joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f8b0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
test rcx, rcx
je 0x14000fa19
cmp word [rcx], 0
je 0x14000fa19
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rax
mov dword [rbp - 0x60], 0x68
psrldq xmm0, 0xc
movd eax, xmm0
or eax, 1
mov dword [rbp - 0x24], eax
xor edi, edi
mov word [rbp - 0x20], di
lea rax, vtable.CVolCommonBaseWithMemManager.0
mov qword [rsp + 0x50], rax
lea rsi, vtable.CVolObject.0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
lea r14, vtable.CVolMem.0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x80], 0x40
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.140010b40
mov rdx, qword [rsp + 0x68]
cmp qword [rsp + 0x78], rdi
cmove rdx, rdi
lea rax, [rbp - 0x78]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x14000f9bb
mov ebx, edi
jmp 0x14000f9e3
mov edx, 0x1f4
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.USER32.dll_WaitForInputIdle]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
mov qword [rsp + 0x50], r14
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x14000fa00
lea rcx, [rsp + 0x50]
mov r8, qword [rsp + 0x50]
call qword [r8 + 0x18]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x50], rsi
mov rax, rbx
jmp 0x14000fa1b
xor eax, eax
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000fa70
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push r14
sub rsp, 0x28
mov r14, rcx
call fcn.14000bab0
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
movzx eax, word [rax]
test ax, ax
je 0x14000faa4
cmp ax, 0x20
ja 0x14000faa4
movzx eax, word [rdx + 2]
add rdx, 2
test ax, ax
jne 0x14000fa91
movzx r9d, word [rdx]
movzx eax, r9w
cmp r9w, 0x22
jne 0x14000fab7
movzx eax, word [rdx + 2]
mov ecx, 0x20
mov r8d, 0x22
cmovne r8w, cx
lea rcx, [rdx + 2]
cmovne rcx, rdx
cmp ax, r8w
je 0x14000faf1
movzx edx, ax
movzx eax, dx
test dx, dx
je 0x14000faf1
movzx eax, word [rcx + 2]
add rcx, 2
movzx edx, ax
cmp ax, r8w
jne 0x14000fad8
test ax, ax
lea rdx, [rcx + 2]
cmove rdx, rcx
mov rsi, rdx
cmp r9w, 0x22
jne 0x14000fb10
cmp word [rdx], 0x20
jne 0x14000fb10
lea rsi, [rdx + 2]
movzx eax, word [rsi]
test ax, ax
je 0x14000fc9e
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
cmp ax, 0x22
jne 0x14000fbe2
movzx eax, word [rsi + 2]
add rsi, 2
mov rdi, rsi
test ax, ax
je 0x14000fb63
nop dword [rax]
cmp ax, 0x22
je 0x14000fb63
movzx eax, word [rdi + 2]
add rdi, 2
test ax, ax
jne 0x14000fb50
mov rbx, rdi
sub rbx, rsi
sar rbx, 1
test rbx, rbx
jle 0x14000fb98
mov rax, qword [r14]
add rbx, rbx
mov rcx, r14
lea rdx, [rbx + 2]
call qword [rax]
mov r8, rbx
mov rdx, rsi
mov rcx, rax
mov rbp, rax
call fcn.140018330
mov word [rbx + rbp], r15w
jmp 0x14000fb9b
mov rbp, r15
mov rbx, qword [r14 + 0x30]
lea rcx, [r14 + 8]
mov rax, qword [rcx + 0x20]
sub rax, rbx
cmp rax, 8
jl 0x14000fbbf
mov rax, qword [rcx + 0x18]
mov qword [rbx + rax], rbp
add qword [rcx + 0x28], 8
jmp 0x14000fbcc
lea rdx, [rbx + 8]
call fcn.1400109f0
mov qword [rax + rbx], rbp
mov rsi, rdi
cmp word [rdi], r15w
je 0x14000fc7e
lea rsi, [rdi + 2]
jmp 0x14000fc7e
cmp ax, 0x20
jbe 0x14000fc7a
mov rdi, rsi
nop
cmp ax, 0x22
je 0x14000fc09
cmp ax, 0x20
jbe 0x14000fc09
movzx eax, word [rdi + 2]
add rdi, 2
test ax, ax
jne 0x14000fbf0
mov rbx, rdi
sub rbx, rsi
sar rbx, 1
test rbx, rbx
jle 0x14000fc3e
mov rax, qword [r14]
add rbx, rbx
mov rcx, r14
lea rdx, [rbx + 2]
call qword [rax]
mov r8, rbx
mov rdx, rsi
mov rcx, rax
mov rbp, rax
call fcn.140018330
mov word [rbx + rbp], r15w
jmp 0x14000fc41
mov rbp, r15
mov rbx, qword [r14 + 0x30]
lea rcx, [r14 + 8]
mov rax, qword [rcx + 0x20]
sub rax, rbx
cmp rax, 8
jl 0x14000fc68
mov rax, qword [rcx + 0x18]
mov rsi, rdi
mov qword [rbx + rax], rbp
add qword [rcx + 0x28], 8
jmp 0x14000fc7e
lea rdx, [rbx + 8]
call fcn.1400109f0
mov rsi, rdi
mov qword [rax + rbx], rbp
jmp 0x14000fc7e
add rsi, 2
movzx eax, word [rsi]
test ax, ax
jne 0x14000fb33
mov r15, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rax, qword [r14 + 0x30]
shr rax, 3
add rsp, 0x28
pop r14
pop rsi
ret
Function at 0x14001327c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400132c6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400132c6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400132c6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400132c6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400132c6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400132c8
xor al, al
add rsp, 0x28
ret

Function at 0x140018d48
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140018bb3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140018bb3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140018bb3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140018bb3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140018bb3
cmp dword [rcx + 0x84], 0xe
jbe 0x140018bb3
cmp dword [rcx + 0xf8], 0
je 0x140018bb3
mov ecx, ebx
call fcn.140018c64
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140018a40
nop
cmp dword [rbp + 0x20], 0
je 0x140018c01
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140018c0c
int3
xor r8d, r8d
xor edx, edx
jmp 0x140018b44
Function at 0x140022164
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400221eb
mov rsi, rbx
cmp word [rax], bp
je 0x1400221aa
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140022194
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140022190
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14001fc88
mov rdi, rax
test rax, rax
je 0x1400221d8
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140018330
mov rbp, rdi
xor ecx, ecx
call fcn.14001e570
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140026bb0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140026bd8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140026bd8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x180914000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x18091400a
jmp 0x18091600f
jmp fcn.1805c4058
Function at 0x140001070
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
xor r9d, r9d
cmp byte [0x14004bc90], r9b
jne 0x14000111a
mov dword [rbp - 0x10], 0xa9d32699
mov dword [rbp - 0xc], 0xeed71383
mov dword [rbp - 8], 0x21ff195c
mov word [rbp - 4], 0xca
mov qword [rbp + 0x10], r9
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x10]
mov rax, qword [rbp + 0x10]
mov r8b, byte [rbp + rax - 0xf]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 4
mov al, dl
add al, al
add dl, al
mov rax, qword [rbp + 0x10]
shl dl, 3
sub cl, dl
mov edx, 0x3ecd376d
sar edx, cl
xor dl, r8b
mov byte [rbp + rax - 0xf], dl
mov rax, qword [rbp + 0x10]
inc rax
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
cmp rax, 0xc
jb 0x1400010ac
mov byte [rbp - 3], r9b
lea rdx, [rbp - 0xf]
lea r8, [0x14004bc90]
mov cl, byte [rdx]
inc rdx
mov byte [r8], cl
inc r8
test cl, cl
jne 0x14000110b
lea rax, [0x14004bc90]
add rsp, 0x10
pop rbp
ret
Function at 0x1400045c8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [r8 + 0x18], 0x10
mov rbx, r8
mov r15, qword [r8 + 0x10]
mov r14, rdx
mov rbp, rcx
jb 0x1400045fb
mov r8, qword [r8]
xor r10d, r10d
lea rcx, [r8 + r15]
cmp r8, rcx
mov rdx, r15
movabs rax, 0xcbf29ce484222325
mov r9, r8
cmova rdx, r10
test rdx, rdx
je 0x140004641
movzx ecx, byte [r9]
movabs r10, 0x100000001b3
xor rax, rcx
inc r9
mov rcx, r9
sub rcx, r8
imul rax, r10
cmp rcx, rdx
jne 0x14000461e
mov r12, qword [rbp + 0x30]
and r12, rax
mov rax, qword [rbp + 0x18]
mov rbp, qword [rbp + 8]
add r12, r12
mov qword [rsp + 0x50], rax
mov rdi, qword [rax + r12*8]
cmp qword [rax + r12*8], rbp
jne 0x140004667
mov rax, rbp
jmp 0x14000466f
mov rax, qword [rax + r12*8 + 8]
mov rax, qword [rax]
cmp rdi, rax
je 0x1400046e4
cmp qword [rbx + 0x18], 0x10
lea rsi, [rdi + 0x10]
mov rdx, rbx
jb 0x140004685
mov rdx, qword [rbx]
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x140004692
mov rcx, qword [rsi]
mov r13, qword [rsi + 0x10]
cmp r13, r15
jne 0x1400046a7
mov r8, r13
call fcn.140032730
test eax, eax
je 0x1400046b1
mov rdi, qword [rdi]
mov rax, qword [rsp + 0x50]
jmp 0x14000465c
cmp qword [rsi + 0x18], 0x10
jb 0x1400046bb
mov rsi, qword [rsi]
cmp qword [rbx + 0x18], 0x10
jb 0x1400046c5
mov rbx, qword [rbx]
cmp r15, r13
jne 0x1400046dc
mov r8, r15
mov rdx, rsi
mov rcx, rbx
call fcn.140032730
test eax, eax
je 0x1400046df
mov rdi, rbp
mov qword [r14], rdi
jmp 0x1400046e7
mov qword [r14], rbp
mov rbx, qword [rsp + 0x58]
mov rax, r14
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140004724
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [rdx + 0x18], 0x10
mov r14, rdx
mov r12, qword [rdx + 0x10]
mov r13, rcx
jb 0x140004751
mov rdx, qword [rdx]
xor ebp, ebp
lea rcx, [rdx + r12]
cmp rdx, rcx
mov r8, r12
movabs rax, 0xcbf29ce484222325
mov r9, rdx
cmova r8, rbp
test r8, r8
je 0x140004796
movzx ecx, byte [r9]
movabs r10, 0x100000001b3
xor rax, rcx
inc r9
mov rcx, r9
sub rcx, rdx
imul rax, r10
cmp rcx, r8
jne 0x140004773
mov r15, qword [r13 + 0x30]
mov rsi, qword [r13 + 8]
and r15, rax
mov rax, qword [r13 + 0x18]
add r15, r15
mov qword [rsp + 0x68], rax
mov rbx, qword [rax + r15*8]
cmp qword [rax + r15*8], rsi
jne 0x1400047bc
mov rax, rsi
jmp 0x1400047c4
mov rax, qword [rax + r15*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x140004862
cmp qword [r14 + 0x18], 0x10
mov rdx, r14
jb 0x1400047da
mov rdx, qword [r14]
cmp qword [rbx + 0x28], 0x10
lea rcx, [rbx + 0x10]
jb 0x1400047e9
mov rcx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x20]
cmp r8, r12
jne 0x1400047fb
call fcn.140032730
test eax, eax
je 0x140004804
mov rbx, qword [rbx]
mov rax, qword [r13 + 0x18]
jmp 0x1400047b1
mov r13, qword [rsp + 0x68]
mov rdi, rbx
cmp qword [r13 + r15*8], rsi
jne 0x140004818
mov rax, rsi
jmp 0x140004820
mov rax, qword [r13 + r15*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x140004858
cmp qword [rbx + 0x28], 0x10
lea rdx, [rbx + 0x10]
jb 0x140004834
mov rdx, qword [rbx + 0x10]
cmp qword [r14 + 0x18], 0x10
mov rcx, r14
jb 0x140004841
mov rcx, qword [r14]
cmp r12, qword [rbx + 0x20]
jne 0x140004858
mov r8, r12
call fcn.140032730
test eax, eax
jne 0x140004858
mov rbx, qword [rbx]
jmp 0x14000480c
mov r13, qword [rsp + 0x60]
cmp rdi, rbx
jne 0x140004868
mov rdi, rsi
mov rbx, rsi
mov rax, rdi
cmp rdi, rbx
je 0x14000487b
mov rax, qword [rax]
inc rbp
cmp rax, rbx
jne 0x140004870
cmp rdi, qword [rsi]
jne 0x1400048b0
cmp rbx, rsi
jne 0x1400048b0
lea rcx, [r13 + 8]
call fcn.1400051ac
mov edx, 8
mov rcx, r13
call fcn.140005250
jmp 0x1400048b5
mov r8, rdi
lea rdx, [rsp + 0x60]
mov rdi, qword [rdi]
mov rcx, r13
call fcn.1400052e0
cmp rdi, rbx
jne 0x14000489d
mov rbx, qword [rsp + 0x70]
mov rax, rbp
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140004bf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [r8 + 0x18], 0x10
mov r14, rdx
mov r15, qword [r8 + 0x10]
mov rdx, r8
mov rbx, r8
mov rbp, rcx
jb 0x140004c26
mov rdx, qword [r8]
xor r10d, r10d
lea rcx, [rdx + r15]
cmp rdx, rcx
mov r8, r15
movabs rax, 0xcbf29ce484222325
mov r9, rdx
cmova r8, r10
test r8, r8
je 0x140004c6c
movzx ecx, byte [r9]
movabs r10, 0x100000001b3
xor rax, rcx
inc r9
mov rcx, r9
sub rcx, rdx
imul rax, r10
cmp rcx, r8
jne 0x140004c49
mov r12, qword [rbp + 0x30]
and r12, rax
mov rax, qword [rbp + 0x18]
mov rbp, qword [rbp + 8]
add r12, r12
mov qword [rsp + 0x50], rax
mov rdi, qword [rax + r12*8]
cmp qword [rax + r12*8], rbp
jne 0x140004c92
mov rax, rbp
jmp 0x140004c9a
mov rax, qword [rax + r12*8 + 8]
mov rax, qword [rax]
cmp rdi, rax
je 0x140004d0f
cmp qword [rbx + 0x18], 0x10
lea rsi, [rdi + 0x10]
mov rdx, rbx
jb 0x140004cb0
mov rdx, qword [rbx]
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x140004cbd
mov rcx, qword [rsi]
mov r13, qword [rsi + 0x10]
cmp r13, r15
jne 0x140004cd2
mov r8, r13
call fcn.140032730
test eax, eax
je 0x140004cdc
mov rdi, qword [rdi]
mov rax, qword [rsp + 0x50]
jmp 0x140004c87
cmp qword [rsi + 0x18], 0x10
jb 0x140004ce6
mov rsi, qword [rsi]
cmp qword [rbx + 0x18], 0x10
jb 0x140004cf0
mov rbx, qword [rbx]
cmp r15, r13
jne 0x140004d07
mov r8, r15
mov rdx, rsi
mov rcx, rbx
call fcn.140032730
test eax, eax
je 0x140004d0a
mov rdi, rbp
mov qword [r14], rdi
jmp 0x140004d12
mov qword [r14], rbp
mov rbx, qword [rsp + 0x58]
mov rax, r14
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1400052e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rdi, rdx
cmp qword [r9 + 0x18], 0x10
mov r10, rcx
mov r11, qword [r9 + 0x10]
jb 0x140005302
mov r9, qword [r9]
xor ecx, ecx
lea rdx, [r9 + r11]
cmp r9, rdx
movabs rax, 0xcbf29ce484222325
mov rbx, r9
cmova r11, rcx
test r11, r11
je 0x140005343
movzx ecx, byte [rbx]
movabs rdx, 0x100000001b3
xor rax, rcx
inc rbx
mov rcx, rbx
sub rcx, r9
imul rax, rdx
cmp rcx, r11
jne 0x140005321
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14000537b
cmp qword [rcx + rdx*8], r8
jne 0x140005370
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x140005374
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140005388
cmp qword [rcx + rdx*8], r8
jne 0x140005388
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r10 + 8]
mov rdx, rdi
call fcn.140005760
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x140005f80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [r8 + 0x18], 0x10
mov rdi, r8
mov r12, qword [r8 + 0x10]
mov r14, rdx
mov r13, rcx
jb 0x140005fb3
mov r8, qword [r8]
xor r10d, r10d
lea rcx, [r8 + r12]
cmp r8, rcx
mov rdx, r12
movabs rax, 0xcbf29ce484222325
mov r9, r8
cmova rdx, r10
test rdx, rdx
je 0x140005ffc
movzx ecx, byte [r9]
movabs r10, 0x100000001b3
xor rax, rcx
inc r9
mov rcx, r9
sub rcx, r8
imul rax, r10
cmp rcx, rdx
jne 0x140005fd6
xor r10d, r10d
mov rbp, qword [r13 + 0x30]
mov r15, qword [r13 + 8]
and rbp, rax
mov rax, qword [r13 + 0x18]
add rbp, rbp
mov rbx, qword [rax + rbp*8]
cmp qword [rax + rbp*8], r15
jne 0x14000601d
mov rax, r15
jmp 0x140006025
mov rax, qword [rax + rbp*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x14000609e
cmp qword [rdi + 0x18], 0x10
lea rsi, [rbx + 0x10]
mov rdx, rdi
jb 0x14000603b
mov rdx, qword [rdi]
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x140006048
mov rcx, qword [rsi]
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x50], rax
cmp rax, r12
jne 0x140006065
mov r8, rax
call fcn.140032730
xor r10d, r10d
test eax, eax
je 0x14000606e
mov rbx, qword [rbx]
mov rax, qword [r13 + 0x18]
jmp 0x140006012
cmp qword [rsi + 0x18], 0x10
jb 0x140006078
mov rsi, qword [rsi]
cmp qword [rdi + 0x18], 0x10
mov rcx, rdi
jb 0x140006085
mov rcx, qword [rdi]
cmp r12, qword [rsp + 0x50]
jne 0x14000609e
mov r8, r12
mov rdx, rsi
call fcn.140032730
xor r10d, r10d
test eax, eax
je 0x1400060a1
mov rbx, r15
cmp rbx, r15
jne 0x14000613b
mov rbx, qword [r15]
mov ecx, 0x40
mov rsi, qword [rbx + 8]
call fcn.1400087e8
xor edx, edx
mov rcx, rax
mov qword [rax], rbx
mov qword [rax + 8], rsi
mov qword [rax + 0x20], rdx
mov qword [rax + 0x28], rdx
movups xmm0, xmmword [rdi]
movups xmmword [rax + 0x10], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rax + 0x20], xmm1
mov qword [rdi + 0x10], rdx
xor eax, eax
mov qword [rdi + 0x18], 0xf
mov byte [rdi], dl
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x34], rdx
mov dword [rcx + 0x3c], eax
movabs rax, 0x3fffffffffffffe
mov rdx, qword [r13 + 0x10]
sub rax, rdx
cmp rax, 1
jb 0x140006162
lea rax, [rdx + 1]
mov rdx, r14
mov qword [r13 + 0x10], rax
mov qword [rbx + 8], rcx
mov qword [rsi], rcx
mov rcx, r13
mov r9, qword [r13 + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.140006444
jmp 0x140006142
mov qword [r14], rbx
mov byte [r14 + 8], r10b
mov rbx, qword [rsp + 0x58]
mov rax, r14
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, str.list_T__too_long
call fcn.14000743c
int3
Function at 0x14000bf80
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14000bf93
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.140015e84
lea rdx, [0x140046888]
lea rcx, [rsp + 0x20]
call fcn.1400267e0
int3

Function at 0x14001681c
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x14004ae20]
xor edx, edx
jmp fcn.14000bf80

Function at 0x1400171b4
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x14004ae20]
jmp fcn.14000bf80

Function at 0x140022e2c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140022ee8]
mov r9, qword [r9 + 8]
jmp fcn.140013fe0

Function at 0x140022ec0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140022ef8]
mov r9, qword [r9 + 8]
jmp fcn.140013fe0

Function at 0x14002ac6c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14002a9d0
Function at 0x1800014d0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x10
xor r14d, r14d
mov rdi, r8
mov r9, rcx
mov eax, r14d
mov r11d, r14d
test edx, edx
je 0x18000161d
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rbp
lea rbp, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov qword [rsp + 0x30], rsi
lea esi, [r14 + 2]
mov ebx, edx
nop
movzx edx, byte [r9]
mov ecx, eax
inc eax
mov dword [rsp + rcx*4], edx
mov r10d, dword [rsp + 4]
mov r8d, dword [rsp]
cmp eax, 3
jne 0x180001594
mov rax, qword [rsp]
mov edx, r10d
shr rax, 2
and eax, 0x3f
shr edx, 4
mov ecx, r11d
and edx, 0xf
add r11d, 4
movzx eax, byte [rax + rbp]
mov byte [rcx + rdi], al
lea ecx, [rsi - 1]
mov eax, r8d
and eax, 3
shl eax, 4
add edx, eax
movzx eax, byte [rdx + rbp]
mov rdx, qword [rsp + 8]
mov byte [rcx + rdi], al
and edx, 0x3f
mov ecx, dword [rsp + 8]
mov eax, r10d
and eax, 0xf
shr ecx, 6
and ecx, 3
lea eax, [rcx + rax*4]
mov ecx, esi
movzx eax, byte [rax + rbp]
mov byte [rcx + rdi], al
lea ecx, [rsi + 1]
movzx eax, byte [rdx + rbp]
add esi, 4
mov byte [rcx + rdi], al
mov eax, r14d
inc r9
sub rbx, 1
jne 0x180001510
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x20]
test eax, eax
je 0x180001618
mov edx, r11d
cmp eax, 1
cmove r10d, r14d
and r8d, 3
shl r8d, 4
mov dword [rsp + 4], r10d
mov rcx, qword [rsp]
shr rcx, 2
and ecx, 0x3f
movzx ecx, byte [rcx + rbp]
mov byte [rdx + rdi], cl
mov ecx, r10d
shr ecx, 4
lea edx, [r11 + 1]
and ecx, 0xf
add ecx, r8d
movzx ecx, byte [rcx + rbp]
mov byte [rdx + rdi], cl
lea edx, [r11 + 2]
cmp eax, 2
jne 0x180001607
and r10d, 0xf
shl r10d, 2
movzx ecx, byte [r10 + rbp]
jmp 0x180001609
mov cl, 0x3d
mov byte [rdx + rdi], cl
lea ecx, [r11 + 3]
mov byte [rcx + rdi], 0x3d
add r11d, 4
mov rbp, qword [rsp + 0x28]
mov ecx, r11d
mov eax, r11d
mov byte [rcx + rdi], r14b
mov rdi, qword [rsp + 0x38]
add rsp, 0x10
pop r14
ret
Function at 0x180016800
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180087010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1800168d5
cmp byte [rcx + 0x71], 0
je 0x1800168d5
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1800168d1
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x180016894
sub eax, 1
je 0x180016898
cmp eax, 2
jne 0x1800168d1
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18000d430
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1800168c8
lfence
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.180049390
cmp rdi, rax
jne 0x1800168d1
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18001687c
xor al, al
jmp 0x18001687c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18000d430
add rsp, 0x60
pop rbx
ret