joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140073d50
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push rbx
sub rsp, 0x20
call fcn.1400194f0
test rax, rax
je 0x140073d6e
call fcn.140019510
mov rbx, qword [rax + 0x88]
jmp 0x140073d70
xor ebx, ebx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetKeyboardLayout]
shr rax, 0x10
mov r9d, 4
movzx ecx, ax
lea r8, [rbx + 0x2c]
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jne 0x140073d9b
mov dword [rbx + 0x2c], eax
add rsp, 0x20
pop rbx
ret

Function at 0x140077850
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
mov rax, qword [0x14089fed8]
mov r8, qword [rax + 0x4e18]
cmp ecx, 0xffffffff
jne 0x140077870
cmp dword [r8 + 0x74], ecx
cmovne ecx, dword [r8 + 0x74]
cmp ecx, dword [r8 + 0x6c]
mov eax, 0xffffffff
cmove ecx, eax
test byte [r8 + 4], 7
je 0x1400778bb
movzx eax, word [r8 + 0x78]
xor edx, edx
mov word [r8 + 0x224], cx
lea rcx, str.ContextMenu
mov word [r8 + 0x7a], ax
mov byte [r8 + 0x23b], 1
mov r8d, dword [r8]
call fcn.14002ad60
xor edx, edx
mov ecx, eax
add rsp, 0x28
jmp fcn.140032770
add rsp, 0x28
ret

Function at 0x140077e00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14089fed8]
mov rcx, qword [rax + 0x4e18]
mov r9, qword [rax + 0x4038]
movups xmm0, xmmword [r9 + 0x248]
movups xmmword [rcx + 0x170], xmm0
mov rax, qword [r9 + 0x2a8]
movups xmm0, xmmword [rcx + 0x150]
movss xmm4, dword [rcx + 0x150]
movss xmm3, dword [rcx + 0x154]
movss xmm2, dword [rcx + 0x158]
movss xmm1, dword [rcx + 0x15c]
movups xmmword [r9 + 0x248], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2a8]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [rcx + 0x232]
mov rcx, qword [rcx + 0x1a0]
mov rdx, qword [r9 + 0x2a8]
add rsp, 0x38
jmp fcn.14004b440

Function at 0x140077ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14089fed8]
mov rcx, qword [rax + 0x4e18]
mov r10, qword [rax + 0x4038]
movsxd rax, dword [rcx + 0x74]
movups xmm0, xmmword [rcx + 0x170]
movss xmm4, dword [rcx + 0x170]
movss xmm3, dword [rcx + 0x174]
movss xmm2, dword [rcx + 0x178]
movss xmm1, dword [rcx + 0x17c]
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
imul r9, rax, 0x70
mov rax, qword [r10 + 0x2a8]
add r9, qword [rcx + 0x18]
movups xmmword [r10 + 0x248], xmm0
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x2a8]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, word [r9 + 0x5c]
mov rdx, qword [r10 + 0x2a8]
mov rcx, qword [rcx + 0x1a0]
add rsp, 0x38
jmp fcn.14004b440
Function at 0x14007d420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, qword [0x14089fed8]
mov r10, rcx
mov r9, qword [rcx + 0x188]
movsxd rax, edx
imul rbx, rax, 0x70
add rbx, qword [rcx + 0x18]
mov dword [rcx + 0x74], edx
test dword [rbx], 0x10000
movss xmm2, dword [rbx + 0x34]
je 0x14007d463
addss xmm2, dword [rcx + 0x90]
movaps xmm0, xmm2
lea rsi, [r9 + 0x110]
subss xmm0, dword [r9 + 0x28]
movss dword [rsi], xmm2
movss xmm1, dword [rcx + 0x88]
addss xmm1, dword [rcx + 0x7c]
movss dword [r9 + 0x128], xmm2
subss xmm0, dword [r9 + 0x154]
movss dword [r9 + 0x118], xmm2
movss dword [r9 + 0x114], xmm1
movss dword [r9 + 0x158], xmm0
mov eax, dword [rcx + 0x8c]
mov dword [r9 + 0x148], eax
movsx eax, byte [rbx + 0x6a]
mov dword [r9 + 0x168], eax
movss dword [r9 + 0x22c], xmm1
mov eax, dword [rbx + 0x34]
mov dword [r9 + 0x228], eax
mov eax, dword [rbx + 0x38]
mov dword [r9 + 0x230], eax
mov eax, dword [rbx + 0x3c]
mov dword [r9 + 0x1cc], eax
movzx eax, byte [rbx + 0x68]
mov byte [r9 + 0xc3], al
cmp byte [rbx + 0x68], 0
je 0x14007d50f
xor eax, eax
mov dword [rdi + 0x49c8], eax
mov dword [rdi + 0x49d0], eax
test dword [rcx + 4], 0x100000
je 0x14007d523
mov r8d, 2
jmp 0x14007d5a3
movups xmm0, xmmword [rbx + 0x20]
mov rax, qword [r9 + 0x2a8]
movss xmm4, dword [rbx + 0x20]
movss xmm3, dword [rbx + 0x24]
movss xmm2, dword [rbx + 0x28]
movss xmm1, dword [rbx + 0x2c]
movups xmmword [r9 + 0x248], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x2a8]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
movzx r8d, word [rbx + 0x5c]
mov rdx, qword [r9 + 0x2a8]
mov rcx, qword [r10 + 0x1a0]
call fcn.14004b440
cmp byte [rdi + 0x5ff8], 0
je 0x14007d5e1
cmp byte [rbx + 0x68], 0
jne 0x14007d5e1
xor r8d, r8d
lea rdx, [0x14037a9d4]
mov rcx, rsi
call fcn.1400321a0
mov dword [rdi + 0x6028], 0x7f7fffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b60b0
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
movaps xmmword [rsp + 0x70], xmm6
mov rsi, rdx
xorps xmm6, xmm6
mov rbp, rcx
cvtss2sd xmm6, xmm2
lea rcx, [0x14037a078]
mov rdi, r9
movaps xmm1, xmm6
movq rdx, xmm6
call fcn.14006f000
movsxd rbx, eax
lea rcx, [rsp + 0x30]
mov rdx, rbx
xor r8d, r8d
call fcn.1400df690
cmp qword [rsp + 0x48], 0xf
lea rcx, [rsp + 0x30]
lea rdx, [rbx + 1]
movaps xmm3, xmm6
cmova rcx, qword [rsp + 0x30]
lea r8, [0x14037a078]
movq r9, xmm6
call fcn.14006f060
cmp qword [rsp + 0x48], 0xf
lea r8, [rsp + 0x30]
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x50]
cmova r8, qword [rsp + 0x30]
mov rdx, rsi
mov rcx, rbp
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400b619b
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b6196
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400b6196
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140224898
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm6, xmmword [rsp + 0x70]
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
cvtsd2ss xmm0, xmm0
mov rsp, r11
pop rdi
ret
Function at 0x1400bb170
Capabilities:
Read .ini file

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb8
mov rbx, r9
mov rsi, r8
mov rdi, rdx
mov r13, rcx
xor r12d, r12d
mov r8, rdx
lea rax, [rdx + 0x18]
cmp qword [rdx + 0x18], 0xf
jbe 0x1400bb1b7
mov r8, qword [rdx]
mov word [rsp + 0x103], 0x4c
mov word [rsp + 0x100], 0x554e
mov byte [rsp + 0x102], 0x4c
mov byte [rsp + 0x105], 0
mov rdx, rbx
lea r15, [rdi + 0x18]
cmp qword [r9 + 0x18], 0xf
jbe 0x1400bb1ef
mov rdx, qword [r9]
mov r15, rax
mov rcx, rsi
lea r14, [rsi + 0x18]
cmp qword [r14], 0xf
jbe 0x1400bb1ff
mov rcx, qword [rsi]
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], 0x64
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x100]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], r12
mov qword [r13 + 0x18], r12
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400bb240
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.14006d8c0
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x1400bb29a
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x1400bb295
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400bb347
mov rcx, r8
lea r15, [rdi + 0x18]
lea r14, [rsi + 0x18]
call fcn.140224898
mov qword [rdi + 0x10], r12
mov qword [r15], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rdx, qword [r14]
cmp rdx, 0xf
jbe 0x1400bb2dd
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x1400bb2d8
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400bb34e
mov rcx, r8
call fcn.140224898
mov qword [rsi + 0x10], r12
mov qword [r14], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400bb321
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400bb31c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400bb355
mov rcx, r8
call fcn.140224898
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rax, r13
add rsp, 0xb8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400c44f0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xa0
mov rbx, rcx
mov r8, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
mov rax, rcx
sub rax, r8
xor r12d, r12d
cmp rax, 3
jb 0x1400c45ac
lea rax, [r8 + 3]
mov qword [rbx + 0x10], rax
mov rdi, rbx
cmp rcx, 0xf
jbe 0x1400c4540
mov rdi, qword [rbx]
lea rax, [0x14037e38f]
mov r14d, 3
lea rsi, [0x14037e38c]
cmp rax, rdi
jbe 0x1400c4574
lea rax, [rdi + r8]
cmp rsi, rax
ja 0x1400c4574
cmp rdi, rsi
ja 0x1400c456c
mov rbp, r12
jmp 0x1400c4577
mov rbp, rdi
sub rbp, rsi
jmp 0x1400c4577
mov rbp, r14
inc r8
lea rcx, [rdi + 3]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
sub r14, rbp
lea rdx, [rsi + 3]
add rdx, rbp
lea rcx, [rdi + rbp]
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
jmp 0x1400c45da
mov r14d, 3
mov qword [rsp + 0x28], r14
lea rsi, [0x14037e38c]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
movzx r8d, byte [rsp + 0xd0]
mov edx, r14d
mov rcx, rbx
call fcn.14006e170
lea rdi, [rbx + 0x18]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
mov dword [rsp + 0x30], reloc.WS2_32.dll_WSASetLastError
mov dword [rsp + 0x34], 0x40
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], r12
lea rax, str.cmd.exe
mov qword [rsp + 0x48], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400c463d
mov rax, qword [rbx]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x60], r12d
mov qword [rsp + 0x68], r12
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x1400c4677
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdi, [rbx + 0x18]
lea rdx, [rsp + 0xd8]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rdi]
cmp rdx, 0xf
jbe 0x1400c46d1
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400c46cc
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400c46fb
mov rcx, r8
call fcn.140224898
mov qword [rbx + 0x10], r12
mov qword [rdi], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400c4710
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x480
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov ecx, 2
xor ebp, ebp
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400c47a6
xor edx, edx
mov dword [rsp + 0x30], 0x238
mov r8d, 0x234
lea rcx, [rsp + 0x34]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x30]
mov rcx, rsi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400c479d
nop
cmp qword [rdi + 0x18], 7
mov rdx, rdi
jbe 0x1400c477d
mov rdx, qword [rdi]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rsi
test eax, eax
je 0x1400c47e2
lea rdx, [rsp + 0x30]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400c4770
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
lea rdx, [0x14037e398]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
xor r8d, r8d
mov qword [rbx + 0x18], rbp
mov rcx, rbx
call fcn.1400d1960
lea r11, [rsp + 0x480]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400c47a6
lea r9, [rsp + 0x4a0]
mov dword [rsp + 0x4a0], 0x104
lea r8, [rsp + 0x270]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
mov rcx, rdi
test eax, eax
je 0x1400c47a0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
lea rax, [rsp + 0x270]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], rbp
inc r8
cmp word [rax + r8*2], bp
jne 0x1400c4856
lea rdx, [rsp + 0x270]
jmp 0x1400c47be
Function at 0x1400dff50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rcx + 0x1384], 0xffffffff
lea r9, [rcx + 8]
mov dword [rcx + 4], edx
mov r8d, 1
nop word [rax + rax]
mov eax, edx
lea r9, [r9 + 4]
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, r8d
inc r8
mov dword [r9 - 4], edx
cmp r8, 0x270
jb 0x1400dff70
mov dword [rcx], 0x270
mov rax, rcx
ret
Function at 0x1400e4170
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1400e41d1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400e4190
mov ecx, dword [r9]
jmp 0x1400e42b8
cmp ecx, 0x4e0
jb 0x1400e42b8
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400e41f0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400e4240
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x1400ea370
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400ea439
cmp byte [rcx + 0x71], 0
je 0x1400ea439
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400ea42c
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400ea3e8
sub eax, 1
je 0x1400ea3ec
cmp eax, 2
jne 0x1400ea42c
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x1400ea41a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400ea42c
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret
Function at 0x1400ea930
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1400eaae1
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x40], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.1400e9c80
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1400eaaa6
mov qword [rsp + 0x38], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x1400eaa20
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1400eaa95
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x1400eaa5d
mov r10, qword [rdx]
cmp r10, rax
je 0x1400eaa57
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1400eaa95
cmp r9, rdx
je 0x1400eaa71
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1400eaabb
cmp r9, rdx
jne 0x1400eaa62
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1400ea9d0
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400eaa95
lea rcx, str.invalid_hash_bucket_count
call sub.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_
int3
Function at 0x1400fc720
Capabilities:
Allocate or change rwx memory
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rdi, rcx
lea rsi, [rcx + 8]
mov r8, rsi
mov edx, dword [rcx]
mov ecx, dword [rcx + 4]
call fcn.1402267c0
test eax, eax
jne 0x1400fc946
mov r15, qword [rdi + 0x18]
mov rbx, qword [rdi + 0x20]
mov qword [rsp + 0xb8], rbx
cmp r15, rbx
je 0x1400fc938
nop dword [rax]
mov r13, qword [r15]
mov r12d, dword [r13 + 0xc]
add r12, qword [rdi + 0x10]
mov edx, dword [r13 + 0x10]
lea r9, [0x1408a867c]
mov r8d, 0x40
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400fc946
mov r8d, dword [r13 + 0x10]
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
mov r9, r12
mov rdx, r12
mov rcx, qword [rsi]
call fcn.140226f70
mov rbp, rax
xor esi, esi
test rax, rax
je 0x1400fc8f0
xor r14d, r14d
mov rbx, qword [rsp + 0xb0]
mov ecx, dword [rbx + r14]
sub ecx, 0xde
cmp ecx, 1
ja 0x1400fc8d5
mov dword [rsp + 0x48], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
mov rbx, qword [rbx + r14 + 8]
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x4c], esi
xor eax, eax
mov rdx, qword [rsp + 0x58]
mov dword [rsp + 0x48], eax
movzx ecx, byte [rbx]
cmp cl, 0xcc
je 0x1400fc82d
cmp cl, 0xf1
jne 0x1400fc870
mov qword [rsp + 0x30], rbx
cmp rdx, qword [rsp + 0x60]
je 0x1400fc851
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdx], xmm0
add rdx, 0x10
mov qword [rsp + 0x58], rdx
inc eax
inc rbx
jmp 0x1400fc81c
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1400d3580
mov rdx, qword [rsp + 0x58]
mov eax, dword [rsp + 0x48]
inc eax
inc rbx
jmp 0x1400fc81c
cmp eax, 1
jbe 0x1400fc899
lea rcx, [rdi + 0x48]
mov rdx, qword [rdi + 0x50]
lea r8, [rsp + 0x40]
cmp rdx, qword [rdi + 0x58]
je 0x1400fc894
call fcn.1400d88d0
add qword [rdi + 0x50], 0x28
jmp 0x1400fc899
call fcn.1400d3720
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400fc8d5
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fc8d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fc931
call fcn.140224898
inc rsi
add r14, 0xf0
cmp rsi, rbp
jb 0x1400fc7d2
mov rbx, qword [rsp + 0xb8]
mov rdx, rbp
mov rcx, qword [rsp + 0xb0]
call fcn.140227730
mov edx, dword [r13 + 0x10]
lea r9, [0x1408a867c]
mov r8d, dword [0x1408a867c]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400fc946
add r15, 0x20
cmp r15, rbx
je 0x1400fc938
lea rsi, [rdi + 8]
jmp 0x1400fc770
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov dword [0x1408a867c], 0
mov al, 1
jmp 0x1400fc948
xor al, al
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140101100
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0x13b8
call fcn.140224c40
sub rsp, rax
lea rcx, [rsp + 0x13c0]
call fcn.14010e7b0
mov dword [rsp + 0x13a4], 0xffffffff
mov ecx, 1
mov edx, dword [rax]
mov dword [rsp + 0x24], edx
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x24], edx
inc rcx
cmp rcx, 0x270
jb 0x140101130
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x270
call fcn.1400e4170
mov ecx, eax
lea rdx, [rcx + rcx*4]
test edx, edx
jne 0x140101185
nop dword [rax + rax]
lea rcx, [rsp + 0x20]
call fcn.1400e4170
mov ecx, eax
lea rdx, [rcx + rcx*4]
cmp edx, 1
jb 0x140101170
shr rdx, 0x20
sub edx, 0x8000
xor edx, 0xffff8000
je 0x1401011f1
sub edx, 1
je 0x1401011e2
sub edx, 1
je 0x1401011d3
sub edx, 1
je 0x1401011c4
cmp edx, 1
je 0x1401011b5
xor eax, eax
add rsp, 0x13b8
ret
lea rax, [0x14037bca8]
add rsp, 0x13b8
ret
lea rax, [0x14037bc98]
add rsp, 0x13b8
ret
lea rax, [0x14037bc88]
add rsp, 0x13b8
ret
lea rax, [0x14037bc78]
add rsp, 0x13b8
ret
lea rax, [0x14037bc68]
add rsp, 0x13b8
ret