joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007bac0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xc0
mov rax, qword [0x1403b8008]
xor rax, rsp
mov qword [rsp + 0xa0], rax
cmp qword [rcx + 8], 0
mov rbx, rcx
mov qword [r11 + 0x18], rbp
mov rbp, rdx
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x18], r14
mov dword [rcx + 0x20], 1
jne 0x14007bb21
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
lea r8, str.Microsoft_Base_Cryptographic_Provider_v1.0
xor edx, edx
add rcx, 8
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov dword [rbx + 0x20], eax
xor edi, edi
cmp dword [rbx + 0x20], edi
je 0x14007bc19
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14007bb42
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov dword [rbx + 0x20], eax
mov qword [rbx + 0x10], rdi
cmp dword [rbx + 0x20], edi
je 0x14007bc19
cmp qword [rbx + 0x10], rdi
lea rax, [rbx + 0x10]
jne 0x14007bb72
mov rcx, qword [rbx + 8]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x8003
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
mov dword [rbx + 0x20], eax
cmp dword [rbx + 0x20], edi
je 0x14007bc19
mov qword [rsp + 0xe8], rsi
mov rsi, 0xffffffffffffffff
test rbp, rbp
jne 0x14007bbf2
mov r8, qword [rbx + 0x30]
lea edx, [rsi + 0x65]
lea rcx, [rsp + 0x30]
call fcn.1402a4d40
lea rcx, [rsp + 0x30]
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], dil
jne 0x14007bbb0
dec eax
movsxd r8, eax
test eax, eax
jle 0x14007bbed
lea rdx, [rsp + 0x30]
add rdx, r8
nop word [rax + rax]
movzx eax, byte [rsp + rdi + 0x30]
movzx ecx, byte [rdx]
lea rdx, [rdx - 1]
add al, 5
mov byte [rdx + 1], al
mov byte [rsp + rdi + 0x30], cl
inc rdi
cmp rdi, r8
jl 0x14007bbd0
lea rbp, [rsp + 0x34]
inc rsi
cmp byte [rsi + rbp], 0
jne 0x14007bbf2
mov rcx, qword [rbx + 0x10]
mov r8, rsi
xor r9d, r9d
mov rdx, rbp
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rsi, qword [rsp + 0xe8]
mov dword [rbx + 0x20], eax
cmp dword [rbx + 0x20], 0
mov rdi, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xe0]
je 0x14007bc54
mov r8, qword [rbx + 0x10]
lea rax, [rbx + 0x18]
mov rcx, qword [rbx + 8]
mov r9d, 1
mov edx, 0x6801
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
mov dword [rbx + 0x20], eax
cmp dword [rbx + 0x20], 0
mov r14, qword [rsp + 0xb0]
jne 0x14007bc7b
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, [rbx + 0x28]
mov dword [rbx + 0x24], eax
lea rdx, str.Error_creating_encryption_key
call fcn.14007c280
mov eax, dword [rbx + 0x20]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400a91a0
add rsp, 0xc0
pop rbx
ret
Function at 0x14007bca0
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x1403b8008]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r15, r9
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x50], rdx
mov dword [rsp + 0x40], 0
mov dword [rcx + 0x20], 1
xor eax, eax
mov qword [rdx], rax
call fcn.14007b770
mov rcx, rax
test rax, rax
je 0x14007be72
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
lea rdx, [0x14038f2a6]
mov rcx, rdi
cmp rdx, 0x10000
jae 0x14007bd1c
movzx edx, dx
call fcn.14007c450
jmp 0x14007bd22
call fcn.14007c280
nop
mov dword [rsp + 0x40], 1
mov rsi, 0xffffffffffffffff
mov rax, rsi
inc rax
cmp byte [rax + rbp], 0
jne 0x14007bd34
mov dword [rsp + 0x58], eax
lea r14, [rbx + 0x18]
test r15, r15
jne 0x14007bd4f
cmp qword [r14], r15
jne 0x14007bd61
mov rdx, r15
mov rcx, rbx
call fcn.14007bac0
mov dword [rbx + 0x20], eax
mov eax, dword [rsp + 0x58]
cmp dword [rbx + 0x20], 0
je 0x14007be55
lea ecx, [rax + 1]
call fcn.1400a96b0
mov r15, rax
mov ecx, dword [rsp + 0x58]
inc ecx
mov edx, ecx
mov r9d, ecx
mov r8, rbp
mov rcx, rax
call fcn.1402a4834
mov edx, dword [rsp + 0x58]
mov dword [rsp + 0x30], edx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
mov rcx, qword [r14]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov dword [rbx + 0x20], eax
test eax, eax
je 0x14007be48
mov r9d, dword [rsp + 0x58]
mov r8, r15
lea rdx, [rsp + 0x48]
call fcn.14007c080
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rdi]
sub rbx, 0x18
cmp rcx, rbx
je 0x14007be2b
cmp dword [rbx + 0x10], 0
jl 0x14007be1e
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14007be1e
call fcn.14007c5d0
mov rbp, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14007be15
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.WS2_32.dll_htonl + 8]
lea rax, [rbp + 0x18]
mov qword [rdi], rax
jmp 0x14007be2b
mov r8d, dword [rdx - 0x10]
mov rcx, rdi
call fcn.14007c680
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14007be48
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
mov edx, 1
mov rcx, r15
call fcn.1400a96a8
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400a91a0
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.14007b5d0
int3
Function at 0x14007be80
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x1403b8008]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rdi, r9
mov r14, r8
mov r12, rdx
mov qword [rsp + 0x40], rdx
mov r13, rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x58], rdx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
mov dword [rcx + 0x20], 1
xor eax, eax
mov qword [rdx], rax
call fcn.14007b770
mov rcx, rax
test rax, rax
je 0x14007c068
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [r12], rax
lea rdx, [0x14038f2a6]
mov rcx, r12
cmp rdx, 0x10000
jae 0x14007bf0b
movzx edx, dx
call fcn.14007c450
jmp 0x14007bf11
call fcn.14007c280
nop
mov dword [rsp + 0x30], 1
mov rsi, 0xffffffffffffffff
mov rbx, rsi
inc rbx
cmp byte [r14 + rbx], 0
jne 0x14007bf23
test rdi, rdi
jne 0x14007bf38
cmp qword [r13 + 0x18], rdi
jne 0x14007bf47
mov rdx, rdi
mov rcx, r13
call fcn.14007bac0
mov dword [r13 + 0x20], eax
cmp dword [r13 + 0x20], 0
je 0x14007c047
shr ebx, 1
mov dword [rsp + 0x60], ebx
lea ecx, [rbx + 1]
call fcn.1400a96b0
mov rbx, rax
mov qword [rsp + 0x50], rax
mov eax, dword [rsp + 0x60]
nop dword [rax]
inc rsi
cmp byte [r14 + rsi], 0
jne 0x14007bf70
mov byte [rbx], 0
mov ebp, r15d
test esi, esi
jle 0x14007c005
mov r12, rbx
mov r13d, eax
nop
movsx ecx, byte [r14]
call fcn.1402a4808
mov edi, eax
lea ebx, [rax - 0x30]
movsx ecx, byte [r14 + 1]
lea r14, [r14 + 2]
call fcn.1402a4808
lea edx, [rax - 0x30]
mov ecx, reloc.WS2_32.dll_getservbyname
cmp bl, 9
mov r8d, gethostbyaddr
cmovbe ecx, r8d
sub dil, cl
shl dil, 4
mov ecx, reloc.WS2_32.dll_getservbyname
cmp dl, 9
cmovbe ecx, r8d
sub al, cl
or dil, al
mov byte [r12], dil
lea r12, [r12 + 1]
mov byte [r12], 0
cmp r15d, r13d
jge 0x14007bff6
inc r15d
add ebp, 2
cmp ebp, esi
jl 0x14007bf90
mov r12, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 1]
mov rcx, qword [r13 + 0x18]
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov dword [r13 + 0x20], eax
test eax, eax
je 0x14007c03a
mov rdx, rbx
mov rcx, r12
call fcn.14007c280
mov edx, 1
mov rcx, rbx
call fcn.1400a96a8
mov rax, r12
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400a91a0
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80004005
call fcn.14007b5d0
int3
Function at 0x140083360
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140083382
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x1400833fc
mov rdi, r14
mov rcx, rbx
call fcn.1400869c0
test rax, rax
jle 0x1400833d4
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.140299960
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400833ec
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_getservbyport]
cmp eax, 0xffffffff
je 0x1400833f4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140083396
sub r14, rdi
jmp 0x1400834df
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140083413
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140083415
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140083447
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140299960
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400834dc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140083482
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x1400834bd
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1402aaec0
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x1400834dc
cmp rbp, rax
ja 0x140083490
test rbp, rbp
je 0x1400834dc
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1402aaec0
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x14009ce20
Capabilities:
Connect socket
Initialize winsock library
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x200
mov rax, qword [0x1403b8008]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
xor edx, edx
xor ecx, ecx
call fcn.1400d7f40
xor edx, edx
mov ecx, 0x200002
call fcn.1400d7f40
mov esi, 2
xor edx, edx
mov ecx, esi
call fcn.14011a020
xor edx, edx
lea ecx, [rsi + 0xa]
call fcn.14011a020
call fcn.1400d8130
mov rcx, rax
call fcn.1400d3d80
mov ecx, 0x202
lea rdx, [rsp + 0x50]
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor ebp, ebp
lea edx, [rsi - 1]
mov dword [rsp + 0x28], ebp
lea r8d, [rsi + 4]
xor r9d, r9d
mov dword [rsp + 0x20], ebp
mov ecx, esi
call qword [sym.imp.WS2_32.dll_WSASocketW]
lea rcx, str.api.github.com
mov word [rsp + 0x40], si
mov rdi, rax
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx]
mov ecx, dword [rdx]
mov dword [rsp + 0x44], ecx
mov ecx, 0x1bb
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, rbx
mov word [rsp + 0x42], ax
call fcn.1400d5500
mov edx, edi
mov rcx, rax
mov rbx, rax
call fcn.1400d5ef0
mov qword [rsp + 0x30], rbp
lea r8d, [rsi + 0xe]
mov qword [rsp + 0x28], rbp
lea rdx, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rbp
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_WSAConnect]
cmp eax, 0xffffffff
jne 0x14009cf3b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x14009cf3e
mov rax, rbx
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1400a91a0
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400a0a50
Capabilities:
Get session user name
Get user security identifier

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x690
mov rax, qword [0x1403b8008]
xor rax, rsp
mov qword [rsp + 0x680], rax
mov rbx, rdx
mov qword [rsp + 0x68], rdx
xor edi, edi
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x80]
lea ecx, [rdi + 2]
call qword [sym.imp.Secur32.dll_GetUserNameExW]
mov edx, 0x800
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [rsp + 0x70], 0x400
mov dword [rsp + 0x74], 0x400
lea rcx, [rsp + 0x7c]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x74]
lea r8, [rsp + 0x280]
lea rdx, [rsp + 0x80]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x280]
call qword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidW]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
mov rdx, qword [rsp + 0x68]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], di
jne 0x1400a0b20
lea rcx, [rsp + 0x48]
call fcn.140086a00
nop
lea r8, [rsp + 0x48]
mov rdx, rbx
call fcn.1400a0c70
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x1400a0b81
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400a0b7c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400a0ba5
call fcn.1400a96a8
mov rax, rbx
mov rcx, qword [rsp + 0x680]
xor rcx, rsp
call fcn.1400a91a0
mov rbx, qword [rsp + 0x6a0]
add rsp, 0x690
pop rdi
ret
call fcn.1402a4cc8
int3
Function at 0x1400a7280
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x1400a728b
xor eax, eax
ret
lea r11, [0x140390750]
not ecx
cmp r8, 8
jb 0x1400a735d
mov r10, r8
shr r10, 3
imul rax, r10, 0xfffffffffffffff8
add r8, rax
nop dword [rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1400a72b0
test r8, r8
je 0x1400a738d
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x1400a7370
not ecx
mov eax, ecx
ret
Function at 0x1400a76b0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rax, qword [0x1403b8008]
xor rax, rsp
mov qword [rsp + 0x38], rax
cmp byte [rcx + 0x41], 0
mov rsi, rdx
mov edi, r8d
mov rbx, rcx
je 0x1400a77c9
mov rcx, qword [rcx + 0x50]
mov rax, rcx
test rcx, rcx
je 0x1400a76fb
cmp dword [rbx + 0x58], edi
jae 0x1400a76fb
call fcn.1400a96a8
mov qword [rbx + 0x50], 0
jmp 0x1400a7700
test rax, rax
jne 0x1400a770f
lea ecx, [rdi + rdi]
call fcn.1400a96b0
mov qword [rbx + 0x50], rax
mov dword [rbx + 0x58], edi
mov r8, rdi
mov rdx, rsi
mov rcx, rax
mov rbp, rdi
call fcn.140299960
test edi, edi
je 0x1400a77c3
mov qword [rsp + 0x40], r15
xor r11d, r11d
lea r15, [0x140390750]
mov rsi, rdi
nop word [rax + rax]
mov rax, qword [rbx + 0x50]
lea r11, [r11 + 1]
mov edx, dword [rbx + 0x44]
mov ecx, edx
mov r9d, dword [rbx + 0x4c]
mov r8d, r9d
shr edx, 8
movsx r10, byte [r11 + rax - 1]
and r9d, 0xfffd
xor rcx, r10
or r9d, 2
movzx eax, cl
xor edx, dword [r15 + rax*4]
movzx eax, dl
add eax, dword [rbx + 0x48]
imul eax, eax, 0x8088405
mov dword [rbx + 0x44], edx
inc eax
mov ecx, eax
shr rcx, 0x18
mov dword [rbx + 0x48], eax
movzx eax, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r15 + rcx*4]
mov ecx, r9d
xor ecx, 1
mov dword [rbx + 0x4c], r8d
mov rax, qword [rbx + 0x50]
imul ecx, r9d
shr ecx, 8
xor cl, r10b
mov byte [r11 + rax - 1], cl
sub rsi, 1
jne 0x1400a7740
mov r15, qword [rsp + 0x40]
mov rsi, qword [rbx + 0x50]
jmp 0x1400a77cc
mov rbp, rdi
mov rdx, qword [rbx + 0x30]
test rdx, rdx
je 0x1400a77fe
mov ecx, dword [rbx + 0x38]
lea eax, [rcx + rdi]
cmp eax, dword [rbx + 0x3c]
jb 0x1400a77e9
mov dword [rbx + 0x24], 0x30000
jmp 0x1400a782e
add rcx, rdx
mov r8, rbp
mov rdx, rsi
call fcn.140299960
add dword [rbx + 0x38], edi
mov eax, edi
jmp 0x1400a7830
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400a7827
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [rsp + 0x30]
jmp 0x1400a7830
mov dword [rbx + 0x24], 0x1000000
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400a91a0
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400a7ac0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1403b8008]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rcx
mov rbp, rdx
mov rcx, qword [rcx + 0xb8]
test rcx, rcx
je 0x1400a7b40
mov eax, dword [rdi + 0xc4]
mov esi, dword [rdi + 0xc0]
cmp eax, esi
jae 0x1400a7b90
sub esi, eax
lea rdx, [rcx + rax]
cmp esi, r8d
mov rcx, rbp
cmova esi, r8d
mov r8d, esi
call fcn.140299960
mov ecx, dword [rdi + 0xa0]
mov rdx, rbp
add dword [rdi + 0xc4], esi
add dword [rdi + 0x9c], esi
mov r8d, esi
call fcn.1400a7280
mov dword [rdi + 0xa0], eax
mov eax, esi
jmp 0x1400a7b92
mov rcx, qword [rdi + 0xa8]
test rcx, rcx
je 0x1400a7b89
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400a7b90
mov ebx, dword [rsp + 0x30]
mov rdx, rbp
add dword [rdi + 0x9c], ebx
mov r8d, ebx
mov ecx, dword [rdi + 0xa0]
call fcn.1400a7280
mov dword [rdi + 0xa0], eax
mov eax, ebx
jmp 0x1400a7b92
mov dword [rdi + 0x24], 0x1000000
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400a91a0
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a9dc0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400a9e0a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400a9e0a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400a9e0a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400a9e0a
cmp dword [rcx + 0x84], 0xe
jbe 0x1400a9e0a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400a9e0c
xor al, al
add rsp, 0x28
ret

Function at 0x1400c9354
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x1400b2e16
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x1400b2df9
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x1400b2de4
Function at 0x14011b700
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1402cdb60
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x140121e50
Capabilities:
Encode data using add xor sub operations

Disassembly:
xor eax, eax
mov r10, rcx
test rcx, rcx
je 0x140121ebc
movzx ecx, byte [rcx]
test cl, cl
je 0x140121ebc
mov r11d, 0x100
nop word [rax + rax]
movsx r9d, cl
lea r10, [r10 + 1]
or r9d, r11d
mov r8d, eax
mov edx, r9d
mov ecx, 0x20
shr edx, 2
add r11d, 0x100
xor edx, r9d
imul r9d, r9d
and edx, 0xf
sub ecx, edx
shr r8, cl
mov ecx, edx
mov edx, eax
mov eax, r8d
shl edx, cl
movzx ecx, byte [r10]
or eax, edx
xor eax, r9d
test cl, cl
jne 0x140121e70
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
ret

Function at 0x140121ec0
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x20
call fcn.1402cdb60
sub rsp, rax
xor ebx, ebx
mov rdi, rcx
test rcx, rcx
je 0x140121f53
movzx eax, byte [rcx]
test al, al
je 0x140121f53
mov qword [rsp + 0x30], rsi
mov esi, 0x100
nop
movsx ecx, al
call fcn.140175f40
mov r9d, eax
mov edx, ebx
or r9d, esi
lea rdi, [rdi + 1]
mov eax, ebx
mov r8d, r9d
shr r8d, 2
mov ecx, 0x20
xor r8d, r9d
add esi, 0x100
and r8d, 0xf
imul r9d, r9d
sub ecx, r8d
shr rdx, cl
mov ecx, r8d
shl eax, cl
mov ebx, edx
or ebx, eax
movzx eax, byte [rdi]
xor ebx, r9d
test al, al
jne 0x140121ef0
mov rsi, qword [rsp + 0x30]
mov eax, ebx
shr eax, 0x10
xor eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x140138540
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1402cdb60
sub rsp, rax
lea rcx, [0x1403c19d0]
add rsp, 0x28
jmp fcn.14011b580
Function at 0x14014e500
Capabilities:
Encode data using xor

Disassembly:
push rbx
movsxd rbx, r9d
mov r10, r8
mov r11, rdx
cmp rdx, r8
je 0x14014e662
mov qword [rsp + 0x10], rsi
lea rsi, [rcx - 1]
not rcx
shr rsi, 0x3f
shr rcx, 0x3f
and rsi, rcx
mov ecx, dword [rdx + 8]
xor ecx, dword [r8 + 8]
dec rsi
and ecx, esi
xor dword [rdx + 8], ecx
xor dword [r8 + 8], ecx
mov ecx, dword [rdx + 0x10]
movq xmm4, rsi
xor ecx, dword [r8 + 0x10]
and ecx, esi
punpcklqdq xmm4, xmm4
xor dword [rdx + 0x10], ecx
xor dword [r8 + 0x10], ecx
mov edx, dword [rdx + 0x14]
mov ecx, dword [r8 + 0x14]
xor rcx, rdx
and ecx, 4
and rcx, rsi
mov eax, ecx
xor eax, edx
mov dword [r11 + 0x14], eax
xor dword [r8 + 0x14], ecx
xor ecx, ecx
mov edx, ecx
test r9d, r9d
jle 0x14014e622
cmp ebx, 2
jb 0x14014e622
mov r9, qword [r8]
lea rax, [rbx - 1]
mov r8, qword [r11]
mov qword [rsp + 0x18], rdi
lea rdi, [rbx - 1]
lea rdi, [r9 + rdi*8]
lea rax, [r8 + rax*8]
cmp r9, rax
ja 0x14014e5ae
cmp rdi, r8
jae 0x14014e61d
cmp r9, r10
ja 0x14014e5b8
cmp rdi, r10
jae 0x14014e61d
cmp r9, r11
ja 0x14014e5c2
cmp rdi, r11
jae 0x14014e61d
cmp r8, r10
ja 0x14014e5cc
cmp rax, r10
jae 0x14014e61d
cmp r8, r11
ja 0x14014e5d6
cmp rax, r11
jae 0x14014e61d
mov eax, ebx
and eax, 0xfffffffe
nop dword [rax + rax]
movdqu xmm2, xmmword [rcx + r9]
add edx, 2
movdqu xmm1, xmmword [rcx + r8]
lea rcx, [rcx + 0x10]
movdqa xmm3, xmm2
pxor xmm3, xmm1
pand xmm3, xmm4
movdqa xmm0, xmm3
pxor xmm3, xmm2
pxor xmm0, xmm1
movdqu xmmword [rcx + r8 - 0x10], xmm0
movdqu xmmword [rcx + r9 - 0x10], xmm3
cmp edx, eax
jl 0x14014e5e0
mov rdi, qword [rsp + 0x18]
movsxd rax, edx
cmp rax, rbx
jge 0x14014e65d
nop word [rax + rax]
mov rcx, qword [r11]
mov rdx, qword [rcx + rax*8]
lea r8, [rcx + rax*8]
mov rcx, qword [r10]
mov r9, rdx
xor r9, qword [rcx + rax*8]
and r9, rsi
xor rdx, r9
mov qword [r8], rdx
mov rcx, qword [r10]
xor qword [rcx + rax*8], r9
inc rax
cmp rax, rbx
jl 0x14014e630
mov rsi, qword [rsp + 0x10]
pop rbx
ret