joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a5720
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xd0
mov rax, qword [0x14049f410]
xor rax, rsp
mov qword [rbp + 0x17], rax
xor edi, edi
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov r15, r8
mov dword [rsp + 0x28], 0x98badcfe
mov rsi, rdx
mov qword [rbp - 0x7d], 0x10325476
mov r14, rcx
mov qword [rbp - 0x75], rdi
cmp rdx, 0x40
jb 0x1400a5797
mov rbx, rdx
lea r8, [rsp + 0x20]
and rbx, 0xffffffffffffffc0
mov rdx, rbx
call fcn.1400754a0
mov edi, dword [rbp - 0x71]
add r14, rbx
and esi, 0x3f
mov r12d, 0x40
test rsi, rsi
je 0x1400a57e3
lea rcx, [rbp - 0x6d]
mov r8, rsi
add rcx, rdi
mov rdx, r14
call fcn.1400fd5d8
add rdi, rsi
cmp rdi, r12
jb 0x1400a57e0
lea r8, [rsp + 0x20]
mov edx, r12d
lea rcx, [rbp - 0x6d]
call fcn.1400754a0
sub rdi, r12
lea rdx, [rbp - 0x2d]
mov r8, rdi
lea rcx, [rbp - 0x6d]
call fcn.1400fd5d8
mov dword [rbp - 0x71], edi
mov ecx, dword [rbp - 0x79]
add ecx, edi
mov dword [rbp - 0x79], ecx
cmp ecx, edi
jae 0x1400a57f2
inc dword [rbp - 0x75]
lea ecx, [rcx*8]
cmp edi, 0x38
mov ebx, pe_nt_image_headers64
lea rdx, [0x14018f950]
mov eax, ebx
mov r8d, 0x78
cmovb rax, r12
cmovb rbx, r12
mov dword [rbp + rax - 0x75], ecx
mov eax, dword [rbp - 0x75]
mov ecx, dword [rbp - 0x79]
shr ecx, 0x1d
lea eax, [rax*8]
or ecx, eax
mov eax, edi
mov dword [rbp + rbx - 0x71], ecx
mov ecx, 0x38
cmp edi, ecx
cmovb r8d, ecx
lea rcx, [rbp - 0x6d]
add rcx, rax
sub r8, rax
call fcn.1400fd5d8
lea r8, [rsp + 0x20]
mov rdx, rbx
lea rcx, [rbp - 0x6d]
call fcn.1400754a0
mov ecx, dword [rsp + 0x20]
mov rax, r15
mov dword [r15], ecx
mov ecx, dword [rsp + 0x24]
mov dword [r15 + 4], ecx
mov ecx, dword [rsp + 0x28]
mov dword [r15 + 8], ecx
mov ecx, dword [rbp - 0x7d]
mov dword [r15 + 0xc], ecx
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400fc4b0
add rsp, 0xd0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400024c4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
cmp dword [0x1400ce6e4], 0
lea rsi, [0x1400ce6e0]
mov ebx, r8d
mov r10, rcx
jne 0x140002529
xor r9d, r9d
mov r11, rsi
mov r8d, r9d
mov edi, 8
mov ecx, r8d
mov eax, r8d
and ecx, 1
shr eax, 1
neg ecx
and ecx, 0xedb88320
mov r8d, ecx
xor r8d, eax
sub rdi, 1
jne 0x1400024f7
mov dword [r11], r8d
inc r9d
add r11, 4
cmp r9d, 0x100
jb 0x1400024ef
not ebx
mov r8d, ebx
test edx, edx
jle 0x140002554
movzx eax, byte [r10]
inc r10
movzx ecx, r8b
xor rcx, rax
mov eax, r8d
shr eax, 8
mov r8d, dword [rsi + rcx*4]
xor r8d, eax
sub edx, 1
jne 0x140002532
jmp 0x140002594
mov cl, byte [r10]
inc r10
test cl, cl
je 0x140002594
mov r9b, reloc.WLDAP32.dll_Ordinal_35
cmp cl, r9b
jne 0x140002573
cmp byte [r10], r9b
jne 0x140002573
cmp byte [r10 + 1], r9b
cmove r8d, ebx
movzx eax, cl
mov ecx, r8d
movzx edx, r8b
shr ecx, 8
xor rdx, rax
mov r8d, dword [rsi + rdx*4]
xor r8d, ecx
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x140002561
mov rbx, qword [rsp + 8]
not r8d
mov rsi, qword [rsp + 0x10]
mov eax, r8d
mov rdi, qword [rsp + 0x18]
ret
Function at 0x14001535d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r8d, r8d
jle 0x1400155c6
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x1400b0700]
xor rax, rsp
mov qword [rbp - 8], rax
mov esi, dword [rbp + 0x50]
mov eax, edx
and qword [rbp - 0x10], 0
mov r14d, edx
sub eax, esi
movsxd r12, r9d
movsxd rbx, eax
mov rdi, rcx
mov r15d, r8d
mov r8, rsi
lea rcx, [rbp - 0x10]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xor r9d, r9d
mov eax, esi
sub eax, 2
je 0x140015514
sub eax, 1
je 0x1400154c5
sub eax, 1
je 0x140015477
xor r8d, r8d
cmp eax, 1
je 0x140015427
test rbx, rbx
js 0x140015558
mov r10, rdi
lea r11, [rbx + 1]
movzx edx, byte [r10]
movsxd rax, r8d
mov ecx, edx
and eax, 7
movzx eax, byte [rbp + rax - 0x10]
sub ecx, eax
lea eax, [rsi + r8]
and eax, 7
add r9d, ecx
inc r8d
mov byte [rbp + rax - 0x10], dl
xor edx, edx
mov eax, r9d
div esi
mov byte [r10], al
inc r10
sub r11, 1
jne 0x1400153eb
jmp 0x140015558
test rbx, rbx
js 0x140015558
mov r10, rdi
lea r11, [rbx + 1]
movzx edx, byte [r10]
movsxd rax, r8d
mov ecx, edx
and eax, 7
movzx eax, byte [rbp + rax - 0x10]
sub ecx, eax
lea eax, [r8 - 3]
and eax, 7
add r9d, ecx
inc r8d
mov byte [rbp + rax - 0x10], dl
mov eax, 0xcccccccd
mul r9d
shr edx, 2
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x140015437
jmp 0x140015558
xor r8d, r8d
test rbx, rbx
js 0x140015558
mov r10, rdi
lea r11, [rbx + 1]
movzx edx, byte [r10]
movsxd rax, r8d
mov ecx, edx
and eax, 7
movzx eax, byte [rbp + rax - 0x10]
sub ecx, eax
lea eax, [r8 - 4]
and eax, 7
add r9d, ecx
inc r8d
mov byte [rbp + rax - 0x10], dl
mov eax, r9d
shr eax, 2
mov byte [r10], al
inc r10
sub r11, 1
jne 0x14001548a
jmp 0x140015558
xor r8d, r8d
test rbx, rbx
js 0x140015558
mov r10, rdi
lea r11, [rbx + 1]
movzx edx, byte [r10]
movsxd rax, r8d
mov ecx, edx
and eax, 7
movzx eax, byte [rbp + rax - 0x10]
sub ecx, eax
lea eax, [r8 + 3]
and eax, 7
add r9d, ecx
inc r8d
mov byte [rbp + rax - 0x10], dl
mov eax, 0xaaaaaaab
mul r9d
shr edx, 1
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x1400154d8
jmp 0x140015558
xor r8d, r8d
test rbx, rbx
js 0x140015558
mov r10, rdi
lea r11, [rbx + 1]
movzx edx, byte [r10]
movsxd rax, r8d
mov ecx, edx
and eax, 7
movzx eax, byte [rbp + rax - 0x10]
sub ecx, eax
lea eax, [r8 + 2]
and eax, 7
add r9d, ecx
inc r8d
mov byte [rbp + rax - 0x10], dl
mov eax, r9d
shr eax, 1
mov byte [r10], al
inc r10
sub r11, 1
jne 0x140015523
cmp r8d, r14d
jge 0x140015591
movsxd rcx, r8d
mov eax, r14d
sub eax, r8d
mov r8d, eax
lea r10, [rcx + rdi]
mov rax, rcx
xor edx, edx
and eax, 7
inc rcx
movzx eax, byte [rbp + rax - 0x10]
sub r9d, eax
mov eax, r9d
div esi
mov byte [r10], al
inc r10
sub r8, 1
jne 0x14001556d
add rdi, r12
sub r15, 1
jne 0x1400153a5
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140085070
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400155d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test edx, edx
jle 0x14001582a
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [0x1400b0700]
xor rax, rsp
mov qword [rbp - 8], rax
mov esi, dword [rbp + 0x60]
mov ebx, r8d
sub ebx, esi
movsxd r14, r9d
and qword [rbp - 0x10], 0
mov r15d, r8d
mov rdi, rcx
mov r12d, edx
mov r8, rsi
lea rcx, [rbp - 0x10]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xor r10d, r10d
mov eax, esi
sub eax, 2
je 0x140015779
sub eax, 1
je 0x14001572b
sub eax, 1
je 0x1400156de
xor r9d, r9d
cmp eax, 1
je 0x14001568f
test ebx, ebx
js 0x1400157bc
xor r11d, r11d
mov eax, r9d
movsxd r8, r11d
and eax, 7
add r11d, r14d
movzx edx, byte [r8 + rdi]
movzx ecx, byte [rbp + rax - 0x10]
mov eax, edx
sub eax, ecx
add r10d, eax
lea eax, [rsi + r9]
and eax, 7
inc r9d
mov byte [rbp + rax - 0x10], dl
xor edx, edx
mov eax, r10d
div esi
mov byte [r8 + rdi], al
cmp r9d, ebx
jle 0x14001564f
jmp 0x1400157bc
test ebx, ebx
js 0x1400157bc
xor r11d, r11d
mov eax, r9d
movsxd r8, r11d
and eax, 7
add r11d, r14d
movzx edx, byte [r8 + rdi]
movzx ecx, byte [rbp + rax - 0x10]
mov eax, edx
sub eax, ecx
add r10d, eax
lea eax, [r9 - 3]
and eax, 7
inc r9d
mov byte [rbp + rax - 0x10], dl
mov eax, 0xcccccccd
mul r10d
shr edx, 2
mov byte [r8 + rdi], dl
cmp r9d, ebx
jle 0x14001569a
jmp 0x1400157bc
xor r9d, r9d
test ebx, ebx
js 0x1400157bc
xor r11d, r11d
mov eax, r9d
movsxd r8, r11d
and eax, 7
add r11d, r14d
movzx edx, byte [r8 + rdi]
movzx ecx, byte [rbp + rax - 0x10]
mov eax, edx
sub eax, ecx
add r10d, eax
lea eax, [r9 - 4]
and eax, 7
inc r9d
mov byte [rbp + rax - 0x10], dl
mov eax, r10d
shr eax, 2
mov byte [r8 + rdi], al
cmp r9d, ebx
jle 0x1400156ec
jmp 0x1400157bc
xor r9d, r9d
test ebx, ebx
js 0x1400157bc
xor r11d, r11d
mov eax, r9d
movsxd r8, r11d
and eax, 7
add r11d, r14d
movzx edx, byte [r8 + rdi]
movzx ecx, byte [rbp + rax - 0x10]
mov eax, edx
sub eax, ecx
add r10d, eax
lea eax, [r9 + 3]
and eax, 7
inc r9d
mov byte [rbp + rax - 0x10], dl
mov eax, 0xaaaaaaab
mul r10d
shr edx, 1
mov byte [r8 + rdi], dl
cmp r9d, ebx
jle 0x140015739
jmp 0x1400157bc
xor r9d, r9d
test ebx, ebx
js 0x1400157bc
xor r11d, r11d
mov eax, r9d
movsxd r8, r11d
and eax, 7
add r11d, r14d
movzx edx, byte [r8 + rdi]
movzx ecx, byte [rbp + rax - 0x10]
mov eax, edx
sub eax, ecx
add r10d, eax
lea eax, [r9 + 2]
and eax, 7
inc r9d
mov byte [rbp + rax - 0x10], dl
mov eax, r10d
shr eax, 1
mov byte [r8 + rdi], al
cmp r9d, ebx
jle 0x140015783
cmp r9d, r15d
jge 0x1400157fd
mov eax, r14d
movsxd r8, r9d
imul eax, r9d
movsxd rcx, eax
mov eax, r15d
add rcx, rdi
sub eax, r9d
mov r9d, eax
mov rax, r8
xor edx, edx
and eax, 7
inc r8
movzx eax, byte [rbp + rax - 0x10]
sub r10d, eax
mov eax, r10d
div esi
mov byte [rcx], al
add rcx, r14
sub r9, 1
jne 0x1400157da
inc rdi
sub r12, 1
jne 0x14001560e
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140085070
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001582c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
xor r14d, r14d
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rsi, rdx
movsxd rdi, r9d
mov rbp, rcx
test r9d, r9d
jle 0x140015a24
lea rbx, [r8 + 0x20]
xor r13d, r13d
lea r8d, [r14 + 1]
mov r11d, 0x100
xorps xmm7, xmm7
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x1400158d5
movsxd r10, dword [rsi + 0x24]
mov r9, qword [rsi + 8]
movsx ecx, r11w
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, r11w
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
mov r8d, 1
movd xmm0, eax
cvtdq2ps xmm0, xmm0
divss xmm6, xmm0
jmp 0x1400158fe
movsxd rcx, dword [rsi + 0x1c]
mov rax, qword [rsi + 8]
movzx edx, byte [rcx + rax + 0x12]
movzx eax, byte [rcx + rax + 0x13]
shl edx, 8
add edx, eax
movd xmm0, edx
cvtdq2ps xmm0, xmm0
divss xmm6, xmm0
xorps xmm6, xmmword [0x1400a2280]
mov al, byte [rbp + 0x20]
xor r15d, r15d
mov byte [rbx], al
mov al, byte [rbp + 0x24]
mov byte [rbx + 1], al
cmp dword [rbx - 0x10], r15d
jle 0x140015a17
mov rcx, qword [rsp + 0xe0]
mov rax, r13
shl rax, 4
add rcx, 6
xor r12d, r12d
add rcx, rax
mov qword [rsp + 0x60], rcx
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x140015945
mov edx, dword [rbx - 0x1c]
add edx, r15d
jmp 0x140015949
mov edx, dword [rax + r12]
mov rcx, rsi
call fcn.140011b64
mov edx, eax
xorps xmm3, xmm3
mov eax, dword [rbp + 0x24]
xorps xmm2, xmm2
mov rcx, rsi
cvtsi2ss xmm3, rax
mov eax, dword [rbp + 0x20]
cvtsi2ss xmm2, rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x30], rax
mulss xmm3, xmm6
mulss xmm2, xmm6
movss dword [rsp + 0x28], xmm7
movss dword [rsp + 0x20], xmm7
call fcn.140013940
mov rcx, qword [rsp + 0x60]
mov r8d, 1
movzx eax, word [rbp + 0x20]
add r14d, r8d
sub ax, word [rsp + 0xd8]
add r13, r8
add ax, word [rbp + 0x1c]
add r15d, r8d
add ax, word [rsp + 0x50]
add r12, 4
sub ax, r8w
mov word [rcx - 2], ax
movzx eax, word [rbp + 0x24]
sub ax, word [rsp + 0x54]
add ax, word [rbp + 0x1c]
add ax, word [rsp + 0x58]
sub ax, r8w
mov word [rcx], ax
add rcx, 0x10
mov qword [rsp + 0x60], rcx
cmp r15d, dword [rbx - 0x10]
jl 0x140015934
mov r11d, 0x100
add rbx, 0x28
sub rdi, r8
jne 0x14001587c
movaps xmm7, xmmword [rsp + 0x70]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov eax, r14d
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001f348
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0xc0
mov rax, qword [0x1400b0700]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetCurrentHwProfileA]
test eax, eax
je 0x14001f3a3
lea rdx, [rsp + 0x34]
mov rcx, rbx
call fcn.140022fec
mov rax, rbx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140085070
add rsp, 0xc0
pop rbx
ret
lea rcx, [0x1400a1330]
call fcn.140149b1e
nop
mov r9d, reloc.WS2_32.dll_recv
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140020014
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push r12
push r15
lea rbp, [rax - 0x198]
sub rsp, 0x280
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1400b0700]
xor rax, rsp
mov qword [rbp + 0x170], rax
movdqa xmm0, xmmword [0x1400a1c80]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x26203d2a
mov word [rsp + 0x44], Ordinal_45
xor ecx, ecx
lea r15d, [rcx + 1]
mov al, byte [rsp + 0x30]
xor byte [rsp + rcx + 0x31], al
add rcx, r15
cmp rcx, 0x14
jb 0x140020072
mov byte [rsp + 0x45], 0
lea rcx, [rsp + 0x31]
push 0x47586ca0
push rsi
mov rsi, qword [rsp + 8]
push rcx
pushfq
neg word [rsp + 0x18]
call fcn.140352449
movabs dword [0x51e3f0d9e68e02e1], eax
cmp esp, dword [rbx + 0x75]
in al, dx
xor dword [rdi - 0x6e154ade], esi
sub byte [rdx + 0x344e1ae2], ch
xor byte [rdx - 0x5dfd71f6], 0xf
or ecx, dword [rsi + 0x6a]
je 0x140020135
out 0xf1, al
add dh, cl
clc
xor esp, esi
invalid
invalid

Function at 0x1400207a4
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
movdqa xmm0, xmmword [0x1400a2240]
mov r10, rcx
movdqa xmm1, xmmword [str.dr_r__9.]
xor ecx, ecx
movdqa xmmword [rbp - 0x39], xmm0
mov r11, rdx
movdqa xmm0, xmmword [0x1400a1ca0]
mov edx, ecx
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm1, xmmword [str._65et_vl]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm0, xmmword [0x1400a2200]
movdqa xmmword [rbp - 9], xmm1
movdqa xmm1, xmmword [0x1400a1c10]
movdqa xmmword [rbp + 7], xmm0
movdqa xmm0, xmmword [0x1400a2230]
movdqa xmmword [rbp + 0x17], xmm1
movdqa xmm1, xmmword [0x1400a1cb0]
movdqa xmmword [rbp + 0x27], xmm0
movdqa xmmword [rbp + 0x37], xmm1
mov word [rbp + 0x47], gethostname
mov al, byte [rbp - 0x39]
xor byte [rbp + rdx - 0x38], al
inc rdx
cmp rdx, 0x80
jb 0x14002082a
mov byte [rbp + 0x48], cl
lea rax, [rbp - 0x38]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], cl
jne 0x140020848
test r11, r11
je 0x140020875
mov rax, rcx
mov r9, r10
xor edx, edx
inc ecx
div r8
mov al, byte [rbp + rdx - 0x38]
xor byte [r9], al
inc r9
movsxd rax, ecx
cmp rax, r11
jb 0x14002085c
mov rax, r10
add rsp, 0x90
pop rbp
ret
Function at 0x140028d34
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov rbx, rcx
mov esi, 0x7fffffff
mov ebp, 0x9908b0df
mov r9, qword [rbx]
mov r8d, dword [r9]
cmp r8d, 0x270
jne 0x140028da4
lea r8, [r9 + 8]
mov r10d, 0x270
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
and edx, esi
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140028d69
mov r8d, dword [r9]
jmp 0x140028e72
cmp r8d, 0x4e0
jb 0x140028e72
lea r10, [r9 + 0x9c4]
mov r11d, 0xe3
mov eax, dword [r10]
lea r8, [r10 + 4]
mov edx, dword [r8]
xor edx, eax
and edx, esi
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x140028dc1
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov eax, dword [r10]
mov edx, eax
lea r8, [r10 + 4]
xor edx, dword [r8]
and edx, esi
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r10 - 0xd4c]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x140028e06
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 4]
and edx, esi
xor edx, dword [r9 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, ebp
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
and dword [r9], 0
xor r8d, r8d
mov eax, r8d
mov edx, dword [r9 + rax*4 + 4]
mov ecx, edx
shr ecx, 0xb
lea eax, [r8 + 1]
mov dword [r9], eax
mov eax, dword [r9 + 0x1384]
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
cmp rax, qword [rbx + 0x10]
ja 0x140028d50
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
ret
Function at 0x140029a48
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
test r8d, r8d
jle 0x140029c79
mov rax, rsp
mov qword [rax + 8], rbx
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x68]
sub rsp, 0x130
xor r10d, r10d
lea r11, [rsp]
sub r11, rcx
lea rbx, [rcx + 0x88]
mov qword [rsp + 0x20], r11
mov r14, rdx
mov qword [rbp + 0x88], rbx
mov eax, r10d
lea rdi, [rsp + 0x30]
shl eax, 6
movsxd r8, eax
add r8, r14
xor r9d, r9d
mov eax, r9d
inc r9d
shl eax, 2
movsxd rcx, eax
movzx eax, byte [r8 + rcx + 1]
movzx edx, byte [rcx + r8]
shl edx, 8
or edx, eax
movzx eax, byte [r8 + rcx + 2]
shl edx, 8
or edx, eax
movzx eax, byte [r8 + rcx + 3]
shl edx, 8
or edx, eax
mov dword [rdi], edx
lea rdi, [rdi + 4]
cmp r9d, 0x10
jl 0x140029aaa
lea r9, [rsp + 0x68]
mov edi, Ordinal_50
mov ecx, dword [r9 - 0x34]
mov r8d, ecx
mov edx, dword [r9]
mov eax, ecx
rol r8d, 0xe
lea r9, [r9 + 4]
shr ecx, 3
ror eax, 7
xor r8d, eax
mov eax, edx
xor r8d, ecx
rol eax, 0xd
mov ecx, edx
shr edx, 0xa
rol ecx, 0xf
xor ecx, eax
xor ecx, edx
add r8d, ecx
add r8d, dword [r9 - 0x3c]
add r8d, dword [r9 - 0x18]
mov dword [r9 + 4], r8d
sub rdi, 1
jne 0x140029af2
movups xmm0, xmmword [rbx]
xor r15d, r15d
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp], xmm0
mov r12d, dword [rsp + 8]
mov r13d, dword [rsp + 4]
mov edi, dword [rsp]
mov ebx, dword [rsp + 0xc]
movups xmmword [rsp + 0x10], xmm1
mov r9d, dword [rsp + 0x10]
mov esi, dword [rsp + 0x18]
mov r14d, dword [rsp + 0x14]
mov r11d, dword [rsp + 0x1c]
mov eax, r9d
mov r8d, r9d
rol eax, 7
mov ecx, r9d
ror r8d, 0xb
not ecx
xor r8d, eax
and ecx, esi
mov eax, r9d
mov edx, edi
ror eax, 6
xor r8d, eax
ror edx, 0xd
mov eax, r14d
and eax, r9d
xor ecx, eax
lea rax, [0x14009ffd0]
add r8d, ecx
mov ecx, r13d
add r8d, dword [r15 + rax]
xor ecx, r12d
add r8d, dword [rsp + r15 + 0x30]
and ecx, edi
add r8d, r11d
mov eax, edi
rol eax, 0xa
mov r11d, esi
xor edx, eax
mov esi, r14d
mov eax, edi
mov r14d, r9d
ror eax, 2
lea r9d, [rbx + r8]
xor edx, eax
mov ebx, r12d
mov eax, r13d
add r15, 4
and eax, r12d
mov r12d, r13d
xor ecx, eax
mov r13d, edi
add edx, ecx
lea edi, [rdx + r8]
cmp r15, 0x100
jl 0x140029b6f
mov dword [rsp + 0xc], ebx
mov edx, 8
mov rbx, qword [rbp + 0x88]
mov dword [rsp + 0x18], esi
mov rcx, rbx
mov esi, dword [rbp + 0x80]
mov dword [rsp + 0x14], r14d
mov r14, qword [rbp + 0x78]
mov dword [rsp + 0x1c], r11d
mov r11, qword [rsp + 0x20]
mov dword [rsp + 0x10], r9d
mov dword [rsp], edi
mov dword [rsp + 8], r12d
mov dword [rsp + 4], r13d
mov eax, dword [r11 + rcx - 0x88]
add dword [rcx], eax
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x140029c3f
inc r10d
cmp r10d, esi
jl 0x140029a96
mov rbx, qword [rsp + 0x170]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140042ba0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x140042bca
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.LoadLibraryExA
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x1400a13bc]
mov rcx, rbx
mov r14, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
test rax, rax
je 0x140042c2e
mov rcx, rbx
test r14, r14
je 0x140042c18
xor edx, edx
lea r8d, [rdx + 8]
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test r14, r14
je 0x140042c66
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140042c66
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x140042d28
mov qword [rsp + 0x40], rsi
mov rsi, 0xffffffffffffffff
mov rdx, rsi
nop
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x140042c90
lea ecx, [rax + 1]
add rcx, rdx
call qword [section..data]
mov rdi, rax
test rax, rax
je 0x140042d1a
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x140042d1a
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x140042cc0
mov ecx, 0x5c
mov word [rax + rdi], cx
inc rsi
cmp byte [rdi + rsi], bpl
jne 0x140042cd4
mov rcx, rdi
sub rcx, rbx
add rcx, rsi
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x140042cf0
mov rcx, rdi
test r14, r14
je 0x140042d11
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x140042d17
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [fcn.140086522]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret