joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140069d30
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x140069ded
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x140069ded
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x9f9512bf
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x140069de8
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x140069db0
cmp r10d, 0x1d88c34e
je 0x140069df5
test r11d, r11d
jne 0x140069d90
mov rax, qword [rax]
jmp 0x140069d60
mov ecx, dword [rsi + 0x24]
mov rdi, qword [rsp + 0x18]
add rcx, rbx
mov r14, qword [rsp + 0x20]
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
mov rsi, qword [rsp + 0x10]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 8]
ret

Function at 0x140069e30
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x140069eed
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x140069eed
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x25f84deb
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x140069ee8
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x140069eb0
cmp r10d, 0x4750aeea
je 0x140069ef5
test r11d, r11d
jne 0x140069e90
mov rax, qword [rax]
jmp 0x140069e60
mov ecx, dword [rsi + 0x24]
mov rdi, qword [rsp + 0x18]
add rcx, rbx
mov r14, qword [rsp + 0x20]
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
mov rsi, qword [rsp + 0x10]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 8]
ret
Function at 0x14007b460
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
movzx eax, dl
mov r15, rcx
xor al, 1
mov byte [rcx + 0x4e], al
test dl, dl
je 0x14007b488
mov ebp, dword [rcx + 0x50]
jmp 0x14007b48a
xor ebp, ebp
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14007b52d
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14007b52d
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x7c3b49f7
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x14007b528
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x14007b4f0
cmp r10d, 0x41df96e6
je 0x14007b535
test r11d, r11d
jne 0x14007b4d0
mov rax, qword [rax]
jmp 0x14007b4a0
mov ecx, dword [rsi + 0x24]
mov edx, ebp
add rcx, rbx
movzx r8d, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + r8*4]
mov rcx, qword [r15]
add rax, rbx
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
pop r15
pop r14
pop rdi
jmp rax
Function at 0x14007dd60
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x14007dd84
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x14007de12
mov rdi, r15
mov qword [rsp + 0x68], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x14007dde0
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x14007dde0
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.1402eefb0
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14007ddfd
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x14007de05
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x14007dda1
mov rbp, qword [rsp + 0x68]
sub r15, rdi
jmp 0x14007def0
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x14007de29
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14007de2b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14007de5d
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.1402eefb0
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14007deed
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14007de98
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x14007dece
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.1402c5974
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x14007deed
cmp rsi, rax
ja 0x14007dea1
test rsi, rsi
je 0x14007deed
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1402c5974
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x28]
mov rax, r15
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
Function at 0x14007df10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov r15, rdx
mov rbx, rcx
je 0x14007dfb1
mov rdi, r8
test r8, r8
jle 0x14007dfa9
lea rsi, [rcx + 0x58]
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x14007df83
mov rax, qword [rsi]
movsxd rdx, dword [rax]
test edx, edx
jle 0x14007df83
cmp rdi, rdx
mov rbp, rdi
cmovge rbp, rdx
mov rdx, r15
mov r8, rbp
call fcn.1402eefb0
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x40]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14007dfa1
mov rax, qword [rbx]
mov rcx, rbx
movzx edx, byte [r15]
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14007dfa9
dec rdi
lea rsi, [rbx + 0x58]
mov ebp, 1
add r15, rbp
test rdi, rdi
jg 0x14007df44
sub r14, rdi
mov rax, r14
jmp 0x14007e028
mov rax, qword [rcx + 0x40]
mov rsi, r14
mov r9, qword [rax]
test r9, r9
je 0x14007dfc8
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14007dfca
xor ecx, ecx
movsxd rdi, ecx
test r14, r14
jle 0x14007e022
test ecx, ecx
jle 0x14007e003
cmp r14, rdi
mov rcx, r9
cmovl rdi, r14
mov r8, rdi
call fcn.1402eefb0
mov rax, qword [rbx + 0x58]
add r15, rdi
sub r14, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x40]
movsxd rax, edi
add qword [rcx], rax
test r14, r14
jle 0x14007e022
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x14007e022
mov r8, r14
mov edx, 1
mov rcx, r15
call fcn.1402c4d78
sub r14, rax
sub rsi, r14
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14007ed80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14033c140]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14007edad
xor eax, eax
jmp 0x14007eefb
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14007ede7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14007ede7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14007eefb
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14007eeee
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14007ee2a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14007ee39
movsx ecx, dil
jmp 0x14007ee8d
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + gethostname]
test eax, eax
je 0x14007eea7
sub eax, 1
je 0x14007eea7
cmp eax, 2
jne 0x14007eeee
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.1402c4e14
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14007eef3
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14007eed4
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.1402c4d78
cmp rsi, rax
jne 0x14007eeee
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14007eef3
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1402bd6f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14008be50
Capabilities:
Hash data using sha512

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x1a0
mov rax, qword [0x14033c140]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ecx, ecx
lea rax, vtable.sw::templates::basic_sha512_char_.0
mov qword [rsp + 0x30], rax
movabs rax, 0x6a09e667f3bcc908
mov qword [rsp + 0x40], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rsp + 0x48], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rsp + 0x50], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rsp + 0x58], rax
movabs rax, 0x510e527fade682d1
mov qword [rsp + 0x60], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rsp + 0x68], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsp + 0x70], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x80], ecx
mov qword [rsp + 0x38], rcx
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x84]
call fcn.1402ef6f0
nop
mov r8, rdi
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14008c630
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.14008c100
nop
mov rax, rsi
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1402bd6f0
add rsp, 0x1a0
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400ad5b0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rbx, rdx
xor eax, eax
mov dword [rsp + 0x20], eax
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], rax
xor r8d, r8d
lea rdx, [0x14031ce4c]
mov rcx, rbx
call fcn.14008b1e0
mov dword [rsp + 0x20], 1
mov rcx, qword [0x14033ccc0]
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1400ad655
mov ecx, reloc.WS2_32.dll_listen
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400ad64f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x1400ad646
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1400ad630
mov rdx, rax
mov rcx, rbx
call fcn.14008b650
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400df590
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbp, rcx
mov r15, qword [rcx + 0x18]
test r15, r15
je 0x1400df681
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x1400df65c
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x1400df65c
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
mov r10d, 0x836fa9ea
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x1400df657
nop
movsx edx, r9b
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx r9d, byte [rcx]
lea rcx, [rcx + 1]
test r9b, r9b
jne 0x1400df620
cmp r10d, 0x5160ffd0
je 0x1400df664
test r11d, r11d
jne 0x1400df600
mov rax, qword [rax]
jmp 0x1400df5d0
mov edx, dword [rsi + 0x24]
add rdx, rbx
movzx r8d, word [rdx + r11*2]
mov edx, dword [rsi + 0x1c]
add rdx, rbx
mov eax, dword [rdx + r8*4]
add rax, rbx
mov rcx, r15
call rax
lea rcx, [rbp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.14008b2f0
Function at 0x1401a31b0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x14033c140]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, rdx
mov r15, rcx
mov qword [rsp + 0x30], rdx
cmp qword [rdx + 0x10], 0
jne 0x1401a31e8
xor eax, eax
jmp 0x1401a32bf
add rcx, 0x7e8
movups xmm0, xmmword [r8]
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rcx], xmm0
call fcn.1400a67f0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x1401a3299
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x1401a3299
mov r14d, dword [rsi + 0x20]
nop word [rax + rax]
dec r11d
lea rcx, [r14 + r11*4]
mov r8d, dword [rcx + rbx]
add r8, rbx
mov r10d, 0x23709bd0
movzx r9d, byte [r8]
inc r8
test r9b, r9b
je 0x1401a3294
movsx ecx, r9b
sub r9b, 0x41
mov edx, ecx
or edx, 0x20
cmp r9b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r9d, byte [r8]
lea r8, [r8 + 1]
test r9b, r9b
jne 0x1401a3260
cmp r10d, 0xbf364d02
je 0x1401a32a1
test r11d, r11d
jne 0x1401a3240
mov rax, qword [rax]
jmp 0x1401a3211
mov edx, dword [rsi + 0x1c]
add rdx, rbx
mov eax, dword [rsi + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov edx, dword [rdx + rax*4]
add rdx, rbx
call rdx
add eax, 0x1c84
mov dword [r15 + 0xc94], eax
mov byte [r15 + 0xc98], 1
mov rcx, rbp
call fcn.14008bcd0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1402bd6f0
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401c25c0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbp, rcx
mov r15, qword [rcx + 0x18]
test r15, r15
je 0x1401c26b0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x1401c268c
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x1401c268c
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
mov r10d, 0x836fa9ea
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x1401c2687
nop
movsx edx, r9b
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
movzx r9d, byte [rcx]
lea rcx, [rcx + 1]
test r9b, r9b
jne 0x1401c2650
cmp r10d, 0x5160ffd0
je 0x1401c2694
test r11d, r11d
jne 0x1401c2630
mov rax, qword [rax]
jmp 0x1401c2600
mov edx, dword [rsi + 0x1c]
add rdx, rbx
mov eax, dword [rsi + 0x24]
add rax, rbx
movzx eax, word [rax + r11*2]
mov edx, dword [rdx + rax*4]
add rdx, rbx
mov rcx, r15
call rdx
lea rcx, [rbp + 0x50]
call fcn.14008b2f0
nop
mov edx, 0x78
mov rcx, rbp
call fcn.1402bd710
mov rax, rbp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x14020fa40
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
lea r11, [0x14031d7d0]
mov r9, rdx
not ecx
cmp r8, 4
jb 0x14020fab9
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
add r9, 4
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x14020fa60
test r8, r8
je 0x14020fadd
nop
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x14020fac0
not ecx
mov eax, ecx
ret
Function at 0x1402132d0
Capabilities:
Write file on windows

Disassembly:
mov rax, r9
mov r10, r8
mov r9, rcx
mov r8, rax
mov rcx, r10
mov edx, 1
jmp fcn.1402c4d78
Function at 0x140257e80
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x140257f3d
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x140257f3d
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x9d45a6ac
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x140257f38
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x140257f00
cmp r10d, 0xc83b901e
je 0x140257f45
test r11d, r11d
jne 0x140257ee0
mov rax, qword [rax]
jmp 0x140257eb0
mov ecx, dword [rsi + 0x24]
mov rdi, qword [rsp + 0x18]
add rcx, rbx
mov r14, qword [rsp + 0x20]
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
mov rsi, qword [rsp + 0x10]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 8]
ret

Function at 0x140257f80
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14025803d
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14025803d
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0xd4097e02
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x140258038
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x140258000
cmp r10d, 0x7a87ef1e
je 0x140258045
test r11d, r11d
jne 0x140257fe0
mov rax, qword [rax]
jmp 0x140257fb0
mov ecx, dword [rsi + 0x24]
mov rdi, qword [rsp + 0x18]
add rcx, rbx
mov r14, qword [rsp + 0x20]
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
mov rsi, qword [rsp + 0x10]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 8]
ret
Function at 0x140258080
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14025813d
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14025813d
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x902437d2
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x140258138
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x140258100
cmp r10d, 0xbc8493e4
je 0x140258145
test r11d, r11d
jne 0x1402580e0
mov rax, qword [rax]
jmp 0x1402580b0
mov ecx, dword [rsi + 0x24]
mov rdi, qword [rsp + 0x18]
add rcx, rbx
mov r14, qword [rsp + 0x20]
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
mov rsi, qword [rsp + 0x10]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 8]
ret

Function at 0x140258180
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x14025823d
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14025823d
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x48ada115
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x140258238
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x140258200
cmp r10d, 0xfff8f295
je 0x140258245
test r11d, r11d
jne 0x1402581e0
mov rax, qword [rax]
jmp 0x1402581b0
mov ecx, dword [rsi + 0x24]
mov rdi, qword [rsp + 0x18]
add rcx, rbx
mov r14, qword [rsp + 0x20]
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
mov rsi, qword [rsp + 0x10]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
mov rbx, qword [rsp + 8]
ret