joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140157d50
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x1a8]
sub rsp, 0x2a0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x14035f028]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], send
mov byte [rcx], dil
lea rdx, [0x140308f30]
call fcn.140019190
mov dword [rsp + 0x20], 1
xor edx, edx
mov r8d, SHFlushSFCache
lea rcx, [rbp - 0x80]
call fcn.140022cb0
lea rdx, [rbp - 0x80]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x140157e7b
movdqa xmm0, xmmword [0x14030b010]
movdqu xmmword [rsp + 0x68], xmm0
mov word [rsp + 0x58], di
lea rcx, [rbp - 0x80]
call fcn.14003e7e0
mov r8, rax
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x58]
call fcn.14000e0cc
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.140176ed8
mov rdx, rax
mov rcx, rbx
call fcn.140018034
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140157e5e
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140157e59
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140157ea2
call fcn.140020950
movdqa xmm0, xmmword [0x14030b020]
movdqu xmmword [rsp + 0x48], xmm0
mov byte [rsp + 0x38], dil
lea rcx, [rsp + 0x58]
call fcn.140007b58
mov rax, rbx
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140020930
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14002edac
int3

Function at 0x140157eb0
Capabilities:
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rdi, edx
mov rbx, rcx
cmp byte [rdi + rcx], 0
jne 0x140157ecd
mov eax, 0x1505
jmp 0x140157edd
inc edx
call fcn.140157eb0
movsx ecx, byte [rdi + rbx]
imul eax, eax, 0x21
xor eax, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140172d88
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x14035f028]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x104
call fcn.140022cb0
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0x30], rax
lea r8, str.CommercialId
lea rax, [rsp + 0x50]
mov r9d, 2
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesDataCollection
and qword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
and qword [rbx + 0x10], 0
lea rdx, [rsp + 0x50]
mov qword [rbx + 0x18], send
mov rcx, rbx
mov byte [rbx], 0
call fcn.140019190
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140020930
add rsp, 0x170
pop rbx
ret

Function at 0x140172e3c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x14035f028]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x50]
xor edx, edx
mov r8d, 0x104
call fcn.140022cb0
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0x30], rax
lea r8, str.BuildLabEx
lea rax, [rsp + 0x50]
mov r9d, 0x10002
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
and qword [rsp + 0x20], 0
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
and qword [rbx + 0x10], 0
lea rdx, [rsp + 0x50]
mov qword [rbx + 0x18], send
mov rcx, rbx
mov byte [rbx], 0
call fcn.140019190
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140020930
add rsp, 0x170
pop rbx
ret
Function at 0x14019a7c8
Capabilities:
Create http request

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rdi, rcx
lea rax, vtable.Microsoft::Applications::Events::HttpClient_WinInet.0
mov qword [rcx], rax
add rcx, 0x10
mov edx, 0x102
call fcn.14010e59c
nop
lea rbx, [rdi + 0x60]
mov qword [rsp + 0x58], rbx
and qword [rbx], 0
and qword [rbx + 8], 0
mov rcx, rbx
call fcn.14016cf7c
mov qword [rbx], rax
mov byte [rdi + 0x70], 0
mov dword [rsp + 0x20], 0x10000000
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rdi + 8], rax
mov rax, rdi
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1401c8b24
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140112f10
or dword [rbx + 0x1384], 0xffffffff
lea r8, [rbx + 8]
mov dword [rbx + 4], eax
mov ecx, 1
mov r9d, 0x26f
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
inc ecx
mov dword [r8], eax
lea r8, [r8 + 4]
sub r9, 1
jne 0x1401c8b4b
movabs rax, 0x3ff0000000000000
mov dword [rbx], 0x270
and qword [rbx + 0x1388], r9
mov qword [rbx + 0x1390], rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
sub rsp, 0x428
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x410], rax
lea rdx, [rsp + 0x30]
mov ecx, 7
lea rax, [0x1400022a0]
nop word [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x140001030
mov ecx, dword [rax + 0x50]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rdx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rdx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rdx + 0x30], xmm1
movups xmmword [rdx + 0x40], xmm0
mov dword [rdx + 0x50], ecx
movzx ecx, word [rax + 0x54]
mov word [rdx + 0x54], cx
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.EnumDateFormatsA
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
mov edx, 0x400
xor ecx, ecx
call rax
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.VirtualProtect
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0
mov edx, 8
lea rcx, [rsp + 0x30]
mov r8d, 0x40
call rax
lea rax, [rsp + 0x30]
call rax
xor eax, eax
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.140001150
add rsp, 0x428
ret

Function at 0x140001a18
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001a62
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001a62
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001a62
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001a62
cmp dword [rcx + 0x84], 0xe
jbe 0x140001a62
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001a64
xor al, al
add rsp, 0x28
ret
Function at 0x140007ef0
Capabilities:
Delete registry key

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp + 0x17], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov rax, qword [0x1402e7080]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor eax, eax
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], rax
mov qword [rbp + 0x37], rax
mov qword [rbp + 0x3f], rax
xor ebx, ebx
mov qword [rbp - 0x39], rbx
mov qword [rbp - 0x21], rbx
mov qword [rbp - 0x19], rbx
lea ecx, [rax + 0x10]
call fcn.140004af0
mov qword [rbp - 0x39], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rbp - 0x39]
mov rax, qword [rbp - 0x39]
mov qword [rax], rcx
mov qword [rbp - 0x21], rbx
mov qword [rbp - 0x19], 7
mov word [rbp - 0x31], bx
lea r8d, [rbx + 0x6a]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssistF4E57C4B_2036_45F0_A9AB_443BCFE33D9FCount
lea rcx, [rbp - 0x39]
call fcn.140013c40
nop
mov qword [rbp - 0x11], rbx
xorps xmm0, xmm0
movdqa xmmword [rbp + 7], xmm0
lea ecx, [rbx + 0x10]
call fcn.140004af0
mov qword [rbp - 0x11], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rbp - 0x11]
mov rax, qword [rbp - 0x11]
mov qword [rax], rcx
movdqa xmm0, xmmword [0x1402cb9e0]
movdqa xmmword [rbp + 7], xmm0
mov word [rbp - 9], bx
lea r8d, [rbx + 0x6a]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssistCEBFF5CD_ACE2_4F4F_9178_9926F41749EACount
lea rcx, [rbp - 0x11]
call fcn.140013c40
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea ecx, [rbx + 0x10]
call fcn.140004af0
mov qword [rbp + 0x27], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rbp + 0x27]
mov rax, qword [rbp + 0x27]
mov qword [rax], rcx
lea r8, [rbp + 0x17]
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 0x27]
call fcn.1400169f0
nop
lea r9, [fcn.140006f60]
lea edx, [rbx + 0x28]
lea r8d, [rbx + 2]
lea rcx, [rbp - 0x39]
call fcn.140068740
mov rdi, qword [rbp + 0x37]
mov rbx, qword [rbp + 0x2f]
cmp rbx, rdi
je 0x140008096
add rbx, 8
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140008042
mov rdx, qword [rbx]
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140008089
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140008072
mov rdx, qword [rbx]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rbp + 0x1f]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rbx, 0x28
lea rax, [rbx - 8]
cmp rax, rdi
jne 0x140008035
lea rcx, [rbp + 0x27]
call fcn.140013770
lea rcx, [rbp + 0x27]
call fcn.140001a50
mov edx, 0x10
mov rcx, qword [rbp + 0x27]
call fcn.140068260
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400681e0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400080e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x160
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x170], rbx
mov rax, qword [0x1402e7080]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rdx
mov qword [rsp + 0x38], rdx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftCryptography
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000818b
xor edi, edi
mov qword [rbx], rdi
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x20], rdi
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rbx], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov rcx, qword [rbx]
mov qword [rcx], rbx
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x20], 0xf
mov byte [rbx + 8], dil
xor r8d, r8d
lea rdx, [0x1401cc042]
mov rcx, rbx
call fcn.140014260
nop
jmp 0x140008278
mov dword [rsp + 0x48], 0x100
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.MachineGuid
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x40]
test eax, eax
je 0x140008217
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov qword [rbx], rdi
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x20], rdi
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rbx], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov rax, qword [rbx]
mov qword [rax], rbx
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x20], 0xf
mov byte [rbx + 8], dil
xor r8d, r8d
lea rdx, [0x1401cc042]
mov rcx, rbx
call fcn.140014260
nop
jmp 0x140008278
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov qword [rbx], rdi
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x20], rdi
lea ecx, [rdi + 0x10]
call fcn.140004af0
mov qword [rbx], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov rax, qword [rbx]
mov qword [rax], rbx
mov qword [rbx + 0x18], rdi
mov qword [rbx + 0x20], 0xf
mov byte [rbx + 8], dil
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140008260
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140014260
nop
mov rax, rbx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400681e0
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x140012820
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400128ba
mov rbx, r8
test r8, r8
jle 0x1400128b2
mov rcx, rdi
call fcn.140014930
test rax, rax
jle 0x140012890
mov rcx, qword [rdi + 0x40]
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov r8, rsi
mov rcx, qword [rcx]
call fcn.1400b5b30
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x1400128aa
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400128b2
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x140012852
sub r14, rbx
mov rax, r14
jmp 0x140012931
mov rax, qword [rcx + 0x40]
mov rsi, r14
mov r9, qword [rax]
test r9, r9
je 0x1400128d1
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400128d3
xor ecx, ecx
movsxd rbx, ecx
test r14, r14
jle 0x14001292b
test ecx, ecx
jle 0x140012907
cmp r14, rbx
mov rcx, r9
cmovl rbx, r14
mov r8, rbx
call fcn.1400b5b30
mov rax, qword [rdi + 0x58]
add rbp, rbx
sub r14, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x40]
movsxd rax, ebx
add qword [rcx], rax
test r14, r14
jle 0x14001292b
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14001292b
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.1400cab00
sub r14, rax
sub rsi, r14
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140012950
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rsi, rdx
mov rbx, rcx
je 0x1400129eb
mov rdi, r8
test r8, r8
jle 0x1400129e0
mov rcx, rbx
call fcn.140014950
test rax, rax
jle 0x1400129c0
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.1400b5b30
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400129d8
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1400129e0
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140012982
sub r14, rdi
mov rax, r14
jmp 0x140012a9a
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140012a02
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140012a04
xor ecx, ecx
movsxd rdi, ecx
test r14, r14
jle 0x140012a94
test ecx, ecx
jle 0x140012a3c
cmp r14, rdi
mov rcx, rsi
cmovl rdi, r14
mov r8, rdi
call fcn.1400b5b30
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub r14, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
test r14, r14
jle 0x140012a94
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x140012a94
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140012a81
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov r9, qword [rbx + 0x80]
mov r8, r14
mov edx, 1
mov rcx, rsi
call fcn.1400cc510
sub r14, rax
sub rbp, r14
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140012ee0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1402e7080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140012f0d
xor eax, eax
jmp 0x140013053
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140012f47
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140012f47
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140013053
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140013046
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140012f8a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140012f99
movsx ecx, dil
jmp 0x140012fed
lea r8, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x51]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x140013046
cmp eax, 1
jle 0x140013007
cmp eax, 3
jne 0x140013046
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call fcn.1400bd640
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14001304b
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140013034
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call fcn.1400cab00
cmp rsi, rax
jne 0x140013046
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x14001304b
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400681e0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x14001caa0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor r9d, r9d
test r8, r8
je 0x14001cad4
movabs r10, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + rdx]
inc r9
xor rcx, rax
imul rcx, r10
cmp r9, r8
jb 0x14001cac0
mov rax, rcx
ret
Function at 0x140022770
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1402e7080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, 0xffff
movzx edi, dx
mov rbx, rcx
cmp si, dx
jne 0x1400227ab
xor eax, eax
cmp dx, si
cmove di, ax
movzx eax, di
jmp 0x1400228f8
mov rax, qword [rcx + 0x40]
mov r8, qword [rax]
test r8, r8
je 0x1400227e7
mov rax, qword [rcx + 0x58]
movsxd r9, dword [rax]
lea rdx, [r8 + r9*2]
cmp r8, rdx
jae 0x1400227e7
lea ecx, [r9 - 1]
mov dword [rax], ecx
movzx eax, di
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 2]
mov qword [rdx], rcx
mov word [r8], di
jmp 0x1400228f8
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xb0], rbp
je 0x1400228ed
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14002282e
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140022857
movzx ecx, di
mov rdx, qword [rbx + 0x80]
call fcn.1400cd0b0
cmp ax, si
je 0x1400228ed
movzx esi, di
jmp 0x1400228ed
lea r8, [rsp + 0x40]
mov word [rsp + 0x50], di
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x52]
lea r8, [rsp + 0x78]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x48]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x50]
call qword [rax + 0x38]
test eax, eax
js 0x1400228ed
cmp eax, 1
jle 0x1400228ad
cmp eax, 3
jne 0x1400228ed
movzx ecx, word [rsp + 0x50]
jmp 0x14002283a
mov rbp, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbp, rax
je 0x1400228da
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbp
mov edx, 1
call fcn.1400cab00
cmp rbp, rax
jne 0x1400228ed
lea rax, [rsp + 0x50]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0x48], rax
movzx eax, di
jne 0x1400228f0
movzx eax, si
mov rbp, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400681e0
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret

Function at 0x140022f00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1402e7080]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140022fb1
cmp byte [rcx + 0x72], 0
je 0x140022fb1
mov rax, qword [rcx]
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140022f73
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x140022f77
sub eax, 1
je 0x140022f7b
sub eax, 2
je 0x140022fb1
xor al, al
jmp 0x140022fb3
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140022fa8
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.1400cab00
cmp rdi, rax
jne 0x140022f73
cmp byte [rbx + 0x72], 0
sete al
jmp 0x140022fb3
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400681e0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400231f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
xor r8d, r8d
movabs rax, 0xcbf29ce484222325
test r9, r9
je 0x140023224
movabs r10, 0x100000001b3
movzx edx, byte [r8 + rcx]
inc r8
xor rax, rdx
imul rax, r10
cmp r8, r9
jb 0x140023210
ret

Function at 0x140024b50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1300]
mov eax, 0x1400
call fcn.140110410
sub rsp, rax
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x1420], rbx
mov rax, qword [0x1402e7080]
xor rax, rsp
mov qword [rbp + 0x12f0], rax
mov ebx, r8d
mov rdi, rdx
mov qword [rsp + 0x28], rdx
call fcn.140037570
mov rcx, rax
mov dword [rbp + 0x12e4], 0xffffffff
mov dword [rsp + 0x64], eax
mov r8d, 1
mov edx, r8d
nop word [rax + rax]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, r8d
mov dword [rsp + rdx*4 + 0x64], ecx
inc r8d
inc rdx
cmp rdx, 0x270
jl 0x140024bc0
mov dword [rsp + 0x60], 0x270
xor esi, esi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rsi
lea ecx, [rsi + 0x10]
call fcn.140004af0
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x30]
mov qword [rax], rcx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], sil
movsxd rdx, ebx
lea rcx, [rsp + 0x30]
call fcn.140011e50
test ebx, ebx
jle 0x140024c5c
lea rcx, [rsp + 0x60]
call fcn.140025f60
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.1400140e0
sub rbx, 1
jne 0x140024c40
mov qword [rdi], rsi
mov qword [rdi + 0x18], rsi
mov qword [rdi + 0x20], rsi
mov ecx, 0x10
call fcn.140004af0
mov qword [rdi], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov rax, qword [rdi]
mov qword [rax], rdi
cmp qword [rsp + 0x50], 0x10
jb 0x140024c97
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.140001ae0
jmp 0x140024ca1
lea rcx, [rsp + 0x30]
call fcn.140001a50
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rdi + 8], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rdi + 0x18], xmm1
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
lea rcx, [rsp + 0x30]
call fcn.140004810
lea rcx, [rsp + 0x30]
call fcn.140001a50
mov edx, 0x10
mov rcx, qword [rsp + 0x30]
call fcn.140068260
mov rax, rdi
mov rcx, qword [rbp + 0x12f0]
xor rcx, rsp
call fcn.1400681e0
mov rbx, qword [rsp + 0x1420]
add rsp, 0x1400
pop rdi
pop rsi
pop rbp
ret