joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d0d00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10, rdx
mov rax, rcx
and r10d, 7
and eax, 7
xor r11d, r11d
cmp rax, r10
jne 0x1400d0e3f
mov rax, r8
and eax, 7
cmp r10, rax
jne 0x1400d0e3f
test r10, r10
je 0x1400d0d5e
nop dword [rax]
test r9d, r9d
je 0x1400d0d5e
movzx eax, byte [r8]
dec r9d
xor al, byte [rdx]
inc r8
mov byte [rcx], al
inc rdx
inc rcx
test dl, 7
jne 0x1400d0d40
mov ebx, r9d
mov edi, r11d
shr ebx, 3
test ebx, ebx
je 0x1400d0e3b
cmp ebx, 8
jb 0x1400d0e10
lea eax, [rbx - 1]
mov r10d, eax
lea rsi, [rcx + rax*8]
lea rax, [rdx + rax*8]
cmp rcx, rax
ja 0x1400d0d94
cmp rsi, rdx
jae 0x1400d0e10
lea rax, [r8 + r10*8]
cmp rcx, rax
ja 0x1400d0da2
cmp rsi, r8
jae 0x1400d0e10
mov eax, ebx
and eax, 0xfffffff8
nop word [rax + rax]
movdqu xmm0, xmmword [rdx]
add edi, 8
movdqu xmm1, xmmword [r8]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rdx + 0x10]
movdqu xmmword [rcx], xmm1
movdqu xmm1, xmmword [r8 + 0x10]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rdx + 0x20]
movdqu xmmword [rcx + 0x10], xmm1
movdqu xmm1, xmmword [r8 + 0x20]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rdx + 0x30]
add rdx, 0x40
movdqu xmmword [rcx + 0x20], xmm1
movdqu xmm1, xmmword [r8 + 0x30]
add r8, 0x40
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x30], xmm1
add rcx, 0x40
cmp edi, eax
jb 0x1400d0db0
cmp edi, ebx
jae 0x1400d0e3b
sub ebx, edi
mov r10d, ebx
nop word [rax + rax]
mov rax, qword [r8]
add r8, 8
xor rax, qword [rdx]
add rdx, 8
mov qword [rcx], rax
add rcx, 8
sub r10, 1
jne 0x1400d0e20
and r9d, 7
test r9d, r9d
je 0x1400d0f66
cmp r9d, 8
jb 0x1400d0f33
lea eax, [r9 - 1]
mov r10d, eax
lea rbx, [rax + rcx]
add rax, rdx
cmp rcx, rax
ja 0x1400d0e6e
cmp rbx, rdx
jae 0x1400d0f33
lea rax, [r10 + r8]
cmp rcx, rax
ja 0x1400d0e80
cmp rbx, r8
jae 0x1400d0f33
cmp r9d, 0x40
jb 0x1400d0f07
mov ebx, r9d
mov edi, r9d
and ebx, 0x3f
sub edi, ebx
mov esi, 0x20
nop word [rax + rax]
movdqu xmm0, xmmword [r11 + rdx]
lea eax, [rsi - 0x10]
movdqu xmm1, xmmword [r11 + r8]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax + rdx]
movdqu xmmword [r11 + rcx], xmm1
add r11d, 0x40
movdqu xmm1, xmmword [rax + r8]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
mov eax, esi
movdqu xmm0, xmmword [rax + rdx]
movdqu xmm1, xmmword [rax + r8]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
lea eax, [rsi + 0x10]
add esi, 0x40
movdqu xmm1, xmmword [rax + r8]
movdqu xmm0, xmmword [rax + rdx]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
cmp r11d, edi
jb 0x1400d0ea0
cmp ebx, 8
jb 0x1400d0f2e
mov r10d, r9d
and r10d, 0xfffffff8
nop
movq xmm1, qword [r11 + r8]
movq xmm0, qword [r11 + rdx]
xorps xmm1, xmm0
movq qword [r11 + rcx], xmm1
add r11d, 8
cmp r11d, r10d
jb 0x1400d0f10
cmp r11d, r9d
jae 0x1400d0f66
sub r8, rdx
mov r10d, r11d
add r10, rdx
sub rcx, rdx
sub r9d, r11d
mov edx, r9d
nop word [rax + rax]
movzx eax, byte [r8 + r10]
xor al, byte [r10]
mov byte [rcx + r10], al
lea r10, [r10 + 1]
sub rdx, 1
jne 0x1400d0f50
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1400d5630
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x1400d573a
test rdx, rdx
je 0x1400d573a
mov eax, dword [rcx]
mov qword [rsp + 0x38], rdi
lea rdi, [rcx + 0xc]
cmp eax, 0x3f
jbe 0x1400d5677
mov rdi, qword [rsp + 0x38]
mov eax, 0xffffff7c
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov byte [rax + rdi], 0x80
mov ecx, dword [rcx]
inc ecx
mov qword [rsp + 0x30], rbp
xor ebp, ebp
mov dword [rbx], ecx
cmp ecx, 0x38
jbe 0x1400d56b5
mov r8d, 0x40
xor edx, edx
sub r8d, ecx
add rcx, rdi
call fcn.14014c1f0
mov rdx, rdi
mov dword [rbx], 0x40
mov rcx, rbx
call fcn.1400d4cd0
mov ecx, ebp
mov dword [rbx], ebp
mov r8d, 0x38
xor edx, edx
sub r8d, ecx
add rcx, rdi
call fcn.14014c1f0
mov r8d, dword [rbx + 4]
mov rdx, rdi
mov eax, dword [rbx + 8]
mov ecx, r8d
shr ecx, 0x1d
lea ecx, [rcx + rax*8]
mov dword [rbx + 8], ecx
lea eax, [r8*8]
mov dword [rbx + 4], eax
mov rcx, rbx
mov dword [rdi + 0x38], eax
mov eax, dword [rbx + 8]
mov dword [rdi + 0x3c], eax
call fcn.1400d4cd0
movups xmm0, xmmword [rbx + 0x4c]
mov rdi, qword [rsp + 0x38]
xor eax, eax
movups xmmword [rsi], xmm0
mov qword [rbx], rbp
mov dword [rbx + 8], ebp
mov rbp, qword [rsp + 0x30]
mov dword [rbx + 0x4c], 0x67452301
mov dword [rbx + 0x50], 0xefcdab89
mov dword [rbx + 0x54], 0x98badcfe
mov dword [rbx + 0x58], 0x10325476
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x40]
mov eax, 0xffffff53
add rsp, 0x20
pop rsi
ret
Function at 0x1400d5750
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r8, rcx
mov rax, rdx
and r8d, 7
and eax, 7
xor r10d, r10d
mov r9d, 8
cmp r8, rax
jne 0x1400d5851
mov qword [rsp + 0x10], rbx
test r8, r8
je 0x1400d5795
nop dword [rax]
test r9d, r9d
je 0x1400d5795
movzx eax, byte [rdx]
inc rdx
xor byte [rcx], al
inc rcx
dec r9d
jmp 0x1400d5780
mov r11d, r9d
mov ebx, r10d
shr r11d, 3
test r11d, r11d
je 0x1400d5848
mov qword [rsp], rdi
cmp r11d, 8
jb 0x1400d5829
lea eax, [r11 - 1]
lea rdi, [rcx + rax*8]
lea rax, [rdx + rax*8]
cmp rcx, rax
ja 0x1400d57c8
cmp rdi, rdx
jae 0x1400d5829
mov eax, r11d
and eax, 0xfffffff8
nop
movdqu xmm0, xmmword [rcx]
add ebx, 8
movdqu xmm1, xmmword [rdx]
xorps xmm1, xmm0
movdqu xmmword [rcx], xmm1
movdqu xmm0, xmmword [rcx + 0x10]
movdqu xmm1, xmmword [rdx + 0x10]
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x10], xmm1
movdqu xmm0, xmmword [rcx + 0x20]
movdqu xmm1, xmmword [rdx + 0x20]
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x20], xmm1
movdqu xmm0, xmmword [rcx + 0x30]
movdqu xmm1, xmmword [rdx + 0x30]
add rdx, 0x40
xorps xmm1, xmm0
movdqu xmmword [rcx + 0x30], xmm1
add rcx, 0x40
cmp ebx, eax
jb 0x1400d57d0
cmp ebx, r11d
jae 0x1400d5844
sub r11d, ebx
mov r8d, r11d
nop
mov rax, qword [rdx]
add rdx, 8
xor qword [rcx], rax
add rcx, 8
sub r8, 1
jne 0x1400d5830
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
and r9d, 7
test r9d, r9d
je 0x1400d58d0
cmp r9d, 8
jb 0x1400d58a3
lea eax, [r9 - 1]
lea r11, [rax + rcx]
add rax, rdx
cmp rcx, rax
ja 0x1400d5871
cmp r11, rdx
jae 0x1400d58a3
mov r8d, r9d
and r8d, 0xfffffff8
nop dword [rax + rax]
movq xmm0, qword [r10 + rcx]
movq xmm1, qword [r10 + rdx]
xorps xmm1, xmm0
movq qword [r10 + rcx], xmm1
add r10d, 8
cmp r10d, r8d
jb 0x1400d5880
cmp r10d, r9d
jae 0x1400d58d0
mov eax, r10d
sub rdx, rcx
add rax, rcx
sub r9d, r10d
mov r8d, r9d
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rdx + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x1400d58c0
add rsp, 8
ret
Function at 0x1400d6df0
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push rsi
push rdi
push r12
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0x100
mov rax, qword [0x14019d0c0]
xor rax, rsp
mov qword [rbp - 9], rax
mov r15, qword [rbp + 0x67]
mov rdi, rdx
mov r12, qword [rbp + 0x77]
mov esi, 0x37
mov byte [rsp + 0x28], r9b
test rcx, rcx
jne 0x1400d6e34
lea eax, [rsi - 0x36]
jmp 0x1400d7015
mov ecx, 0x1b8
mov qword [rsp + 0x130], rbx
mov eax, ecx
mov qword [rsp + 0xf8], r13
mov r13d, dword [rbp + 0x7f]
rol ecx, 8
ror eax, 8
xor ecx, eax
mov qword [rsp + 0xf0], r14
and ecx, 0xff00ff
mov byte [rsp + 0x20], 1
xor ecx, eax
mov qword [rsp + 0x38], 2
mov dword [rsp + 0x30], ecx
xor r14d, r14d
nop dword [rax]
mov r8d, 1
mov dword [rsp + 0x40], 0x6a09e667
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x44], 0xbb67ae85
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x48], 0x3c6ef372
mov dword [rsp + 0x4c], 0xa54ff53a
mov dword [rsp + 0x50], 0x510e527f
mov dword [rsp + 0x54], 0x9b05688c
mov dword [rsp + 0x58], 0x1f83d9ab
mov dword [rsp + 0x5c], 0x5be0cd19
mov qword [rbp - 0x49], r14
mov dword [rbp - 0x41], r14d
mov qword [rbp - 0x39], r14
call fcn.1400d0110
mov ebx, eax
test eax, eax
jne 0x1400d6f81
inc byte [rsp + 0x20]
lea r8d, [rax + 4]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.1400d0110
mov ebx, eax
test eax, eax
jne 0x1400d6f81
cmp byte [rsp + 0x28], 4
je 0x1400d6f28
lea r8d, [rax + 1]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x40]
call fcn.1400d0110
mov ebx, eax
test eax, eax
jne 0x1400d6f81
test r15, r15
jne 0x1400d6f3a
cmp dword [rbp + 0x6f], r14d
jbe 0x1400d6f51
mov ebx, 0xffffff53
jmp 0x1400d6f81
mov r8d, dword [rbp + 0x6f]
lea rcx, [rsp + 0x40]
mov rdx, r15
call fcn.1400d0110
mov ebx, eax
test eax, eax
jne 0x1400d6f81
test r12, r12
je 0x1400d6f71
test r13d, r13d
je 0x1400d6f71
mov r8d, r13d
lea rcx, [rsp + 0x40]
mov rdx, r12
call fcn.1400d0110
mov ebx, eax
test eax, eax
jne 0x1400d6f81
lea rdx, [rbp - 0x29]
lea rcx, [rsp + 0x40]
call fcn.1400d0ac0
mov ebx, eax
mov ecx, 0x78
lea rax, [rsp + 0x40]
nop dword [rax + rax]
mov byte [rax], r14b
lea rax, [rax + 1]
add ecx, 0xffffffff
jne 0x1400d6f90
test ebx, ebx
jne 0x1400d6fcc
cmp esi, 0x20
jbe 0x1400d6fbd
movups xmm0, xmmword [rbp - 0x29]
add esi, 0xffffffe0
movups xmm1, xmmword [rbp - 0x19]
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm1
add rdi, 0x20
jmp 0x1400d6fcc
mov r8d, esi
lea rdx, [rbp - 0x29]
mov rcx, rdi
call fcn.14014bb50
sub qword [rsp + 0x38], 1
jne 0x1400d6e80
mov r13, qword [rsp + 0xf8]
lea rdx, [rbp - 0x29]
mov ecx, 0x20
nop dword [rax]
mov byte [rdx], r14b
lea rdx, [rdx + 1]
add ecx, 0xffffffff
jne 0x1400d6ff0
test ebx, ebx
mov rbx, qword [rsp + 0x130]
setne r14b
mov eax, r14d
mov r14, qword [rsp + 0xf0]
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.14011c6a0
add rsp, 0x100
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d7150
Capabilities:
Hash data using sha256

Disassembly:
push rbp
push rdi
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x14019d0c0]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15, rdx
mov edi, 1
test rcx, rcx
jne 0x1400d7183
mov eax, edi
jmp 0x1400d7375
movups xmm0, xmmword [r9]
mov qword [rsp + 0x140], rbx
test r8d, r8d
movups xmm1, xmmword [r9 + 0x10]
mov qword [rsp + 0x118], rsi
mov esi, edi
cmovne esi, r8d
mov qword [rsp + 0x110], r12
mov qword [rsp + 0x108], r13
test sil, 0x1f
mov qword [rsp + 0x100], r14
mov eax, esi
mov r14d, 0
mov r13d, r14d
mov r12d, r14d
setne r13b
shr eax, 5
add r13d, eax
mov eax, dword [r9 + 0x30]
mov dword [rbp - 0x10], eax
lea ebx, [r14 + 0x37]
movzx eax, word [r9 + 0x34]
movups xmmword [rbp - 0x40], xmm0
mov word [rbp - 0xc], ax
movups xmm0, xmmword [r9 + 0x20]
movzx eax, byte [r9 + 0x36]
mov byte [rbp - 0xa], al
movups xmmword [rbp - 0x30], xmm1
movups xmmword [rbp - 0x20], xmm0
je 0x1400d732b
nop dword [rax]
mov r8d, ebx
mov dword [rsp + 0x40], 0x6a09e667
lea rdx, [rbp - 0x40]
mov dword [rsp + 0x44], 0xbb67ae85
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x48], 0x3c6ef372
mov dword [rsp + 0x4c], 0xa54ff53a
mov dword [rsp + 0x50], 0x510e527f
mov dword [rsp + 0x54], 0x9b05688c
mov dword [rsp + 0x58], 0x1f83d9ab
mov dword [rsp + 0x5c], 0x5be0cd19
mov qword [rbp - 0x60], r14
mov dword [rbp - 0x58], r14d
mov qword [rbp - 0x50], r14
call fcn.1400d0110
mov edi, eax
test eax, eax
jne 0x1400d7284
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400d0ac0
mov edi, eax
mov eax, 0x78
lea rcx, [rsp + 0x40]
nop
mov byte [rcx], r14b
lea rcx, [rcx + 1]
add eax, 0xffffffff
jne 0x1400d7290
test edi, edi
jne 0x1400d732b
test r15, r15
je 0x1400d731f
test esi, esi
je 0x1400d731f
cmp esi, 0x20
jb 0x1400d730c
movups xmm0, xmmword [rsp + 0x20]
add esi, 0xffffffe0
lea rcx, [rbp - 0xc]
movups xmm1, xmmword [rsp + 0x30]
mov edx, 0x36
lea rax, [rbp - 0xc]
movups xmmword [r15], xmm0
movups xmmword [r15 + 0x10], xmm1
add r15, 0x20
sub rdx, rcx
nop dword [rax]
add byte [rax + 2], 1
jne 0x1400d731f
add byte [rax + 1], 1
jne 0x1400d731f
add byte [rax], 1
jne 0x1400d731f
add byte [rax - 1], 1
jne 0x1400d731f
add byte [rax - 2], 1
jne 0x1400d731f
sub rax, 5
lea rcx, [rdx + rax]
test rcx, rcx
jns 0x1400d72e0
jmp 0x1400d731f
mov r8d, esi
lea rdx, [rsp + 0x20]
mov rcx, r15
call fcn.14014bb50
mov esi, r14d
inc r12d
cmp r12d, r13d
jb 0x1400d7210
mov r13, qword [rsp + 0x108]
lea rcx, [rbp - 0x40]
mov r12, qword [rsp + 0x110]
mov rsi, qword [rsp + 0x118]
nop word [rax + rax]
mov byte [rcx], r14b
lea rcx, [rcx + 1]
add ebx, 0xffffffff
jne 0x1400d7350
mov rbx, qword [rsp + 0x140]
test edi, edi
setne r14b
mov eax, r14d
mov r14, qword [rsp + 0x100]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14011c6a0
add rsp, 0x120
pop r15
pop rdi
pop rbp
ret
Function at 0x1400d7a80
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x14019d0c0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
test rcx, rcx
jne 0x1400d7aaa
mov eax, 0xffffff53
jmp 0x1400d7ca4
mov qword [rsp + 0xb8], rbp
xor ebp, ebp
mov qword [rcx + 0x10], rbp
mov byte [rcx + 0x18], bpl
mov qword [rcx + 8], r9
xor ecx, ecx
mov qword [rsp + 0xc8], rdi
call fcn.1400d8230
test eax, eax
jne 0x1400d7c89
mov rax, qword [0x1401a22f0]
mov ecx, 0x80
mov qword [rsp + 0xc0], rsi
test rax, rax
je 0x1400d7af4
call rax
jmp 0x1400d7af9
call fcn.1401325bc
mov qword [rbx + 0x10], rax
mov esi, 0x34
test rax, rax
jne 0x1400d7b13
lea edi, [rax - 0x7d]
mov byte [rbx + 0x18], 2
jmp 0x1400d7c4e
mov edi, 1
mov dword [rsp + 0x20], 0xf0000000
mov r9d, edi
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400d7c28
mov rcx, qword [rbx]
lea r8, [rsp + 0x40]
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1400d7c28
mov rcx, qword [rbx]
xor edx, edx
mov qword [rsp + 0x98], r12
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x80], r15
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov r12d, 4
mov edi, ebp
mov r14d, ebp
mov r8d, r12d
mov r15, rbp
lea r13d, [r12 - 1]
nop dword [rax]
nop word [rax + rax]
mov eax, r8d
lea rdx, [rsp + 0x40]
add rax, r15
lea rcx, [rsp + 0x40]
add rdx, rax
add rcx, r15
call fcn.14007f140
test eax, eax
mov r8d, esi
cmove edi, r13d
add r14d, r12d
sub r8d, r14d
add r15, r12
cmp r8d, r12d
cmova r8d, r12d
cmp r14d, 0x30
jb 0x1400d7ba0
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
mov r12, qword [rsp + 0x98]
test edi, edi
jne 0x1400d7c2c
mov rax, qword [rbx + 8]
lea r8d, [rdi + 0x30]
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x44]
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov dword [rsp + 0x20], ebp
call fcn.1400d79c0
mov edi, eax
test eax, eax
je 0x1400d7c4e
jmp 0x1400d7c2c
mov byte [rbx + 0x18], 2
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x1400d7c4a
mov rax, qword [0x1401a22e0]
test rax, rax
je 0x1400d7c45
call rax
jmp 0x1400d7c4a
call fcn.14012e000
mov qword [rbx + 0x10], rbp
lea rax, [rsp + 0x40]
mov byte [rax], bpl
lea rax, [rax + 1]
add esi, 0xffffffff
jne 0x1400d7c53
mov rsi, qword [rsp + 0xc0]
test edi, edi
jne 0x1400d7c71
mov byte [rbx + 0x18], 1
jmp 0x1400d7c92
cmp edi, 3
je 0x1400d7c89
cmp edi, 1
mov byte [rbx + 0x18], 2
mov eax, 0xffffff39
cmove edi, eax
mov ebp, edi
jmp 0x1400d7c92
mov byte [rbx + 0x18], 3
mov ebp, 0xffffff2f
mov rdi, qword [rsp + 0xc8]
mov eax, ebp
mov rbp, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14011c6a0
add rsp, 0xa0
pop rbx
ret
Function at 0x1400eb480
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14019d0c0]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r14, rcx
mov qword [rsp + 0x58], rcx
xor ebx, ebx
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.14014c1f0
mov dword [rsp + 0x58], 0x104
call fcn.1400ea610
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
lea r8d, [rbx + 0x1a]
lea rdx, str.QueryFullProcessImageNameW
lea rcx, [rsp + 0x20]
call fcn.1400016c0
nop
call fcn.140102f60
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rdx, qword [rsp + 0x20]
movabs r9, 0xcbf29ce484222325
mov ecx, ebx
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x1400eb555
movabs r10, 0x100000001b3
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1400eb542
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.140018ef0
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400eb587
cmp rdx, qword [rsi + 8]
je 0x1400eb587
mov rbx, qword [rdx + 0x30]
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
jmp 0x1400eb592
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0x20]
call fcn.140001e20
test rbx, rbx
je 0x1400eb5ba
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
xor edx, edx
call rbx
jmp 0x1400eb5cc
mov r8d, dword [rsp + 0x58]
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400eb5f0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140015310
nop
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.1400eb370
nop
lea rcx, [rsp + 0x20]
call fcn.1400152a0
mov rax, r14
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14011c6a0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400ede90
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x1a0
mov rax, qword [0x14019d0c0]
xor rax, rsp
mov qword [rsp + 0x190], rax
xorps xmm0, xmm0
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x108
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call fcn.14014c1f0
mov rax, qword [rdi + 8]
mov qword [rsp + 0x30], 0
test rbx, rbx
je 0x1400edf7e
mov rax, qword [rax + 0x70]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x40]
mov r9d, 0x40
mov rdx, rbx
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x1400edf7e
mov eax, 0x5a4d
cmp word [rsp + 0x40], ax
jne 0x1400edf7e
movsxd rdx, dword [rsp + 0x7c]
mov rax, qword [rdi + 8]
mov qword [rsp + 0x30], 0
add rdx, rbx
je 0x1400edf7e
mov rax, qword [rax + 0x70]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
mov r9d, 0x108
lea r8, [rsp + 0x80]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x1400edf7e
cmp dword [rsp + 0x80], 0x4550
sete al
jmp 0x1400edf80
xor al, al
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14011c6a0
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x1a0
pop rdi
ret

Function at 0x1400ee340
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x14019d0c0]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rbx, rcx
movsxd rsi, r8d
lea rcx, [rsp + 0x40]
call fcn.1400eb260
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400eb880
xor edi, edi
lea rcx, [rsp + 0x60]
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x90], xmm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov dword [rsp + 0xa0], esi
call fcn.1400152a0
movups xmm1, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x80]
movdqa xmm0, xmm1
movq rcx, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 7
movabs rax, 0xcbf29ce484222325
lea r8, [rcx + rcx]
cmova rdx, qword [rsp + 0x20]
test r8, r8
je 0x1400ee423
movabs r9, 0x100000001b3
nop dword [rax + rax]
movzx ecx, byte [rdi + rdx]
inc rdi
xor rax, rcx
imul rax, r9
cmp rdi, r8
jb 0x1400ee410
mov r9, rsi
lea r8, [rsp + 0x80]
xor r9, rax
lea rdx, [rsp + 0x30]
lea rcx, [rbx + 0x18]
call fcn.1400ef540
cmp qword [rax + 8], 0
je 0x1400ee457
lea rdx, [rsp + 0x80]
lea rcx, [rbx + 0x18]
call fcn.1400ee820
lea rcx, [rsp + 0x80]
call fcn.1400152a0
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14011c6a0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400ee820
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 7
mov r8, rdx
mov r10, qword [rdx + 0x10]
mov rdi, rcx
mov r9, rdx
jbe 0x1400ee841
mov r9, qword [rdx]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
add r10, r10
je 0x1400ee874
movabs r11, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + r9]
inc rcx
xor rdx, rax
imul rdx, r11
cmp rcx, r10
jb 0x1400ee860
movsxd r9, dword [r8 + 0x20]
mov rcx, rdi
xor r9, rdx
lea rdx, [rsp + 0x20]
call fcn.1400ef540
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x1400ee90c
mov rdx, qword [rdi + 0x30]
and rdx, r9
shl rdx, 4
add rdx, qword [rdi + 0x18]
mov rax, qword [rdx]
cmp qword [rdx + 8], rbx
jne 0x1400ee8c5
cmp rax, rbx
jne 0x1400ee8bb
mov rax, qword [rdi + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x1400ee8d0
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
jmp 0x1400ee8d0
cmp rax, rbx
jne 0x1400ee8d0
mov rax, qword [rbx]
mov qword [rdx], rax
mov rdx, qword [rbx]
lea rcx, [rbx + 0x10]
dec qword [rdi + 0x10]
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
call fcn.1400ef620
mov edx, 0x48
mov rcx, rbx
call fcn.14011c93c
mov eax, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1400f0ec0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
xor esi, esi
mov rcx, qword [rcx + 0x10]
movzx edi, dl
test rcx, rcx
je 0x1400f0eec
jle 0x1400f0ee8
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbx + 0x10], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400f0f01
jle 0x1400f0efd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], rsi
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400f0f14
jle 0x1400f0f11
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rsi
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x1400f0f29
jle 0x1400f0f25
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov qword [rbx + 0x48], rsi
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x28], rsi
test dil, dil
jne 0x1400f0f95
cmp qword [rbx + 0x110], 7
lea rcx, [rbx + 0xf8]
jbe 0x1400f0f4e
mov rcx, qword [rbx + 0xf8]
mov qword [rbx + 0x108], rsi
mov word [rcx], si
cmp byte [rbx + 0x1c], sil
je 0x1400f0f7a
add rbx, 0x118
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x1400f0f72
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400f0f81
add rbx, 0x118
cmp qword [rbx + 0x18], 7
mov rax, rbx
jbe 0x1400f0f8e
mov rax, qword [rbx]
mov qword [rbx + 0x10], rsi
mov word [rax], si
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret