joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002420
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rbp, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1800024c7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1800024c7
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0x892459bc
lea rdx, [r11 + r9*4]
mov ecx, dword [rdx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1800024c2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1800024a0
cmp r8d, 0x43e9f7ba
je 0x1800024cc
test r9d, r9d
jne 0x180002480
mov rax, qword [rax]
jmp 0x180002450
mov ecx, dword [rbx + 0x24]
mov edx, dword [rbx + 0x1c]
add rcx, r10
add rdx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
mov rcx, rbp
add rax, r10
call rax
mov rcx, 0xffffffffffffffff
lea rsi, [rax + 1]
mov eax, 2
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.18000ca70
mov rcx, qword gs:[0x60]
mov rdi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov r11d, dword [rdx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x180002595
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x180002595
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0x1429b1bb
add r8, r10
movzx eax, byte [r8]
inc r8
test al, al
je 0x180002590
nop
movsx eax, al
lea r8, [r8 + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [r8 - 1]
test al, al
jne 0x180002570
cmp edx, 0x3c268f8b
je 0x18000259a
test r9d, r9d
jne 0x180002550
mov rcx, qword [rcx]
jmp 0x180002520
mov ecx, dword [r11 + 0x24]
mov r8, rsi
add rcx, r10
mov rdx, rbp
movzx r9d, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + r9*4]
mov rcx, rdi
add rax, r10
call rax
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800025e0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002687
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002687
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xf2ef0416
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002682
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002660
cmp r8d, 0x678ac1ca
je 0x18000268c
test r9d, r9d
jne 0x180002640
mov rax, qword [rax]
jmp 0x180002610
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x30]
add rax, r10
call rax
movd xmm0, dword [rsp + 0x30]
mov rax, rsi
movd xmm2, dword [rsp + 0x34]
mov rbx, qword [rsp + 0x38]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm2, xmm2
cvtps2pd xmm1, xmm0
cvtps2pd xmm0, xmm2
movsd qword [rsi], xmm1
movsd qword [rsi + 8], xmm0
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180002aa0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x110
movaps xmmword [rax - 0x18], xmm6
mov r14, r8
movaps xmmword [rax - 0x28], xmm7
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm8
mov rbp, rcx
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov edi, dword [r9 + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180002b77
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180002b77
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x905d2384
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002b72
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002b50
cmp r8d, 0x37f98f42
je 0x180002b7c
test r9d, r9d
jne 0x180002b30
mov rax, qword [rax]
jmp 0x180002b00
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r10
call rax
movsd xmm7, qword [rsi]
mov rcx, rbp
movsd xmm8, qword [rsi + 8]
addsd xmm7, qword [0x18000f8f8]
addsd xmm8, qword [0x18000f8f8]
movups xmm9, xmmword [0x18000f830]
movups xmm10, xmmword [0x180016308]
movaps xmm11, xmmword [r14]
movaps xmm6, xmmword [rsi]
call fcn.180002420
cmp word [rax], 0
je 0x180002bf6
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x180002be0
xor edx, edx
add ecx, 1
je 0x180002bfa
mov rdx, rax
jmp 0x180002bfa
xor edx, edx
mov ecx, edx
mov rax, qword [0x1800127d8]
movaps xmm0, xmmword [0x18000fae0]
mov rbx, qword [0x180012858]
mov qword [rsp + 0x20], rax
mov rax, qword [0x180016798]
movsd qword [rsp + 0x38], xmm6
unpckhpd xmm6, xmm6
movsd qword [rsp + 0x40], xmm6
movsd qword [rsp + 0x80], xmm7
movsd qword [rsp + 0x88], xmm8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x68], 0
mov word [rsp + 0x90], 0x100
mov byte [rsp + 0x92], 1
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm11
movups xmmword [rsp + 0x6c], xmm10
movups xmmword [rsp + 0x94], xmm9
test rax, rax
jne 0x180002ca8
mov rax, qword [0x180012980]
lea r8, str.Canvas.K2_DrawText
add rax, 0x17a803c
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x180016798], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x268]
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r14
ret
Function at 0x180002d00
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x110
movaps xmmword [rax - 0x18], xmm6
mov r14, r8
movaps xmmword [rax - 0x28], xmm7
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm8
mov rbp, rcx
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov edi, dword [r9 + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180002dd7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180002dd7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x91505924
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002dd2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002db0
cmp r8d, 0x5740ce2
je 0x180002ddc
test r9d, r9d
jne 0x180002d90
mov rax, qword [rax]
jmp 0x180002d60
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r10
call rax
movsd xmm7, qword [rsi]
mov rcx, rbp
movsd xmm8, qword [rsi + 8]
addsd xmm7, qword [0x18000f8f8]
addsd xmm8, qword [0x18000f8f8]
movups xmm9, xmmword [0x18000f830]
movups xmm10, xmmword [0x180016308]
movaps xmm11, xmmword [r14]
movaps xmm6, xmmword [rsi]
call fcn.180002420
cmp word [rax], 0
je 0x180002e56
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x180002e40
xor edx, edx
add ecx, 1
je 0x180002e5a
mov rdx, rax
jmp 0x180002e5a
xor edx, edx
mov ecx, edx
mov rax, qword [0x1800127d8]
movaps xmm0, xmmword [0x18000fae0]
mov rbx, qword [0x180012858]
mov qword [rsp + 0x20], rax
mov rax, qword [0x180016798]
movsd qword [rsp + 0x38], xmm6
unpckhpd xmm6, xmm6
movsd qword [rsp + 0x40], xmm6
movsd qword [rsp + 0x80], xmm7
movsd qword [rsp + 0x88], xmm8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x68], 0
mov word [rsp + 0x90], 0x101
mov byte [rsp + 0x92], 1
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm11
movups xmmword [rsp + 0x6c], xmm10
movups xmmword [rsp + 0x94], xmm9
test rax, rax
jne 0x180002f08
mov rax, qword [0x180012980]
lea r8, str.Canvas.K2_DrawText
add rax, 0x17a803c
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x180016798], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x268]
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r14
ret
Function at 0x140c66058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140c661df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140c66089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c6606f
add dl, dl
jne 0x140c66096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c660f6
xor eax, eax
add dl, dl
jne 0x140c660a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c661ad
add dl, dl
jne 0x140c660b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c660c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c660d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c660dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140c660ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140c6607e
mov eax, 1
add dl, dl
jne 0x140c66106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c66113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c660fb
sub eax, ebx
mov ebx, 1
jne 0x140c6614c
mov ecx, 1
add dl, dl
jne 0x140c6612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c6613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c66123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c6607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140c66168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c66175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c6615d
cmp eax, 0x7d00
jae 0x140c6619b
cmp eax, 0x500
jb 0x140c66196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c6607e
cmp eax, 0x7f
ja 0x140c6619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c6607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140c661d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140c6607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002f20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1406b92c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
xor eax, eax
mov word [rsp + 0x35], ax
mov byte [rsp + 0x37], al
mov rbp, qword [rcx + 8]
mov r14, qword [rcx]
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x30], eax
mov byte [rsp + 0x34], al
call fcn.140002900
test rax, rax
je 0x140002f92
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov rdx, rbp
mov rcx, r14
call rax
test eax, eax
setne byte [rsp + 0x34]
movzx eax, byte [rsi]
mov byte [rdi + 0x10], al
mov ecx, 1
lea rdx, [rbx - 1]
cmp rbx, rcx
jbe 0x140003060
cmp rdx, 0x40
jb 0x140003040
lea r8, [rdi + 0x20]
movsx eax, byte [r8]
movd xmm2, eax
punpcklbw xmm2, xmm2
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
lea r9, [rdx + rsi]
lea rax, [rsi + 1]
cmp rax, r8
ja 0x140002fdf
cmp r9, r8
jae 0x140003040
and edx, 0x3f
mov r8, rbx
sub r8, rdx
lea rax, [rsi + 0x21]
nop dword [rax]
movdqu xmm0, xmmword [rax - 0x20]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
movdqu xmm0, xmmword [rax - 0x10]
xorps xmm0, xmm2
movdqu xmmword [rax - 0x10], xmm0
movdqu xmm0, xmmword [rax]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rax + 0x10]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rax + 0x10], xmm1
add rcx, 0x40
lea rax, [rax + 0x40]
cmp rcx, r8
jb 0x140002ff0
cmp rcx, rbx
jae 0x140003060
lea rax, [rsi + rcx]
sub rbx, rcx
nop word [rax + rax]
movzx ecx, byte [rdi + 0x20]
xor byte [rax], cl
lea rax, [rax + 1]
sub rbx, 1
jne 0x140003050
mov rax, qword [rdi]
mov byte [rax], 0xcc
cmp byte [rsp + 0x34], 0
je 0x14000308e
call fcn.140002900
test rax, rax
je 0x14000308e
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call rax
nop
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14028f750
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1400030b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1406b92c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
xor eax, eax
mov word [rsp + 0x35], ax
mov byte [rsp + 0x37], al
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], eax
mov byte [rsp + 0x34], al
call fcn.140002900
test rax, rax
je 0x14000311e
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov rdx, rbx
mov rcx, rdi
call rax
test eax, eax
setne r9b
mov byte [rsp + 0x34], r9b
jmp 0x140003124
movzx r9d, byte [rsp + 0x34]
movzx eax, byte [rsi + 0x10]
mov byte [rdi], al
mov ecx, 1
lea rdx, [rbx - 1]
cmp rbx, rcx
jbe 0x1400031e0
cmp rdx, 0x40
jb 0x1400031c8
lea r8, [rsi + 0x20]
movsx eax, byte [r8]
movd xmm2, eax
punpcklbw xmm2, xmm2
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
lea r10, [rdx + rdi]
lea rax, [rdi + 1]
cmp rax, r8
ja 0x140003171
cmp r10, r8
jae 0x1400031c8
and edx, 0x3f
mov r8, rbx
sub r8, rdx
lea rax, [rdi + 0x21]
nop
movdqu xmm0, xmmword [rax - 0x20]
xorps xmm0, xmm2
movdqu xmmword [rax - 0x20], xmm0
movdqu xmm0, xmmword [rax - 0x10]
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rax - 0x10], xmm1
movdqu xmm0, xmmword [rax]
xorps xmm0, xmm2
movdqu xmmword [rax], xmm0
movdqu xmm0, xmmword [rax + 0x10]
xorps xmm0, xmm2
movdqu xmmword [rax + 0x10], xmm0
add rcx, 0x40
lea rax, [rax + 0x40]
cmp rcx, r8
jb 0x140003180
cmp rcx, rbx
jae 0x1400031e0
lea rax, [rdi + rcx]
sub rbx, rcx
nop
movzx ecx, byte [rsi + 0x20]
xor byte [rax], cl
lea rax, [rax + 1]
sub rbx, 1
jne 0x1400031d0
test r9b, r9b
je 0x140003206
call fcn.140002900
test rax, rax
je 0x140003206
lea r9, [rsp + 0x30]
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call rax
nop
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14028f750
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140012cd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x140012e61
mov r15, qword [rsp + 0x60]
lea r8d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r9d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x140012e61
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r8w, dx
jae 0x140012d6b
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x140012e88
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x140012d82
mov eax, ecx
add cx, r11w
cmp cx, r9w
ja 0x140012d82
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140012d95
movzx r9d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x140012de2
mov r9d, eax
cmp eax, 0x800
jae 0x140012daf
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov r11d, r8d
jmp 0x140012de2
cmp eax, 0x10000
jae 0x140012dc9
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov r11d, r10d
jmp 0x140012de2
shr r9d, 0x12
mov r10d, 3
movzx r11d, sil
or r9b, 0xf0
xor r11d, 1
add r11d, r11d
lea r8d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r8d
cmp rdx, rcx
jl 0x140012e61
add qword [r14], 2
test sil, sil
jne 0x140012e03
cmp r10d, 3
jae 0x140012e0f
mov rcx, qword [rbx]
mov r8d, r11d
mov byte [rcx], r9b
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jle 0x140012e3e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [rbx]
mov r9, qword [rbx]
test r8d, r8d
jg 0x140012e20
shr eax, 0xa
mov r8d, 1
test sil, sil
mov ecx, r8d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x140012d1f
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x140012e6f
Function at 0x140013330
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, qword [rcx]
test rbx, rbx
je 0x14001346a
mov r8, qword [rbx + 8]
mov rdx, qword [rbx]
mov rcx, rbx
call fcn.1400030b0
movzx edx, byte [rbx]
movabs rax, 0xcbf29ce484222325
xor rdx, rax
movabs rcx, 0x100000001b3
imul rdx, rcx
movzx eax, byte [rbx + 1]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rbx + 2]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rbx + 3]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rbx + 4]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rbx + 5]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rbx + 6]
xor rdx, rax
imul rdx, rcx
movzx eax, byte [rbx + 7]
xor rdx, rax
imul rdx, rcx
and rdx, qword [0x140708310]
shl rdx, 4
add rdx, qword [0x1407082f8]
mov rcx, qword [rdx + 8]
mov r9, qword [0x1407082e8]
cmp rcx, r9
je 0x140013401
mov r8, qword [rdx]
mov rax, qword [rbx]
cmp rax, qword [rcx + 0x10]
je 0x140013403
nop word [rax + rax]
cmp rcx, r8
je 0x140013401
mov rcx, qword [rcx + 8]
cmp rax, qword [rcx + 0x10]
jne 0x1400133f0
jmp 0x140013403
xor ecx, ecx
test rcx, rcx
je 0x140013458
mov rax, qword [rdx]
cmp qword [rdx + 8], rcx
jne 0x140013429
cmp rax, rcx
jne 0x14001341f
mov qword [rdx], r9
mov qword [rdx + 8], r9
jmp 0x140013434
mov r9, qword [rcx + 8]
mov qword [rdx + 8], r9
jmp 0x140013434
cmp rax, rcx
jne 0x140013434
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
dec qword [0x1407082f0]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov edx, reloc.WLDAP32.dll_Ordinal_32
call fcn.14028f770
nop
mov edx, gethostname
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.14028f770
add rsp, 0x20
pop rbx
ret

Function at 0x140013800
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140013828
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14001384e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140013850
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400138a9
test ecx, ecx
jle 0x140013889
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400138a9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400138a9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x1400138d0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400138f2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140013908
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140013924
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140013926
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140013962
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400139fe
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14001399d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x1400139de
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1400139fe
cmp rbx, rax
ja 0x1400139b0
test rbx, rbx
je 0x1400139fe
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret