joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800b4e2b
Capabilities:
Encode data using xor

Disassembly:
jmp 0x18017c690
mov rax, rcx
neg rcx
test rax, 7
je 0x18017c6ad
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x18017c708
test al, 7
jne 0x18017c6a0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x18017c6c1
mov rdx, qword [rax - 8]
test dl, dl
je 0x18017c732
test dh, dh
je 0x18017c72c
shr rdx, 0x10
test dl, dl
je 0x18017c726
test dh, dh
je 0x18017c720
shr rdx, 0x10
test dl, dl
je 0x18017c71a
test dh, dh
je 0x18017c714
shr edx, 0x10
test dl, dl
je 0x18017c70e
test dh, dh
jne 0x18017c6c1
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x1800b570e
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x18017afa0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.18017a920
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18017afdf
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1802a8020]
jmp 0x18017afe9
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret
Function at 0x1800b5b55
Capabilities:
Query environment variable

Disassembly:
jmp 0x1801f1f80
sub rsp, 0xb8
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1801f1db0
lea rcx, [rsp + 0x40]
call fcn.1801f1f30
movzx eax, al
test eax, eax
jne 0x1801f1fc8
mov qword [rsp + 0x70], 0
lea rcx, [rsp + 0x40]
call fcn.1801f1de0
mov rax, qword [rsp + 0x70]
jmp 0x1801f2199
lea rcx, [rsp + 0x40]
call fcn.1801f1f00
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call fcn.1801f1ea0
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x40]
call fcn.1801f1f00
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, dword [rsp + 0x68]
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.1800b7810
cdqe
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jne 0x1801f206e
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x40]
call fcn.1801f1de0
mov rax, qword [rsp + 0x80]
jmp 0x1801f2199
mov r9d, 0x66
lea r8, str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
mov edx, 2
mov rcx, qword [rsp + 0x58]
call fcn.1800b54a7
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1800b5128
lea rcx, [rsp + 0x48]
call fcn.1800b4764
movzx eax, al
test eax, eax
jne 0x1801f20d5
mov qword [rsp + 0x88], 0
lea rcx, [rsp + 0x48]
call fcn.1800b24ff
lea rcx, [rsp + 0x40]
call fcn.1801f1de0
mov rax, qword [rsp + 0x88]
jmp 0x1801f2199
lea rcx, [rsp + 0x48]
call fcn.1800b6302
mov qword [rsp + 0x90], rax
lea rcx, [rsp + 0x40]
call fcn.1801f1f00
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x68]
mov r8, qword [rsp + 0x98]
xor edx, edx
xor ecx, ecx
call fcn.1800b7810
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
jne 0x1801f216b
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0x48]
call fcn.1800b24ff
lea rcx, [rsp + 0x40]
call fcn.1801f1de0
mov rax, qword [rsp + 0xa0]
jmp 0x1801f2199
lea rcx, [rsp + 0x48]
call fcn.1800b508d
mov qword [rsp + 0xa8], rax
lea rcx, [rsp + 0x48]
call fcn.1800b24ff
lea rcx, [rsp + 0x40]
call fcn.1801f1de0
mov rax, qword [rsp + 0xa8]
add rsp, 0xb8
ret

Function at 0x1800b5b8c
Capabilities:
Allocate thread local storage

Disassembly:
jmp 0x18017aed0
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.18017a8a0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18017af11
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1802a8020]
jmp 0x18017af17
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
add rsp, 0x48
ret
Function at 0x1800b5cb8
Capabilities:
Get geographical location

Disassembly:
jmp 0x1801eaaa0
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x58
call fcn.1801e9a10
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1801eab07
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x40], rax
movabs r10, 0xe375262d7cd44270
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x40]
call qword [0x1802a8030]
jmp 0x1801eab29
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1800b466f
mov r9d, dword [rsp + 0x78]
mov r8, qword [rsp + 0x70]
mov edx, dword [rsp + 0x68]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
add rsp, 0x58
ret

Function at 0x1800b5cf4
Capabilities:
Terminate process

Disassembly:
jmp 0x18015a6e0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1800b6276
Capabilities:
Print debug messages

Disassembly:
jmp 0x1802097f0
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x180283158]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x180209816
jmp 0x180209893
mov rcx, qword [rbp + 0x30]
call fcn.1800b4e2b
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x18020982f
jmp 0x180209893
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x18020984c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1800b28c4
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.1800b3378
test eax, eax
jne 0x180209893
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1800b5344
lea rsp, [rbp + 0x20]
pop rbp
ret

Function at 0x1800b7c5c
Capabilities:
Terminate process

Disassembly:
jmp 0x18017c540
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x18017c56e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.1800b90ed
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1800b9197
Capabilities:
Print debug messages

Disassembly:
jmp 0x1801e8170
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x1800b9395
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x18017b010
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.18017a960
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x18017b059
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x1802a8020]
jmp 0x18017b068
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x1800ba8d5
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x180154de0
mov byte [rsp + 0x10], dl
mov dword [rsp + 8], ecx
push rbp
sub rsp, 0x40
mov rbp, rsp
movsx eax, byte [rbp + 0x58]
mov ecx, dword [rbp + 0x50]
xor ecx, eax
mov eax, ecx
mov eax, eax
imul rax, rax, 0x1000193
lea rsp, [rbp + 0x40]
pop rbp
ret
Function at 0x18021bef0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1800b28c4
sub rsp, rax
mov rax, qword [0x180283158]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1802874a0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x18021c0e2
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x18021c036
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x18021c036
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x18021c01b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x18021bfb8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18021c0a2
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x18021c101
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x18021c0dd
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x18021c101
jmp 0x18021bf8e
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1800b5344
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x18021c1b0
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1800b28c4
sub rsp, rax
mov rax, qword [0x180283158]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x1802874a0]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x18021c3bd
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x18021c309
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x18021c309
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x18021c2e9
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x18021c278
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18021c37d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x18021c3dc
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x18021c3b8
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x18021c3dc
jmp 0x18021c24e
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1800b5344
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x140001920
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
call fcn.140001b70
test eax, eax
js 0x140001b5e
mov eax, dword [rbx + 0xf0]
xor r10d, r10d
shl eax, 2
movsxd r9, eax
test eax, eax
jle 0x1400019a9
lea r8, [rbx + 8]
lea rax, [rbx + 8]
lea r8, [r8 + r9*4]
nop word [rax + rax]
mov ecx, dword [r8 - 8]
mov edx, dword [rax - 8]
add r10, 4
mov dword [rax - 8], ecx
mov ecx, dword [r8 - 4]
mov dword [r8 - 8], edx
mov edx, dword [rax - 4]
mov dword [rax - 4], ecx
mov ecx, dword [r8]
mov dword [r8 - 4], edx
mov edx, dword [rax]
mov dword [rax], ecx
mov ecx, dword [r8 + 4]
mov dword [r8], edx
mov edx, dword [rax + 4]
mov dword [rax + 4], ecx
sub r9, 4
mov dword [r8 + 4], edx
lea r8, [r8 - 0x10]
lea rax, [rax + 0x10]
cmp r10, r9
jl 0x140001960
mov r11d, 1
cmp dword [rbx + 0xf0], r11d
jle 0x140001b5c
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 2]
lea rdi, [0x140000000]
nop dword [rax]
mov r8d, dword [r10 + 0xe]
lea r10, [r10 + 0x10]
inc r11d
mov eax, r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0xe2560]
movzx eax, byte [r10 - 1]
movzx ecx, byte [rdi + rax*4 + 0xe2560]
mov r9d, dword [rdi + rdx*4 + 0xe2960]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0xe3160]
movzx ecx, byte [rdi + rax*4 + 0xe2560]
movzx eax, byte [r10]
xor r9d, dword [rdi + rcx*4 + 0xe3560]
movzx ecx, byte [rdi + rax*4 + 0xe2560]
movzx eax, byte [r10 + 3]
movzx edx, byte [rdi + rax*4 + 0xe2560]
xor r9d, dword [rdi + rcx*4 + 0xe2d60]
movzx eax, byte [r10 + 4]
movzx ecx, byte [rdi + rax*4 + 0xe2560]
mov r8d, dword [rdi + rdx*4 + 0xe3160]
mov dword [r10 - 2], r9d
xor r8d, dword [rdi + rcx*4 + 0xe2d60]
mov r9d, dword [r10 + 2]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0xe2560]
movzx eax, r9b
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0xe2960]
movzx ecx, byte [rdi + rax*4 + 0xe2560]
movzx eax, byte [r10 + 7]
xor r8d, dword [rdi + rcx*4 + 0xe3560]
movzx edx, byte [rdi + rax*4 + 0xe2560]
movzx eax, byte [r10 + 8]
movzx ecx, byte [rdi + rax*4 + 0xe2560]
mov dword [r10 + 2], r8d
mov r8d, dword [rdi + rdx*4 + 0xe3160]
xor r8d, dword [rdi + rcx*4 + 0xe2d60]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0xe2560]
movzx eax, r9b
mov r9d, dword [r10 + 0xa]
xor r8d, dword [rdi + rcx*4 + 0xe2960]
movzx ecx, byte [rdi + rax*4 + 0xe2560]
movzx eax, byte [r10 + 0xb]
xor r8d, dword [rdi + rcx*4 + 0xe3560]
movzx edx, byte [rdi + rax*4 + 0xe2560]
movzx eax, byte [r10 + 0xc]
movzx ecx, byte [rdi + rax*4 + 0xe2560]
mov dword [r10 + 6], r8d
mov r8d, dword [rdi + rdx*4 + 0xe3160]
xor r8d, dword [rdi + rcx*4 + 0xe2d60]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0xe2560]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0xe2960]
movzx ecx, byte [rdi + rax*4 + 0xe2560]
xor r8d, dword [rdi + rcx*4 + 0xe3560]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x1400019d0
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140003800
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x5c]
call fcn.1400cd3b0
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x140005ad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
movzx ecx, byte [rcx]
or eax, 0xffffffff
test cl, cl
je 0x140005b7a
movzx edx, cl
lea r8, [r8 + 1]
xor eax, edx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
movzx ecx, byte [r8]
test cl, cl
jne 0x140005ae1
not eax
ret
Function at 0x1400b2210
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
cmp byte [rcx + 8], 0
mov r9, rcx
je 0x1400b224c
xor ecx, ecx
cmp dword [r9 + 0x3d0], ecx
jle 0x1400b2247
sub r8, rdx
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
inc ecx
lea rdx, [rdx + 1]
xor byte [rdx - 1], al
cmp ecx, dword [r9 + 0x3d0]
jl 0x1400b2230
add rsp, 0x48
ret
lea rdx, [0x140108030]
lea rcx, [rsp + 0x20]
call fcn.1400cf054
lea rdx, [0x1401067d0]
lea rcx, [rsp + 0x20]
call fcn.1400ccb88
int3
Function at 0x1400b44c0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov dword [rcx], 0x6a09e667
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov dword [rcx + 0x1c], 0x5be0cd19
ret
Function at 0x1400c5830
Capabilities:
Check http status code

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xb0
mov qword [rbp - 0x49], 0xfffffffffffffffe
mov rsi, rcx
xor r14b, r14b
call fcn.140005990
movzx edx, al
lea rcx, [rbp + 0x7f]
call fcn.140062280
nop
mov rdx, qword [rax]
mov qword [rbp + 0x17], 0xf
xor r15d, r15d
mov qword [rbp + 0xf], r15
mov byte [rbp - 1], r15b
or rdi, 0xffffffffffffffff
cmp byte [rdx], r15b
jne 0x1400c588b
mov r8d, r15d
jmp 0x1400c5899
mov r8, rdi
nop
inc r8
cmp byte [rdx + r8], r15b
jne 0x1400c5890
lea rcx, [rbp - 1]
call fcn.140003e40
xor ecx, ecx
call fcn.1400c5100
mov r8d, eax
mov r12d, 1
mov r9d, r12d
lea rdx, [rbp - 1]
mov rcx, rsi
call fcn.1400be520
nop
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1400c58da
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
cmp byte [rsi + 0x20], 0
je 0x1400c59e1
xor edx, edx
lea rcx, [rbp - 0x21]
call fcn.1400c5720
mov rbx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400c58fc
mov rbx, qword [rax]
lea rcx, [rbp - 0x41]
call fcn.1400c0ed0
mov rdi, rax
lea rcx, [rbp + 0x77]
call fcn.1400be600
mov r8, rax
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], 0x4080000
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov r9, rdi
mov rdx, rbx
mov rcx, qword [rsi + 0x30]
call fcn.1400aa250
mov rbx, rax
cmp qword [rbp - 9], 0x10
jb 0x1400c594d
mov rcx, qword [rbp - 0x21]
call fcn.1400cc508
mov qword [rbp - 9], 0xf
mov qword [rbp - 0x11], r15
mov byte [rbp - 0x21], 0
lea rdi, [rbp + 0x77]
xor eax, eax
mov ecx, 2
rep stosb byte [rdi], al
lea rdi, [rbp + 0x79]
mov ecx, 4
rep stosb byte [rdi], al
lea rdi, [rbp - 0x41]
mov ecx, 9
rep stosb byte [rdi], al
lea rdi, [rbp - 0x37]
mov ecx, 0x12
rep stosb byte [rdi], al
test rbx, rbx
je 0x1400c59d9
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1400aa3e0
mov dword [rbp + 0x67], r15d
mov dword [rbp + 0x6f], 4
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x6f]
lea r8, [rbp + 0x67]
mov edx, 0x20000013
mov rcx, rbx
call fcn.1400aa330
movzx r14d, r14b
cmp dword [rbp + 0x67], 0xc8
cmove r14d, r12d
mov rcx, rbx
call fcn.1400aa520
mov rcx, rsi
call fcn.1400c4d80
movzx eax, r14b
add rsp, 0xb0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1400cdff8
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400cde60
Function at 0x180003b10
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword gs:[0x60]
mov rbp, rdx
mov r14, rcx
mov rsi, qword [rax + 0x18]
add rsi, 0x10
mov rdi, qword [rsi]
cmp rdi, rsi
je 0x180003bb6
movzx ebx, word [rdi + 0x58]
xor eax, eax
shr rbx, 1
je 0x180003ba5
mov r10, qword [rdi + 0x60]
nop dword [rax]
nop dword [rax + rax]
movzx edx, word [r10]
movsx r11d, byte [rax + rbp]
movzx r9d, r11w
lea ecx, [rdx - 0x61]
cmp cx, 0x19
lea r8d, [rdx - 0x20]
lea ecx, [r9 - 0x61]
cmova r8w, dx
cmp cx, 0x19
lea edx, [r9 - 0x20]
cmova dx, r11w
cmp r8w, dx
jne 0x180003bae
test r11b, r11b
je 0x180003bae
inc rax
add r10, 2
cmp rax, rbx
jb 0x180003b60
mov rax, qword [rdi + 0x30]
mov qword [r14], rax
jmp 0x180003bbd
mov rdi, qword [rdi]
cmp rdi, rsi
jne 0x180003b45
mov qword [r14], 0
mov rbx, qword [rsp + 0x10]
mov rax, r14
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x18000be70
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
xor ebx, ebx
cmp edx, 1
jne 0x18000bfb6
cmp qword [0x180013028], rbx
jne 0x18000bfb6
lea rax, [0x180013520]
mov qword [0x180013520], 0xf4240
mov qword [0x180013030], rax
lea rdx, str.SDL3.dll
lea rax, [0x180013030]
mov qword [0x180013528], rbx
lea rcx, [rsp + 0x68]
mov qword [0x180013028], rax
mov byte [0x180013518], bl
call fcn.180003b10
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x18000bf4a
mov edx, 0x5a4d
mov rcx, rax
cmp word [rax], dx
cmovne rcx, rbx
test rcx, rcx
je 0x18000bf4a
movsxd r8, dword [rcx + 0x3c]
add r8, rax
cmp dword [r8], 0x4550
cmovne r8, rbx
test r8, r8
je 0x18000bf4a
movzx edx, word [r8 + 0x14]
movzx ecx, word [r8 + 6]
add rdx, 0x18
add rdx, r8
lea rcx, [rcx + rcx*4]
lea r8, [rdx + rcx*8]
cmp rdx, r8
je 0x18000bf4a
test dword [rdx + 0x24], 0x20000000
je 0x18000bf41
cmp dword [rdx], 0x7865742e
jne 0x18000bf41
cmp byte [rdx + 4], 0x74
je 0x18000bfd7
add rdx, 0x28
cmp rdx, r8
jne 0x18000bf26
mov rcx, rbx
mov rax, rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x28], rcx
lea rcx, [0x180013038]
mov qword [rsp + 0x20], rax
call fcn.180005fa0
lea r9, [rsp + 0x20]
mov byte [0x180013518], 0xff
lea r8, [rsp + 0x68]
xor edx, edx
lea rcx, [0x180013038]
call fcn.180001010
mov rcx, qword [0x180013038]
mov byte [0x180013518], 1
test rcx, rcx
je 0x18000bfb6
mov rax, qword [rcx]
mov qword [0x180013040], rax
lea rax, [0x18000d0c3]
mov qword [rcx], rax
lea rdx, [0x18000c254]
lea rcx, section..text
mov rax, rdx
sub rax, rcx
cmp rdx, rcx
cmovb rax, rbx
add rsp, 0x40
pop rbx
ret
mov ecx, dword [rdx + 0xc]
add rcx, rax
mov eax, dword [rdx + 8]
jmp 0x18000bf50