joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1401170b0
sub rsp, 0x58
mov rax, qword [0x1401c70a0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov r8, rdx
mov eax, r9d
mov r10, rcx
cmp rax, 0x20
lea r11d, [r9 + 1]
jae 0x14011714a
mov byte [rsp + rax + 0x20], r9b
add rax, r11
cmp rax, 0x20
jl 0x1401170d7
mov al, byte [rdx]
jmp 0x14011710a
movzx edx, al
shr rdx, 3
movzx eax, al
and eax, 7
movzx ecx, byte [rsp + rdx + 0x20]
bts ecx, eax
add r8, r11
mov byte [rsp + rdx + 0x20], cl
mov al, byte [r8]
test al, al
jne 0x1401170eb
or byte [rsp + 0x20], r11b
jmp 0x14011711b
add r9d, r11d
add r10, r11
movzx r8d, byte [r10]
mov edx, r11d
mov ecx, r8d
shr r8, 3
and ecx, 7
shl edx, cl
test byte [rsp + r8 + 0x20], dl
je 0x140117115
movsxd rax, r9d
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140011080
add rsp, 0x58
ret
call fcn.140005e50
int3

Function at 0x1400061d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14014ddf8
sub rsp, 0x58
mov rax, qword [0x1401c70a0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov r9, rdx
cmp rax, 0x20
mov r8, rcx
jae 0x14014de90
mov byte [rsp + rax + 0x20], 0
inc rax
cmp rax, 0x20
jl 0x14014de17
mov al, byte [rdx]
jmp 0x14014de4a
movzx edx, al
shr rdx, 3
movzx eax, al
and eax, 7
movzx ecx, byte [rsp + rdx + 0x20]
bts ecx, eax
inc r9
mov byte [rsp + rdx + 0x20], cl
mov al, byte [r9]
test al, al
jne 0x14014de2b
jmp 0x14014de6f
movzx eax, r9b
mov edx, 1
movzx ecx, r9b
and ecx, 7
shr rax, 3
shl edx, cl
test byte [rsp + rax + 0x20], dl
jne 0x14014de8b
inc r8
mov r9b, byte [r8]
test r9b, r9b
jne 0x14014de50
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140011080
add rsp, 0x58
ret
mov rax, r8
jmp 0x14014de79
call fcn.140005e50
int3
Function at 0x140007ae0
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
add dword [rbp - 0x7d7bf040], eax
push rax
add byte [rax], al

Function at 0x1400080b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp fcn.1400080b0
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
jne 0x140008b82
jmp 0x140009a5b
mov rax, qword [rsp + 0x88]
cmp qword [rsp + 0x80], rax
jbe 0x1400074e0
jmp 0x140008064
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
mov byte [rax], al
add byte [rax], al
jmp fcn.1400080b0
mov eax, dword [rsp + 0x48]
inc eax
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x50]
add rax, 0x28
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x48], eax
jb 0x140007be3
jmp 0x14000c8e4
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x50]
add eax, dword [rcx + 0x10]
mov eax, eax
mov qword [rsp + 0x80], rax
jmp 0x140007e58
invalid
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0xc]
add rax, qword [rsp + 0xa0]
mov qword [rsp + 0x80], rax
add byte [rax], al
add cl, ch
loopne 0x140009a59
invalid
invalid
cmp qword [rsp + 0x40], rax
je 0x14000c2e7
sbb dword [rax], eax
invalid
jmp 0x14000d134
mov eax, dword [rsp + 0xb4]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0x50]
mov edx, eax
call fcn.14000a87c
jmp 0x14000bed8
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0xb4]
mov edx, eax
mov rcx, qword [rsp + 0x88]
call fcn.14000a87c
jmp 0x14000a948
cmp qword [rsp + 0x30], 0
je 0x14000d1ac
lea rcx, [rsp + 0xb0]
call qword [0x1400887fd]
jmp 0x14000b89d

Function at 0x140009565
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x1a0]
jmp 0x14000ae5f
invalid
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x198
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x50], rax
and al, 0x50
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
jmp 0x140009961
mov rax, rcx
mov qword [rsp + 0x58], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + rax + 0x88]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a0]
jmp 0x140007b26
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
mov rax, rcx
Function at 0x14000af33
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], 0
add byte [rax], al
add byte [rax], al
jmp 0x14000b9d7
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword gs:[0x60]
and eax, 0x60
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov rax, qword [rax + 0x20]
sub rax, 0x10
jmp 0x14000964c

Function at 0x14000bb00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea rcx, [rsp + 0xb0]
mov rax, qword [rsp + 0x30]
call qword [rax + 0x60]

Function at 0x14000bb10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r9d, 4
mov r8d, 0x3000
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
mov rax, qword [rsp + 0x30]
mov ecx, 0x10
call fcn.140007b9f
jmp 0x14000d4df
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x58]
call fcn.14000cd99
jmp 0x140009c2a
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov qword [rax], rcx
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x28]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x30], 0
jne 0x140007668
jmp 0x14000b20f
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rax + 8], rcx
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [0x140084046]
jmp 0x140007e15
mov r9d, 4
mov r8d, 0x3000
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x28], eax
jmp 0x14000b474
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x58]
call fcn.14000cd99
add byte [rax], al
jmp 0x14000b3fe
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [0x140084f61]
jmp 0x1400094c0
mov ecx, 0xe
call qword [0x1400850a2]
xor eax, eax
jmp fcn.14000b080
mov dword [rax + 0x40], ecx
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
mov qword [rax + 0x48], rcx
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x54]
mov edx, eax
mov rcx, qword [rsp + 0x108]
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x28]
mov rax, qword [rsp + 0x30]
call qword [rax + 8]
jmp 0x140007e15
mov rax, qword [rsp + 0x30]
call qword [rax + 0x68]
mov r8d, 0x10
add byte [rbx], dh
ror byte [rax - 0x75], cl
enter 0xffffffffffff8b48, 0x44
and al, 0x30
call qword [rax + 0x70]
mov qword [rsp + 0x68], rax
jmp 0x14000c026
cmp qword [rsp + 0x30], 0
je 0x140009c03
jmp 0x14000d467
mov r9d, 4
mov r8d, 0x3000
mov rdx, qword [rsp + 0x40]
xor ecx, ecx
call qword [0x140086747]
mov qword [rsp + 0x28], rax
jmp 0x140007c34
mov ecx, 0xe
call qword [0x1400867cb]
xor eax, eax
jmp fcn.14000b080
mov ecx, 0xe
call qword [0x14008672f]
xor eax, eax
jmp fcn.14000b080
cmp qword [rsp + 0x28], 0
jne 0x14000a5d9
jmp 0x14000dc6e
jmp 0x14000b89d
invalid
invalid
invalid
Function at 0x14000bbbe
Capabilities:
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
movzx eax, word [rax]
cmp eax, 0x5a4d
pop r10
add byte [rax], al
je 0x140008e5a
jmp 0x14000da88
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
invalid
cmp al, 0x48
add eax, 0x108
mov rdx, rax
mov rcx, qword [rsp + 0x108]
call fcn.140008867
jmp fcn.14000cc50
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x30], eax
mov edx, 0x40
mov rcx, qword [rsp + 0x108]
call fcn.140008867
jmp 0x140009df8
test eax, eax
je 0x140009f7a
jmp 0x14000742a
xor eax, eax
jmp fcn.14000b080
invalid
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xe8
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x88], 0
mov dword [rsp + 0x88], 0
mov qword [rsp + 0x58], 0
jmp 0x140009487
mov ecx, 0xc1
invalid
invalid
invalid
Function at 0x14000bf30
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x40000000
add byte [rax], al
test eax, eax
je 0x14000c114
jmp 0x1400077fe
mov dword [rsp + 0x28], 1
jmp 0x140008161
mov dword [rsp + 0x2c], 1
jmp 0x14000cb30
cmp qword [rsp + 0x38], 0
jne 0x140007fa4
jmp 0x14000b4e2
mov eax, 1
jmp 0x14000a5d1
add byte [rax], al
lea r9, [rsp + 0x4c]
mov r8d, dword [rsp + 0x20]
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax + 0x10]
mov rax, qword [rsp + 0x98]
add byte [rax], al
mov rcx, qword [rax]
mov rax, qword [rsp + 0x38]
call qword [rax + 0x10]
mov dword [rsp + 0x30], eax
jmp 0x14000aee2
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x80000000
test eax, eax
jne 0x140007b61
invalid
jmp 0x14000885a
mov dword [rsp + 0x2c], 0
jmp 0x14000cb30
mov dword [rsp + 0x24], 1
jmp 0x14000779b
invalid
invalid
invalid
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x98]
and al, 0x98
add byte [rax], al
invalid
mov eax, dword [rax + 0x18]
and eax, 0x4000000
test eax, eax
jne 0x14000a4db
test dword [rsi + 4], eax
add byte [rax], al
jmp 0x140007c45
lea rcx, [0x1400abc5c]
call fcn.14000a9e9
jmp 0x14000e059
mov eax, dword [rsp + 0x20]
bts eax, 9
mov dword [rsp + 0x20], eax
cmp qword [rsp + 0x38], 0
je 0x14000b4e2
sldt word [rax]
jmp 0x140007fa4
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x20000000
test eax, eax
je 0x14000bda7
jmp 0x140008f06
cmp dword [rsp + 0x30], 0
jne 0x14000dd0f
jmp 0x14000a1bd
lea r9, [rsp + 0x4c]
mov r8d, dword [rsp + 0x20]
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax + 0x10]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
call qword [0x1400876d3]
mov dword [rsp + 0x30], eax
jmp 0x14000aee2
mov eax, 1
jmp 0x14000a5d1
mov dword [rsp + 0x24], 0
jmp 0x14000779b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x98]
cmp qword [rax + 0x10], 0
jne 0x14000c798
test dword [rbx], esi
or byte [rax], al
invalid
jmp 0x14000ba83
mov dword [rsp + 0x28], 0
jmp 0x140008161
mov rax, qword [rsp + 0x98]
invalid
invalid
mov word [rax + rbx*4], fs
Function at 0x14000c1ec
Capabilities:
Enumerate pe sections

Disassembly:
jmp 0x14000d181
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
or byte [rax - 0x77], cl
and al, 0x38
mov rax, qword [rsp + 0x88]
jmp 0x14000d523
call qword [rdx]
add byte [rax], al
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x24], eax
jl 0x14000ac79
jmp 0x14000bab9
mov rax, qword [rax]
mov rcx, qword [rsp + 0x88]
mov rcx, qword [rcx]
or dword [rdi], ecx
mov bh, 0x49
adc al, 0x48
lea eax, [rax + rcx + 0x18]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x88]
mov eax, dword [rsp + 0x88]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x24], 0
jmp 0x140007563

Function at 0x14000cc50
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x38]
and eax, 1
add dword [rbp - 0x7d7bf040], eax
push rax
add byte [rax], al
jmp 0x14000b818
mov ecx, 0xc1
call qword [0x14008384b]
xor eax, eax
jmp fcn.14000b080
mov ecx, 0xc1
call qword [0x140083912]
xor eax, eax
jmp fcn.14000b080
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 6]
xor eax, eax
jmp fcn.14000b080
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x100]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0x4550
jne 0x1400081ab
jmp 0x14000ca83
mov ecx, 0xc1
call qword [0x140086f3c]
mov bh, 7
add byte [rbx], dh
shr cl, 0x56
clc
invalid
invalid
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 4]
cmp eax, 0x8664
add byte [rdi], cl
test dword [rdi - 0x4a], ebp
invalid
invalid
jmp 0x140007ad6
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x50], rax
and al, 0x50
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x38]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x48], 0
jmp 0x1400086e7
test eax, eax
jne 0x14000979f
jmp 0x140009292

Function at 0x14000ebf0
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1401342bc
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x14018ea90]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 6
lea r8, [0x14018ea88]
call fcn.14013385c
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x1401342fc
call qword [0x1401df010]
jmp 0x140134302
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000ed00
Capabilities:
Read file on windows

Disassembly:
jmp 0x1401472e4
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15d, r8d
mov r13, rdx
movsxd rsi, ecx
cmp esi, 0xfffffffe
jne 0x140147320
call fcn.1400115d0
and dword [rax], 0
call fcn.14000a780
mov dword [rax], 9
jmp 0x1401473e5
test ecx, ecx
js 0x1401473cd
cmp esi, dword [0x1401cc47c]
jae 0x1401473cd
mov r14, rsi
mov r12, rsi
sar r12, 6
lea rax, [0x1401cbfb0]
and r14d, 0x3f
shl r14, 6
mov rax, qword [rax + r12*8]
movzx ecx, byte [rax + r14 + 0x38]
and ecx, 1
je 0x1401473cd
xor eax, eax
cmp r8d, 0x7fffffff
setbe al
test eax, eax
jne 0x140147381
call fcn.1400115d0
and dword [rax], 0
call fcn.14000a780
mov dword [rax], 0x16
jmp 0x1401473e0
mov ecx, esi
call fcn.14000d510
or ebx, 0xffffffff
lea rax, [0x1401cbfb0]
mov rax, qword [rax + r12*8]
test byte [rax + r14 + 0x38], 1
jne 0x1401473b3
call fcn.14000a780
mov dword [rax], 9
call fcn.1400115d0
and dword [rax], 0
jmp 0x1401473c2
mov r8d, r15d
mov rdx, r13
mov ecx, esi
call fcn.1400067f0
mov ebx, eax
mov ecx, esi
call fcn.140003100
mov eax, ebx
jmp 0x1401473e8
call fcn.1400115d0
and dword [rax], 0
call fcn.14000a780
mov dword [rax], 9
call fcn.14000ff10
or eax, 0xffffffff
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rsi
ret

Function at 0x14000f290
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1401341b0
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x14018ea60]
mov ecx, 3
lea r8, [0x14018ea58]
lea rdx, str.FlsAlloc
call fcn.14013385c
test rax, rax
je 0x1401341ec
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [0x1401df010]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x1400107f0
Capabilities:
Parse pe header

Disassembly:
jmp 0x14012aac0
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14012a87b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14012a87b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14012a87b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14012a87b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14012a87b
cmp dword [rcx + 0x84], 0xe
jbe 0x14012a87b
cmp dword [rcx + 0xf8], 0
je 0x14012a87b
mov ecx, ebx
call fcn.14012aa0c
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400065f0
cmp dword [rbp + 0x20], 0
je 0x14012a8c8
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14012a900
int3
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x14012a814
Function at 0x1400114a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1401097d0
sub rsp, 0x28
cmp word [rcx + 0x42], 0x46
jne 0x1401097f4
test byte [rcx], 8
jne 0x14010996b
mov dword [rcx + 0x2c], 7
add rsp, 0x28
jmp fcn.1400080b0
cmp word [rcx + 0x42], 0x4e
jne 0x140109822
test byte [rcx], 8
jne 0x14010996b
mov dword [rcx + 0x2c], 8
call fcn.14000a780
mov dword [rax], 0x16
call fcn.14000ff10
xor al, al
jmp 0x14010996d
cmp dword [rcx + 0x3c], 0
jne 0x14010980b
movzx eax, word [rcx + 0x42]
cmp eax, 0x49
je 0x140109904
cmp eax, 0x4c
je 0x1401098fb
cmp eax, 0x54
je 0x1401098f2
mov edx, 0x68
cmp eax, edx
je 0x1401098cc
cmp eax, 0x6a
je 0x1401098c0
mov edx, 0x6c
cmp eax, edx
je 0x140109897
cmp eax, 0x74
je 0x14010988b
cmp eax, 0x77
je 0x14010987f
cmp eax, 0x7a
mov al, 1
jne 0x14010996d
mov dword [rcx + 0x3c], 6
jmp 0x14010996d
mov dword [rcx + 0x3c], 0xc
jmp 0x14010996b
mov dword [rcx + 0x3c], 7
jmp 0x14010996b
mov rax, qword [rcx + 0x18]
cmp word [rax], dx
jne 0x1401098b4
add rax, 2
mov dword [rcx + 0x3c], 4
mov qword [rcx + 0x18], rax
jmp 0x14010996b
mov dword [rcx + 0x3c], 3
jmp 0x14010996b
mov dword [rcx + 0x3c], 5
jmp 0x14010996b
mov rax, qword [rcx + 0x18]
cmp word [rax], dx
jne 0x1401098e9
add rax, 2
mov dword [rcx + 0x3c], 1
mov qword [rcx + 0x18], rax
jmp 0x14010996b
mov dword [rcx + 0x3c], 2
jmp 0x14010996b
mov dword [rcx + 0x3c], 0xd
jmp 0x14010996b
mov dword [rcx + 0x3c], 8
jmp 0x14010996b
mov rdx, qword [rcx + 0x18]
movzx eax, word [rdx]
cmp ax, 0x33
jne 0x140109929
cmp word [rdx + 2], 0x32
jne 0x140109929
lea rax, [rdx + 4]
mov dword [rcx + 0x3c], 0xa
mov qword [rcx + 0x18], rax
jmp 0x14010996b
cmp ax, 0x36
jne 0x140109947
cmp word [rdx + 2], 0x34
jne 0x140109947
lea rax, [rdx + 4]
mov dword [rcx + 0x3c], 0xb
mov qword [rcx + 0x18], rax
jmp 0x14010996b
sub ax, 0x58
cmp ax, 0x20
ja 0x14010996b
movzx eax, ax
movabs rdx, 0x120821001
bt rdx, rax
jae 0x14010996b
mov dword [rcx + 0x3c], 9
mov al, 1
add rsp, 0x28
ret

Function at 0x1400116f0
Capabilities:
Print debug messages

Disassembly:
jmp 0x140141f4c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
call fcn.14000b3e0
cmp eax, 2
sete dil
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140141f99
test rbx, rbx
je 0x140141f8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test dil, dil
je 0x140141fd0
mov eax, 4
jmp 0x140141fdf
test dil, dil
je 0x140141fd0
call fcn.140002c90
test al, al
je 0x140141fd0
call fcn.1400110a0
test al, al
jne 0x140141fc6
bts esi, 0x15
xor ecx, ecx
mov rdx, rbx
mov r8, rbp
mov r9d, esi
call fcn.14000d770
jmp 0x140141fdf
call fcn.1400067b0
mov rcx, rax
jmp 0x140141fb6
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb eax, eax
neg eax
add eax, 3
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140014360
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140043190
movzx eax, byte [rdx + 1]
mov r8, rdx
movzx r9d, byte [rdx]
movabs r11, 0x100000001b3
movabs r10, 0xcbf29ce484222325
xor r9, r10
movzx ecx, byte [r8 + 8]
imul r9, r11
xor rcx, r10
xor r9, rax
movzx eax, byte [rdx + 2]
imul rcx, r11
imul r9, r11
xor r9, rax
movzx eax, byte [rdx + 3]
movzx edx, byte [rdx + 4]
xor rdx, r10
imul rdx, r11
imul r9, r11
xor r9, rax
movzx eax, byte [r8 + 5]
xor rdx, rax
movzx eax, byte [r8 + 6]
imul rdx, r11
imul r9, r11
xor rdx, rax
movzx eax, byte [r8 + 7]
imul rdx, r11
shr r9, 1
xor rdx, rax
movzx eax, byte [r8 + 9]
xor rcx, rax
movzx eax, byte [r8 + 0xa]
imul rcx, r11
imul rdx, r11
xor rcx, rax
movzx eax, byte [r8 + 0xb]
imul rcx, r11
xor rcx, rax
imul rcx, r11
lea rax, [rcx + rcx]
movabs rcx, 0x7fffffffffffffff
and rdx, rcx
xor rax, rdx
xor rax, r9
ret

Function at 0x140045710
Capabilities:
Set console window title

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401c70a0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x14004576a
movzx ecx, word [rsp + 0x30]
mov eax, 0x4e20
add cx, 0x1e
mov word [rsp + 0x22], ax
mov word [rsp + 0x20], cx
mov rcx, rbx
mov edx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
xor eax, eax
lea r8, [rsp + 0x28]
mov dword [rsp + 0x28], eax
mov rcx, rbx
movzx eax, word [rsp + 0x30]
add ax, 0x1d
mov word [rsp + 0x2c], ax
mov eax, 0x32
mov word [rsp + 0x2e], ax
lea edx, [rax - 0x31]
call qword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
mov rcx, qword [section..data]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140011080
add rsp, 0x50
pop rbx
ret
Function at 0x1401097d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1401097d0
sub rsp, 0x28
cmp word [rcx + 0x42], 0x46
jne 0x1401097f4
test byte [rcx], 8
jne 0x14010996b
mov dword [rcx + 0x2c], 7
add rsp, 0x28
jmp fcn.1400080b0
cmp word [rcx + 0x42], 0x4e
jne 0x140109822
test byte [rcx], 8
jne 0x14010996b
mov dword [rcx + 0x2c], 8
call fcn.14000a780
mov dword [rax], 0x16
call fcn.14000ff10
xor al, al
jmp 0x14010996d
cmp dword [rcx + 0x3c], 0
jne 0x14010980b
movzx eax, word [rcx + 0x42]
cmp eax, 0x49
je 0x140109904
cmp eax, 0x4c
je 0x1401098fb
cmp eax, 0x54
je 0x1401098f2
mov edx, 0x68
cmp eax, edx
je 0x1401098cc
cmp eax, 0x6a
je 0x1401098c0
mov edx, 0x6c
cmp eax, edx
je 0x140109897
cmp eax, 0x74
je 0x14010988b
cmp eax, 0x77
je 0x14010987f
cmp eax, 0x7a
mov al, 1
jne 0x14010996d
mov dword [rcx + 0x3c], 6
jmp 0x14010996d
mov dword [rcx + 0x3c], 0xc
jmp 0x14010996b
mov dword [rcx + 0x3c], 7
jmp 0x14010996b
mov rax, qword [rcx + 0x18]
cmp word [rax], dx
jne 0x1401098b4
add rax, 2
mov dword [rcx + 0x3c], 4
mov qword [rcx + 0x18], rax
jmp 0x14010996b
mov dword [rcx + 0x3c], 3
jmp 0x14010996b
mov dword [rcx + 0x3c], 5
jmp 0x14010996b
mov rax, qword [rcx + 0x18]
cmp word [rax], dx
jne 0x1401098e9
add rax, 2
mov dword [rcx + 0x3c], 1
mov qword [rcx + 0x18], rax
jmp 0x14010996b
mov dword [rcx + 0x3c], 2
jmp 0x14010996b
mov dword [rcx + 0x3c], 0xd
jmp 0x14010996b
mov dword [rcx + 0x3c], 8
jmp 0x14010996b
mov rdx, qword [rcx + 0x18]
movzx eax, word [rdx]
cmp ax, 0x33
jne 0x140109929
cmp word [rdx + 2], 0x32
jne 0x140109929
lea rax, [rdx + 4]
mov dword [rcx + 0x3c], 0xa
mov qword [rcx + 0x18], rax
jmp 0x14010996b
cmp ax, 0x36
jne 0x140109947
cmp word [rdx + 2], 0x34
jne 0x140109947
lea rax, [rdx + 4]
mov dword [rcx + 0x3c], 0xb
mov qword [rcx + 0x18], rax
jmp 0x14010996b
sub ax, 0x58
cmp ax, 0x20
ja 0x14010996b
movzx eax, ax
movabs rdx, 0x120821001
bt rdx, rax
jae 0x14010996b
mov dword [rcx + 0x3c], 9
mov al, 1
add rsp, 0x28
ret