joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b7424
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1400f6180]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, r8
mov rdi, rdx
mov ecx, dword [0x140114440]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x140113de0], ecx
jg 0x1400b7506
mov eax, ebx
cmp rbx, rax
jne 0x1400b74c8
xor ecx, ecx
test rbx, rbx
setne cl
xor eax, eax
test ebx, ebx
setne al
cmp ecx, eax
jne 0x1400b74c8
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
mov rcx, qword [0x140113dd8]
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x1400b7549
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400bfa40
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x20]
call fcn.140002d70
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400b7154
lea rdx, [0x1400f1d48]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, [0x140113de0]
call fcn.1400bfb08
cmp dword [0x140113de0], 0xffffffff
jne 0x1400b7470
lea rcx, [0x140113dd8]
call fcn.1400b7068
lea rcx, [0x1400c72fc]
call fcn.1400bfeb4
nop
lea rcx, [0x140113de0]
call fcn.1400bfa9c
jmp 0x1400b7470
mov ecx, eax
call fcn.1400b758c
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [0x1400ce808]
lea rcx, [rsp + 0x20]
call fcn.140002d70
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.1400b7154
lea rdx, [0x1400f1d48]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x1400b8990
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp r8, 8
jb 0x1400b8a03
mov rbp, r8
shr rbp, 3
imul rax, rbp, 0xfffffffffffffff8
add rdi, rax
mov r8d, 8
lea rcx, [rsp + 0x58]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 8
lea rcx, [rsp + 0x50]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x50]
add rsi, 8
xor rax, qword [rsp + 0x58]
add rbx, 8
or r14, rax
sub rbp, 1
jne 0x1400b89c2
mov rcx, r14
shr rcx, 0x20
or ecx, r14d
mov edx, ecx
mov eax, ecx
shr edx, 8
or edx, ecx
shr eax, 0x10
and edx, 0xff00
or edx, eax
movzx eax, cl
shr edx, 8
or edx, eax
test rdi, rdi
je 0x1400b8a45
sub rsi, rbx
movzx ecx, byte [rsi + rbx]
movzx eax, byte [rbx]
inc rbx
xor ecx, eax
or edx, ecx
sub rdi, 1
jne 0x1400b8a31
mov rbx, qword [rsp + 0x40]
test edx, edx
mov rbp, qword [rsp + 0x48]
sete al
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1400b8a60
Capabilities:
Encode data using xor

Disassembly:
test r9, r9
je 0x1400b8b26
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, r9
mov r15d, 4
mov rdi, r8
mov rsi, rdx
mov r14, rcx
cmp rbx, r15
jb 0x1400b8af1
mov rbp, rbx
shr rbp, 2
imul rax, rbp, 0xfffffffffffffffc
add rbx, rax
mov r8, r15
lea rcx, [rsp + 0x20]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r15
lea rcx, [rsp + 0x68]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x68]
lea rdx, [rsp + 0x24]
xor eax, dword [rsp + 0x20]
mov r8, r15
mov rcx, r14
mov dword [rsp + 0x24], eax
call sub.VCRUNTIME140.dll_memcpy
add r14, r15
add rsi, r15
add rdi, r15
sub rbp, 1
jne 0x1400b8aa6
test rbx, rbx
je 0x1400b8b0e
sub rsi, rdi
sub r14, rdi
mov al, byte [rsi + rdi]
xor al, byte [rdi]
mov byte [r14 + rdi], al
inc rdi
sub rbx, 1
jne 0x1400b8afc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x1400b8b28
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400b8bd5
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, r8
mov r14d, 4
mov rsi, rdx
mov rdi, rcx
cmp rbx, r14
jb 0x1400b8bad
mov rbp, rbx
shr rbp, 2
imul rax, rbp, 0xfffffffffffffffc
add rbx, rax
mov r8, r14
lea rcx, [rsp + 0x68]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r14
lea rcx, [rsp + 0x60]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x60]
lea rdx, [rsp + 0x20]
xor eax, dword [rsp + 0x68]
mov r8, r14
mov rcx, rdi
mov dword [rsp + 0x20], eax
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
add rsi, r14
sub rbp, 1
jne 0x1400b8b65
test rbx, rbx
je 0x1400b8bc3
sub rsi, rdi
mov al, byte [rsi + rdi]
xor byte [rdi], al
inc rdi
sub rbx, 1
jne 0x1400b8bb5
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400beb1c
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm1, xmmword [rcx]
mov r9d, 4
shl edx, 2
mov r8, rcx
movdqu xmm0, xmmword [rcx + rdx*4]
movdqu xmmword [rcx], xmm0
movdqu xmmword [rcx + rdx*4], xmm1
add edx, 0xfffffffc
cmp edx, r9d
jbe 0x1400beb6b
aesimc xmm0, xmmword [r8 + rdx*4]
mov ecx, r9d
add r9d, 4
aesimc xmm1, xmmword [r8 + rcx*4]
movdqu xmmword [r8 + rcx*4], xmm0
movdqu xmmword [r8 + rdx*4], xmm1
add edx, 0xfffffffc
cmp r9d, edx
jb 0x1400beb42
mov eax, r9d
aesimc xmm0, xmmword [r8 + rax*4]
movdqu xmmword [r8 + rax*4], xmm0
ret

Function at 0x1400bef18
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1400bef52
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400bef57
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400befa0
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400d0050]
cmp byte [rcx + rax], 0
je 0x1400befa0
dec r8
sub rdx, 1
jne 0x1400bef86
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400c0818
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400c0862
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400c0862
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400c0862
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400c0862
cmp dword [rcx + 0x84], 0xe
jbe 0x1400c0862
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400c0864
xor al, al
add rsp, 0x28
ret
Function at 0x14000abe0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x100
mov rax, qword [0x14023c8a0]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, r8
mov rdi, rdx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
movdqa xmm0, xmmword [0x140214170]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140214200]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x140214160]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1402141b0]
movdqa xmmword [rsp + 0x80], xmm1
movdqa xmm0, xmmword [0x1402141f0]
movdqa xmmword [r11 - 0x78], xmm0
movdqa xmm1, xmmword [0x1402141d0]
movdqa xmmword [r11 - 0x68], xmm1
movdqa xmm0, xmmword [0x140214230]
movdqa xmmword [r11 - 0x58], xmm0
movdqa xmm1, xmmword [0x140214220]
movdqa xmmword [r11 - 0x48], xmm1
movdqa xmm0, xmmword [0x1402141c0]
movdqa xmmword [r11 - 0x38], xmm0
mov word [r11 - 0x28], 0x6c75
mov byte [r11 - 0x26], 0x74
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140007300
mov rsi, rax
cmp rdi, rax
je 0x14000ace2
mov rcx, rdi
call fcn.140012660
movups xmm0, xmmword [rsi]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000ad20
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ad1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ae44
call fcn.1400b1cb0
nop
jmp 0x14000ad27
movdqa xmm0, xmmword [0x140214170]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140214200]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x140214160]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm1, xmmword [0x1402141b0]
movdqa xmmword [rsp + 0x80], xmm1
movdqa xmm0, xmmword [0x1402141f0]
movdqa xmmword [rsp + 0x90], xmm0
movdqa xmm1, xmmword [0x1402141e0]
movdqa xmmword [rsp + 0xa0], xmm1
mov dword [rsp + 0xb0], 0x6f725020
mov dword [rsp + 0xb4], 0x74637564
mov dword [rsp + 0xb8], 0x656d614e
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140007300
mov rdi, rax
cmp rbx, rax
je 0x14000ade5
mov rcx, rbx
call fcn.140012660
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14000ae1f
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ae19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ae4a
call fcn.1400b1cb0
nop
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1400b1c90
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1400c8390
nop
call fcn.1400c8390
int3
Function at 0x14000ebe0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov rbx, r8
je 0x14000ec81
test r8, r8
jle 0x14000ec79
mov rcx, rdi
call fcn.1400121d0
test rax, rax
jle 0x14000ec50
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov rax, qword [rdi + 0x40]
mov r8, rsi
mov rcx, qword [rax]
call fcn.1400b4460
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x14000ec71
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
mov rax, qword [rax + 0x18]
call qword [case.0x1400faf48.0]
cmp eax, 0xffffffff
je 0x14000ec79
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x14000ec12
sub r14, rbx
mov rax, r14
jmp 0x14000ecf5
mov rax, qword [rcx + 0x40]
mov r9, qword [rax]
test r9, r9
je 0x14000ec95
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000ec97
xor ecx, ecx
movsxd rsi, ecx
test r14, r14
jle 0x14000ecef
test ecx, ecx
jle 0x14000ecd0
cmp r14, rsi
mov rcx, r9
cmovl rsi, r14
mov r8, rsi
call fcn.1400b4460
mov rax, qword [rdi + 0x58]
sub r14, rsi
add rbp, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
test r14, r14
jle 0x14000ecef
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000ecef
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.1400c8cb0
sub r14, rax
sub rbx, r14
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14000ed10
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14000ed32
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14000edb3
mov rdi, r14
mov rcx, rbx
call fcn.1400121f0
test rax, rax
jle 0x14000ed84
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1400b4460
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000eda3
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x1400faf48.0]
cmp eax, 0xffffffff
je 0x14000edab
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14000ed46
sub r14, rdi
jmp 0x14000eea8
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14000edca
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000edcc
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000ee01
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400b4460
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000eea5
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x14000ee3c
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x14000ee80
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400c9550
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x14000eebe
cmp rbp, rax
ja 0x14000ee50
mov r8, rdi
test rdi, rdi
je 0x14000eea5
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400c9550
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x14000eea8
Function at 0x14000f310
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x14023c8a0]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000f340
xor eax, eax
jmp 0x14000f490
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14000f37a
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14000f37a
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14000f490
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xb0], rsi
je 0x14000f483
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000f3bd
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000f3cc
movsx ecx, dil
jmp 0x14000f42a
lea r8, [rsp + 0x50]
mov byte [rsp + 0x60], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x61]
lea r8, [rsp + 0x88]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x68]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x60]
call qword [case.0x1400faf48.0]
test eax, eax
je 0x14000f444
sub eax, 1
je 0x14000f444
cmp eax, 2
jne 0x14000f483
movsx ecx, byte [rsp + 0x60]
mov rdx, qword [rbx + 0x80]
call fcn.1400c0dd0
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14000f488
mov rsi, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
sub rsi, rax
je 0x14000f471
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x68]
mov r8, rsi
mov edx, 1
call fcn.1400c8cb0
cmp rsi, rax
jne 0x14000f483
lea rax, [rsp + 0x60]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x58], rax
mov eax, edi
jne 0x14000f488
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400b1c90
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
Function at 0x140011dc0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14023c8a0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140011ea0
cmp byte [rcx + 0x71], 0
je 0x140011ea0
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
mov rax, qword [rax + 0x18]
call qword [case.0x1400faf48.0]
cmp eax, 0xffffffff
je 0x140011e9c
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [case.0x1400faf48.0]
test eax, eax
je 0x140011e62
sub eax, 1
je 0x140011e66
cmp eax, 2
jne 0x140011e9c
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400b1c90
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140011e93
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.1400c8cb0
cmp rdi, rax
jne 0x140011e9c
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140011e4a
xor al, al
jmp 0x140011e4a
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400b1c90
add rsp, 0x60
pop rbx
ret

Function at 0x14001e3b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14023c8a0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400b1f80
mov r9, rax
mov rax, qword [rbx]
mov qword [r9], rax
mov rax, qword [rdi]
mov qword [r9 + 8], rax
mov qword [rsp + 0x30], r9
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
xor edi, edi
mov dword [rsp + 0x20], edi
lea r8, [0x140027be0]
xor edx, edx
xor ecx, ecx
call fcn.1400c4c10
mov qword [rsi], rax
test rax, rax
je 0x14001e43d
mov rax, rsi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400b1c90
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], edi
mov ecx, 6
call fcn.1400affcc
int3
Function at 0x140023770
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov edi, r14d
mov ebp, r14d
mov rsi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl rdi, cl
add rdi, rdi
nop dword [rax]
mov r10, qword [rsi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x140023814
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x1400237d0
mov ecx, dword [r10]
jmp 0x1400238f7
cmp ecx, 0x4e0
jb 0x1400238f7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140023830
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140023880
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov ecx, edx
mov dword [r10], eax
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rdx, rcx
shr rdx, 0x12
xor rdx, rcx
cmp rdx, qword [rsi + 0x10]
ja 0x1400237b0
mov rax, qword [rsi + 8]
or rdi, rdx
add rbp, rax
cmp rbp, 0x40
jb 0x1400237a0
mov rbx, qword [rsp + 0x10]
mov rax, rdi
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop r14
ret
Function at 0x14002bae0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x14023c8a0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
mov rcx, qword [0x140243770]
mov rax, qword [rcx + 8]
cmp byte [rax + 0x19], 0
jne 0x14002bb28
nop dword [rax]
cmp dword [rax + 0x20], 4
jge 0x14002bb1c
mov rax, qword [rax + 0x10]
jmp 0x14002bb22
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x14002bb10
cmp byte [rcx + 0x19], 0
jne 0x14002bc04
cmp dword [rcx + 0x20], 4
jg 0x14002bc04
lea r8, [rcx + 0x28]
mov r10, qword [r8 + 0x10]
mov rdx, r8
cmp qword [r8 + 0x18], 0x10
jb 0x14002bb51
mov rdx, qword [r8]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x14002bb83
movabs r11, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r11
inc rcx
cmp rcx, r10
jb 0x14002bb70
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14002b540
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14002bbbe
cmp rcx, qword [rbx + 8]
je 0x14002bbbe
cmp qword [rbx + 0x10], 1
jne 0x14002bbc2
mov al, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400b1c90
add rsp, 0x80
pop rbx
ret
xor al, al
jmp 0x14002bba8
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.14002bc30
nop
mov r8, rax
lea rdx, str.AcceptEncoding_does_not_accept_any_other_values_if_disabled_is_present._You_set_the_following_encodings:
lea rcx, [rsp + 0x58]
call fcn.140014ec0
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14002ba80
lea rdx, [0x140238af0]
lea rcx, [rsp + 0x20]
call fcn.1400b4230
nop
lea rcx, str.invalid_map_K__T__key
call fcn.1400b0210
int3
Function at 0x1400301f0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, 0x23456789
mov dword [rdx], 0x12345678
mov dword [rdx + 4], r9d
mov rbx, r8
mov dword [rdx + 8], 0x34567890
mov r10, rcx
movzx eax, byte [rcx]
test al, al
je 0x140030283
mov r8d, 0x12345678
mov r11d, 0x34567890
nop word [rax + rax]
mov rcx, r8
lea r10, [r10 + 1]
xor rcx, rax
movzx eax, cl
mov ecx, r8d
shr ecx, 8
xor ecx, dword [rbx + rax*4]
movzx eax, cl
mov r8d, ecx
add eax, r9d
mov dword [rdx], ecx
imul r9d, eax, 0x8088405
mov ecx, r11d
shr ecx, 8
inc r9d
mov dword [rdx + 4], r9d
mov eax, r9d
shr rax, 0x18
xor rax, r11
movzx eax, al
xor ecx, dword [rbx + rax*4]
mov dword [rdx + 8], ecx
mov r11d, ecx
movzx eax, byte [r10]
test al, al
jne 0x140030230
mov rbx, qword [rsp + 8]
ret

Function at 0x140030290
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0x10108], 0
mov rbx, rcx
je 0x140030356
xor r11d, r11d
cmp dword [rcx + 0xd4], r11d
jbe 0x140030356
nop word [rax + rax]
movzx eax, byte [r11 + rbx + 0x100]
mov edx, dword [rbx + 0x10128]
mov ecx, edx
mov r8, qword [rbx + 0x10138]
xor rcx, rax
mov r10d, dword [rbx + 0x10130]
movzx eax, cl
and r10d, 0xfffd
mov ecx, dword [rbx + 0x10130]
or r10d, 2
shr edx, 8
xor edx, dword [r8 + rax*4]
mov dword [rbx + 0x10128], edx
movzx eax, dl
add eax, dword [rbx + 0x1012c]
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0x1012c], eax
shr rax, 0x18
xor rax, rcx
shr ecx, 8
movzx eax, al
xor ecx, dword [r8 + rax*4]
mov eax, r10d
xor eax, 1
mov dword [rbx + 0x10130], ecx
imul eax, r10d
shr eax, 8
xor byte [r11 + rbx + 0x100], al
inc r11d
cmp r11d, dword [rbx + 0xd4]
jb 0x1400302c0
mov r9d, dword [rbx + 0xd4]
lea r8, [rbx + 0x100]
mov rdx, qword [rbx + 0x58]
mov rcx, qword [rbx + 0x38]
mov edi, dword [rbx + 0xd4]
call qword [rbx + reloc.WS2_32.dll_recv]
xor edx, edx
mov dword [rbx + 0xd4], 0
cmp eax, edi
mov ecx, 0xffffffff
cmovne edx, ecx
mov ecx, dword [rbx + 0x84]
add qword [rbx + 0x10118], rdi
mov eax, edx
add qword [rbx + 0x10120], rcx
mov dword [rbx + 0x84], 0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret