joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008040
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140033410]
xor rax, rsp
mov qword [rbp + 0x27], rax
movzx r14d, dx
mov rdi, rcx
mov ebx, 0xffff
xor esi, esi
cmp bx, dx
jne 0x14000808f
movzx eax, si
jmp 0x14000825c
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x1400080cc
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x1400080cc
lea ecx, [r9 - 1]
mov dword [rax], ecx
mov rdx, qword [rdi + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], r14w
movzx eax, r14w
jmp 0x14000825c
cmp qword [rcx + 0x90], rsi
je 0x140008259
mov rdx, qword [rcx + 0x18]
lea rax, [rcx + 0x80]
cmp qword [rdx], rax
jne 0x140008107
mov rcx, qword [rcx + 0x70]
mov rax, qword [rdi + 0x68]
mov qword [rdx], rax
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
sub rcx, rcx
sar rcx, 1
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
cmp qword [rdi + 0x78], rsi
jne 0x14000812f
mov rdx, qword [rdi + 0x90]
movzx ecx, r14w
call fcn.14000c108
cmp ax, bx
je 0x140008259
movzx ebx, r14w
jmp 0x140008259
mov word [rbp - 1], r14w
mov qword [rbp + 0x1f], 0xf
mov qword [rbp + 0x17], rsi
mov byte [rbp + 7], sil
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp + 7]
call fcn.1400095dc
nop
lea rdx, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae rdx, qword [rbp + 7]
lea r8, [rbp + 7]
cmovae r8, qword [rbp + 7]
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
add rdx, qword [rbp + 0x17]
lea rax, [rbp - 9]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], r8
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 1]
lea r8, [rbp - 1]
lea rdx, [rdi + 0x84]
call qword [r10 + 0x38]
test eax, eax
js 0x140008249
cmp eax, 1
jg 0x14000822b
lea rax, [rbp + 7]
mov r9, qword [rbp + 7]
mov r10, qword [rbp + 0x1f]
cmp r10, 0x10
cmovae rax, r9
mov r15, qword [rbp - 9]
sub r15, rax
je 0x1400081f5
lea rcx, [rbp + 7]
cmp r10, 0x10
cmovae rcx, r9
mov r9, qword [rdi + 0x90]
mov r8, r15
mov edx, 1
call fcn.14000d664
cmp r15, rax
jne 0x140008249
mov byte [rdi + 0x82], 1
lea rax, [rbp - 1]
cmp qword [rbp - 0x11], rax
jne 0x140008245
test r15, r15
jne 0x140008155
cmp qword [rbp + 0x17], 0x20
jae 0x140008249
xor r8d, r8d
lea edx, [r15 + 8]
lea rcx, [rbp + 7]
call fcn.140002610
jmp 0x140008155
cmp eax, 3
jne 0x140008249
mov rdx, qword [rdi + 0x90]
movzx ecx, word [rbp - 1]
call fcn.14000c108
cmp ax, bx
je 0x140008249
movzx ebx, r14w
cmp qword [rbp + 0x1f], 0x10
jb 0x140008259
mov rcx, qword [rbp + 7]
call fcn.14000b084
movzx eax, bx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14000a720
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x140009338
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140033410]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rcx
xor ebx, ebx
cmp qword [rcx + 0x78], rbx
je 0x140009497
cmp byte [rcx + 0x82], bl
je 0x140009497
mov rax, qword [rcx]
mov esi, 0xffff
mov edx, esi
call qword [rax + 0x18]
cmp si, ax
jne 0x14000939d
xor al, al
jmp 0x14000949c
mov qword [rbp - 0x18], 0xf
mov qword [rbp - 0x20], rbx
mov byte [rbp - 0x30], bl
xor r8d, r8d
lea edx, [r8 + 8]
lea rcx, [rbp - 0x30]
call fcn.1400095dc
nop
mov esi, 1
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
lea r8, [rbp - 0x30]
cmovae r8, qword [rbp - 0x30]
mov rcx, qword [rdi + 0x78]
mov r10, qword [rcx]
mov r9, qword [rbp - 0x20]
add r9, rdx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
lea rdx, [rdi + 0x84]
call qword [r10 + 0x40]
mov ecx, eax
test eax, eax
je 0x140009407
dec ecx
jne 0x140009473
jmp 0x14000940d
mov byte [rdi + 0x82], bl
lea rax, [rbp - 0x30]
mov r9, qword [rbp - 0x30]
mov r10, qword [rbp - 0x18]
cmp r10, 0x10
cmovae rax, r9
mov r14, qword [rbp - 0x38]
sub r14, rax
je 0x14000944d
lea rcx, [rbp - 0x30]
cmp r10, 0x10
cmovae rcx, r9
mov r9, qword [rdi + 0x90]
mov r8, r14
mov rdx, rsi
call fcn.14000d664
cmp r14, rax
jne 0x14000947d
cmp byte [rdi + 0x82], bl
je 0x14000947a
test r14, r14
jne 0x1400093c2
xor r8d, r8d
lea edx, [r14 + 8]
lea rcx, [rbp - 0x30]
call fcn.140002610
jmp 0x1400093c2
cmp ecx, 2
jne 0x140009483
jmp 0x140009480
mov bl, sil
mov sil, bl
mov bl, sil
cmp qword [rbp - 0x18], 0x10
jb 0x140009493
mov rcx, qword [rbp - 0x30]
call fcn.14000b084
mov al, bl
jmp 0x14000949c
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14000a720
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000a488
Capabilities:
Get file size
Read file via mapping

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0x30
and qword [rax - 0x10], 0
and dword [rax - 0x18], 0
xor r9d, r9d
mov r14, rdx
lea r8d, [r9 + 2]
xor edx, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
test rax, rax
jne 0x14000a4f2
lea rdx, str._X__Could_not_create_mapping_
call fcn.140001c54
mov rcx, rax
mov rbx, rax
call fcn.14000a5c4
mov rcx, rbx
call fcn.140001688
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000a5ae
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
test rax, rax
jne 0x14000a53d
lea rdx, str._X__Could_not_map_view_of_file
call fcn.140001c54
mov rcx, rax
mov rbx, rax
call fcn.14000a5c4
mov rcx, rbx
call fcn.140001688
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000a4e2
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
mov r8d, 0x3000
mov edx, eax
lea r9d, [rcx + 4]
mov qword [r14], rdx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x14000a58b
lea rdx, str.Could_not_allocate_memory_in_the_current_process
call fcn.140001c54
mov rcx, rax
mov rbx, rax
call fcn.14000a5c4
mov rcx, rbx
call fcn.140001688
jmp 0x14000a4eb
mov r8, qword [r14]
mov rdx, rbx
mov rcx, rax
call fcn.14000a940
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x14004d420
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov rbx, qword [rcx + 0x10]
movabs rax, 0xcccccccccccccccd
xor r11d, r11d
mov r8, rcx
mov r9d, 0x811c9dc5
mul rbx
shr rdx, 3
inc rdx
test rbx, rbx
je 0x14004d477
mov r10, qword [rcx + 0x18]
cmp r10, 8
jb 0x14004d45d
mov rax, qword [r8]
jmp 0x14004d460
mov rax, r8
movzx ecx, word [rax + r11*2]
imul r9, r9, 0x1000193
add r11, rdx
xor r9, rcx
cmp r11, rbx
jb 0x14004d452
mov rbx, qword [rsp + 8]
mov rax, r9
ret

Function at 0x1400caaa0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov rbx, qword [rdx + 0x10]
mov r8, rdx
movabs rax, 0xcccccccccccccccd
xor r10d, r10d
mov r11, rcx
mov r9d, 0x811c9dc5
mul rbx
shr rdx, 3
inc rdx
test rbx, rbx
je 0x1400caafa
mov rcx, qword [r8 + 0x18]
cmp rcx, 0x10
jb 0x1400caae0
mov rax, qword [r8]
jmp 0x1400caae3
mov rax, r8
movsx rax, byte [rax + r10]
imul r9, r9, 0x1000193
add r10, rdx
xor r9, rax
cmp r10, rbx
jb 0x1400caad5
mov rdx, qword [r11 + 0x40]
mov rax, rdx
and rax, r9
cmp qword [r11 + 0x48], rax
ja 0x1400cab17
shr rdx, 1
or rcx, 0xffffffffffffffff
sub rcx, rdx
add rax, rcx
mov rbx, qword [rsp + 8]
ret
Function at 0x1400d44b0
Capabilities:
Encrypt data using tea

Disassembly:
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov r15, r8
mov ebx, edx
mov r14, rcx
lea rcx, [0x140056200]
call qword [0x1401dcd60]
cmp ebx, 2
jae 0x1400d44f3
xor r13d, r13d
jmp 0x1400d463e
lea esi, [rbx - 1]
mov ecx, dword [r14 + rsi*4]
mov dword [rsp + 0x88], ecx
pxor xmm1, xmm1
cvtsi2ss xmm1, rbx
movss xmm0, dword [0x14023233c]
divss xmm0, xmm1
addss xmm0, dword [0x140232338]
call fcn.1401bd1f0
cvttss2si r12, xmm0
mov dword [rsp + 0x28], r12d
xor r13d, r13d
mov edi, r13d
mov dword [rsp + 0x2c], r13d
mov r10d, dword [rsp + 0x88]
mov eax, r12d
dec r12d
mov dword [rsp + 0x28], r12d
test eax, eax
je 0x1400d4638
add edi, 0x9e3779b9
mov dword [rsp + 0x2c], edi
mov r11d, edi
shr r11d, 2
and r11d, 3
mov dword [rsp + 0x24], r13d
mov edx, r13d
mov dword [rsp + 0x24], edx
cmp edx, esi
jae 0x1400d45e2
lea ebx, [rdx + 1]
mov r8d, dword [r14 + rbx*4]
mov r10d, edx
lea r9d, [r8*4]
mov edx, dword [rsp + 0x88]
mov eax, edx
shr eax, 5
xor r9d, eax
mov ecx, r8d
shr ecx, 3
mov eax, edx
shl eax, 4
xor ecx, eax
add r9d, ecx
mov ecx, r10d
and ecx, 3
mov eax, r11d
xor rcx, rax
mov edx, dword [r15 + rcx*4]
xor edx, dword [rsp + 0x88]
mov eax, edi
xor eax, r8d
add edx, eax
xor r9d, edx
add dword [r14 + r10*4], r9d
mov r10d, dword [r14 + r10*4]
mov dword [rsp + 0x88], r10d
mov edx, ebx
mov dword [rsp + 0x24], ebx
jmp 0x1400d4574
mov r8d, dword [r14]
lea r9d, [r8*4]
mov eax, r10d
shr eax, 5
xor r9d, eax
mov ecx, r8d
shr ecx, 3
mov eax, r10d
shl eax, 4
xor ecx, eax
add r9d, ecx
mov ecx, edx
and ecx, 3
mov eax, r11d
xor rcx, rax
mov edx, dword [r15 + rcx*4]
xor edx, r10d
mov eax, edi
xor eax, r8d
add edx, eax
xor r9d, edx
add dword [r14 + rsi*4], r9d
mov r10d, dword [r14 + rsi*4]
mov dword [rsp + 0x88], r10d
jmp 0x1400d4540
mov r13d, 1
mov dword [rsp + 0x20], r13d
mov eax, r13d
jmp 0x1400d464c
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400ecbd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov eax, edx
mov ebx, edx
shl rax, 4
mov ecx, 0x40
cmp rax, 0x400
cmova ebx, ecx
cmp ebx, dword [rdi]
jne 0x1400ecc04
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x1402ab270]
test rax, rax
je 0x1400ecc12
call rax
shl ebx, 4
mov ecx, ebx
call fcn.1400e8e00
mov rcx, qword [0x1402ab278]
mov rbx, rax
test rcx, rcx
je 0x1400ecc2d
call rcx
test rbx, rbx
je 0x1400ecbf7
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x38], rsi
call fcn.1400e9140
mov rcx, rbx
mov qword [rdi + 0x10], rbx
call qword [0x1402a48c8]
xor edx, edx
mov rcx, rbx
movsxd rsi, eax
shr rsi, 4
mov r8d, esi
mov dword [rdi], esi
shl r8, 4
call fcn.1401bcc1c
mov r8, qword [rdi + 8]
xor r11d, r11d
mov qword [rdi + 8], r11
test r8, r8
je 0x1400ecd43
mov qword [rsp + 0x30], rbp
lea rbp, [0x1401f2280]
nop word [rax + rax]
mov r9d, dword [r8 + 0x20]
mov r10, qword [r8 + 0x18]
mov eax, r11d
test r9d, r9d
jle 0x1400eccbe
movzx ecx, byte [r10]
dec r9d
inc r10
movzx edx, byte [rcx + rbp]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r9d, r9d
jg 0x1400ecca0
mov r10, qword [r8]
xor edx, edx
div esi
mov r9d, edx
shl r9, 4
add r9, rbx
je 0x1400ecd16
mov eax, dword [r9]
test eax, eax
je 0x1400eccde
mov rcx, qword [r9 + 8]
jmp 0x1400ecce1
mov rcx, r11
inc eax
mov qword [r9 + 8], r8
mov dword [r9], eax
test rcx, rcx
je 0x1400ecd16
mov qword [r8], rcx
mov rax, qword [rcx + 8]
mov qword [r8 + 8], rax
mov rax, qword [rcx + 8]
test rax, rax
je 0x1400ecd0c
mov qword [rax], r8
mov qword [rcx + 8], r8
jmp 0x1400ecd32
mov qword [rdi + 8], r8
mov qword [rcx + 8], r8
jmp 0x1400ecd32
mov rax, qword [rdi + 8]
mov qword [r8], rax
mov rax, qword [rdi + 8]
test rax, rax
je 0x1400ecd2a
mov qword [rax + 8], r8
mov qword [r8 + 8], r11
mov qword [rdi + 8], r8
mov r8, r10
test r10, r10
jne 0x1400ecc90
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400ecec0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r13
push r14
sub rsp, 0x20
mov r10d, dword [rcx]
mov r12, r9
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
lea r14, [0x1401f2280]
test r10d, r10d
je 0x1400ecf29
xor eax, eax
mov r9, rdx
test r8d, r8d
jle 0x1400ecf1f
nop
movzx ecx, byte [r9]
dec r8d
inc r9
movzx edx, byte [rcx + r14]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r8d, r8d
jg 0x1400ecf00
xor edx, edx
div r10d
mov r13d, edx
jmp 0x1400ecf2c
xor r13d, r13d
mov r9d, r13d
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x40], rdi
call fcn.1400ecd60
mov r11, rax
test rax, rax
je 0x1400ecfce
mov rdi, qword [rax + 0x10]
test r12, r12
jne 0x1400ecfbe
mov rax, qword [rax + 8]
test rax, rax
je 0x1400ecf68
mov rcx, qword [r11]
mov qword [rax], rcx
jmp 0x1400ecf6f
mov rax, qword [r11]
mov qword [rbx + 8], rax
mov rcx, qword [r11]
test rcx, rcx
je 0x1400ecf7f
mov rax, qword [r11 + 8]
mov qword [rcx + 8], rax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400ecfa1
mov ecx, r13d
shl rcx, 4
add rcx, rax
cmp qword [rcx + 8], r11
jne 0x1400ecf9f
mov rax, qword [r11]
mov qword [rcx + 8], rax
dec dword [rcx]
mov rcx, r11
call fcn.1400e9140
dec dword [rbx + 4]
jne 0x1400ecfc6
mov rcx, rbx
call fcn.1400eca70
mov rax, rdi
jmp 0x1400ed096
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], rbp
mov rax, rdi
jmp 0x1400ed096
test r12, r12
je 0x1400ed094
mov ecx, 0x28
call fcn.1400e8e00
mov rdi, rax
test rax, rax
jne 0x1400ecff1
mov rax, r12
jmp 0x1400ed096
mov qword [rax + 0x18], rbp
mov dword [rax + 0x20], esi
mov qword [rax + 0x10], r12
inc dword [rbx + 4]
mov edx, dword [rbx + 4]
cmp edx, 0xa
jb 0x1400ed054
mov eax, dword [rbx]
add eax, eax
cmp edx, eax
jbe 0x1400ed054
add edx, edx
mov rcx, rbx
call fcn.1400ecbd0
test eax, eax
je 0x1400ed054
xor eax, eax
test esi, esi
jle 0x1400ed04d
nop word [rax + rax]
movzx ecx, byte [rbp]
dec esi
inc rbp
movzx edx, byte [rcx + r14]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test esi, esi
jg 0x1400ed030
xor edx, edx
div dword [rbx]
mov r13d, edx
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400ed074
mov edx, r13d
mov r8, rdi
mov rcx, rbx
shl rdx, 4
add rdx, rax
call fcn.1400ecb60
jmp 0x1400ed094
mov rax, qword [rbx + 8]
mov qword [rdi], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x1400ed088
mov qword [rax + 8], rdi
mov qword [rdi + 8], 0
mov qword [rbx + 8], rdi
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x140121750
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x1401218ce
test rdx, rdx
je 0x1401218ce
movzx edx, word [rcx + 2]
mov r8d, 0x800
movzx eax, dx
and ax, r8w
cmp ax, r8w
je 0x14012181b
movzx ecx, word [rbx + 2]
movzx eax, cx
and ax, r8w
cmp ax, r8w
je 0x14012181b
xor cl, dl
test cl, 0x10
jne 0x14012181b
movzx eax, byte [rbx]
cmp byte [rdi], al
jne 0x14012181b
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rdi + 0x10]
call fcn.140121750
test eax, eax
jne 0x14012181b
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
call fcn.140121750
test eax, eax
jne 0x14012181b
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x20]
call fcn.1401218f0
test eax, eax
jne 0x14012181b
mov eax, dword [rbx + 0x30]
cmp dword [rdi + 0x30], eax
jne 0x14012181b
movzx eax, word [rbx + 0x34]
cmp word [rdi + 0x34], ax
jne 0x14012181b
movzx r9d, word [rdi + 2]
mov edx, 0x400
movzx eax, r9w
and ax, dx
cmp ax, dx
jne 0x14012182b
movzx eax, word [rbx + 2]
and ax, dx
cmp ax, dx
jne 0x14012181b
mov eax, dword [rbx + 8]
cmp dword [rdi + 8], eax
je 0x140121887
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rdi]
cmp al, 0x98
je 0x140121887
cmp al, 0x9a
je 0x140121887
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140121887
movzx eax, word [rbx + 2]
and ax, dx
cmp ax, dx
je 0x14012181b
mov r8, qword [rbx + 8]
test r8, r8
je 0x14012181b
sub r8, rcx
nop word [rax + rax]
movzx edx, byte [rcx]
movzx eax, byte [rcx + r8]
sub edx, eax
jne 0x140121873
inc rcx
test eax, eax
jne 0x140121860
test edx, edx
je 0x140121887
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, word [rbx + 2]
mov ecx, 0x100
and ax, cx
and r9w, cx
cmp r9w, ax
je 0x1401218ad
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test r9w, r9w
je 0x1401218c1
mov rax, qword [rbx + 0x28]
cmp qword [rdi + 0x28], rax
jne 0x14012181b
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor ecx, ecx
mov eax, 2
cmp rdx, rdi
cmove eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x140126500
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor r10d, r10d
mov rbp, r8
mov rsi, rdx
mov r12, rcx
mov rbx, rdx
test rdx, rdx
je 0x140126541
cmp byte [rdx], r10b
je 0x140126539
inc rbx
cmp byte [rbx], r10b
jne 0x140126531
sub ebx, edx
and ebx, 0x3fffffff
mov r13d, dword [rcx + 0x28]
xor edi, edi
test r13d, r13d
jle 0x14012666d
mov qword [rsp + 0x40], r14
lea r14, [0x1401f2280]
nop dword [rax]
mov r9d, edi
cmp edi, 2
jge 0x14012656c
xor r9d, 1
test rbp, rbp
je 0x1401265c5
mov rax, qword [r12 + 0x20]
movsxd rcx, r9d
mov rdx, rbp
shl rcx, 5
mov r8, qword [rcx + rax]
movzx ecx, byte [rbp]
test cl, cl
je 0x1401265b0
nop dword [rax]
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + r14]
cmp byte [rcx + r14], al
jne 0x1401265b0
movzx ecx, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x140126590
movzx eax, byte [r8]
movzx ecx, byte [rax + r14]
movzx eax, byte [rdx]
movzx eax, byte [rax + r14]
cmp eax, ecx
jne 0x140126641
mov rax, qword [r12 + 0x20]
movsxd rcx, r9d
shl rcx, 5
mov r10, qword [rcx + rax + 0x18]
cmp qword [r10 + 0x18], 0
je 0x14012661a
xor r8d, r8d
mov edx, ebx
mov r9, rsi
test ebx, ebx
jle 0x14012660f
nop dword [rax]
movzx eax, byte [r9]
dec edx
inc r9
movzx ecx, byte [rax + r14]
lea eax, [r8*8]
xor ecx, eax
xor r8d, ecx
test edx, edx
jg 0x1401265f0
xor edx, edx
mov eax, r8d
div dword [r10 + 8]
jmp 0x14012661c
xor edx, edx
mov r9d, edx
lea rcx, [r10 + 8]
mov r8d, ebx
mov rdx, rsi
call fcn.1400ecd60
test rax, rax
je 0x14012663e
mov r10, qword [rax + 0x10]
test r10, r10
jne 0x14012664c
jmp 0x140126641
xor r10d, r10d
inc edi
cmp edi, r13d
jl 0x140126560
mov r14, qword [rsp + 0x40]
mov rax, r10
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov rax, r10
jmp 0x140126654
Function at 0x140126750
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
sub rsp, 0x20
xor r9d, r9d
mov rbp, r8
mov rsi, rdx
mov rbx, rdx
test rdx, rdx
je 0x140126788
cmp byte [rdx], r9b
je 0x140126780
inc rbx
cmp byte [rbx], r9b
jne 0x140126778
sub ebx, edx
and ebx, 0x3fffffff
mov r13d, dword [rcx + 0x28]
xor edi, edi
test r13d, r13d
jle 0x1401268ac
mov qword [rsp + 0x40], r12
mov r12, qword [rcx + 0x20]
mov qword [rsp + 0x48], r14
lea r14, [0x1401f2280]
nop dword [rax]
mov eax, edi
cmp edi, 2
jge 0x1401267ba
xor eax, 1
movsxd r8, eax
shl r8, 5
mov r10, qword [r8 + r12 + 0x18]
test rbp, rbp
je 0x140126815
movzx ecx, byte [rbp]
mov r8, qword [r8 + r12]
mov rdx, rbp
test cl, cl
je 0x140126800
nop word [rax + rax]
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + r14]
cmp byte [rcx + r14], al
jne 0x140126800
movzx ecx, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x1401267e0
movzx eax, byte [r8]
movzx ecx, byte [rax + r14]
movzx eax, byte [rdx]
movzx eax, byte [rax + r14]
cmp eax, ecx
jne 0x140126881
cmp qword [r10 + 0x30], 0
je 0x14012685a
xor r8d, r8d
mov edx, ebx
mov r9, rsi
test ebx, ebx
jle 0x14012684f
nop dword [rax + rax]
movzx eax, byte [r9]
dec edx
inc r9
movzx ecx, byte [rax + r14]
lea eax, [r8*8]
xor ecx, eax
xor r8d, ecx
test edx, edx
jg 0x140126830
xor edx, edx
mov eax, r8d
div dword [r10 + 0x20]
jmp 0x14012685c
xor edx, edx
mov r9d, edx
lea rcx, [r10 + 0x20]
mov r8d, ebx
mov rdx, rsi
call fcn.1400ecd60
test rax, rax
je 0x14012687e
mov r9, qword [rax + 0x10]
test r9, r9
jne 0x14012688c
jmp 0x140126881
xor r9d, r9d
inc edi
cmp edi, r13d
jl 0x1401267b0
mov r12, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rax, r9
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
mov rax, r9
jmp 0x140126899
Function at 0x140132f40
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rcx]
mov rax, rdx
test rdx, rdx
je 0x140132f5f
cmp byte [rdx], 0
je 0x140132f58
inc rax
cmp byte [rax], 0
jne 0x140132f50
sub eax, edx
and eax, 0x3fffffff
mov rcx, qword [rcx + 0x78]
mov r8d, eax
add rcx, 0x50
jmp fcn.1400ece30
Function at 0x14019ed10
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x20], 0
mov edx, 2
mov rcx, qword [rsp + 0x50]
call fcn.1401a3160
test eax, eax
jne 0x14019ed7a
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x14019ed7a
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x3c]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
cmp dword [rax], 0x4550
je 0x14019ed7a
mov qword [rsp + 0x20], 0
jmp 0x14019ed85
mov rax, qword [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x1400789f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [0x1409241a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140078a29
mov rdx, qword [rax + 8]
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400d6db0
xor edx, edx
mov r8, rbx
add rsp, 0x20
pop rbx
jmp fcn.1400d6db0

Function at 0x140078a40
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x28
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x1409241a4]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor r8d, r8d
test rax, rax
je 0x140078a70
mov r9, qword [rax + 8]
jmp 0x140078a73
mov r9, r8
cmp rdi, 0x3fc
ja 0x140078a97
test r9, r9
je 0x140078a97
mov rax, r8
cmp qword [r9 + rax*8], 0
je 0x140078aa7
inc r8d
inc rax
cmp rax, 2
jl 0x140078a84
mov rcx, rbx
add rsp, 0x28
pop rdi
pop rbx
jmp qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll__aligned_free]
movzx eax, byte [rbx + rdi]
mov byte [rbx], al
movsxd rax, r8d
mov qword [r9 + rax*8], rbx
add rsp, 0x28
pop rdi
pop rbx
ret

Function at 0x140078e20
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x140924124], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x140078e7d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
add rsp, 0x30
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [fcn.140009110]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret