joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e0640
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, byte [0x1401b21c1]
mov ecx, 0x1818
mov edx, 4
call fcn.140008480
test rax, rax
je 0x1400e075e
xor ecx, ecx
lea rdx, [0x14014cab8]
movdqa xmm0, xmmword [0x14010c410]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rcx + rdx]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rcx], xmm2
add rcx, 0x10
cmp rcx, 0x1810
jne 0x1400e0690
movabs rcx, 0xe01ef000e0100
mov qword [rax + 0x1810], rcx
mov rcx, rax
add rcx, 0x1818
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0x303
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x38]
lea rdx, [rbp - 0x20]
call fcn.1400d9310
mov rax, qword [rbp - 0x28]
test rax, rax
mov qword [rbp - 0x10], rax
movups xmm0, xmmword [rbp - 0x38]
movaps xmmword [rbp - 0x20], xmm0
sete byte [rbp - 8]
lea rcx, [rbp - 0x20]
call fcn.1400e6c00
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x68
pop rsi
pop rbp
ret
mov ecx, 4
mov edx, 0x1818
call fcn.14010a860
ud2

Function at 0x1400e08d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
movzx eax, byte [0x1401b21c1]
mov ecx, 0x200
mov edx, 4
call fcn.140008480
test rax, rax
je 0x1400e09dd
xor ecx, ecx
lea rdx, [0x14014e320]
movdqa xmm0, xmmword [0x14010c410]
nop word cs:[rax + rax]
movdqu xmm1, xmmword [rcx + rdx]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rcx], xmm2
add rcx, 0x10
cmp rcx, 0x200
jne 0x1400e0920
mov rcx, rax
add rcx, 0x200
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 0x40
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rcx
lea rcx, [rbp - 0x38]
lea rdx, [rbp - 0x20]
call fcn.1400d9310
mov rax, qword [rbp - 0x28]
test rax, rax
mov qword [rbp - 0x10], rax
movups xmm0, xmmword [rbp - 0x38]
movaps xmmword [rbp - 0x20], xmm0
sete byte [rbp - 8]
lea rcx, [rbp - 0x20]
call fcn.1400e6c00
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, rsi
add rsp, 0x68
pop rsi
pop rbp
ret
mov ecx, 4
mov edx, 0x200
call fcn.14010a860
ud2
Function at 0x1400e9840
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x1400e98d0
jmp 0x1400e98bf
jae 0x1400e9990
cmp r8, 0x201
jae 0x1400e98d0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x1400e9928
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x1400e98ff
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.140109ac0
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x1400e9951
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400e99f8
mov r8d, r14d
cmp r15, r8
jne 0x1400e98b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400e9a1b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x1400e98bf
jmp 0x1400e98d0
cmp rsi, r8
jb 0x1400e9a35
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.1400ecc70
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x1400e99e1
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.140008490
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x1400e99c9
jmp 0x1400e99e1
lea rcx, str.internal_error:_entered_unreachable_code_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14010ab60
jmp 0x1400e9a4a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.14010aff0
ud2
Function at 0x1400e9aa0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4a8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x420], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
call fcn.1400f58b0
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x408], rax
test rax, rax
je 0x1400e9c26
mov qword [rbp + 0x400], rsi
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x418], rax
mov qword [rbp + 0x3e8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x410], rax
xor edi, edi
xor ebx, ebx
xor r13d, r13d
cmp r8, 0x201
jae 0x1400e9b60
jmp 0x1400e9b4f
jae 0x1400e9c38
cmp r8, 0x201
jae 0x1400e9b60
mov r15d, 0x200
lea r14, [rbp - 0x60]
mov r12, r8
jmp 0x1400e9bb8
sub r8, r13
sub rbx, r13
cmp rbx, r8
jae 0x1400e9b8f
lea rcx, [rbp + 0x3e8]
mov rdx, r13
call fcn.140109ac0
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x410], rax
mov rdi, qword [rbp + 0x3f0]
mov eax, 0xffffffff
cmp rdi, rax
mov r13d, 0xffffffff
cmovb r13, rdi
mov qword [rbp + 0x3f8], r13
mov rbx, rdi
mov r15, r13
mov r14, qword [rbp + 0x410]
mov r12, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rbp + 0x408]
mov rdx, r14
mov r8d, r12d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x1400e9be7
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400e9d0b
mov r8d, esi
cmp r12, r8
jne 0x1400e9b40
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400e9d35
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x1400e9b4f
jmp 0x1400e9b60
lea rcx, [rbp - 0x58]
call fcn.1400e7790
mov byte [rsi + 0x18], 2
jmp 0x1400e9cca
cmp r15, r8
jb 0x1400e9d4f
lea rcx, [rbp + 0x3a0]
mov rdx, r14
call fcn.1400ecc70
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
movaps xmmword [rbp + 0x3d0], xmm1
movaps xmmword [rbp + 0x3c0], xmm0
test rdi, rdi
je 0x1400e9c89
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x410]
mov rdx, rdi
call fcn.140008490
cmp byte [rbp + 0x3d8], 2
jne 0x1400e9ce1
mov rsi, qword [rbp + 0x400]
mov byte [rsi + 0x18], 2
lea rcx, [rbp + 0x3c0]
call fcn.1400e7790
mov rdx, qword [rbp + 0x418]
test rdx, rdx
je 0x1400e9cca
add rdx, rdx
mov r8d, 2
mov rcx, qword [rbp + 0x408]
call fcn.140008490
mov rax, rsi
add rsp, 0x4a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movaps xmm0, xmmword [rbp + 0x3c0]
movaps xmm1, xmmword [rbp + 0x3d0]
mov rsi, qword [rbp + 0x400]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x418]
test rdx, rdx
jne 0x1400e9cb5
jmp 0x1400e9cca
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 0x3c0], rax
mov byte [rbp + 0x3d8], 2
test rdi, rdi
jne 0x1400e9c71
jmp 0x1400e9c89
lea rcx, str.internal_error:_entered_unreachable_code_rustc_82e1608dfa6e0b5569232559e3d385fea5a93112library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.14010ab60
jmp 0x1400e9d64
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, r15
mov r8, rax
call fcn.14010aff0
ud2
Function at 0x1400f34a0
Capabilities:
Read file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14018fb00]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x1400f34e4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x1400f3543
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0xc0000011
jne 0x1400f3552
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x1400f358a
cmp eax, 0x103
je 0x1400f3594
test eax, eax
js 0x1400f356f
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
mov qword [rsi], 0
jmp 0x1400f358a
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 1
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x14018fb60]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1400ec8a0
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.1400e7930
mov ecx, 7
int 0x29
ud2

Function at 0x1400f3600
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x14018fb00]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x1400f3644
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x1400f36aa
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x1400f36e1
test eax, eax
js 0x1400f36bb
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x1400f36d4
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, [0x14018fb60]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.1400ec8a0
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.1400e7930
mov ecx, 7
int 0x29
ud2
Function at 0x1400f4c70
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rdx, [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x1400f4ca8
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x38
ret
call fcn.1400f4cc0
nop
add rsp, 0x38
ret

Function at 0x1400f4cc0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x80]
mov qword [rbp - 8], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
lea rcx, [rbp - 0x20]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x1400f4d03
mov rax, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
add rsp, 0x80
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x10]
mov qword [rbp - 0x30], rax
lea rax, [0x1400eb160]
mov qword [rbp - 0x28], rax
lea rax, str.fallback_RNG_broken:
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x40], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rdx, str.library_std_src_syswindows_rand.rs
lea rcx, [rbp - 0x60]
call fcn.14010aab0
ud2
Function at 0x140103100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14010317a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140103170
cmp r11, r10
ja 0x140103213
cmp r10, rdx
ja 0x140103227
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140103172
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140103150
jmp 0x1401031e7
ja 0x14010317a
mov r11, r10
cmp rax, r8
jne 0x140103122
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x1401031eb
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x1401031c0
mov r8, r10
sub ecx, r9d
jns 0x1401031de
jmp 0x1401031ed
cmp r10, rdx
je 0x1401031f9
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x1401031ed
xor al, 1
cmp r8, rdx
jne 0x1401031a0
jmp 0x1401031ed
xor eax, eax
jmp 0x1401031ed
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14010ab60
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14010b070
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14010aff0
ud2

Function at 0x140104ca0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140104cea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140104cea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140104cea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140104cea
cmp dword [rcx + 0x84], 0xe
jbe 0x140104cea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140104cec
xor al, al
add rsp, 0x28
ret

Function at 0x140104f8c
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
call fcn.14005da6c
xor rax, 0xffffffff9fcd9ac0
xor rdi, 0xfffffffff57037ac
or qword [0x1401b28f9], rax
xchg rdi, rax
sub rax, 0xffffffffaf4226d5
call 0xef527685

Function at 0x14010500b
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
movsb byte [rdi], byte [rsi]
cmp dword [rax + 1], ecx
or eax, 0xad67b
jnp 0x140104fe3
or al, byte [rax]
add rax, qword [0x1401b2f38]
rol rax, 0x1c
call fcn.1400a7718
cli
dec dword [rax + 0x29]
xor eax, 0xad497
or al, byte [rax]
xor rbx, rdx
Function at 0x1401059f0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3

Disassembly:
mov edx, 0xf7480378
fisttp dword [rax + 0x23]
sbb eax, 0xac67a

Function at 0x140105a70
Capabilities:
Hash data using murmur3

Disassembly:
xor rdx, qword [0x1401b2c10]
call fcn.140060d5d
ror rax, 0x11
sub rbx, 0x73d0a9e0
xor qword [0x1401b292c], rdi
add rdx, qword [0x1401b2edc]
xor qword [0x1401b23dc], rbx
add rdx, qword [0x1401b2ce3]
ror rax, 0x1a
xor rdx, rbp
or qword [0x1401b2685], rbx
call fcn.1400bfcc3
dec rdi
xor qword [0x1401b27f3], rdx
mov qword [0x1401b252f], rsi
inc rdi
call fcn.1400230f3
and qword [0x1401b27b3], rcx
xor rdx, rbp
rol rax, 0x1a
add rsi, qword [0x1401b2cf3]
and qword [0x1401b2922], rcx
or rdi, qword [0x1401b2d07]
add rbx, 0x73d0a9e0
rol rax, 0x11
call fcn.14006194e
xor rax, rcx
add qword [0x1401b28b6], rsi
inc rbx
sub rdx, rbx
xor rbx, rcx
neg rsi
add rcx, qword [0x1401b2b01]
mov rdi, rsp
add qword [0x1401b2511], rcx
xor rax, rdx
sub qword [0x1401b262c], 0x8c5c658
xor rdi, rsp
xor rbx, 0xffffffffd3883268
add rdi, 0x34ba08d
xor rdi, 0xffffffff99bb68e9
not rcx
ror rdi, 0xb
dec rsi
call fcn.140055e8b
inc rsi
rol rdi, 0xb
not rcx
xor rdi, 0xffffffff99bb68e9
sub rdi, 0x34ba08d
xor rbx, 0xffffffffd3883268
xor rdi, rsp
xor rax, rdx
add qword [0x1401b25d5], rcx
and rdi, 0xf
or rbx, qword [0x1401b2baa]
xor rsi, qword [0x1401b2e9b]
sub qword [0x1401b2850], rsi
neg rcx
or rax, qword [0x1401b2be6]
rol rcx, 0x1c
call fcn.1400245e5
xor rbx, 0x23494ec5
inc rbx
call fcn.14001178c
and qword [0x1401b2479], rdx
and qword [0x1401b24fb], 0x32fb3870
add rsi, 0x48747064
neg rdx
dec rsi
ror rdi, 8
or rdi, qword [0x1401b2ba9]
add rdx, qword [0x1401b2fa8]
rol rdi, 8
inc rsi
neg rdx
sub rsi, 0x48747064
xor qword [0x1401b2554], 0xffffffffa2f18981
call fcn.140021915
dec rbx
xor rbx, 0x23494ec5
call fcn.1400efabb
ror rcx, 0x1c
or rdx, qword [0x1401b2cc2]
neg rcx
mov qword [0x1401b23f7], rbx
xor rsi, qword [0x1401b2ab9]
sub rsp, rdi
dec rbx
or rcx, qword [0x1401b2d23]
mov qword [0x1401b240c], rbx
add rdi, qword [0x1401b2b22]
xor rbx, qword [0x1401b2ab7]
and qword [0x1401b28ad], 0xffffffffaa1b6691
add rcx, rdi
add qword [0x1401b257e], 0x5a149206
not rbx
xchg rax, rsi
sub rbx, 0xffffffffb776b137
inc rdx
not rdi
Function at 0x1401060e0
Capabilities:
Hash data using murmur3

Disassembly:
inc rsi
call fcn.1400947b8
not rbx
call fcn.14000698b
call fcn.14009766d
not rbx
call fcn.1400ac67a
dec rsi
neg rcx
add rdi, rbp
mov qword [0x1401b245a], rdx
xor rcx, rdx
call fcn.140079ec2
xor rsi, 0x3010d56
xchg rsi, rax
not rdx
xor rax, rsp
xor ebx, 0xb3a1aa31
dec rsi
add qword [0x1401b26b1], rsi
call fcn.140078da3
sub rdx, qword [0x1401b2d2f]
rol rdi, 0x1d
sub rsi, qword [0x1401b2be9]
inc rsi
xor qword [0x1401b27eb], rdi
mov qword [0x1401b25b6], rdi
xor rdx, rax
xor rdi, 0x2b9d32aa
xor rdi, rsi
rol rax, 2
or qword [0x1401b264b], 0x9b1652b
sub rax, rdx
add rax, rdx
ror rax, 2
xor rdi, rsi
xor rdi, 0x2b9d32aa
xor rdx, rax
sub qword [0x1401b296e], rax
add qword [0x1401b2887], rax
dec rsi
xor rbx, qword [0x1401b2db1]
ror rdi, 0x1d
or rdx, qword [0x1401b2a52]
inc rsi
mov dword [rsp + 0x24], ebx
sub rdi, qword [0x1401b2f0b]
sub qword [0x1401b2877], rcx
xchg rax, rsi
or rbx, qword [0x1401b2dab]
ror rsi, 0x15
xor rsi, rbp
sub rbx, qword [0x1401b2ea4]
sub rax, 0xffffffffe2f19c3f
dec rcx
add rsi, 0xffffffff867352b0
inc rax
xor qword [0x1401b2909], 0xffffffff8da8e8f3
dec rax
sub rsi, 0xffffffff867352b0
inc rcx
add rax, 0xffffffffe2f19c3f
xor rsi, rbp
rol rsi, 0x15
or rbx, qword [0x1401b2d8f]
xchg rax, rsi
mov qword [0x1401b259d], rdi
xor rax, qword [0x1401b2e0b]
mov edx, 0xa4a74d2f
neg rdx
xor rsi, rbx
not rdx
xor rax, qword [0x1401b2c0b]
inc rsi
xor rsi, rdi
or qword [0x1401b2894], rax
xor qword [0x1401b2660], rdx
xor rdi, 0xd5caef3
xor rsi, 0x5bb04efd
call fcn.1400c4a1f
xor rsi, 0x5bb04efd
xor rdi, 0xd5caef3
sub qword [0x1401b2823], rax
xor rsi, rdi
dec rsi
sub rbx, qword [0x1401b2ea1]
not rdx
xor rsi, rbx
neg rdx
add edx, 0xedcc5ff1
mov qword [0x1401b255d], 0xffffffffa18b018a
xor rbx, qword [0x1401b2f3e]
add qword [0x1401b24a3], rcx
add rax, qword [0x1401b2bfe]
xchg rdi, rsi
mov qword [0x1401b268b], rsi
dec rdx
xor rax, rsp
inc rbx
neg rsi
call fcn.14009766d
call fcn.14009bad3
neg rsi
dec rbx
xor rax, rsp
inc rdx
or qword [0x1401b2750], rbx
or al, byte [rax]
xchg rdi, rsi
add qword [0x1401b249a], rsi
sub rcx, qword [0x1401b2d5f]
or qword [0x1401b2599], 0x483d64ad
add edx, 0x6d8c52e0
add rsi, rsp
neg rdi
ror rbx, 7
neg rsi
xor rdi, 0xffffffffcd909bc2
xchg rcx, rdx
call fcn.1400bcdf9
xor rdi, rdx
sub rsi, rbx
xor rbx, qword [0x1401b2c41]
xor qword [0x1401b2727], rbx
not rsi
call fcn.14008cfcd
call fcn.1400c484d
not rsi
xor rdi, qword [0x1401b2ba0]
add rsi, rbx
xor rdi, rdx
call fcn.14007db02
xchg rcx, rdx
xor rdi, 0xffffffffcd909bc2
neg rsi
rol rbx, 7
neg rdi
sub rsi, rsp
mov dword [rsp + 0x28], edx
xor rax, qword [0x1401b2ec9]
xor rcx, 0xffffffffdeaaf11d
sub rcx, qword [0x1401b2e18]
or rcx, qword [0x1401b2be5]
xor rdi, 0xffffffffb57852b6
sub rbx, rdx
add rsi, qword [0x1401b2f96]
mov qword [0x1401b2428], 0xffffffffbe8fb8d9
inc rsi
invalid
push rax
add dl, dh
Function at 0x140106490
Capabilities:
Hash data using murmur3

Disassembly:
rol rdi, 0x1b
add rdx, rax
call fcn.1400d82c9
inc rax
add qword [0x1401b252a], rax
ror rcx, 0xd
add qword [0x1401b26f9], 0x4abe7937
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
add rsi, qword [0x1401b2eb8]
sub qword [0x1401b2635], rsi
call fcn.1400478e2
dec rdx
xchg rcx, rax
xor rdx, rbx
and qword [0x1401b2471], rdi
add rax, qword [0x1401b2e6f]
sub qword [0x1401b2741], 0x5cdc639e
or rdi, qword [0x1401b2f85]
call fcn.14008bbe9
xor rdx, qword [0x1401b2ef8]
call fcn.1400bd6d9
or rbx, qword [0x1401b2a66]
mov qword [0x1401b26ef], 0x3be53615
inc rcx
xor rbx, rax
dec rsi
not rcx
rol rax, 3
call fcn.14009a70b
call fcn.1400c113c
ror rax, 3
not rcx
inc rsi
xor rbx, rax
dec rcx
or qword [0x1401b25c8], 0x20bf3ef9
add rax, qword [0x1401b2def]
add eax, dword [0x1401b2def]
call fcn.1400b2a6d
call fcn.1400451a4
sub rcx, qword [0x1401b2b2c]
add rsi, qword [0x1401b2ad7]
add qword [0x1401b23df], rdx
xor rdx, rbx
xchg rcx, rax
inc rdx
mov qword [0x1401b2423], rax
add rsp, rdi
neg rbx
sub rcx, qword [0x1401b2b52]
xor rsi, rcx
add rsi, rsp
and qword [0x1401b26c8], rbx
rol rsi, 0xe
mov qword [0x1401b28fa], rbx
sub rcx, 0xffffffffbb857553
dec rsi
xchg rbx, rax
dec rsi
sub rbx, 0x39808793
xor rcx, qword [0x1401b2bea]
dec rax
ror rdx, 0xc
dec rsi
sub rdi, qword [0x1401b2dae]
xor rdx, qword [0x1401b2e02]
rol rdi, 0x1a
call fcn.1400acfaa
call fcn.1400e3177
call fcn.1400e3765
call fcn.140059c0b
ror rdi, 0x1a
xor rsi, qword [0x1401b2dd9]
inc rsi
rol rdx, 0xc
inc rax
add rbx, qword [0x1401b2c79]
add rbx, 0x39808793
inc rsi
invalid
invalid
Function at 0x140001f90
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x1400500d0]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor edx, edx
mov qword [rsp + 0x38], rcx
lea rax, str.runas
mov dword [rsp + 0x20], WSACleanup
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x20]
lea rax, [0x140049270]
mov dword [rsp + 0x24], 0x40
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x50], 5
mov qword [rsp + 0x58], rdx
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140013430
add rsp, 0xa8
ret