joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1400f64f0
sub rsp, 0x58
mov rax, qword [0x1401970a0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor r9d, r9d
mov r8, rdx
mov eax, r9d
mov r10, rcx
cmp rax, 0x20
lea r11d, [r9 + 1]
jae 0x1400f658a
mov byte [rsp + rax + 0x20], r9b
add rax, r11
cmp rax, 0x20
jl 0x1400f6517
mov al, byte [rdx]
jmp 0x1400f654a
movzx edx, al
shr rdx, 3
movzx eax, al
and eax, 7
movzx ecx, byte [rsp + rdx + 0x20]
bts ecx, eax
add r8, r11
mov byte [rsp + rdx + 0x20], cl
mov al, byte [r8]
test al, al
jne 0x1400f652b
or byte [rsp + 0x20], r11b
jmp 0x1400f655b
add r9d, r11d
add r10, r11
movzx r8d, byte [r10]
mov edx, r11d
mov ecx, r8d
shr r8, 3
and ecx, 7
shl edx, cl
test byte [rsp + r8 + 0x20], dl
je 0x1400f6555
movsxd rax, r9d
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400107e0
add rsp, 0x58
ret
call fcn.140005bd0
int3

Function at 0x140005f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14012b854
sub rsp, 0x58
mov rax, qword [0x1401970a0]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor eax, eax
mov r9, rdx
cmp rax, 0x20
mov r8, rcx
jae 0x14012b8ec
mov byte [rsp + rax + 0x20], 0
inc rax
cmp rax, 0x20
jl 0x14012b873
mov al, byte [rdx]
jmp 0x14012b8a6
movzx edx, al
shr rdx, 3
movzx eax, al
and eax, 7
movzx ecx, byte [rsp + rdx + 0x20]
bts ecx, eax
inc r9
mov byte [rsp + rdx + 0x20], cl
mov al, byte [r9]
test al, al
jne 0x14012b887
jmp 0x14012b8cb
movzx eax, r9b
mov edx, 1
movzx ecx, r9b
and ecx, 7
shr rax, 3
shl edx, cl
test byte [rsp + rax + 0x20], dl
jne 0x14012b8e7
inc r8
mov r9b, byte [r8]
test r9b, r9b
jne 0x14012b8ac
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400107e0
add rsp, 0x58
ret
mov rax, r8
jmp 0x14012b8d5
call fcn.140005bd0
int3
Function at 0x140007746
Capabilities:
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xe8
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x58], 0
jmp 0x14000b7b1
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x30], rax
mov edx, 0x40
mov rcx, qword [rsp + 0x108]
call fcn.14000cf66

Function at 0x140007a60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x14000d273
mov r9d, 4
mov r8d, 0x3000
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax]
mov qword [rsp + 0x28], rax
jmp 0x14000904f
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
je 0x14000bb05
jmp 0x14000c5dd
cmp qword [rsp + 0x30], 0
je 0x14000d63e
jmp 0x14000793e
cmp qword [rsp + 0x28], 0
jne 0x14000be9f
jmp 0x14000cbba
mov qword [rsp + 0x40], rax
invalid

Function at 0x14000891b
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [rsp + 0x88]
mov rax, qword [rax + 8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x88]
jmp 0x14000aac1
and dword [rax], eax
invalid
invalid
invalid
test byte [rax + rcx*4], ah
Function at 0x140008ac1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], 0
jmp 0x14000d188
jmp 0x14000ce34
movsxd rax, dword [rsp + 0x20]
mov ecx, 0x64
mov word [rsp + rax*2 + 0x90], cx
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov ecx, 0x6c
mov word [rsp + rax*2 + 0x90], cx
mov eax, dword [rsp + 0x20]
and al, 0x20
jmp 0x14000daf5
inc rax
test dl, dl
jne 0x140007d62
jmp 0x14000d8da
sbb eax, eax
or eax, 1
enter 0xffffffffffffe901, 0xfffffffffffffffe
sub al, 0
invalid
movzx edx, byte [rax]
cmp dl, byte [rax + rcx]
jne 0x140007a7d
jmp 0x140007834
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x38], rax
jmp 0x140009876
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
movsx eax, byte [rcx + rax]
cmp eax, 0x2e
je 0x14000db2b
jmp 0x14000c89f
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x60]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x78], rax
and al, 0x78
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x68]
movzx eax, word [rcx + rax*2]
mov word [rsp + 0x28], ax
jmp 0x14000b9ac
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 4]
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rsp + 0x30]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x38], rax
jbe 0x140006f52
xchg byte [rbp - 0x14], cl
invalid
invalid
jmp 0x14000bda6
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x198
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov eax, dword [rsp + 0x50]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
jmp 0x14000a1b4
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x1a0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x24], 0
and al, 0
add byte [rax], al
add cl, ch
mov ah, 0x26
add byte [rax], al
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
add rsp, 0x198
ret
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
jb 0x14000bda6
jmp 0x1400082e7
mov rax, rcx
mov qword [rsp + 0x58], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x58]
lea rax, [rcx + rax + 0x88]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x1a0]
mov word [rax + riz*4], fs
add dword [rax], eax
add cl, ch
xor al, 0x22
add byte [rax], al
test eax, eax
jne 0x140007429
invalid
sbb dh, dl

Function at 0x1400097d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ah, 0
add byte [rax], al
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0x50]
mov edx, eax
call fcn.140007cc1
in al, 0xff
invalid
jmp 0x14000909a
Function at 0x14000b223
Capabilities:
Inspect section memory permissions

Disassembly:
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x40], eax
and al, 0x40
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x40000000
add byte [rax], al
test eax, eax
je 0x1400095f3
jmp 0x140008018
mov eax, 1
jmp 0x14000a76c
mov eax, 1
jmp 0x14000a76c
cmp qword [rsp + 0x38], 0
je 0x14000b1b8
jmp 0x14000ac7e
mov dword [rsp + 0x28], 1
jmp 0x14000da75
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x2000000
test eax, eax
je 0x14000928e
jmp 0x14000c794
mov rax, qword [rsp + 0x90]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x90]
mov ecx, dword [rcx + 0x40]
cmp dword [rax + 0x38], ecx
jne 0x140008d57
jmp 0x140009c32
mov rax, qword [rsp + 0x90]
mov eax, dword [rax + 0x40]
mov qword [rsp + 0x70], rax
xor edx, edx
mov rcx, qword [rsp + 0x98]
mov rax, qword [rcx + 0x10]
mov rcx, qword [rsp + 0x70]
div rcx
mov rax, rdx
test rax, rax
jne 0x14000ae41
jmp 0x140009c32
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x20000000
test eax, eax
jne 0x14000b8d1
jmp 0x14000ce8f
mov dword [rsp + 0x64], 0x80
mov dword [rsp + 0x68], 0x20
mov dword [rsp + 0x6c], 0x40
movsxd rax, dword [rsp + 0x40]
imul rax, rax, 0x10
lea rax, [rsp + rax + 0x50]
movsxd rcx, dword [rsp + 0x44]
lea rax, [rax + rcx*8]
add al, 0xc8
movsxd rcx, dword [rsp + 0x48]
jmp 0x14000b043
mov dword [rsp + 0x28], 0
jmp 0x14000da75
cmp qword [rsp + 0x38], 0
jne 0x14000cd0f
jmp 0x14000d1a4
lea r9, [rsp + 0x4c]
mov r8d, dword [rsp + 0x20]
mov rax, qword [rsp + 0x98]
mov dword [rsp + 0x2c], 1
jmp 0x14000d7b1
mov eax, 1
jmp 0x14000a76c
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x18]
and eax, 0x4000000
test eax, eax
jne 0x14000bc27
jmp 0x140007d07
lea r9, [rsp + 0x4c]
mov r8d, dword [rsp + 0x20]
mov rax, qword [rsp + 0x98]
mov rdx, qword [rax + 0x10]
mov rax, qword [rsp + 0x98]
mov rcx, qword [rax]
call qword [0x1400873a9]
mov dword [rsp + 0x30], eax
and al, 0x30
jmp method.std::_Mpunct_char_.virtual_24
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [rsp + 0x90]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x98]
cmp qword [rax + 0x10], 0
adc byte [rax], al
je 0x140007082
jmp 0x14000803c
mov dword [rsp + 0x24], 1
jmp 0x140006f8b
mov eax, dword [rsp + 0x20]
bts eax, 9
mov dword [rsp + 0x20], eax
cmp qword [rsp + 0x38], 0
jne 0x14000ac7e
invalid
Function at 0x14000b7d0
Capabilities:
Enumerate pe sections
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov ecx, 0xc1
call qword [0x14008260d]
xor eax, eax
jmp 0x140007e53
xor eax, eax
jmp 0x140007e53
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
add rax, 0x108
add byte [rax], al
mov rdx, rax
mov rcx, qword [rsp + 0x108]
call fcn.14000cf66
add byte [rax], al
jmp 0x14000c738
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x38]
and eax, 1
test eax, eax
jne 0x140006ee9
invalid
movsb byte [rdi], byte [rsi]
hlt
invalid
invalid
jmp 0x14000af05
mov ecx, 0xc1
call qword [0x140083887]
xor eax, eax
jmp 0x140007e53
mov ecx, 0xc1
call qword [0x140085100]
xor eax, eax
jmp 0x140007e53
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 4]
cmp eax, 0x8664
je 0x140007a32
jmp 0x140008142
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x38]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x38]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x48], 0
add byte [rax], al
add byte [rax], al
jmp 0x14000bfb4
test eax, eax
jne 0x14000dca9
jmp 0x140007228
jmp 0x14000b3e2
mov rax, qword [rsp + 0x38]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x48], eax
jb 0x140007a57
jmp 0x14000abd3
test eax, eax
jne 0x14000d0c1
jmp 0x14000d67f
mov rax, qword [rsp + 0x70]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x100]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0x4550
je 0x14000a0c0
jmp 0x14000db84
invalid

Function at 0x14000c959
Capabilities:
Access peb ldr_data
Get process filename

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x68
in al, dx
push 0x48b4865
and eax, 0x60
mov qword [rsp + 0x50], rax

Function at 0x14000c990
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x88], rax
Function at 0x14000e440
Capabilities:
Read file on windows

Disassembly:
jmp 0x140124ca4
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15d, r8d
mov r13, rdx
movsxd rsi, ecx
cmp esi, 0xfffffffe
jne 0x140124ce0
call fcn.140010d30
and dword [rax], 0
call fcn.14000a110
mov dword [rax], 9
jmp 0x140124da5
test ecx, ecx
js 0x140124d8d
cmp esi, dword [0x14019c43c]
jae 0x140124d8d
mov r14, rsi
mov r12, rsi
sar r12, 6
lea rax, [0x14019bf70]
and r14d, 0x3f
shl r14, 6
mov rax, qword [rax + r12*8]
movzx ecx, byte [rax + r14 + 0x38]
and ecx, 1
je 0x140124d8d
xor eax, eax
cmp r8d, 0x7fffffff
setbe al
test eax, eax
jne 0x140124d41
call fcn.140010d30
and dword [rax], 0
call fcn.14000a110
mov dword [rax], 0x16
jmp 0x140124da0
mov ecx, esi
call fcn.14000ccb0
or ebx, 0xffffffff
lea rax, [0x14019bf70]
mov rax, qword [rax + r12*8]
test byte [rax + r14 + 0x38], 1
jne 0x140124d73
call fcn.14000a110
mov dword [rax], 9
call fcn.140010d30
and dword [rax], 0
jmp 0x140124d82
mov r8d, r15d
mov rdx, r13
mov ecx, esi
call fcn.1400064b0
mov ebx, eax
mov ecx, esi
call fcn.140003030
mov eax, ebx
jmp 0x140124da8
call fcn.140010d30
and dword [rax], 0
call fcn.14000a110
mov dword [rax], 9
call fcn.14000f620
or eax, 0xffffffff
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rsi
ret

Function at 0x14000e990
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x1401103e4
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x140163690]
mov ecx, 3
lea r8, [0x140163688]
lea rdx, str.FlsAlloc
call fcn.14010fcec
mov rbx, rax
test rax, rax
je 0x140110428
mov rcx, rax
call qword [section..00cfg]
mov rcx, rdi
call rbx
jmp 0x14011042e
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000fef0
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400d3eec
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1400d3bc4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400d3bc4
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400d3bc4
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400d3bc4
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400d3bc4
cmp dword [rcx + 0x84], 0xe
jbe 0x1400d3bc4
cmp dword [rcx + 0xf8], esi
je 0x1400d3bc4
mov ecx, r14d
call fcn.1400d3e24
mov ecx, 2
call fcn.14000dfe0
nop
cmp byte [0x14019ae89], 0
jne 0x1400d3c8e
mov r15d, 1
mov eax, r15d
xchg dword [0x14019ae7c], eax
test ebx, ebx
jne 0x1400d3c37
mov rdi, qword [0x1401970a0]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14019ae80]
cmp rcx, rax
je 0x1400d3c2e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [section..00cfg]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14019b530]
jmp 0x1400d3c43
cmp ebx, r15d
jne 0x1400d3c49
lea rcx, [0x14019b550]
call fcn.14000f090
nop
test ebx, ebx
jne 0x1400d3c60
lea rdx, [0x140141eb8]
lea rcx, [0x140141b78]
call fcn.14000c1d0
lea rdx, [0x1401420d8]
lea rcx, [0x140141fc8]
call fcn.14000c1d0
movzx eax, byte [0x14019ae89]
test esi, esi
cmove eax, r15d
mov byte [0x14019ae89], al
jmp 0x1400d3c8e
mov ecx, 2
call fcn.140007ff0
test esi, esi
jne 0x1400d3ca5
mov ecx, r14d
call fcn.1400d3d1c
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
lea edx, [r8 + 2]
jmp 0x1400d3b54
Function at 0x140010e60
Capabilities:
Print debug messages

Disassembly:
jmp 0x14011f878
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r8d
mov r14, rdx
mov rbx, rcx
call fcn.14000ab60
mov bpl, al
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor edi, edi
test eax, eax
je 0x14011f8cb
test rbx, rbx
je 0x14011f8bc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bpl, bpl
je 0x14011f8cb
mov edi, 4
jmp 0x14011f974
call fcn.140002bc0
test al, al
jne 0x14011f8e8
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb edi, edi
neg edi
add edi, 3
jmp 0x14011f974
test bpl, bpl
je 0x14011f94b
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
lea r8, [0x14011f630]
mov dword [rsp + 0x20], edi
xor edx, edx
mov qword [rsp + 0x30], r14
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14011f974
xor r8d, r8d
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rcx, rbx
test eax, eax
je 0x14011f945
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14011f974
mov edi, dword [rsp + 0x44]
jmp 0x14011f93d
call fcn.140010800
test al, al
jne 0x14011f95c
bts esi, 0x15
xor ecx, ecx
jmp 0x14011f964
call fcn.140006470
mov rcx, rax
mov r9d, esi
mov r8, r14
mov rdx, rbx
call fcn.14000ced0
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret

Function at 0x140011360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x140079e90
push rdi
sub rsp, 0x20
mov r11, rdx
mov r10, rcx
mov rcx, qword [rcx + 0x10]
movabs rdi, 0x2aaaaaaaaaaaaaab
mov r8, rcx
mov rax, rdi
mov r9, qword [r10 + 8]
sub r8, r9
imul r8
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, r11
jae 0x140079f40
sub r9, qword [r10]
mov rax, rdi
imul r9
movabs r9, 0xaaaaaaaaaaaaaaa
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r9
sub rax, rdx
cmp rax, r11
jb 0x140079f46
sub rcx, qword [r10]
lea r8, [rdx + r11]
mov rax, rdi
imul rcx
xor ecx, ecx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, rdx
shr rax, 1
sub r9, rax
add rax, rdx
cmp r9, rdx
cmovae rcx, rax
cmp rcx, r8
cmovae r8, rcx
mov rcx, r10
mov rdx, r8
add rsp, 0x20
pop rdi
jmp 0x14000d290
add rsp, 0x20
pop rdi
ret
lea rcx, str.vector_T__too_long
call fcn.140012b80
int3
Function at 0x1400139d0
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x14003e530
movzx eax, byte [rdx + 1]
mov r8, rdx
movzx r9d, byte [rdx]
movabs r11, 0x100000001b3
movabs r10, 0xcbf29ce484222325
xor r9, r10
movzx ecx, byte [r8 + 8]
imul r9, r11
xor rcx, r10
xor r9, rax
movzx eax, byte [rdx + 2]
imul rcx, r11
imul r9, r11
xor r9, rax
movzx eax, byte [rdx + 3]
movzx edx, byte [rdx + 4]
xor rdx, r10
imul rdx, r11
imul r9, r11
xor r9, rax
movzx eax, byte [r8 + 5]
xor rdx, rax
movzx eax, byte [r8 + 6]
imul rdx, r11
imul r9, r11
xor rdx, rax
movzx eax, byte [r8 + 7]
imul rdx, r11
shr r9, 1
xor rdx, rax
movzx eax, byte [r8 + 9]
xor rcx, rax
movzx eax, byte [r8 + 0xa]
imul rcx, r11
imul rdx, r11
xor rcx, rax
movzx eax, byte [r8 + 0xb]
imul rcx, r11
xor rcx, rax
imul rcx, r11
lea rax, [rcx + rcx]
movabs rcx, 0x7fffffffffffffff
and rdx, rcx
xor rax, rdx
xor rax, r9
ret

Function at 0x140040b00
Capabilities:
Set console window title

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401970a0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
test eax, eax
je 0x140040b5a
movzx ecx, word [rsp + 0x30]
mov eax, 0x4e20
add cx, 0x1e
mov word [rsp + 0x22], ax
mov word [rsp + 0x20], cx
mov rcx, rbx
mov edx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
xor eax, eax
lea r8, [rsp + 0x28]
mov dword [rsp + 0x28], eax
mov rcx, rbx
movzx eax, word [rsp + 0x30]
add ax, 0x1d
mov word [rsp + 0x2c], ax
mov eax, 0x32
mov word [rsp + 0x2e], ax
lea edx, [rax - 0x31]
call qword [sym.imp.KERNEL32.dll_SetConsoleWindowInfo]
mov rcx, qword [str.vulkaninfo]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400107e0
add rsp, 0x50
pop rbx
ret
Function at 0x14011f878
Capabilities:
Create thread
Print debug messages

Disassembly:
jmp 0x14011f878
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov esi, r8d
mov r14, rdx
mov rbx, rcx
call fcn.14000ab60
mov bpl, al
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor edi, edi
test eax, eax
je 0x14011f8cb
test rbx, rbx
je 0x14011f8bc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test bpl, bpl
je 0x14011f8cb
mov edi, 4
jmp 0x14011f974
call fcn.140002bc0
test al, al
jne 0x14011f8e8
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
neg eax
sbb edi, edi
neg edi
add edi, 3
jmp 0x14011f974
test bpl, bpl
je 0x14011f94b
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
lea r8, [0x14011f630]
mov dword [rsp + 0x20], edi
xor edx, edx
mov qword [rsp + 0x30], r14
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x40], esi
mov dword [rsp + 0x44], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14011f974
xor r8d, r8d
or edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
mov rcx, rbx
test eax, eax
je 0x14011f945
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14011f974
mov edi, dword [rsp + 0x44]
jmp 0x14011f93d
call fcn.140010800
test al, al
jne 0x14011f95c
bts esi, 0x15
xor ecx, ecx
jmp 0x14011f964
call fcn.140006470
mov rcx, rax
mov r9d, esi
mov r8, r14
mov rdx, rbx
call fcn.14000ced0
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov eax, edi
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop r14
ret
Function at 0x1400b21e0
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1098
call fcn.1400dc2c0
add al, byte [rax]

Function at 0x1400b26e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov rsi, r8
mov r8, rcx
mov r9d, dword [rdx]
mov eax, dword [rdx + 4]
bswap r9d
bswap eax
mov r11d, dword [rdx + 8]
bswap r11d
mov edx, dword [rdx + 0xc]
bswap edx
xor r10d, r10d
nop word cs:[rax + rax]
mov ebx, eax
xor r9d, eax
mov ecx, ebx
rol r9d, cl
mov eax, r11d
mov ecx, edx
xor eax, edx
mov r11d, edx
rol eax, cl
mov edx, r9d
add edx, dword [r8 + r10*8]
add eax, dword [r8 + r10*8 + 4]
inc r10
mov r9d, ebx
cmp r10, 0x14
jne 0x1400b2710
add ebx, dword [r8 + 0xa0]
add r11d, dword [r8 + 0xa4]
mov ecx, ebx
shr ecx, 0x18
mov byte [rsi], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [rsi + 1], cl
mov byte [rsi + 2], bh
mov byte [rsi + 3], bl
mov ecx, eax
shr ecx, 0x18
mov byte [rsi + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rsi + 5], cl
mov byte [rsi + 6], ah
mov byte [rsi + 7], al
mov ecx, r11d
mov eax, r11d
shr eax, 0x18
mov byte [rsi + 8], al
mov eax, ecx
shr eax, 0x10
mov byte [rsi + 9], al
mov byte [rsi + 0xa], ch
mov byte [rsi + 0xb], cl
mov eax, edx
shr eax, 0x18
mov byte [rsi + 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [rsi + 0xd], al
mov byte [rsi + 0xe], dh
mov byte [rsi + 0xf], dl
pop rbx
pop rsi
ret
Function at 0x1400b4dc0
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x160
mov rdi, rcx
mov rax, qword [0x140303618]
xor rax, rsp
mov qword [rsp + 0x158], rax
call fcn.1400b4860
call fcn.1400b4850
xor ebx, ebx
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x1400b4e7b
mov rsi, rax
mov dword [rsp + 0x28], 0x130
lea rdx, [rsp + 0x28]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1400b4e60
call fcn.1400b4860
call fcn.1400b4850
lea rbx, [rsp + 0x54]
mov r15, qword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea r14, [rsp + 0x28]
nop dword [rax + rax]
mov rcx, rdi
mov rdx, rbx
call r15
test eax, eax
je 0x1400b4e64
mov rcx, rsi
mov rdx, r14
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1400b4e40
xor ebx, ebx
jmp 0x1400b4e68
xor ebx, ebx
jmp 0x1400b4e72
mov ebx, dword [rsp + 0x30]
call fcn.1400b4860
call fcn.1400b4850
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x158]
xor rcx, rsp
call fcn.1400dc320
mov eax, ebx
add rsp, 0x160
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x1400b4ea0
Capabilities:
Create process on windows

Disassembly:
push rsi
sub rsp, 0xf0
movaps xmmword [rsp + 0xe0], xmm6
mov rsi, rcx
mov rax, qword [0x140303618]
xor rax, rsp
mov qword [rsp + 0xd8], rax
call fcn.1400b4850
xorps xmm6, xmm6
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm6
movaps xmmword [rsp + 0xa0], xmm6
movaps xmmword [rsp + 0x90], xmm6
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
mov qword [rsp + 0xd0], 0
movaps xmmword [rsp + 0x50], xmm6
mov qword [rsp + 0x60], 0
mov word [rsp + 0xb0], 0
call fcn.1400b4860
call fcn.1400b4850
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x1400b4f80
call fcn.1400b4860
mov rcx, qword [rsp + 0x50]
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rsi
mov rcx, qword [rsp + 0x58]
call rsi
call fcn.1400b4850
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.1400dc320
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf0
pop rsi
ret