joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c43b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
xor edi, edi
mov ecx, dword [0x1404e7590]
mov rax, qword gs:[0x58]
mov edx, 4
mov rsi, qword [rax + rcx*8]
add rsi, rdx
mov eax, dword [rsi]
cmp dword [0x1404e6020], eax
jg 0x1400c44e8
mov ebp, dword [reloc.WS2_32.dll_accept]
mov eax, dword [rsi]
cmp dword [0x1404e6050], eax
jg 0x1400c4520
cmp byte [0x1404e601f], 0
jne 0x1400c4450
cmp ebp, 2
jge 0x1400c4450
lea r8, [0x1404e6018]
nop dword [rax + rax]
mov eax, 0x5397829d
imul edi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x31
add cl, dil
xor byte [r8], cl
inc edi
lea r8, [r8 + 1]
cmp edi, 8
jl 0x1400c4420
nop
mov qword [0x1404e6018], 0
lea rdi, [0x1404e6018]
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rdx, [0x1404e6028]
mov rcx, rbx
call fcn.14003fa30
movzx eax, byte [0x1404e6048]
mov byte [rbx + 0x20], al
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
lea rdx, [0x1404e6018]
lea rcx, [rsp + 0x28]
call fcn.1400b7450
nop
lea rdx, [rsp + 0x28]
lea rcx, [0x1404e6028]
call fcn.1400b8790
nop
lea rcx, [rsp + 0x28]
call fcn.14003fc80
lea rcx, [0x140187720]
call fcn.14017cf54
nop
lea rcx, [0x1404e6050]
call fcn.14017cfa8
jmp 0x1400c4406
lea rcx, [0x1404e6020]
call fcn.14017d014
cmp dword [0x1404e6020], 0xffffffff
jne 0x1400c43f2
mov rax, qword [0x140191950]
mov qword [0x1404e6018], rax
lea rcx, [0x1404e6020]
call fcn.14017cfa8
jmp 0x1400c43f2
lea rcx, [0x1404e6050]
call fcn.14017d014
cmp dword [0x1404e6050], 0xffffffff
jne 0x1400c4406
cmp byte [0x1404e601f], 0
je 0x1400c449c
cmp ebp, 2
jl 0x1400c4650
movdqa xmm4, xmmword [0x1401937c0]
movdqa xmm2, xmmword [0x14018f690]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.1111]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140191460]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401937b0]
movd xmm0, dword [0x1404e6018]
xorps xmm2, xmm0
movd dword [0x1404e6018], xmm2
movdqa xmm3, xmmword [0x140191440]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.1111]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140191460]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401937b0]
movd xmm0, dword [0x1404e601c]
xorps xmm2, xmm0
movd dword [0x1404e601c], xmm2
jmp 0x1400c449c
lea r9, [0x1404e6018]
mov r8d, edi
nop word [rax + rax]
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x31
add cl, r8b
xor byte [r9], cl
inc r8d
lea r9, [r9 + 1]
cmp r8d, 8
jl 0x1400c4660
jmp 0x1400c449c
Function at 0x1400c57a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
xor edi, edi
mov ecx, dword [0x1404e7590]
mov rax, qword gs:[0x58]
mov edx, 4
mov rsi, qword [rax + rcx*8]
add rsi, rdx
mov eax, dword [rsi]
cmp dword [0x1404e6060], eax
jg 0x1400c58d8
mov ebp, dword [reloc.WS2_32.dll_accept]
mov eax, dword [rsi]
cmp dword [0x1404e6090], eax
jg 0x1400c5910
cmp byte [0x1404e605f], 0
jne 0x1400c5840
cmp ebp, 2
jge 0x1400c5840
lea r8, [0x1404e6058]
nop dword [rax + rax]
mov eax, 0x5397829d
imul edi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x31
add cl, dil
xor byte [r8], cl
inc edi
lea r8, [r8 + 1]
cmp edi, 8
jl 0x1400c5810
nop
mov qword [0x1404e6058], 0
lea rdi, [0x1404e6058]
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rdx, [0x1404e6068]
mov rcx, rbx
call fcn.14003fa30
movzx eax, byte [0x1404e6088]
mov byte [rbx + 0x20], al
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
lea rdx, [0x1404e6058]
lea rcx, [rsp + 0x28]
call fcn.1400b7450
nop
lea rdx, [rsp + 0x28]
lea rcx, [0x1404e6068]
call fcn.1400b8790
nop
lea rcx, [rsp + 0x28]
call fcn.14003fc80
lea rcx, [0x1401877d0]
call fcn.14017cf54
nop
lea rcx, [0x1404e6090]
call fcn.14017cfa8
jmp 0x1400c57f6
lea rcx, [0x1404e6060]
call fcn.14017d014
cmp dword [0x1404e6060], 0xffffffff
jne 0x1400c57e2
mov rax, qword [0x140191958]
mov qword [0x1404e6058], rax
lea rcx, [0x1404e6060]
call fcn.14017cfa8
jmp 0x1400c57e2
lea rcx, [0x1404e6090]
call fcn.14017d014
cmp dword [0x1404e6090], 0xffffffff
jne 0x1400c57f6
cmp byte [0x1404e605f], 0
je 0x1400c588c
cmp ebp, 2
jl 0x1400c5a40
movdqa xmm4, xmmword [0x1401937c0]
movdqa xmm2, xmmword [0x14018f690]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.1111]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140191460]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401937b0]
movd xmm0, dword [0x1404e6058]
xorps xmm2, xmm0
movd dword [0x1404e6058], xmm2
movdqa xmm3, xmmword [0x140191440]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.1111]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140191460]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401937b0]
movd xmm0, dword [0x1404e605c]
xorps xmm2, xmm0
movd dword [0x1404e605c], xmm2
jmp 0x1400c588c
lea r9, [0x1404e6058]
mov r8d, edi
nop word [rax + rax]
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x31
add cl, r8b
xor byte [r9], cl
inc r8d
lea r9, [r9 + 1]
cmp r8d, 8
jl 0x1400c5a50
jmp 0x1400c588c
Function at 0x1400c66c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbx, rdx
xor edi, edi
mov ecx, dword [0x1404e7590]
mov rax, qword gs:[0x58]
mov edx, 4
mov rsi, qword [rax + rcx*8]
add rsi, rdx
mov eax, dword [rsi]
cmp dword [0x1404e60a0], eax
jg 0x1400c67f8
mov ebp, dword [reloc.WS2_32.dll_accept]
mov eax, dword [rsi]
cmp dword [0x1404e60d0], eax
jg 0x1400c6830
cmp byte [0x1404e609f], 0
jne 0x1400c6760
cmp ebp, 2
jge 0x1400c6760
lea r8, [0x1404e6098]
nop dword [rax + rax]
mov eax, 0x5397829d
imul edi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x31
add cl, dil
xor byte [r8], cl
inc edi
lea r8, [r8 + 1]
cmp edi, 8
jl 0x1400c6730
nop
mov qword [0x1404e6098], 0
lea rdi, [0x1404e6098]
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rdx, [0x1404e60a8]
mov rcx, rbx
call fcn.14003fa30
movzx eax, byte [0x1404e60c8]
mov byte [rbx + 0x20], al
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
lea rdx, [0x1404e6098]
lea rcx, [rsp + 0x28]
call fcn.1400b7450
nop
lea rdx, [rsp + 0x28]
lea rcx, [0x1404e60a8]
call fcn.1400b8790
nop
lea rcx, [rsp + 0x28]
call fcn.14003fc80
lea rcx, [0x140187850]
call fcn.14017cf54
nop
lea rcx, [0x1404e60d0]
call fcn.14017cfa8
jmp 0x1400c6716
lea rcx, [0x1404e60a0]
call fcn.14017d014
cmp dword [0x1404e60a0], 0xffffffff
jne 0x1400c6702
mov rax, qword [0x140191960]
mov qword [0x1404e6098], rax
lea rcx, [0x1404e60a0]
call fcn.14017cfa8
jmp 0x1400c6702
lea rcx, [0x1404e60d0]
call fcn.14017d014
cmp dword [0x1404e60d0], 0xffffffff
jne 0x1400c6716
cmp byte [0x1404e609f], 0
je 0x1400c67ac
cmp ebp, 2
jl 0x1400c6960
movdqa xmm4, xmmword [0x1401937c0]
movdqa xmm2, xmmword [0x14018f690]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.1111]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140191460]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401937b0]
movd xmm0, dword [0x1404e6098]
xorps xmm2, xmm0
movd dword [0x1404e6098], xmm2
movdqa xmm3, xmmword [0x140191440]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.1111]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140191460]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401937b0]
movd xmm0, dword [0x1404e609c]
xorps xmm2, xmm0
movd dword [0x1404e609c], xmm2
jmp 0x1400c67ac
lea r9, [0x1404e6098]
mov r8d, edi
nop word [rax + rax]
mov eax, 0x5397829d
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x31
add cl, r8b
xor byte [r9], cl
inc r8d
lea r9, [r9 + 1]
cmp r8d, 8
jl 0x1400c6970
jmp 0x1400c67ac
Function at 0x1400d95b0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x288
mov rax, qword [0x1404e4980]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov dword [rsp + 0x30], 0x238
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x1400d9639
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x1400d9639
mov rdx, qword [rsp + 0x290]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400d9637
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
jmp 0x1400d9646
jmp 0x1400d95fb
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14017d1a0
add rsp, 0x288
ret
Function at 0x1400fb7f0
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x28
xor eax, eax
test eax, eax
je 0x1400fb7fe
mov al, 1
jmp 0x1400fb82d
xor eax, eax
test eax, eax
je 0x1400fb808
mov al, 1
jmp 0x1400fb82d
xor eax, eax
test eax, eax
je 0x1400fb812
mov al, 1
jmp 0x1400fb82d
xor eax, eax
test eax, eax
je 0x1400fb81c
mov al, 1
jmp 0x1400fb82d
xor edx, edx
lea rcx, [0x1400d7460]
call qword [sym.imp.USER32.dll_EnumWindows]
xor al, al
add rsp, 0x28
ret

Function at 0x1400fb840
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [0x1404e4980]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x1400fb87f
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov dword [rsp + 0x24], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x24]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov eax, dword [rsp + 0x24]
cmp dword [rsp + 0x28], eax
jne 0x1400fb8af
mov dword [rsp + 0x20], 1
jmp 0x1400fb8b7
mov dword [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14017d1a0
add rsp, 0x48
ret
Function at 0x14012ec60
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rbx
mov rsi, rcx
mov qword [rsp + 0x38], rdi
call fcn.1400fb7f0
test al, al
je 0x14012ed37
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14012ed17
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14012ed17
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x13004d96
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14012ed12
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14012ecf0
cmp r8d, 0xed454fe
je 0x14012ed1c
test r9d, r9d
jne 0x14012ecd0
mov rax, qword [rax]
jmp 0x14012eca0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
call fcn.1400fb7f0
test al, al
je 0x14012edf7
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14012edd7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14012edd7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xd5991d6a
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14012edd2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14012edb0
cmp r8d, 0xd9c428e2
je 0x14012eddc
test r9d, r9d
jne 0x14012ed90
mov rax, qword [rax]
jmp 0x14012ed60
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
cmp byte [rsi + 5], 0
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
je 0x14012ee23
xor ecx, ecx
nop dword [rax]
lea eax, [rcx + 0x28]
xor byte [rcx + rsi], al
inc rcx
cmp rcx, 4
jb 0x14012ee10
mov byte [rsi + 5], 0
mov rax, rsi
add rsp, 0x20
pop rsi
ret
Function at 0x14012ee30
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rbx
mov rsi, rcx
mov qword [rsp + 0x38], rdi
call fcn.1400fb7f0
test al, al
je 0x14012ef07
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14012eee7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14012eee7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x13004d96
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14012eee2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14012eec0
cmp r8d, 0xed454fe
je 0x14012eeec
test r9d, r9d
jne 0x14012eea0
mov rax, qword [rax]
jmp 0x14012ee70
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
call fcn.1400fb7f0
test al, al
je 0x14012efc7
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14012efa7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14012efa7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xd5991d6a
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14012efa2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14012ef80
cmp r8d, 0xd9c428e2
je 0x14012efac
test r9d, r9d
jne 0x14012ef60
mov rax, qword [rax]
jmp 0x14012ef30
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
cmp byte [rsi + 8], 0
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
je 0x14012eff4
xor ecx, ecx
mov edx, 0x4828
nop
lea eax, [rdx + rcx]
xor word [rsi + rcx*2], ax
inc rcx
cmp rcx, 3
jb 0x14012efe0
mov byte [rsi + 8], 0
mov rax, rsi
add rsp, 0x20
pop rsi
ret
Function at 0x14012f000
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rbx
mov rsi, rcx
mov qword [rsp + 0x38], rdi
call fcn.1400fb7f0
test al, al
je 0x14012f0d7
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14012f0b7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14012f0b7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x13004d96
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14012f0b2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14012f090
cmp r8d, 0xed454fe
je 0x14012f0bc
test r9d, r9d
jne 0x14012f070
mov rax, qword [rax]
jmp 0x14012f040
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
call fcn.1400fb7f0
test al, al
je 0x14012f197
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14012f177
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14012f177
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xd5991d6a
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14012f172
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14012f150
cmp r8d, 0xd9c428e2
je 0x14012f17c
test r9d, r9d
jne 0x14012f130
mov rax, qword [rax]
jmp 0x14012f100
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
cmp byte [rsi + 0x3c], 0
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
je 0x14012f1c4
xor ecx, ecx
mov edx, 0x4828
nop
lea eax, [rdx + rcx]
xor word [rsi + rcx*2], ax
inc rcx
cmp rcx, 0x1d
jb 0x14012f1b0
mov byte [rsi + 0x3c], 0
mov rax, rsi
add rsp, 0x20
pop rsi
ret
Function at 0x14012f1d0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rbx
mov rsi, rcx
mov qword [rsp + 0x38], rdi
call fcn.1400fb7f0
test al, al
je 0x14012f2a7
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14012f287
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14012f287
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x13004d96
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14012f282
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14012f260
cmp r8d, 0xed454fe
je 0x14012f28c
test r9d, r9d
jne 0x14012f240
mov rax, qword [rax]
jmp 0x14012f210
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
call fcn.1400fb7f0
test al, al
je 0x14012f367
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14012f347
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14012f347
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xd5991d6a
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14012f342
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14012f320
cmp r8d, 0xd9c428e2
je 0x14012f34c
test r9d, r9d
jne 0x14012f300
mov rax, qword [rax]
jmp 0x14012f2d0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
cmp byte [rsi + 0x16], 0
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
je 0x14012f394
xor ecx, ecx
mov edx, 0x4828
nop
lea eax, [rdx + rcx]
xor word [rsi + rcx*2], ax
inc rcx
cmp rcx, 0xa
jb 0x14012f380
mov byte [rsi + 0x16], 0
mov rax, rsi
add rsp, 0x20
pop rsi
ret
Function at 0x14012f3a0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rbx
mov rsi, rcx
mov qword [rsp + 0x38], rdi
call fcn.1400fb7f0
test al, al
je 0x14012f477
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14012f457
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14012f457
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x13004d96
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14012f452
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14012f430
cmp r8d, 0xed454fe
je 0x14012f45c
test r9d, r9d
jne 0x14012f410
mov rax, qword [rax]
jmp 0x14012f3e0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
call fcn.1400fb7f0
test al, al
je 0x14012f537
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14012f517
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14012f517
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xd5991d6a
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14012f512
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14012f4f0
cmp r8d, 0xd9c428e2
je 0x14012f51c
test r9d, r9d
jne 0x14012f4d0
mov rax, qword [rax]
jmp 0x14012f4a0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
cmp byte [rsi + 0x18], 0
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
je 0x14012f564
xor ecx, ecx
mov edx, 0x4828
nop
lea eax, [rdx + rcx]
xor word [rsi + rcx*2], ax
inc rcx
cmp rcx, 0xb
jb 0x14012f550
mov byte [rsi + 0x18], 0
mov rax, rsi
add rsp, 0x20
pop rsi
ret
Function at 0x140130750
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret