function at 0x14005d330
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x208
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14005d340
test al, 1
je 0x14005d426
test al, 2
jne 0x14005d426
test al, 8
jne 0x14005d37b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 7
lea rdx, [rsp + 0x20]
call fcn.1400974e0
jmp 0x14005d399
test al, 0x10
je 0x14005d399
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x14005d426
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1400ff130
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x14005d426
jne 0x14005d41b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14005d3e1
mov rcx, rdi
call fcn.1400921b0
lea rcx, [rsi + 0x30]
call fcn.14005b5a0
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x14005d400
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140205100]
xor edx, edx
add rsp, 0x208
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x208
pop rdi
pop rsi
ret
ud2