joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140118a37
Capabilities:
Parse pe header

Disassembly:
jmp 0x1401cc5d0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1401cc5f0
xor al, al
jmp 0x1401cc671
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1401cc603
xor al, al
jmp 0x1401cc671
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1401cc62d
xor al, al
jmp 0x1401cc671
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1401cc641
xor al, al
jmp 0x1401cc671
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1401cc653
xor al, al
jmp 0x1401cc671
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1401cc66f
xor al, al
jmp 0x1401cc671
mov al, 1
add rsp, 0x38
ret

Function at 0x140118c1c
Capabilities:
Check if file exists

Disassembly:
jmp 0x14012ba90
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x1b0
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x2c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x1403d71c0]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x140442064]
call fcn.14011b3f9
nop
lea rax, [rbp + 8]
lea rcx, str._pipediscord_ipc_0
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2e
rep movsb byte [rdi], byte [rsi]
mov qword [rbp + 0x58], 0x15
mov eax, 2
imul rax, rax, 0x15
mov ecx, 0x30
mov word [rbp + rax + 8], cx
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x78], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, qword [rbp + 0x78]
mov qword [rcx + 8], rax
mov rax, qword [rbp + 0x78]
cmp qword [rax + 8], 0xffffffffffffffff
je 0x14012bb65
mov rax, qword [rbp + 0x78]
mov byte [rax], 1
mov al, 1
jmp 0x14012bbe4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x94], eax
cmp dword [rbp + 0x94], 2
jne 0x14012bbb3
mov eax, 2
imul rax, rax, 0x15
movzx eax, word [rbp + rax + 8]
cmp eax, 0x39
jge 0x14012bbb1
mov eax, 2
imul rax, rax, 0x15
movzx eax, word [rbp + rax + 8]
inc ax
mov ecx, 2
imul rcx, rcx, 0x15
mov word [rbp + rcx + 8], ax
jmp 0x14012bb19
jmp 0x14012bbdb
cmp dword [rbp + 0x94], 0xe7
jne 0x14012bbdb
mov edx, 0x2710
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WaitNamedPipeW]
test eax, eax
jne 0x14012bbd6
xor al, al
jmp 0x14012bbe4
jmp 0x14012bb19
xor al, al
jmp 0x14012bbe4
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x140359690]
call fcn.140119cf2
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.140116f4d
lea rsp, [rbp + 0x170]
pop rdi
pop rsi
pop rbp
ret
Function at 0x140119770
Capabilities:
Terminate process

Disassembly:
jmp 0x1402b5650
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1402b567e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.14011aa67
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14011ab25
Capabilities:
Print debug messages

Disassembly:
jmp 0x1402f76b0
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x14011ad4b
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x140261390
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140260ce0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1402613d9
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140444020]
jmp 0x1402613e8
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x14011b2f0
Capabilities:
Create thread

Disassembly:
jmp 0x1402b94d0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
cmp qword [rsp + 0x90], 0
je 0x1402b94fc
mov dword [rsp + 0x30], 1
jmp 0x1402b9504
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x1402b954d
lea rax, str.procedure___nullptr
mov qword [rsp + 0x28], rax
lea rax, [0x14036c098]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0xc8
lea rdx, str.minkernelcrtsucrt_src_appcrt_startup_thread.cpp
mov ecx, 2
call fcn.140113f00
cmp eax, 1
jne 0x1402b954d
int3
cmp dword [rsp + 0x34], 0
jne 0x1402b958f
call fcn.140115f03
mov dword [rax], 0x16
mov qword [rsp + 0x20], 0
mov r9d, 0xc8
lea r8, str.minkernelcrtsucrt_src_appcrt_startup_thread.cpp
lea rdx, str._beginthreadex
lea rcx, str.procedure___nullptr
call fcn.14011a12a
xor eax, eax
jmp 0x1402b968f
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.1402b8fc0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1402b8dc0
lea rcx, [rsp + 0x40]
call fcn.1402b8e30
movzx eax, al
test eax, eax
jne 0x1402b95df
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x40]
call fcn.1402b8e10
mov rax, qword [rsp + 0x50]
jmp 0x1402b968f
lea rcx, [rsp + 0x40]
call fcn.1402b9170
mov ecx, dword [rsp + 0x88]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdx
mov edx, dword [rsp + 0xa0]
mov dword [rsp + 0x20], edx
mov r9, rax
lea r8, [0x1402b8b70]
mov edx, ecx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x1402b9653
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140115616
mov qword [rsp + 0x58], 0
lea rcx, [rsp + 0x40]
call fcn.1402b8e10
mov rax, qword [rsp + 0x58]
jmp 0x1402b968f
cmp qword [rsp + 0xa8], 0
je 0x1402b966c
mov rax, qword [rsp + 0xa8]
mov ecx, dword [rsp + 0x38]
mov dword [rax], ecx
lea rcx, [rsp + 0x40]
call fcn.1402b9130
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x40]
call fcn.1402b8e10
mov rax, qword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x14011c0f1
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x14012cbc0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
mov eax, 0x1068
call fcn.14011477a
sub rsp, rax
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2ee
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1088]
mov rax, qword [0x1403d71c0]
xor rax, rbp
mov qword [rbp + 0x1028], rax
lea rcx, [0x1404420f0]
call fcn.14011b3f9
nop
mov dword [rsp + 0x28], 0x20
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rbp + 0x1050]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop
mov dword [rsp + 0x28], 0x20
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, qword [rbp + 0x1058]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareValveSteam
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp + 0xe4], eax
cmp dword [rbp + 0xe4], 0
je 0x14012ccc4
mov ecx, 2
call fcn.14011be85
lea rdx, str.Error_opening_Steam_key_n
mov rcx, rax
call fcn.14011a2c4
nop
jmp 0x14012cde5
mov dword [rbp + 0x334], 0x208
lea rax, [rbp + 0x334]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x110]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SteamExe
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbp + 0xe4], eax
mov rcx, qword [rbp + 0xc8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0xe4], 0
jne 0x14012cd26
cmp dword [rbp + 0x334], 1
jae 0x14012cd45
mov ecx, 2
call fcn.14011be85
lea rdx, str.Error_reading_SteamExe_key_n
mov rcx, rax
call fcn.14011a2c4
nop
jmp 0x14012cde5
mov eax, dword [rbp + 0x334]
xor edx, edx
mov ecx, 2
div rcx
mov dword [rbp + 0x354], eax
mov dword [rbp + 0x374], 0
jmp 0x14012cd75
mov eax, dword [rbp + 0x374]
inc eax
mov dword [rbp + 0x374], eax
mov eax, dword [rbp + 0x354]
cmp dword [rbp + 0x374], eax
jae 0x14012cdab
mov eax, dword [rbp + 0x374]
movzx eax, word [rbp + rax*2 + 0x110]
cmp eax, 0x2f
jne 0x14012cda9
mov eax, dword [rbp + 0x374]
mov ecx, 0x5c
mov word [rbp + rax*2 + 0x110], cx
jmp 0x14012cd67
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x110]
lea r8, str.__s__steam:__rungameid__s
mov edx, 0x800
lea rcx, [rbp + 0x3a0]
call fcn.14011750b
nop
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x10]
call fcn.14012c0d0
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x140359c80]
call fcn.140119cf2
mov rcx, qword [rbp + 0x1028]
xor rcx, rbp
call fcn.140116f4d
lea rsp, [rbp + 0x1038]
pop rdi
pop rbp
ret
Function at 0x14012c880
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x178
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x1a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x198]
mov rax, qword [0x1403d71c0]
xor rax, rbp
mov qword [rbp + 0x118], rax
lea rcx, [0x1404420f0]
call fcn.14011b3f9
nop
mov rax, qword [rbp + 0x140]
mov qword [rbp + 8], rax
mov qword [rbp + 0x28], 0
cmp qword [rbp + 0x148], 0
je 0x14012c969
mov eax, 2
imul rax, rax, 0
mov rcx, qword [rbp + 0x148]
movzx eax, word [rcx + rax]
test eax, eax
je 0x14012c969
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x28]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rbp + 0x148]
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
je 0x14012c961
mov eax, dword [rbp + 0x44]
jmp 0x14012c9bf
mov rax, qword [rbp + 0x28]
mov qword [rbp + 8], rax
mov eax, dword [rbp + 0x168]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x160]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x158]
xor r8d, r8d
mov rdx, qword [rbp + 0x150]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x44], eax
cmp qword [rbp + 0x28], 0
je 0x14012c9bc
mov rax, qword [rbp + 0x140]
cmp qword [rbp + 0x28], rax
je 0x14012c9bc
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov eax, dword [rbp + 0x44]
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x140359e40]
call fcn.140119cf2
mov rax, rdi
mov rcx, qword [rbp + 0x118]
xor rcx, rbp
call fcn.140116f4d
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x140307de0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14011477a
sub rsp, rax
mov rax, qword [0x1403d71c0]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1404202f0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140307fd2
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x140307f26
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x140307f26
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x140307f0b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x140307ea8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140307f92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140307ff1
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x140307fcd
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x140307ff1
jmp 0x140307e7e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140116f4d
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1403080a0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.14011477a
sub rsp, rax
mov rax, qword [0x1403d71c0]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1404202f0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1403082ad
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x1403081f9
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x1403081f9
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x1403081d9
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x140308168
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14030826d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1403082cc
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x1403082a8
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x1403082cc
jmp 0x14030813e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.140116f4d
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1800027d8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov dword [rax + 0x20], r9d
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x50
and dword [rax + 0x10], 0
mov rdi, rcx
mov r8d, dword [0x1801f1c94]
mov sil, dl
movaps xmmword [rax - 0x28], xmm6
movss xmm6, dword [0x18015d8f4]
mov dword [rax + 0x20], 0xff
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov eax, dword [rcx + rax]
cmp dword [0x1801f2a70], eax
jg 0x1800029a4
movabs rbx, 0xcbf29ce484222325
xor edx, edx
mov rcx, rbx
movabs r14, 0x100000001b3
movzx eax, byte [rsp + rdx + 0x70]
inc rdx
xor rcx, rax
imul rcx, r14
cmp rdx, 8
jb 0x18000284d
mov rax, qword [0x1801f2a60]
mov rdx, qword [0x1801f2a48]
and rax, rcx
mov r9, qword [0x1801f2a38]
add rax, rax
mov rcx, qword [rdx + rax*8 + 8]
cmp rcx, r9
je 0x18000289e
mov r8, qword [rdx + rax*8]
jmp 0x180002896
cmp rcx, r8
je 0x18000289e
mov rcx, qword [rcx + 8]
cmp rdi, qword [rcx + 0x10]
jne 0x18000288d
jmp 0x1800028a0
xor ecx, ecx
test rcx, rcx
mov rax, r9
cmovne rax, rcx
cmp rax, r9
jne 0x180002921
and dword [rsp + 0x28], 0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
call fcn.180003128
xor ecx, ecx
movzx eax, byte [rsp + rcx + 0x70]
inc rcx
xor rbx, rax
imul rbx, r14
cmp rcx, 8
jb 0x1800028ca
and rbx, qword [0x1801f2a60]
mov rdx, qword [0x1801f2a48]
add rbx, rbx
mov rax, qword [0x1801f2a38]
mov rcx, qword [rdx + rbx*8 + 8]
cmp rcx, rax
je 0x180002918
mov r8, qword [rdx + rbx*8]
jmp 0x180002910
cmp rcx, r8
je 0x180002918
mov rcx, qword [rcx + 8]
cmp rdi, qword [rcx + 0x10]
jne 0x180002907
jmp 0x18000291a
xor ecx, ecx
test rcx, rcx
cmovne rax, rcx
mov rcx, qword [0x1801f2490]
lea r8, [rax + 0x18]
mov edx, dword [r8]
subss xmm6, dword [rcx + 0x18]
mulss xmm6, dword [0x18015dcf4]
test sil, sil
je 0x180002956
cmp edx, 0xff
jge 0x18000296c
movd xmm0, edx
cvtdq2ps xmm0, xmm0
addss xmm0, xmm6
jmp 0x180002965
test edx, edx
jle 0x18000296c
movd xmm0, edx
cvtdq2ps xmm0, xmm0
subss xmm0, xmm6
cvttss2si edx, xmm0
mov dword [r8], edx
mov rbx, qword [rsp + 0x80]
lea rcx, [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x40]
lea rax, [rsp + 0x88]
test edx, edx
cmovns rcx, r8
cmp edx, 0xff
cmovle rax, rcx
mov eax, dword [rax]
mov dword [r8], eax
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
lea rcx, [0x1801f2a70]
call fcn.18006ab74
cmp dword [0x1801f2a70], 0xffffffff
jne 0x180002834
mov ecx, 0x20
call fcn.18006aa90
xorps xmm0, xmm0
lea rcx, [0x1801f2a48]
mov r8, rax
mov edx, 0x10
mov qword [rax], rax
mov qword [rax + 8], rax
and qword [0x1801f2a48], 0
mov qword [0x1801f2a38], rax
movdqa xmmword [0x1801f2a50], xmm0
mov qword [0x1801f2a60], 7
mov qword [0x1801f2a68], 8
mov dword [0x1801f2a30], 0x3f800000
call fcn.180002db8
lea rcx, [0x1800d7a68]
call fcn.18006af44
lea rcx, [0x1801f2a70]
call fcn.18006ab08
jmp 0x180002834
Function at 0x180002adc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
movss dword [rax + 0x20], xmm3
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x60
and dword [rax + 0x10], 0
mov rdi, rcx
mov r8d, dword [0x1801f1c94]
mov sil, dl
movaps xmmword [rax - 0x28], xmm6
movss xmm6, dword [0x18015d8f4]
movaps xmmword [rax - 0x38], xmm7
movaps xmm7, xmm3
mov rax, qword gs:[0x58]
mov ecx, 4
mov rax, qword [rax + r8*8]
mov eax, dword [rcx + rax]
cmp dword [0x1801f2a74], eax
jg 0x180002cac
movabs rbx, 0xcbf29ce484222325
xor edx, edx
mov rcx, rbx
movabs rbp, 0x100000001b3
movzx eax, byte [rsp + rdx + 0x80]
inc rdx
xor rcx, rax
imul rcx, rbp
cmp rdx, 8
jb 0x180002b51
mov rax, qword [0x1801f2a20]
mov rdx, qword [0x1801f2a08]
and rax, rcx
mov r9, qword [0x1801f29f8]
add rax, rax
mov rcx, qword [rdx + rax*8 + 8]
cmp rcx, r9
je 0x180002ba5
mov r8, qword [rdx + rax*8]
jmp 0x180002b9d
cmp rcx, r8
je 0x180002ba5
mov rcx, qword [rcx + 8]
cmp rdi, qword [rcx + 0x10]
jne 0x180002b94
jmp 0x180002ba7
xor ecx, ecx
test rcx, rcx
mov rax, r9
cmovne rax, rcx
cmp rax, r9
jne 0x180002c2b
and dword [rsp + 0x28], 0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
call fcn.180002ef8
xor ecx, ecx
movzx eax, byte [rsp + rcx + 0x80]
inc rcx
xor rbx, rax
imul rbx, rbp
cmp rcx, 8
jb 0x180002bd1
and rbx, qword [0x1801f2a20]
mov rdx, qword [0x1801f2a08]
add rbx, rbx
mov rax, qword [0x1801f29f8]
mov rcx, qword [rdx + rbx*8 + 8]
cmp rcx, rax
je 0x180002c22
mov r8, qword [rdx + rbx*8]
jmp 0x180002c1a
cmp rcx, r8
je 0x180002c22
mov rcx, qword [rcx + 8]
cmp rdi, qword [rcx + 0x10]
jne 0x180002c11
jmp 0x180002c24
xor ecx, ecx
test rcx, rcx
cmovne rax, rcx
mov rcx, qword [0x1801f2490]
lea rdx, [rax + 0x18]
movss xmm0, dword [rdx]
subss xmm6, dword [rcx + 0x18]
mulss xmm6, dword [0x18015d6f4]
test sil, sil
je 0x180002c57
comiss xmm0, xmm7
jae 0x180002c68
addss xmm0, xmm6
jmp 0x180002c64
comiss xmm0, dword [0x18015d65c]
jbe 0x180002c68
subss xmm0, xmm6
movss dword [rdx], xmm0
comiss xmm0, dword [0x18015d65c]
mov rbx, qword [rsp + 0x90]
lea rcx, [rsp + 0x88]
lea rax, [rsp + 0x98]
movaps xmm6, xmmword [rsp + 0x50]
cmovae rcx, rdx
comiss xmm7, xmm0
movaps xmm7, xmmword [rsp + 0x40]
cmovae rax, rcx
movss xmm0, dword [rax]
movss dword [rdx], xmm0
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
lea rcx, [0x1801f2a74]
call fcn.18006ab74
cmp dword [0x1801f2a74], 0xffffffff
jne 0x180002b38
mov ecx, 0x20
call fcn.18006aa90
xorps xmm0, xmm0
lea rcx, [0x1801f2a08]
mov r8, rax
mov edx, 0x10
mov qword [rax], rax
mov qword [rax + 8], rax
and qword [0x1801f2a08], 0
mov qword [0x1801f29f8], rax
movdqa xmmword [0x1801f2a10], xmm0
mov qword [0x1801f2a20], 7
mov qword [0x1801f2a28], 8
mov dword [0x1801f29f0], 0x3f800000
call fcn.180002db8
lea rcx, [0x1800d7a74]
call fcn.18006af44
lea rcx, [0x1801f2a74]
call fcn.18006ab08
jmp 0x180002b38