joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51c0f0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00731420]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x51c15d
mov rcx, r8
call fcn.0051bfd0
test eax, eax
je 0x51c15d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x51c15d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x51c154
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x51c15f
add rax, 0x28
cmp rax, r9
jne 0x51c140
xor eax, eax
add rsp, 0x28
ret

Function at 0x51c610
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.0051c4e0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.0051c4e0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x1400011e0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xorps xmm0, xmm0
lea rcx, str.ntdll.dll
mov r15, rax
xor eax, eax
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9d, 0x18
lea r8, [rsp + 0x50]
mov rdx, rax
mov qword [rsp + 0x40], rax
mov rcx, r15
mov r12, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rbp, qword [rsp + 0x50]
lea rcx, str.c:windows_system32_ntdll.dll
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0x80000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
mov rcx, rax
mov dword [rsp + 0x20], ebx
xor edx, edx
mov r8d, 0x1000002
mov r13, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea edx, [rbx + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
movsxd rsi, dword [rbp + 0x3c]
movzx edi, bx
add rsi, rbp
mov r14, rax
cmp bx, word [rsi + 6]
jae 0x140001378
lea r8, str..text
xor r12d, r12d
movzx ecx, word [rsi + 0x14]
movzx eax, di
add rcx, rsi
lea rdx, [rax + rax*4]
mov rax, r12
lea rbx, [rcx + rdx*8]
nop word [rax + rax]
movzx ecx, byte [rbx + rax + 0x18]
inc rax
cmp cl, byte [r8 + rax - 1]
jne 0x140001366
cmp rax, 6
jne 0x140001300
mov ecx, dword [rbx + 0x24]
lea r9, [rsp + 0x68]
mov edx, dword [rbx + 0x20]
lea r8d, [rax + 0x3a]
add rcx, rbp
mov dword [rsp + 0x68], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rbx + 0x24]
mov r8d, dword [rbx + 0x20]
lea rdx, [rax + r14]
lea rcx, [rax + rbp]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rbx + 0x24]
lea r9, [rsp + 0x68]
mov edx, dword [rbx + 0x20]
add rcx, rbp
mov r8d, dword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r8, str..text
inc di
cmp di, word [rsi + 6]
jb 0x1400012e0
mov r12, qword [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400021b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x2fc4d4250
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d4c52
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4f9108]
test eax, eax
je 0x2fc4d4cea
lea rax, [0x2fc4f90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4f9110]
mov qword [rbp - 8], rax
jmp 0x2fc4d4cce
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d4cc2
cmp qword [rbp - 0x10], 0
je 0x2fc4d4cc2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d4c88
lea rax, [0x2fc4f90e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d4ceb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d4df0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d4e18
mov eax, 0
jmp 0x2fc4d4e66
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d4e41
mov eax, 0
jmp 0x2fc4d4e66
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d4e61
mov eax, 0
jmp 0x2fc4d4e66
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d4e6c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d4eea
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d4ee1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d4ee1
mov rax, qword [rbp - 8]
jmp 0x2fc4d4eff
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d4eb4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d9830
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4da232
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fe108]
test eax, eax
je 0x2fc4da2ca
lea rax, [0x2fc4fe0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fe110]
mov qword [rbp - 8], rax
jmp 0x2fc4da2ae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4da2a2
cmp qword [rbp - 0x10], 0
je 0x2fc4da2a2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4da268
lea rax, [0x2fc4fe0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4da2cb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4da3d0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4da3f8
mov eax, 0
jmp 0x2fc4da446
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4da421
mov eax, 0
jmp 0x2fc4da446
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4da441
mov eax, 0
jmp 0x2fc4da446
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4da44c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4da4ca
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4da4c1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4da4c1
mov rax, qword [rbp - 8]
jmp 0x2fc4da4df
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4da494
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140028a5c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14001bef8
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14001bef8
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140028bac
cmp rax, 0xffffffffffffffff
je 0x140028bac
xor edi, edi
test rbp, rbp
jle 0x140028b57
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14001eb84
mov rbx, rax
test rax, rax
jne 0x140028ae4
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140028b4d
mov edx, 0x8000
mov ecx, r14d
call fcn.1400197a0
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14001cbe0
cmp eax, 0xffffffff
je 0x140028b2d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140028af4
mov edx, r15d
mov ecx, r14d
call fcn.1400197a0
jmp 0x140028b4d
cmp byte [rsi + 0x38], dil
je 0x140028b44
cmp dword [rsi + 0x34], 5
jne 0x140028b44
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140028b4d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14001a0e4
jmp 0x140028bc0
jns 0x140028bc0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14001bef8
cmp rax, 0xffffffffffffffff
jne 0x140028b78
cmp byte [rsi + 0x30], dil
je 0x140028bc0
mov edi, dword [rsi + 0x2c]
jmp 0x140028bc0
mov ecx, r14d
call fcn.1400182d0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140028bc0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140028bc0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140028bb9
mov eax, dword [rsi + 0x2c]
jmp 0x140028bbe
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14001bef8
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140029cb0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140029cd8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140029cd8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x140ff52a0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140ff52aa
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140ff52d3
pop rbp
sub rbp, 0x33
sub rbp, 0xff52a0
sub rsp, 0x20
jmp 0x140ff52f2
mov rax, 0xff52a0
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x4d42f747
xor byte [rax], dl
inc rax
dec rcx
jne 0x140ff5311
jmp 0x140ff5328
bswap esi
scasb al, byte [rdi]
int3
Function at 0x140013910
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x140013aee
mov rsi, rcx
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov ebx, 1
shl rbx, cl
lea rax, [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, rdi
call fcn.14000f170
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov rax, qword [rsi + 8]
mov rax, qword [rax]
cmp rax, rdi
je 0x140013ae2
movabs rcx, 0x100000001b3
movabs rdx, 0xcbf29ce484222325
jmp 0x1400139b1
mov qword [r9 + r10*8], r8
mov qword [r9 + rbx*8], r8
cmp rax, rdi
je 0x140013ae2
mov r8, rax
mov rax, qword [rax]
movzx r9d, byte [r8 + 0x10]
xor r9, rdx
imul r9, rcx
movzx r10d, byte [r8 + 0x11]
xor r10, r9
imul r10, rcx
movzx r9d, byte [r8 + 0x12]
xor r9, r10
imul r9, rcx
movzx r10d, byte [r8 + 0x13]
xor r10, r9
imul r10, rcx
movzx r9d, byte [r8 + 0x14]
xor r9, r10
imul r9, rcx
movzx r10d, byte [r8 + 0x15]
xor r10, r9
imul r10, rcx
movzx r9d, byte [r8 + 0x16]
xor r9, r10
imul r9, rcx
movzx r11d, byte [r8 + 0x17]
xor r11, r9
imul r11, rcx
and r11, qword [rsi + 0x30]
mov r9, qword [rsi + 0x18]
lea r10, [r11 + r11]
lea rbx, [r11*2 + 1]
shl r11, 4
mov r11, qword [r9 + r11]
cmp r11, rdi
je 0x1400139a0
mov r14, qword [r9 + rbx*8]
mov r15, qword [r8 + 0x10]
cmp r15, qword [r14 + 0x10]
jne 0x140013a80
mov r10, qword [r14]
cmp r10, r8
je 0x1400139a4
mov r11, qword [r8 + 8]
mov qword [r11], rax
mov r14, qword [rax + 8]
mov qword [r14], r10
mov r15, qword [r10 + 8]
mov qword [r15], r8
mov qword [r10 + 8], r14
mov qword [rax + 8], r11
mov qword [r8 + 8], r15
jmp 0x1400139a4
cmp r11, r14
je 0x140013ab8
mov r14, qword [r14 + 8]
cmp r15, qword [r14 + 0x10]
jne 0x140013a80
mov r9, qword [r14]
mov r10, qword [r8 + 8]
mov qword [r10], rax
mov r11, qword [rax + 8]
mov qword [r11], r9
mov rbx, qword [r9 + 8]
mov qword [rbx], r8
mov qword [r9 + 8], r11
mov qword [rax + 8], r10
mov qword [r8 + 8], rbx
jmp 0x1400139a8
mov rbx, qword [r8 + 8]
mov qword [rbx], rax
mov r14, qword [rax + 8]
mov qword [r14], r11
mov r15, qword [r11 + 8]
mov qword [r15], r8
mov qword [r11 + 8], r14
mov qword [rax + 8], rbx
mov qword [r8 + 8], r15
mov qword [r9 + r10*8], r8
jmp 0x1400139a8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.1400a190c
int3
Function at 0x140036e00
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x468
mov rax, qword [0x1400fe980]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
mov ebp, 0xfffffffc
test rdx, rdx
je 0x140036ea8
mov r13d, r9d
mov r12d, r8d
mov rdi, rcx
lea rax, [0x1400f2acb]
mov rcx, rdx
mov rdx, rax
call fcn.1400b1bac
test rax, rax
je 0x140036ea8
mov rsi, rax
mov rcx, rax
xor edx, edx
mov r8d, 2
call fcn.1400af020
test eax, eax
jne 0x140036ea0
mov rcx, rsi
call fcn.1400b25a0
mov ebx, eax
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call fcn.1400af020
test eax, eax
jne 0x140036ea0
lea eax, [rbx - 0x400001]
cmp eax, 0xffbfffff
ja 0x140036ece
mov rcx, rsi
call fcn.1400b1248
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400a1150
mov eax, ebp
add rsp, 0x468
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15d, ebx
cmp ebx, 0x401
jae 0x140036ee0
lea r14, [rsp + 0x60]
jmp 0x140036ef0
mov rcx, r15
call fcn.1400455f0
mov r14, rax
test rax, rax
je 0x140036ea0
mov edx, 1
mov rcx, r14
mov r8, r15
mov r9, rsi
call fcn.1400b21dc
mov ebp, 0xfffffffc
cmp rax, r15
jne 0x140037019
mov r9d, r13d
cmp r13d, 0x16
jne 0x140036fa2
lea rdx, [rsp + 0x58]
lea r8, [rsp + 0x50]
mov ecx, 5
call fcn.14006b630
test eax, eax
je 0x140036f6d
lea rdx, [rsp + 0x58]
lea r8, [rsp + 0x50]
xor ecx, ecx
call fcn.14006b630
test eax, eax
je 0x140036f8a
cmp ebx, 0x401
jb 0x140036f5b
mov rcx, r14
call fcn.140045610
mov rcx, rsi
call fcn.1400b1248
mov ebp, 0xfffffff8
jmp 0x140036ea8
mov rdx, qword [rsp + 0x58]
mov rcx, r14
mov r8d, ebx
call fcn.1400464e0
mov r9d, 5
test rax, rax
jne 0x140036fa2
jmp 0x140036f36
mov rdx, qword [rsp + 0x58]
mov rcx, r14
mov r8d, ebx
call fcn.1400464e0
xor r9d, r9d
test rax, rax
je 0x140036f4b
mov ecx, dword [rsp + 0x4e8]
mov rax, qword [rsp + 0x4d0]
cmp r9d, 5
sete dl
cmp r9d, 0xf
sete r8b
cmp r12d, 1
jne 0x140036fe4
or dl, r8b
je 0x140036fe4
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, r14
mov r8d, ebx
call fcn.140037040
jmp 0x140037017
mov edx, dword [rsp + 0x4d8]
mov dword [rsp + 0x40], ecx
mov dword [rsp + 0x38], edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x30], 0
mov rcx, rdi
mov rdx, r14
mov r9d, r12d
mov r8d, ebx
call fcn.1400355c0
mov ebp, eax
mov rcx, rsi
call fcn.1400b1248
cmp ebx, 0x401
jb 0x140036ea8
mov rcx, r14
call fcn.140045610
jmp 0x140036ea8
Function at 0x140041ae0
Capabilities:
Encrypt data using aes
Resolve function by parsing pe exports

Disassembly:
mov rax, rdx
mov rdx, r8
mov r8, rax
jmp fcn.140041af0
Function at 0x140045690
Capabilities:
Encrypt data using des

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov dword [rsp + 0x2c], edx
mov rax, qword [0x1400fe980]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xor eax, eax
lea rdx, str.91__
lea r10, [0x1400dcf70]
nop dword [rax]
movzx r11d, byte [rax + rdx]
dec r11d
mov esi, r11d
and esi, 7
sar r11d, 3
movsxd r11, r11d
movzx r11d, byte [rcx + r11]
test dword [r10 + rsi*4], r11d
setne byte [rsp + rax + 0x30]
inc rax
cmp rax, 0x38
jne 0x1400456d0
xor r11d, r11d
lea rsi, [0x1400dcf90]
mov edi, 0xffffffe5
mov ebx, 0x1c
movabs r14, 0xaaaaaaaaaaaaaaab
lea r15, [0x1400dcfa0]
jmp 0x1400457a3
mov eax, dword [rsp + 0xa0]
shl eax, 0x18
movzx ecx, byte [rsp + 0xa2]
shl ecx, 0x10
or ecx, eax
movzx eax, byte [rsp + 0xa4]
shl eax, 8
or eax, ecx
movzx ecx, byte [rsp + 0xa6]
or ecx, eax
mov dword [r8 + r11*8], ecx
movzx eax, byte [rsp + 0xa1]
shl eax, 0x18
movzx ecx, byte [rsp + 0xa3]
shl ecx, 0x10
or ecx, eax
movzx eax, byte [rsp + 0xa5]
shl eax, 8
or eax, ecx
movzx ecx, byte [rsp + 0xa7]
or ecx, eax
mov dword [r8 + r11*8 + 4], ecx
inc r11
cmp r11, 0x10
je 0x14004587d
mov qword [rsp + 0xa0], 0
movzx eax, byte [r11 + rsi]
lea rcx, [rax + 1]
lea rdx, [rax + rdi]
xor r12d, r12d
nop
lea r13, [rax + r12]
cmp r12, 0x1c
mov ebp, 0x38
cmovb rbp, rbx
lea r9d, [rdx - 1]
cmp r13, rbp
cmovb r9, r13
movsxd r9, r9d
movzx r9d, byte [rsp + r9 + 0x30]
lea r13, [r12 + 1]
cmp r13, 0x1c
mov r13d, 0x38
cmovb r13, rbx
cmp rcx, r13
mov r13, rdx
cmovb r13, rcx
mov byte [rsp + r12 + 0x68], r9b
movsxd r9, r13d
movzx r9d, byte [rsp + r9 + 0x30]
mov byte [rsp + r12 + 0x69], r9b
add rcx, 2
add rdx, 2
add r12, 2
cmp r12, 0x38
jne 0x1400457c0
mov r12, r10
xor ecx, ecx
jmp 0x140045841
inc rcx
add r12, 4
cmp rcx, 0x30
je 0x140045730
mov rax, rcx
mul r14
movzx eax, byte [rcx + r15]
cmp byte [rsp + rax + 0x67], 0
je 0x140045830
add rdx, rdx
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
neg rax
mov eax, dword [r12 + rax]
shr eax, 2
movzx edx, cl
imul edx, edx, 0xab
shr edx, 0xa
or byte [rsp + rdx + 0xa0], al
jmp 0x140045830
cmp dword [rsp + 0x2c], 1
jne 0x14004590e
movdqu xmm0, xmmword [r8 + 0x70]
pshufd xmm0, xmm0, 0x4e
movdqu xmm1, xmmword [r8]
movdqu xmm2, xmmword [r8 + 0x10]
movdqu xmm3, xmmword [r8 + 0x20]
movdqu xmm4, xmmword [r8 + 0x30]
movdqu xmmword [r8], xmm0
pshufd xmm0, xmm1, 0x4e
movdqu xmmword [r8 + 0x70], xmm0
movdqu xmm0, xmmword [r8 + 0x60]
pshufd xmm0, xmm0, 0x4e
movdqu xmmword [r8 + 0x10], xmm0
pshufd xmm0, xmm2, 0x4e
movdqu xmmword [r8 + 0x60], xmm0
movdqu xmm0, xmmword [r8 + 0x50]
pshufd xmm0, xmm0, 0x4e
movdqu xmmword [r8 + 0x20], xmm0
pshufd xmm0, xmm3, 0x4e
movdqu xmmword [r8 + 0x50], xmm0
movdqu xmm0, xmmword [r8 + 0x40]
pshufd xmm0, xmm0, 0x4e
movdqu xmmword [r8 + 0x30], xmm0
pshufd xmm0, xmm4, 0x4e
movdqu xmmword [r8 + 0x40], xmm0
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400a1150
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140046240
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, dword [rcx]
mov esi, dword [rdx]
xor r9d, r9d
lea r10, [0x1400dcfd0]
nop word [rax + rax]
mov r11d, esi
rol esi, 0x1c
xor esi, dword [r8 + r9]
mov edi, esi
and edi, 0x3f
mov ebx, esi
shr ebx, 6
and ebx, 0xfc
mov r14d, esi
shr r14d, 0xe
and r14d, 0xfc
shr esi, 0x16
and esi, 0xfc
mov r15d, dword [r8 + r9 + 4]
xor r15d, r11d
mov r12d, r15d
and r12d, 0x3f
mov r13d, r15d
shr r13d, 6
and r13d, 0xfc
mov ebp, r15d
shr ebp, 0xe
and ebp, 0xfc
shr r15d, 0x16
and r15d, 0xfc
xor eax, dword [r10 + rdi*4 + 0x600]
xor eax, dword [rbx + r10 + 0x400]
xor eax, dword [r14 + r10 + 0x200]
xor eax, dword [rsi + r10]
xor eax, dword [r10 + r12*4 + 0x700]
xor eax, dword [r13 + r10 + 0x500]
xor eax, dword [rbp + r10 + 0x300]
xor eax, dword [r15 + r10 + 0x100]
mov edi, eax
rol edi, 0x1c
xor edi, dword [r8 + r9 + 8]
mov esi, edi
and esi, 0x3f
mov esi, dword [r10 + rsi*4 + 0x600]
mov ebx, edi
shr ebx, 6
and ebx, 0xfc
mov r14d, edi
shr r14d, 0xe
and r14d, 0xfc
shr edi, 0x16
and edi, 0xfc
mov r15d, dword [r8 + r9 + 0xc]
xor r15d, eax
mov r12d, r15d
and r12d, 0x3f
mov r13d, r15d
shr r13d, 6
and r13d, 0xfc
mov ebp, r15d
shr ebp, 0xe
and ebp, 0xfc
shr r15d, 0x16
and r15d, 0xfc
xor esi, dword [rbx + r10 + 0x400]
xor esi, dword [r14 + r10 + 0x200]
xor esi, dword [rdi + r10]
xor esi, dword [r10 + r12*4 + 0x700]
xor esi, dword [r13 + r10 + 0x500]
xor esi, dword [rbp + r10 + 0x300]
xor esi, dword [r15 + r10 + 0x100]
xor esi, r11d
add r9, 0x10
cmp r9, 0x80
jne 0x140046260
mov dword [rcx], eax
mov dword [rdx], esi
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140046d60
Capabilities:
Generate random numbers via winapi

Disassembly:
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp fcn.140046800

Function at 0x140046d70
Capabilities:
Generate random numbers via winapi

Disassembly:
mov r9, rdx
xor edx, edx
xor r8d, r8d
jmp fcn.140046800
Function at 0x140047a90
Capabilities:
Generate random numbers via winapi

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov rdi, rdx
mov rsi, rcx
mov dword [rsp + 0x20], 0xf0000000
xor edx, edx
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140047ade
mov rcx, qword [rsi]
mov edx, ebx
mov r8, rdi
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x140047ae5
mov rcx, qword [rsi]
xor esi, esi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x140047aea
mov esi, 0xffffff99
jmp 0x140047aea
mov esi, 0xffffff98
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret