joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000bb10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180037028]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18000bb3d
xor eax, eax
jmp 0x18000bca9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x18000bb77
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x18000bb77
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x18000bca9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x18000bc9c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18000bbba
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18000bbe5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18000bca1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18000bc54
sub eax, 1
je 0x18000bc54
cmp eax, 2
jne 0x18000bc9c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x18000bca1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x18000bc82
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x18000bc9c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x18000bca1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18000c7c0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x18000be90
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180037028]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18000bf63
cmp byte [rcx + 0x71], 0
je 0x18000bf63
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18000bf5f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x18000bf24
sub eax, 1
je 0x18000bf28
cmp eax, 2
jne 0x18000bf5f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18000c7c0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x18000bf56
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18000bf5f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18000bf0c
xor al, al
jmp 0x18000bf0c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18000c7c0
add rsp, 0x60
pop rbx
ret
Function at 0x1400030c0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov r15, rcx
call fcn.140003380
test eax, eax
js 0x140003346
and qword [rbp + 0x48], 0
mov rax, qword [0x140008048]
test rax, rax
jne 0x14000319c
mov rdx, qword [0x1400081c0]
test rdx, rdx
jne 0x140003111
mov rdx, qword [0x1400080f8]
mov qword [0x1400081c0], rdx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov r10d, dword [rcx + 0x1c]
mov r8d, dword [rcx + 0x20]
add r10, rdx
mov r11d, dword [rcx + 0x24]
add r8, rdx
mov ebx, dword [rcx + 0x18]
add r11, rdx
xor edx, edx
test ebx, ebx
je 0x140003192
mov ecx, dword [r8]
movabs r9, 0xcbf29ce484222325
add rcx, qword [0x1400081c0]
mov al, byte [rcx]
test al, al
je 0x140003188
inc rcx
movsx rax, al
xor r9, rax
movabs rdi, 0x100000001b3
imul r9, rdi
mov al, byte [rcx]
test al, al
jne 0x140003157
movabs rax, 0x8a0ab57e2bf51c65
cmp r9, rax
je 0x140003357
inc edx
add r8, 4
cmp edx, ebx
jb 0x14000313d
int3
mov qword [0x140008048], rax
call qword [0x140007080]
mov rbx, rax
cmp qword [rax], 0
je 0x140003346
mov rdi, rax
mov r13d, 0x1ff
mov rax, qword [rbx + 8]
test rax, rax
je 0x140003346
mov rsi, qword [rbx]
cqo
and edx, 0xfff
xor r14d, r14d
add rax, rdx
sar rax, 0xc
test rax, rax
jle 0x140003335
mov rax, qword [0x1400080d8]
mov r8, rsi
shr r8, 0xc
lea rcx, [r8 + r8*2]
add rcx, rcx
mov rdx, qword [rax + rcx*8 + 0x28]
movabs rax, 0xffffffffff
and rdx, rax
cmp rdx, r8
jne 0x14000330c
and qword [rbp + 0x50], 0
lea r9, [rbp + 0x48]
mov rax, r15
lea rdx, [rbp + 0x50]
shr rax, 0x27
mov r8d, 8
and rax, r13
lea rcx, [rsi + rax*8]
call fcn.1400041c0
test eax, eax
js 0x14000330c
mov rax, qword [rbp + 0x50]
test al, 1
je 0x14000330c
and qword [rbp + 0x58], 0
lea r9, [rbp + 0x48]
movabs rdx, 0xffffffffff000
mov rcx, r15
shr rcx, 0x1e
and rax, rdx
and rcx, r13
lea rdx, [rbp + 0x58]
mov r8d, 8
lea rcx, [rax + rcx*8]
call fcn.1400041c0
test eax, eax
js 0x14000330c
mov rax, qword [rbp + 0x58]
test al, 1
je 0x14000330c
and qword [rbp - 0x10], 0
lea r9, [rbp + 0x48]
movabs rdx, 0xffffffffff000
mov rcx, r15
shr rcx, 0x15
and rax, rdx
and rcx, r13
lea rdx, [rbp - 0x10]
mov r8d, 8
lea rcx, [rax + rcx*8]
call fcn.1400041c0
test eax, eax
js 0x14000330c
mov rax, qword [rbp - 0x10]
test al, 1
je 0x14000330c
and qword [rbp - 8], 0
lea r9, [rbp + 0x48]
movabs rdx, 0xffffffffff000
mov rcx, r15
shr rcx, 0xc
and rax, rdx
and rcx, r13
lea rdx, [rbp - 8]
mov r8d, 8
lea rcx, [rax + rcx*8]
call fcn.1400041c0
test eax, eax
js 0x14000330c
test byte [rbp - 8], 1
jne 0x14000336c
mov rax, qword [rbx + 8]
inc r14d
cqo
movsxd rcx, r14d
and edx, 0xfff
add rsi, 0x1000
add rax, rdx
sar rax, 0xc
cmp rcx, rax
jl 0x1400031e3
add rdi, 0x10
mov rbx, rdi
cmp qword [rdi], 0
jne 0x1400031b8
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret
movzx ecx, word [r11 + rdx*2]
mov eax, dword [r10 + rcx*4]
add rax, qword [0x1400081c0]
jmp 0x140003195
mov rax, rsi
jmp 0x140003348
Function at 0x140003380
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rcx, qword [0x140008040]
test rcx, rcx
jne 0x140003459
mov rdx, qword [0x1400081c0]
test rdx, rdx
jne 0x1400033b4
mov rdx, qword [0x1400080f8]
mov qword [0x1400081c0], rdx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov r10d, dword [rcx + 0x1c]
mov r8d, dword [rcx + 0x20]
add r10, rdx
mov r11d, dword [rcx + 0x24]
add r8, rdx
mov ebx, dword [rcx + 0x18]
add r11, rdx
xor edx, edx
test ebx, ebx
je 0x140003431
mov ecx, dword [r8]
movabs r9, 0xcbf29ce484222325
add rcx, qword [0x1400081c0]
mov al, byte [rcx]
test al, al
je 0x140003427
inc rcx
movsx rax, al
xor r9, rax
movabs rdi, 0x100000001b3
imul r9, rdi
mov al, byte [rcx]
test al, al
jne 0x1400033fa
movabs rax, 0x7f2823d9ac4595a2
cmp r9, rax
je 0x140003447
inc edx
add r8, 4
cmp edx, ebx
jb 0x1400033e0
int3
mov qword [0x140008040], rcx
test rcx, rcx
jne 0x140003459
mov eax, 0xc000007a
jmp 0x14000348a
movzx ecx, word [r11 + rdx*2]
mov ecx, dword [r10 + rcx*4]
add rcx, qword [0x1400081c0]
jmp 0x140003434
mov r9d, 0x10
lea r8, [0x1400070d0]
call fcn.1400034a0
test rax, rax
jne 0x140003477
mov eax, 0xc0000001
jmp 0x14000348a
mov rax, qword [rax + 0x10]
and rax, 0xfffffffffffff000
mov qword [0x1400080d8], rax
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140003fa0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rax, qword [0x140008028]
mov r14, r9
mov rbx, r8
mov rdi, rdx
movabs r15, 0xcbf29ce484222325
movabs r12, 0x100000001b3
test rax, rax
jne 0x14000407d
mov r9, qword [0x1400081c0]
test r9, r9
jne 0x140004004
mov r9, qword [0x1400080f8]
mov qword [0x1400081c0], r9
movsxd rax, dword [r9 + 0x3c]
xor r8d, r8d
mov edx, dword [rax + r9 + 0x88]
add rdx, r9
mov r11d, dword [rdx + 0x1c]
mov r10d, dword [rdx + 0x20]
add r11, r9
mov esi, dword [rdx + 0x24]
add r10, r9
mov ebp, dword [rdx + 0x18]
add rsi, r9
test ebp, ebp
je 0x140004073
mov edx, dword [r10]
mov r9, r15
add rdx, qword [0x1400081c0]
mov al, byte [rdx]
test al, al
je 0x140004067
inc rdx
movsx rax, al
xor r9, rax
imul r9, r12
mov al, byte [rdx]
test al, al
jne 0x140004044
movabs rax, 0x2be3b7dda50ff6fe
cmp r9, rax
je 0x14000409e
inc r8d
add r10, 4
cmp r8d, ebp
jb 0x140004031
int3
mov qword [0x140008028], rax
mov r8d, 4
mov rdx, rbx
call qword [0x140007080]
mov r10, rax
test rax, rax
jne 0x1400040b0
mov eax, 0xc0000001
jmp 0x14000417c
movzx edx, word [rsi + r8*2]
mov eax, dword [r11 + rdx*4]
add rax, qword [0x1400081c0]
jmp 0x140004076
mov rdx, rbx
mov rcx, r10
test rbx, rbx
je 0x1400040cc
sub rdi, r10
mov al, byte [rdi + rcx]
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1400040be
mov rax, qword [0x140008178]
mov qword [r14], rbx
test rax, rax
jne 0x14000416e
mov rdx, qword [0x1400081c0]
test rdx, rdx
jne 0x1400040f9
mov rdx, qword [0x1400080f8]
mov qword [0x1400081c0], rdx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov r11d, dword [rcx + 0x1c]
mov r8d, dword [rcx + 0x20]
add r11, rdx
mov edi, dword [rcx + 0x24]
add r8, rdx
mov esi, dword [rcx + 0x18]
add rdi, rdx
xor edx, edx
test esi, esi
je 0x140004164
mov ecx, dword [r8]
mov r9, r15
add rcx, qword [0x1400081c0]
mov al, byte [rcx]
test al, al
je 0x14000415a
inc rcx
movsx rax, al
xor r9, rax
imul r9, r12
mov al, byte [rcx]
test al, al
jne 0x140004137
movabs rax, 0x47e1ca0e288956c0
cmp r9, rax
je 0x14000419b
inc edx
add r8, 4
cmp edx, esi
jb 0x140004124
int3
mov qword [0x140008178], rax
mov rdx, rbx
mov rcx, r10
call qword [0x140007080]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
movzx ecx, word [rdi + rdx*2]
mov eax, dword [r11 + rcx*4]
add rax, qword [0x1400081c0]
jmp 0x140004167
Function at 0x1400041c0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rax, qword [0x140008088]
mov rsi, r9
mov rbp, r8
mov r14, rdx
test rax, rax
jne 0x140004295
mov r10, qword [0x1400081c0]
test r10, r10
jne 0x14000420b
mov r10, qword [0x1400080f8]
mov qword [0x1400081c0], r10
movsxd rax, dword [r10 + 0x3c]
xor r8d, r8d
mov edx, dword [rax + r10 + 0x88]
add rdx, r10
mov r11d, dword [rdx + 0x1c]
mov r9d, dword [rdx + 0x20]
add r11, r10
mov ebx, dword [rdx + 0x24]
add r9, r10
mov edi, dword [rdx + 0x18]
add rbx, r10
test edi, edi
je 0x14000428b
mov edx, dword [r9]
movabs r10, 0xcbf29ce484222325
add rdx, qword [0x1400081c0]
mov al, byte [rdx]
test al, al
je 0x14000427f
inc rdx
movsx rax, al
xor r10, rax
movabs r15, 0x100000001b3
imul r10, r15
mov al, byte [rdx]
test al, al
jne 0x140004252
movabs rax, 0x306328ee8e049a39
cmp r10, rax
je 0x1400042c8
inc r8d
add r9, 4
cmp r8d, edi
jb 0x140004238
int3
mov qword [0x140008088], rax
mov rdx, rcx
mov qword [rsp + 0x20], rsi
mov rcx, r14
mov r9d, 1
mov r8, rbp
call qword [0x140007080]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
movzx edx, word [rbx + r8*2]
mov eax, dword [r11 + rdx*4]
add rax, qword [0x1400081c0]
jmp 0x14000428e
Function at 0x140004ac0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
sub rsp, 0x38
cmp byte [0x14000715b], 0
movsd xmm0, qword [str._XTJTZL]
mov eax, dword [str.MF3A]
movsd qword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], eax
je 0x140004b14
xor r8d, r8d
lea r9, [rsp + 0x20]
mov eax, 0x4ec4ec4f
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x34
mov al, r8b
inc r8d
sub al, cl
add al, 0x36
xor byte [r9], al
inc r9
cmp r8d, 0xc
jl 0x140004aed
lea rcx, [rsp + 0x20]
call fcn.140005940
test rax, rax
je 0x140004b59
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x54494e49
mov rcx, rax
mov byte [rsp + 0x44], 0
call fcn.140006240
lea rcx, [rax - 0x30]
lea rax, [rcx - 0x30]
mov qword [0x1400080e0], rcx
test rcx, rcx
mov qword [0x1400080e8], rax
setne al
add rsp, 0x38
ret
Function at 0x1400056b0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, qword [0x140008180]
xor r13d, r13d
mov r15, r8
mov rbp, rdx
mov r14, rcx
movabs rdi, 0xcbf29ce484222325
movabs rsi, 0x100000001b3
test rax, rax
jne 0x140005797
mov r9, qword [0x1400081c0]
test r9, r9
jne 0x14000571a
mov r9, qword [0x1400080f8]
mov qword [0x1400081c0], r9
movsxd rax, dword [r9 + 0x3c]
mov r8d, r13d
mov ecx, dword [rax + r9 + 0x88]
add rcx, r9
mov r10d, dword [rcx + 0x1c]
mov edx, dword [rcx + 0x20]
add r10, r9
mov r11d, dword [rcx + 0x24]
add rdx, r9
mov ebx, dword [rcx + 0x18]
add r11, r9
test ebx, ebx
je 0x14000578c
mov ecx, dword [rdx]
mov r9, rdi
add rcx, qword [0x1400081c0]
mov al, byte [rcx]
test al, al
je 0x140005780
inc rcx
movsx rax, al
xor r9, rax
imul r9, rsi
mov al, byte [rcx]
test al, al
jne 0x140005759
movabs rax, 0x30e36d1e897986ef
cmp r9, rax
je 0x14000590b
inc r8d
add rdx, 4
cmp r8d, ebx
jb 0x140005747
int3
mov qword [0x140008180], rax
xor edx, edx
mov rcx, r14
call qword [0x140007080]
or rdi, 0xffffffffffffffff
mov rsi, rdi
inc rsi
cmp word [rbp + rsi*2], r13w
jne 0x1400057a9
inc rdi
cmp word [r15 + rdi*2], r13w
jne 0x1400057b4
mov rax, qword [0x140008070]
lea rbx, [rdi + rsi]
test rax, rax
jne 0x140005881
mov rdx, qword [0x1400081c0]
test rdx, rdx
jne 0x1400057ec
mov rdx, qword [0x1400080f8]
mov qword [0x1400081c0], rdx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov r10d, dword [rcx + 0x1c]
mov r8d, dword [rcx + 0x20]
add r10, rdx
mov r11d, dword [rcx + 0x24]
add r8, rdx
mov r12d, dword [rcx + 0x18]
add r11, rdx
mov edx, r13d
test r12d, r12d
je 0x140005876
mov ecx, dword [r8]
movabs r9, 0xcbf29ce484222325
add rcx, qword [0x1400081c0]
mov al, byte [rcx]
test al, al
je 0x14000586b
movabs r15, 0x100000001b3
inc rcx
movsx rax, al
xor r9, rax
imul r9, r15
mov al, byte [rcx]
test al, al
jne 0x14000583f
mov r15, qword [rsp + 0x60]
movabs rax, 0x48b8617d81fdd475
cmp r9, rax
je 0x140005923
inc edx
add r8, 4
cmp edx, r12d
jb 0x14000581b
int3
mov qword [0x140008070], rax
lea rdx, [rbx*2 + 2]
xor ecx, ecx
call qword [0x140007080]
mov qword [r14 + 8], rax
mov rcx, rax
test rax, rax
je 0x1400058eb
add bx, bx
mov word [r14], bx
add bx, 2
add rsi, rsi
mov word [r14 + 2], bx
mov rdx, rsi
je 0x1400058c6
mov al, byte [rbp]
inc rbp
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1400058b5
mov rdx, qword [r14 + 8]
lea rcx, [rdi*2 + 2]
add rdx, rsi
test rcx, rcx
je 0x1400058eb
mov al, byte [r15]
inc r15
mov byte [rdx], al
inc rdx
sub rcx, 1
jne 0x1400058da
mov rbx, qword [rsp + 0x50]
mov rax, r14
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, r8d
movzx ecx, word [r11 + rax*2]
mov eax, dword [r10 + rcx*4]
add rax, qword [0x1400081c0]
jmp 0x140005790
mov eax, edx
movzx ecx, word [r11 + rax*2]
mov eax, dword [r10 + rcx*4]
add rax, qword [0x1400081c0]
jmp 0x14000587a
Function at 0x1400060a0
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x140008090]
mov rbx, rcx
test rax, rax
jne 0x140006163
mov rdx, qword [0x1400081c0]
test rdx, rdx
jne 0x1400060dc
mov rdx, qword [0x1400080f8]
mov qword [0x1400081c0], rdx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov r10d, dword [rcx + 0x1c]
mov r8d, dword [rcx + 0x20]
add r10, rdx
mov r11d, dword [rcx + 0x24]
add r8, rdx
mov edi, dword [rcx + 0x18]
add r11, rdx
xor edx, edx
test edi, edi
je 0x140006159
mov ecx, dword [r8]
movabs r9, 0xcbf29ce484222325
add rcx, qword [0x1400081c0]
mov al, byte [rcx]
test al, al
je 0x14000614f
inc rcx
movsx rax, al
xor r9, rax
movabs rsi, 0x100000001b3
imul r9, rsi
mov al, byte [rcx]
test al, al
jne 0x140006122
movabs rax, 0xce03cf29aaff16c0
cmp r9, rax
je 0x140006170
inc edx
add r8, 4
cmp edx, edi
jb 0x140006108
int3
mov qword [0x140008090], rax
call qword [0x140007080]
test rax, rax
jne 0x140006182
jmp 0x140006198
movzx ecx, word [r11 + rdx*2]
mov eax, dword [r10 + rcx*4]
add rax, qword [0x1400081c0]
jmp 0x14000615c
mov rcx, qword [rax + 0x98]
mov rax, qword [rcx + 0x20]
mov qword [rcx + 0x20], rbx
mov rcx, qword [rbx + 0x28]
mov cr3, rcx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400061b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, qword [0x1400080f8]
test r9, r9
je 0x140006211
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x140006211
movsxd rax, dword [r9 + 0x3c]
mov ecx, dword [rax + r9 + 0x88]
test ecx, ecx
je 0x140006211
lea rbx, [r9 + rcx]
xor r11d, r11d
mov r10d, dword [rbx + 0x20]
mov edi, dword [rbx + 0x18]
add r10, r9
test edi, edi
je 0x140006211
mov ecx, dword [r10]
add rcx, r9
call fcn.1400063c0
test eax, eax
je 0x14000621e
inc r11d
add r10, 4
cmp r11d, edi
jb 0x1400061f6
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 0x24]
mov ecx, dword [rbx + 0x1c]
add rax, r9
add rcx, r9
movzx edx, word [rax + r11*2]
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140006213

Function at 0x140006240
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
movsxd r8, dword [rcx + 0x3c]
lea r14, [rcx + 0x18]
add r14, r8
xor r11d, r11d
mov rbp, rdx
mov rbx, rcx
movzx eax, word [r8 + rcx + 0x14]
movzx esi, word [r8 + rcx + 6]
add r14, rax
test esi, esi
je 0x14000629f
lea rcx, [r11 + r11*4]
mov rdx, rbp
lea rdi, [r14 + rcx*8]
mov rcx, rdi
call fcn.140006450
test eax, eax
je 0x1400062bc
inc r11d
cmp r11d, esi
jb 0x140006280
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov eax, dword [rdi + 0xc]
add rax, rbx
jmp 0x1400062a1
Function at 0x1400012b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x17c0
call fcn.14003ad30
sub rsp, rax
mov rax, qword [0x14004de00]
xor rax, rsp
mov qword [rsp + 0x17b0], rax
xor edi, edi
mov bpl, r9b
mov rsi, r8
mov r13, rdx
mov r12, rcx
test r8, r8
jle 0x1400013a2
mov r14d, 0x1770
mov r8d, esi
mov rax, rsi
lea r9, [rsp + 0x30]
sub r8d, edi
sub rax, rdi
lea rdx, [rsp + 0x40]
cmp rax, r14
mov rcx, r12
cmovg r8d, r14d
and qword [rsp + 0x20], 0
call qword [0x14003d138]
test eax, eax
je 0x1400013e8
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x1400013e8
test bpl, bpl
je 0x140001354
test ecx, ecx
je 0x140001354
lea rax, [rsp + 0x40]
mov rdx, rcx
xor byte [rax], 0x88
inc rax
sub rdx, 1
jne 0x140001348
xor ebx, ebx
test ecx, ecx
je 0x14000138b
and qword [rsp + 0x20], 0
sub ecx, ebx
movsxd rax, ebx
mov r8d, ecx
lea rdx, [rsp + rax + 0x40]
lea r9, [rsp + 0x34]
mov rcx, r13
call qword [0x14003d130]
test eax, eax
je 0x1400013c6
add ebx, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x30]
cmp ebx, ecx
jb 0x14000135a
mov eax, ecx
add rdi, rax
call fcn.140004bcc
test al, al
jne 0x1400013a2
cmp rdi, rsi
jl 0x1400012f7
xor eax, eax
mov rcx, qword [rsp + 0x17b0]
xor rcx, rsp
call fcn.14001c510
add rsp, 0x17c0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call qword [0x14003d118]
mov edx, dword [rsp + 0x30]
lea rcx, str.WriteFile_failed__d__d
sub edx, ebx
mov r8d, eax
call fcn.140016300
mov eax, 2
jmp 0x1400013a4
call qword [0x14003d118]
mov edx, dword [rsp + 0x30]
lea rcx, str.ReadFile_failed__d__d__I64d
mov r8d, eax
mov r9, rdi
call fcn.140016300
mov eax, 1
jmp 0x1400013a4
Function at 0x14000d990
Capabilities:
Parse pe header
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x50
mov rax, qword [0x14004de00]
xor rax, rsp
mov qword [rsp + 0x40], rax
and qword [rsp + 0x20], 0
mov rbx, rcx
mov rdx, rcx
lea rcx, [rsp + 0x20]
lea r8, [0x140040c14]
call fcn.140020100
mov r9, qword [rsp + 0x20]
test eax, eax
jne 0x14000db36
test r9, r9
je 0x14000db36
lea esi, [rax + 1]
lea r8d, [rax + 2]
lea rcx, [rsp + 0x30]
mov rdx, rsi
call fcn.14001ffa8
cmp rax, 2
jne 0x14000db20
cmp byte [rsp + 0x30], 0x4d
jne 0x14000db20
cmp byte [rsp + 0x31], 0x5a
jne 0x14000db20
mov rcx, qword [rsp + 0x20]
lea edx, [rsi + 0x3b]
xor r8d, r8d
call fcn.14001fbdc
test eax, eax
je 0x14000da42
mov rcx, qword [rsp + 0x20]
call fcn.14001ee5c
lea rcx, str.no_PE32_file_2__S
mov rdx, rbx
call fcn.140016394
jmp 0x14000db48
mov r9, qword [rsp + 0x20]
lea rcx, [rsp + 0x2c]
mov r8, rsi
mov edx, 4
call fcn.14001ffa8
mov rcx, qword [rsp + 0x20]
cmp rax, rsi
je 0x14000da71
call fcn.14001ee5c
lea rcx, str.no_PE32_file_3__S
jmp 0x14000da35
mov edx, dword [rsp + 0x2c]
xor r8d, r8d
call fcn.14001fbdc
test eax, eax
je 0x14000da94
mov rcx, qword [rsp + 0x20]
call fcn.14001ee5c
lea rcx, str.no_PE32_file_4__S
jmp 0x14000da35
mov r9, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r8d, 4
mov rdx, rsi
call fcn.14001ffa8
cmp rax, 4
jne 0x14000db0a
cmp byte [rsp + 0x30], 0x50
jne 0x14000db0a
cmp byte [rsp + 0x31], 0x45
jne 0x14000db0a
cmp byte [rsp + 0x32], 0
jne 0x14000db0a
cmp byte [rsp + 0x33], 0
jne 0x14000db0a
mov r9, qword [rsp + 0x20]
lea edx, [rax - 2]
lea rcx, [rsp + 0x28]
mov r8, rsi
call fcn.14001ffa8
mov rcx, qword [rsp + 0x20]
cmp rax, rsi
je 0x14000dafe
call fcn.14001ee5c
lea rcx, str.no_PE32_file_6__S
jmp 0x14000da35
call fcn.14001ee5c
movzx eax, word [rsp + 0x28]
jmp 0x14000db4a
mov rcx, qword [rsp + 0x20]
call fcn.14001ee5c
lea rcx, str.no_PE32_file_5__S
jmp 0x14000da35
mov rcx, qword [rsp + 0x20]
call fcn.14001ee5c
lea rcx, str.no_PE32_file__S
jmp 0x14000da35
lea rcx, str.could_not_open__S__d__p
mov r8d, eax
mov rdx, rbx
call fcn.140016394
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14001c510
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret

Function at 0x140015960
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r10, rdx
test r8d, r8d
jle 0x140015994
mov r9d, r8d
mov r8d, dword [rcx]
movsx eax, byte [r10]
inc r10
xor rax, r8
shr r8d, 8
movzx edx, al
lea rax, [0x14004d4a0]
mov eax, dword [rax + rdx*4]
xor eax, r8d
sub r9, 1
mov dword [rcx], eax
jne 0x14001596b
repz ret