joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140087b30
Capabilities:
Encode data using xor

Disassembly:
test r9d, r9d
jle 0x140087d8c
mov r11, rsp
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x88
mov rax, qword [0x1403e3c28]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov qword [r11 + 0x10], r12
mov esi, r9d
mov qword [r11 - 0x28], r13
mov rbx, r8
mov qword [r11 - 0x30], r14
mov rdi, rdx
mov qword [r11 - 0x38], r15
mov r14d, 0x40
mov rbp, rcx
nop dword [rax + rax]
mov rdx, rbp
lea rcx, [rsp + 0x20]
call fcn.140087650
add dword [rbp + 0x30], 1
jne 0x140087b96
inc dword [rbp + 0x34]
cmp esi, 0x40
mov r8d, esi
cmovge r8d, r14d
xor eax, eax
test r8d, r8d
jle 0x140087cfc
cmp r8d, 8
jb 0x140087cfc
lea edx, [r8 - 1]
movsxd r9, edx
movsxd rcx, edx
add r9, rbx
lea rdx, [rsp + 0x20]
add rdx, rcx
cmp rbx, rdx
ja 0x140087bdd
lea rcx, [rsp + 0x20]
cmp r9, rcx
jae 0x140087cfc
lea edx, [r8 - 1]
movsxd r9, edx
movsxd rcx, edx
add r9, rbx
add rcx, rdi
cmp rbx, rcx
ja 0x140087bfb
cmp r9, rdi
jae 0x140087cfc
cmp r8d, 0x40
jb 0x140087cc3
mov edx, r8d
and edx, 0x8000003f
jge 0x140087c17
dec edx
or edx, 0xffffffc0
inc edx
mov ecx, r8d
sub ecx, edx
movsxd r15, ecx
lea r10, [rsp + 0x20]
lea rcx, [rsp + 0x20]
mov r12, rdi
mov r13, rdi
lea r11, [rsp + 0x30]
mov r9, rdi
lea r14, [rsp + 0x40]
sub rcx, rbx
lea rdx, [rbx + 0x10]
sub r12, rbx
sub r13, rbx
sub r10, rbx
sub r11, rbx
sub r9, rbx
sub r14, rbx
movdqu xmm0, xmmword [rcx + rdx - 0x10]
add rax, 0x40
movdqu xmm1, xmmword [r9 + rdx - 0x10]
movdqu xmm2, xmmword [r10 + rdx]
lea rdx, [rdx + 0x40]
xorps xmm1, xmm0
movdqu xmm0, xmmword [r9 + rdx - 0x40]
movdqu xmmword [rdx - 0x50], xmm1
xorps xmm2, xmm0
movdqu xmm0, xmmword [r12 + rdx - 0x30]
movdqu xmm1, xmmword [r11 + rdx - 0x40]
movdqu xmmword [rdx - 0x40], xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rdx + r13 - 0x20]
movdqu xmm2, xmmword [r14 + rdx - 0x40]
movdqu xmmword [rdx - 0x30], xmm1
xorps xmm2, xmm0
movdqu xmmword [rdx - 0x20], xmm2
cmp rax, r15
jl 0x140087c55
mov ecx, r8d
and cl, 0x3f
cmp cl, 8
jb 0x140087cfc
mov edx, r8d
and edx, 0x80000007
jge 0x140087cd5
dec edx
or edx, 0xfffffff8
inc edx
mov ecx, r8d
sub ecx, edx
movsxd rdx, ecx
nop dword [rax]
movq xmm1, qword [rax + rdi]
movq xmm0, qword [rsp + rax + 0x20]
xorps xmm1, xmm0
movq qword [rax + rbx], xmm1
add rax, 8
cmp rax, rdx
jl 0x140087ce0
movsxd r11, r8d
cmp rax, r11
jge 0x140087d3d
lea rcx, [rsp + 0x20]
mov r9, rdi
sub r9, rcx
mov r10, rbx
lea rcx, [rsp + 0x20]
sub r10, rcx
nop word [rax + rax]
lea rcx, [r9 + rax]
movzx edx, byte [rsp + rcx + 0x20]
lea rcx, [r10 + rax]
xor dl, byte [rsp + rax + 0x20]
inc rax
mov byte [rsp + rcx + 0x20], dl
cmp rax, r11
jl 0x140087d20
movsxd rax, r8d
sub esi, r8d
add rdi, rax
mov r14d, 0x40
movsxd rax, r8d
add rbx, rax
test esi, esi
jg 0x140087b80
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov r13, qword [rsp + 0x80]
mov r12, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1401f11e0
add rsp, 0x88
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400883d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x90
mov rax, qword [0x1403e3c28]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbp, rdx
mov rdx, qword [rsp + 0xd8]
mov esi, r8d
test r8d, r8d
jns 0x140088407
mov eax, 0xffffffff
jmp 0x1400885ae
lea rax, [rsp + 0x60]
mov qword [rsp + 0x88], rdi
movsxd rdi, dword [rsp + 0xf0]
mov r8, rbp
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0xe0]
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0xd0]
mov qword [rsp + 0x38], rdx
mov edx, 1
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r9
mov r9, rbp
mov dword [rsp + 0x20], esi
call fcn.140088690
mov r9d, eax
mov ebx, 0xffffffff
test eax, eax
jne 0x14008859e
mov r10, qword [rsp + 0xe8]
xor r9d, r9d
mov ecx, r9d
mov edx, r9d
test edi, edi
jle 0x140088554
cmp edi, 8
jb 0x140088554
mov ecx, edi
mov qword [rsp + 0x80], r14
xorps xmm4, xmm4
xorps xmm3, xmm3
mov r8d, r9d
and ecx, 0x80000007
jge 0x1400884ad
dec ecx
or ecx, 0xfffffff8
inc ecx
mov eax, edi
mov r14, r10
sub eax, ecx
lea rcx, [rsp + 0x60]
sub r14, rcx
movsxd r11, eax
add r14, 4
lea rax, [rsp + 0x60]
mov rcx, r10
sub rcx, rax
nop
movd xmm1, dword [rsp + r8 + 0x60]
lea rax, [rcx + r8]
movd xmm2, dword [rsp + rax + 0x60]
xorps xmm0, xmm0
punpcklbw xmm2, xmm0
lea rax, [r14 + r8]
punpcklwd xmm2, xmm0
add edx, 8
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [rsp + r8 + 0x64]
orps xmm4, xmm2
punpcklbw xmm1, xmm0
movd xmm2, dword [rsp + rax + 0x60]
add r8, 8
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp r8, r11
jl 0x1400884d0
mov r14, qword [rsp + 0x80]
orps xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd ecx, xmm3
movsxd rax, edx
cmp rax, rdi
jge 0x14008858d
lea rdx, [rsp + 0x60]
sub r10, rdx
nop dword [rax]
nop dword [rax + rax]
lea rdx, [r10 + rax]
movzx r8d, byte [rsp + rdx + 0x60]
movzx edx, byte [rsp + rax + 0x60]
inc rax
xor r8d, edx
or ecx, r8d
cmp rax, rdi
jl 0x140088570
test ecx, ecx
je 0x14008859e
mov edx, esi
mov rcx, rbp
call fcn.140063da0
mov r9d, ebx
mov rdi, qword [rsp + 0x88]
test r9d, r9d
cmove ebx, esi
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1401f11e0
add rsp, 0x90
pop rsi
pop rbp
pop rbx
ret
Function at 0x140088690
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
sub rsp, 0x70
mov rax, qword [0x1403e3c28]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xe8]
mov ebx, edx
mov rbp, qword [rsp + 0xc8]
mov rdi, rcx
movsxd rsi, dword [rsp + 0xe0]
add rcx, 0x120
mov edx, reloc.WS2_32.dll_recv
mov qword [rsp + 0x28], rax
mov r13, r9
mov qword [rsp + 0x20], r8
call fcn.140063da0
lea rcx, [rdi + 0x130]
mov edx, reloc.WS2_32.dll_recv
call fcn.140063da0
xor eax, eax
mov dword [rdi + 0x140], ebx
cmp dword [rsp + 0xd0], 0xc
mov qword [rdi + 0x100], rax
mov qword [rdi + 0x108], rax
jne 0x140088909
lea rcx, [rdi + 0x120]
mov qword [rsp + 0x68], r14
lea r8d, [rax + 0xc]
mov rdx, rbp
call fcn.140063db0
lea r8, [rdi + 0x110]
mov byte [rdi + 0x12f], 1
lea rdx, [rdi + 0x120]
lea rcx, [rdi + 0x144]
call fcn.140086080
mov r14, qword [rsp + 0xd8]
mov qword [rdi + 0x108], rsi
test esi, esi
jle 0x1400887c7
nop word [rax + rax]
mov ebx, reloc.WS2_32.dll_recv
cmp esi, ebx
cmovl ebx, esi
movsxd rdx, ebx
test ebx, ebx
jle 0x1400887a5
mov r8, r14
lea rax, [rdi + 0x130]
sub r8, rdi
nop
movzx ecx, byte [r8 + rax - 0x130]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140088790
lea r8, [rdi + 0x130]
mov rcx, rdi
lea rdx, [rdi + 0x130]
call fcn.140088d20
movsxd rax, ebx
sub esi, ebx
add r14, rax
test esi, esi
jg 0x140088770
movsxd rbp, dword [rsp + 0xc0]
add qword [rdi + 0x100], rbp
test ebp, ebp
jle 0x1400888ed
mov rsi, 0xfffffffffffffee1
mov qword [rsp + 0xa8], r12
sub rsi, rdi
mov qword [rsp + 0x60], r15
nop word [rax + rax]
mov ebx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x40]
cmp ebp, ebx
mov rdx, r13
cmovl ebx, ebp
mov r8d, ebx
call fcn.140063db0
lea rcx, [rdi + 0x12f]
add byte [rcx], 1
jne 0x140088833
dec rcx
lea rax, [rsi + rcx]
cmp rax, 0xc
jg 0x140088821
lea r8, [rsp + 0x30]
lea rdx, [rdi + 0x120]
lea rcx, [rdi + 0x144]
call fcn.140086080
movsxd rdx, ebx
test ebx, ebx
jle 0x1400888b2
mov r10, qword [rsp + 0x20]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
sub r9, rdi
sub r8, rdi
lea rcx, [rdi + 0x130]
sub r10, rdi
cmp dword [rdi + 0x140], 1
jne 0x140088885
movzx eax, byte [r8 + rcx - 0x130]
xor byte [rcx], al
movzx eax, byte [r8 + rcx - 0x130]
xor al, byte [r9 + rcx - 0x130]
mov byte [r10 + rcx - 0x130], al
cmp dword [rdi + 0x140], 0
jne 0x1400888a9
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140088871
lea r8, [rdi + 0x130]
mov rcx, rdi
lea rdx, [rdi + 0x130]
call fcn.140088d20
movsxd rax, ebx
sub ebp, ebx
add r13, rax
movsxd rax, ebx
add qword [rsp + 0x20], rax
test ebp, ebp
jg 0x140088800
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0xa8]
mov r8d, dword [rsp + 0xf0]
mov rcx, rdi
mov rdx, qword [rsp + 0x28]
call fcn.140088930
mov r14, qword [rsp + 0x68]
jmp 0x14008890e
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1401f11e0
add rsp, 0x70
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140088930
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x1403e3c28]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, qword [rcx + 0x100]
mov rbx, rdx
mov r14, qword [rcx + 0x108]
shl rdi, 3
shl r14, 3
mov dword [rsp + 0x20], r8d
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], r14
cmp r8d, 0x10
jle 0x14008898d
mov eax, 0xffffffff
jmp 0x140088b17
test r8d, r8d
jle 0x1400889a1
lea rdx, [rcx + 0x110]
mov rcx, rbx
call fcn.140063db0
test rdi, rdi
jne 0x1400889af
test r14, r14
je 0x140088b15
mov qword [rsp + 0xb8], rbp
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x78], rsi
mov edx, reloc.WS2_32.dll_recv
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x60], r15
call fcn.140063da0
mov rbx, qword [rsp + 0x28]
mov rax, r14
mov r8, qword [rsp + 0x30]
mov r9, r14
shr rax, 0x38
mov rsi, r14
mov r12, r14
shr r8, 0x18
xor byte [rbx + 0x130], al
mov rcx, r14
shr rcx, 0x18
mov r10, r14
mov rbp, r14
shr r9, 0x30
xor byte [rbx + 0x131], r9b
mov rdx, rdi
shr rdx, 0x38
mov r11, rdi
shr r10, 0x10
mov r14, rdi
mov r13, rdi
shr r11, 0x30
mov r15, rdi
shr rsi, 0x28
xor byte [rbx + 0x132], sil
mov rax, rbx
shr r12, 0x20
xor byte [rbx + 0x133], r12b
xor byte [rbx + 0x134], cl
xor byte [rbx + 0x135], r10b
mov rcx, qword [rsp + 0x38]
shr rbp, 8
xor byte [rbx + 0x136], bpl
xor byte [rbx + 0x137], cl
xor byte [rbx + 0x138], dl
lea rdx, [rbx + 0x130]
xor byte [rbx + 0x139], r11b
mov rcx, qword [rsp + 0x30]
shr r14, 0x28
xor byte [rbx + 0x13a], r14b
shr r13, 0x20
xor byte [rbx + 0x13b], r13b
xor byte [rbx + 0x13c], r8b
lea r8, [rbx + 0x130]
shr rdi, 0x10
xor byte [rbx + 0x13d], dil
shr r15, 8
xor byte [rbx + 0x13e], r15b
xor byte [rbx + 0x13f], cl
mov rcx, rbx
call fcn.140088d20
movsxd rcx, dword [rsp + 0x20]
mov r15, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0x40]
test rcx, rcx
jle 0x140088b15
mov rdx, qword [rsp + 0x28]
sub rdx, rbx
movzx eax, byte [rdx + rbx + 0x130]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rcx, 1
jne 0x140088b01
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1401f11e0
add rsp, 0x80
pop r14
pop rdi
pop rbx
ret
Function at 0x140088b30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov ebx, r8d
mov edx, 0x328
mov rsi, rcx
call fcn.140063da0
lea rcx, [rsi + 0x144]
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
call fcn.140086250
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140088b30
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1403e3c28]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140063da0
lea rcx, [rbx + 0x144]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x20]
call fcn.140086080
movzx eax, byte [rsp + 0x21]
movzx r8d, byte [rsp + 0x20]
movzx r9d, byte [rsp + 0x28]
movzx ecx, byte [rsp + 0x24]
shl r8d, 8
or r8d, eax
shl r9d, 8
movzx eax, byte [rsp + 0x22]
shl r8d, 8
or r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x23]
shl r8d, 8
or r8, rax
movzx eax, byte [rsp + 0x25]
or ecx, eax
shl r8, 0x20
movzx eax, byte [rsp + 0x26]
shl ecx, 8
or eax, ecx
movzx ecx, byte [rsp + 0x2c]
shl eax, 8
or r8, rax
shl ecx, 8
movzx eax, byte [rsp + 0x27]
or r8, rax
movzx eax, byte [rsp + 0x29]
or r9d, eax
mov qword [rbx + 0xc0], r8
movzx eax, byte [rsp + 0x2a]
shl r9d, 8
or r9d, eax
movzx eax, byte [rsp + 0x2b]
shl r9d, 8
or r9, rax
movzx eax, byte [rsp + 0x2d]
or ecx, eax
shl r9, 0x20
movzx eax, byte [rsp + 0x2e]
shl ecx, 8
or eax, ecx
shl eax, 8
or r9, rax
movzx eax, byte [rsp + 0x2f]
or r9, rax
xor eax, eax
mov qword [rbx + 0x40], r9
mov qword [rbx + 0x80], rax
mov qword [rbx], rax
lea r10d, [rax + 4]
nop dword [rax + rax]
mov eax, r9d
mov rcx, r8
and eax, 1
shl rcx, 0x3f
imul edx, eax, 0xe1000000
mov rax, r9
shr rax, 1
mov r9, rcx
or r9, rax
mov rax, r8
shr rax, 1
mov ecx, edx
shl rcx, 0x20
mov r8, rcx
xor r8, rax
movsxd rax, r10d
mov qword [rbx + rax*8], r9
movsxd rax, r10d
sar r10d, 1
mov qword [rbx + rax*8 + 0x80], r8
test r10d, r10d
jg 0x140088c40
mov r10d, 2
movsxd rcx, r10d
add rcx, 0x10
movsxd rax, r10d
mov rdi, qword [rbx + rcx*8]
lea rcx, [rbx + rcx*8]
mov rsi, qword [rbx + rax*8]
lea r9, [rbx + rax*8]
movsxd rdx, r10d
cmp rdx, 1
jle 0x140088cf5
mov r8, rbx
lea rax, [rcx + 8]
mov r11, rbx
sub r8, rcx
sub r11, rcx
sub r9, rcx
dec rdx
nop word [rax + rax]
mov rcx, rdi
xor rcx, qword [r8 + rax + 0x80]
mov qword [rax], rcx
lea rax, [rax + 8]
mov rcx, rsi
xor rcx, qword [r11 + rax - 8]
mov qword [r9 + rax - 8], rcx
sub rdx, 1
jne 0x140088cd0
add r10d, r10d
cmp r10d, 0x10
jl 0x140088c91
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1401f11e0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14008b860
Capabilities:
Hash data using sha224
Hash data using sha256
Hash data using sha384
Hash data using sha512

Disassembly:
cmp dl, 0x30
mov dword [rcx], 0
mov eax, 0x80
mov byte [rcx + 6], 0
mov r8d, 0x40
mov byte [rcx + 4], dl
cmovb eax, r8d
mov byte [rcx + 5], al
cmp dl, 0x1c
jne 0x14008b8c0
mov dword [rcx + 8], 0xc1059ed8
mov dword [rcx + 0xc], 0x367cd507
mov dword [rcx + 0x10], 0x3070dd17
mov dword [rcx + 0x14], 0xf70e5939
mov dword [rcx + 0x18], 0xffc00b31
mov dword [rcx + 0x1c], 0x68581511
mov dword [rcx + 0x20], 0x64f98fa7
mov dword [rcx + 0x24], 0xbefa4fa4
ret
cmp dl, 0x20
jne 0x14008b8fe
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
mov dword [rcx + 0x24], 0x5be0cd19
ret
cmp dl, 0x30
jne 0x14008b974
movabs rax, 0xcbbb9d5dc1059ed8
mov qword [rcx + 8], rax
movabs rax, 0x629a292a367cd507
mov qword [rcx + 0x10], rax
movabs rax, 0x9159015a3070dd17
mov qword [rcx + 0x18], rax
movabs rax, 0x152fecd8f70e5939
mov qword [rcx + 0x20], rax
movabs rax, 0x67332667ffc00b31
mov qword [rcx + 0x28], rax
movabs rax, 0x8eb44a8768581511
mov qword [rcx + 0x30], rax
movabs rax, 0xdb0c2e0d64f98fa7
mov qword [rcx + 0x38], rax
movabs rax, 0x47b5481dbefa4fa4
mov qword [rcx + 0x40], rax
ret
cmp dl, r8b
jne 0x14008b9e9
movabs rax, 0x6a09e667f3bcc908
mov qword [rcx + 8], rax
movabs rax, 0xbb67ae8584caa73b
mov qword [rcx + 0x10], rax
movabs rax, 0x3c6ef372fe94f82b
mov qword [rcx + 0x18], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rcx + 0x20], rax
movabs rax, 0x510e527fade682d1
mov qword [rcx + 0x28], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rcx + 0x30], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rcx + 0x38], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rcx + 0x40], rax
ret
Function at 0x14008d8a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
add rcx, 0x14c4
mov edi, r8d
mov edx, dword [rbx + 0x14c0]
call fcn.140081d20
mov edx, 4
lea rcx, [rsp + 0x40]
call fcn.140081d20
xor r9d, r9d
cmp dword [rbx + 0x14c0], r9d
jle 0x14008d923
mov edx, dword [rsp + 0x40]
lea r8, [rbx + 0x14c4]
cmp byte [r8], 0
jne 0x14008d914
movzx eax, byte [r8]
nop word [rax + rax]
lea ecx, [rdx + 1]
imul edx, ecx, 0x10dcd
xor al, dl
je 0x14008d900
mov dword [rsp + 0x40], edx
mov byte [r8], al
inc r9d
inc r8
cmp r9d, dword [rbx + 0x14c0]
jl 0x14008d8f0
mov word [rbx + 0x14c4], 0x200
mov r8d, edi
mov edx, dword [rbx + 0x14c0]
sub edx, edi
lea eax, [rdx - 1]
movsxd rcx, eax
mov byte [rcx + rbx + 0x14c4], 0
movsxd rcx, edx
mov rdx, rsi
add rcx, 0x14c4
add rcx, rbx
call fcn.140063db0
cmp byte [rbx + 0x18c7], 0
lea r8, [rbx + 0x14c4]
mov r9d, dword [rbx + 0x14c0]
mov edx, 0xffffffff
mov byte [rbx + 0x18c6], 1
jne 0x14008d999
lea rcx, [rbx + 0x420]
call fcn.140083710
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rcx, [rbx + 0xa50]
call fcn.140083710
mov r9d, dword [rbx + 0x14c0]
lea r8, [rbx + 0x14c4]
lea rcx, [rbx + 0xc60]
mov edx, 0xffffffff
call fcn.140083710
lea r8, [rbx + 0xa50]
xor r9d, r9d
lea rcx, [rbx + 0xa50]
mov rdx, rbx
call fcn.1400851d0
lea r8, [rbx + 0xc60]
xor r9d, r9d
lea rdx, [rbx + 0x210]
lea rcx, [rbx + 0xc60]
call fcn.1400851d0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400900d0
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
xor r10d, r10d
mov qword [rsp + 0x10], rbx
mov eax, r9d
mov qword [rsp + 0x18], rsi
and eax, 0xf
lea rdi, [0x140000000]
dec eax
mov ebx, edx
mov r11, rcx
cmp eax, 0xe
ja case.default.0x14009011c
cdqe
movabs rsi, 0x4cf5ad432745937f
movabs rcx, 0x87c37b91114253d5
mov edx, dword [rdi + rax*4 + 0x90334]
add rdx, rdi
jmp rdx
movzx r10d, byte [r8 + 0xe]
shl r10, 0x30
movzx eax, byte [r8 + 0xd]
shl rax, 0x28
xor r10, rax
movzx eax, byte [r8 + 0xc]
shl rax, 0x20
xor r10, rax
movzx eax, byte [r8 + 0xb]
shl rax, 0x18
xor r10, rax
movzx eax, byte [r8 + 0xa]
shl rax, 0x10
xor r10, rax
movzx eax, byte [r8 + 9]
shl rax, 8
xor r10, rax
movzx eax, byte [r8 + 8]
xor rax, r10
imul rax, rsi
rol rax, 0x21
imul rax, rcx
xor qword [rsp + 0x38], rax
movzx r10d, byte [r8 + 7]
shl r10, 0x38
movzx eax, byte [r8 + 6]
shl rax, 0x30
xor r10, rax
movzx eax, byte [r8 + 5]
shl rax, 0x28
xor r10, rax
movzx eax, byte [r8 + 4]
shl rax, 0x20
xor r10, rax
movzx eax, byte [r8 + 3]
shl rax, 0x18
xor r10, rax
movzx eax, byte [r8 + 2]
shl rax, 0x10
xor r10, rax
movzx eax, byte [r8 + 1]
shl rax, 8
xor r10, rax
movzx eax, byte [r8]
mov r8, qword [rsp + 0x30]
xor rax, r10
imul rax, rcx
rol rax, 0x1f
imul rax, rsi
xor r8, rax
jmp 0x1400901ef
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
movabs r10, 0xff51afd7ed558ccd
mov rsi, qword [rsp + 0x18]
movsxd rax, r9d
xor rdx, rax
movsxd rcx, r9d
xor rcx, r8
movabs r9, 0xc4ceb9fe1a85ec53
add rcx, rdx
mov rax, rcx
shr rax, 0x21
xor rax, rcx
imul rax, r10
mov r8, rax
shr r8, 0x21
xor r8, rax
lea rax, [rcx + rdx]
mov rcx, rax
imul r8, r9
shr rcx, 0x21
xor rcx, rax
imul rcx, r10
mov rax, rcx
shr rax, 0x21
xor rax, rcx
imul rax, r9
mov r9, r8
shr r9, 0x21
mov rdx, rax
shr rdx, 0x21
xor r9, r8
xor rdx, rax
lea eax, [rbx - 1]
mov rbx, qword [rsp + 0x10]
add r9, rdx
add rdx, r9
cmp eax, 0xf
ja case.default.0x14009028f
cdqe
mov ecx, dword [rdi + rax*4 + 0x90370]
add rcx, rdi
jmp rcx
mov rax, rdx
shr rax, 0x38
mov byte [r11 + 0xf], al
mov rax, rdx
shr rax, 0x30
mov byte [r11 + 0xe], al
mov rax, rdx
shr rax, 0x28
mov byte [r11 + 0xd], al
mov rax, rdx
shr rax, 0x20
mov byte [r11 + 0xc], al
mov rax, rdx
shr rax, 0x18
mov byte [r11 + 0xb], al
mov rax, rdx
shr rax, 0x10
mov byte [r11 + 0xa], al
mov rax, rdx
shr rax, 8
mov byte [r11 + 9], al
mov byte [r11 + 8], dl
shr rdx, 0x38
mov byte [r11 + 7], dl
mov rax, r9
shr rax, 0x30
mov byte [r11 + 6], al
mov rax, r9
shr rax, 0x28
mov byte [r11 + 5], al
mov rax, r9
shr rax, 0x20
mov byte [r11 + 4], al
mov rax, r9
shr rax, 0x18
mov byte [r11 + 3], al
mov rax, r9
shr rax, 0x10
mov byte [r11 + 2], al
mov rax, r9
shr rax, 8
mov byte [r11 + 1], al
mov byte [r11], r9b
pop rdi
ret

Function at 0x140094a50
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 9], 0
mov rbx, rcx
je 0x140094a6b
lea rcx, str.User_requested_cancellation_of_run._n
call fcn.1400b4070
mov rcx, qword [rbx + 0x6f8]
mov edx, 0xffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [rbx + 0x48], 0
add rsp, 0x20
pop rbx
ret
Function at 0x1400955a0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [rcx + 9], 0
mov rdi, rdx
mov rbx, rcx
je 0x1400955ef
lea rcx, str.Target_process_generated_an_exception._n
call fcn.1400b4070
mov edx, dword [rdi]
lea rcx, str._Code______0x_08x_n
call fcn.1400b4070
mov rdx, qword [rdi + 0x10]
lea rcx, str._Address___0x_016llX__n
call fcn.1400b4070
mov edx, dword [rdi + 4]
lea rcx, str._Flags_____0x_08x_n
call fcn.1400b4070
mov rcx, qword [rbx + 0x6f8]
mov edx, 0xffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [rbx + 0x48], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400976e0
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x38
xor r10d, r10d
mov r11, rcx
cmp byte [rcx + 0x558], r10b
je 0x14009773a
cmp qword [rcx + 0x5b8], 0xffffffffffffffff
je 0x140097709
mov r10, qword [rcx + 0x5b8]
cmp r8, r10
jb 0x140097742
mov rcx, qword [rcx + 0x5c0]
add rcx, r10
cmp r8, rcx
jae 0x140097742
cmp byte [r11 + 0x5b0], 0
je 0x140097725
sub r8, r10
mov rax, qword [rsp + 0x60]
mov rcx, r11
mov qword [rsp + 0x20], rax
call fcn.140098dd0
mov r10d, eax
mov eax, r10d
add rsp, 0x38
ret
mov rcx, r11
add rsp, 0x38
jmp fcn.140098dd0
Function at 0x14009b8a0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push rbx
push rsi
sub rsp, 0x508
mov rax, qword [0x1403e3c28]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rbx, rdx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp eax, ebx
jne 0x14009b8fc
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x50], 0x100003
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0x118]
jmp 0x14009b995
mov edx, 1
mov qword [rsp + 0x530], rbp
mov r8d, ebx
mov qword [rsp + 0x500], rdi
lea ecx, [rdx + 9]
call qword [sym.imp.KERNEL32.dll_OpenThread]
xor ebx, ebx
mov rdi, rax
mov ebp, ebx
test rax, rax
je 0x14009b97f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x14009b958
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x50], 0x100003
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
mov rcx, rdi
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebp, ebp
je 0x14009b97f
mov rbx, qword [rsp + 0x118]
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xb8]
jmp 0x14009b985
mov rcx, rbx
mov rax, rbx
mov rbp, qword [rsp + 0x530]
mov rdi, qword [rsp + 0x500]
test rbx, rbx
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x18], rbx
setne al
mov qword [rsi + 0x20], rcx
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.1401f11e0
add rsp, 0x508
pop rsi
pop rbx
ret