joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140360af8
Capabilities:
Hash data using murmur3

Disassembly:
not edi
ror edi, 3
dec ebp
not edi
lea edi, [r9 + rdi - 0x3b134089]
jne 0x1402cd1be
add r9, 4
xor edx, edi
jmp 0x1403e147a
ror edi, 2
mov eax, 0x78af5c32
lea edi, [rdi + rax*2 - 0x635420b3]
mov edx, r9d
push rsi
lea rbx, [rbx*4 + 0x323bfc32]
call fcn.1403f02d5
mov edx, 0x819df0b9
mov qword [rsp], 0xffffffffd4ab9512
mov r11w, word [r8]
movsx esi, byte [rsp + 3]
mov cl, byte [r8 + 2]
inc dx
lea rdi, [rdx*8 - 0xcd1f9e9]
call fcn.1403c95b2
sub esi, 0x5a9edc88
xor r11b, 0x13
jnp 0x1403fc472
movzx ebp, al
call fcn.1403deee9
bswap esi
shr r11d, cl
sub esi, r11d
call fcn.14036c28b
mov ebx, 0x811b6818
movsx ecx, bx
dec cx
mov cx, word [r10 + rcx*2 - 0xd02e]
movsx eax, bl
call fcn.140255d9b
mov r9d, 0xddbaf03f
movzx ebx, r9b
mov edi, dword [r8 + rbx*2 - 0x7e]
lea r8, [r8 + rbx - 0x3b]
mov ebp, ebx
xor edi, esi
jmp 0x14027752c

Function at 0x1404025bb
Capabilities:
Hash data using murmur3

Disassembly:
shl si, 0xa2
mov qword [rsp + rsi - 0x42a0390c], rdi
mov ax, word [rsi + r10 - 0x42a0390c]
xor ax, r8w
mov qword [rsp + rdi - 0x69c2a4d4], 0xffffffffdc847f0c
xor word [rsp + rsi - 0x42a0390c], r11w
adc ax, 0xf094
not ax
inc di
rol ax, 1
xor ax, 0xff91
pop r11
neg ax
and r11w, dx
seta sil
xor r8w, ax
lea rax, [rsp + rax + 8]
pop rsi
jmp 0x140327f0e
Function at 0x4292f0
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x42950f
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
lea rax, [0x007d1ca0]
mov qword [rsp], rax
call fcn.0040d8a0
mov rax, qword [0x007d1d48]
test rax, rax
je 0x42941a
lea rax, [0x007d1ca0]
mov qword [rsp], rax
call fcn.0040dab0
movabs rax, 0x8000000000000000
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x70]
test eax, eax
jle 0x429411
mov ecx, eax
mov eax, 0x3e8
cmp ecx, 0xffffffff
je 0x429407
cdq
idiv ecx
test eax, eax
jne 0x429387
mov eax, 1
movsxd rdx, eax
imul rdx, rdx, 0xffffffffffffd8f0
mov qword [rsp + 0x48], rdx
mov rdx, qword [sym.imp.KERNEL32.DLL_SetWaitableTimer]
mov qword [rsp], rdx
mov rdx, qword [0x007d1d48]
mov qword [rsp + 8], rdx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x10], rdx
movsxd rax, eax
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call fcn.00428f00
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov ecx, dword [rsp + 0x70]
xchg dword [rax + 0xdc], ecx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
neg rax
xor edx, edx
jmp 0x42937e
mov ecx, eax
xor eax, eax
jmp 0x429396
mov rax, qword [sym.imp.KERNEL32.DLL_CreateWaitableTimerA]
mov qword [rsp], rax
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], 0
call fcn.00428de0
mov rax, qword [rsp + 0x20]
lea rcx, [0x007d1d48]
xchg qword [rcx], rax
lea rax, [0x0062fc80]
mov qword [rsp + 0x50], rax
lea rax, [0x00695788]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x58]
test byte [rax], al
lea rax, [rsp + 0x50]
mov rcx, 8
mov rax, qword [rcx + rax]
mov rax, qword [rax]
mov rcx, qword [sym.imp.KERNEL32.DLL_CreateThread]
mov qword [rsp], rcx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
call fcn.00428f00
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov rcx, qword [sym.imp.KERNEL32.DLL_SetThreadPriority]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 2
call fcn.00428d80
mov rax, qword [sym.imp.KERNEL32.DLL_CloseHandle]
mov qword [rsp], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 8], rax
call fcn.00428d20
jmp 0x429340
call fcn.00452440
jmp fcn.004292f0
Function at 0x4330f0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov qword [rsp + 0x18], rax
mov rcx, qword [rax + 0x30]
mov edx, dword [rcx + 0xd0]
inc edx
mov dword [rcx + 0xd0], edx
mov byte [rax + 0xed], 1
mov qword [rax + 0x10], 0xfffffffffffffade
mov rcx, qword [rax + 0x30]
mov rdx, qword [rcx + 0xa0]
mov edx, dword [rdx + 0x1c]
mov dword [rcx + 0x314], edx
mov byte [rax + 0xef], 1
mov rcx, qword [rax + 0x30]
mov rcx, qword [rcx + 0xa0]
mov edx, dword [rcx + 0x1c]
inc edx
mov dword [rcx + 0x1c], edx
lea rcx, [rsp + 0x70]
mov qword [rsp], rcx
call fcn.00453e00
mov rax, qword [rsp + 8]
lea rcx, [rsp + 0x70]
mov rdx, rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp], rax
mov qword [rsp + 8], rdx
call fcn.00432c80
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x40]
mov qword [rax + 0x78], rcx
mov rcx, qword [rax + 0x48]
mov qword [rax + 0x80], rcx
mov rcx, qword [rax + 0x78]
mov rdx, qword [rax]
cmp rcx, rdx
jae 0x4332e5
mov rdx, qword [rax + 0x40]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
lea rbx, [0x00451340]
mov qword [rsp + 0x38], rbx
mov rbx, qword [rsp + 0x10]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x38]
mov qword [rsp], rcx
call fcn.004522e0
mov rax, qword [rsp + 0x18]
mov qword [rsp], rax
movabs rcx, 0x300000002
mov qword [rsp + 8], rcx
call fcn.0042e980
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x78]
mov rdx, qword [rax]
cmp rcx, rdx
jae 0x4332d7
mov qword [rsp + 0x20], 0
lea rcx, [0x004514b0]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.004522e0
lea rax, [0x00695590]
mov qword [rsp], rax
call fcn.004522e0
lea rax, [rsp + 0x70]
mov qword [rsp], rax
call fcn.00453e00
mov rax, qword [rsp + 8]
lea rcx, [rsp + 0x70]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00432c80
mov rax, qword [rsp + 0x18]
mov rax, qword [rax + 0x30]
mov ecx, dword [rax + 0xd0]
dec ecx
mov dword [rax + 0xd0], ecx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rdx, qword [rax + 8]
cmp rdx, rcx
jae 0x433280
jmp 0x43324e
mov rdx, qword [rax + 8]
cmp rdx, rcx
jae 0x43321c
jmp 0x4331b8
Function at 0x445b70
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rax, qword gs:[0x28]
mov rax, qword [rax]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x18], rax
lea rcx, [rax + 0x368]
test byte [rcx], al
mov rdx, qword [rsp + 0x30]
mov qword [rax + 0x368], rdx
test byte [rcx], al
mov rdx, qword [rsp + 0x38]
mov qword [rax + 0x370], rdx
lea rdx, [rsp + 0x40]
mov qword [rax + 0x378], rdx
mov rdx, qword [0x007b5730]
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
call fcn.004024e0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rax + 0x388]
mov rdx, qword [rax + 0x390]
mov rax, qword [rax + 0x380]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x44b650
Capabilities:
Access peb ldr_data

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x44b750
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
lea rax, [rsp + 0x78]
mov rcx, rax
mov qword [rsp + 0x18], rcx
mov qword [rsp], rax
call fcn.00453e00
mov rax, qword [rsp + 8]
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x20], 0
lea rdi, [rsp + 0x28]
xorps xmm0, xmm0
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045506d
mov rbp, qword [rbp]
lea rdx, [0x00451af0]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x20]
mov qword [rsp], rax
call fcn.004522e0
mov rax, qword [rsp + 0x10]
mov qword [rsp + 0x98], rax
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
call fcn.00452440
jmp fcn.0044b650
Function at 0x45fc10
Capabilities:
Encode data using base64

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x45fd18
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rcx + 8]
lea rbx, [rdx + 0x2e]
neg rbx
imul rbx, rbx, 0x1c
movabs rax, 0x2c0b02c0b02c0b03
mov rsi, rdx
imul rbx
sar rdx, 4
sar rbx, 0x3f
sub rdx, rbx
lea rbx, [rdx + 0x15c]
sar rbx, 0x3f
shr rbx, 0x3d
lea rdx, [rdx + rbx + 0x15c]
sar rdx, 3
cmp rdx, 0x57
jae 0x45fcb7
lea rax, [rdx + rdx*2]
lea rbx, [0x00796980]
mov rdi, qword [rbx + rax*8 + 8]
lea r8, [rsi + rdi + 0x40]
mov r9, rax
shl rax, 3
cmp r8, 0xffffffffffffffc4
jge 0x45fcbe
lea rax, [rdx + 1]
mov rdx, rax
cmp rdx, 0x57
jb 0x45fc88
call fcn.004295e0
ud2
cmp r8, 0xffffffffffffffe0
jle 0x45fcca
lea rax, [rdx - 1]
jmp 0x45fcae
mov qword [rsp + 0x20], rdx
movzx eax, byte [rbx + rax + 0x10]
mov rbx, qword [rbx + r9*8]
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov byte [rsp + 0x18], al
mov qword [rsp], rcx
call fcn.0045f8b0
mov rax, qword [rsp + 0x20]
mov rcx, rax
shl rax, 3
add rax, 0xfffffffffffffea4
neg rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
call fcn.00452440
jmp fcn.0045fc10

Function at 0x4a44e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x18]
mov ecx, dword [rsp + 8]
mov rdx, qword [rsp + 0x10]
xor ebx, ebx
cmp rbx, rax
jge 0x4a450f
lea rsi, [rdx + 1]
inc rbx
movzx edi, byte [rdx]
imul ecx, ecx, 0x1000193
xor ecx, edi
mov rdx, rsi
cmp rbx, rax
jl 0x4a44f5
mov dword [rsp + 0x28], ecx
ret
Function at 0x555d40
Capabilities:
Encrypt data using des

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x555e7f
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
xor eax, eax
mov qword [rsp + 0x28], rax
cmp rax, 8
jge 0x555e6e
xor ecx, ecx
mov qword [rsp + 0x38], rcx
cmp rcx, 4
jge 0x555e5c
xor edx, edx
mov qword [rsp + 0x30], rdx
cmp rdx, 0x10
jge 0x555e4a
mov rbx, rax
shl rax, 6
lea rsi, [0x0078df40]
add rax, rsi
shl rcx, 4
mov qword [rsp + 0x40], rcx
add rax, rcx
movzx eax, byte [rax + rdx]
lea r8, [rbx - 7]
neg r8
shl r8, 2
mov rcx, r8
shl rax, cl
cmp rcx, 0x40
sbb r8, r8
and r8, rax
mov qword [rsp], r8
lea rax, [0x00784fa0]
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], 0x20
mov qword [rsp + 0x18], 0x20
call fcn.00555cd0
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rdx, rbx
cmp rdx, 0x40
jae 0x555e78
mov rsi, qword [rsp + 0x28]
mov rdi, rsi
shl rsi, 8
lea r8, [0x007d3160]
add rsi, r8
mov dword [rsi + rdx*4], eax
lea rdx, [rbx + 1]
mov rax, rdi
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x30], rdx
cmp rdx, 0x10
jl 0x555d9b
inc rcx
mov qword [rsp + 0x38], rcx
cmp rcx, 4
jl 0x555d8a
inc rax
mov qword [rsp + 0x28], rax
cmp rax, 8
jl 0x555d79
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
call fcn.004295e0
ud2
call fcn.00452440
jmp fcn.00555d40
Function at 0x5b6570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 8
mov qword [rsp], rbp
lea rbp, [rsp]
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x5b6686
mov rcx, qword [rsp + 0x18]
movzx edx, byte [rcx]
cmp dl, 0x30
jb 0x5b6686
cmp dl, 0x39
ja 0x5b6686
cmp rax, 2
jl 0x5b65c1
cmp dl, 0x30
jne 0x5b65c1
movzx edx, byte [rcx + 1]
cmp dl, 0x30
jb 0x5b65c1
cmp dl, 0x39
jbe 0x5b665d
mov rdx, rax
mov rbx, rcx
test rax, rax
je 0x5b65f6
movzx esi, byte [rcx]
cmp sil, 0x30
jb 0x5b65f6
cmp sil, 0x39
ja 0x5b65f6
lea rsi, [rax - 2]
sar rsi, 0x3f
xor rsi, 0xffffffffffffffff
and rsi, 1
add rcx, rsi
dec rax
test rax, rax
jne 0x5b65cc
mov rsi, rdx
sub rdx, rax
cmp rdx, rsi
ja 0x5b6656
xor esi, esi
xor edi, edi
cmp rsi, rdx
jge 0x5b662d
cmp rdi, 0x5f5e100
jge 0x5b664d
lea r8, [rsi + 1]
movzx r9d, byte [rbx + rsi]
lea r10, [rdi + rdi*4]
lea rdi, [r9 + r10*2 - 0x30]
mov rsi, r8
cmp rsi, rdx
jl 0x5b660a
mov rdx, rdi
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x40], 1
mov rbp, qword [rsp]
add rsp, 8
ret
mov rdx, 0xffffffffffffffff
jmp 0x5b6630
call fcn.00429650
ud2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov byte [rsp + 0x40], 0
mov rbp, qword [rsp]
add rsp, 8
ret
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov byte [rsp + 0x40], 0
mov rbp, qword [rsp]
add rsp, 8
ret

Function at 0x5ba450
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x5ba587
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
xor eax, eax
xor ecx, ecx
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov rdi, qword [rsp + 0x78]
cmp rax, rdi
jge 0x5ba4e2
lea r8, [rax + 1]
cmp r8, rdi
jae 0x5ba580
mov r8, qword [rsp + 0x70]
mov r9d, dword [r8 + rax*4 + 4]
mov dword [rsp + 0x3c], r9d
cmp rax, rdi
jae 0x5ba580
mov r10d, dword [r8 + rax*4]
dec r10d
cmp ecx, r10d
jle 0x5ba53c
add rax, 2
lea ecx, [r9 + 1]
mov qword [rsp + 0x40], rax
mov rdi, qword [rsp + 0x78]
cmp rax, rdi
jl 0x5ba49a
cmp ecx, 0x10ffff
jle 0x5ba50c
mov qword [rsp + 0x88], rdx
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x98], rsi
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], 0x10ffff
call fcn.005b9e40
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
jmp 0x5ba4ea
mov qword [rsp], rdx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp + 0x18], ecx
mov dword [rsp + 0x1c], r10d
call fcn.005b9e40
mov rdx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov r9d, dword [rsp + 0x3c]
jmp 0x5ba4cb
call fcn.004295e0
ud2
call fcn.00452440
jmp fcn.005ba450
Function at 0x5ba5a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x5ba80d
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x58], rdx
xor ebx, ebx
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov r8, qword [rsp + 0x90]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rcx
cmp rbx, rdx
jge 0x5ba6ae
movzx r9d, word [rcx + 4]
mov dword [rsp + 0x4c], r9d
movzx r10d, word [rcx + 2]
mov dword [rsp + 0x48], r10d
movzx r11d, word [rcx]
cmp r9d, 1
je 0x5ba7c5
mov dword [rsp + 0x44], r11d
cmp r11d, r10d
jg 0x5ba694
mov qword [rsp], rsi
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r8
mov dword [rsp + 0x18], r11d
mov dword [rsp + 0x1c], r11d
call fcn.005b9e40
mov r9d, dword [rsp + 0x4c]
mov eax, dword [rsp + 0x44]
lea r11d, [rax + r9]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r10d, dword [rsp + 0x48]
mov dword [rsp + 0x44], r11d
cmp r11d, r10d
jle 0x5ba635
add rcx, 6
inc rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rcx
cmp rbx, rdx
jl 0x5ba609
mov rcx, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x58], rax
xor edx, edx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x60], rcx
cmp rdx, rax
jge 0x5ba766
mov ebx, dword [rcx + 8]
mov dword [rsp + 0x38], ebx
mov r9d, dword [rcx + 4]
mov dword [rsp + 0x3c], r9d
mov r10d, dword [rcx]
cmp ebx, 1
je 0x5ba788
mov dword [rsp + 0x40], r10d
cmp r10d, r9d
jg 0x5ba74c
mov qword [rsp], rsi
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r8
mov dword [rsp + 0x18], r10d
mov dword [rsp + 0x1c], r10d
call fcn.005b9e40
mov eax, dword [rsp + 0x40]
mov ebx, dword [rsp + 0x38]
lea r10d, [rbx + rax]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov r9d, dword [rsp + 0x3c]
mov dword [rsp + 0x40], r10d
cmp r10d, r9d
jle 0x5ba6f6
add rcx, 0xc
inc rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x60], rcx
cmp rdx, rax
jl 0x5ba6d0
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], r8
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp], rsi
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r8
mov dword [rsp + 0x18], r10d
mov dword [rsp + 0x1c], r9d
call fcn.005b9e40
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
jmp 0x5ba74c
mov qword [rsp], rsi
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], r8
mov dword [rsp + 0x18], r11d
mov dword [rsp + 0x1c], r10d
call fcn.005b9e40
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
jmp 0x5ba694
call fcn.00452440
jmp fcn.005ba5a0
Function at 0x180004a60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
mov r8, rcx
je 0x180004ae8
mov r9, 0xfffffffffffffffe
lea rax, [rcx + 2]
sub r9, rcx
nop word [rax + rax]
lea edx, [r9 + rax]
xor byte [rax + 7], dl
lea ecx, [rdx - 9]
xor byte [rax - 2], cl
lea rax, [rax + 0xe]
lea ecx, [rdx - 8]
xor byte [rax - 0xf], cl
lea ecx, [rdx - 7]
xor byte [rax - 0xe], cl
lea ecx, [rdx - 6]
xor byte [rax - 0xd], cl
lea ecx, [rdx - 5]
xor byte [rax - 0xc], cl
lea ecx, [rdx - 4]
xor byte [rax - 0xb], cl
lea ecx, [rdx - 3]
xor byte [rax - 0xa], cl
lea ecx, [rdx - 2]
xor byte [rax - 9], cl
lea ecx, [rdx - 1]
xor byte [rax - 8], cl
lea ecx, [rdx + 1]
xor byte [rax - 6], cl
lea ecx, [rdx + 2]
xor byte [rax - 5], cl
lea ecx, [rdx + 3]
xor byte [rax - 4], cl
add dl, 4
xor byte [rax - 3], dl
lea rcx, [rax + r9]
cmp rcx, 0x46
jb 0x180004a80
mov byte [r8 + 0x47], 0
mov rax, r8
ret

Function at 0x180004e90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x180004eb8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 9]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x135
jb 0x180004ea0
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x180014f00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rdx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [rcx + r8]
movabs r9, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, r9
cmp r8, 4
jb 0x180014f0d
mov rax, rdx
ret
Function at 0x18002153c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rbp, r9d
mov r14, r8
test r8, r8
je 0x180021563
and qword [r8], 0
call fcn.180021648
mov rbx, rax
test rax, rax
je 0x18002162b
mov rcx, rax
call fcn.1800214c4
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180021622
mov rax, qword [0x18014cdc8]
test rax, rax
je 0x18002159b
inc dword [rax + 0xec]
mov rdx, qword [0x18014cdd8]
lea rcx, [rdi + rbp]
call qword [section..data]
mov rsi, rax
test rax, rax
je 0x180021622
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rdi
je 0x1800215fa
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x18014cdc8]
test rax, rax
je 0x1800215e8
dec dword [rax + 0xec]
mov rdx, qword [0x18014cdd8]
mov rcx, rsi
call qword [0x18014b008]
jmp 0x18002162b
test ebp, ebp
jle 0x18002160c
lea rcx, [rsi + rdi]
mov r8, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x18002161d
mov qword [r14], rdi
mov rax, rsi
jmp 0x18002162d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1800219a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rcx
not r8d
test rdx, rdx
je 0x1800219ce
movzx eax, byte [r9]
inc r9
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
lea rax, [0x1800c03d0]
xor r8d, dword [rax + rcx*4]
sub rdx, 1
jne 0x1800219ab
not r8d
mov eax, r8d
ret

Function at 0x1800219d8
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x180021a32
mov r11b, reloc.WLDAP32.dll_Ordinal_35
lea rbx, [0x1800c03d0]
movzx edi, byte [r10]
dec rdx
inc r10
cmp dil, r11b
jne 0x180021a1c
cmp rdx, 2
jb 0x180021a1c
cmp byte [r10], r11b
jne 0x180021a1c
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rdi
shr r9d, 8
xor r9d, dword [rbx + rcx*4]
test rdx, rdx
jne 0x1800219fa
jmp 0x180021a73
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x180021a73
mov r11b, reloc.WLDAP32.dll_Ordinal_35
lea rbx, [0x1800c03d0]
cmp dl, r11b
jne 0x180021a57
cmp byte [r10], r11b
jne 0x180021a57
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rbx + rcx*4]
test dl, dl
jne 0x180021a45
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret
Function at 0x180023a4c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5ca0], 0
lea rbx, [rcx + 0x5ca8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x180023ae5
mov r9d, dword [rbx + 4]
test r9d, r9d
jns 0x180023a9d
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.1800303f8
and dword [rbx], 0
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.18002faf4
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5ca0]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x18014cdd0]
movsxd r8, eax
mov rax, qword [rdi + 0x5cb0]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x180023aed
mov rcx, rbx
call fcn.18002faf4
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18002aeac
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x18014cdc8]
mov rbx, rcx
and dword [rax + 0x5bfc], 0
test rcx, rcx
je 0x18002af15
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.18002af20
lea rdx, [0x1800c1aec]
mov rcx, rbx
mov rdi, rax
call fcn.180021648
mov rbx, rax
test rax, rax
je 0x18002af15
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret