joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019220
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140076040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1400e1b90]
mov edi, edx
cmp byte [rbx + 0x20d5], 0
jne 0x140019280
cmp byte [rbx + 0x20d6], 0
jne 0x140019280
mov r9d, dword [rbx + 0x3178]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140007820
test dil, 1
je 0x1400193a6
jmp 0x14001930f
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x14006cd88]
xor eax, eax
mulss xmm1, dword [0x14006cd78]
addss xmm0, dword [rbx + 0x120]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0x124]
mov qword [rbx + 0x1ddc], rax
mov dword [rbx + 0x1dc4], 1
movss dword [rbx + 0x1dd4], xmm0
mov byte [rbx + 0x1dfc], 1
movss dword [rbx + 0x1dd8], xmm1
movss xmm0, dword [rbx + 0x1748]
mulss xmm0, dword [0x14006ccac]
or dword [rbx + 0x1dc0], 0x41
movss dword [rbx + 0x1e20], xmm0
mov r9d, dword [rbx + 0x3178]
call fcn.140007820
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140019360
lea r11, [0x14005ee80]
nop
cmp r9b, 0x23
jne 0x140019343
cmp byte [r8], r9b
jne 0x140019343
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140019330
not ecx
call fcn.1400109a0
test rax, rax
je 0x1400193a6
cmp byte [rax + 0xcf], 0
je 0x1400193a6
mov byte [rax + 0xd6], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3178]
mov edx, 0x10
mov r9d, dword [rbx + 0x3178]
call fcn.140007820
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.140013310
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14005c580
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14001ed10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3260], 0
lea rbx, [rcx + 0x3268]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001edb7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001ed6a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14002e4c0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140008270
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x3260]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x3270]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1400e1b82]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001edbf
mov rcx, rbx
call fcn.140008270
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001f310
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov r10d, 0xffffffff
mov ecx, r10d
movzx r9d, byte [rbx]
lea r8, [rbx + 1]
test r9b, r9b
je 0x14001f366
lea r11, [0x14005ee80]
cmp r9b, 0x23
jne 0x14001f349
cmp byte [r8], r9b
jne 0x14001f349
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001f336
not ecx
call fcn.14001f220
test rax, rax
jne 0x14001f37f
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14001f130
add rsp, 0x20
pop rbx
ret
Function at 0x140023c10
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x140023e4e
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x140076040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x14005ee80]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x140023e16
mov rcx, rbp
call fcn.140022ed0
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x140023ce1
movsxd rdx, dword [rbp + 0x31c0]
mov r8, qword [rbp + 0x31c8]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x140023cd1
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x140023cc9
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x140023ccc
mov rdx, rcx
test rdx, rdx
jne 0x140023ca0
cmp r8, r10
je 0x140023ce1
cmp dword [r8], r9d
jne 0x140023ce1
mov rcx, qword [r8 + 8]
jmp 0x140023ce3
xor ecx, ecx
mov qword [rbx + 0x10], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x40], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x44], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xb8]
and eax, 0xfffffe49
movss dword [rbx + 0x50], xmm1
or eax, 0x49
mov dword [rbx + 0xb8], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
test rcx, rcx
je 0x140023d77
cmp qword [rcx + 0x18], 0
jne 0x140023d6c
mov qword [rcx + 0x18], rbx
jmp 0x140023d77
cmp qword [rcx + 0x20], 0
jne 0x140023d77
mov qword [rcx + 0x20], rbx
mov eax, dword [rdi - 0xe]
mov r9, rbx
mov dword [rbx + 0xb0], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x58], eax
mov eax, dword [rdi - 6]
and eax, 0x61fc20
or dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140023dac
nop
mov r9, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x140023da0
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, 0x14
lea rcx, [rsp + 0x20]
call fcn.140007820
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x140023e08
cmp r9b, 0x23
jne 0x140023deb
cmp byte [r8], r9b
jne 0x140023deb
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x140023dd8
not ecx
call fcn.1400109a0
mov qword [rbx + 0x80], rax
add rdi, 0x24
sub rsi, 1
jne 0x140023c60
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14005c580
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x14005b530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm6
mov rax, qword [0x140076040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
movaps xmm6, xmm2
mov ebx, edx
test al, al
je 0x14005b577
nop
cmp al, 0x25
jne 0x14005b56c
cmp byte [rcx + 1], al
jne 0x14005b577
inc rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14005b560
cmp byte [rcx], 0x25
jne 0x14005b65a
cmp byte [rcx + 1], 0x25
je 0x14005b65a
lea rdx, [rsp + 0x20]
call fcn.14004c770
xorps xmm3, xmm3
lea r8, [rsp + 0x20]
cvtss2sd xmm3, xmm6
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.140007820
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x14005b5c8
inc rcx
cmp byte [rcx], 0x20
je 0x14005b5c0
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14005b648
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x14005b5e3
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x14005b5f9
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x14005b636
movss xmm2, dword [0x14006cd7c]
cmp al, 0x39
ja 0x14005b636
movzx eax, al
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x14005b610
cmp r9b, 0x2d
jne 0x14005b655
xorps xmm1, xmmword [0x14006d100]
movaps xmm0, xmm1
jmp 0x14005b65d
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14005b65d
movaps xmm0, xmm6
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14005c580
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa0
pop rbx
ret
Function at 0x14005b680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm6
mov rax, qword [0x140076040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
movaps xmm6, xmm2
mov ebx, edx
test al, al
je 0x14005b6c7
nop
cmp al, 0x25
jne 0x14005b6bc
cmp byte [rcx + 1], al
jne 0x14005b6c7
inc rcx
movzx eax, byte [rcx + 1]
inc rcx
test al, al
jne 0x14005b6b0
cmp byte [rcx], 0x25
jne 0x14005b7a4
cmp byte [rcx + 1], 0x25
je 0x14005b7a4
lea rdx, [rsp + 0x20]
call fcn.14004c770
movaps xmm3, xmm6
lea r8, [rsp + 0x20]
movq r9, xmm6
lea rcx, [rsp + 0x40]
mov edx, 0x40
call fcn.140007820
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x14005b718
nop dword [rax]
inc rcx
cmp byte [rcx], 0x20
je 0x14005b710
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14005b796
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x14005b733
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x14005b749
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x14005b784
movsd xmm2, qword [0x14006cd38]
cmp al, 0x39
ja 0x14005b784
movzx eax, al
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x14005b760
cmp r9b, 0x2d
jne 0x14005b79f
xorps xmm1, xmmword [0x14006d0f0]
movaps xmm0, xmm1
jmp 0x14005b7a7
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14005b7a7
movaps xmm0, xmm6
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14005c580
movaps xmm6, xmmword [rsp + 0x90]
add rsp, 0xa0
pop rbx
ret

Function at 0x14005d204
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005d24e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005d24e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005d24e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005d24e
cmp dword [rcx + 0x84], 0xe
jbe 0x14005d24e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005d250
xor al, al
add rsp, 0x28
ret
Function at 0x2fc4dbeb0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4dcf90
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4dc8b2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4ff108]
test eax, eax
je 0x2fc4dc94a
lea rax, [0x2fc4ff0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4ff110]
mov qword [rbp - 8], rax
jmp 0x2fc4dc92e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4dc922
cmp qword [rbp - 0x10], 0
je 0x2fc4dc922
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4dc8e8
lea rax, [0x2fc4ff0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4dc94b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4dca50
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4dca78
mov eax, 0
jmp 0x2fc4dcac6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4dcaa1
mov eax, 0
jmp 0x2fc4dcac6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4dcac1
mov eax, 0
jmp 0x2fc4dcac6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4dcacc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4dcb4a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4dcb41
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4dcb41
mov rax, qword [rbp - 8]
jmp 0x2fc4dcb5f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4dcb14
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x14000fc20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14000fcb0
cmp r11, r10
ja 0x14000fd26
cmp r10, rdx
ja 0x14000fd38
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14000fcb2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14000fc90
jmp 0x14000fd14
ja 0x14000fcba
mov r11, r10
cmp rax, r8
jne 0x14000fc54
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14000fcf0
mov rdi, r8
sub ecx, edx
jns 0x14000fd0b
jmp 0x14000fd16
cmp r8, rsi
je 0x14000fd47
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14000fd16
xor al, 1
cmp rdi, rsi
jne 0x14000fcd0
jmp 0x14000fd16
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400a8bd0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400a88c0
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.1400a8d40
int3

Function at 0x140012d8f
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rcx]
xor r9d, r9d
movabs r10, 0x100000001b3
cmp r8, r9
je 0x140012db5
movzx r11d, byte [rdx + r9]
xor rax, r11
imul rax, r10
inc r9
jmp 0x140012d9f
mov qword [rcx], rax
ret

Function at 0x140012f48
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
xor ecx, ecx
test rbx, rbx
setne cl
call fcn.140012d64
test rbx, rbx
je 0x140012f81
mov rdx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140012d8f
mov cl, byte [rdi + 8]
mov rdx, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp fcn.140012d87
Function at 0x1400336a1
Capabilities:
Link many functions at runtime

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov r14, qword [0x140117160]
test r14, r14
jne 0x1400337d8
lea rcx, str.api_ms_win_core_synch_l1_2_0.dll
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x14003370b
mov rbx, rax
lea rdx, str.WaitOnAddress
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14003370b
mov rdi, rax
lea rdx, str.WakeByAddressSingle
mov rcx, rbx
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x14003370b
mov r15, rax
xor ebx, ebx
jmp 0x140033790
lea rcx, [0x1400d7828]
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
test rax, rax
je 0x1400337ec
mov rdi, rax
lea rdx, str.NtCreateKeyedEvent
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1400337ec
mov r14, rax
lea rdx, str.NtReleaseKeyedEvent
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1400337ec
mov rbx, rax
lea rdx, str.NtWaitForKeyedEvent
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
je 0x1400337ec
mov rdi, rax
lea rcx, [rsp + 0x28]
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call r14
test eax, eax
jne 0x1400337ec
mov r15, qword [rsp + 0x28]
mov ecx, 0x18
call fcn.140030f62
mov r14, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], r15
xor eax, eax
lock cmpxchg qword [0x140117160], r14
je 0x1400337d8
mov rdi, rax
cmp qword [r14], 0
je 0x1400337c8
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov edx, 8
mov rcx, r14
call fcn.140007720
mov r14, rdi
and qword [rsi + 8], 0
mov qword [rsi], r14
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.parking_lot_requires_either_NT_Keyed_Events__WinXP__or_WaitOnAddress_WakeByAddress__Win8_C:Users_fhnir.cargo_registry_srcindex.crates.io_6f17d22bba15001fparking_lot_core_0.9.9_src_thread_parkerwindowsmod.rs
lea r8, [0x1400d7930]
mov edx, 0x5b
call fcn.1400a9c1f
int3
Function at 0x140034c46
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x50]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call fcn.140036b06
test rax, rax
je 0x140034c7e
mov edx, 4
mov rcx, rax
call fcn.140007720
jmp 0x140034ce0
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
lea rdx, [rsp + 0x70]
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
lea rbx, [rsp + 0x90]
mov rcx, rbx
call fcn.1400341b3
mov rax, qword [rbx]
movups xmm0, xmmword [rbx + 8]
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rbx + 0x18]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, qword [rbx + 0x28]
mov qword [rsp + 0x40], rcx
mov qword [rdi], rax
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rdi + 8], xmm0
movups xmmword [rdi + 0x18], xmm1
mov rax, qword [rsp + 0x40]
mov qword [rdi + 0x28], rax
and qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
jmp fcn.140034224
Function at 0x140036b06
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rdi, rcx
mov r12d, 0x20
mov r13d, 0xffffffff
mov rbp, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov rsi, qword [sym.imp.advapi32.dll_SystemFunction036]
test r12, r12
je 0x140036b96
mov r14, rdi
cmp r12, r13
mov r15d, 0xffffffff
cmovb r15, r12
add rdi, r15
sub r12, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call rbp
cmp eax, 0xc0000000
jb 0x140036b33
mov ebx, eax
mov rcx, r14
mov edx, r15d
call rsi
test al, al
jne 0x140036b33
and ebx, 0x7fffffff
je 0x140036b96
mov al, byte [0x1401172e0]
mov edx, 4
xor ecx, ecx
call fcn.140090a50
test rax, rax
je 0x140036ba9
mov dword [rax], ebx
jmp 0x140036b98
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 4
mov edx, 4
call fcn.1400a8570
int3

Function at 0x14003a095
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x6f8
mov r13, r8
mov r12, rdx
mov qword [rsp + 0x148], rcx
mov word [rax + rcx*2], fs
add dword [rax], eax
add byte [rax - 0x75], cl
xchg edx, eax
add byte [rax + rax], al
add byte [rax - 0x7d], cl
ret 0x4810
lea esi, [rsp + 0x1b0]
mov rcx, rsi
call fcn.1400122ef
cmp qword [rsi], 0
jne 0x14003bc31
mov rcx, qword [rsp + 0x1b8]
mov dl, byte [rsp + 0x1c0]
mov rax, qword [rcx + 0x28]
or rax, qword [rcx + 0x38]
je 0x14003a0fb
call fcn.140031348
jmp 0x14003a126
mov rsi, qword [rcx + 0x230]
call fcn.140031348
cmp rsi, 1
ja 0x14003a126
mov rdx, qword [r12 + 0x400]
add rdx, 0x10
lea rcx, [r12 + 0x3a0]
call fcn.14003fc9d
mov rax, qword [r12 + 0x378]
cmp rax, 2
add dh, byte [rbp + 7]
mov eax, 2
jmp 0x14003a1ad
lea rsi, [r12 + 0x378]
lea rdx, [r12 + 0x390]
test rax, rax
je 0x14003a174
mov rcx, qword [r12 + 0x380]
mov rax, qword [r12 + 0x388]
mov r8, qword [rax + 0x10]
dec r8
and r8, 0xfffffffffffffff0
add rcx, r8
add rcx, 0x10
jmp 0x14003a184
mov rcx, qword [r12 + 0x380]
mov rax, qword [r12 + 0x388]
call qword [rax + 0x70]
mov r14, rax
lea r15, [rsp + 0x1b0]
mov rcx, r15
mov rdx, rsi
call fcn.14009ff77
mov rax, qword [r15]
movups xmm0, xmmword [r15 + 8]
movups xmm0, xmmword [rdi + 8]
movaps xmmword [rsp + 0x2f0], xmm0
mov rcx, qword [r12 + 0x398]
mov qword [rsp + 0x4b8], rax
movaps xmm0, xmmword [rsp + 0x2f0]
add byte [rdi], cl
adc dword [rsp + 0x4c0], eax
mov qword [rsp + 0x4d0], r14
mov qword [rsp + 0x4d8], rcx
cmp rax, 2
je 0x14003a1f8
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x4b8]
call fcn.14009fff3
mov qword [rsp + 0x608], 2
and qword [rsp + 0x628], 0
lea rax, [r12 + 0x48]
mov qword [rsp + 0x80], rax
lea rax, [r12 + 0x3a0]
mov qword [rsp + 0x198], rax
add byte [rax], al
mov rax, qword [rsp + 0x1b8]
mov cl, byte [rsp + 0x1c0]
mov word [rax + rax*8], fs
add dword [rax], eax
add byte [rbp + rcx*4 - 0x7c], cl
and al, 0xf0
add al, byte [rax]
add byte [rcx - 0x77], cl
add byte [rcx - 0x78], al
or byte [rax - 0x73], cl
add eax, 0x9dfb2
Function at 0x140065674
Capabilities:
Decrypt data via sspi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rdi, rdx
mov rsi, rcx
mov r8, qword [rdx + 0x78]
mov rcx, qword [rdx + 0x68]
mov rdx, qword [rdx + 0x70]
lea r9, [0x1400dd2d8]
call fcn.140065417
xor ecx, ecx
test rax, rax
cmove edx, ecx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movups xmmword [rcx + 0x30], xmm0
mov dword [rcx], edx
mov dword [rcx + 4], 1
mov qword [rcx + 8], rax
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movabs rax, 0x400000000
lea rdx, [rsp + 0x60]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rdi + 0xf0]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.secur32.dll_DecryptMessage]
cmp eax, 0x80090318
je 0x1400657c3
test eax, eax
je 0x140065750
cmp eax, 0x90317
je 0x1400657bd
cmp eax, 0x90321
jne 0x1400657e1
mov dword [rdi + 0xd0], 0x10000
xor ebx, ebx
mov byte [rdi + 0xd4], bl
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x78]
mov eax, 0
cmove eax, dword [rsp + 0x50]
sub rdx, rax
mov rcx, rdi
call fcn.14006561e
and qword [rdi + 0x110], 0
mov byte [rsi + 1], bl
jmp 0x1400657ef
mov r8, qword [rsp + 0x38]
mov rcx, qword [rdi + 0x68]
mov rdx, qword [rdi + 0x70]
sub r8, rcx
mov r9d, dword [rsp + 0x30]
add r9, r8
lea rbx, [rdi + 0x40]
and qword [rdi + 0x50], 0
call fcn.140065803
lea r8, [rdx + rax]
mov rcx, rbx
mov rdx, rax
call fcn.1400a6e61
and qword [rdi + 0x58], 0
xor ebx, ebx
cmp dword [rsp + 0x54], 5
mov rdx, qword [rdi + 0x78]
mov eax, dword [rsp + 0x50]
cmovne eax, ebx
sub rdx, rax
mov rcx, rdi
call fcn.14006561e
xor eax, eax
cmp qword [rdi + 0x78], rbx
sete al
mov qword [rdi + 0x110], rax
mov byte [rsi + 1], 0
jmp 0x1400657ef
mov byte [rsi + 1], 1
jmp 0x1400657dd
cmp dword [rsp + 0x34], 4
mov eax, 1
cmove eax, dword [rsp + 0x30]
mov qword [rdi + 0x110], rax
mov byte [rsi + 1], 0
xor ebx, ebx
jmp 0x1400657ef
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov bl, 1
mov byte [rsi], bl
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret