joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140064b40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400f4080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140064b6d
xor eax, eax
jmp 0x140064cd9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140064ba7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140064ba7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140064cd9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140064ccc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140064bea
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140064c15
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140064cd1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140064c84
sub eax, 1
je 0x140064c84
cmp eax, 2
jne 0x140064ccc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140064cd1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140064cb2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140064ccc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140064cd1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400ca670
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140065d80
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400f4080]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140065e53
cmp byte [rcx + 0x71], 0
je 0x140065e53
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x140065e4f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140065e14
sub eax, 1
je 0x140065e18
cmp eax, 2
jne 0x140065e4f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ca670
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140065e46
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140065e4f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140065dfc
xor al, al
jmp 0x140065dfc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ca670
add rsp, 0x60
pop rbx
ret

Function at 0x1400664d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov rax, qword gs:[0x60]
test rax, rax
je 0x14006655a
mov rbx, qword [rax + 0x18]
add rbx, 0x10
mov r9, qword [rbx]
cmp r9, rbx
je 0x14006655a
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r9 + 0x60]
mov r10d, 0x811c9dc5
movzx ecx, word [r9 + 0x58]
shr rcx, 1
lea r11, [rax + rcx*2]
cmp rax, r11
je 0x140066552
nop dword [rax + rax]
movsx ecx, byte [rax]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
add rax, 2
xor r8d, r10d
imul r10d, r8d, 0x1000193
cmp rax, r11
jne 0x140066520
cmp r10d, 0xa62a3b3b
je 0x140066562
mov r9, qword [r9]
cmp r9, rbx
jne 0x140066500
xor eax, eax
mov rbx, qword [rsp + 8]
ret
mov rax, qword [r9 + 0x30]
mov rbx, qword [rsp + 8]
ret
Function at 0x1400667c0
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14006689d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14006689d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14006680a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x140066812
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14006689d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x140066895
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140066860
cmp r10d, 0xbf21a4fa
je 0x1400668b4
inc r9
cmp r9, rbx
jb 0x140066840
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14006689f

Function at 0x1400668d0
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x1400669ad
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400669ad
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14006691a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x140066922
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x1400669ad
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x1400669a5
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140066970
cmp r10d, 0x97085561
je 0x1400669c4
inc r9
cmp r9, rbx
jb 0x140066950
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x1400669af
Function at 0x1400669e0
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x140066abd
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140066abd
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x140066a2a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x140066a32
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x140066abd
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x140066ab5
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140066a80
cmp r10d, 0x3d71f40a
je 0x140066ad4
inc r9
cmp r9, rbx
jb 0x140066a60
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x140066abf

Function at 0x140066af0
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x140066bcd
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140066bcd
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x140066b3a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x140066b42
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x140066bcd
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x140066bc5
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140066b90
cmp r10d, 0xe054604a
je 0x140066be4
inc r9
cmp r9, rbx
jb 0x140066b70
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x140066bcf
Function at 0x140066c00
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x140066cdd
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140066cdd
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x140066c4a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x140066c52
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x140066cdd
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x140066cd5
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140066ca0
cmp r10d, 0xddeaabca
je 0x140066cf4
inc r9
cmp r9, rbx
jb 0x140066c80
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x140066cdf

Function at 0x140066d10
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x140066ded
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140066ded
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x140066d5a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x140066d62
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x140066ded
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x140066de5
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140066db0
cmp r10d, 0x4ecb007a
je 0x140066e04
inc r9
cmp r9, rbx
jb 0x140066d90
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x140066def
Function at 0x140066e20
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x140066efd
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x140066efd
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x140066e6a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x140066e72
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x140066efd
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x140066ef5
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140066ec0
cmp r10d, 0xde10f3da
je 0x140066f14
inc r9
cmp r9, rbx
jb 0x140066ea0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x140066eff

Function at 0x140066f30
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14006700d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14006700d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x140066f7a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x140066f82
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14006700d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x140067005
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140066fd0
cmp r10d, 0xd07708df
je 0x140067024
inc r9
cmp r9, rbx
jb 0x140066fb0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14006700f
Function at 0x140067040
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14006711d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14006711d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14006708a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x140067092
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14006711d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x140067115
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x1400670e0
cmp r10d, 0xe049c205
je 0x140067134
inc r9
cmp r9, rbx
jb 0x1400670c0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14006711f

Function at 0x140067150
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14006722d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14006722d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14006719a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x1400671a2
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14006722d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x140067225
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x1400671f0
cmp r10d, 0xe082843
je 0x140067244
inc r9
cmp r9, rbx
jb 0x1400671d0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14006722f
Function at 0x140067260
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14006733d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14006733d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x1400672aa
mov ecx, dword [rax + r11 + 0x78]
jmp 0x1400672b2
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14006733d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x140067335
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140067300
cmp r10d, 0x1a946df0
je 0x140067354
inc r9
cmp r9, rbx
jb 0x1400672e0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14006733f

Function at 0x140067370
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14006744d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14006744d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x1400673ba
mov ecx, dword [rax + r11 + 0x78]
jmp 0x1400673c2
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14006744d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x140067445
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x140067410
cmp r10d, 0x3546aa24
je 0x140067464
inc r9
cmp r9, rbx
jb 0x1400673f0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14006744f