joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012bb0
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.shell32.dll_CommandLineToArgvW]
test rax, rax
je 0x140012cc4
mov rdi, rax
movsxd r13, dword [rsp + 0x44]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], 0
test r13, r13
je 0x140012ca3
shl r13, 3
lea rbx, [rsp + 0x60]
lea r14, [rsp + 0x48]
lea r15, [rsp + 0x28]
mov r12, rdi
jmp 0x140012c65
add r12, 8
mov rax, qword [rsp + 0x30]
lea rcx, [rbp*2]
add rcx, rbp
mov rdx, qword [rsp + 0x70]
mov qword [rax + rcx*8 + 0x10], rdx
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rax + rcx*8], xmm0
inc rbp
mov qword [rsp + 0x38], rbp
add r13, 0xfffffffffffffff8
je 0x140012ca3
mov rcx, r12
call fcn.140015af0
lea rcx, [rax + rdx*2]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rcx
mov word [rsp + 0x58], 0
mov rcx, rbx
mov rdx, r14
call fcn.14000f810
mov rbp, qword [rsp + 0x38]
cmp rbp, qword [rsp + 0x28]
jne 0x140012c30
mov rcx, r15
call fcn.1400107c0
jmp 0x140012c30
mov rcx, rdi
call qword [sym.imp.kernel32.dll_LocalFree]
test rax, rax
je 0x140012cdd
mov rax, qword [rsp + 0x38]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsi], xmm0
jmp 0x140012d14
mov qword [rsi], 0
mov qword [rsi + 8], 8
mov qword [rsi + 0x10], 0
jmp 0x140012d14
call fcn.140015d50
mov dword [rsp + 0x58], edx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 1
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsi], xmm0
mov rcx, qword [rsp + 0x38]
mov qword [rsi + 0x10], rcx
test rax, rax
je 0x140012d14
lea rcx, [rsp + 0x50]
call fcn.140015b10
nop
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400145b0
Capabilities:
Get hostname

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rsi, rcx
mov dword [rsp + 0x24], 0
xor edi, edi
lea r8, [rsp + 0x24]
mov ecx, 5
xor edx, edx
call qword [sym.imp.kernel32.dll_GetComputerNameExW]
test eax, eax
je 0x140014646
mov qword [rsp + 0x28], rdi
mov edi, dword [rsp + 0x24]
test rdi, rdi
je 0x140014667
lea r14, [rdi + rdi]
mov edx, 2
mov rcx, r14
call fcn.140005410
test rax, rax
je 0x140014772
mov rbx, rax
lea r8, [rsp + 0x24]
mov ecx, 5
mov rdx, rax
call qword [sym.imp.kernel32.dll_GetComputerNameExW]
test eax, eax
je 0x1400146bb
xor r8d, r8d
nop word cs:[rax + rax]
cmp word [rbx + r8*2], 0
je 0x14001468d
inc r8
add r14, 0xfffffffffffffffe
jne 0x140014630
mov r8, rdi
jmp 0x14001468d
call fcn.140015d50
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], edx
mov edi, 1
mov qword [rsp + 0x28], rdi
mov edi, dword [rsp + 0x24]
test rdi, rdi
jne 0x1400145ea
mov ebx, 2
lea r8, [rsp + 0x24]
mov edx, 2
mov ecx, 5
call qword [sym.imp.kernel32.dll_GetComputerNameExW]
test eax, eax
je 0x1400146bb
mov ebx, 2
xor r8d, r8d
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.140034940
movabs rax, 0x8000000000000000
cmp qword [rsp + 0x40], rax
jne 0x140014722
mov qword [rsi], rax
test edi, edi
jne 0x140014737
jmp 0x14001474b
call fcn.140015d50
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], edx
mov qword [rsp + 0x40], 1
test rax, rax
je 0x1400146e1
lea rcx, [rsp + 0x48]
call fcn.140015b10
test edi, edi
je 0x1400146f9
add rdi, rdi
mov r8d, 2
mov rcx, rbx
mov rdx, rdi
call fcn.1400053f0
cmp qword [rsp + 0x28], 0
je 0x140014713
cmp qword [rsp + 0x30], 0
je 0x140014713
lea rcx, [rsp + 0x30]
call fcn.140015b10
movabs rax, 0x8000000000000000
mov qword [rsi], rax
jmp 0x140014765
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsi], xmm0
test edi, edi
je 0x14001474b
add rdi, rdi
mov r8d, 2
mov rcx, rbx
mov rdx, rdi
call fcn.1400053f0
cmp qword [rsp + 0x28], 0
je 0x140014765
cmp qword [rsp + 0x30], 0
je 0x140014765
lea rcx, [rsp + 0x30]
call fcn.140015b10
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
mov ecx, 2
mov rdx, r14
call fcn.140049310
int3
Function at 0x140018f50
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, rdx
mov rsi, rcx
mov rax, qword [rdx + 0x28]
mov qword [rsp + 0x30], rax
movzx eax, byte [rdx + 0x30]
mov byte [rsp + 0x27], al
movzx eax, byte [0x14011e1a1]
mov ecx, 0x5f0
mov edx, 8
call fcn.1400053e0
test rax, rax
je 0x1400191b3
mov rbx, rax
lea r15, [rdi + 0x38]
mov r8d, 0x5f0
mov rcx, rax
xor edx, edx
call fcn.1400451b0
mov rax, qword [rdi + 0x60]
mov qword [rsp + 0x28], rax
movabs rcx, 0x7465646279746573
movabs rdx, 0x6c7967656e657261
movabs r8, 0xded7d4e2d7dedfc6
movabs r9, 0xa60c596fc19fead0
movabs r10, 0xe414a674f0de7325
movabs r11, 0x800000000000000
nop word cs:[rax + rax]
mov ebp, 1
lock xadd qword [0x14011e1a8], rbp
mov r14, rbp
xor r14, rcx
lea r12, [r14 + rdx]
mov rax, r14
rol rax, 0x10
xor rax, r12
lea r13, [rax + r8]
rol rax, 0x15
add r14, r9
mov r12, r14
xor r12, r10
rol r14, 0x20
xor rbp, r13
add rbp, r12
rol r12, 0xd
xor r13, r11
xor r12, rbp
rol rbp, 0x20
xor r13, rax
add r14, r13
rol r13, 0x10
xor r13, r14
add rbp, r13
rol r13, 0x15
add r14, r12
rol r12, 0x11
xor r13, rbp
xor r12, r14
rol r14, 0x20
xor rbp, r11
add rbp, r12
rol r12, 0xd
xor r12, rbp
rol rbp, 0x20
xor r14, 0xff
add r14, r13
rol r13, 0x10
xor r13, r14
add rbp, r13
rol r13, 0x15
add r14, r12
rol r12, 0x11
xor r12, r14
rol r14, 0x20
xor r13, rbp
add rbp, r12
rol r12, 0xd
xor r12, rbp
rol rbp, 0x20
add r14, r13
rol r13, 0x10
xor r13, r14
add rbp, r13
rol r13, 0x15
add r14, r12
rol r12, 0x11
xor r12, r14
rol r14, 0x20
xor r13, rbp
add rbp, r12
rol r12, 0xd
add r14, r13
rol r13, 0x10
xor r13, r14
rol r13, 0x15
xor r12, rbp
add r14, r12
rol r12, 0x11
mov rbp, r14
rol rbp, 0x20
xor rbp, r12
xor rbp, r13
xor rbp, r14
je 0x140019000
mov rax, qword [rdi + 0x58]
movups xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [rsi + 0x128], xmm1
movups xmmword [rsi + 0x118], xmm0
mov rcx, qword [rsp + 0x30]
mov qword [rsi + 0x138], rcx
movzx ecx, byte [rsp + 0x27]
mov byte [rsi + 0x140], cl
mov qword [rsi], 0
mov qword [rsi + 8], rbx
mov qword [rsi + 0x80], 0
mov qword [rsi + 0x88], rbx
mov rcx, qword [rsp + 0x28]
mov qword [rsi + 0x100], rcx
mov qword [rsi + 0x108], rbp
mov qword [rsi + 0x110], rax
mov rdx, qword [rdi + 0x10]
movabs rax, 0x8000000000000000
cmp rdx, rax
je 0x14001919f
test rdx, rdx
je 0x14001919f
mov rcx, qword [rdi + 0x18]
mov r8d, 1
call fcn.1400053f0
mov rax, rsi
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 8
mov edx, 0x5f0
call fcn.140049330
int3

Function at 0x14001e700
Capabilities:
Get system information on windows

Disassembly:
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x50]
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
lea rcx, [rbp - 0x30]
call qword [sym.imp.kernel32.dll_GetSystemInfo]
mov ecx, dword [rbp - 0x10]
xor eax, eax
test rcx, rcx
sete al
lea rdx, str.The_number_of_hardware_threads_is_not_known_for_the_target_platform
cmovne rdx, rcx
add rsp, 0x50
pop rbp
ret
Function at 0x14001f570
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x14001f610
jmp 0x14001f5ff
jae 0x14001f6cf
cmp r8, 0x201
jae 0x14001f610
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x14001f667
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x14001f63f
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.1400481c0
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.kernel32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x14001f690
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14001f73b
mov r8d, r13d
cmp r12, r8
jne 0x14001f5f0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14001f76f
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14001f5ff
jmp 0x14001f610
cmp r14, r8
jb 0x14001f789
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.140022740
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x14001f724
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.1400053f0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x14001f70f
jmp 0x14001f724
lea rcx, str.internal_error:_entered_unreachable_code_rustc_129f3b9964af4d4a709d1383930ade12dfe7c081library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.1400494d0
jmp 0x14001f79e
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.140049860
ud2
Function at 0x14001fd10
Capabilities:
Create directory

Disassembly:
push rbp
mov rbp, rsp
cmp byte [rcx], 0
je 0x14001fd25
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.14001fd40
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.1400281a0

Function at 0x1400281a0
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x10]
call fcn.14002a610
mov rax, qword [rbp - 0x10]
mov rsi, qword [rbp - 8]
movabs rbx, 0x8000000000000000
cmp rax, rbx
je 0x140028200
mov rcx, qword [rbp]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rcx
lea rcx, [rbp - 0x40]
lea rdx, [rbp - 0x28]
mov r8b, 1
call fcn.14002b650
mov rdi, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x38]
cmp rdi, rbx
jne 0x14002820c
mov rax, rsi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
xor edx, edx
call qword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
je 0x140028238
test rdi, rdi
je 0x140028264
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.1400053f0
xor eax, eax
jmp 0x140028203
call qword [sym.imp.kernel32.dll_GetLastError]
shl rax, 0x20
or rax, 2
test rdi, rdi
je 0x140028203
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
mov rsi, rax
call fcn.1400053f0
jmp 0x140028200
xor eax, eax
jmp 0x140028203

Function at 0x140028a20
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x14010b070]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140028a58
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtReadFile]
cmp eax, 0x103
jne 0x140028aaf
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0xc0000011
jne 0x140028abc
xor edx, edx
xor eax, eax
jmp 0x140028ae6
cmp eax, 0x103
je 0x140028af0
test eax, eax
js 0x140028acf
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140028ae6
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.1400220d0
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.14001c6f0
mov ecx, 7
int 0x29
ud2
Function at 0x140028b40
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov rsi, rcx
movups xmm0, xmmword [0x14010b070]
movaps xmmword [rbp], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
test r9, r9
je 0x140028b78
mov rcx, qword [rbp + 0x60]
mov qword [rbp - 0x30], rcx
test r9, r9
mov qword [rbp - 0x38], r9
lea rcx, [rbp - 0x30]
cmove rcx, r9
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
mov rax, rbp
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140028bd6
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov eax, dword [rbp]
cmp eax, 0x103
je 0x140028c03
test eax, eax
js 0x140028be2
mov rdx, qword [rbp + 8]
xor eax, eax
jmp 0x140028bf9
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xa8
pop rsi
pop rbp
ret
mov dword [rbp + 0x18], 0
mov byte [rbp + 0x1c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x20]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x38]
call fcn.1400220d0
mov qword [rbp - 8], rax
lea rcx, [rbp - 8]
call fcn.14001c6f0
mov ecx, 7
int 0x29
ud2
Function at 0x14003d510
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
test r8, r8
je 0x14003d59a
mov rax, rdx
mov rdx, qword [rbp + 0x50]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14003d590
cmp r11, r10
ja 0x14003d616
cmp r10, rdx
ja 0x14003d628
add r11, r9
xor ebx, ebx
nop word cs:[rax + rax]
cmp rdi, rbx
je 0x14003d592
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14003d570
jmp 0x14003d5f7
ja 0x14003d59a
mov r11, r10
cmp rax, r8
jne 0x14003d537
mov rdx, qword [rbp + 0x60]
test rdx, rdx
je 0x14003d5fb
mov r8, qword [rbp + 0x58]
add rdx, r8
movzx ecx, cx
mov al, 1
nop
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14003d5d0
mov r8, r10
sub ecx, r9d
jns 0x14003d5ee
jmp 0x14003d5fd
cmp r10, rdx
je 0x14003d60a
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14003d5fd
xor al, 1
cmp r8, rdx
jne 0x14003d5b0
jmp 0x14003d5fd
xor eax, eax
jmp 0x14003d5fd
mov al, 1
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.1400493d0
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140049870
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140049860
int3

Function at 0x140040c94
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x140040cde
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140040cde
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140040cde
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140040cde
cmp dword [rcx + 0x84], 0xe
jbe 0x140040cde
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140040ce0
xor al, al
add rsp, 0x28
ret

Function at 0x1400448f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140044918
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140044918
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400634f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
push rbx
push rbp
push r15
sub rsp, 0xa0
mov rax, qword [0x140309440]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r10, qword [r9 + 0x10]
mov rbp, rdx
mov rdx, qword [r8 + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rdx
mov qword [rsp + 0x40], rcx
xor ebx, ebx
mov r15, rcx
cmp rax, r10
jb 0x1400636da
cmp qword [r8 + 0x18], 0xf
mov qword [r11 - 0x20], rsi
mov qword [r11 - 0x28], rdi
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x38], r14
jbe 0x140063552
mov r8, qword [r8]
cmp qword [r9 + 0x18], 0xf
jbe 0x14006355c
mov r9, qword [r9]
mov qword [rsp + 0x30], r10
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], r9
mov r9, r8
mov qword [rsp + 0x20], rdx
call fcn.140067600
mov r13, qword [rsp + 0x68]
lea r8, [rsp + 0x50]
mov r14, qword [rsp + 0x50]
cmp r13, 0xf
mov rsi, qword [rsp + 0x60]
movabs rdx, 0xcbf29ce484222325
cmova r8, r14
mov rcx, rbx
test rsi, rsi
je 0x1400635c4
movabs r9, 0x100000001b3
movzx eax, byte [r8 + rcx]
inc rcx
xor rdx, rax
imul rdx, r9
cmp rcx, rsi
jb 0x1400635b0
mov rcx, qword [r15 + 0xe8]
mov rax, qword [r15 + 0xd0]
and rcx, rdx
add rcx, rcx
mov rdi, qword [rax + rcx*8 + 8]
cmp rdi, qword [r15 + 0xc0]
je 0x140063633
mov r15, qword [rax + rcx*8]
nop word [rax + rax]
cmp qword [rdi + 0x28], 0xf
lea rdx, [rdi + 0x10]
mov rax, qword [rdx + 0x10]
jbe 0x140063602
mov rdx, qword [rdx]
cmp r13, 0xf
lea rcx, [rsp + 0x50]
cmova rcx, r14
cmp rsi, rax
jne 0x140063620
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14006362b
cmp rdi, r15
je 0x14006362e
mov rdi, qword [rdi + 8]
jmp 0x1400635f0
mov rbx, rdi
mov r15, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x90]
test rbx, rbx
mov rsi, qword [rsp + 0x98]
cmove rbx, qword [r15 + 0xc0]
cmp r13, 0xf
jbe 0x140063688
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140063680
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140063680
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.140246eb0
mov rax, rbp
cmp rbx, qword [r15 + 0xc0]
jne 0x1400636a1
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
jmp 0x1400636b1
movups xmm0, xmmword [rbx + 0x30]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rbx + 0x40]
movups xmmword [rbp + 0x10], xmm1
mov r13, qword [rsp + 0x88]
mov r14, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140246e90
add rsp, 0xa0
pop r15
pop rbp
pop rbx
ret
call fcn.14005daf0
int3
Function at 0x1400757e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14007583d
lea rbx, [0x1402dedc0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140075824
cmp r10, 2
jb 0x140075824
cmp byte [r9], r8b
jne 0x140075824
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140075800
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14007587f
lea rbx, [0x1402dedc0]
cmp r8b, 0x23
jne 0x140075863
cmp byte [r9], r8b
jne 0x140075863
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140075850
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1400759c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x1400759da
mov qword [r8], 0
lea rdx, [0x1402e4250]
call fcn.140075890
mov rbx, rax
test rax, rax
jne 0x1400759fa
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140075ad1
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140075ad1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140075ad1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140075ad1
cmp rdi, 0xffffffffffffffff
je 0x140075ad1
mov rax, qword [0x140389020]
test rax, rax
je 0x140075a6e
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140075ad1
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140075abe
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140389020]
test rax, rax
je 0x140075ab3
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140075ada
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140075acc
mov qword [r14], rdi
mov rax, rsi
jmp 0x140075adc
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret