joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004aa40
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
call fcn.14004ac80
xor ebx, ebx
mov r11, rax
cmp byte [rax + 0xc], bl
jne 0x14004aac2
lea rcx, [rax + 0x10]
mov r8d, ebx
nop dword [rax + rax]
mov eax, dword [r11 + 4]
mov edx, dword [r11]
lea r9d, [rax + 1]
cmp edx, r9d
je 0x14004aaa7
lea r9d, [rax + 2]
cmp edx, r9d
je 0x14004aaa7
cmp edx, eax
je 0x14004aaaf
lea r9d, [rax + 4]
cmp edx, r9d
jne 0x14004aaa0
add eax, 3
xor dword [rcx], eax
inc dword [r11]
jmp 0x14004aa70
add eax, 5
cmp edx, eax
jne 0x14004aab5
xor dword [rcx], r9d
inc dword [r11]
jmp 0x14004aa70
lea eax, [r8 - 0x74]
xor dword [rcx], eax
inc r8d
add rcx, 4
cmp r8d, 1
jb 0x14004aa70
mov edi, dword [r11 + 0x10]
mov byte [r11 + 0xc], 1
call fcn.14004abf0
mov r11, rax
cmp byte [rax + 9], bl
jne 0x14004ab60
mov r8d, ebx
nop
mov edx, dword [r11 + 4]
mov r9d, dword [r11]
lea ecx, [rdx + 1]
cmp r9d, ecx
jne 0x14004aafe
movsxd rax, r8d
inc dl
xor byte [rax + r11 + 0xa], dl
inc dword [r11]
jmp 0x14004aae0
lea eax, [rdx + 2]
cmp r9d, eax
jne 0x14004ab16
movsxd rax, r8d
add dl, 2
xor byte [rax + r11 + 0xa], dl
inc dword [r11]
jmp 0x14004aae0
cmp r9d, edx
je 0x14004ab4b
lea eax, [rdx + 4]
cmp r9d, eax
jne 0x14004ab33
movsxd rax, r8d
add dl, 3
xor byte [rax + r11 + 0xa], dl
inc dword [r11]
jmp 0x14004aae0
lea eax, [rdx + 5]
cmp r9d, eax
jne 0x14004ab57
movsxd rax, r8d
add dl, 4
xor byte [rax + r11 + 0xa], dl
inc dword [r11]
jmp 0x14004aae0
movsxd rdx, r8d
lea eax, [r8 - 0x74]
xor byte [rdx + r11 + 0xa], al
inc r8d
cmp r8d, 1
jb 0x14004aae0
mov rcx, rsi
mov byte [r11 + 9], 1
call fcn.14003f580
mov rdx, rax
lea r8, [r11 + 0xa]
mov r9d, edi
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call fcn.14004ad10
mov r11, rax
cmp byte [rax + 0xc], bl
jne 0x14004abdf
lea rcx, [rax + 0x10]
mov eax, dword [r11 + 4]
mov edx, dword [r11]
lea r8d, [rax + 1]
cmp edx, r8d
je 0x14004abc7
lea r8d, [rax + 2]
cmp edx, r8d
je 0x14004abc7
cmp edx, eax
je 0x14004abcf
lea r8d, [rax + 4]
cmp edx, r8d
jne 0x14004abc0
add eax, 3
xor dword [rcx], eax
inc dword [r11]
jmp 0x14004ab90
add eax, 5
cmp edx, eax
jne 0x14004abd4
xor dword [rcx], r8d
inc dword [r11]
jmp 0x14004ab90
lea eax, [rbx - 0x73]
xor dword [rcx], eax
inc ebx
add rcx, 4
cmp ebx, 1
jb 0x14004ab90
mov ecx, dword [r11 + 0x10]
mov byte [r11 + 0xc], 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14004e900
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov rax, qword gs:[0x60]
test rax, rax
je 0x14004e98a
mov rbx, qword [rax + 0x18]
add rbx, 0x10
mov r9, qword [rbx]
cmp r9, rbx
je 0x14004e98a
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r9 + 0x60]
mov r10d, 0x811c9dc5
movzx ecx, word [r9 + 0x58]
shr rcx, 1
lea r11, [rax + rcx*2]
cmp rax, r11
je 0x14004e982
nop dword [rax + rax]
movsx ecx, byte [rax]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
add rax, 2
xor r8d, r10d
imul r10d, r8d, 0x1000193
cmp rax, r11
jne 0x14004e950
cmp r10d, 0xa62a3b3b
je 0x14004e992
mov r9, qword [r9]
cmp r9, rbx
jne 0x14004e930
xor eax, eax
mov rbx, qword [rsp + 8]
ret
mov rax, qword [r9 + 0x30]
mov rbx, qword [rsp + 8]
ret

Function at 0x14004eb80
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14004ec5d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14004ec5d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14004ebca
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14004ebd2
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14004ec5d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14004ec55
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14004ec20
cmp r10d, 0xbf21a4fa
je 0x14004ec74
inc r9
cmp r9, rbx
jb 0x14004ec00
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14004ec5f
Function at 0x14004ec90
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14004ed6d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14004ed6d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14004ecda
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14004ece2
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14004ed6d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14004ed65
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14004ed30
cmp r10d, 0x97085561
je 0x14004ed84
inc r9
cmp r9, rbx
jb 0x14004ed10
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14004ed6f

Function at 0x14004eda0
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14004ee7d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14004ee7d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14004edea
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14004edf2
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14004ee7d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14004ee75
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14004ee40
cmp r10d, 0x3d71f40a
je 0x14004ee94
inc r9
cmp r9, rbx
jb 0x14004ee20
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14004ee7f
Function at 0x14004eeb0
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14004ef8d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14004ef8d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14004eefa
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14004ef02
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14004ef8d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14004ef85
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14004ef50
cmp r10d, 0xe054604a
je 0x14004efa4
inc r9
cmp r9, rbx
jb 0x14004ef30
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14004ef8f

Function at 0x14004efc0
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14004f09d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14004f09d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14004f00a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14004f012
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14004f09d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14004f095
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14004f060
cmp r10d, 0xddeaabca
je 0x14004f0b4
inc r9
cmp r9, rbx
jb 0x14004f040
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14004f09f
Function at 0x14004f0d0
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14004f1ad
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14004f1ad
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14004f11a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14004f122
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14004f1ad
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14004f1a5
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14004f170
cmp r10d, 0x4ecb007a
je 0x14004f1c4
inc r9
cmp r9, rbx
jb 0x14004f150
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14004f1af

Function at 0x14004f1e0
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14004f2bd
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14004f2bd
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14004f22a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14004f232
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14004f2bd
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14004f2b5
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14004f280
cmp r10d, 0xde10f3da
je 0x14004f2d4
inc r9
cmp r9, rbx
jb 0x14004f260
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14004f2bf
Function at 0x14004f2f0
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14004f3cd
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14004f3cd
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14004f33a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14004f342
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14004f3cd
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14004f3c5
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14004f390
cmp r10d, 0xd07708df
je 0x14004f3e4
inc r9
cmp r9, rbx
jb 0x14004f370
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14004f3cf

Function at 0x14004f400
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14004f4dd
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14004f4dd
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14004f44a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14004f452
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14004f4dd
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14004f4d5
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14004f4a0
cmp r10d, 0xe049c205
je 0x14004f4f4
inc r9
cmp r9, rbx
jb 0x14004f480
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14004f4df
Function at 0x14004f510
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14004f5ed
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14004f5ed
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14004f55a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14004f562
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14004f5ed
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14004f5e5
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14004f5b0
cmp r10d, 0xe082843
je 0x14004f604
inc r9
cmp r9, rbx
jb 0x14004f590
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14004f5ef

Function at 0x14004f620
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14004f6fd
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14004f6fd
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14004f66a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14004f672
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14004f6fd
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14004f6f5
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14004f6c0
cmp r10d, 0x1a946df0
je 0x14004f714
inc r9
cmp r9, rbx
jb 0x14004f6a0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14004f6ff
Function at 0x14004f730
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14004f80d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14004f80d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14004f77a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14004f782
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14004f80d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14004f805
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14004f7d0
cmp r10d, 0x3546aa24
je 0x14004f824
inc r9
cmp r9, rbx
jb 0x14004f7b0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14004f80f

Function at 0x14004f840
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14004f91d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14004f91d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14004f88a
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14004f892
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14004f91d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14004f915
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14004f8e0
cmp r10d, 0xd8133d9d
je 0x14004f934
inc r9
cmp r9, rbx
jb 0x14004f8c0
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14004f91f
Function at 0x14004fb80
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14004fc5d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14004fc5d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14004fbca
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14004fbd2
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14004fc5d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14004fc55
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14004fc20
cmp r10d, 0xa623a735
je 0x14004fc74
inc r9
cmp r9, rbx
jb 0x14004fc00
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14004fc5f

Function at 0x14004fc90
Capabilities:
Encode data using xor
Hash data using fnv
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov eax, 0x5a4d
mov r11, rcx
cmp word [rcx], ax
jne 0x14004fd6d
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x14004fd6d
mov ecx, 0x20b
cmp word [rax + r11 + 0x18], cx
je 0x14004fcda
mov ecx, dword [rax + r11 + 0x78]
jmp 0x14004fce2
mov ecx, dword [rax + r11 + 0x88]
mov eax, ecx
xor r9d, r9d
mov esi, dword [rax + r11 + 0x1c]
mov edi, dword [rax + r11 + 0x20]
add rsi, r11
mov ebp, dword [rax + r11 + 0x24]
add rdi, r11
mov ebx, dword [rax + r11 + 0x18]
add rbp, r11
test rbx, rbx
je 0x14004fd6d
nop dword [rax]
mov eax, dword [rdi + r9*4]
mov r10d, 0x811c9dc5
add rax, r11
movzx r8d, byte [rax]
inc rax
test r8b, r8b
je 0x14004fd65
nop dword [rax]
movsx ecx, r8b
lea rax, [rax + 1]
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
movzx r8d, byte [rax - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r8b, r8b
jne 0x14004fd30
cmp r10d, 0xb63ca8f7
je 0x14004fd84
inc r9
cmp r9, rbx
jb 0x14004fd10
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
movzx eax, word [rbp + r9*2]
mov eax, dword [rsi + rax*4]
add rax, r11
jmp 0x14004fd6f