joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004dd00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rdi
push r12
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm7
mov rax, qword [0x140184900]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rax, qword [0x140185610]
lea rdx, [rsp + 0x30]
movss xmm1, dword [rcx + 0x2c]
mov rdi, rcx
movss xmm0, dword [rax + 0x1674]
mov r12, qword [rax + 0x1d18]
subss xmm1, xmm0
movaps xmm2, xmm0
movss xmm0, dword [rcx + 0x30]
addss xmm2, dword [rax + 0x1a80]
movss xmm6, dword [r12 + 0x118]
movss xmm7, dword [r12 + 0x11c]
movss dword [r12 + 0x11c], xmm0
movss dword [r12 + 0x118], xmm1
addss xmm2, dword [rcx + 0x2c]
movss dword [rcx + 0x2c], xmm2
xor ecx, ecx
movups xmm0, xmmword [rax + 0x16fc]
movups xmmword [rsp + 0x30], xmm0
shufps xmm0, xmm0, 0xff
mulss xmm0, dword [0x14010ee04]
movss dword [rsp + 0x3c], xmm0
call fcn.140021c90
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov ecx, reloc.WS2_32.dll_setsockopt
movups xmmword [rsp + 0x20], xmm0
call fcn.140021c90
xor edx, edx
lea rcx, [0x14010ef40]
lea r8d, [rdx + 0x50]
call fcn.140045850
mov ecx, 2
movzx ebx, al
call fcn.140021490
xor ebp, ebp
test bl, bl
je 0x14004dee2
mov eax, dword [rdi]
mov qword [rsp + 0xa8], rsi
mov esi, ebp
test eax, eax
jle 0x14004ded5
mov qword [rsp + 0xb0], r14
mov r14d, ebp
mov qword [rsp + 0x70], r15
mov r15d, ebp
test r14, r14
js 0x14004de21
cmp esi, eax
jl 0x14004de3b
mov r8d, 0x6c7
lea rdx, str.C:UsersmikzxDownloads_frozenimguiimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rbx, qword [rdi + 8]
add rbx, r15
test dword [rbx + 4], 0x200000
jne 0x14004deb5
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14004de59
mov rcx, qword [rcx]
jmp 0x14004de91
movsx eax, word [rbx + 0x24]
cmp ax, 0xffff
je 0x14004de6b
cmp eax, dword [rdi + 0x88]
jl 0x14004de85
mov r8d, 0x89d
lea rdx, str.C:UsersmikzxDownloads_frozenimguiimgui_internal.h
lea rcx, str.tab__NameOffset____1___int_tab__NameOffset___TabsNames.Buf.Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsx rcx, word [rbx + 0x24]
add rcx, qword [rdi + 0x90]
mov eax, dword [rbx]
lea r9, [rsp + 0x20]
cmp dword [rdi + 0x18], eax
mov qword [rsp + 0x20], 0
sete dl
xor r8d, r8d
call fcn.14004b940
test al, al
cmovne rbp, rbx
mov eax, dword [rdi]
inc esi
inc r14
add r15, 0x30
cmp esi, eax
jl 0x14004de18
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0xb0]
call fcn.140016b40
mov rsi, qword [rsp + 0xa8]
movss dword [r12 + 0x118], xmm6
mov rax, rbp
movss dword [r12 + 0x11c], xmm7
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401024e0
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x50]
add rsp, 0x78
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400691a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x140184900]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx eax, word [0x140150110]
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
movups xmm0, xmmword [str.pWQbQk_VSI_2___F]
mov word [rsp + 0x30], ax
movzx eax, byte [0x140150112]
mov byte [rsp + 0x32], al
movups xmmword [rsp + 0x20], xmm0
jl 0x140069329
movdqa xmm0, xmmword [str.4444444444444444]
lea rdx, [rsp + 0x24]
movdqa xmm5, xmmword [0x140114170]
movdqa xmm4, xmmword [0x140156190]
movdqa xmmword [rsp + 0x40], xmm0
mov r8d, dword [rsp + 0x40]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x140156040]
nop dword [rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1401560b0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1401560b0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x10
jl 0x140069220
movaps xmm6, xmmword [rsp + 0x60]
cmp ecx, 0x13
jge 0x14006936d
movsxd rax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x51eb851f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x13
jl 0x140069340
mov rax, qword [0x140185a38]
test rax, rax
jne 0x14006938d
lea rcx, [0x1401500f0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x140185a38], rax
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400693d8
mov edx, 4
lea r9, [rsp + 0x50]
mov rcx, rax
lea r8d, [rdx + 0x3c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x50]
mov edx, 4
mov dword [rbx], 0x1ee7c0de
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401024e0
add rsp, 0x70
pop rbx
ret
Function at 0x14007a5b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov ecx, dword [0x140186170]
mov rax, qword gs:[0x58]
mov r14, qword [rax + rcx*8]
mov r15d, 0x1398
mov eax, dword [r15 + r14]
mov r12d, reloc.WS2_32.dll_recv
test al, 1
jne 0x14007a658
or eax, 1
mov dword [r15 + r14], eax
mov edi, r12d
add rdi, r14
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov edx, eax
mov dword [rdi + 0x1384], 0xffffffff
mov dword [rdi + 4], eax
lea ecx, [rbp + 1]
lea r8, [rdi + 8]
nop word [rax + rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [r8], edx
inc rcx
lea r8, [r8 + 4]
cmp rcx, 0x270
jb 0x14007a630
mov dword [rdi], 0x270
mov eax, dword [r15 + r14]
mov edi, 0x13a0
test al, 2
jne 0x14007a679
or eax, 2
mov dword [r15 + r14], eax
mov qword [r14 + rdi], rbp
mov qword [r14 + rdi + 8], reloc.WS2_32.dll_ntohs
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov dword [rsp + 0x20], 1
mov rdx, rsi
mov rcx, rbx
call fcn.140092d30
test rsi, rsi
je 0x14007a73b
lea r15, [r14 + rdi]
mov ebp, r12d
add rbp, r14
nop dword [rax]
nop dword [rax + rax]
dec rsi
mov r14, qword [0x140184640]
mov qword [rsp + 0x28], rbp
mov rdi, qword [r15]
mov rdx, qword [r15 + 8]
sub rdx, rdi
lea rcx, [rsp + 0x28]
cmp rdx, 0xffffffffffffffff
jne 0x14007a6eb
call fcn.14007b5f0
jmp 0x14007a6f3
inc rdx
call fcn.140066a00
add rax, r14
movzx r9d, byte [rax + rdi]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x14007a727
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x14007a71c
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14007a736
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.140058a40
test rsi, rsi
jne 0x14007a6c0
mov rax, rbx
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14007b160
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140184900]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14007b233
cmp byte [rcx + 0x71], 0
je 0x14007b233
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14007b22f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14007b1f4
sub eax, 1
je 0x14007b1f8
cmp eax, 2
jne 0x14007b22f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401024e0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14007b226
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14007b22f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14007b1dc
xor al, al
jmp 0x14007b1dc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401024e0
add rsp, 0x60
pop rbx
ret
Function at 0x14007b5f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.14007b930
mov r9, qword [rbx]
mov rdi, rax
shl rdi, 0x20
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x14007b661
lea r8, [r9 + 8]
nop
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14007b620
mov ecx, dword [r9]
jmp 0x14007b747
cmp ecx, 0x4e0
jb 0x14007b747
lea r10, [r9 + 0x9c4]
mov ebx, 0xe3
mov r11d, dword [r10]
nop dword [rax]
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14007b680
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14007b6d0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov rbx, qword [rsp + 0x30]
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
or rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x14007b7a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x14007b801
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14007b7c0
mov ecx, dword [r9]
jmp 0x14007b8eb
cmp ecx, 0x4e0
jb 0x14007b8eb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14007b820
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14007b870
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14007b930
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x14007b991
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14007b950
mov ecx, dword [r9]
jmp 0x14007ba7b
cmp ecx, 0x4e0
jb 0x14007ba7b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14007b9b0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14007ba00
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
add rsp, 8
ret
Function at 0x14007bae0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov ebp, r9d
mov r15, r8
mov r14, rdx
mov rsi, rcx
call fcn.14007b930
mov rdi, rax
add ebp, 0xffffffff
je 0x14007bcbd
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r12
xor r12d, r12d
nop word [rax + rax]
mov r9, qword [rsi]
shl rdi, 0x20
mov ecx, dword [r9]
cmp ecx, 0x270
jne 0x14007bb84
lea rax, [r9 + 8]
mov r10d, ecx
nop dword [rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r10, 1
jne 0x14007bb40
mov ecx, dword [r9]
jmp 0x14007bc66
cmp ecx, 0x4e0
jb 0x14007bc66
lea r10, [r9 + 0x9c4]
mov r11d, 0xe3
mov ebx, dword [r10]
mov eax, ebx
mov r8, r10
mov ebx, dword [r10 + 4]
mov edx, eax
xor edx, ebx
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub r11, 1
jne 0x14007bba0
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov ebx, dword [r10]
nop dword [rax]
mov eax, ebx
mov r8, r10
mov ebx, dword [r10 + 4]
mov edx, eax
xor edx, ebx
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub r11, 1
jne 0x14007bbf0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
mov ecx, r12d
mov dword [r9], r12d
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov ecx, edx
mov dword [r9], eax
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
xor rdx, rax
mov rcx, rdx
shr rcx, 0x12
xor rcx, rdx
or rdi, rcx
add ebp, 0xffffffff
jne 0x14007bb20
mov r12, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rax, r15
mul rdi
mov qword [r14], rax
mov rax, r14
mov qword [r14 + 8], rdx
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14007cd50
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov ecx, 0xbeef
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14007cd6e
test ebx, ebx
je 0x14007cf8f
mov byte [0x1401857c5], 1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14007ce06
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14007ce06
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14007cdf8
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14007cde0
cmp r8d, 0xcded1a85
je 0x14007ce0b
test r9d, r9d
jne 0x14007cdc0
mov rax, qword [rax]
jmp 0x14007cd90
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
xor ecx, ecx
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14007ceb6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14007ceb6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14007cea8
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x14007ce90
cmp r8d, 0xe80fd3a
je 0x14007cebb
test r9d, r9d
jne 0x14007ce70
mov rax, qword [rax]
jmp 0x14007ce40
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
xor ecx, ecx
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14007cf66
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14007cf66
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14007cf58
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x14007cf40
cmp r8d, 0xa52bcaf9
je 0x14007cf6b
test r9d, r9d
jne 0x14007cf20
mov rax, qword [rax]
jmp 0x14007cef0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov dword [0], 0xdead
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14007d290
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14007d4da
mov byte [0x1401857c5], 1
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14007d347
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14007d347
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14007d342
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14007d320
cmp r8d, 0xcded1a85
je 0x14007d34c
test r9d, r9d
jne 0x14007d300
mov rax, qword [rax]
jmp 0x14007d2d0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14007d3f7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14007d3f7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14007d3f2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14007d3d0
cmp r8d, 0xe80fd3a
je 0x14007d3fc
test r9d, r9d
jne 0x14007d3b0
mov rax, qword [rax]
jmp 0x14007d380
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14007d4a7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14007d4a7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14007d4a2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14007d480
cmp r8d, 0xa52bcaf9
je 0x14007d4ac
test r9d, r9d
jne 0x14007d460
mov rax, qword [rax]
jmp 0x14007d430
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
mov dword [0], 0xdead
add rsp, 0x28
ret