joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140092b58
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140092ba2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140092ba2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140092ba2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140092ba2
cmp dword [rcx + 0x84], 0xe
jbe 0x140092ba2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140092ba4
xor al, al
add rsp, 0x28
ret

Function at 0x140092d90
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140092dca
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140092dcf
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140092e18
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x14009be70]
cmp byte [rcx + rax], 0
je 0x140092e18
dec r8
sub rdx, 1
jne 0x140092dfe
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400935dc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.140092ea8
mov ebx, eax
test eax, eax
jne 0x14009360c
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x14009366f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140093666
test al, 0x10
je 0x140093666
bt eax, 0xa
jae 0x14009365f
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.140093680
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x14009365b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x14009365b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
test edi, edi
jne 0x140093666
and dword [rsp + 0x3c], 0
jmp 0x14009366b
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140014200
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140014228
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140014228
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x14004d2fa
Capabilities:
Packed with generic packer

Disassembly:
movabs r8, 0xb1a918158109d23b
mov qword [rsp + 0x30], r8
jb 0x14008293d
mov rsi, qword [rsp + r12 - 0x18d]
lea rax, [rax + r12 + 0x40ba03f6]
add qword [rsp + r11*2 - 0x10000], 0xfffffffffffc64bd

Function at 0x14005b0b8
Capabilities:
Encode data using base64

Disassembly:
and qword [rsp + 0x10], r15
mov rdx, r15
or dx, dx
lea rsi, [rsi - 0x637d3d5a]
call fcn.14004dc85

Function at 0x14007a475
Capabilities:
Encode data using xor

Disassembly:
jbe 0x14005a624
lea r15, [r13 + r13 + 0x5ed388a7]
shl r15w, 0xdc
not qword [rsp + r13*2 - 0x5c575a8]
xchg qword [rsp + r13 - 0x2e2bab0], rbp
mov r15, qword [rsp + r13 - 0x2e2bac8]
mov r9, qword [rsp + r13*8 - 0x1715d750]
call fcn.1400860bd
push rcx
call fcn.14006f66c

Function at 0x14008291b
Capabilities:
Packed with generic packer

Disassembly:
movabs rsi, 0x759c3abc4695ec33
jae 0x14006ea6a
add bpl, sil
ja 0x140076219
push rbp
push rdi
lea rax, [rax + 1]
pushfq
movabs rbp, 0x292d1b8c22a0234
and rbp, 0xffffffff9718c6be
movabs rdi, 0x8b688b99b345d37
push rsi
jb 0x140085fd9
cmp di, 0x6432
mov qword [rsp + 0x38], rax
jl 0x140049089
sti
invalid

Function at 0x140083720
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + r9*2 - 0x1bfde], rax
mov dword [rsp + rcx*2 - 0x1bfde], eax
shl r12d, 0xe8
setbe r9b
push rsi
push rbp
jae 0x14006f512
ja 0x14007541d
shl r9b, 0x46
call fcn.140057692
jno 0x14005795b
sbb ah, dl
insd dword [rdi], dx
insb byte [rdi], dx
movsd dword [rdi], dword [rsi]
mov bl, 0x77
jno 0x1400579ab
adc cl, byte [rbx]
retf 0xa5d2
retf
mov r10, qword [rsp + 0x30]
mov dword [rsp + rsi - 0x14208ff0], esi
je 0x14007c8d7
lea rsp, [rsp + 0x98]
ret
call fcn.140063f84
call fcn.140065237
push rdi
movabs rdi, 0x9e3efa26c5a8b40d
pushfq
add qword [rsp + 0x10], 0xfffffffffffcb7f6
mov qword [rsp + 8], rbp
push r11
xor bp, 0xf70b
mov r11, qword [rsp + 0x10]
mov rdi, r11
add edi, dword [rsp + 0x13]
neg byte [rsp + 0x10]
push rsi
mov rdi, qword [rsp + 0x20]
mov rdi, qword [rdi]
cmp r11, rbp
ja fcn.14005daf3
xor byte [rsp + 0x18], 0x8d
not r11
lea rdi, [rdi + 0x582db2d]
or r11w, word [rsp + 0x1e]
mov rsi, qword [rsp + 0x18]
not r11w
sub ebp, r11d
shr dword [rsp + 0x18], 0x5f
xchg qword [rsp + 0x38], rdi
mov rbp, qword [rsp + 0x28]
not dword [rsp + 0x18]
jae 0x14005795a
shr word [rsp + 0x18], 0x21
and r11b, byte [rsp + 0x1e]
jns 0x14007948e

Function at 0x140085e2c
Capabilities:
Encode data using xor

Disassembly:
or r11w, 0x5a86
mov r11, qword [rsp + r11*8 - 0x2d420]
mov qword [rsp + 0x10], rdi
jae 0x140086159
xor r11d, r11d
shl r11d, 0x36
xchg qword [rsp + r11 + 0x18], rdi
shr r11w, 0x36
xor r11w, r11w
jae 0x140075fb0
Function at 0x1400019b0
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
xor edi, edi
mov r8, rcx
lea rdx, str.rmdir__s__q__
lea rcx, [rsp + 0x30]
call fcn.1400029d0
mov r8, rax
mov rdx, qword [rax + 0x10]
mov r10, qword [rax + 0x18]
mov rax, r10
sub rax, rdx
mov rcx, r8
cmp rax, 1
jb 0x140001a21
lea r9, [rdx + 1]
mov qword [r8 + 0x10], r9
cmp r10, 7
jbe 0x140001a10
mov rcx, qword [r8]
mov eax, dword [0x140005758]
mov word [rcx + rdx*2], ax
mov word [rcx + r9*2], di
jmp 0x140001a3e
mov qword [rsp + 0x20], 1
lea r9, [0x140005758]
mov edx, 1
call fcn.140002d70
mov r8, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], rdi
movups xmm0, xmmword [r8]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [r8 + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [r8 + 0x10], rdi
mov qword [r8 + 0x18], 7
mov word [r8], di
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140001ab8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001ab3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001ab3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400034b0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], di
mov qword [rsp + 0x50], rdi
mov rax, qword [rbx + 0x10]
lea rbx, [rax*2 + 2]
mov rcx, rbx
call fcn.140003734
mov rdi, rax
lea r9, [rsp + 0x58]
cmp qword [rsp + 0x70], 7
cmova r9, qword [rsp + 0x58]
mov qword [rsp + 0x20], rbx
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
sete bl
mov rcx, rdi
call fcn.1400034b0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 7
jbe 0x140001b6a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001b65
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400034b0
movzx eax, bl
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003490
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
Function at 0x140003ebc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003f06
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003f06
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003f06
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003f06
cmp dword [rcx + 0x84], 0xe
jbe 0x140003f06
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003f08
xor al, al
add rsp, 0x28
ret
Function at 0x140001a20
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140001a48
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140001a6e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140001a70
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140001ac9
test ecx, ecx
jle 0x140001aa9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140001ac9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140001ac9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140001af0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140001b12
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140001b28
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140001b44
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140001b46
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140001b82
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140001c1e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140001bbd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140001bfe
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140001c1e
cmp rbx, rax
ja 0x140001bd0
test rbx, rbx
je 0x140001c1e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140002080
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140013040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400020ad
xor eax, eax
jmp 0x140002219
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400020e7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400020e7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002219
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000220c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000212a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002155
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002211
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400021c4
sub eax, 1
je 0x1400021c4
cmp eax, 2
jne 0x14000220c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002211
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400021f2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000220c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002211
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400052a0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140002740
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140013040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002813
cmp byte [rcx + 0x71], 0
je 0x140002813
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000280f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400027d4
sub eax, 1
je 0x1400027d8
cmp eax, 2
jne 0x14000280f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400052a0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002806
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000280f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400027bc
xor al, al
jmp 0x1400027bc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400052a0
add rsp, 0x60
pop rbx
ret
Function at 0x140005040
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140013040]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rcx
lea r9, [rsp + 0x20]
xor edi, edi
mov ecx, 0xb
xor r8d, r8d
mov dword [rsp + 0x20], edi
xor edx, edx
mov ebx, edi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400050d5
test rbx, rbx
je 0x14000509b
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140005085
test eax, eax
jns 0x1400050f6
test rbx, rbx
je 0x1400050fb
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x1400051bd
test rbx, rbx
jne 0x140005102
xor eax, eax
jmp 0x1400051bd
mov qword [rsp + 0x68], rbp
cmp dword [rbx], edi
jbe 0x1400051a5
nop
mov eax, edi
imul rcx, rax, 0x128
movzx edx, word [rcx + rbx + 0x2e]
lea rbp, [rcx + rbx]
add rcx, 0x30
add rdx, rcx
lea rcx, [rsp + 0x28]
add rdx, rbx
call fcn.140004120
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x140005143
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400051da
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14000519b
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005196
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005223
call fcn.1400052fc
inc edi
cmp edi, dword [rbx]
jb 0x140005110
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400052a0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov rdi, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x14000522f
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000522a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000522a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400052fc
mov rax, rdi
jmp 0x1400051b8
Function at 0x140005d4c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005d96
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005d96
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005d96
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005d96
cmp dword [rcx + 0x84], 0xe
jbe 0x140005d96
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005d98
xor al, al
add rsp, 0x28
ret
Function at 0x1400cac3c
Capabilities:
Hash data using murmur3

Disassembly:
mov qword [rsp + r9*2 - 0x35c23558], 0xffffffffa18358b1
movsxd rax, eax
add r11, rax
call fcn.1401bd6a7
mov r8d, 0xf7182b87
mov di, word [r11 + riz]
lea r10, [r8 + r8*2 - 0x1771fc6e]
mov r10w, word [r11 + riz + 2]
btr r8, 0x8c
mov edx, r8d
movzx ecx, dl
mov cl, byte [r11 + rcx*2 - 0x10a]
bts rdx, r8
movzx esi, dl
lea r11, [r11 + rsi*4 - 0x218]
neg si
rol r8w, 0x67
ror r8b, 0x61
shrd di, r10w, cl
mov word [rsi + r11 - 0xff79], di
mov eax, dword [rbx + rsi - 0xff79]
mov r10d, r8d
xor r8, 0x5a8683a
lea rbx, [rbx + rsi - 0xff75]
bt r8, r8
lea rdi, [r8 + rsi - 0x5e579741]
xor eax, r9d
lea eax, [rax + rsi*2 - 0x3c94e10d]
ror eax, 1
shl esi, 0x94
call fcn.1402bda40

Function at 0x1400cad09
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
mov rdi, qword [rsp + rdx - 0x5113aaa0]
mov qword [rsp + rdx - 0x5113aaa8], rsi
jmp 0x140113629
movsxd r8, r8d
sub edx, 0x2d8e3187
jle 0x1402670f6
mov eax, r11d
adc rbx, r8
bt r11d, r11d
shr qword [rsp + rdx*2 - 0x470af24a], cl
pop rcx
mov r11d, dword [r10 + rdx*2 - 0x470af252]
dec cl
cqo
rol si, 0x42
mov r9d, dword [r10 + rdx + 4]
mov qword [rsp + rdx*2 + 8], rcx
push rax
mov cl, byte [r10 + rdx + 8]
lea r8, [rsi + rax*2 - 0x32ced644]
lea r10, [r10 + rdx*8 + 6]
jne 0x1401a77d5
shld r11d, r9d, cl
mov dword [rdx + r10], r11d
movzx ecx, word [rsp + rdx*4 + 0x14]
xadd sil, dl
bt ecx, ecx
mov qword [rsp + rdx*8 - 0x630], rbx
ret 0x10
movzx eax, r8w
mov cx, word [r8 + r11 - 0x1d2e3e09]
mov ax, word [r11 + r8 - 0x1d2e3e07]
call fcn.1401667b1
Function at 0x1400f6e24
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [r9 + r8*2 - 0x21480000], edx
xchg byte [rsp + r8*4 - 0x428ffff5], r8b
sal word [rsp + r8*4 - 0x42900076], 0x6e
ror r8w, 0xeb
lea rbx, [rbx + r8*2 - 0x21480804]
jae 0x1401d83e0
mov esi, r9d
btc r9w, 0xaf
mov r11, qword [rsp + r9 - 0xb8adb9b]
lea r9, [rsi + rsi*4 - 0x30489ed3]
movsxd rcx, ecx
call fcn.14025c317
sub rdi, 1
movzx eax, byte [rdi]
mov ebx, 0x46283430
movsx r9d, bl
add bl, bl
xor al, bpl
xor al, 3
dec r9b
rol al, 1
movsx edx, bl
dec al
lea r8, [rbx + rbx*2 - 0x786cc1eb]
sub r8, 0xffffffffeb0b529f
xor al, 0x1a
and rbx, r9
movsx r11d, bx
xor bpl, al
lea r10, [r10 + r9 - 0x31]
push r9
pop r8
mov word [r10 + rbx - 0x20], ax
and r11b, r11b
lea rdi, [rdi + rbx - 0x24]
shr dl, 0x46
sal bx, 0xa9
btc r11, rbx
mov eax, dword [rbx + rdi - 0x4000]
xor eax, ebp
lea r11, [rdx + r8 + 0x230c070b]
btc bx, r11w
xchg bl, r11b
sbb eax, 0xe79aa83f
xor eax, 0x9fafda84
bswap eax
xor eax, 0xf20f128a
push rbp
not r9b
bts r11w, r9w
sbb ebx, 0xa0a7a899
xor dword [rsp + rbx - 0x5f589fa2], eax
pop rbp
sal dx, 0x8d
jns 0x1401a0e37
mov edx, dword [r10]
add r10, 4
mov r8d, 0x12a4003f
lea rbx, [rbx + r8*4 - 0x4a9000fd]
push r8
inc r8
movzx r9d, byte [rbx + r8 - 0x12a40040]
jp 0x1401ca24e
xor r9b, r11b
lea rsi, [r8 + r8*8 + 0x1d930bb8]
and r8d, 0xb1a4cf9d
dec rsi
inc r9b
movzx ecx, r8b
movzx edi, r8b
xor r9b, 0x91
xadd dword [rsp + r8*2 - 0x2147fffe], esi
adc di, 0xedbc
rol rcx, 0xb8
rol r9b, 1
add r9b, 0x80
xor r11b, r9b
push rsi
shl dil, 0x46
rol r8b, 0x83
lea r9, [rsp + r9 + 0x10]
or word [rsp + r8 - 0x10a3ffff], cx
sub byte [rsp + r8 - 0x10a3fffa], r8b
jno 0x1400ed7f1
mov ecx, r9d
movsxd rax, eax
xor edx, 0x87a52d87
adc rsi, rax
shl ecx, 0x81
jg fcn.1402ba960
call fcn.1401fd25e
xor ecx, 0x659fa03a
xor edx, r8d
movzx ebx, cx
lea rsi, [rbx + rbx*8 - 0x207e96fe]
movsx r9d, si
lea edx, [rdx + rcx*2 - 0x2dbdb80a]
bswap rcx
xor edx, 0x4f133838
movsx eax, r9b
push r9
lea edx, [rdx + rbx*8 + 0x5e9eb789]
rol edx, 1
dec al
mov qword [rsp + rbx*2 - 0xe426], r8
xor dword [rsp + rbx*4 - 0x1c84c], edx
lea r10, [rcx + rsi*4 - 0x4ecd2d68]
shr rax, 0x4c
not cl
pop r8
movsxd rdx, edx
call fcn.14025995e
movsx edx, r8b
movsx eax, dl
not ecx
xor ecx, dword [rbx + r8*2 - 0x21480800]
xor ecx, r11d
lea r9, [rsi + r8 - 0x64a9659]
lea rax, [rdi + r8*8 - 0xa568be1]
xor ecx, 0x6e204714
neg dword [rsp + rsi*4 - 0x4a90]
cbw
xor di, ax
not ecx
xchg di, r9w
inc ecx
and word [rsp + r8 - 0x10a403f2], si
neg eax
jno 0x14024ff34
mov qword [rsp + rax - 0x460f8d96], rbp
ret
ror ecx, 3
jmp 0x1401bb5f4