joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140a77a40
Capabilities:
Hash data using sha1

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rbp
push r14
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0xa0
xorps xmm0, xmm0
mov dword [rbp - 0x29], 0x67452301
xor eax, eax
mov dword [rbp - 0x25], 0xefcdab89
xor ebx, ebx
mov dword [rbp + 0x3b], eax
mov dword [rbp - 0x21], 0x98badcfe
mov r15, r8
mov dword [rbp - 0x1d], 0x10325476
mov rsi, rdx
mov dword [rbp - 0x19], 0xc3d2e1f0
mov r14, rcx
movups xmmword [rbp - 0x15], xmm0
movups xmmword [rbp - 5], xmm0
movups xmmword [rbp + 0xb], xmm0
movups xmmword [rbp + 0x1b], xmm0
movups xmmword [rbp + 0x2b], xmm0
test rdx, rdx
je 0x140a77b16
mov qword [r11 + 8], rdi
nop
movzx ecx, byte [rbp + 0x37]
lea rdx, [rbx + r14]
and ecx, 0x3f
mov edi, 0x40
sub rdi, rcx
mov rax, rsi
sub rax, rbx
cmp rdi, rax
cmovae rdi, rax
lea rax, [rbp - 9]
add rcx, rax
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov rax, qword [rbp - 0x11]
movzx edx, dil
add dl, byte [rbp + 0x37]
and dl, 0x3f
mov byte [rbp + 0x37], dl
lea rcx, [rax + rdi*8]
mov qword [rbp - 0x11], rcx
test dl, 0x3f
jne 0x140a77b06
lea rcx, [rbp - 0x29]
call fcn.140a77db0
add rbx, rdi
cmp rbx, rsi
jb 0x140a77ab0
mov rdi, qword [rsp + 0xc0]
lea rcx, [rbp - 0x29]
call fcn.140a77be0
movzx eax, byte [rbp - 0x1d]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov byte [rbp - 0x2a], al
movzx eax, byte [rbp - 0x1c]
mov byte [rbp - 0x2b], al
movzx eax, byte [rbp - 0x1b]
mov byte [rbp - 0x2c], al
movzx eax, byte [rbp - 0x1a]
mov byte [rbp - 0x2d], al
movzx eax, byte [rbp - 0x21]
mov byte [rbp - 0x2e], al
movzx eax, byte [rbp - 0x20]
mov byte [rbp - 0x2f], al
movzx eax, byte [rbp - 0x1f]
mov byte [rbp - 0x30], al
movzx eax, byte [rbp - 0x1e]
mov byte [rbp - 0x31], al
movzx eax, byte [rbp - 0x25]
mov byte [rbp - 0x32], al
movzx eax, byte [rbp - 0x24]
mov byte [rbp - 0x33], al
movzx eax, byte [rbp - 0x23]
mov byte [rbp - 0x34], al
movzx eax, byte [rbp - 0x22]
mov byte [rbp - 0x35], al
movzx eax, byte [rbp - 0x29]
mov byte [rbp - 0x36], al
movzx eax, byte [rbp - 0x28]
mov byte [rbp - 0x37], al
movzx eax, byte [rbp - 0x27]
mov byte [rbp - 0x38], al
movzx eax, byte [rbp - 0x26]
mov byte [rbp - 0x39], al
movzx eax, byte [rbp - 0x16]
movdqa xmm0, xmmword [rbp - 0x39]
mov byte [r15 + 0x10], al
movzx eax, byte [rbp - 0x17]
mov byte [r15 + 0x11], al
movzx eax, byte [rbp - 0x18]
mov byte [r15 + 0x12], al
movzx eax, byte [rbp - 0x19]
mov byte [r15 + 0x13], al
mov rax, r15
movdqu xmmword [r15], xmm0
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x140a7a738
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140a7a782
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140a7a782
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140a7a782
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140a7a782
cmp dword [rcx + 0x84], 0xe
jbe 0x140a7a782
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140a7a784
xor al, al
add rsp, 0x28
ret
Function at 0x140a80370
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x140a924c0]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x140a803ac
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.140a7a5a4
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140a80468
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x140a804ce
test ebx, ebx
jne 0x140a804ce
lea ecx, [rax + 2]
call fcn.140a7a5a4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.140a79d80
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret

Function at 0x140a808b0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov ebx, ecx
mov dword [rsp + 0x60], 0
xor ecx, ecx
mov dword [rsp + 0x68], 2
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140a80912
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140a80912
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
jne 0x140a80912
mov eax, 0x20b
cmp word [rdx + 0x18], ax
jne 0x140a80912
cmp dword [rdx + 0x84], 0xe
jbe 0x140a80912
cmp dword [rdx + 0xf8], 0
je 0x140a80912
mov ecx, ebx
call fcn.140a80770
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x1415fc018]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.140a805f0
cmp dword [rsp + 0x60], 0
jne 0x140a80955
mov ecx, ebx
call fcn.140a80720
int3
add rsp, 0x40
pop rbx
ret
Function at 0x140a809a0
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
xor eax, eax
mov ebx, ecx
xor ecx, ecx
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140a809fc
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140a809fc
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140a809fc
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140a809fc
cmp dword [rcx + 0x84], 0xe
jbe 0x140a809fc
cmp dword [rcx + 0xf8], 0
je 0x140a809fc
mov ecx, ebx
call fcn.140a80770
lea rax, [rsp + 0x68]
mov byte [rsp + 0x58], 0
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rcx, [0x1415fc018]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
call fcn.140a805f0
cmp dword [rsp + 0x60], 0
jne 0x140a80a3f
mov ecx, ebx
call fcn.140a80720
int3
add rsp, 0x40
pop rbx
ret

Function at 0x140a80f70
Capabilities:
Get disk information

Disassembly:
push rbp
sub rsp, 0x250
mov rax, qword [0x140a924c0]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rdx, [0x140a8bbd8]
mov rbp, rcx
call sub.msvcrt.dll_wcspbrk
test rax, rax
je 0x140a81131
mov qword [rsp + 0x268], rbx
xor ebx, ebx
mov qword [rsp + 0x270], rsi
mov qword [rsp + 0x278], rdi
call sub.msvcrt.dll__errno
mov esi, dword [rax]
call sub.msvcrt.dll__errno
mov r8d, 0x104
lea rcx, [rsp + 0x30]
mov rdx, rbp
mov dword [rax], ebx
call sub.msvcrt.dll__wfullpath
mov rdi, rax
test rax, rax
je 0x140a80fef
call sub.msvcrt.dll__errno
mov dword [rax], esi
jmp 0x140a81020
call sub.msvcrt.dll__errno
cmp dword [rax], 0x22
jne 0x140a8110f
call sub.msvcrt.dll__errno
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], esi
call sub.msvcrt.dll__wfullpath
mov rbx, rax
mov rdi, rax
test rax, rax
je 0x140a8110f
mov rax, 0xffffffffffffffff
mov rcx, rax
nop word [rax + rax]
inc rcx
cmp word [rdi + rcx*2], 0
jne 0x140a81030
cmp rcx, 3
je 0x140a810f5
inc rax
cmp word [rdi + rax*2], 0
jne 0x140a81044
cmp rax, 5
jb 0x140a8110f
movzx eax, word [rdi]
cmp ax, 0x5c
je 0x140a8106b
cmp ax, 0x2f
jne 0x140a8110f
movzx eax, word [rdi + 2]
cmp ax, 0x5c
je 0x140a8107f
cmp ax, 0x2f
jne 0x140a8110f
movzx eax, word [rdi + 4]
cmp ax, 0x5c
je 0x140a8110f
cmp ax, 0x2f
je 0x140a8110f
movzx eax, word [rdi + 6]
lea rcx, [rdi + 6]
test ax, ax
je 0x140a8110f
cmp ax, 0x5c
je 0x140a810b9
cmp ax, 0x2f
je 0x140a810b9
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x140a810a0
test ax, ax
je 0x140a8110f
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
je 0x140a8110f
nop dword [rax + rax]
cmp ax, 0x5c
je 0x140a810e9
cmp ax, 0x2f
je 0x140a810e9
movzx eax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x140a810d0
test ax, ax
je 0x140a810f5
cmp word [rcx + 2], 0
jne 0x140a8110f
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov rcx, rbx
cmp eax, 1
jbe 0x140a81112
call fcn.140a80245
mov al, 1
jmp 0x140a81119
mov rcx, rbx
call fcn.140a80245
xor al, al
mov rsi, qword [rsp + 0x270]
mov rbx, qword [rsp + 0x268]
mov rdi, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140a79d80
add rsp, 0x250
pop rbp
ret
Function at 0x140003060
Capabilities:
Write file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [fcn.140078700]
xor ebx, ebx
mov r12, rcx
mov rdi, rdx
test rdx, rdx
jle 0x1400030a2
nop
mov rsi, qword [r12 + rbx*8]
mov ecx, 1
add rbx, 1
call rbp
xor r8d, r8d
mov rcx, rax
mov rdx, rsi
call fcn.140002de0
cmp rbx, rdi
jne 0x140003080
mov ecx, 1
call rbp
mov r8d, 1
mov edx, 1
lea rcx, [0x14007a1fc]
mov r9, rax
call sub.msvcrt.dll_fwrite
mov ecx, 1
call rbp
mov rcx, rax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp sub.msvcrt.dll_fflush

Function at 0x1400032c0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
xor ebx, ebx
mov rbp, rcx
mov ecx, 0xfa0
call fcn.14000c0a0
mov rdi, rax
test rax, rax
je 0x1400033a5
lea r12, [rax + 0x10]
nop dword [rax]
mov rdx, qword [rdi]
test rdx, rdx
jg 0x140003303
sub rdx, 1
xor ecx, ecx
call fcn.14000d9c0
mov r9, rbp
mov r8d, 0xfa0
mov edx, 1
mov rcx, r12
call sub.msvcrt.dll_fread
mov rsi, rax
cmp rax, 0xfa0
je 0x1400033e0
mov rcx, rbp
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x140003441
test rsi, rsi
js 0x140003428
mov rdx, rsi
mov rcx, rdi
call fcn.14000c790
mov rsi, rax
test rax, rax
je 0x140003410
mov rdx, qword [rax]
mov rcx, rbx
call fcn.14000ccf0
lea rdx, [rsi + 0x10]
mov rbx, rax
mov rax, qword [rax]
lea rcx, [rbx + rax + 0x10]
mov rax, qword [rsi]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rsi]
add qword [rbx], rax
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rbx
xor edx, edx
call fcn.14000ccf0
mov rbx, rax
mov rdx, 0xffffffffffffffff
xor ecx, ecx
call fcn.14000d9c0
mov r9, rbp
mov r8d, 0xfa0
mov edx, 1
mov ecx, 0x10
call sub.msvcrt.dll_fread
mov rsi, rax
cmp rax, 0xfa0
jne 0x140003328
jmp 0x140003398
mov rdx, qword [rdi]
mov rcx, rbx
call fcn.14000ccf0
mov r8, qword [rdi]
mov rdx, r12
mov rbx, rax
mov rax, qword [rax]
add r8, 1
lea rcx, [rbx + rax + 0x10]
call sub.msvcrt.dll_memcpy
mov rax, qword [rdi]
add qword [rbx], rax
jmp 0x1400032f0
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.14000ccf0
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rsi
call fcn.14000d820
jmp 0x140003341
mov rcx, rbp
call fcn.140002c60
nop
nop word [rax + rax]
Function at 0x140003450
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov rsi, rdx
test rdx, rdx
js 0x140003590
mov rcx, rsi
call fcn.14000c0a0
mov rbx, rax
test rax, rax
je 0x1400035b8
mov rdx, qword [rax]
test rdx, rdx
jle 0x140003500
test rsi, rsi
js 0x140003514
lea rcx, [rbx + 0x10]
mov r9, rdi
mov r8, rsi
mov edx, 1
call sub.msvcrt.dll_fread
mov rcx, rdi
mov rbp, rax
cmp rsi, rax
je 0x140003530
call sub.msvcrt.dll_ferror
mov rcx, rdi
test eax, eax
jne 0x1400035f9
call sub.msvcrt.dll_fgetc
mov rdx, rdi
mov r12d, eax
mov ecx, eax
call sub.msvcrt.dll_ungetc
test r12d, r12d
jns 0x140003545
cmp rsi, rbp
jle 0x140003581
test rbp, rbp
js 0x1400035e0
mov rdx, rbp
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.14000c790
sub rdx, 1
xor ecx, ecx
call fcn.14000d9c0
test rsi, rsi
jns 0x14000348e
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rsi
call fcn.14000d820
jmp 0x14000348e
call sub.msvcrt.dll_fgetc
mov rdx, rdi
mov esi, eax
mov ecx, eax
call sub.msvcrt.dll_ungetc
test esi, esi
js 0x140003581
mov rcx, rdi
call fcn.1400032c0
mov rsi, rax
test rax, rax
je 0x1400035c8
mov rdx, qword [rax]
mov rcx, rbx
call fcn.14000ccf0
lea rdx, [rsi + 0x10]
mov rbx, rax
mov rax, qword [rax]
lea rcx, [rbx + rax + 0x10]
mov rax, qword [rsi]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rsi]
add qword [rbx], rax
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rsi
call fcn.14000d820
mov rcx, rsi
call fcn.14000c0a0
mov rbx, rax
test rax, rax
jne 0x14000347d
mov rdx, 0xffffffffffffffff
jmp 0x140003504
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.14000ccf0
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbp
call fcn.14000d820
jmp 0x1400034ea
call fcn.140002c60
nop
nop
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
xor ecx, ecx
call qword [fcn.140078700]
cmp rbx, rax
je 0x140003653
mov rsi, qword [0x140079160]
mov rcx, rbx
call rsi
xor edx, edx
mov r8d, 2
mov rcx, rbx
mov rdi, rax
mov rbp, qword [0x140079168]
call rbp
mov rcx, rbx
call rsi
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
mov rsi, rax
call rbp
test rsi, rsi
jg 0x140003668
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1400032c0
mov rdx, rsi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.140003450
Function at 0x140003600
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov rsi, rdx
test rdx, rdx
js 0x140003590
mov rcx, rsi
call fcn.14000c0a0
mov rbx, rax
test rax, rax
je 0x1400035b8
mov rdx, qword [rax]
test rdx, rdx
jle 0x140003500
test rsi, rsi
js 0x140003514
lea rcx, [rbx + 0x10]
mov r9, rdi
mov r8, rsi
mov edx, 1
call sub.msvcrt.dll_fread
mov rcx, rdi
mov rbp, rax
cmp rsi, rax
je 0x140003530
call sub.msvcrt.dll_ferror
mov rcx, rdi
test eax, eax
jne 0x1400035f9
call sub.msvcrt.dll_fgetc
mov rdx, rdi
mov r12d, eax
mov ecx, eax
call sub.msvcrt.dll_ungetc
test r12d, r12d
jns 0x140003545
cmp rsi, rbp
jle 0x140003581
test rbp, rbp
js 0x1400035e0
mov rdx, rbp
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.14000c790
sub rdx, 1
xor ecx, ecx
call fcn.14000d9c0
test rsi, rsi
jns 0x14000348e
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rsi
call fcn.14000d820
jmp 0x14000348e
call sub.msvcrt.dll_fgetc
mov rdx, rdi
mov esi, eax
mov ecx, eax
call sub.msvcrt.dll_ungetc
test esi, esi
js 0x140003581
mov rcx, rdi
call fcn.1400032c0
mov rsi, rax
test rax, rax
je 0x1400035c8
mov rdx, qword [rax]
mov rcx, rbx
call fcn.14000ccf0
lea rdx, [rsi + 0x10]
mov rbx, rax
mov rax, qword [rax]
lea rcx, [rbx + rax + 0x10]
mov rax, qword [rsi]
lea r8, [rax + 1]
call sub.msvcrt.dll_memcpy
mov rax, qword [rsi]
add qword [rbx], rax
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rsi
call fcn.14000d820
mov rcx, rsi
call fcn.14000c0a0
mov rbx, rax
test rax, rax
jne 0x14000347d
mov rdx, 0xffffffffffffffff
jmp 0x140003504
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp fcn.14000ccf0
movabs r8, 0x7fffffffffffffff
xor edx, edx
mov rcx, rbp
call fcn.14000d820
jmp 0x1400034ea
call fcn.140002c60
nop
nop
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
xor ecx, ecx
call qword [fcn.140078700]
cmp rbx, rax
je 0x140003653
mov rsi, qword [0x140079160]
mov rcx, rbx
call rsi
xor edx, edx
mov r8d, 2
mov rcx, rbx
mov rdi, rax
mov rbp, qword [0x140079168]
call rbp
mov rcx, rbx
call rsi
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
mov rsi, rax
call rbp
test rsi, rsi
jg 0x140003668
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.1400032c0
mov rdx, rsi
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp fcn.140003450
Function at 0x140004030
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
mov rsi, rcx
mov rbx, rdx
test rdx, rdx
je 0x14000404f
mov rcx, rdx
call sub.msvcrt.dll_strlen
mov r8, rax
mov rcx, rbx
mov r9, rsi
mov edx, 1
call sub.msvcrt.dll_fwrite
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp sub.msvcrt.dll_fflush

Function at 0x140004100
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 2
call qword [fcn.140078700]
mov r8d, 0x4b
mov edx, 1
lea rcx, str._GC__cannot_register_thread_local_variable__too_many_thread_local_variables
mov rbx, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, rbx
call sub.msvcrt.dll_fflush
mov ecx, 1
call sub.msvcrt.dll_exit
nop
ret

Function at 0x140012290
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
test rcx, rcx
je 0x1400122eb
mov r9, qword [rcx]
add rcx, 0x10
xor eax, eax
lea r8, [rcx + r9]
test r9, r9
jle 0x1400122eb
nop dword [rax]
movzx edx, byte [rcx]
add rcx, 1
add rdx, rax
mov rax, rdx
shl rax, 0xa
add rax, rdx
mov rdx, rax
shr rdx, 6
xor rax, rdx
cmp r8, rcx
jne 0x1400122b0
lea rdx, [rax + rax*8]
mov rax, rdx
shr rax, 0xb
xor rax, rdx
mov rdx, rax
shl rdx, 0xf
add rdx, rax
mov rax, rdx
ret
Function at 0x140013fa0
Capabilities:
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor ebx, ebx
xor r13d, r13d
mov rdi, rdx
sar rdx, 0x3f
mov rbp, rcx
shr rdx, 0x3e
mov r12, rdi
lea rsi, [rdi - 1]
lea rax, [rdi + rdx]
and eax, 3
sub rax, rdx
sub r12, rax
cmp rdi, 3
jle 0x140014110
nop dword [rax]
cmp rdi, rbx
jle 0x1400140d0
mov eax, dword [rbp + rbx]
add rbx, 4
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, r13d
rol eax, 0xd
lea r13d, [rax + rax*4 - 0x19ab949c]
cmp rbx, r12
jl 0x140013fe8
mov rax, rdi
xor ebx, ebx
sar rax, 0x3f
shr rax, 0x3e
lea r14, [rdi + rax]
and r14d, 3
sub r14, rax
test r14, r14
jle 0x14001408c
lea rsi, [rdi - 1]
jmp 0x140014055
test r15, r15
js 0x140014062
movzx eax, byte [rbp + r15]
shl ebx, 8
or ebx, eax
test r14, r14
je 0x14001407d
sub r14, 1
lea r15, [r12 + r14]
cmp r15, rdi
jl 0x140014040
mov rdx, rsi
mov rcx, r15
shl ebx, 8
call fcn.14000d9c0
movzx eax, byte [rbp + r15]
or ebx, eax
test r14, r14
jne 0x140014055
imul ebx, ebx, 0xcc9e2d51
rol ebx, 0xf
imul ebx, ebx, 0x1b873593
xor r13d, edi
mov eax, r13d
xor eax, ebx
mov r13d, eax
shr r13d, 0x10
xor r13d, eax
imul r13d, r13d, 0x85ebca6b
mov edx, r13d
shr edx, 0xd
xor edx, r13d
imul edx, edx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
mov rdx, rsi
call fcn.14000d9c0
mov eax, dword [rbp + rbx]
add rbx, 4
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, r13d
rol eax, 0xd
lea r13d, [rax + rax*4 - 0x19ab949c]
cmp r12, rbx
jg 0x140013fe8
jmp 0x14001401b
xor r12d, r12d
jmp 0x14001401b
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
test rcx, rcx
je 0x14001413b
mov rdx, qword [rcx]
test rdx, rdx
js 0x140014150
add rbx, 0x10
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140013fa0
lea rax, [rdx - 1]
mov r8, rdx
xor ecx, ecx
mov rdx, rax
call fcn.140010550
mov rdx, qword [rbx]
jmp 0x140014137
Function at 0x140014120
Capabilities:
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
xor ebx, ebx
xor r13d, r13d
mov rdi, rdx
sar rdx, 0x3f
mov rbp, rcx
shr rdx, 0x3e
mov r12, rdi
lea rsi, [rdi - 1]
lea rax, [rdi + rdx]
and eax, 3
sub rax, rdx
sub r12, rax
cmp rdi, 3
jle 0x140014110
nop dword [rax]
cmp rdi, rbx
jle 0x1400140d0
mov eax, dword [rbp + rbx]
add rbx, 4
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, r13d
rol eax, 0xd
lea r13d, [rax + rax*4 - 0x19ab949c]
cmp rbx, r12
jl 0x140013fe8
mov rax, rdi
xor ebx, ebx
sar rax, 0x3f
shr rax, 0x3e
lea r14, [rdi + rax]
and r14d, 3
sub r14, rax
test r14, r14
jle 0x14001408c
lea rsi, [rdi - 1]
jmp 0x140014055
test r15, r15
js 0x140014062
movzx eax, byte [rbp + r15]
shl ebx, 8
or ebx, eax
test r14, r14
je 0x14001407d
sub r14, 1
lea r15, [r12 + r14]
cmp r15, rdi
jl 0x140014040
mov rdx, rsi
mov rcx, r15
shl ebx, 8
call fcn.14000d9c0
movzx eax, byte [rbp + r15]
or ebx, eax
test r14, r14
jne 0x140014055
imul ebx, ebx, 0xcc9e2d51
rol ebx, 0xf
imul ebx, ebx, 0x1b873593
xor r13d, edi
mov eax, r13d
xor eax, ebx
mov r13d, eax
shr r13d, 0x10
xor r13d, eax
imul r13d, r13d, 0x85ebca6b
mov edx, r13d
shr edx, 0xd
xor edx, r13d
imul edx, edx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rbx
mov rdx, rsi
call fcn.14000d9c0
mov eax, dword [rbp + rbx]
add rbx, 4
imul eax, eax, 0xcc9e2d51
rol eax, 0xf
imul eax, eax, 0x1b873593
xor eax, r13d
rol eax, 0xd
lea r13d, [rax + rax*4 - 0x19ab949c]
cmp r12, rbx
jg 0x140013fe8
jmp 0x14001401b
xor r12d, r12d
jmp 0x14001401b
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
test rcx, rcx
je 0x14001413b
mov rdx, qword [rcx]
test rdx, rdx
js 0x140014150
add rbx, 0x10
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x140013fa0
lea rax, [rdx - 1]
mov r8, rdx
xor ecx, ecx
mov rdx, rax
call fcn.140010550
mov rdx, qword [rbx]
jmp 0x140014137

Function at 0x140024790
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, qword [rcx]
mov rdi, qword [rcx + 8]
mov rbx, rsi
cmp rdi, rsi
jge 0x1400247b2
lea rcx, [0x14007cd60]
call fcn.140001cb0
sub rdi, rsi
mov r8, rdi
je 0x140024819
mov r9, qword [0x1400b7f80]
mov rcx, qword [0x1400b7f88]
cmp rdi, 0xffffffffffffffff
je 0x140024828
mov rax, 0xffffffffffffffff
xor edx, edx
div rdi
lea rax, [rcx + r9]
xor rcx, r9
ror r9, 9
mov rdi, rdx
mov r10, rcx
xor r9, rcx
ror rcx, 0x1c
shl r10, 0xe
xor r9, r10
add rdi, rax
jb 0x1400247da
add r8, 1
xor edx, edx
mov qword [0x1400b7f80], r9
div r8
mov qword [0x1400b7f88], rcx
lea rbx, [rdx + rsi]
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rax, r9
mov rdx, r9
add r9, rcx
xor rax, rcx
ror rdx, 9
lea rbx, [r9 + rsi]
mov r8, rax
xor rdx, rax
ror rax, 0x1c
shl r8, 0xe
mov qword [0x1400b7f88], rax
mov rax, rbx
xor rdx, r8
mov qword [0x1400b7f80], rdx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
Function at 0x140048a50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rsi
push rbx
test rdx, rdx
mov eax, r8d
lea r8, [rdx + 7]
mov r9, rcx
cmovns r8, rdx
mov r10, rdx
xor r11d, r11d
lea rcx, [0x1400815e0]
sar r8, 3
cmp rdx, 7
jle 0x140048b20
nop
mov ebx, dword [r9 + r11*8 + 4]
xor eax, dword [r9 + r11*8]
add r11, 1
mov esi, ebx
movzx edx, bl
shr esi, 0x18
mov edx, dword [rcx + rdx*4 + 0xc00]
xor edx, dword [rcx + rsi*4]
movzx esi, al
xor edx, dword [rcx + rsi*4 + 0x1c00]
mov esi, eax
shr esi, 0x18
xor edx, dword [rcx + rsi*4 + 0x1000]
movzx esi, bh
shr ebx, 0x10
movzx ebx, bl
xor edx, dword [rcx + rsi*4 + 0x800]
xor edx, dword [rcx + rbx*4 + 0x400]
movzx ebx, ah
shr eax, 0x10
movzx eax, al
xor edx, dword [rcx + rbx*4 + 0x1800]
xor edx, dword [rcx + rax*4 + 0x1400]
mov eax, edx
cmp r8, r11
jg 0x140048a80
shl r8, 3
cmp r10, r8
jle 0x140048b18
add r8, r9
lea rcx, [0x1400815e0]
add r9, r10
movzx edx, byte [r8]
add r8, 1
xor edx, eax
shr eax, 8
movzx edx, dl
xor eax, dword [rcx + rdx*4]
cmp r9, r8
jne 0x140048b00
pop rbx
pop rsi
ret
xor r8d, r8d
jmp 0x140048aee