joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff7ceccdb30
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x70
mov rax, qword [0x7ff7ced83080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, qword [0x7ff7ced87310]
mov rbp, rcx
lea rcx, [rsp + 0x58]
call qword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x7ff7ceccdd4e
lea rcx, [rsp + 0x60]
call qword [sym.imp.kernel32.dll_QueryPerformanceCounter]
test eax, eax
je 0x7ff7ceccdd4e
mov qword [rsp + 0x80], rbx
mov ecx, 0x50
mov qword [rsp + 0x88], rdi
call qword [sym.imp.ucrtbase.dll_malloc]
mov r8, qword [0x7ff7ced87310]
xor ebx, ebx
mov rdi, rax
test r8, r8
je 0x7ff7ceccdc04
movsx rdx, word [r8 + 0x6078]
lea rax, [r8 + 0x607c]
mov r9d, dword [r8 + 0x3f60]
lea rax, [rax + rdx*8]
cmp dword [rax], r9d
je 0x7ff7ceccdbf9
lea ecx, [rdx + 1]
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
mov word [r8 + 0x6078], cx
movsx rax, cx
lea rax, [rax*8 + 0x607c]
add rax, r8
mov dword [rax], r9d
mov dword [rax + 4], ebx
inc word [rax + 4]
inc dword [r8 + 0x6070]
test rdi, rdi
je 0x7ff7ceccdc21
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
jmp 0x7ff7ceccdc24
mov rdi, rbx
or dword [rsi + 0xc], 6
lea rax, [0x7ff7ced71b98]
mov qword [rsi + 0x80], rax
mov qword [rsi + 0x90], rdi
mov qword [rdi], rbp
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x20], rax
mov rax, qword [rsp + 0x60]
mov qword [rdi + 0x18], rax
mov dword [rdi + 0x28], 9
test r8, r8
je 0x7ff7ceccdc67
mov rsi, qword [r8 + 0x90]
jmp 0x7ff7ceccdc6a
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.user32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rsi + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.kernel32.dll_GetLocaleInfoA]
test eax, eax
jne 0x7ff7ceccdc95
mov dword [rsi + 0x2c], ebx
mov rax, qword [0x7ff7ced87310]
mov rcx, qword [rax + 0x4ae0]
mov rax, qword [rcx]
mov qword [rax + 0x28], rbp
lea rax, [0x7ff7ced71bb0]
mov qword [rsp + 0x30], rax
lea rax, [0x7ff7ced71bc0]
mov qword [rsp + 0x38], rax
lea rax, [0x7ff7ced71bd0]
mov qword [rsp + 0x40], rax
lea rax, [0x7ff7ced71be0]
mov qword [rsp + 0x48], rax
lea rax, [0x7ff7ced71bf0]
mov qword [rsp + 0x50], rax
mov byte [rdi + 0x31], 1
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x30]
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
jne 0x7ff7ceccdd0e
inc rbx
cmp rbx, 5
jl 0x7ff7ceccdcf0
jmp 0x7ff7ceccdd3a
lea rdx, [0x7ff7ced71c00]
mov qword [rdi + 0x38], rsi
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
lea rdx, [0x7ff7ced71c18]
mov rcx, rsi
mov qword [rdi + 0x40], rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov qword [rdi + 0x48], rax
mov rdi, qword [rsp + 0x88]
mov al, 1
mov rbx, qword [rsp + 0x80]
jmp 0x7ff7ceccdd50
xor al, al
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.7ff7ced50860
mov rbp, qword [rsp + 0x90]
add rsp, 0x70
pop rsi
ret
Function at 0x7ff7cecd3100
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x7ff7ced87798]
test rax, rax
jne 0x7ff7cecd32ec
mov rax, qword gs:[0x60]
xor r11d, r11d
mov qword [rsp + 0x48], rbp
mov r9d, 0x9d2c8f28
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x30], rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], r15
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test r11d, r11d
je 0x7ff7cecd31ad
psrldq xmm0, 8
mov edx, 0x7e6dd486
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x7ff7cecd31a4
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x7ff7cecd3190
cmp edx, r11d
jne 0x7ff7cecd32af
mov r10, qword [rdi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
mov ebx, ecx
shr r15, 0x20
add rbx, r10
cmp rbx, r10
je 0x7ff7cecd32af
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x7ff7cecd32af
mov r14d, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0x7e6dd486
lea rax, [r14 + r8*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x7ff7cecd3227
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x7ff7cecd3210
cmp edx, r9d
je 0x7ff7cecd3233
test r8d, r8d
jne 0x7ff7cecd31f0
jmp 0x7ff7cecd32af
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
cmp rax, rbx
jbe 0x7ff7cecd32c7
lea rcx, [r15 + rbx]
cmp rax, rcx
jae 0x7ff7cecd32c7
movzx ecx, byte [rax]
mov r11d, 0x7e6dd486
mov r9d, r11d
cmp cl, 0x2e
je 0x7ff7cecd3288
nop dword [rax]
movsx ecx, cl
inc rax
xor ecx, r11d
imul r11d, ecx, 0x1000193
movzx ecx, byte [rax]
cmp cl, 0x2e
jne 0x7ff7cecd3270
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
je 0x7ff7cecd32ab
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx ecx, byte [rax]
test cl, cl
jne 0x7ff7cecd3293
mov rdi, qword [rbp]
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x7ff7cecd32c5
cmp qword [rax + 0x30], 0
jne 0x7ff7cecd3160
xor eax, eax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x7ff7ced87798], rax
add rsp, 0x38
jmp rax
Function at 0x7ff7cecd51b0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x7ff7ced83080]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x7ff7cecd5267
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x7ff7cecd5267
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x9b3ca098
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x7ff7cecd5262
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x7ff7cecd5240
cmp r8d, 0x3398544a
je 0x7ff7cecd526c
test r9d, r9d
jne 0x7ff7cecd5220
mov rax, qword [rax]
jmp 0x7ff7cecd51f0
mov ecx, dword [rbx + 0x24]
mov rdx, rsi
add rcx, r10
movzx r8d, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + r8*4]
lea rcx, [rsp + 0x90]
add rax, r10
call rax
mov dword [rsp + 0x60], 0x30
lea rax, [rsp + 0x90]
mov qword [rsp + 0x70], rax
xor esi, esi
mov qword [rsp + 0x68], rsi
xorps xmm0, xmm0
mov dword [rsp + 0x78], esi
movdqu xmmword [rsp + 0x80], xmm0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x7ff7cecd5347
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x7ff7cecd5347
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x6c5f1260
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x7ff7cecd5342
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x7ff7cecd5320
cmp r8d, 0xe63e3da8
je 0x7ff7cecd534c
test r9d, r9d
jne 0x7ff7cecd5300
mov rax, qword [rax]
jmp 0x7ff7cecd52d0
mov ecx, dword [rbx + 0x24]
lea r8, [rsp + 0x60]
mov dword [rsp + 0x50], esi
add rcx, r10
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 3
movzx edx, word [rcx + r9*2]
lea r9, [0x7ff7ced876b0]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rsi
mov eax, dword [rcx + rdx*4]
mov edx, 0x40100000
add rax, r10
lea rcx, [0x7ff7ced87668]
call rax
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.7ff7ced50860
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x7ff7cecd53d0
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x7ff7ced83080]
xor rax, rsp
mov qword [rbp + 0x70], rax
mov word [rsp + 0x53], 0
mov byte [rsp + 0x50], cl
mov byte [rsp + 0x51], dl
mov byte [rsp + 0x52], r8b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x7ff7cecd5497
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x7ff7cecd5497
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x5c14c79f
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x7ff7cecd5492
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x7ff7cecd5470
cmp r8d, 0x3f606b52
je 0x7ff7cecd549c
test r9d, r9d
jne 0x7ff7cecd5450
mov rax, qword [rax]
jmp 0x7ff7cecd5420
mov ecx, dword [rbx + 0x24]
xor r8d, r8d
add rcx, r10
movzx edx, word [rcx + r9*2]
xor r9d, r9d
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
mov dword [rsp + 0x48], ecx
add rax, r10
mov qword [rsp + 0x40], rcx
xor edx, edx
mov dword [rsp + 0x38], 5
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x28], 0x2a2010
mov qword [rsp + 0x20], rcx
mov rcx, qword [0x7ff7ced87668]
call rax
test eax, eax
je 0x7ff7cecd55d5
cmp qword [0x7ff7ced87668], 0
jne 0x7ff7cecd55d5
movaps xmm0, xmmword [0x7ff7ced71e20]
lea rcx, [rsp + 0x70]
movaps xmm1, xmmword [0x7ff7ced71e30]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [0x7ff7ced71e40]
movaps xmmword [rbp - 0x70], xmm0
movaps xmm0, xmmword [0x7ff7ced71e60]
movaps xmmword [rbp - 0x50], xmm0
movaps xmm0, xmmword [0x7ff7ced71e80]
movaps xmmword [rbp - 0x80], xmm1
movaps xmm1, xmmword [0x7ff7ced71e50]
movaps xmmword [rbp - 0x30], xmm0
movsd xmm0, qword [0x7ff7ced71e90]
movaps xmmword [rbp - 0x60], xmm1
movaps xmm1, xmmword [0x7ff7ced71e70]
movsd qword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x40], xmm1
call fcn.7ff7cecd51b0
test eax, eax
jns 0x7ff7cecd55d5
movaps xmm0, xmmword [0x7ff7ced71ea0]
lea rcx, [rbp - 0x10]
movaps xmm1, xmmword [0x7ff7ced71eb0]
movaps xmmword [rbp - 0x10], xmm0
movaps xmm0, xmmword [0x7ff7ced71ec0]
movaps xmmword [rbp + 0x10], xmm0
movaps xmm0, xmmword [0x7ff7ced71ee0]
movaps xmmword [rbp + 0x30], xmm0
movaps xmm0, xmmword [0x7ff7ced71f00]
movaps xmmword [rbp], xmm1
movaps xmm1, xmmword [0x7ff7ced71ed0]
movaps xmmword [rbp + 0x50], xmm0
movsd xmm0, qword [0x7ff7ced71f10]
movaps xmmword [rbp + 0x20], xmm1
movaps xmm1, xmmword [0x7ff7ced71ef0]
movsd qword [rbp + 0x60], xmm0
movaps xmmword [rbp + 0x40], xmm1
call fcn.7ff7cecd51b0
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.7ff7ced50860
add rsp, 0x180
pop rdi
pop rbx
pop rbp
ret
Function at 0x7ff7cecd5b60
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x7ff7cecd5c07
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x7ff7cecd5c07
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x795f26d7
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x7ff7cecd5c02
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x7ff7cecd5be0
cmp r8d, 0xa120a074
je 0x7ff7cecd5c0c
test r9d, r9d
jne 0x7ff7cecd5bc0
mov rax, qword [rax]
jmp 0x7ff7cecd5b90
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, qword [rsi + 0x10]
add rax, r10
call rax
mov qword [rsi + 0x10], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x7ff7cecd5cc7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x7ff7cecd5cc7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x21f49ab1
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x7ff7cecd5cc2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x7ff7cecd5ca0
cmp r8d, 0x6880dc91
je 0x7ff7cecd5ccc
test r9d, r9d
jne 0x7ff7cecd5c80
mov rax, qword [rax]
jmp 0x7ff7cecd5c50
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, qword [rsi + 8]
add rax, r10
call rax
mov rbx, qword [rsp + 0x30]
mov qword [rsi + 8], 0
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x7ff7cecd5d10
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x10]
mov rbp, r9
mov rsi, rcx
mov dword [rax + 0xc], edx
mov rax, qword [rcx + 0x10]
mov dword [rax + 0x10], r8d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x7ff7cecd5dc7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x7ff7cecd5dc7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xb6e694a7
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x7ff7cecd5dc2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x7ff7cecd5da0
cmp r8d, 0x29635c82
je 0x7ff7cecd5dcc
test r9d, r9d
jne 0x7ff7cecd5d80
mov rax, qword [rax]
jmp 0x7ff7cecd5d50
mov ecx, dword [rbx + 0x24]
mov r8d, dword [rsp + 0x50]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rdx, rbp
mov rcx, qword [rsi + 0x10]
add rax, r10
add rcx, 0x14
call rax
mov rax, qword [rsi + 0x10]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
inc dword [rax + 4]
add rsp, 0x20
pop rdi
ret
Function at 0x7ff7cecd5e20
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov esi, edx
imul esi, r8d
mov r14, rcx
mov dword [rcx], edx
mov dword [rcx + 4], r8d
mov rax, qword [rax + 0x18]
shl esi, 2
mov dword [rcx + 8], esi
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x7ff7cecd5ed7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x7ff7cecd5ed7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x32cbcb3a
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x7ff7cecd5ed2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x7ff7cecd5eb0
cmp r8d, 0x53a833a6
je 0x7ff7cecd5edc
test r9d, r9d
jne 0x7ff7cecd5e90
mov rax, qword [rax]
jmp 0x7ff7cecd5e60
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
mov ecx, esi
call rax
mov rcx, qword gs:[0x60]
mov rsi, rax
mov qword [r14 + 0x10], rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x7ff7cecd5f87
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x7ff7cecd5f87
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x946303be
lea rax, [rdi + r9*4]
mov eax, dword [rax + r10]
add rax, r10
movzx edx, byte [rax]
inc rax
test dl, dl
je 0x7ff7cecd5f82
nop
movsx edx, dl
lea rax, [rax + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rax - 1]
test dl, dl
jne 0x7ff7cecd5f60
cmp r8d, 0x7a42de19
je 0x7ff7cecd5f8c
test r9d, r9d
jne 0x7ff7cecd5f40
mov rcx, qword [rcx]
jmp 0x7ff7cecd5f10
mov ecx, dword [rbx + 0x24]
mov r8d, dword [r14 + 8]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
add rax, r10
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x30]
mov rax, r14
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x7ff7cecdc270
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x58
mov eax, dword [0x7ff7ced8746c]
xorps xmm4, xmm4
cdq
movaps xmmword [rsp + 0x40], xmm6
sub eax, edx
movaps xmmword [rsp + 0x30], xmm7
sar eax, 1
movaps xmm7, xmm1
movaps xmmword [rsp + 0x20], xmm8
xorps xmm3, xmm3
movaps xmm8, xmm0
xorps xmm2, xmm2
movd xmm6, eax
mov eax, dword [0x7ff7ced87468]
cdq
sub eax, edx
sar eax, 1
ucomiss xmm8, xmm4
movd xmm5, eax
cvttss2si eax, dword [0x7ff7ced86440]
cvtdq2ps xmm5, xmm5
cvtdq2ps xmm6, xmm6
jp 0x7ff7cecdc2c8
je 0x7ff7cecdc326
comiss xmm8, xmm6
jbe 0x7ff7cecdc2fe
movaps xmm3, xmm6
movd xmm0, eax
subss xmm3, xmm8
cvtdq2ps xmm0, xmm0
xorps xmm3, xmmword [0x7ff7ced73340]
divss xmm3, xmm0
movaps xmm0, xmm6
movaps xmm1, xmm3
addss xmm0, xmm6
addss xmm1, xmm6
comiss xmm1, xmm0
jbe 0x7ff7cecdc2fe
xorps xmm3, xmm3
comiss xmm6, xmm8
jbe 0x7ff7cecdc326
movaps xmm3, xmm8
movd xmm0, eax
subss xmm3, xmm6
cvtdq2ps xmm0, xmm0
divss xmm3, xmm0
movaps xmm1, xmm3
addss xmm1, xmm6
comiss xmm4, xmm1
jbe 0x7ff7cecdc326
xorps xmm3, xmm3
ucomiss xmm7, xmm4
jp 0x7ff7cecdc32d
je 0x7ff7cecdc387
comiss xmm7, xmm5
jbe 0x7ff7cecdc361
movaps xmm2, xmm5
movd xmm0, eax
subss xmm2, xmm7
cvtdq2ps xmm0, xmm0
xorps xmm2, xmmword [0x7ff7ced73340]
divss xmm2, xmm0
movaps xmm0, xmm5
movaps xmm1, xmm2
addss xmm0, xmm5
addss xmm1, xmm5
comiss xmm1, xmm0
jbe 0x7ff7cecdc361
xorps xmm2, xmm2
comiss xmm5, xmm7
jbe 0x7ff7cecdc387
movaps xmm2, xmm7
movd xmm0, eax
subss xmm2, xmm5
cvtdq2ps xmm0, xmm0
divss xmm2, xmm0
movaps xmm1, xmm2
addss xmm1, xmm5
comiss xmm4, xmm1
jbe 0x7ff7cecdc387
xorps xmm2, xmm2
cvttss2si r8d, xmm2
xor ecx, ecx
cvttss2si edx, xmm3
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x20]
add rsp, 0x58
jmp fcn.7ff7cecd53d0
Function at 0x7ff7cece56f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x7ff7ced83080]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.7ff7ced50e8c
mov qword [rax], rbx
mov qword [rsp + 0x30], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x7ff7cece63d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbase.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x7ff7cece5766
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.7ff7ced50860
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.msvcp140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x7ff7cece6090
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x7ff7cece60c1
lea rcx, [0x7ff7ced721b8]
call qword [sym.imp.msvcp140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x7ff7ced87718]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x7ff7ced87728]
lea rdx, [rdi + rdi]
call fcn.7ff7cece3d00
mov rax, qword [0x7ff7ced87718]
lea r9, [rdi - 1]
mov qword [0x7ff7ced87740], r9
mov qword [0x7ff7ced87748], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x7ff7cece6234
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x7ff7ced87728]
mov r9, qword [r11]
cmp r9, rbx
jne 0x7ff7cece6180
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x7ff7cece61f5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x7ff7cece61bd
mov r10, qword [rdx]
cmp r10, rax
je 0x7ff7cece61b7
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x7ff7cece61f5
cmp r9, rdx
je 0x7ff7cece61d1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x7ff7cece6209
cmp r9, rdx
jne 0x7ff7cece61c2
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x7ff7cece622f
mov r9, qword [0x7ff7ced87740]
jmp 0x7ff7cece6131
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x7ff7cece61f5
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret