joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140106d60
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov r14, r8
mov rsi, rdx
mov rbp, rcx
mov qword [rsp + 0x28], rcx
xor r15d, r15d
mov ecx, dword [0x14059e730]
call fcn.140106840
test al, al
jne 0x140106dd1
mov ecx, dword [0x14059e734]
call fcn.140106840
test al, al
jne 0x140106dd1
mov ecx, dword [0x14059e738]
call fcn.140106840
test al, al
jne 0x140106dd1
mov ecx, dword [0x14059e73c]
call fcn.140106840
test al, al
jne 0x140106dd1
xor edx, edx
lea rcx, [0x1400ecb80]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x140106e86
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140106e66
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140106e66
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x4f7b6be0
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140106e61
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140106e40
cmp r8d, 0x642f93b0
je 0x140106e6b
test r9d, r9d
jne 0x140106e20
mov rax, qword [rax]
jmp 0x140106df0
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.140106b10
nop
mov r9, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
jbe 0x140106ea2
mov rsi, qword [rsi]
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.1400e0a40
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140106f1c
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140106f17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140106f17
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140127e30
mov rax, rbp
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140107070
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x30
mov rbp, rcx
mov rsi, rdx
mov ecx, dword [0x14059e730]
call fcn.140106840
test al, al
jne 0x1401070d0
mov ecx, dword [0x14059e734]
call fcn.140106840
test al, al
jne 0x1401070d0
mov ecx, dword [0x14059e738]
call fcn.140106840
test al, al
jne 0x1401070d0
mov ecx, dword [0x14059e73c]
call fcn.140106840
test al, al
jne 0x1401070d0
xor edx, edx
lea rcx, [0x1400ecb80]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x140107191
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140107167
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140107167
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xaa14b916
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140107162
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140107140
cmp r8d, 0x97a3f87e
je 0x14010716c
test r9d, r9d
jne 0x140107120
mov rax, qword [rax]
jmp 0x1401070f0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rcx, rbp
call fcn.1401071c0
lea r8, [rbp + 9]
mov rdx, rbp
lea r9, [rsp + 0x48]
mov rcx, rsi
call fcn.140106f40
mov rbp, qword [rsp + 0x58]
mov rax, rsi
add rsp, 0x30
pop rsi
ret
Function at 0x1401071c0
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x14059e730]
call fcn.140106840
test al, al
jne 0x140107219
mov ecx, dword [0x14059e734]
call fcn.140106840
test al, al
jne 0x140107219
mov ecx, dword [0x14059e738]
call fcn.140106840
test al, al
jne 0x140107219
mov ecx, dword [0x14059e73c]
call fcn.140106840
test al, al
jne 0x140107219
xor edx, edx
lea rcx, [0x1400ecb80]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x1401072e1
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1401072b7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1401072b7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xd952e8d4
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1401072b2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140107290
cmp r8d, 0xc4699ce4
je 0x1401072bc
test r9d, r9d
jne 0x140107270
mov rax, qword [rax]
jmp 0x140107240
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
cmp byte [rsi + 0xa], 0
je 0x140107303
xor ecx, ecx
nop dword [rax]
lea eax, [rcx + 6]
xor byte [rcx + rsi], al
inc rcx
cmp rcx, 9
jb 0x1401072f0
mov byte [rsi + 0xa], 0
add rsp, 0x20
pop rsi
ret
Function at 0x140107310
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x14059e730]
call fcn.140106840
test al, al
jne 0x140107375
mov ecx, dword [0x14059e734]
call fcn.140106840
test al, al
jne 0x140107375
mov ecx, dword [0x14059e738]
call fcn.140106840
test al, al
jne 0x140107375
mov ecx, dword [0x14059e73c]
call fcn.140106840
test al, al
jne 0x140107375
xor edx, edx
lea rcx, [0x1400ecb80]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, rsi
call fcn.1401075a0
mov rax, rsi
add rsp, 0x20
pop rsi
ret
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140107407
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140107407
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x29ac20d4
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140107402
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1401073e0
cmp r8d, 0xaf1e54e4
je 0x14010740c
test r9d, r9d
jne 0x1401073c0
mov rax, qword [rax]
jmp 0x140107390
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rdi, qword [rsp + 0x38]
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
call fcn.1401075a0
mov rax, rsi
add rsp, 0x20
pop rsi
ret
Function at 0x140107450
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x30
mov rbp, rcx
mov rsi, rdx
mov ecx, dword [0x14059e730]
call fcn.140106840
test al, al
jne 0x1401074b0
mov ecx, dword [0x14059e734]
call fcn.140106840
test al, al
jne 0x1401074b0
mov ecx, dword [0x14059e738]
call fcn.140106840
test al, al
jne 0x1401074b0
mov ecx, dword [0x14059e73c]
call fcn.140106840
test al, al
jne 0x1401074b0
xor edx, edx
lea rcx, [0x1400ecb80]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x140107571
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140107547
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140107547
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xaa14b916
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140107542
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140107520
cmp r8d, 0x97a3f87e
je 0x14010754c
test r9d, r9d
jne 0x140107500
mov rax, qword [rax]
jmp 0x1401074d0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rcx, rbp
call fcn.1401075a0
lea r8, [rbp + 5]
mov rdx, rbp
lea r9, [rsp + 0x48]
mov rcx, rsi
call fcn.140106f40
mov rbp, qword [rsp + 0x58]
mov rax, rsi
add rsp, 0x30
pop rsi
ret
Function at 0x1401075a0
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x14059e730]
call fcn.140106840
test al, al
jne 0x1401075f9
mov ecx, dword [0x14059e734]
call fcn.140106840
test al, al
jne 0x1401075f9
mov ecx, dword [0x14059e738]
call fcn.140106840
test al, al
jne 0x1401075f9
mov ecx, dword [0x14059e73c]
call fcn.140106840
test al, al
jne 0x1401075f9
xor edx, edx
lea rcx, [0x1400ecb80]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x1401076c1
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140107697
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140107697
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xd952e8d4
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140107692
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140107670
cmp r8d, 0xc4699ce4
je 0x14010769c
test r9d, r9d
jne 0x140107650
mov rax, qword [rax]
jmp 0x140107620
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
cmp byte [rsi + 6], 0
je 0x1401076e3
xor ecx, ecx
nop dword [rax]
lea eax, [rcx + 6]
xor byte [rcx + rsi], al
inc rcx
cmp rcx, 5
jb 0x1401076d0
mov byte [rsi + 6], 0
add rsp, 0x20
pop rsi
ret
Function at 0x1401076f0
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov r14, r8
mov rbp, rdx
mov rsi, rcx
mov qword [rsp + 0x48], rcx
mov ecx, dword [0x14059e730]
call fcn.140106840
test al, al
jne 0x140107759
mov ecx, dword [0x14059e734]
call fcn.140106840
test al, al
jne 0x140107759
mov ecx, dword [0x14059e738]
call fcn.140106840
test al, al
jne 0x140107759
mov ecx, dword [0x14059e73c]
call fcn.140106840
test al, al
jne 0x140107759
xor edx, edx
lea rcx, [0x1400ecb80]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x140107806
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1401077e6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1401077e6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0xa52a666e
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1401077e1
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1401077c0
cmp r8d, 0x639cf236
je 0x1401077eb
test r9d, r9d
jne 0x1401077a0
mov rax, qword [rax]
jmp 0x140107770
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.140107450
mov rbx, rax
lea rdx, [rsp + 0x28]
mov rcx, rbp
call fcn.140107070
nop
mov r9, rbx
mov r8, rax
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.14000c140
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140107878
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140107873
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140107873
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140127e30
movdqa xmm0, xmmword [0x140173540]
movdqu xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x28], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1401078cb
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401078c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1401078c6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140127e30
mov rax, rsi
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401078e0
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x30
mov rbp, rcx
mov rsi, rdx
mov ecx, dword [0x14059e730]
call fcn.140106840
test al, al
jne 0x140107940
mov ecx, dword [0x14059e734]
call fcn.140106840
test al, al
jne 0x140107940
mov ecx, dword [0x14059e738]
call fcn.140106840
test al, al
jne 0x140107940
mov ecx, dword [0x14059e73c]
call fcn.140106840
test al, al
jne 0x140107940
xor edx, edx
lea rcx, [0x1400ecb80]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x140107a01
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1401079d7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1401079d7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xaa14b916
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1401079d2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1401079b0
cmp r8d, 0x97a3f87e
je 0x1401079dc
test r9d, r9d
jne 0x140107990
mov rax, qword [rax]
jmp 0x140107960
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rcx, rbp
call fcn.140107a30
lea r8, [rbp + 6]
mov rdx, rbp
lea r9, [rsp + 0x48]
mov rcx, rsi
call fcn.140106f40
mov rbp, qword [rsp + 0x58]
mov rax, rsi
add rsp, 0x30
pop rsi
ret
Function at 0x140107a30
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x14059e730]
call fcn.140106840
test al, al
jne 0x140107a89
mov ecx, dword [0x14059e734]
call fcn.140106840
test al, al
jne 0x140107a89
mov ecx, dword [0x14059e738]
call fcn.140106840
test al, al
jne 0x140107a89
mov ecx, dword [0x14059e73c]
call fcn.140106840
test al, al
jne 0x140107a89
xor edx, edx
lea rcx, [0x1400ecb80]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x140107b51
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140107b27
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140107b27
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xd952e8d4
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140107b22
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140107b00
cmp r8d, 0xc4699ce4
je 0x140107b2c
test r9d, r9d
jne 0x140107ae0
mov rax, qword [rax]
jmp 0x140107ab0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
cmp byte [rsi + 7], 0
je 0x140107b73
xor ecx, ecx
nop dword [rax]
lea eax, [rcx + 6]
xor byte [rcx + rsi], al
inc rcx
cmp rcx, 6
jb 0x140107b60
mov byte [rsi + 7], 0
add rsp, 0x20
pop rsi
ret
Function at 0x140107b80
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov r14, r8
mov rsi, rdx
mov rbp, rcx
mov qword [rsp + 0x28], rcx
xor r15d, r15d
mov ecx, dword [0x14059e730]
call fcn.140106840
test al, al
jne 0x140107bf1
mov ecx, dword [0x14059e734]
call fcn.140106840
test al, al
jne 0x140107bf1
mov ecx, dword [0x14059e738]
call fcn.140106840
test al, al
jne 0x140107bf1
mov ecx, dword [0x14059e73c]
call fcn.140106840
test al, al
jne 0x140107bf1
xor edx, edx
lea rcx, [0x1400ecb80]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x140107ca6
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140107c86
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140107c86
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x4f7b6be0
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140107c81
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140107c60
cmp r8d, 0x642f93b0
je 0x140107c8b
test r9d, r9d
jne 0x140107c40
mov rax, qword [rax]
jmp 0x140107c10
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.1401078e0
nop
mov r9, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
jbe 0x140107cc2
mov rsi, qword [rsi]
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.1400e0a40
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140107d3c
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140107d37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140107d37
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140127e30
mov rax, rbp
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140107fd0
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov r14, r8
mov rsi, rdx
mov rbp, rcx
mov qword [rsp + 0x28], rcx
xor r15d, r15d
mov ecx, dword [0x14059e730]
call fcn.140106840
test al, al
jne 0x140108041
mov ecx, dword [0x14059e734]
call fcn.140106840
test al, al
jne 0x140108041
mov ecx, dword [0x14059e738]
call fcn.140106840
test al, al
jne 0x140108041
mov ecx, dword [0x14059e73c]
call fcn.140106840
test al, al
jne 0x140108041
xor edx, edx
lea rcx, [0x1400ecb80]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x1401080f6
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1401080d6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1401080d6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x4f7b6be0
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1401080d1
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1401080b0
cmp r8d, 0x642f93b0
je 0x1401080db
test r9d, r9d
jne 0x140108090
mov rax, qword [rax]
jmp 0x140108060
mov edx, dword [rbx + 0x1c]
add rdx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.140107d60
nop
mov r9, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
jbe 0x140108112
mov rsi, qword [rsi]
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.1400e0a40
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14010818c
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140108187
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140108187
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140127e30
mov rax, rbp
mov rbx, qword [rsp + 0x98]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret