joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400baf20
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
xor r15d, r15d
lea r12, [0x140000000]
movzx eax, byte [r15 + r12 + 0xd42c0]
mov edi, eax
mov r8d, eax
shr edi, 5
mov r11d, eax
shr r8d, 6
mov ebp, edi
lea edx, [rax + rax]
shr r11d, 7
xor edx, eax
and ebp, 4
mov r10d, edi
mov r9d, r8d
and edi, 1
and r10d, 2
imul ecx, edi, 0x1b000000
and r8d, 1
lea ebx, [rdx + rdx]
and r9d, 2
lea edx, [rdx*4]
xor ebx, eax
xor edx, eax
shl ebx, 0x19
shl edx, 8
mov esi, eax
xor rbx, rcx
mov r14d, eax
imul ecx, r10d, 0x1b000000
xor rbx, rcx
imul ecx, r8d, 0x1b000000
xor rbx, rcx
imul ecx, r9d, 0x1b000000
xor rbx, rcx
imul ecx, ebp, 0x1b000000
xor rbx, rcx
imul ecx, r11d, 0x1b000000
xor rbx, rcx
imul ecx, edi, 0x11b00
xor rdx, rcx
imul ecx, r10d, 0x11b00
xor rdx, rcx
imul ecx, r8d, 0x11b00
xor rdx, rcx
imul ecx, r9d, 0x11b00
xor rdx, rcx
imul ecx, ebp, 0x11b00
xor rdx, rcx
imul ecx, edi, 0x11b0000
or rbx, rdx
lea edx, [rax*8]
xor edx, eax
lea eax, [rax*4]
shl edx, 0x10
xor eax, r14d
xor rdx, rcx
imul ecx, r10d, 0x11b0000
xor rdx, rcx
imul ecx, ebp, 0x11b0000
xor rdx, rcx
imul ecx, edi, 0x11b
or rbx, rdx
lea edx, [rax + rax]
xor rdx, rcx
imul ecx, r10d, 0x11b
xor rdx, rcx
imul ecx, ebp, 0x11b
xor rdx, rcx
imul ecx, r11d, 0x11b
xor rdx, rcx
xor rdx, rsi
or rdx, rbx
shl rdx, 0x20
or rdx, rbx
or rdx, rsi
mov qword [r12 + r15*8 + 0x38d8f0], rdx
inc r15
cmp r15, 0x100
jl 0x1400baf43
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov byte [0x14038e0f1], 1
pop r15
pop r14
pop r12
ret

Function at 0x1400bb0ac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r11d, r11d
lea rbx, [0x140000000]
movzx r9d, byte [r11 + rbx + 0xd41c0]
mov edx, r9d
shr edx, 7
imul r10d, edx, 0x1b000000
lea r8d, [r9 + r9]
imul ecx, edx, 0x11b
mov eax, r8d
shl eax, 0x18
xor r10, rax
mov eax, r9d
shl eax, 8
or eax, r9d
shl eax, 8
or r10, rax
mov eax, r8d
xor rcx, rax
xor rcx, r9
or rcx, r10
shl rcx, 0x20
or rcx, r10
mov qword [rbx + r11*8 + 0x38d0e0], rcx
inc r11
cmp r11, 0x100
jl 0x1400bb0bb
and qword [0x14038d8e8], 0
and qword [0x14038d8e0], 0
mov rbx, qword [rsp + 8]
mov byte [0x14038e0f0], 1
ret
Function at 0x1400bcb70
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x14016a180]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, r8
mov rdi, rdx
mov ecx, dword [0x14038e1f0]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x14038e100], ecx
jg 0x1400bcc52
mov eax, ebx
cmp rbx, rax
jne 0x1400bcc14
xor ecx, ecx
test rbx, rbx
setne cl
xor eax, eax
test ebx, ebx
setne al
cmp ecx, eax
jne 0x1400bcc14
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
mov rcx, qword [0x14038e0f8]
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x1400bcc95
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400c5160
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x20]
call fcn.1400736b0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400bc8a0
lea rdx, [0x1401657a0]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, [0x14038e100]
call fcn.1400c4984
cmp dword [0x14038e100], 0xffffffff
jne 0x1400bcbbc
lea rcx, [0x14038e0f8]
call fcn.1400bc7b4
lea rcx, [0x1400ca5ac]
call fcn.1400c4c60
nop
lea rcx, [0x14038e100]
call fcn.1400c4918
jmp 0x1400bcbbc
mov ecx, eax
call fcn.1400bccd8
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [0x1400d2d58]
lea rcx, [rsp + 0x20]
call fcn.1400736b0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400bc8a0
lea rdx, [0x1401657a0]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x1400be0dc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp r8, 8
jb 0x1400be14f
mov rbp, r8
shr rbp, 3
imul rax, rbp, 0xfffffffffffffff8
add rdi, rax
mov r8d, 8
lea rcx, [rsp + 0x58]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 8
lea rcx, [rsp + 0x50]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x50]
add rsi, 8
xor rax, qword [rsp + 0x58]
add rbx, 8
or r14, rax
sub rbp, 1
jne 0x1400be10e
mov rcx, r14
shr rcx, 0x20
or ecx, r14d
mov edx, ecx
mov eax, ecx
shr edx, 8
or edx, ecx
shr eax, 0x10
and edx, 0xff00
or edx, eax
movzx eax, cl
shr edx, 8
or edx, eax
test rdi, rdi
je 0x1400be191
sub rsi, rbx
movzx ecx, byte [rsi + rbx]
movzx eax, byte [rbx]
inc rbx
xor ecx, eax
or edx, ecx
sub rdi, 1
jne 0x1400be17d
mov rbx, qword [rsp + 0x40]
test edx, edx
mov rbp, qword [rsp + 0x48]
sete al
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1400be1ac
Capabilities:
Encode data using xor

Disassembly:
test r9, r9
je 0x1400be272
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, r9
mov r15d, 4
mov rdi, r8
mov rsi, rdx
mov r14, rcx
cmp rbx, r15
jb 0x1400be23d
mov rbp, rbx
shr rbp, 2
imul rax, rbp, 0xfffffffffffffffc
add rbx, rax
mov r8, r15
lea rcx, [rsp + 0x20]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r15
lea rcx, [rsp + 0x68]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x68]
lea rdx, [rsp + 0x24]
xor eax, dword [rsp + 0x20]
mov r8, r15
mov rcx, r14
mov dword [rsp + 0x24], eax
call sub.VCRUNTIME140.dll_memcpy
add r14, r15
add rsi, r15
add rdi, r15
sub rbp, 1
jne 0x1400be1f2
test rbx, rbx
je 0x1400be25a
sub rsi, rdi
sub r14, rdi
mov al, byte [rsi + rdi]
xor al, byte [rdi]
mov byte [r14 + rdi], al
inc rdi
sub rbx, 1
jne 0x1400be248
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x1400be274
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400be321
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, r8
mov r14d, 4
mov rsi, rdx
mov rdi, rcx
cmp rbx, r14
jb 0x1400be2f9
mov rbp, rbx
shr rbp, 2
imul rax, rbp, 0xfffffffffffffffc
add rbx, rax
mov r8, r14
lea rcx, [rsp + 0x68]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r14
lea rcx, [rsp + 0x60]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x60]
lea rdx, [rsp + 0x20]
xor eax, dword [rsp + 0x68]
mov r8, r14
mov rcx, rdi
mov dword [rsp + 0x20], eax
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
add rsi, r14
sub rbp, 1
jne 0x1400be2b1
test rbx, rbx
je 0x1400be30f
sub rsi, rdi
mov al, byte [rsi + rdi]
xor byte [rdi], al
inc rdi
sub rbx, 1
jne 0x1400be301
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400c4244
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm1, xmmword [rcx]
mov r9d, 4
shl edx, 2
mov r8, rcx
movdqu xmm0, xmmword [rcx + rdx*4]
movdqu xmmword [rcx], xmm0
movdqu xmmword [rcx + rdx*4], xmm1
add edx, 0xfffffffc
cmp edx, r9d
jbe 0x1400c4293
aesimc xmm0, xmmword [r8 + rdx*4]
mov ecx, r9d
add r9d, 4
aesimc xmm1, xmmword [r8 + rcx*4]
movdqu xmmword [r8 + rcx*4], xmm0
movdqu xmmword [r8 + rdx*4], xmm1
add edx, 0xfffffffc
cmp r9d, edx
jb 0x1400c426a
mov eax, r9d
aesimc xmm0, xmmword [r8 + rax*4]
movdqu xmmword [r8 + rax*4], xmm0
ret

Function at 0x1400c56bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400c5706
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400c5706
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400c5706
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400c5706
cmp dword [rcx + 0x84], 0xe
jbe 0x1400c5706
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400c5708
xor al, al
add rsp, 0x28
ret

Function at 0x180001e40
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180001e68
xor eax, eax
lea r8, [0x180001c40]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x14000b520
Capabilities:
Print debug messages

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x850
mov rsi, rcx
mov qword [rsp + 0x878], rdx
mov qword [rsp + 0x880], r8
mov qword [rsp + 0x888], r9
mov rax, qword [0x1406a7e00]
xor rax, rsp
mov qword [rsp + 0x848], rax
lea rbx, [rsp + 0x878]
mov qword [rsp + 0x38], rbx
mov ecx, 2
call fcn.1405699b8
mov rdi, rax
call fcn.14000b600
mov rcx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rdx, rdi
mov r8, rsi
xor r9d, r9d
call fcn.14056e9c4
mov ecx, 2
call fcn.1405699b8
mov rcx, rax
call fcn.14056f4d0
mov qword [rsp + 0x38], rbx
call fcn.14000b600
mov rcx, qword [rax]
or rcx, 2
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
lea rdi, [rsp + 0x40]
mov r8d, 0x800
mov rdx, rdi
mov r9, rsi
call fcn.14056ede4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x848]
xor rcx, rsp
call fcn.1405602f0
nop
add rsp, 0x850
pop rbx
pop rdi
pop rsi
ret
Function at 0x140014f30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0xc8
movaps xmmword [rsp + 0xb0], xmm8
movaps xmmword [rsp + 0xa0], xmm7
movaps xmmword [rsp + 0x90], xmm6
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1406a7e00]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea rdx, [rsp + 0x20]
call fcn.140018980
movsxd r14, dword [rsp + 0x28]
movsxd rbx, dword [rsp + 0x20]
mov rax, r14
sub rax, rbx
test rax, rax
jle 0x14001507a
movsxd r15, dword [rsp + 0x2c]
movsxd r12, dword [rsp + 0x24]
mov rcx, r15
sub rcx, r12
test rcx, rcx
jle 0x14001507a
or rcx, rax
shr rcx, 0x1f
jne 0x14001507a
movss xmm0, dword [0x1406908dc]
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm0
movabs rax, 0x103f800000
mov qword [rsp + 0x80], rax
mov rax, qword [rdi + 0xc40]
movss xmm0, dword [rax + 0x54]
movd xmm1, dword [rax + 0x34]
movss xmm2, dword [rax + 0x24]
movss xmm3, dword [rax + 0x4c]
movss xmm4, dword [rax + 0x2c]
movss xmm5, dword [rax + 0x18]
movss xmm6, dword [rax + 0x1c]
movss xmm7, dword [rax + 0x48]
movss xmm8, dword [rax + 0x28]
movss dword [rsp + 0x30], xmm5
movss dword [rsp + 0x34], xmm8
movss dword [rsp + 0x38], xmm7
movss dword [rsp + 0x3c], xmm6
movss dword [rsp + 0x40], xmm4
movss dword [rsp + 0x44], xmm3
movss dword [rsp + 0x48], xmm2
movd dword [rsp + 0x4c], xmm1
movss dword [rsp + 0x50], xmm0
mov dword [rsp + 0x54], 0x80
lea rcx, [rsp + 0x30]
call fcn.140020030
movzx eax, al
mov dword [rsp + 0x54], eax
test al, 0xf
je 0x140015085
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x60]
call fcn.1400220e0
test al, al
jne 0x14001508f
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
jmp 0x140015112
lea rcx, [rsp + 0x60]
call fcn.14001ffc0
cmp rbx, 0xffffffff80000003
mov rax, 0xffffffff80000002
cmovl rbx, rax
cmp r12, 0xffffffff80000003
cmovge rax, r12
cmp r14, 0x7ffffffe
mov ecx, 0x7ffffffe
cmovge r14, rcx
xorps xmm0, xmm0
cmp r15, 0x7ffffffe
cmovl rcx, r15
movups xmmword [rsi], xmm0
movd xmm0, ecx
movd xmm1, r14d
punpckldq xmm1, xmm0
movd xmm0, eax
movd xmm2, ebx
punpckldq xmm2, xmm0
punpcklqdq xmm2, xmm1
paddd xmm2, xmmword [0x14059a100]
cvtdq2ps xmm0, xmm2
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x30]
mov rdx, rsi
mov r9d, 1
call fcn.140023470
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1405602f0
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x90]
movaps xmm7, xmmword [rsp + 0xa0]
movaps xmm8, xmmword [rsp + 0xb0]
add rsp, 0xc8
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x14002d0b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
movaps xmmword [rsp + 0x90], xmm13
movaps xmmword [rsp + 0x80], xmm12
movaps xmmword [rsp + 0x70], xmm11
movaps xmmword [rsp + 0x60], xmm10
movaps xmmword [rsp + 0x50], xmm9
movaps xmmword [rsp + 0x40], xmm8
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rdx
mov rdi, rcx
mov r14d, dword [rcx]
cmp r14d, 0x101
mov r15d, 0x100
cmovae r15d, r14d
lea eax, [r15 - 1]
cvtsi2ss xmm0, rax
movss xmm8, dword [0x1406908dc]
lea eax, [r14 - 1]
xorps xmm9, xmm9
cvtsi2ss xmm9, rax
movaps xmm10, xmm8
divss xmm10, xmm0
lea rbx, [rcx + 4]
xor ebp, ebp
xorps xmm6, xmm6
movaps xmm11, xmmword [0x140599730]
movss xmm12, dword [0x140599700]
movss xmm13, dword [0x140599704]
jmp 0x14002d194
mov rcx, rbx
movaps xmm1, xmm7
call fcn.14002c8e0
movaps xmm1, xmm0
mov rcx, rsi
call fcn.14002c8e0
subss xmm7, xmm0
movaps xmm0, xmm7
xorps xmm0, xmm11
maxss xmm0, xmm7
maxss xmm6, xmm0
inc ebp
cmp r15d, ebp
je 0x14002d253
mov eax, ebp
xorps xmm7, xmm7
cvtsi2ss xmm7, rax
mulss xmm7, xmm10
test r14d, r14d
je 0x14002d160
movaps xmm0, xmm7
minss xmm0, xmm8
mulss xmm0, xmm9
cvttss2si eax, xmm0
movaps xmm1, xmm0
addss xmm1, xmm8
movd ecx, xmm1
dec ecx
movd xmm1, ecx
cvttss2si ecx, xmm1
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x14002d200
cdqe
movzx eax, byte [rdx + rax]
xorps xmm2, xmm2
cvtsi2ss xmm2, eax
mulss xmm2, xmm13
movsxd rax, ecx
movzx eax, byte [rdx + rax]
xorps xmm1, xmm1
cvtsi2ss xmm1, eax
mulss xmm1, xmm13
jmp 0x14002d237
mov rdx, qword [rdi + 0x10]
cdqe
movzx eax, word [rdx + rax*2]
movsxd rcx, ecx
movzx ecx, word [rdx + rcx*2]
rol ax, 8
movzx eax, ax
xorps xmm2, xmm2
cvtsi2ss xmm2, eax
rol cx, 8
mulss xmm2, xmm12
movzx eax, cx
xorps xmm1, xmm1
cvtsi2ss xmm1, eax
mulss xmm1, xmm12
cvttps2dq xmm3, xmm0
cvtdq2ps xmm3, xmm3
subss xmm0, xmm3
subss xmm1, xmm2
mulss xmm1, xmm0
addss xmm1, xmm2
jmp 0x14002d16e
movaps xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
movaps xmm9, xmmword [rsp + 0x50]
movaps xmm10, xmmword [rsp + 0x60]
movaps xmm11, xmmword [rsp + 0x70]
movaps xmm12, xmmword [rsp + 0x80]
movaps xmm13, xmmword [rsp + 0x90]
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14005fb80
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rax, qword [0x1406a7e00]
xor rax, rsp
mov qword [rsp + 0x38], rax
call fcn.140572da8
cmp rax, 0xffffffffffffffff
je 0x14005fc30
mov rbx, rax
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor edi, edi
test eax, eax
je 0x14005fc32
cmp qword [rsp + 0x30], 0
js 0x14005fc32
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor edi, edi
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbx, rax
test rax, rax
je 0x14005fc25
mov qword [rsp + 0x20], 0
xor edi, edi
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14005fc25
mov rcx, qword [rsp + 0x30]
mov qword [rsi], rcx
mov rdi, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14005fc32
xor edi, edi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1405602f0
mov rax, rdi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
push rsi
sub rsp, 0x20
mov rsi, rdx
call fcn.1405727b4
test eax, eax
js 0x14005fc70
mov ecx, eax
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp 0x14005fb80
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x14005fc50
Capabilities:
Get file size
Read file via mapping

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rax, qword [0x1406a7e00]
xor rax, rsp
mov qword [rsp + 0x38], rax
call fcn.140572da8
cmp rax, 0xffffffffffffffff
je 0x14005fc30
mov rbx, rax
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
xor edi, edi
test eax, eax
je 0x14005fc32
cmp qword [rsp + 0x30], 0
js 0x14005fc32
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor edi, edi
mov rcx, rbx
xor edx, edx
mov r8d, 2
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbx, rax
test rax, rax
je 0x14005fc25
mov qword [rsp + 0x20], 0
xor edi, edi
mov rcx, rbx
mov edx, 4
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
je 0x14005fc25
mov rcx, qword [rsp + 0x30]
mov qword [rsi], rcx
mov rdi, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14005fc32
xor edi, edi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1405602f0
mov rax, rdi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
push rsi
sub rsp, 0x20
mov rsi, rdx
call fcn.1405727b4
test eax, eax
js 0x14005fc70
mov ecx, eax
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp 0x14005fb80
xor eax, eax
add rsp, 0x20
pop rsi
ret
Function at 0x14005fc80
Capabilities:
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x1406a7e00]
xor rax, rsp
mov qword [rsp + 0x50], rax
call fcn.1405727b4
mov ecx, eax
call fcn.140572da8
cmp r14, 0xffffffffffffffff
je 0x14005fcfa
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rbx
mov r8d, 0xffffffff
cmp rdi, r8
cmovb r8, rdi
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x2c]
mov rcx, rax
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005fd03
mov esi, dword [rsp + 0x2c]
jmp 0x14005fd15
mov rsi, 0xffffffffffffffff
jmp 0x14005fd15
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
cmp eax, 0x26
setne sil
neg rsi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1405602f0
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140079fb0
Capabilities:
Hash data using murmur3

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
mov eax, dword [rcx]
mov ecx, dword [rcx + 4]
shl eax, 2
lea edx, [rcx + rcx*2]
cmp eax, edx
jl 0x140079fe7
lea eax, [rcx + rcx]
test ecx, ecx
mov edx, 4
cmovg edx, eax
mov rcx, rdi
call fcn.14007a0b0
mov ecx, dword [rdi + 4]
mov edx, dword [rsi]
mov eax, edx
shr eax, 0x10
xor eax, edx
imul eax, eax, 0x85ebca6b
mov r8d, eax
shr r8d, 0xd
xor r8d, eax
imul eax, r8d, 0xc2b2ae35
mov r9d, eax
shr r9d, 0x10
xor r9d, eax
mov r8d, 1
cmovne r8d, r9d
xor eax, eax
test ecx, ecx
jle 0x14007a0a1
lea r10d, [rcx - 1]
and r10d, r8d
mov r9, qword [rdi + 8]
mov r11d, ecx
jmp 0x14007a053
test r10d, r10d
mov ebx, ecx
cmovg ebx, eax
add r10d, ebx
dec r10d
dec r11d
je 0x14007a0a1
movsxd rbx, r10d
lea r14, [rbx + rbx*2]
lea rbx, [r9 + r14*8]
mov ebp, dword [r9 + r14*8]
test ebp, ebp
je 0x14007a08b
cmp r8d, ebp
jne 0x14007a040
cmp edx, dword [r9 + r14*8 + 8]
jne 0x14007a040
lea rax, [r9 + r14*8]
add rax, 8
mov dword [rbx], 0
movups xmm0, xmmword [rsi]
movups xmmword [rax], xmm0
mov dword [rbx], r8d
jmp 0x14007a0a1
lea rax, [r9 + r14*8]
add rax, 8
movups xmm0, xmmword [rsi]
movups xmmword [r9 + r14*8 + 8], xmm0
mov dword [rbx], r8d
inc dword [rdi]
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14007a0b0
Capabilities:
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov r14d, dword [rcx + 4]
mov dword [rcx], 0
mov dword [rcx + 4], edx
mov rbx, qword [rcx + 8]
test edx, edx
je 0x14007a132
movsxd rdi, edx
mov ecx, 0x18
mov rax, rdi
mul rcx
seto dl
add rax, 8
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
test dl, dl
cmove rcx, rax
call fcn.14056080c
mov qword [rax], rdi
add rax, 8
shl rdi, 3
lea rcx, [rdi + rdi*2]
xor edx, edx
nop word cs:[rax + rax]
mov dword [rax + rdx], 0
add rdx, 0x18
cmp rcx, rdx
jne 0x14007a120
jmp 0x14007a134
xor eax, eax
mov qword [rsi + 8], rax
test r14d, r14d
jle 0x14007a22a
xor eax, eax
xor edx, edx
jmp 0x14007a16c
movups xmm0, xmmword [r11]
movups xmmword [rdi + r13*8 + 8], xmm0
mov dword [r12], r9d
inc dword [rsi]
nop word [rax + rax]
inc rdx
cmp rdx, r14
je 0x14007a22a
lea r11, [rdx + rdx*2]
cmp dword [rbx + r11*8], 0
je 0x14007a160
mov r8d, dword [rbx + r11*8 + 8]
mov ecx, r8d
shr ecx, 0x10
xor ecx, r8d
imul ecx, ecx, 0x85ebca6b
mov r9d, ecx
shr r9d, 0xd
xor r9d, ecx
imul ecx, r9d, 0xc2b2ae35
mov r9d, ecx
shr r9d, 0x10
xor r9d, ecx
mov ecx, 1
cmove r9d, ecx
mov r10d, dword [rsi + 4]
test r10d, r10d
jle 0x14007a160
lea r11, [rbx + r11*8]
add r11, 8
lea r15d, [r10 - 1]
and r15d, r9d
mov rdi, qword [rsi + 8]
mov ebp, r10d
jmp 0x14007a1e7
test r15d, r15d
mov ecx, r10d
cmovg ecx, eax
add r15d, ecx
dec r15d
dec ebp
je 0x14007a160
movsxd rcx, r15d
lea r13, [rcx + rcx*2]
lea r12, [rdi + r13*8]
mov ecx, dword [rdi + r13*8]
test ecx, ecx
je 0x14007a147
cmp r9d, ecx
jne 0x14007a1d0
cmp r8d, dword [rdi + r13*8 + 8]
jne 0x14007a1d0
lea rcx, [rdi + r13*8]
add rcx, 8
mov dword [r12], 0
movups xmm0, xmmword [r11]
movups xmmword [rcx], xmm0
mov dword [r12], r9d
jmp 0x14007a160
test rbx, rbx
je 0x14007a27c
lea rcx, [rbx - 8]
mov rax, qword [rbx - 8]
test rax, rax
je 0x14007a267
shl rax, 3
lea rax, [rax + rax*2]
jmp 0x14007a256
add rax, 0xffffffffffffffe8
je 0x14007a267
cmp dword [rbx + rax - 0x18], 0
je 0x14007a250
mov dword [rbx + rax - 0x18], 0
jmp 0x14007a250
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.140560310
nop
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14007d7a0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm9
movaps xmmword [rsp + 0x40], xmm8
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
movss xmm0, dword [0x140599c10]
ucomiss xmm0, xmm1
jae 0x14007d864
mov edi, r8d
lea ebp, [rdi + rdi]
inc ebp
test ebp, ebp
jle 0x14007d8c6
movaps xmm0, xmm1
addss xmm0, xmm1
mulss xmm0, xmm1
movss xmm6, dword [0x1406908dc]
movaps xmm7, xmm6
divss xmm7, xmm0
mov ebx, ebp
neg edi
xorps xmm8, xmm8
xor r14d, r14d
movaps xmm9, xmmword [0x140599730]
nop word cs:[rax + rax]
lea eax, [rdi + r14]
xorps xmm1, xmm1
cvtsi2ss xmm1, eax
movaps xmm0, xmm1
xorps xmm0, xmm9
mulss xmm0, xmm1
mulss xmm0, xmm7
call fcn.140574c10
movss dword [rsi + r14*4], xmm0
addss xmm8, xmm0
inc r14
cmp rbx, r14
jne 0x14007d820
test ebp, ebp
jle 0x14007d8c6
divss xmm6, xmm8
cmp ebp, 7
ja 0x14007d86c
xor eax, eax
jmp 0x14007d8b0
mov dword [rsi], 0x3f800000
jmp 0x14007d8c6
mov eax, ebx
and eax, 0xfffffff8
movaps xmm0, xmm6
shufps xmm0, xmm6, 0
xor ecx, ecx
nop word [rax + rax]
movups xmm1, xmmword [rsi + rcx*4]
movups xmm2, xmmword [rsi + rcx*4 + 0x10]
mulps xmm1, xmm0
mulps xmm2, xmm0
movups xmmword [rsi + rcx*4], xmm1
movups xmmword [rsi + rcx*4 + 0x10], xmm2
add rcx, 8
cmp rax, rcx
jne 0x14007d880
nop word cs:[rax + rax]
movss xmm0, dword [rsi + rax*4]
mulss xmm0, xmm6
movss dword [rsi + rax*4], xmm0
inc rax
cmp rbx, rax
jne 0x14007d8b0
movaps xmm6, xmmword [rsp + 0x20]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x40]
movaps xmm9, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret