joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140034a50
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
cmp r8d, 0x10
jbe 0x140034a72
lea rcx, str.Alignment___16_is_not_supported_n
call sub.KERNEL32.dll_OutputDebugStringW
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsi + 0x30], eax
je 0x140034a91
call fcn.1400dbd80
jmp 0x140034bc5
xor ebp, ebp
lea r10, [0x14036c828]
mov edx, ebp
nop dword [rax]
movsxd rax, edx
imul rax, rax, 0x4020
add rax, r10
mov r9d, dword [rax]
mov r8d, dword [rax + 0x4018]
cmp r9d, r8d
jae 0x140034ac6
mov ecx, dword [rax + 0x10]
sub ecx, 0x10
cmp edi, ecx
jbe 0x140034b28
inc edx
cmp edx, 0xe
jb 0x140034aa0
mov eax, dword [rsi + 0x40]
lea ecx, [rdi + 0x10]
add eax, 0xf
mov r8d, 0x200000
and eax, 0xfffffff0
mov edx, edi
add ecx, eax
mov dword [rsi + 0x40], eax
cmp ecx, r8d
ja 0x140034ba3
mov rbx, qword [rsi + 0x38]
mov dword [rsi + 0x40], ecx
mov ecx, eax
add rbx, rcx
mov eax, edi
mov qword [rbx], rax
mov rax, qword [rsi + 0x38]
add rax, 0x10
add rcx, rax
mov qword [rbx + 8], rcx
lea rcx, str.Malloc_Size_d_LargeMemoryPoolOffset_d__n
mov r8d, dword [rsi + 0x40]
call fcn.1400348c0
mov rax, qword [rbx + 8]
jmp 0x140034bc7
mov edx, ebp
test r8d, r8d
je 0x140034b43
nop
mov ecx, edx
mov rbx, qword [rax + rcx*8 + 0x18]
cmp qword [rbx], rbp
je 0x140034b69
inc edx
cmp edx, r8d
jb 0x140034b30
mov edx, edi
lea rcx, str.AllocateFromPool_run_out_of_memory_allocating__u_bytes_for__u_allocations_n
call fcn.1400348c0
lea rcx, str.Please_increase_MaxNumAllocations_for_that_pool__exiting..._n
call sub.KERNEL32.dll_OutputDebugStringW
mov cl, 1
call fcn.1400db0a0
mov rax, rbp
jmp 0x140034bc7
cmp dword [rax + 4], edx
mov r8d, edi
cmovae edx, dword [rax + 4]
inc dword [rax + 0xc]
mov dword [rax + 4], edx
lea edx, [r9 + 1]
cmp dword [rax + 8], edx
mov dword [rax], edx
cmovae edx, dword [rax + 8]
mov dword [rax + 8], edx
mov edx, 0xfe
mov rcx, qword [rbx + 8]
mov qword [rbx], r8
call sub.VCRUNTIME140.dll_memset
mov rbp, qword [rbx + 8]
mov rax, rbp
jmp 0x140034bc7
sub r8d, eax
lea rcx, str.MallocCrash_run_out_of_memory_allocating__u_bytes__free__u_bytes_n
call fcn.1400348c0
lea rcx, str.Please_increase_LARGE_MEMORYPOOL_SIZE__exiting..._n
call sub.KERNEL32.dll_OutputDebugStringW
mov cl, 1
call fcn.1400db0a0
xor eax, eax
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140042409
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp edx, 2
jl 0x1400425f7
mov r11, rsp
push rbx
push rdi
sub rsp, 0x368
mov rax, qword [0x14035e6e8]
xor rax, rsp
mov qword [rsp + 0x340], rax
mov qword [rsp + 0x40], rcx
mov rbx, r9
mov qword [r11 - 0x18], rbp
dec rcx
movd xmm0, edx
movzx edi, r8b
movsxd rax, edx
add rcx, rax
mov qword [r11 - 0x20], rsi
cvtdq2ps xmm0, xmm0
mov qword [r11 - 0x28], r14
mov qword [rsp + 0x48], rcx
call sub.api_ms_win_crt_math_l1_1_0.dll_logf
addss xmm0, xmm0
xor edx, edx
mov r8d, 0x2e8
lea rcx, [rsp + 0x58]
cvttss2si rax, xmm0
mov dword [rsp + 0x50], eax
call sub.VCRUNTIME140.dll_memset
lea rsi, [rsp + 0x40]
nop dword [rax]
movups xmm2, xmmword [rsi]
movsd xmm0, qword [rsi + 0x10]
movdqa xmm1, xmm2
movd ebp, xmm2
psrldq xmm1, 8
movd r14d, xmm1
movsd qword [rsp + 0x30], xmm0
mov r11d, dword [rsp + 0x30]
mov edx, r14d
sub edx, ebp
inc edx
movups xmmword [rsp + 0x20], xmm2
mov r10, qword [rsp + 0x20]
test r11d, r11d
je 0x1400425a5
mov r9, qword [rsp + 0x28]
cmp edx, 8
jle 0x1400425f8
mov eax, edx
lea r8, [r9 + 1]
cdq
sub eax, edx
sar eax, 1
movsxd rdx, eax
movzx eax, byte [r10]
movzx ecx, byte [rdx + r10]
mov byte [rdx + r10], al
mov rdx, r10
mov byte [r10], cl
nop
inc rdx
cmp rdx, r9
ja 0x140042500
movzx eax, byte [rdx]
cmp byte [r10], al
jae 0x1400424f0
movzx ecx, byte [r8 - 1]
dec r8
cmp r8, r10
jbe 0x140042512
cmp cl, byte [r10]
jae 0x140042500
cmp rdx, r8
ja 0x140042521
movzx eax, byte [rdx]
mov byte [rdx], cl
mov byte [r8], al
jmp 0x1400424f0
movzx eax, byte [r10]
dec r11d
mov byte [r10], cl
mov rcx, r8
mov byte [r8], al
sub rcx, r10
mov rax, r9
sub rax, rdx
cmp rcx, rax
jle 0x14004256c
lea rax, [r10 + 1]
cmp rax, r8
jae 0x14004255b
lea rax, [r8 - 1]
mov qword [rsi], r10
mov qword [rsi + 8], rax
mov dword [rsi + 0x10], r11d
add rsi, 0x18
cmp r9, rdx
jbe 0x1400425b4
mov r10, rdx
mov qword [rsp + 0x20], rdx
mov ebp, edx
jmp 0x140042595
cmp r9, rdx
jbe 0x140042580
mov qword [rsi], rdx
mov qword [rsi + 8], r9
mov dword [rsi + 0x10], r11d
add rsi, 0x18
lea rax, [r10 + 1]
cmp rax, r8
jae 0x1400425b4
lea r9, [r8 - 1]
mov qword [rsp + 0x28], r9
mov r14d, r9d
mov edx, r14d
sub edx, ebp
inc edx
test r11d, r11d
jne 0x1400424c4
mov r9, rbx
movzx r8d, dil
mov rcx, r10
call fcn.140041f20
sub rsi, 0x18
lea rax, [rsp + 0x40]
cmp rsi, rax
jae 0x140042480
mov r14, qword [rsp + 0x350]
mov rsi, qword [rsp + 0x358]
mov rbp, qword [rsp + 0x360]
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.140250070
add rsp, 0x368
pop rdi
pop rbx
ret
cmp r9, r10
jbe 0x1400425b4
lea r8, [r10 + 1]
mov rdx, r10
mov rcx, r8
cmp r8, r9
ja 0x140042621
nop dword [rax]
movzx eax, byte [rcx]
cmp byte [rdx], al
cmovb rdx, rcx
inc rcx
cmp rcx, r9
jbe 0x140042610
movzx eax, byte [r9]
movzx ecx, byte [rdx]
mov byte [rdx], al
mov byte [r9], cl
dec r9
cmp r9, r10
ja 0x140042601
jmp 0x1400425b4
Function at 0x140042640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r12
push r14
sub rsp, 0x38
mov r14, rdx
mov r12, rcx
movsxd rdx, dword [rcx + 8]
test edx, edx
jne 0x140042661
xor eax, eax
add rsp, 0x38
pop r14
pop r12
ret
mov rax, qword [rcx]
xor r8d, r8d
mov qword [rsp + 0x58], rbx
movabs r9, 0x10ffffffc0ffe5
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
movzx ecx, word [rax]
mov qword [rsp + 0x30], rdi
mov edi, r8d
mov qword [rsp + 0x28], r13
mov r13d, r8d
mov qword [rsp + 0x20], r15
test cx, cx
je 0x1400426ad
cmp cx, 0x2f
jne 0x140042771
mov rax, qword [r14]
mov dword [rax], r8d
mov bpl, 1
mov r15, rdx
mov rbx, r8
nop word [rax + rax]
movsxd rdx, edi
inc rbx
inc edi
cmp rbx, r15
jge 0x1400426fe
nop dword [rax]
mov rax, qword [r12]
movzx eax, word [rax + rbx*2]
test ax, ax
je 0x1400426ed
cmp ax, 0x2f
jne 0x1400427a3
mov rax, qword [r14]
mov dword [rax], r8d
mov al, 1
cmp bpl, al
jne 0x1400426fe
inc edi
inc rbx
cmp rbx, r15
jl 0x1400426d0
mov esi, edi
sub esi, edx
test bpl, bpl
je 0x140042736
cmp r13d, edx
je 0x140042733
mov rcx, qword [r12]
movsxd rax, r13d
movsxd r8, esi
add r8, r8
lea rdx, [rcx + rdx*2]
lea rcx, [rcx + rax*2]
call fcn.140251fd4
xor r8d, r8d
movabs r9, 0x10ffffffc0ffe5
add r13d, esi
xor bpl, 1
cmp rbx, r15
jl 0x1400426c0
mov rdi, qword [rsp + 0x30]
mov eax, r15d
mov r15, qword [rsp + 0x20]
sub eax, r13d
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x58]
mov dword [r12 + 8], r13d
mov r13, qword [rsp + 0x28]
add rsp, 0x38
pop r14
pop r12
ret
lea eax, [rcx - 0x2b]
cmp ax, 0x34
ja 0x140042783
movzx eax, ax
bt r9, rax
jb 0x14004278d
sub cx, 0x61
cmp cx, 0x19
ja 0x14004279b
mov rax, qword [r14]
inc dword [rax]
cmp dword [rax], 0xe
jle 0x1400426ad
xor bpl, bpl
jmp 0x1400426b0
lea ecx, [rax - 0x2b]
cmp cx, 0x34
ja 0x1400427b5
movzx ecx, cx
bt r9, rcx
jb 0x1400427bf
sub ax, 0x61
cmp ax, 0x19
ja 0x1400427cd
mov rax, qword [r14]
inc dword [rax]
cmp dword [rax], 0xe
jle 0x1400426ed
xor al, al
jmp 0x1400426ef

Function at 0x140042d10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
movzx eax, word [rcx]
lea r10, [rcx + 2]
not edx
test ax, ax
je 0x140042d89
lea r11, [0x14034e790]
nop word [rax + rax]
movzx r9d, ax
lea r10, [r10 + 2]
mov eax, edx
shr edx, 8
xor rax, r9
shr r9, 8
movzx ecx, al
mov r8d, dword [r11 + rcx*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor r9, rax
movzx eax, r9b
mov edx, dword [r11 + rax*4]
movzx eax, word [r10 - 2]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [r11 + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r11 + rcx*4]
xor edx, r8d
test ax, ax
jne 0x140042d30
not edx
mov eax, edx
ret
Function at 0x140043bc0
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rax, [0x140275180]
mov qword [rcx + 8], rdx
mov qword [rcx], rax
mov rdi, rcx
mov byte [rcx + 0x10], 0
add rcx, 0x18
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, 0xfa0
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
lea rcx, [rdi + 0x48]
call qword [sym.imp.KERNEL32.dll_InitializeSRWLock]
xor eax, eax
mov dword [rdi + 0x7c], 0x80
mov qword [rdi + 0x50], rax
mov qword [rdi + 0x58], rax
mov qword [rdi + 0x70], rax
mov dword [rdi + 0x78], eax
mov dword [rdi + 0x84], eax
mov qword [rdi + 0x90], rax
mov dword [rdi + 0x98], eax
mov qword [rdi + 0xa0], rax
mov qword [rdi + 0xa8], rax
mov dword [rdi + 0x80], 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
mov dword [rdi + 0x40], eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x14004e100
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
cmp dword [rdx], 0xffffffff
mov rdi, rdx
mov rbx, rcx
jne 0x14004e131
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
mov eax, 0xffffffff
lock cmpxchg dword [rdi], ecx
cmp eax, 0xffffffff
je 0x14004e131
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov ecx, dword [rdi]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14004e19e
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x38], rsi
call qword [rbx]
mov ecx, dword [0x1403aa4e4]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14004e18b
lea rbx, [rax + 0x30]
mov qword [rsp + 0x30], rbp
movsxd rbp, dword [rbx + 8]
lea ecx, [rbp + 1]
mov dword [rbx + 8], ecx
cmp ecx, dword [rbx + 0xc]
jle 0x14004e17f
mov edx, ebp
mov rcx, rbx
call fcn.14005a3a0
mov rax, qword [rbx]
mov qword [rax + rbp*8], rsi
mov rbp, qword [rsp + 0x30]
mov ecx, dword [rdi]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14005b650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
push r13
sub rsp, 0x48
movsxd rdi, dword [rdx + 8]
mov r13, rcx
cmp edi, 1
jg 0x14005b674
call fcn.14001e210
mov rax, r13
add rsp, 0x48
pop r13
pop rdi
ret
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x20]
mov rbx, qword [rdx]
xor r8d, r8d
mov qword [rsp + 0x40], r12
mov edx, edi
xor r12d, r12d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x28], edi
call fcn.14001c210
mov r15, qword [rsp + 0x20]
mov r8, rdi
add r8, r8
mov rdx, rbx
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
movsxd rdx, dword [rsp + 0x28]
test edx, edx
je 0x14005b7ab
movzx ecx, word [r15]
mov edi, r12d
mov qword [rsp + 0x68], rbp
movabs r8, 0x43ffffff95ffb
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x38], r14
test cx, cx
je 0x14005b70a
lea eax, [rcx - 0x2d]
cmp ax, 0x32
ja 0x14005b6fb
movzx eax, ax
bt r8, rax
jb 0x14005b70a
sub cx, 0x61
cmp cx, 0x19
jbe 0x14005b70a
xor bpl, bpl
jmp 0x14005b70d
mov bpl, 1
mov r14, rdx
mov rbx, r12
movsxd rdx, edi
inc rbx
inc edi
cmp rbx, r14
jge 0x14005b75b
movzx eax, word [r15 + rbx*2]
test ax, ax
je 0x14005b74a
lea ecx, [rax - 0x2d]
cmp cx, 0x32
ja 0x14005b73c
movzx ecx, cx
bt r8, rcx
jb 0x14005b74a
sub ax, 0x61
cmp ax, 0x19
jbe 0x14005b74a
xor al, al
jmp 0x14005b74c
mov al, 1
cmp bpl, al
jne 0x14005b75b
inc edi
inc rbx
cmp rbx, r14
jl 0x14005b720
mov esi, edi
sub esi, edx
test bpl, bpl
je 0x14005b78c
cmp r12d, edx
je 0x14005b789
movsxd rax, r12d
lea rdx, [r15 + rdx*2]
movsxd r8, esi
add r8, r8
lea rcx, [r15 + rax*2]
call fcn.140251fd4
movabs r8, 0x43ffffff95ffb
add r12d, esi
xor bpl, 1
cmp rbx, r14
jl 0x14005b713
mov r14, qword [rsp + 0x38]
mov edx, r12d
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov eax, dword [rsp + 0x2c]
mov r12, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
mov qword [r13], r15
mov r15, qword [rsp + 0x30]
mov dword [r13 + 0xc], eax
mov rax, r13
mov dword [r13 + 8], edx
add rsp, 0x48
pop r13
pop rdi
ret
Function at 0x14008ced0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1403acdfc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14008cf22
lea ecx, [rax + 0x10]
mov qword [rsp + 0x20], rbx
call fcn.140012750
mov rbx, rax
test rax, rax
je 0x14008cf08
mov byte [rax], 5
xor eax, eax
mov qword [rbx + 4], rax
mov dword [rbx + 0xc], eax
jmp 0x14008cf0b
mov rbx, rax
mov ecx, dword [0x1403acdfc]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rbx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x14008f4d0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push rbx
mov rbx, r8
mov r10d, edx
mov r9, rcx
test edx, edx
je 0x14008f4f3
nop
lea ecx, [r10 - 1]
cmp word [r9 + rcx*2], 0x3d
jne 0x14008f4f3
mov r10d, ecx
test ecx, ecx
jne 0x14008f4e0
mov eax, r10d
mov qword [rsp + 0x10], rsi
and al, 3
mov qword [rsp + 0x18], rdi
cmp al, 1
je 0x14008f5d9
xor edx, edx
lea rsi, [0x140279a60]
mov edi, 0x100
cmp r10d, 4
jb 0x14008f570
nop
mov eax, edx
mov r11d, edx
movzx ecx, word [r9]
add r9, 2
cmp cx, di
jae 0x14008f5d9
movzx r8d, byte [rcx + rsi]
cmp r8b, 0xff
je 0x14008f5d9
shl eax, 6
inc r11d
or eax, r8d
cmp r11d, 4
jl 0x14008f525
mov byte [rbx + 2], al
add r10d, 0xfffffffc
shr eax, 8
mov byte [rbx + 1], al
shr eax, 8
mov byte [rbx], al
add rbx, 3
cmp r10d, 4
jae 0x14008f520
test r10d, r10d
je 0x14008f5cb
mov r8d, edx
nop dword [rax + rax]
movzx eax, word [r9]
lea r9, [r9 + 2]
cmp ax, di
jae 0x14008f5d9
movzx ecx, byte [rax + rsi]
cmp cl, 0xff
je 0x14008f5d9
shl edx, 6
inc r8d
or edx, ecx
cmp r8d, r10d
jb 0x14008f580
cmp r10d, 4
jge 0x14008f5ba
mov ecx, 4
sub ecx, r10d
shl edx, 6
sub rcx, 1
jne 0x14008f5b1
shr edx, 8
cmp r10d, 3
jb 0x14008f5c6
mov byte [rbx + 1], dl
shr edx, 8
mov byte [rbx], dl
mov al, 1
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x10]
pop rbx
ret
mov rdi, qword [rsp + 0x18]
xor al, al
mov rsi, qword [rsp + 0x10]
pop rbx
ret
Function at 0x14008ff50
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
lea rsi, [0x140279a20]
mov rbx, r8
mov r11d, edx
mov r10, rcx
mov r9, r8
cmp edx, 3
jb 0x14008fffa
mov eax, 0xaaaaaaab
mov qword [rsp + 0x10], rdi
mul r11d
shr edx, 1
mov edi, edx
movzx ecx, byte [r10 + 1]
add r11d, 0xfffffffd
movzx r8d, byte [r10]
movzx edx, byte [r10 + 2]
add r10, 3
shl r8d, 8
or r8d, ecx
shl r8d, 8
or r8d, edx
mov eax, r8d
shr r8d, 6
and eax, 0x3f
mov ecx, r8d
shr rcx, 6
movzx eax, byte [rax + rsi]
mov word [r9 + 6], ax
mov eax, r8d
and eax, 0x3f
movzx eax, byte [rax + rsi]
mov word [r9 + 4], ax
mov rax, rcx
and eax, 0x3f
shr rcx, 6
movzx eax, byte [rax + rsi]
mov word [r9 + 2], ax
movzx eax, byte [rcx + rsi]
mov word [r9], ax
add r9, 8
sub rdi, 1
jne 0x14008ff83
mov rdi, qword [rsp + 0x10]
test r11d, r11d
je 0x140090063
movzx ecx, byte [r10]
xor al, al
cmp r11d, 2
jne 0x140090010
movzx eax, byte [r10 + 1]
shl ecx, 8
mov r8d, 0x3d
movzx eax, al
or ecx, eax
mov word [r9 + 6], r8w
shl ecx, 8
shr ecx, 6
mov edx, ecx
cmp r11d, 1
je 0x14009003b
mov eax, ecx
and eax, 0x3f
movzx r8d, byte [rax + rsi]
mov word [r9 + 4], r8w
shr rdx, 6
mov rax, rdx
shr rdx, 6
and eax, 0x3f
movzx eax, byte [rax + rsi]
mov word [r9 + 2], ax
movzx eax, byte [rdx + rsi]
mov word [r9], ax
add r9, 8
xor eax, eax
mov word [r9], ax
sub r9, rbx
mov rbx, qword [rsp + 0x18]
sar r9, 1
mov eax, r9d
pop rsi
ret
Function at 0x140092110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push r14
sub rsp, 0x58
mov r14, rdx
mov rsi, rcx
cmp rcx, rdx
je 0x1400922ff
mov qword [rsp + 0x50], rbx
mov r9d, 4
mov qword [rsp + 0x48], rbp
lea rbx, [rcx + 0x38]
mov qword [rsp + 0x40], rdi
mov rcx, rbx
movsxd rdi, dword [rdx + 0x48]
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x28], r15
call fcn.14001c0d0
mov rax, qword [r14 + 0x40]
lea rdx, [r14 + 0x38]
mov r9, qword [rbx + 8]
mov r8, rdi
shl r8, 2
test rax, rax
cmovne rdx, rax
test r9, r9
cmovne rbx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov dword [rsi + 0x48], edi
mov rcx, rsi
movsxd rbx, dword [r14 + 8]
mov edx, ebx
call fcn.1400707c0
mov edx, dword [rsi + 8]
lea eax, [rdx + rbx]
mov dword [rsi + 8], eax
cmp eax, dword [rsi + 0xc]
jle 0x1400921aa
mov rcx, rsi
call fcn.140082f30
mov eax, dword [r14 + 0x30]
lea r15, [r14 + 0x10]
lea rcx, [rsi + 0x10]
mov dword [rsi + 0x30], eax
mov eax, dword [r14 + 0x34]
mov dword [rsi + 0x34], eax
cmp rcx, r15
je 0x1400921cd
mov rdx, r15
call fcn.140023880
mov rax, qword [r14]
xor ebp, ebp
mov rcx, qword [rsi]
mov r14, rbx
test ebx, ebx
jle 0x1400922fa
sub rax, rcx
mov qword [rsp + 0x38], r12
lea rbx, [rcx + 0x1c]
mov qword [rsp + 0x30], r13
lea edi, [rbp + 1]
lea rcx, [rax - 0xc]
mov qword [rsp + 0x78], rcx
lea r12, [rax - 0x18]
mov rsi, qword [rsp + 0x78]
lea rcx, [rax + 0x44]
mov qword [rsp + 0x80], rcx
lea r13, [rax - 0x1c]
lea rcx, [rax + 0x48]
mov qword [rsp + 0x88], rcx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r15 + 0x10]
lea rdx, [rbx + r13]
test rax, rax
lea rcx, [rbx - 0x1c]
mov r8, r15
cmovne r8, rax
mov eax, ebp
test ebp, ebp
jns 0x14009224f
lea eax, [rbp + 0x1f]
sar eax, 5
cdqe
test dword [r8 + rax*4], edi
je 0x1400922b2
call fcn.14001e210
xor eax, eax
mov dword [rbx + 0x20], 0x80
lea rcx, [rbx - 0xc]
mov qword [rbx - 4], rax
lea rdx, [rsi + rbx]
mov qword [rcx], rax
mov qword [rbx + 0x14], rax
mov dword [rbx + 0x1c], eax
mov dword [rbx + 0x28], eax
mov qword [rbx + 0x34], rax
mov dword [rbx + 0x3c], eax
mov dword [rbx + 0x24], 0xffffffff
call fcn.1400264e0
mov rcx, qword [rsp + 0x80]
mov eax, dword [rcx + rbx]
mov dword [rbx + 0x44], eax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + rbx]
mov dword [rbx + 0x48], eax
jmp 0x1400922bd
mov eax, dword [rdx]
mov dword [rcx], eax
mov eax, dword [rbx + r12]
mov dword [rbx - 0x18], eax
inc ebp
rol edi, 1
add rbx, 0x68
sub r14, 1
jne 0x140092230
mov rax, qword [rsp + 0x70]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x28]
add rsp, 0x58
pop r14
pop rsi
ret
mov rax, rsi
jmp 0x1400922de
mov rax, rsi
add rsp, 0x58
pop r14
pop rsi
ret
Function at 0x1400a0af0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
lea r9d, [rcx + 3]
mov ebx, edx
and r9d, 0xfffffffc
lea rsi, [0x14034e790]
sub r9d, ecx
mov r11, rcx
not r8d
cmp edx, r9d
jle 0x1400a0c07
sub ebx, r9d
mov qword [rsp + 0x10], rdi
test r9d, r9d
je 0x1400a0b51
nop word [rax + rax]
movzx eax, byte [r11]
inc r11
movzx ecx, r8b
xor rcx, rax
mov eax, r8d
shr eax, 8
mov r8d, dword [rsi + rcx*4]
xor r8d, eax
sub r9d, 1
jne 0x1400a0b30
mov eax, ebx
cdq
and edx, 7
add eax, edx
mov edi, eax
and eax, 7
sub eax, edx
sar edi, 3
mov ebx, eax
test edi, edi
je 0x1400a0c02
nop dword [rax]
mov r10d, dword [r11 + 4]
mov ecx, dword [r11]
add r11, 8
xor ecx, r8d
mov r9d, ecx
mov eax, ecx
shr rax, 0x10
movzx edx, al
mov eax, ecx
shr rax, 8
movzx ecx, al
mov eax, r10d
mov r8d, dword [rsi + rdx*4 + 0x1400]
shr rax, 0x10
xor r8d, dword [rsi + rcx*4 + 0x1800]
movzx ecx, al
mov eax, r10d
shr rax, 8
xor r8d, dword [rsi + rcx*4 + 0x400]
movzx ecx, al
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rsi + rcx*4 + 0x800]
xor r8d, dword [rsi + rax*4 + 0x1000]
mov eax, r10d
shr rax, 0x18
xor r8d, dword [rsi + rax*4]
movzx eax, r9b
xor r8d, dword [rsi + rax*4 + 0x1c00]
movzx eax, r10b
xor r8d, dword [rsi + rax*4 + 0xc00]
add edi, 0xffffffff
jne 0x1400a0b70
mov rdi, qword [rsp + 0x10]
test ebx, ebx
je 0x1400a0c31
nop dword [rax + rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
movzx ecx, r8b
xor rcx, rax
mov eax, r8d
shr eax, 8
mov r8d, dword [rsi + rcx*4]
xor r8d, eax
sub ebx, 1
jne 0x1400a0c10
mov rbx, qword [rsp + 0x18]
not r8d
mov eax, r8d
pop rsi
ret
Function at 0x1400ab760
Capabilities:
Hash data using sha1

Disassembly:
mov dword [rcx], 0x67452301
mov rax, rcx
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
mov qword [rcx + 0x18], 0
ret

Function at 0x1400abdc0
Capabilities:
Hash data using sha1

Disassembly:
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
mov qword [rcx + 0x18], 0
ret

Function at 0x1400b2480
Capabilities:
Hash data using sha1

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x14035e6e8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x20], 0x67452301
mov rsi, r8
mov dword [rsp + 0x24], 0xefcdab89
mov rbx, rdx
mov dword [rsp + 0x28], 0x98badcfe
mov rdi, rcx
mov dword [rsp + 0x2c], 0x10325476
mov dword [rsp + 0x30], 0xc3d2e1f0
mov qword [rsp + 0x38], 0
test rdx, rdx
je 0x1400b2514
mov qword [rsp + 0x38], rdx
cmp rdx, 0x40
jb 0x1400b2504
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400ba7f0
mov rax, rbx
and rax, 0xffffffffffffffc0
add rdi, rax
and ebx, 0x3f
mov r8, rbx
lea rcx, [rsp + 0x44]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x20]
call fcn.1400af8e0
movups xmm0, xmmword [rsp + 0x84]
mov eax, dword [rsp + 0x94]
movups xmmword [rsi], xmm0
mov dword [rsi + 0x10], eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140250070
add rsp, 0xc0
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400c8700
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov rdi, rcx
mov qword [rcx + 8], r15
mov dword [rcx], r15d
mov dword [rcx + 0x10], r15d
mov qword [rcx + 0x18], r15
mov qword [rcx + 0x20], r15
mov qword [rcx + 0x40], r15
mov dword [rcx + 0x58], r15d
mov dword [rcx + 0x9470], r15d
mov qword [rcx + 0x28], r15
mov dword [rcx + 0x30], r15d
mov qword [rcx + 0x38], r15
mov qword [rcx + 0x48], r15
mov qword [rcx + 0x50], r15
add rcx, 0xb4b0
call fcn.140025400
xor r9d, r9d
mov qword [rdi + 0xb520], r15
xor r8d, r8d
lea edx, [r15 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
lea edx, [r15 + 1]
xor r8d, r8d
mov qword [rdi + 0x18], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea rcx, [0x1400d1990]
mov qword [rdi + 0x20], rax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov r9, rdi
mov qword [rsp + 0x28], rdi
lea r8, [0x1400cd290]
mov dword [rsp + 0x20], r15d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rdi + 8], rax
test rax, rax
je 0x1400c87d4
lea edx, [r15 - 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp qword [rdi + 0x40], r15
je 0x1400c87e3
mov eax, dword [rdi + 0x58]
mov dword [0x14036bfa4], eax
call fcn.14009d840
xor r8d, r8d
xor ecx, ecx
mov rbp, rax
lea edx, [r8 + 0x30]
call fcn.140058210
mov rbx, rax
mov r14d, 3
test rax, rax
je 0x1400c8833
lea rax, [0x140264f08]
mov qword [rbx], rax
call fcn.140023080
mov qword [rbx + 0x10], rax
lea rax, [0x140269b98]
mov qword [rbx], rax
lea rax, [0x1400cec80]
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x18], rdi
mov rsi, rbx
test rbx, rbx
je 0x1400c8887
mov dl, 1
mov rcx, rbp
call fcn.140014a50
mov rax, qword [rbx]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [rax + 0x38]
movsxd rsi, dword [rbp + 8]
lea eax, [rsi + 1]
mov dword [rbp + 8], eax
cmp eax, dword [rbp + 0xc]
jle 0x1400c886c
mov edx, esi
mov rcx, rbp
call fcn.14001c290
mov rax, rsi
mov rsi, r15
shl rax, 4
add rax, qword [rbp]
mov qword [rax], rbx
mov rbx, r15
mov dword [rax + 8], r14d
mov r14d, r15d
test r14d, r14d
mov rcx, rsi
cmove rcx, r15
test rcx, rcx
je 0x1400c88a7
mov rax, qword [rcx]
xor edx, edx
call qword [rax]
test rsi, rsi
je 0x1400c88cb
mov rcx, rsi
jmp 0x1400c88be
test r14d, r14d
je 0x1400c88cb
test rbx, rbx
je 0x1400c88d8
mov rax, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [rax]
mov rcx, rbx
xor r8d, r8d
xor edx, edx
call fcn.140058210
mov rbx, rax
test rbx, rbx
je 0x1400c88d8
mov rcx, rbx
call fcn.14004dcf0
mov rbx, qword [rsp + 0x58]
mov rax, rdi
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret