joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402b0d50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1402b0db1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1402b0d70
mov ecx, dword [r9]
jmp 0x1402b0e98
cmp ecx, 0x4e0
jb 0x1402b0e98
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1402b0dd0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1402b0e20
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x1402b4f10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
lea r11, [0x1403c3a80]
mov r9, rdx
not ecx
cmp r8, 4
jb 0x1402b4f89
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
add r9, 4
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1402b4f30
test r8, r8
je 0x1402b4fad
nop
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x1402b4f90
not ecx
mov eax, ecx
ret
Function at 0x1402b8790
Capabilities:
Write file on windows

Disassembly:
mov rax, r9
mov r10, r8
mov r9, rcx
mov r8, rax
mov rcx, r10
mov edx, 1
jmp fcn.140368b8c
Function at 0x1402f90d0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x1402f918d
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x1402f918d
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x57059c47
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x1402f9188
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x1402f9150
cmp r10d, 0x2939f5b1
je 0x1402f9195
test r11d, r11d
jne 0x1402f9130
mov rax, qword [rax]
jmp 0x1402f9100
mov ecx, dword [rsi + 0x24]
mov rdi, qword [rsp + 0x18]
add rcx, rbx
mov r14, qword [rsp + 0x20]
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
mov rsi, qword [rsp + 0x10]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 8]
ret

Function at 0x1402f91d0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x1402f928d
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x1402f928d
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x5f0a8fd7
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x1402f9288
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x1402f9250
cmp r10d, 0x644f3d6b
je 0x1402f9295
test r11d, r11d
jne 0x1402f9230
mov rax, qword [rax]
jmp 0x1402f9200
mov ecx, dword [rsi + 0x24]
mov rdi, qword [rsp + 0x18]
add rcx, rbx
mov r14, qword [rsp + 0x20]
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
mov rsi, qword [rsp + 0x10]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 8]
ret
Function at 0x1402f92d0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x1402f938d
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x1402f938d
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x7251bc0d
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x1402f9388
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x1402f9350
cmp r10d, 0x41f1d91
je 0x1402f9395
test r11d, r11d
jne 0x1402f9330
mov rax, qword [rax]
jmp 0x1402f9300
mov ecx, dword [rsi + 0x24]
mov rdi, qword [rsp + 0x18]
add rcx, rbx
mov r14, qword [rsp + 0x20]
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
mov rsi, qword [rsp + 0x10]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 8]
ret

Function at 0x1402f93d0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x1402f948d
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x1402f948d
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x6f6b4d28
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x1402f9488
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x1402f9450
cmp r10d, 0xc373489a
je 0x1402f9495
test r11d, r11d
jne 0x1402f9430
mov rax, qword [rax]
jmp 0x1402f9400
mov ecx, dword [rsi + 0x24]
mov rdi, qword [rsp + 0x18]
add rcx, rbx
mov r14, qword [rsp + 0x20]
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
mov rsi, qword [rsp + 0x10]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 8]
ret
Function at 0x1402f9810
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x1402f98cd
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x1402f98cd
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x7e9c8534
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x1402f98c8
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x1402f9890
cmp r10d, 0x3ac3efa6
je 0x1402f98d5
test r11d, r11d
jne 0x1402f9870
mov rax, qword [rax]
jmp 0x1402f9840
mov ecx, dword [rsi + 0x24]
mov rdi, qword [rsp + 0x18]
add rcx, rbx
mov r14, qword [rsp + 0x20]
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
mov rsi, qword [rsp + 0x10]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 8]
ret

Function at 0x1402f9910
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x1402f99cd
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x1402f99cd
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x3524b818
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x1402f99c8
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x1402f9990
cmp r10d, 0xad509327
je 0x1402f99d5
test r11d, r11d
jne 0x1402f9970
mov rax, qword [rax]
jmp 0x1402f9940
mov ecx, dword [rsi + 0x24]
mov rdi, qword [rsp + 0x18]
add rcx, rbx
mov r14, qword [rsp + 0x20]
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
mov rsi, qword [rsp + 0x10]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 8]
ret
Function at 0x1402f9a10
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x1402f9acd
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x1402f9acd
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x3624b9ab
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x1402f9ac8
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x1402f9a90
cmp r10d, 0x9845eda9
je 0x1402f9ad5
test r11d, r11d
jne 0x1402f9a70
mov rax, qword [rax]
jmp 0x1402f9a40
mov ecx, dword [rsi + 0x24]
mov rdi, qword [rsp + 0x18]
add rcx, rbx
mov r14, qword [rsp + 0x20]
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
mov rsi, qword [rsp + 0x10]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 8]
ret

Function at 0x1402f9b10
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x1402f9bcd
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x1402f9bcd
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0xb7c263e
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x1402f9bc8
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x1402f9b90
cmp r10d, 0x92430085
je 0x1402f9bd5
test r11d, r11d
jne 0x1402f9b70
mov rax, qword [rax]
jmp 0x1402f9b40
mov ecx, dword [rsi + 0x24]
mov rdi, qword [rsp + 0x18]
add rcx, rbx
mov r14, qword [rsp + 0x20]
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
mov rsi, qword [rsp + 0x10]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 8]
ret
Function at 0x1402f9c10
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x1402f9ccd
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x1402f9ccd
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0xc7c27d1
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x1402f9cc8
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x1402f9c90
cmp r10d, 0xa7d6900a
je 0x1402f9cd5
test r11d, r11d
jne 0x1402f9c70
mov rax, qword [rax]
jmp 0x1402f9c40
mov ecx, dword [rsi + 0x24]
mov rdi, qword [rsp + 0x18]
add rcx, rbx
mov r14, qword [rsp + 0x20]
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
mov rsi, qword [rsp + 0x10]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 8]
ret

Function at 0x1402f9d10
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x1402f9dcd
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x1402f9dcd
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0xc8bc4735
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x1402f9dc8
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x1402f9d90
cmp r10d, 0xe2bcf87
je 0x1402f9dd5
test r11d, r11d
jne 0x1402f9d70
mov rax, qword [rax]
jmp 0x1402f9d40
mov ecx, dword [rsi + 0x24]
mov rdi, qword [rsp + 0x18]
add rcx, rbx
mov r14, qword [rsp + 0x20]
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
mov rsi, qword [rsp + 0x10]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 8]
ret
Function at 0x1402f9e10
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x1402f9ecd
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x1402f9ecd
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x77f559f2
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x1402f9ec8
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x1402f9e90
cmp r10d, 0x45b92ff4
je 0x1402f9ed5
test r11d, r11d
jne 0x1402f9e70
mov rax, qword [rax]
jmp 0x1402f9e40
mov ecx, dword [rsi + 0x24]
mov rdi, qword [rsp + 0x18]
add rcx, rbx
mov r14, qword [rsp + 0x20]
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
mov rsi, qword [rsp + 0x10]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 8]
ret

Function at 0x1402f9f10
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x1402f9fcd
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x1402f9fcd
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x23ea13db
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x1402f9fc8
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x1402f9f90
cmp r10d, 0x94b7c8ab
je 0x1402f9fd5
test r11d, r11d
jne 0x1402f9f70
mov rax, qword [rax]
jmp 0x1402f9f40
mov ecx, dword [rsi + 0x24]
mov rdi, qword [rsp + 0x18]
add rcx, rbx
mov r14, qword [rsp + 0x20]
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
mov rsi, qword [rsp + 0x10]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 8]
ret
Function at 0x1402faff0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x18], 7
mov rbx, rcx
mov r8, qword [rcx + 0x10]
mov rdx, rcx
jbe 0x1402fb00a
mov rdx, qword [rcx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
add r8, r8
je 0x1402fb043
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
inc rcx
xor r9, rax
imul r9, r10
cmp rcx, r8
jb 0x1402fb030
mov r8, rbx
lea rdx, [rsp + 0x20]
lea rcx, [0x1403e7e90]
call fcn.140302950
mov rdx, qword [0x1403e7e98]
mov rcx, qword [rax + 8]
test rcx, rcx
cmovne rdx, rcx
cmp rdx, qword [0x1403e7e98]
lea rax, [rdx + 0x30]
jne 0x1402fb079
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1402fb080
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rdx + 0x18], 7
mov rbx, rdx
mov r8, qword [rdx + 0x10]
jbe 0x1402fb097
mov rdx, qword [rdx]
xor eax, eax
movabs r9, 0xcbf29ce484222325
add r8, r8
je 0x1402fb0c5
movabs r10, 0x100000001b3
movzx ecx, byte [rax + rdx]
inc rax
xor r9, rcx
imul r9, r10
cmp rax, r8
jb 0x1402fb0b2
mov r8, rbx
lea rdx, [rsp + 0x20]
lea rcx, [0x1403e7e90]
call fcn.140302950
mov rdx, qword [0x1403e7e98]
mov rcx, qword [rax + 8]
test rcx, rcx
cmovne rdx, rcx
cmp rdx, qword [0x1403e7e98]
lea rax, [rdx + 0x30]
cmovne rbx, rax
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140305f30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x138
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140305f97
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
lea r8, [r8 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x140305f52
mov ecx, dword [r10]
jmp 0x1403060a6
cmp ecx, 0x270
jb 0x1403060a6
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
nop word [rax + rax]
mov r9, qword [rbx + 8]
lea rbx, [rbx + 8]
mov rdx, r9
xor rdx, rax
and rdx, 0xffffffff80000000
xor rdx, r9
movzx eax, dl
and al, 1
neg al
mov rax, r9
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx + 0x4d8]
xor rcx, rdx
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x140305fd0
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov r9, qword [rbx]
mov r8, qword [rbx + 8]
lea rbx, [rbx + 8]
xor r9, r8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rbx - 0xea8]
xor rcx, r9
mov r9, r8
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x140306021
mov rdx, qword [r10 + 8]
xor rdx, qword [r10 + 0x1380]
mov rdi, qword [rsp]
and rdx, 0xffffffff80000000
xor rdx, qword [r10 + 8]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret
Function at 0x140307570
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1403e7140]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x140421b60]
mov rbx, r8
lea rsi, [rdi + 0x164]
lea rcx, [rdi + 0x16c]
mov dword [rsi], 1
call fcn.1403934b0
mov dword [rdi + 0x168], ebx
add rbx, 8
je 0x140307647
mov rax, qword [rdi]
test rax, rax
je 0x140307605
mov rcx, qword [rax + 8]
cmp rcx, 0xffffffffffffffff
je 0x140307605
test rsi, rsi
je 0x140307605
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov r8d, ebx
mov qword [rsp + 0x20], 0
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x140307605
cmp dword [rsp + 0x30], ebx
je 0x140307647
mov r8, qword [rdi + 0x18]
test r8, r8
je 0x140307624
mov eax, dword [rdi + 8]
dec eax
test eax, 0xfffffffd
jne 0x140307624
mov ecx, dword [rdi + 0x60]
lea rdx, [rdi + 0x64]
call r8
mov rbx, qword [rdi]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
xor al, al
mov byte [rbx], 0
mov dword [rdi + 8], 0
jmp 0x140307649
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140360560
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret