joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c19d0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
movabs rax, 0x65764f6c6164654d
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x18], 0x79616c72
mov byte [rbp - 0x14], 0
movaps xmm0, xmmword [0x1401718a0]
movaps xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x30], reloc.WS2_32.dll_WSAStartup
mov rax, qword [rbp + 0x28]
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x28], 0
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x20]
call qword [0x14059d0a8]
mov rsi, rax
lea rax, [rbp + 0x28]
mov rcx, qword [rbp - 0x10]
mov qword [rax], rcx
mov qword [0x14059d9b0], rsi
test rsi, rsi
je 0x1400c1b2b
movups xmm0, xmmword [0x1401707e8]
movaps xmmword [rbp - 0x40], xmm0
lea rdx, [rbp - 0x40]
mov rcx, rsi
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
lea rax, [rbp + 0x28]
mov rcx, qword [rax]
mov qword [rbp - 0x10], rcx
mov qword [rax], 0
mov ecx, 1
call qword [0x14059d0a0]
mov edi, eax
lea rax, [rbp + 0x28]
mov qword [rax], 0
xor ecx, ecx
call qword [0x14059d0a0]
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp - 0x10]
mov qword [rdx], rcx
mov rcx, qword [0x14059d9b0]
mov qword [rdx], 0
mov r10, qword [0x14059d0f0]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x30], 0x40
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call r10
lea rax, [rbp + 0x28]
mov rcx, qword [rbp - 0x10]
mov qword [rax], rcx
mov rcx, qword [0x14059d9b0]
mov qword [rax], 0
mov edx, 5
call qword [0x14059d0f8]
lea rax, [rbp + 0x28]
mov rcx, qword [rbp - 0x10]
mov qword [rax], rcx
mov rcx, qword [0x14059d9b0]
mov qword [rax], 0
call qword [0x14059d110]
lea rax, [rbp + 0x28]
mov rcx, qword [rbp - 0x10]
mov qword [rax], rcx
jmp 0x1400c1be3
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
nop dword [rax]
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x1400c1b40
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x1400c1b40
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
jmp 0x1400c1b75
test r8d, r8d
je 0x1400c1b40
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
movzx ebx, byte [rax + rdi]
test bl, bl
je 0x1400c1b70
add rdi, r10
mov r14d, 0x811c9dc5
movsx ebx, bl
xor ebx, r14d
imul r14d, ebx, 0x1000193
movzx ebx, byte [rdi]
inc rdi
test bl, bl
jne 0x1400c1b90
cmp r14d, 0x23a979e4
jne 0x1400c1b70
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r10d, dword [rcx + rdx*4]
add r10, rax
lea rdx, str.Medal_Not_Found
lea r8, str.Overlay
xor ecx, ecx
mov r9d, 2
call r10
test rsi, rsi
setne al
add rsp, 0x80
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x1400d8740
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
mov eax, 0x13c0
call fcn.140128020
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1338], 0xfffffffffffffffe
mov edi, r8d
mov esi, edx
mov rax, qword [rbp + 0x1368]
mov qword [rbp + 0x1330], rax
mov qword [rbp + 0x1368], 0
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rbp + 0x132c], 0xffffffff
mov dword [rbp - 0x54], eax
mov ecx, 3
nop dword [rax + rax]
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add rax, rcx
add rax, 0xfffffffffffffffe
mov dword [rbp + rcx*4 - 0x5c], eax
cmp rcx, 0x271
je 0x1400d87dc
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
dec eax
mov dword [rbp + rcx*4 - 0x58], eax
add rcx, 2
jmp 0x1400d87a0
mov dword [rbp - 0x58], 0x270
add esi, 0x80000000
add edi, 0x80000000
sub edi, esi
cmp edi, 0xffffffff
je 0x1400d8848
lea rcx, [rbp - 0x58]
call fcn.1400d9930
lea r8d, [rdi + 1]
mov ecx, eax
mov r14d, r8d
imul rcx, r14
cmp edi, ecx
jb 0x1400d8842
not edi
mov eax, edi
xor edx, edx
div r8d
cmp edx, ecx
jbe 0x1400d8842
mov edi, edx
lea rbx, [rbp - 0x58]
nop word cs:[rax + rax]
mov rcx, rbx
call fcn.1400d9930
mov ecx, eax
imul rcx, r14
cmp edi, ecx
ja 0x1400d8830
shr rcx, 0x20
jmp 0x1400d8853
lea rcx, [rbp - 0x58]
call fcn.1400d9930
mov ecx, eax
lea eax, [rcx + rsi]
add eax, 0x80000000
lea rcx, [rbp + 0x1368]
mov rdx, qword [rbp + 0x1330]
mov qword [rcx], rdx
add rsp, 0x13c0
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
Function at 0x1400d9690
Capabilities:
Create thread

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov qword [rbp - 8], 0xfffffffffffffffe
mov edi, r8d
mov rsi, rdx
cmp ecx, 0x7c
jae 0x1400d96fd
mov eax, ecx
lea rcx, str.Keybind
mov rbx, qword [rcx + rax*8]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
test rbx, rbx
je 0x1400d970d
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r14, rax
cmp rax, 0xf
jbe 0x1400d975f
lea rcx, [rbp - 0x30]
mov rdx, r14
mov r9, rbx
call fcn.1400098f0
jmp 0x1400d972d
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x20], 0xa
movabs rax, 0x4b207463656c6553
mov qword [rbp - 0x30], rax
mov word [rbp - 0x28], 0x7965
mov byte [rbp - 0x26], 0
cmp edi, 1
jne 0x1400d97aa
mov rax, qword [rbp - 0x18]
cmp rax, 0xd
jae 0x1400d9753
lea r9, str.Press_the_Key
lea rcx, [rbp - 0x30]
mov edx, reloc.WS2_32.dll_listen
call fcn.1400098f0
jmp 0x1400d97aa
cmp rax, 0x10
jb 0x1400d977f
mov rax, qword [rbp - 0x30]
jmp 0x1400d9783
mov qword [rbp - 0x20], r14
lea rcx, [rbp - 0x30]
mov rdx, rbx
mov r8, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + r14 - 0x30], 0
cmp edi, 1
je 0x1400d9732
jmp 0x1400d97aa
lea rax, [rbp - 0x30]
mov qword [rbp - 0x20], reloc.WS2_32.dll_listen
movabs rcx, 0x79654b2065687420
mov qword [rax + 5], rcx
movabs rcx, 0x6874207373657250
mov qword [rax], rcx
mov byte [rax + 0xd], 0
movsd xmm0, qword [0x140171fc0]
movsd qword [rbp - 0x38], xmm0
cmp qword [rbp - 0x18], 0x10
jb 0x1400d97c4
mov rcx, qword [rbp - 0x30]
jmp 0x1400d97c8
lea rcx, [rbp - 0x30]
lea rdx, [rbp - 0x38]
call fcn.140056880
test edi, edi
setne cl
xor al, 1
or al, cl
jne 0x1400d97fd
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor ecx, ecx
xor edx, edx
mov r8, rsi
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rax, qword [rbp - 0x18]
cmp rax, 0x10
jb 0x1400d9838
mov rcx, qword [rbp - 0x30]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400d9833
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400d9844
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140127e30
nop
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400e19c0
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14059e730]
call fcn.140106840
test al, al
jne 0x1400e1a16
mov ecx, dword [0x14059e734]
call fcn.140106840
test al, al
jne 0x1400e1a16
mov ecx, dword [0x14059e738]
call fcn.140106840
test al, al
jne 0x1400e1a16
mov ecx, dword [0x14059e73c]
call fcn.140106840
test al, al
jne 0x1400e1a16
xor edx, edx
lea rcx, [0x1400ecb80]
call qword [sym.imp.USER32.dll_EnumWindows]
xor al, al
add rsp, 0x28
ret
mov al, 1
add rsp, 0x28
ret
Function at 0x1400f1b10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rbx, rdx
mov qword [rsp + 0x48], rdx
xor edi, edi
mov ecx, dword [0x14059f868]
mov rax, qword gs:[0x58]
mov edx, 4
mov rsi, qword [rax + rcx*8]
add rsi, rdx
mov eax, dword [rsi]
cmp dword [0x14059ead0], eax
jg 0x1400f1c9d
lea r14, [0x14059eacc]
mov ebp, dword [reloc.WS2_32.dll_accept]
mov eax, dword [rsi]
cmp dword [0x14059eb00], eax
jg 0x1400f1cd3
cmp byte [0x14059eacf], 0
jne 0x1400f1bb0
cmp ebp, 2
jge 0x1400f1bb0
mov r8, r14
mov eax, 0x94f2095
imul edi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, dil
sub al, cl
add al, 0x34
xor byte [r8], al
inc edi
lea r8, [r8 + 1]
cmp edi, 4
jl 0x1400f1b81
nop dword [rax]
mov dword [0x14059eacc], 0
mov rdi, r14
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rdx, [0x14059ead8]
mov rcx, rbx
call fcn.1400e0750
movzx ecx, byte [0x14059eaf8]
mov byte [rbx + 0x20], cl
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
mov r8, 0xffffffffffffffff
inc r8
cmp byte [r14 + r8], 0
je 0x1400f1c3a
jmp 0x1400f1c10
lea rcx, [0x140163b10]
call fcn.1401280a0
nop
lea rcx, [0x14059eb00]
call fcn.140127f20
jmp 0x1400f1b70
mov rdx, r14
lea rcx, [rsp + 0x28]
call fcn.1400f2730
nop
lea rdx, [rsp + 0x28]
lea rcx, [0x14059ead8]
call fcn.1400e16d0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x1400f1c1c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f1dc4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f1dc4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rcx, [0x14059ead0]
call fcn.140127e6c
cmp dword [0x14059ead0], 0xffffffff
jne 0x1400f1b55
mov eax, dword [str.PWQ7]
mov dword [0x14059eacc], eax
lea rcx, [0x14059ead0]
call fcn.140127f20
jmp 0x1400f1b55
lea rcx, [0x14059eb00]
call fcn.140127e6c
cmp dword [0x14059eb00], 0xffffffff
jne 0x1400f1b70
cmp byte [0x14059eacf], 0
je 0x1400f1bf8
cmp ebp, 2
jl 0x1400f1d89
movdqa xmm3, xmmword [0x14016ef50]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1401735c0]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1401735c0]
shufps xmm2, xmm0, 0xdd
psrad xmm2, 1
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [str.7777]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401735a0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140173610]
movd xmm0, dword [0x14059eacc]
xorps xmm2, xmm0
movd dword [0x14059eacc], xmm2
jmp 0x1400f1bf8
mov r9, r14
mov r8d, edi
nop
mov eax, 0x94f2095
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x37
movzx eax, r8b
sub al, cl
add al, 0x34
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 4
jl 0x1400f1d90
jmp 0x1400f1bf8
call fcn.140127e30
jmp 0x1400f1c1c
Function at 0x1400f5280
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x30
mov rbp, rcx
mov rsi, rdx
mov ecx, dword [0x14059e730]
call fcn.140106840
test al, al
jne 0x1400f52e0
mov ecx, dword [0x14059e734]
call fcn.140106840
test al, al
jne 0x1400f52e0
mov ecx, dword [0x14059e738]
call fcn.140106840
test al, al
jne 0x1400f52e0
mov ecx, dword [0x14059e73c]
call fcn.140106840
test al, al
jne 0x1400f52e0
xor edx, edx
lea rcx, [0x1400ecb80]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x1400f53a1
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400f5377
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400f5377
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xaa14b916
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400f5372
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1400f5350
cmp r8d, 0x97a3f87e
je 0x1400f537c
test r9d, r9d
jne 0x1400f5330
mov rax, qword [rax]
jmp 0x1400f5300
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rcx, rbp
call fcn.1400f53d0
lea r8, [rbp + 0xc]
mov rdx, rbp
lea r9, [rsp + 0x48]
mov rcx, rsi
call fcn.140106f40
mov rbp, qword [rsp + 0x58]
mov rax, rsi
add rsp, 0x30
pop rsi
ret
Function at 0x1400f53d0
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x14059e730]
call fcn.140106840
test al, al
jne 0x1400f5429
mov ecx, dword [0x14059e734]
call fcn.140106840
test al, al
jne 0x1400f5429
mov ecx, dword [0x14059e738]
call fcn.140106840
test al, al
jne 0x1400f5429
mov ecx, dword [0x14059e73c]
call fcn.140106840
test al, al
jne 0x1400f5429
xor edx, edx
lea rcx, [0x1400ecb80]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x1400f54f1
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400f54c7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400f54c7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xd952e8d4
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400f54c2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1400f54a0
cmp r8d, 0xc4699ce4
je 0x1400f54cc
test r9d, r9d
jne 0x1400f5480
mov rax, qword [rax]
jmp 0x1400f5450
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
cmp byte [rsi + 0xd], 0
je 0x1400f5513
xor ecx, ecx
nop dword [rax]
lea eax, [rcx + 6]
xor byte [rcx + rsi], al
inc rcx
cmp rcx, 0xc
jb 0x1400f5500
mov byte [rsi + 0xd], 0
add rsp, 0x20
pop rsi
ret
Function at 0x1400f9d50
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rax, qword [0x140596f00]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
mov r9, qword [r11 + 0x30]
xor r14d, r14d
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400f9e08
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400f9e08
mov edi, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x2f4bb8dc
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400f9e03
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1400f9de0
cmp edx, 0x3b94b270
je 0x1400f9ecb
test r8d, r8d
jne 0x1400f9dc0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x1400f9e1d
cmp qword [rax + 0x30], r14
jne 0x1400f9d90
mov rbp, r14
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400f9eb4
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400f9eb4
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x304bba6f
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400f9eaf
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400f9e90
cmp edx, 0xe459b17b
je 0x1400f9ee7
test r8d, r8d
jne 0x1400f9e70
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x1400f9eff
cmp qword [rax + 0x30], r14
jne 0x1400f9e40
jmp 0x1400f9eff
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov ebp, dword [rcx + rdx*4]
add rbp, r9
jmp 0x1400f9e20
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov r14d, dword [rcx + rdx*4]
add r14, r9
call r14
lea rdx, [rsp + 0x20]
mov rcx, rax
call rbp
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140128080
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1400fb810
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ecx, ecx
int 0x29
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400fb8a7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400fb8a7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x4984eff5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400fb8a2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400fb880
cmp r8d, 0x14c8d375
je 0x1400fb8ac
test r9d, r9d
jne 0x1400fb860
mov rax, qword [rax]
jmp 0x1400fb830
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400fb957
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400fb957
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x5c380fbf
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400fb952
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x1400fb930
cmp r8d, 0x4ea4cb0c
je 0x1400fb95c
test r9d, r9d
jne 0x1400fb910
mov rax, qword [rax]
jmp 0x1400fb8e0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400fba07
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400fba07
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x769b8a41
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400fba02
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1400fb9e0
cmp r8d, 0x2728f67d
je 0x1400fba0c
test r9d, r9d
jne 0x1400fb9c0
mov rax, qword [rax]
jmp 0x1400fb990
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov rbx, qword [rsp + 0x30]
mov dword [0], 0xdead
add rsp, 0x20
pop rdi
ret
Function at 0x1400fba40
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x58
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r8, qword [rax + 0x30]
mov qword [rsp + 0x30], r8
movsxd rcx, dword [r8 + 0x3c]
mov rdx, qword [rcx + r8 + 0x88]
mov qword [rsp + 0x60], rdx
mov r11d, edx
add r11, r8
mov qword [rsp + 0x38], r11
shr rdx, 0x20
mov dword [rsp + 0x40], edx
cmp r11, r8
je 0x1400fbb19
mov r10d, dword [r11 + 0x18]
mov dword [rsp + 0x20], r10d
nop
mov ecx, r10d
dec r10d
mov dword [rsp + 0x20], r10d
test ecx, ecx
je 0x1400fbb19
mov ecx, dword [r11 + 0x20]
add rcx, r8
mov ecx, dword [rcx + r10*4]
add rcx, r8
mov qword [rsp + 0x28], rcx
mov r9d, 0x765fc1ee
nop dword [rax + rax]
movsx edx, byte [rcx]
inc rcx
mov qword [rsp + 0x28], rcx
test dl, dl
jne 0x1400fbb0d
cmp r9d, 0x49b3a09c
jne 0x1400fbb0b
mov edx, dword [r11 + 0x1c]
add rdx, r8
mov ecx, dword [r11 + 0x24]
add rcx, r8
movzx ecx, word [rcx + r10*2]
mov eax, dword [rdx + rcx*4]
add rax, r8
call rax
nop
mov al, 1
add rsp, 0x58
ret
jmp 0x1400fbaa0
xor edx, r9d
imul r9d, edx, 0x1000193
jmp 0x1400fbad0
mov rax, qword [rax]
jmp 0x1400fba60
Function at 0x1401068c0
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov qword [rsp + 0x30], rbx
mov ecx, dword [0x14059e730]
mov qword [rsp + 0x38], rdi
call fcn.140106840
test al, al
jne 0x140106923
mov ecx, dword [0x14059e734]
call fcn.140106840
test al, al
jne 0x140106923
mov ecx, dword [0x14059e738]
call fcn.140106840
test al, al
jne 0x140106923
mov ecx, dword [0x14059e73c]
call fcn.140106840
test al, al
jne 0x140106923
xor edx, edx
lea rcx, [0x1400ecb80]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x1401069d7
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1401069b7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1401069b7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x29ac20d4
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1401069b2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140106990
cmp r8d, 0xaf1e54e4
je 0x1401069bc
test r9d, r9d
jne 0x140106970
mov rax, qword [rax]
jmp 0x140106940
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov ecx, dword [0x14059e730]
call fcn.140106840
test al, al
jne 0x140106a27
mov ecx, dword [0x14059e734]
call fcn.140106840
test al, al
jne 0x140106a27
mov ecx, dword [0x14059e738]
call fcn.140106840
test al, al
jne 0x140106a27
mov ecx, dword [0x14059e73c]
call fcn.140106840
test al, al
jne 0x140106a27
xor edx, edx
lea rcx, [0x1400ecb80]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x140106ad7
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140106ab7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140106ab7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xd952e8d4
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140106ab2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140106a90
cmp r8d, 0xc4699ce4
je 0x140106abc
test r9d, r9d
jne 0x140106a70
mov rax, qword [rax]
jmp 0x140106a40
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
cmp byte [rsi + 0x47], 0
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
je 0x140106b03
xor ecx, ecx
nop dword [rax]
lea eax, [rcx + 6]
xor byte [rcx + rsi], al
inc rcx
cmp rcx, 0x46
jb 0x140106af0
mov byte [rsi + 0x47], 0
mov rax, rsi
add rsp, 0x20
pop rsi
ret