joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140023360
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
lea rax, [0x14012a190]
mov rsi, rcx
mov qword [rcx], rax
mov rdi, rdx
add rcx, 8
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, 0xfa0
lea rcx, [rsi + 8]
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
xor r13d, r13d
mov qword [rsi + 0x58], rdi
lea rcx, [rsp + 0x20]
mov dword [rsi + 0x30], r13d
mov dword [rsi + 0x40], r13d
mov dword [rsi + 0x50], r13d
call fcn.1400c72e0
mov edx, dword [rax + 0x10]
test edx, edx
mov eax, 0x10000
cmove edx, eax
lea ecx, [rdx + 0x1fffff]
neg edx
mov eax, edx
and rcx, rax
call fcn.1400c24b0
mov rcx, rsi
mov qword [rsi + 0x38], rax
call fcn.14002f470
mov ecx, eax
call fcn.1400c24b0
mov qword [rsi + 0x48], rax
test rax, rax
je 0x140023406
cmp qword [rsi + 0x38], r13
jne 0x140023419
lea rcx, str.Memory_pools_allocations_failed__exiting..._n
call sub.KERNEL32.dll_OutputDebugStringW
mov cl, 1
call fcn.1400caa20
test byte [rsi + 0x38], 0xf
jne 0x140023425
test byte [rsi + 0x48], 0xf
je 0x140023438
lea rcx, str.OS_allocations_must_be_aligned_to_a_value_multiple_of_16__exiting..._n
call sub.KERNEL32.dll_OutputDebugStringW
mov cl, 1
call fcn.1400caa20
mov r15d, r13d
lea r12, [0x14015a2a0]
lea rdx, [0x140170a88]
nop dword [rax]
movsxd rax, r15d
mov edi, r13d
imul rbx, rax, 0x4020
mov eax, dword [r12]
add rbx, rdx
add eax, 0x10
mov edx, dword [r12 + 4]
mov qword [rbx], r13
mov qword [rbx + 8], r13
mov dword [rbx + 0x10], eax
mov dword [rbx + 0x4018], edx
test edx, edx
je 0x1400234c3
mov ebp, dword [rbx + 0x10]
mov rcx, rsi
mov r14d, dword [rsi + 0x50]
add ebp, r14d
call fcn.14002f470
cmp ebp, eax
ja 0x1400234a2
mov eax, r14d
mov dword [rsi + 0x50], ebp
add rax, qword [rsi + 0x48]
jmp 0x1400234a5
mov rax, r13
lea rcx, [rax + 0x10]
mov qword [rax], r13
mov qword [rax + 8], rcx
mov ecx, edi
inc edi
mov qword [rbx + rcx*8 + 0x18], rax
mov edx, dword [rbx + 0x4018]
cmp edi, edx
jb 0x140023480
cmp edx, 0x800
jae 0x1400234ef
mov eax, edx
mov r8d, 0x800
sub r8d, edx
add rax, 3
shl r8, 3
xor edx, edx
lea rcx, [rbx + rax*8]
call sub.VCRUNTIME140.dll_memset
mov edx, dword [rbx + 0x4018]
mov eax, dword [rbx + 0x10]
inc r15d
imul eax, edx
add r12, 8
lea rdx, [0x140170a88]
add eax, 0x4000
mov dword [rbx + 0x401c], eax
cmp r15d, 0xe
jb 0x140023450
lea r11, [rsp + 0xa0]
mov rax, rsi
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400294d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
mov r15d, r8d
mov rsi, rdx
mov r14, rcx
test rdx, rdx
je 0x1400294fc
mov ebp, dword [rdx + 0x28]
jmp 0x1400294ff
mov ebp, r12d
call fcn.14001d940
mov rdi, rax
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140029542
lea ecx, [rax + 0x18]
call fcn.1400134a0
mov rbx, rax
test rax, rax
je 0x140029534
mov qword [rax], r12
mov qword [rax + 8], r12
mov dword [rax + 0x10], r12d
jmp 0x140029537
mov rbx, r12
mov ecx, dword [rdi]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [rbx + 8]
test rcx, rcx
jne 0x1400295b4
mov rax, qword [rbx]
test rax, rax
je 0x140029567
mov edx, 0x20
mov qword [rbx + 8], rax
mov dword [rbx + 0x10], edx
mov rcx, rax
mov qword [rbx], r12
jmp 0x1400295b7
lea rcx, [rdi + 8]
call fcn.14001e790
mov qword [rbx + 8], rax
test rax, rax
jne 0x1400295a6
xor edx, edx
mov ecx, 0x2000
call fcn.1400461a0
mov qword [rbx + 8], rax
mov edx, 0x1f
nop
lea rcx, [rax + 0x100]
mov qword [rax], rcx
mov rax, rcx
sub rdx, 1
jne 0x140029590
mov qword [rcx], r12
mov rcx, qword [rbx + 8]
mov edx, 0x20
mov dword [rbx + 0x10], edx
jmp 0x1400295b7
mov edx, dword [rbx + 0x10]
mov rax, qword [rcx]
mov qword [rbx + 8], rax
lea eax, [rdx - 1]
mov dword [rbx + 0x10], eax
lea rax, [0x14011eae0]
mov rbx, qword [rsp + 0x58]
mov qword [rcx], rax
lea eax, [rbp + 1]
mov rbp, qword [rsp + 0x60]
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x50], r12
mov dword [rcx + 8], 0xff
mov dword [rcx + 0xc], eax
lea rax, [0x14012c910]
mov qword [rcx], rax
mov rax, r14
mov byte [rcx + 0x28], r12b
mov qword [rcx + 0x30], r12
mov qword [r14], rcx
mov qword [r14 + 8], rsi
mov dword [r14 + 0x10], r15d
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140032c40
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x450
mov rax, qword [0x1401674b8]
xor rax, rsp
mov qword [rsp + 0x440], rax
xor r12d, r12d
lea r14, [rsp + 0x40]
mov ebx, r12d
lea rbp, [r11 + 0x10]
mov rdi, rcx
mov esi, 0x400
call fcn.14001b5c0
mov qword [rsp + 0x28], rbp
lea rdx, [rsp + 0x40]
mov r9, rdi
mov qword [rsp + 0x20], r12
mov r8d, 0x200
mov r15, rax
mov rcx, qword [rax]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
test eax, eax
mov ebp, 0xffffffff
cmovs eax, ebp
cmp eax, 0x200
jae 0x140032cd0
cmp eax, ebp
jne 0x140032d2a
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
movsxd rdi, esi
lea rcx, [rdi + rdi]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
mov r14, rax
test rax, rax
je 0x140032d42
mov r9, qword [rsp + 0x490]
lea rax, [rsp + 0x498]
mov rcx, qword [r15]
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rdx, rbx
mov qword [rsp + 0x20], r12
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___stdio_common_vswprintf]
test eax, eax
cmovs eax, ebp
cmp eax, esi
cmovge eax, ebp
add esi, esi
cmp eax, ebp
je 0x140032cd0
cdqe
mov rcx, r14
mov word [r14 + rax*2], r12w
call sub.KERNEL32.dll_OutputDebugStringW
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.14010f980
add rsp, 0x450
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140032dd0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
cmp r8d, 0x10
jbe 0x140032df2
lea rcx, str.Alignment___16_is_not_supported_n
call sub.KERNEL32.dll_OutputDebugStringW
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsi + 0x30], eax
je 0x140032e11
call fcn.1400cb700
jmp 0x140032f45
xor ebp, ebp
lea r10, [0x140170a88]
mov edx, ebp
nop dword [rax]
movsxd rax, edx
imul rax, rax, 0x4020
add rax, r10
mov r9d, dword [rax]
mov r8d, dword [rax + 0x4018]
cmp r9d, r8d
jae 0x140032e46
mov ecx, dword [rax + 0x10]
sub ecx, 0x10
cmp edi, ecx
jbe 0x140032ea8
inc edx
cmp edx, 0xe
jb 0x140032e20
mov eax, dword [rsi + 0x40]
lea ecx, [rdi + 0x10]
add eax, 0xf
mov r8d, 0x200000
and eax, 0xfffffff0
mov edx, edi
add ecx, eax
mov dword [rsi + 0x40], eax
cmp ecx, r8d
ja 0x140032f23
mov rbx, qword [rsi + 0x38]
mov dword [rsi + 0x40], ecx
mov ecx, eax
add rbx, rcx
mov eax, edi
mov qword [rbx], rax
mov rax, qword [rsi + 0x38]
add rax, 0x10
add rcx, rax
mov qword [rbx + 8], rcx
lea rcx, str.Malloc_Size_d_LargeMemoryPoolOffset_d__n
mov r8d, dword [rsi + 0x40]
call fcn.140032c40
mov rax, qword [rbx + 8]
jmp 0x140032f47
mov edx, ebp
test r8d, r8d
je 0x140032ec3
nop
mov ecx, edx
mov rbx, qword [rax + rcx*8 + 0x18]
cmp qword [rbx], rbp
je 0x140032ee9
inc edx
cmp edx, r8d
jb 0x140032eb0
mov edx, edi
lea rcx, str.AllocateFromPool_run_out_of_memory_allocating__u_bytes_for__u_allocations_n
call fcn.140032c40
lea rcx, str.Please_increase_MaxNumAllocations_for_that_pool__exiting..._n
call sub.KERNEL32.dll_OutputDebugStringW
mov cl, 1
call fcn.1400caa20
mov rax, rbp
jmp 0x140032f47
cmp dword [rax + 4], edx
mov r8d, edi
cmovae edx, dword [rax + 4]
inc dword [rax + 0xc]
mov dword [rax + 4], edx
lea edx, [r9 + 1]
cmp dword [rax + 8], edx
mov dword [rax], edx
cmovae edx, dword [rax + 8]
mov dword [rax + 8], edx
mov edx, 0xfe
mov rcx, qword [rbx + 8]
mov qword [rbx], r8
call sub.VCRUNTIME140.dll_memset
mov rbp, qword [rbx + 8]
mov rax, rbp
jmp 0x140032f47
sub r8d, eax
lea rcx, str.MallocCrash_run_out_of_memory_allocating__u_bytes__free__u_bytes_n
call fcn.140032c40
lea rcx, str.Please_increase_LARGE_MEMORYPOOL_SIZE__exiting..._n
call sub.KERNEL32.dll_OutputDebugStringW
mov cl, 1
call fcn.1400caa20
xor eax, eax
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14003fd20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
movzx eax, word [rcx]
lea r10, [rcx + 2]
not edx
test ax, ax
je 0x14003fd99
lea r11, [0x14015a7c0]
nop word [rax + rax]
movzx r9d, ax
lea r10, [r10 + 2]
mov eax, edx
shr edx, 8
xor rax, r9
shr r9, 8
movzx ecx, al
mov r8d, dword [r11 + rcx*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor r9, rax
movzx eax, r9b
mov edx, dword [r11 + rax*4]
movzx eax, word [r10 - 2]
xor edx, r8d
movzx ecx, dl
shr edx, 8
mov r8d, dword [r11 + rcx*4]
xor r8d, edx
movzx ecx, r8b
shr r8d, 8
mov edx, dword [r11 + rcx*4]
xor edx, r8d
test ax, ax
jne 0x14003fd40
not edx
mov eax, edx
ret
Function at 0x140040380
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rax, [0x14012d400]
mov qword [rcx + 8], rdx
mov qword [rcx], rax
mov rdi, rcx
mov byte [rcx + 0x10], 0
add rcx, 0x18
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov edx, 0xfa0
lea rcx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_SetCriticalSectionSpinCount]
lea rcx, [rdi + 0x48]
call qword [sym.imp.KERNEL32.dll_InitializeSRWLock]
xor eax, eax
mov dword [rdi + 0x7c], 0x80
mov qword [rdi + 0x50], rax
mov qword [rdi + 0x58], rax
mov qword [rdi + 0x70], rax
mov dword [rdi + 0x78], eax
mov dword [rdi + 0x84], eax
mov qword [rdi + 0x90], rax
mov dword [rdi + 0x98], eax
mov qword [rdi + 0xa0], rax
mov qword [rdi + 0xa8], rax
mov dword [rdi + 0x80], 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
mov dword [rdi + 0x40], eax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x1400447f0
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
cmp dword [rdx], 0xffffffff
mov rdi, rdx
mov rbx, rcx
jne 0x140044821
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, eax
mov eax, 0xffffffff
lock cmpxchg dword [rdi], ecx
cmp eax, 0xffffffff
je 0x140044821
call qword [sym.imp.KERNEL32.dll_TlsFree]
mov ecx, dword [rdi]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x14004488e
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x38], rsi
call qword [rbx]
mov ecx, dword [0x1401ae774]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x14004487b
lea rbx, [rax + 0x30]
mov qword [rsp + 0x30], rbp
movsxd rbp, dword [rbx + 8]
lea ecx, [rbp + 1]
mov dword [rbx + 8], ecx
cmp ecx, dword [rbx + 0xc]
jle 0x14004486f
mov edx, ebp
mov rcx, rbx
call fcn.1400483b0
mov rax, qword [rbx]
mov qword [rax + rbp*8], rsi
mov rbp, qword [rsp + 0x30]
mov ecx, dword [rdi]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140079f80
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1401b0dfc]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140079fd0
lea ecx, [rax + 0xc]
mov qword [rsp + 0x20], rbx
call fcn.1400134a0
mov rbx, rax
test rax, rax
je 0x140079fb7
mov byte [rax], 5
mov qword [rax + 4], 0
jmp 0x140079fb9
xor ebx, ebx
mov ecx, dword [0x1401b0dfc]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, rbx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret

Function at 0x14007cd70
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push rbx
mov rbx, r8
mov r10d, edx
mov r9, rcx
test edx, edx
je 0x14007cd93
nop
lea ecx, [r10 - 1]
cmp word [r9 + rcx*2], 0x3d
jne 0x14007cd93
mov r10d, ecx
test ecx, ecx
jne 0x14007cd80
mov eax, r10d
mov qword [rsp + 0x10], rsi
and al, 3
mov qword [rsp + 0x18], rdi
cmp al, 1
je 0x14007ce79
xor edx, edx
lea rsi, [0x1401313f0]
mov edi, 0x100
cmp r10d, 4
jb 0x14007ce10
nop
mov eax, edx
mov r11d, edx
movzx ecx, word [r9]
add r9, 2
cmp cx, di
jae 0x14007ce79
movzx r8d, byte [rcx + rsi]
cmp r8b, 0xff
je 0x14007ce79
shl eax, 6
inc r11d
or eax, r8d
cmp r11d, 4
jl 0x14007cdc5
mov byte [rbx + 2], al
add r10d, 0xfffffffc
shr eax, 8
mov byte [rbx + 1], al
shr eax, 8
mov byte [rbx], al
add rbx, 3
cmp r10d, 4
jae 0x14007cdc0
test r10d, r10d
je 0x14007ce6b
mov r8d, edx
nop dword [rax + rax]
movzx eax, word [r9]
lea r9, [r9 + 2]
cmp ax, di
jae 0x14007ce79
movzx ecx, byte [rax + rsi]
cmp cl, 0xff
je 0x14007ce79
shl edx, 6
inc r8d
or edx, ecx
cmp r8d, r10d
jb 0x14007ce20
cmp r10d, 4
jge 0x14007ce5a
mov ecx, 4
sub ecx, r10d
shl edx, 6
sub rcx, 1
jne 0x14007ce51
shr edx, 8
cmp r10d, 3
jb 0x14007ce66
mov byte [rbx + 1], dl
shr edx, 8
mov byte [rbx], dl
mov al, 1
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x10]
pop rbx
ret
mov rdi, qword [rsp + 0x18]
xor al, al
mov rsi, qword [rsp + 0x10]
pop rbx
ret
Function at 0x14007d7f0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
lea rsi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov rbx, r8
mov r11d, edx
mov r10, rcx
mov r9, r8
cmp edx, 3
jb 0x14007d89a
mov eax, 0xaaaaaaab
mov qword [rsp + 0x10], rdi
mul r11d
shr edx, 1
mov edi, edx
movzx ecx, byte [r10 + 1]
add r11d, 0xfffffffd
movzx r8d, byte [r10]
movzx edx, byte [r10 + 2]
add r10, 3
shl r8d, 8
or r8d, ecx
shl r8d, 8
or r8d, edx
mov eax, r8d
shr r8d, 6
and eax, 0x3f
mov ecx, r8d
shr rcx, 6
movzx eax, byte [rax + rsi]
mov word [r9 + 6], ax
mov eax, r8d
and eax, 0x3f
movzx eax, byte [rax + rsi]
mov word [r9 + 4], ax
mov rax, rcx
and eax, 0x3f
shr rcx, 6
movzx eax, byte [rax + rsi]
mov word [r9 + 2], ax
movzx eax, byte [rcx + rsi]
mov word [r9], ax
add r9, 8
sub rdi, 1
jne 0x14007d823
mov rdi, qword [rsp + 0x10]
test r11d, r11d
je 0x14007d903
movzx ecx, byte [r10]
xor al, al
cmp r11d, 2
jne 0x14007d8b0
movzx eax, byte [r10 + 1]
shl ecx, 8
mov r8d, 0x3d
movzx eax, al
or ecx, eax
mov word [r9 + 6], r8w
shl ecx, 8
shr ecx, 6
mov edx, ecx
cmp r11d, 1
je 0x14007d8db
mov eax, ecx
and eax, 0x3f
movzx r8d, byte [rax + rsi]
mov word [r9 + 4], r8w
shr rdx, 6
mov rax, rdx
shr rdx, 6
and eax, 0x3f
movzx eax, byte [rax + rsi]
mov word [r9 + 2], ax
movzx eax, byte [rdx + rsi]
mov word [r9], ax
add r9, 8
xor eax, eax
mov word [r9], ax
sub r9, rbx
mov rbx, qword [rsp + 0x18]
sar r9, 1
mov eax, r9d
pop rsi
ret
Function at 0x14007f880
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push r14
sub rsp, 0x58
mov r14, rdx
mov rsi, rcx
cmp rcx, rdx
je 0x14007fa6f
mov qword [rsp + 0x50], rbx
mov r9d, 4
mov qword [rsp + 0x48], rbp
lea rbx, [rcx + 0x38]
mov qword [rsp + 0x40], rdi
mov rcx, rbx
movsxd rdi, dword [rdx + 0x48]
xor edx, edx
mov r8d, edi
mov qword [rsp + 0x28], r15
call fcn.140018d00
mov rax, qword [r14 + 0x40]
lea rdx, [r14 + 0x38]
mov r9, qword [rbx + 8]
mov r8, rdi
shl r8, 2
test rax, rax
cmovne rdx, rax
test r9, r9
cmovne rbx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov dword [rsi + 0x48], edi
mov rcx, rsi
movsxd rbx, dword [r14 + 8]
mov edx, ebx
call fcn.14005e000
mov edx, dword [rsi + 8]
lea eax, [rdx + rbx]
mov dword [rsi + 8], eax
cmp eax, dword [rsi + 0xc]
jle 0x14007f91a
mov rcx, rsi
call fcn.1400708c0
mov eax, dword [r14 + 0x30]
lea r15, [r14 + 0x10]
lea rcx, [rsi + 0x10]
mov dword [rsi + 0x30], eax
mov eax, dword [r14 + 0x34]
mov dword [rsi + 0x34], eax
cmp rcx, r15
je 0x14007f93d
mov rdx, r15
call fcn.1400219f0
mov rax, qword [r14]
xor ebp, ebp
mov rcx, qword [rsi]
mov r14, rbx
test ebx, ebx
jle 0x14007fa6a
sub rax, rcx
mov qword [rsp + 0x38], r12
lea rbx, [rcx + 0x1c]
mov qword [rsp + 0x30], r13
lea edi, [rbp + 1]
lea rcx, [rax - 0xc]
mov qword [rsp + 0x78], rcx
lea r12, [rax - 0x18]
mov rsi, qword [rsp + 0x78]
lea rcx, [rax + 0x44]
mov qword [rsp + 0x80], rcx
lea r13, [rax - 0x1c]
lea rcx, [rax + 0x48]
mov qword [rsp + 0x88], rcx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r15 + 0x10]
lea rdx, [rbx + r13]
test rax, rax
lea rcx, [rbx - 0x1c]
mov r8, r15
cmovne r8, rax
mov eax, ebp
test ebp, ebp
jns 0x14007f9bf
lea eax, [rbp + 0x1f]
sar eax, 5
cdqe
test dword [r8 + rax*4], edi
je 0x14007fa22
call fcn.140013210
xor eax, eax
mov dword [rbx + 0x20], 0x80
lea rcx, [rbx - 0xc]
mov qword [rbx - 4], rax
lea rdx, [rsi + rbx]
mov qword [rcx], rax
mov qword [rbx + 0x14], rax
mov dword [rbx + 0x1c], eax
mov dword [rbx + 0x28], eax
mov qword [rbx + 0x34], rax
mov dword [rbx + 0x3c], eax
mov dword [rbx + 0x24], 0xffffffff
call fcn.140024610
mov rcx, qword [rsp + 0x80]
mov eax, dword [rcx + rbx]
mov dword [rbx + 0x44], eax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax + rbx]
mov dword [rbx + 0x48], eax
jmp 0x14007fa2d
mov eax, dword [rdx]
mov dword [rcx], eax
mov eax, dword [rbx + r12]
mov dword [rbx - 0x18], eax
inc ebp
rol edi, 1
add rbx, 0x68
sub r14, 1
jne 0x14007f9a0
mov rax, qword [rsp + 0x70]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov r15, qword [rsp + 0x28]
add rsp, 0x58
pop r14
pop rsi
ret
mov rax, rsi
jmp 0x14007fa4e
mov rax, rsi
add rsp, 0x58
pop r14
pop rsi
ret
Function at 0x14008d9b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
lea r9d, [rcx + 3]
mov ebx, edx
and r9d, 0xfffffffc
lea rsi, [0x14015a7c0]
sub r9d, ecx
mov r11, rcx
not r8d
cmp edx, r9d
jle 0x14008dac7
sub ebx, r9d
mov qword [rsp + 0x10], rdi
test r9d, r9d
je 0x14008da11
nop word [rax + rax]
movzx eax, byte [r11]
inc r11
movzx ecx, r8b
xor rcx, rax
mov eax, r8d
shr eax, 8
mov r8d, dword [rsi + rcx*4]
xor r8d, eax
sub r9d, 1
jne 0x14008d9f0
mov eax, ebx
cdq
and edx, 7
add eax, edx
mov edi, eax
and eax, 7
sub eax, edx
sar edi, 3
mov ebx, eax
test edi, edi
je 0x14008dac2
nop dword [rax]
mov r10d, dword [r11 + 4]
mov ecx, dword [r11]
add r11, 8
xor ecx, r8d
mov r9d, ecx
mov eax, ecx
shr rax, 0x10
movzx edx, al
mov eax, ecx
shr rax, 8
movzx ecx, al
mov eax, r10d
mov r8d, dword [rsi + rdx*4 + 0x1400]
shr rax, 0x10
xor r8d, dword [rsi + rcx*4 + 0x1800]
movzx ecx, al
mov eax, r10d
shr rax, 8
xor r8d, dword [rsi + rcx*4 + 0x400]
movzx ecx, al
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rsi + rcx*4 + 0x800]
xor r8d, dword [rsi + rax*4 + 0x1000]
mov eax, r10d
shr rax, 0x18
xor r8d, dword [rsi + rax*4]
movzx eax, r9b
xor r8d, dword [rsi + rax*4 + 0x1c00]
movzx eax, r10b
xor r8d, dword [rsi + rax*4 + 0xc00]
add edi, 0xffffffff
jne 0x14008da30
mov rdi, qword [rsp + 0x10]
test ebx, ebx
je 0x14008daf1
nop dword [rax + rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
movzx ecx, r8b
xor rcx, rax
mov eax, r8d
shr eax, 8
mov r8d, dword [rsi + rcx*4]
xor r8d, eax
sub ebx, 1
jne 0x14008dad0
mov rbx, qword [rsp + 0x18]
not r8d
mov eax, r8d
pop rsi
ret

Function at 0x140099080
Capabilities:
Hash data using sha1

Disassembly:
mov dword [rcx], 0x67452301
mov rax, rcx
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
mov qword [rcx + 0x18], 0
ret

Function at 0x140099990
Capabilities:
Hash data using sha1

Disassembly:
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
mov dword [rcx + 0x10], 0xc3d2e1f0
mov qword [rcx + 0x18], 0
ret

Function at 0x1400a04e0
Capabilities:
Hash data using sha1

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x1401674b8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x20], 0x67452301
mov rsi, r8
mov dword [rsp + 0x24], 0xefcdab89
mov rbx, rdx
mov dword [rsp + 0x28], 0x98badcfe
mov rdi, rcx
mov dword [rsp + 0x2c], 0x10325476
mov dword [rsp + 0x30], 0xc3d2e1f0
mov qword [rsp + 0x38], 0
test rdx, rdx
je 0x1400a0574
mov qword [rsp + 0x38], rdx
cmp rdx, 0x40
jb 0x1400a0564
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.1400aa100
mov rax, rbx
and rax, 0xffffffffffffffc0
add rdi, rax
and ebx, 0x3f
mov r8, rbx
lea rcx, [rsp + 0x44]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rsp + 0x20]
call fcn.14009d400
movups xmm0, xmmword [rsp + 0x84]
mov eax, dword [rsp + 0x94]
movups xmmword [rsi], xmm0
mov dword [rsi + 0x10], eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14010f980
add rsp, 0xc0
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400a78e0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rcx
mov r8d, dword [0x140238534]
movzx edi, dl
mov ecx, 0x1c
mov r9, qword [rax + r8*8]
mov eax, dword [rcx + r9]
cmp dword [0x1401dc560], eax
jg 0x1400a796f
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x40]
mulsd xmm1, qword [0x140170a60]
addsd xmm1, qword [0x14011ed48]
test dil, dil
jne 0x1400a7954
movaps xmm0, xmm1
subsd xmm0, qword [0x1401dc558]
comisd xmm0, xmmword [0x14015d8a0]
jbe 0x1400a7964
mov rcx, rbx
movsd qword [0x1401dc558], xmm1
call fcn.1400ab860
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x1401dc560]
call fcn.14010fb6c
cmp dword [0x1401dc560], 0xffffffff
jne 0x1400a7915
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm0, xmm0
lea rcx, [0x1401dc560]
cvtsi2sd xmm0, qword [rsp + 0x40]
mulsd xmm0, qword [0x140170a60]
addsd xmm0, qword [0x14011ed48]
movsd qword [0x1401dc558], xmm0
call fcn.14010fb0c
jmp 0x1400a7915
Function at 0x1400ae4c0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x48], rbx
mov rdi, rcx
mov qword [rsp + 0x58], rsi
mov rbx, r8
lea rsi, [rcx + 0x18]
movaps xmmword [rsp + 0x20], xmm6
mov rcx, r8
movaps xmm6, xmm1
call fcn.140067740
test al, al
je 0x1400ae4f6
call fcn.140063290
mov rbx, rax
mov rdx, rbx
mov rcx, rsi
call fcn.140051590
cmp byte [rdi + 0x51], 0
movss xmm1, dword [rdi + 0x34]
addss xmm1, dword [rdi + 0x38]
movss xmm0, dword [rdi + 0x30]
subss xmm0, xmm1
movss dword [rdi + 0x34], xmm1
minss xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x20]
movss dword [rdi + 0x38], xmm0
jne 0x1400ae62c
cmp byte [rdi + 0x4c], 0
je 0x1400ae62c
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x40]
mulsd xmm0, qword [0x140170a60]
addsd xmm0, qword [0x14011ed48]
subsd xmm0, qword [rdi + 0x40]
cvtpd2ps xmm0, xmm0
comiss xmm0, dword [rdi + 0x48]
jbe 0x1400ae62c
mov rcx, qword [rdi + 0x58]
movzx ebx, byte [rdi + 0x60]
mov qword [rsp + 0x50], rbp
movzx ebp, bl
and bpl, 1
mov rax, qword [rcx]
call qword [rax + 0x70]
test al, al
je 0x1400ae59a
test bl, 2
jne 0x1400ae59a
mov al, 1
jmp 0x1400ae59c
xor al, al
cmp byte [rdi + 0x50], 0
je 0x1400ae5d4
cmp byte [0x1401bb364], 0
jne 0x1400ae5d4
test al, al
jne 0x1400ae5d4
cmp byte [0x1401bb380], al
je 0x1400ae5ca
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, dword [0x1401bb378]
sete al
test al, al
je 0x1400ae5d4
cmp dword [rdi + 0x3c], 2
je 0x1400ae5d4
mov al, 1
jmp 0x1400ae5d6
xor al, al
cmp byte [0x1401bb365], 0
jne 0x1400ae627
test al, al
je 0x1400ae627
mov rcx, rsi
call fcn.140067740
mov rcx, qword [rdi + 0x58]
test al, al
movzx r8d, bpl
cmovne rsi, rdi
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x58]
cmp byte [0x1401bb365], 0
je 0x1400ae627
mov rbx, qword [rdi + 0x58]
mov dl, 1
mov rcx, rbx
mov byte [rdi + 0x51], 1
call fcn.1400a78e0
mov dl, 1
mov rcx, rbx
call fcn.1400a78e0
mov rbp, qword [rsp + 0x50]
cmp byte [rdi + 0x50], 0
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
je 0x1400ae64c
mov rcx, qword [rdi + 0x58]
xor edx, edx
add rsp, 0x30
pop rdi
jmp fcn.1400a78e0
add rsp, 0x30
pop rdi
ret