joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400030c0
Capabilities:
Access peb ldr_data

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0xa0
mov rax, qword [0x1400c5b30]
mov rbx, rcx
xorps xmm0, xmm0
mov r14, rdx
movaps xmmword [r11 - 0x28], xmm0
mov esi, r9d
mov ebp, r8d
movd xmm1, dword [rax + 0x130]
movd xmm0, dword [rax + 0x134]
mov eax, dword [rsp + 0xd8]
mov edx, eax
movzx r10d, al
cvtdq2ps xmm1, xmm1
shr edx, 8
movzx ecx, dl
lea rdx, [r11 - 0x48]
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x60], xmm1
movd xmm1, ecx
mov ecx, eax
shr eax, 0x18
shr ecx, 0x10
movzx ecx, cl
movss dword [rsp + 0x64], xmm0
movss xmm0, dword [0x1400b8670]
movd xmm3, eax
xor eax, eax
cmp dword [rbx], 2
movd xmm2, ecx
lea rcx, [0x1400c5b38]
movd xmm4, r10d
setne al
cvtdq2ps xmm4, xmm4
inc eax
cvtdq2ps xmm1, xmm1
divss xmm4, xmm0
cvtdq2ps xmm2, xmm2
shufps xmm4, xmm4, 0xe1
divss xmm1, xmm0
cvtdq2ps xmm3, xmm3
movss xmm4, xmm1
shufps xmm4, xmm4, 0xc6
divss xmm2, xmm0
divss xmm3, xmm0
movss xmm4, xmm2
shufps xmm4, xmm4, 0x27
movss xmm4, xmm3
shufps xmm4, xmm4, 0x39
movdqa xmmword [rsp + 0x70], xmm4
mov dword [r11 - 0x18], eax
movups xmmword [rsp + 0x40], xmm4
call fcn.14000a4a0
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov eax, 8
cmp byte [rax + rdi], 0
jne 0x1400031cd
call fcn.1400743e8
movups xmm0, xmmword [r14]
mov eax, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x40]
add rax, rdi
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov r9d, ebp
mov eax, dword [rsp + 0xd0]
mov rdx, rbx
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], esi
movaps xmmword [rsp + 0x40], xmm0
call fcn.14000ba00
lea rcx, [rsp + 0x40]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm1
call fcn.140002ea0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14000ce00
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1400c5040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov r9d, 1
xor ecx, ecx
mov r8d, 0x2000
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
je 0x14000cf11
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x60], xmm6
mov qword [rdi], rax
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x24]
xorps xmm6, xmm6
mov qword [rdi + 0x10], rcx
lea rax, [rcx + rcx*2]
mov qword [rdi + 8], rax
test rcx, rcx
js 0x14000ce6e
cvtsi2sd xmm6, rcx
jmp 0x14000ce83
mov rax, rcx
and ecx, 1
shr rax, 1
or rax, rcx
cvtsi2sd xmm6, rax
addsd xmm6, xmm6
xorps xmm0, xmm0
test rbx, rbx
js 0x14000ce92
cvtsi2sd xmm0, rbx
jmp 0x14000cea7
mov rax, rbx
and ebx, 1
shr rax, 1
or rax, rbx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
divsd xmm0, xmm6
call fcn.14008b434
movsd xmm1, qword [0x1400b8678]
xor ecx, ecx
mulsd xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x60]
comisd xmm0, xmm1
jb 0x14000cee0
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x14000cee0
movabs rax, 0x8000000000000000
mov rcx, rax
cvttsd2si rax, xmm0
add rax, rcx
mov qword [rdi + 0x20], rax
xor eax, eax
mov qword [rdi + 0x18], rax
mov qword [rdi + 0x28], rax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140074360
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret
call fcn.14000f2a0
mov r9, rax
lea rdx, str.Failed_to_reserve__llu_bytes_of_memory:__s.
mov r8, rbx
lea rcx, str.C:_sourceIronfortFoundationwin32_specific.cpp_195
call fcn.14000be60
int3

Function at 0x14000e210
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x1400c5040]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
cmp qword [0x1400c7d20], 0
jle 0x14000e24d
mov al, 1
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140074360
add rsp, 0x1d8
ret
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor ecx, ecx
test eax, eax
sete cl
test eax, eax
mov qword [0x1400c7d20], rcx
sete al
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.140074360
add rsp, 0x1d8
ret
Function at 0x14000e290
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm6
mov rax, qword [0x1400c5040]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r15, r8
mov rsi, rcx
mov r14, qword [rsp + 0xe0]
call fcn.14000e210
test al, al
jne 0x14000e2db
call fcn.14000e0d0
jmp 0x14000e40d
xor r8d, r8d
mov edx, 2
mov ecx, edx
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
je 0x14000e2d1
xor ebp, ebp
mov dword [rsp + 0x38], ebp
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
mov dword [rsp + 0x3c], 2
mov dword [rsp + 0x40], 2
mov dword [rsp + 0x44], reloc.WS2_32.dll_recvfrom
mov r9d, 0x2694
lea r8, [0x1400b819c]
mov edx, 8
lea rcx, [rsp + 0x68]
call fcn.140004230
mov rdi, qword [r15]
lea rdx, [rdi + 1]
mov rcx, qword [0x1400c5ab0]
call qword [0x1400c5ab8]
mov rbx, rax
mov r8, rdi
mov rdx, qword [r15 + 8]
mov rcx, rax
call fcn.14008f790
mov byte [rdi + rbx], bpl
mov qword [rsp + 0x28], rbx
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x14000e3c7
mov r8, qword [rsp + 0x20]
mov rdx, qword [r8 + 0x20]
movups xmm6, xmmword [rdx]
mov r8d, dword [r8 + 0x10]
mov rcx, qword [rsi]
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x14000e3c7
mov dword [rsp + 0x30], 1
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
mov rcx, qword [rsi]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
je 0x14000e3e3
call fcn.14000e0d0
mov ebp, eax
mov rcx, qword [rsi]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rax, 0xffffffffffffffff
mov qword [rsi], rax
jmp 0x14000e3e7
movups xmmword [r14], xmm6
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
nop
mov rdx, qword [rsp + 0x28]
test rdx, rdx
je 0x14000e40b
mov rcx, qword [0x1400c5ab0]
call qword [0x1400c5ac0]
nop
mov eax, ebp
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140074360
mov rbx, qword [rsp + 0xc8]
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000e690
Capabilities:
Send data
Send data on socket

Disassembly:
push rdi
sub rsp, 0x30
cmp dword [rcx + 8], 0
mov rdi, rcx
je 0x14000e843
movzx eax, word [rdx + 0x410]
add ax, 0x14
mov qword [rsp + 0x48], rbx
mov word [rdx], ax
movzx eax, byte [rcx + 0xc]
mov byte [rdx + 2], al
mov eax, dword [rcx + 0x10]
mov dword [rdx + 4], eax
mov eax, dword [rcx + 0x14]
mov dword [rdx + 8], eax
mov eax, dword [rcx + 0x18]
mov dword [rdx + 0xc], eax
mov eax, dword [rcx + 0x1c]
mov dword [rdx + 0x10], eax
mov byte [rdx + 0x14], r8b
inc dword [rcx + 0x14]
mov qword [rcx + 0xc68], 0
movzx eax, word [rdx]
mov word [rcx + 0x860], ax
mov qword [rcx + 0xc68], 2
movzx eax, byte [rdx + 2]
mov byte [rcx + 0x862], al
inc qword [rcx + 0xc68]
mov rcx, qword [rcx + 0xc68]
mov eax, dword [rdx + 4]
mov qword [rsp + 0x50], rsi
mov dword [rcx + rdi + 0x860], eax
add qword [rdi + 0xc68], 4
mov eax, dword [rdx + 8]
mov rcx, qword [rdi + 0xc68]
mov dword [rcx + rdi + 0x860], eax
add qword [rdi + 0xc68], 4
mov eax, dword [rdx + 0xc]
mov rcx, qword [rdi + 0xc68]
mov dword [rcx + rdi + 0x860], eax
add qword [rdi + 0xc68], 4
mov eax, dword [rdx + 0x10]
mov rcx, qword [rdi + 0xc68]
mov dword [rcx + rdi + 0x860], eax
mov rcx, qword [rdi + 0xc68]
add rcx, 4
mov qword [rdi + 0xc68], rcx
movzx eax, byte [rdx + 0x14]
mov byte [rcx + rdi + 0x860], al
lea rcx, [rdi + 0x860]
mov rax, qword [rdi + 0xc68]
inc rax
mov qword [rdi + 0xc68], rax
add rcx, rax
mov rbx, qword [rdx + 0x410]
add rdx, 0x18
mov r8, rbx
call fcn.14008f790
mov r8, qword [rdi + 0xc68]
mov ecx, dword [rdi + 4]
add r8, rbx
mov rbx, qword [rsp + 0x48]
mov qword [rdi + 0xc68], r8
sub ecx, 1
je 0x14000e810
cmp ecx, 1
jne 0x14000e809
mov rcx, qword [rdi + 0x440]
lea rax, [rdi + 0xc70]
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
lea rdx, [rdi + 0x860]
xor r9d, r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
jmp 0x14000e827
movzx eax, byte [rsp + 0x40]
jmp 0x14000e82d
mov rcx, qword [rdi + 0x440]
lea rdx, [rdi + 0x860]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
setne al
mov rsi, qword [rsp + 0x50]
test al, al
jne 0x14000e843
mov rcx, rdi
add rsp, 0x30
pop rdi
jmp fcn.14000e610
add rsp, 0x30
pop rdi
ret
Function at 0x14000f330
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rdi, qword [r8]
xorps xmm0, xmm0
mov rbx, qword [r8 + 8]
mov r14, rdx
mov rsi, rcx
movups xmmword [rcx], xmm0
mov rcx, qword [0x1400c5ab0]
lea rdx, [rdi + 1]
call qword [0x1400c5ab8]
mov r8, rdi
mov rdx, rbx
mov rcx, rax
mov rbp, rax
call fcn.14008f790
mov byte [rdi + rbp], 0
xor r9d, r9d
xor edi, edi
mov edx, 0x80000000
mov qword [rsp + 0x30], rdi
mov r8d, 7
mov dword [rsp + 0x28], 0x80
mov rcx, rbp
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000f406
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [r14]
mov edx, eax
mov qword [rsi], rdx
call qword [r14 + ioctlsocket]
mov r8d, dword [rsi]
xor r9d, r9d
mov rdx, rax
mov qword [rsi + 8], rax
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000f406
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x14000f400
mov rcx, qword [r14]
call qword [r14 + reloc.WS2_32.dll_recv]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbp, rbp
je 0x14000f424
mov rcx, qword [0x1400c5ab0]
mov rdx, rbp
call qword [0x1400c5ac0]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14001a990
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push rbx
push rbp
sub rsp, 0x48
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
jne 0x14001a9ae
mov eax, 0x28
add rsp, 0x48
pop rbp
pop rbx
ret
mov qword [rsp + 0x68], rsi
xor r9d, r9d
mov qword [rsp + 0x40], r14
mov edx, 0x80000000
xor r14d, r14d
mov r8d, 1
mov qword [rsp + 0x30], r14
mov rcx, rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14001aa06
mov rsi, qword [rsp + 0x68]
mov eax, 1
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
pop rbx
ret
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x78], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14001ab1f
mov rax, qword [rsp + 0x70]
cmp rax, 0x7fffffff
jg 0x14001ab1f
test rax, rax
je 0x14001ab1f
mov qword [rsp + 0x28], r14
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r14d
mov r8d, 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
test rax, rax
je 0x14001ab1f
mov ecx, dword [rsp + 0x70]
xor r9d, r9d
mov dword [rbx + 8], ecx
xor r8d, r8d
mov rcx, rax
mov dword [rbx + 0xc], r14d
mov edx, 4
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rdi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], r14
je 0x14001aaa3
lea rax, [0x14001ab90]
jmp 0x14001aaf3
mov edx, dword [rbx + 8]
mov rcx, qword [rbx + 0x30]
call fcn.14001ab50
mov qword [rbx], rax
test rax, rax
je 0x14001ab1f
mov edi, r14d
nop word [rax + rax]
mov r8d, dword [rbx + 8]
lea r9, [rsp + 0x60]
mov edx, edi
sub r8d, edi
add rdx, qword [rbx]
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001ab13
add edi, dword [rsp + 0x60]
cmp edi, dword [rbx + 8]
jne 0x14001aac0
lea rax, [0x14001ab60]
mov rcx, rsi
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov qword [rbx + 0x10], rax
xor eax, eax
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], r14
jmp 0x14001ab34
mov rdx, qword [rbx]
mov rcx, qword [rbx + 0x30]
call fcn.14001abc0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x51
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
pop rbx
ret
Function at 0x140021c70
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
push r12
sub rsp, 0x50
mov rax, qword [rcx + 8]
mov r12d, r8d
mov ecx, 0x3e80000
mov rbx, qword [rax + 0x2f0]
mov rax, qword [rdx + 0x80]
movzx edx, word [rdx + 0x68]
movzx edi, word [rax + 0x18]
mov eax, 0x40000
shl edi, 0x10
cmp edi, eax
cmovl edi, eax
shl edx, 0x10
call fcn.140011c00
mov dword [rsp + 0x24], eax
mov ecx, eax
cmp eax, 0x28f
jge 0x140021cc8
xor eax, eax
add rsp, 0x50
pop r12
pop rdi
pop rbx
ret
mov eax, dword [rbx + 0x24]
mov qword [rsp + 0x80], rbp
mov ebp, dword [rbx + 0x40]
mov qword [rsp + 0x48], rsi
mov esi, dword [rbx + 0x28]
mov qword [rsp + 0x40], r13
mov r13d, dword [rbx + 0x3c]
mov dword [rsp + 0x88], eax
mov eax, dword [rbx + 0x2c]
mov qword [rsp + 0x38], r14
mov r14d, dword [rbx + 0x34]
mov dword [rsp + 0x70], eax
mov eax, dword [rbx + 0x38]
mov qword [rsp + 0x30], r15
mov r15d, dword [rbx + 0x30]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x20], r13d
test r12d, r12d
jg 0x140021d1f
mov ebx, 0x4b0000
jmp 0x140021d2f
shl r12d, 0x10
mov edx, ecx
mov ecx, r12d
call fcn.140013b10
mov ebx, eax
bsr ecx, ebx
bsr eax, edi
shl r13d, 0x10
add eax, ecx
cmp eax, 0x2e
jl 0x140021d45
mov ecx, r13d
jmp 0x140021d50
mov edx, edi
mov ecx, ebx
call fcn.140013b10
mov ecx, eax
mov r8d, dword [rsp + 0x88]
mov eax, r8d
shl eax, 0x10
cmp ecx, eax
jge 0x140021d6c
shl esi, 0x10
mov ecx, esi
jmp 0x140021e32
mov edx, dword [rsp + 0x70]
mov r12d, edx
shl r12d, 0x10
cmp ecx, r12d
jge 0x140021d9f
mov r13d, edx
mov ecx, eax
mov edx, edi
sub r13d, r8d
call fcn.140011c00
mov ecx, ebx
sub ecx, eax
test r13d, r13d
je 0x140021def
sub r15d, esi
mov r8d, r13d
mov edx, r15d
jmp 0x140021dd8
mov eax, r14d
shl eax, 0x10
cmp ecx, eax
jl 0x140021df3
cmp ecx, r13d
jge 0x140021e2d
mov r15d, dword [rsp + 0x20]
mov edx, edi
sub r15d, r14d
shl r14d, 0x10
mov ecx, r14d
call fcn.140011c00
sub ebx, eax
test r15d, r15d
je 0x140021e2d
mov esi, dword [rsp + 0x78]
mov r8d, r15d
sub ebp, esi
mov ecx, ebx
mov edx, ebp
call fcn.1400139e0
shl esi, 0x10
mov edx, edi
mov ecx, esi
mov ebx, eax
call fcn.140011c00
add ebx, eax
jmp 0x140021e3b
mov edx, dword [rsp + 0x70]
mov esi, r14d
mov ecx, r12d
sub esi, edx
mov edx, edi
call fcn.140011c00
mov ecx, ebx
sub ecx, eax
test esi, esi
je 0x140021dae
mov edx, dword [rsp + 0x78]
mov r8d, esi
sub edx, r15d
call fcn.1400139e0
shl r15d, 0x10
mov edx, edi
mov ecx, r15d
mov ebx, eax
call fcn.140011c00
add ebx, eax
jmp 0x140021e3b
shl ebp, 0x10
mov ecx, ebp
mov edx, edi
call fcn.140011c00
mov ebx, eax
mov edx, dword [rsp + 0x24]
mov ecx, ebx
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r12
pop rdi
pop rbx
jmp fcn.140011c00
Function at 0x14004eee0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov r14, qword [rsp + 0x30]
mov r10, r9
mov rdi, qword [rcx]
mov rbp, r8
mov rsi, rcx
movzx ebx, word [r14]
cmp rdi, rdx
jb 0x14004ef14
xor eax, eax
jmp 0x14004ef6e
sub edx, edi
mov eax, edx
cmp r10, rax
cmova r10, rax
xor r9d, r9d
test r10, r10
je 0x14004ef60
mov r11d, r9d
nop word [rax + rax]
movzx eax, byte [r11 + rdi]
mov r8d, ebx
shr r8d, 8
inc r9d
xor r8d, eax
mov edx, 0x58bf
add eax, ebx
mov byte [r11 + rbp], r8b
imul ecx, eax, 0x3193
mov r11d, r9d
sub edx, ecx
movzx ebx, dx
cmp r11, r10
jb 0x14004ef30
lea rcx, [rdi + r10]
mov eax, r9d
mov qword [rsi], rcx
mov word [r14], bx
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x140062800
Capabilities:
Hash data using murmur3

Disassembly:
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret

Function at 0x140063020
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r10d, r8d
mov r11d, r8d
mov ebx, r8d
mov edi, r8d
mov eax, edx
mov esi, edx
cdq
mov r14, r9
and edx, 0xf
add eax, edx
sar eax, 4
mov r8d, eax
shl r8d, 4
movsxd r8, r8d
add r8, rcx
neg eax
movsxd rdx, eax
je 0x14006311a
mov r9, rdx
shl r9, 4
add r9, 8
add r9, r8
neg rdx
nop word [rax + rax]
imul eax, dword [r9 - 8], 0x239b961b
lea r9, [r9 + 0x10]
ror eax, 0x11
imul ecx, eax, 0xab0e9789
imul eax, dword [r9 - 0x14], 0xab0e9789
xor ecx, r10d
ror ecx, 0xd
add ecx, r11d
ror eax, 0x10
lea r10d, [rcx*4 + 0x561ccd1b]
add r10d, ecx
imul ecx, eax, 0x38b34ae5
imul eax, dword [r9 - 0x10], 0x38b34ae5
xor ecx, r11d
ror ecx, 0xf
add ecx, ebx
ror eax, 0xf
lea r11d, [rcx*4 + 0xbcaa747]
add r11d, ecx
imul ecx, eax, 0xa1e38b93
imul eax, dword [r9 - 0xc], 0xa1e38b93
xor ecx, ebx
ror ecx, 0x11
add ecx, 0xeaf5d271
ror eax, 0xe
add ecx, edi
lea ebx, [rcx + rcx*4]
imul ecx, eax, 0x239b961b
xor ecx, edi
ror ecx, 0x13
add ecx, r10d
lea edi, [rcx*4 + 0x32ac3b17]
add edi, ecx
sub rdx, 1
jne 0x140063080
xor eax, eax
mov ecx, esi
and ecx, 0xf
dec ecx
cmp ecx, 0xe
ja case.default.0x14006313e
lea r9, [0x140000000]
mov edx, dword [r9 + rcx*4 + 0x6327c]
add rdx, r9
jmp rdx
movzx eax, byte [r8 + 0xe]
shl eax, 0x10
movzx ecx, byte [r8 + 0xd]
shl ecx, 8
xor eax, ecx
movzx ecx, byte [r8 + 0xc]
xor ecx, eax
imul eax, ecx, 0xa1e38b93
ror eax, 0xe
imul eax, eax, 0x239b961b
xor edi, eax
movzx eax, byte [r8 + 0xb]
shl eax, 0x18
movzx ecx, byte [r8 + 0xa]
shl ecx, 0x10
xor eax, ecx
movzx ecx, byte [r8 + 9]
shl ecx, 8
xor eax, ecx
movzx ecx, byte [r8 + 8]
xor ecx, eax
imul eax, ecx, 0x38b34ae5
ror eax, 0xf
imul eax, eax, 0xa1e38b93
xor ebx, eax
movzx eax, byte [r8 + 7]
shl eax, 0x18
movzx ecx, byte [r8 + 6]
shl ecx, 0x10
xor eax, ecx
movzx ecx, byte [r8 + 5]
shl ecx, 8
xor eax, ecx
movzx ecx, byte [r8 + 4]
xor ecx, eax
imul eax, ecx, 0xab0e9789
ror eax, 0x10
imul eax, eax, 0x38b34ae5
xor r11d, eax
movzx eax, byte [r8 + 3]
shl eax, 0x18
movzx ecx, byte [r8 + 2]
shl ecx, 0x10
xor eax, ecx
movzx ecx, byte [r8 + 1]
shl ecx, 8
xor eax, ecx
movzx ecx, byte [r8]
xor ecx, eax
imul eax, ecx, 0x239b961b
ror eax, 0x11
imul eax, eax, 0xab0e9789
xor r10d, eax
xor r10d, esi
xor r11d, esi
xor edi, esi
xor ebx, esi
add r10d, edi
add r10d, ebx
add r10d, r11d
lea ecx, [r11 + r10]
call fcn.140062800
lea ecx, [rbx + r10]
mov r9d, eax
call fcn.140062800
lea ecx, [rdi + r10]
mov r8d, eax
call fcn.140062800
mov ecx, r10d
mov edx, eax
call fcn.140062800
mov rbx, qword [rsp + 0x30]
add eax, edx
mov rsi, qword [rsp + 0x38]
add eax, r8d
mov rdi, qword [rsp + 0x40]
add eax, r9d
mov dword [r14], eax
lea ecx, [r9 + rax]
mov dword [r14 + 4], ecx
lea ecx, [r8 + rax]
add eax, edx
mov dword [r14 + 8], ecx
mov dword [r14 + 0xc], eax
add rsp, 0x20
pop r14
ret
Function at 0x14006a1d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x1400c5040]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, dword [rcx + 0x58]
lea rbx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov ebp, r9d
mov eax, dword [rcx + 0x5c]
mov rdi, rcx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x280]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], r8d
mov dword [rsp + 0x30], r9d
nop dword [rax + rax]
mov r10d, dword [rbx + 0x14]
mov eax, r10d
mov esi, dword [rbx + 4]
cmp r10d, esi
mov ecx, dword [rbx + 0xc]
cmovg eax, esi
cmp ecx, eax
jl 0x14006a30f
cmp r10d, esi
mov eax, esi
cmovg eax, r10d
cmp ecx, eax
jg 0x14006a30f
cmp r10d, esi
jne 0x14006a26a
sub rbx, 0x10
jmp 0x14006a31b
mov edx, dword [rdi + 0x88]
xor r9d, r9d
cmp r10d, esi
setge r9b
inc r9d
cmp edx, r9d
je 0x14006a2d4
mov eax, dword [rdi + 4]
mov ecx, eax
mov r8d, dword [rdi + 8]
neg ecx
cmp r10d, esi
jge 0x14006a29e
dec eax
add eax, r10d
and eax, ecx
sub eax, r10d
jmp 0x14006a2a6
and ecx, r10d
mov eax, r10d
sub eax, ecx
cmp eax, r8d
setge r11b
test edx, edx
je 0x14006a2c1
movzx edx, r11b
mov rcx, rdi
call fcn.14006ae00
test al, al
jne 0x14006a32c
movzx r8d, r11b
mov edx, r9d
mov rcx, rdi
call fcn.14006b680
test al, al
jne 0x14006a32c
mov ecx, dword [rdi + 0x60]
lea r9, [fcn.14006baa0]
mov eax, dword [rdi + 0x64]
mov r8, rbx
mov dword [rsp + 0x28], eax
mov edx, 2
mov dword [rsp + 0x20], ecx
mov rcx, rdi
cmp r10d, esi
jge 0x14006a300
call fcn.14006a050
jmp 0x14006a305
call fcn.140069fc0
test al, al
jne 0x14006a32c
sub rbx, 0x10
jmp 0x14006a31b
mov rcx, rbx
call fcn.14006baa0
add rbx, 0x10
lea rax, [rsp + 0x30]
cmp rbx, rax
jb 0x14006a330
mov ebp, dword [rbx]
jmp 0x14006a230
mov al, 1
jmp 0x14006a338
mov dword [rdi + 0x58], ebp
xor al, al
mov dword [rdi + 0x5c], esi
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140074360
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14006a4e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x350
mov rax, qword [0x1400c5040]
xor rax, rsp
mov qword [rsp + 0x340], rax
mov eax, dword [rcx + 0x58]
lea rbx, [rsp + 0x30]
mov ebp, dword [rsp + 0x388]
mov rdi, rcx
mov dword [rsp + 0x48], eax
mov eax, dword [rcx + 0x5c]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x380]
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x390]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x40], edx
mov dword [rsp + 0x44], r8d
mov dword [rsp + 0x38], r9d
mov dword [rsp + 0x30], ebp
nop
mov r10d, dword [rbx + 0x1c]
mov ecx, r10d
mov esi, dword [rbx + 4]
cmp r10d, esi
mov r8d, dword [rbx + 0x14]
mov eax, r8d
mov edx, dword [rbx + 0xc]
cmovg ecx, esi
cmp r8d, edx
cmovg eax, edx
cmp eax, ecx
jl 0x14006a643
cmp r10d, esi
mov eax, esi
cmovg eax, r10d
cmp r8d, edx
cmovg edx, r8d
cmp edx, eax
jg 0x14006a643
cmp r10d, esi
jne 0x14006a59e
sub rbx, 0x18
jmp 0x14006a64f
mov edx, dword [rdi + 0x88]
xor r9d, r9d
cmp r10d, esi
setg r9b
inc r9d
cmp edx, r9d
je 0x14006a608
mov eax, dword [rdi + 4]
mov ecx, eax
mov r8d, dword [rdi + 8]
neg ecx
cmp r10d, esi
jg 0x14006a5d2
dec eax
add eax, r10d
and eax, ecx
sub eax, r10d
jmp 0x14006a5da
and ecx, r10d
mov eax, r10d
sub eax, ecx
cmp eax, r8d
setge r11b
test edx, edx
je 0x14006a5f5
movzx edx, r11b
mov rcx, rdi
call fcn.14006ae00
test al, al
jne 0x14006a660
movzx r8d, r11b
mov edx, r9d
mov rcx, rdi
call fcn.14006b680
test al, al
jne 0x14006a660
mov ecx, dword [rdi + 0x60]
lea r9, [fcn.140069690]
mov eax, dword [rdi + 0x64]
mov r8, rbx
mov dword [rsp + 0x28], eax
mov edx, 3
mov dword [rsp + 0x20], ecx
mov rcx, rdi
cmp r10d, esi
jg 0x14006a634
call fcn.14006a050
jmp 0x14006a639
call fcn.140069fc0
test al, al
jne 0x14006a660
sub rbx, 0x18
jmp 0x14006a64f
mov rcx, rbx
call fcn.140069690
add rbx, 0x18
lea rax, [rsp + 0x30]
cmp rbx, rax
jb 0x14006a664
mov ebp, dword [rbx]
jmp 0x14006a550
mov al, 1
jmp 0x14006a66c
mov dword [rdi + 0x58], ebp
xor al, al
mov dword [rdi + 0x5c], esi
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.140074360
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret