joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14086f618
Capabilities:
Encode data using xor

Disassembly:
test word [rsp + 0x3a], r8w
cmovl rcx, qword [rsp + 0x38]
xor r8b, byte [rsp + 0x3c]
add qword [rsp + 0x10], 0xffffffffbf5b7b7e
cmp word [rsp + 0x38], r8w
mov rcx, qword [rsp + 0x30]
jns 0x140a2a022

Function at 0x14089775a
Capabilities:
Encode data using xor

Disassembly:
jo 0x140a2a985
setno byte [rsp + 0x10]
jbe 0x140ff29ac
add qword [rsp + 8], 0xffffffffffe4dfdd
call fcn.140a23959

Function at 0x140906b73
Capabilities:
Authenticate hmac

Disassembly:
mov r9d, 0x4b937d48
and r9d, r9d
bswap r10d
setge r9b
neg r9b
sete r9b
add qword [rsp + 0x18], 0x73908
neg r9w
or r10d, r10d
movzx r10, r9w
and r9w, 0x66a5
add r9w, 0x5298
call fcn.1409f40c9

Function at 0x140906baf
Capabilities:
Authenticate hmac
Resolve function by parsing pe exports

Disassembly:
xor sil, 0xa6
jae 0x140a1031a
setne r10b
mov r15, qword [rsp + 0x50]
not r8d
movsx r8d, si
xor r10d, 0x672a2934
jbe 0x140a47a9a
test r11b, 0x5c
movzx r10w, r8b
setge r8b
jb 0x14099bfbf
test r12d, r8d
jb 0x140a10340
and r12d, 0x67d22db8
lea r12, [rsi + r8*8 + 0x6e9c2c66]
mov r11, rsi
neg rsi
jo 0x1409ec5de
xor r11d, 0x53eb3668
add sil, 0x86
test sil, sil
movzx r12d, si
lea r11, [rsi*2 + 0x57ba27be]
mov r11, qword [rsp + 0x28]
call fcn.1409caa48
pushfq
and r9, 0x23204c37
push r15
movabs r15, 0x44bb10017f5e3c30
and r15b, 0xee
call fcn.14090952b

Function at 0x140924675
Capabilities:
Encode data using xor

Disassembly:
not dword [rsp + 0x38]
lea rbx, [rbx*4 + 0x65b9348c]
sub ebx, 0x4b455568
test bx, bx
call fcn.14086a5c7
setb bl
cmp word [rsp + 0x38], 0x3324
mov byte [rsp + 0x38], bl
setg bl
je 0x140a2b8ed
jo 0x14090eb8e
setb r10b
lea rbx, [rbx + r10*2 + 0x5e83149f]
add r10, 0x393a025c
mov r10, qword [rsp + 0x50]
and dword [rsp + 0x40], ebx
and word [rsp + 0x38], 0x7f7b
jns 0x140870730
movsb byte [rdi], byte [rsi]
or dword [rdi - 0x1a2a1499], 0x71
cwde
movabs byte [0x6789df92307d2ea6], al
in eax, 5
pand mm0, qword [rdx + 0x7e84d10d]
cwde
movabs dword [0xc4d970c467beba9d], eax
invalid

Function at 0x1409254ef
Capabilities:
Encode data using xor

Disassembly:
call fcn.140a05737
add byte [rax], al
push 0x70557261
jo 0x140925563
jb 0x140925542
jne 0x140925568
push di
add byte [rax - 0x73], cl
lea rsp, [rsp + 0x28]
neg ch
and al, 0
Function at 0x140948dd8
Capabilities:
Encode data using xor

Disassembly:
lea rcx, [r12 + r12 + 0x46dc187f]
bswap r12
mov ecx, 0xe5b7821
neg ecx
neg rcx
test r12b, 0x3a
lea r12, [r12 + 0x4a9d037b]
mov cl, 0xc2
push rcx
call fcn.14095186a
or r14b, r14b
test r14d, 0x3f2f710c
call fcn.14088e882
js 0x140feb76d
jns 0x140a32640
add bpl, 0x29
add r14w, 0x7c67
sub r14, rbp
xor bpl, r14b
bswap r14
not r14w
mov rbp, qword [rsp + 0x38]
add r14b, 0x94
sub r14d, 0xee4130e
lea r14, [r14 + r14*8 + 0x370f02be]
add r14b, r14b
jge 0x14091e9ef
push r9
sub word [rsp + 0x18], 0x7ff7
not cl
push r11
neg dword [rsp + 0x20]
jge 0x14091ade2
add qword [rsp + 0x18], 0x7d4a4
mov r11, qword [rsp + 0x20]
lea rcx, [r11*2 + 0x4a876a5e]
push rsi
push r11
mov r11, qword [rsp + 0x10]
lea rsp, [rsp + 0x28]
ret 8
xor r14w, r14w
neg r14
setb r14b
or r14, r14
xor r14d, r14d
add r14d, r14d
and r14w, r14w
movsx r14, r14w
neg r14w
sub r14d, r14d
test r14, 0x472c213f
jg 0x1409d4be2
neg r14
mov r14, qword [rsp + 0x38]
ja 0x140a4849a
js 0x140a12a6f
jae 0x140894d54
adc ch, byte [rbx - 0x3ace46e3]
movsd dword [rdi], dword [rsi]
pop r12
cmpsd dword [rsi], dword [rdi]
push rbp
fsubr st(2), st(0)
sbb r14b, dl
or al, 0xb0
movabs dword [0xb90260b91587e61a], eax
invalid
add bp, 0x3867
movzx rcx, r14b
add qword [rsp + 0x18], 0xffffffffbf688594
add bpl, bpl
ja 0x1409e1d4b
mov esi, 0x9cf3b6df
div dword [rbx - 0x270a384e]
cli
invalid

Function at 0x14098948e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
neg qword [rsp + 8]
neg dword [rsp + 0x38]
sub byte [rsp + 8], 0x3d
cmp dword [rsp + 0x28], 0x4d9872f8
call fcn.140fe704a
movsb byte [rdi], byte [rsi]
push 0xdc2b929
mov ebp, 0xa40955f1
jmp 0x140877a81
push rdi
outsb dx, byte cs:[rsi]
xchg edi, eax
imul dword [rax + rax*4 - 0x1d2bdf6d]
invalid
test bl, 0xf7
jno 0x140a06739
jl 0x140a3e799
cmovge r9, qword [rsp + 0x20]
sub word [rsp + 0x28], 0x2282
test dword [rsp + 0x21], r9d
mov byte [rsp + 8], 1
setno byte [rsp + 0x38]
cmp qword [rsp + 0x38], 0x1d213ee
mov r14, qword [rsp + 0x58]
not byte [rsp + 0x20]
jae 0x1408779ee
leave
add dl, byte [r8 - 0x1445fa27]
mov ebp, 0x868967e9
mov ebp, 0x374458f8
invalid
mov r11, rbx
mov rbp, r14
movsx r14, dx
mov r10, r11
add r14w, r14w
lea rbp, [rbp + 0x5b915e70]
mov r14, qword [rsp + 0x18]
neg r11d
movsx ebp, bp
test ebx, 0x1d0369de
jle 0x14087b6f7
sub edx, edx
jbe 0x14087313d
and rbx, 0x44c6514d
sub ebx, 0x22007e64
and rbx, 0x4e6e7b78
or bl, 0xf4
setl bl
mov rbx, qword [rsp + 0x40]
add qword [rsp + 0x18], 0xffffffffbf70b368
add qword [rsp], 0xffffffffbf79813e
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x50]
call fcn.14108b52b
sub rbx, 0x2aeb28f0
cmp bl, dl
push r11
push r10
push rbp
jl 0x1409c006a
xor byte [rsp + 0x38], 0x48
cmovo r9w, word [rsp + 0x3c]
test qword [rsp + 0x28], 0x400a6af1
jns 0x140993e80
Function at 0x1409b4730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
call fcn.1409a071c
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x28]
call fcn.141089c3c
je 0x140989444
xor r11w, si
neg r12
lea r12, [r10 + r12 + 0x72224481]
call fcn.140906baf
sbb cl, bh
out 0xef, eax
jno 0x1409b47be
mov dh, 0x72
mov esp, 0x3fb1d179
invalid
invalid
iretd
mov spl, 0xb
mov bl, 0x95
xchg ebp, eax
jb 0x1409b47a9
xchg ebx, eax
cmc
hlt
lodsd eax, dword [rsi]
insd dword [rdi], dx
push 0xffffffff9096c5ae
jne 0x1409b47e4
invalid
and ah, ch
ja 0x1409b479d
loopne 0x1409b47b2
jg 0x1409b47ac
sbb al, 0xb3
mov al, 0x6c
jge 0x1409b47a4
cmp al, 0x83
mov ebx, 0x64cdb643
pop rdx
mov r14b, 0x25
mov ecx, 0x365891a9
mov ecx, 0xc72b64b7
ficomp word [rbx]
sub edx, dword [rbx + rax + 0xb684469]
push rbp
sbb al, 0x15
xchg esi, eax
fsubr dword gs:[rbp + 0x43bb833d]
lahf
outsb dx, byte [rsi]
cmc
popfq
sbb eax, 0x59e2f0b0
movabs al, byte [0x8cfa67daa79e2fb5]
pop rdi
xchg eax, eax
jae 0x1409b479e
invalid

Function at 0x1409caa48
Capabilities:
Encode data using xor

Disassembly:
movsx r10w, r12w
jno 0x140fdc1cb
not r12b
lea r10, [r8*2 + 0x72f34c60]
call fcn.140fe592a
call fcn.1409f51d9
movsb byte [rdi], byte [rsi]
push 0x1ad9b528
mov ah, 0xf0
ja fcn.140fdc205
mov esp, 0xb6bd44e3
xchg ebx, eax
invalid

Function at 0x1409d14c3
Capabilities:
Encode data using xor

Disassembly:
and bp, r13w
or dword [rsp + 0x28], 0x452a591e
lea rbp, [r13 + r11 + 0x4390e85]
bswap rbp
mov rbp, qword [rsp + 0x30]
or r11d, r11d
and r11b, r11b
sete byte [rsp + 0x28]
test word [rsp + 0x2c], r11w
lea rsp, [rsp + 0x18]
ret
sub r14d, r14d
setle r14b
movsx r14w, r14w
sub r14d, 0x5b6857a8
add r14b, 1
setno r14b
push rcx
movabs rcx, 0x1f6260ca11bc421a
neg r14w
sub r14, 0x420b4d73
setge cl
push r11
push rbp
jo 0x14087d339
push rcx
movabs r11, 0x67e143ac50a53899
not r11
neg word [rsp]
test dword [rsp], 0x61cc3122
mov rbp, qword [rsp]
movabs rbp, 0x5d86448c491c7c73
movabs r14, 0x72b01aca3bb02150
jl 0x1409c001a
test ecx, r11d
push r13
call fcn.140fddfe9
lea r11, [r13 + rbp*8 + 0x5ad907ff]
lea r13, [r13 + 0x28af22d3]
jge 0x1409bffe9
or r11, 0x57b7ce6
neg r13
add r13b, 0xb7
jne 0x140886aa1
xor r14, qword [r10]
insb byte [rdi], dx
insb byte [rdi], dx
add bh, dh
and al, 0x20
movabs eax, dword [0x2024449f0f0cc04e]

Function at 0x1409d4cc1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jae 0x140a3e7c7
xor qword [rsp + 0x18], 0x52096004
cmovo esi, dword [rsp + 0x1c]
setae r10b
add qword [rsp + 0x28], 0xffffffffff8b4c16
bswap rsi
add r10d, r10d
mov r12, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x10]
lea rsp, [rsp + 0x28]
ret

Function at 0x1409d6d88
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rdx
movabs rdx, 0x75c151d258260087
setno r9b
add r8w, r8w
sub r9w, 0x523b
setbe r9b
not qword [rsp + 0x10]
neg qword [rsp + 0x30]
xor r8d, r9d
movabs rdi, 0x5c2d13877c9e7cd9
je 0x1409d6d89
cmp rdi, 0x531830cd
call fcn.1408f5251
iretd
Function at 0x1409e5e96
Capabilities:
Encode data using xor

Disassembly:
and rbp, rbx
not rdx
or bl, 0xe7
sub rdi, 0x273941f1
not dil
setns dil
neg dil
and bp, dx
and bpl, 0x1f
and edx, 0x2c636c21
test bp, 0x612b
call fcn.140a1a145
sub dx, 0x7a6d
mov rdi, rbx
bswap edi
bswap rbx
movabs rdx, 0x1d0460c6127e7b92
mov rbp, rbx
and bx, 0x5f9c
xor dx, 0x2e1a
neg ebx
neg dil
or dil, 0x83
lea rdi, [rdx + rbp*2 + 0x587d522e]
mov dil, 0x26
js 0x14086e387
fild word [rax - 0x80]
iretd
push r9
pushfq
movabs r9, 0x6b75047850e9001a
lea r9, [r9 + r9 + 0x3fdf051b]
push r8
push 0x7ae13a08
and byte [rsp], r9b
push rdi
push 0x784872cc
test qword [rsp + 0x10], r9
call fcn.14088fa23
sub rax, 0x4bbd37a0
adc dl, byte [rdi - 0x38]
test al, 0xef
jnp 0x1409e5ebe
mov dword [0x1784d3041], esp
xchg esi, eax
invalid

Function at 0x1409ec5c3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea rsp, [rsp + 0x20]
call fcn.14108b52b

Function at 0x140a13e75
Capabilities:
Encode data using xor

Disassembly:
movabs r9, 0x503d70283b1507f0
add r9w, r9w
setns r9b
add r9d, r9d
setno r9b
test r9, r9
test ecx, ecx
call fcn.1408f9f49
xor esp, dword fs:[rax + rdi*2 + 0x39]
pop rdi
xor al, 0x33
insb byte [rdi], dx
insb byte [rdi], dx
add byte [0x1a020aa76], bh
ja 0x140877a55
wait
and eax, 0x35cb9a75
pop rbx
clc
stosb byte [rdi], al
push rdi
invalid
jl 0x140877a3b
call fcn.14097312b

Function at 0x140a1b350
Capabilities:
Encode data using xor

Disassembly:
not byte [rsp + 0x50]
jo 0x1409ee230
call section..
push rbx
xchg byte [rdx + rcx*2 - 0x66549b26], bh
push rsi
invalid

Function at 0x140a3e8c3
Capabilities:
Encode data using xor

Disassembly:
setns r9b
add r9d, 0x23e84241
jns 0x14096e8c4
not r9w
setns bpl
jb 0x14096e901
add qword [rsp + 0x28], 0xf2c65
or bp, r8w
and r10, 0x679d10f7
add r9w, si
mov esi, 0x6a577c26
xor r8d, ebp
jbe 0x1409cd82c
add r8w, r9w
cmp r10b, 0x76
lea rbp, [rsi + rbp*4 + 0x68551b6f]
setl bpl
mov ebp, 0x7de6683d
test dword [rsp + 0x10], ebp
cmovno si, r9w
add esi, 0x292504ea
mov r8, qword [rsp + 0x58]
not r9w
setb sil
or r10d, dword [rsp + 0x10]
xor bpl, 0x2c
not r10w
jb 0x140a3e90c
mov r10w, si
cmp si, 0xce9
mov rsi, qword [rsp + 0x20]
lea rsp, [rsp + 0x28]
ret

Function at 0x140fef9ff
Capabilities:
Encode data using xor

Disassembly:
mov word [rsp + 0x30], r14w
not byte [rsp + 0x38]
add dword [rsp + 0x30], r14d
and qword [rsp + 0x30], 0x40b02ac4
setne byte [rsp + 0x38]
push r13
add dword [rsp + 0x38], 0x4d8d1aa4
mov r13, r14
add qword [rsp + 0x18], 0x1a6f5b
add qword [rsp + 0x28], 0xfffffffffff26701
push r9
or qword [rsp + 0x40], 0x303a5c63
mov r13, qword [rsp + 8]
mov r9, r14
setne byte [rsp + 0x48]
neg r14w
cmp r14, r9
movabs r9, 0x6266348258406183
movsxd r14, r9d
setno r14b
or byte [rsp + 0x48], 0x19
cmp r9w, word [rsp + 0x45]
setbe r9b
mov r9, qword [rsp + 0x40]
lea r14, [r14*8 + 0x43135fff]
and byte [rsp + 0x48], 0x78
lea r9, [r14 + r9*4 + 0x1f8a68a9]
xor word [rsp + 0x40], 0x320f
sub dword [rsp + 0x48], 0x68f54c98
seta byte [rsp + 0x48]
test qword [rsp + 0x40], r14
bswap r9
jb 0x140fefa70
mov qword [rsp + 0x48], r9
add r14, r14
sub qword [rsp + 0x48], 0x1522229d
cmp r14, qword [rsp + 0x48]
mov r9, qword [rsp]
lea rsp, [rsp + 0x20]
ret 8
Function at 0x140001000
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
mov eax, 0x13c0
call fcn.1400023f0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov ecx, 1
mov dword [rsp + 0x24], eax
nop dword [rax + rax]
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
mov dword [rsp + rcx*4 + 0x24], eax
inc rcx
cmp rcx, 0x270
jb 0x140001040
mov dword [rsp + 0x20], 0x270
nop word [rax + rax]
lea rcx, [rsp + 0x20]
call fcn.140001540
mov ecx, eax
mov eax, 0xcccccccd
mul ecx
shr edx, 3
cmp edx, 0x19999999
jae 0x140001070
mov eax, 0xcccccccd
mul ecx
shr edx, 3
lea eax, [rdx + rdx*4]
mov edx, 0x80000000
add eax, eax
sub ecx, eax
add ecx, 0x80000001
cmp ecx, edx
lea eax, [rcx + rdx]
lea ebx, [rcx - 0x80000000]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Random_Number:
cmovae ebx, eax
call fcn.140001330
mov rcx, rax
mov edx, ebx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___int____ptr64]
mov rcx, rax
lea rdx, [0x140001500]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test bl, 1
jne 0x140001120
lea rdx, str.I_am_in_the_sleep_
call fcn.140001330
mov rcx, rax
lea rdx, [0x140001500]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
jmp 0x140001156
lea rdx, str.I_am_in_the_other_sleep_
call fcn.140001330
mov rcx, rax
lea rdx, [0x140001500]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 2
call section..text
mov ecx, 0x2af8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 3
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.1400016e0
add rsp, 0x13c0
pop rbx
ret
Function at 0x140001170
Capabilities:
Check for peb beingdebugged flag
Get memory capacity
Get system information on windows

Disassembly:
push rbx
sub rsp, 0xe0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xd0], rax
lea rcx, [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0xc0], 2
jb 0x14000129a
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x68]
shr rax, 0x14
cmp eax, 0x800
jb 0x14000129a
xor ebx, ebx
lea rcx, str..PhysicalDrive0
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], ebx
xor edx, edx
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x38], rbx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
xor r9d, r9d
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x28], 0x18
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov rcx, rax
mov edx, 0x70000
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [rsp + 0x58]
mov eax, dword [rsp + 0x5c]
imul rax, rcx
mov ecx, dword [rsp + 0x54]
imul rax, rcx
imul rax, qword [rsp + 0x48]
cqo
and edx, 0x3fffffff
add rax, rdx
sar rax, 0x1e
cmp eax, 0x64
jb 0x14000129a
mov rbx, qword gs:[0x60]
call section..text
cmp byte [rbx + 2], 0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
je 0x14000128e
lea rdx, str.Being_debugged__n
call fcn.140001330
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14000129a
lea rdx, str.Hello_World__n
call fcn.140001330
xor eax, eax
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400016e0
add rsp, 0xe0
pop rbx
ret
Function at 0x140001540
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x1400015a1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140001560
mov ecx, dword [r10]
jmp 0x14000168a
cmp ecx, 0x4e0
jb 0x14000168a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400015c0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140001610
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140001fbc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002006
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002006
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002006
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002006
cmp dword [rcx + 0x84], 0xe
jbe 0x140002006
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002008
xor al, al
add rsp, 0x28
ret
Function at 0x180006a70
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov qword [rcx + 0x10], rdx
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx], rax
mov rax, rbx
mov qword [rbx + 8], 0
add rsp, 0x20
pop rbx
ret

Function at 0x180006f50
Capabilities:
Hash data using fnv

Disassembly:
movzx eax, byte [rdx + 9]
mov r8, rdx
movzx r9d, byte [rdx + 8]
movabs r10, 0x100000001b3
movabs rcx, 0xcbf29ce484222325
xor r9, rcx
imul r9, r10
xor r9, rax
movzx eax, byte [rdx + 0xa]
imul r9, r10
xor r9, rax
movzx eax, byte [rdx + 0xb]
imul r9, r10
xor r9, rax
movzx eax, byte [rdx + 0xc]
imul r9, r10
xor r9, rax
movzx eax, byte [rdx + 0xd]
imul r9, r10
xor r9, rax
movzx eax, byte [rdx + 0xe]
imul r9, r10
xor r9, rax
movzx eax, byte [rdx + 0xf]
movzx edx, byte [rdx]
xor rdx, rcx
movzx ecx, byte [r8 + 6]
imul rdx, r10
imul r9, r10
xor r9, rax
movzx eax, byte [r8 + 1]
xor rdx, rax
movzx eax, byte [r8 + 2]
imul rdx, r10
imul r9, r10
xor rdx, rax
movzx eax, byte [r8 + 3]
imul rdx, r10
xor rdx, rax
movzx eax, byte [r8 + 4]
imul rdx, r10
xor rdx, rax
movzx eax, byte [r8 + 5]
imul rdx, r10
xor rdx, rax
movabs rax, 0x18d000002a297
imul rdx, r10
xor rdx, rcx
movzx ecx, byte [r8 + 7]
imul rdx, r10
xor rdx, rcx
imul rax, rdx
xor rax, r9
ret
Function at 0x18000ef10
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r11, rcx
mov qword [r8], rdx
movabs rbx, 0x100000001b3
movzx r10d, dl
movabs rdi, 0xcbf29ce484222325
mov rax, rdx
xor r10, rdi
shr rax, 8
imul r10, rbx
movzx r8d, al
mov rax, rdx
xor r10, r8
shr rax, 0x10
mov r8, qword [r11 + 0x148]
imul r10, rbx
movzx ecx, al
mov rax, rdx
xor r10, rcx
shr rax, 0x18
imul r10, rbx
movzx ecx, al
mov rax, rdx
xor r10, rcx
shr rax, 0x20
imul r10, rbx
movzx ecx, al
mov rax, rdx
xor r10, rcx
shr rax, 0x28
imul r10, rbx
movzx ecx, al
mov rax, rdx
xor r10, rcx
shr rax, 0x30
imul r10, rbx
movzx ecx, al
mov rax, rdx
xor r10, rcx
shr rax, 0x38
imul r10, rbx
xor r10, rax
mov rax, qword [r11 + 0x120]
imul r10, rbx
and r8, r10
shl r8, 4
add r8, qword [r11 + 0x130]
mov rcx, qword [r8 + 8]
cmp rcx, rax
je 0x18000f0f8
mov r8, qword [r8]
cmp rdx, qword [rcx + 0x10]
je 0x18000eff9
cmp rcx, r8
je 0x18000f0f8
mov rcx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
jne 0x18000efe6
test rcx, rcx
cmove rcx, rax
cmp rcx, rax
je 0x18000f0f8
mov rax, qword [r11 + 0x1a0]
cmp qword [rdx + 8], rax
jne 0x18000f0f8
mov r8, qword [rdx]
movzx edx, r8b
mov rax, r8
xor rdx, rdi
shr rax, 8
imul rdx, rbx
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x10
imul rdx, rbx
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x18
imul rdx, rbx
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x20
imul rdx, rbx
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x28
imul rdx, rbx
movzx ecx, al
mov rax, r8
xor rdx, rcx
shr rax, 0x30
imul rdx, rbx
movzx ecx, al
mov rax, r8
xor rdx, rcx
mov qword [r9], r8
imul rdx, rbx
shr rax, 0x38
xor rdx, rax
mov rax, qword [r11 + 0xe0]
imul rdx, rbx
and rdx, qword [r11 + 0x108]
shl rdx, 4
add rdx, qword [r11 + 0xf0]
mov rcx, qword [rdx + 8]
cmp rcx, rax
je 0x18000f0f8
mov rdx, qword [rdx]
cmp r8, qword [rcx + 0x10]
je 0x18000f0df
nop word [rax + rax]
cmp rcx, rdx
je 0x18000f0f8
mov rcx, qword [rcx + 8]
cmp r8, qword [rcx + 0x10]
jne 0x18000f0d0
test rcx, rcx
cmove rcx, rax
cmp rcx, rax
je 0x18000f0f8
mov al, 1
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 8]
xor al, al
mov rdi, qword [rsp + 0x10]
ret
Function at 0x18000ff70
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x18004b148]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx + 0x198]
test rbx, rbx
je 0x18001000b
lea rcx, [rsp + 0x48]
call fcn.180010d70
nop
mov r8, rax
lea rdx, str.UnloadLibraryMetadata_:
lea rcx, [rsp + 0x28]
call fcn.180006e20
mov rdx, rax
mov rcx, rbx
call fcn.180003940
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x18001000b
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180010006
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180010153
call fcn.180012704
mov rax, qword [rdi + 0xe0]
mov rbx, qword [rax]
cmp rbx, rax
je 0x180010129
movabs rbp, 0x100000001b3
movabs r14, 0xcbf29ce484222325
mov rcx, qword [rbx + 0x10]
cmp qword [rcx + 0x10], rsi
jne 0x18001011d
mov edx, 0x58
call fcn.180012704
mov rcx, rbx
movzx r8d, byte [rbx + 0x10]
xor r8, r14
imul r8, rbp
movzx eax, byte [rbx + 0x11]
xor r8, rax
imul r8, rbp
movzx eax, byte [rbx + 0x12]
xor r8, rax
imul r8, rbp
movzx eax, byte [rbx + 0x13]
xor r8, rax
imul r8, rbp
movzx eax, byte [rbx + 0x14]
xor r8, rax
imul r8, rbp
movzx eax, byte [rbx + 0x15]
xor r8, rax
imul r8, rbp
movzx eax, byte [rbx + 0x16]
xor r8, rax
imul r8, rbp
movzx eax, byte [rbx + 0x17]
xor r8, rax
imul r8, rbp
mov rdx, qword [rdi + 0x108]
and rdx, r8
shl rdx, 4
mov r8, qword [rdi + 0xf0]
add r8, rdx
mov rax, qword [r8]
cmp qword [r8 + 8], rbx
jne 0x1800100e6
cmp rax, rbx
jne 0x1800100dc
mov rax, qword [rdi + 0xe0]
mov qword [r8], rax
mov qword [r8 + 8], rax
jmp 0x1800100f1
mov rax, qword [rbx + 8]
mov qword [r8 + 8], rax
jmp 0x1800100f1
cmp rax, rbx
jne 0x1800100f1
mov rax, qword [rbx]
mov qword [r8], rax
mov rbx, qword [rbx]
dec qword [rdi + 0xe8]
mov rax, qword [rcx + 8]
mov qword [rax], rbx
mov rax, qword [rcx + 8]
mov qword [rbx + 8], rax
mov edx, 0x18
call fcn.180012704
mov rax, qword [rdi + 0xe0]
jmp 0x180010120
mov rbx, qword [rbx]
cmp rbx, rax
jne 0x180010032
mov rcx, rdi
call fcn.18000fdd0
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.180012820
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.180018dac
int3
jmp 0x18000ff70