joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b4e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
xorps xmm15, xmm15
xor r14, r14
mov rax, qword [0x0068a510]
mov rax, qword gs:[rax]
cmp rax, 0
je 0x46b57b
mov r14, qword [rax]
sub rsp, 0x10
mov rax, rcx
mov rbx, rdx
call sym.runtime.sigtrampgo
add rsp, 0x10
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
pop rbp
ret

Function at 0x46b7a0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
mov rax, qword [0x0068a510]
mov rax, qword gs:[rax]
cmp rax, 0
jne 0x46b837
int 3
mov r14, qword [rax]
sub rsp, 0x28
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], r9
call sym.runtime.sehhandler.abi0
mov eax, dword [rsp + 0x20]
add rsp, 0x28
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
add rsp, 0x28
pop rbp
ret
Function at 0x46bc00
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46bc34
mov rcx, 0x28
jmp 0x46bc3f
shl rcx, 3
add rcx, 0x1480
mov qword [0x0068a510], rcx
pop rbp
ret
Function at 0x485ca0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x485d6a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0068a510]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x485d4f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004f54c0]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x485d3e
mov edi, 1
lea rsi, [0x004f54c0]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0054daf8]
lea rsi, [0x0054d1b0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString

Function at 0x4ae660
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aed9f
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x4ae68d
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x4ae911
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x4ae93d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x0054fc80]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004f53c0]
lea rbx, [0x0054d9f0]
call sym.runtime.gopanic
inc rax
cmp rax, r8
jge 0x4ae962
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x4ae997
lea rdi, [0x004f5440]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x4ae683
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x4ae97b
jmp 0x4ae950
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.internal_bisect.Hash

Function at 0x4aef40
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4aef57
inc rax
cmp rax, 4
jge 0x4aef6f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4aef54
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4aef80
inc rax
cmp rax, 4
jge 0x4aef8e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4aefb7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4aef9b
jmp 0x4aef7d
Function at 0x4beac0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bec0e
push rbp
mov rbp, rsp
sub rsp, 0x68
movups xmmword [rsp + 0x40], xmm15
mov qword [rsp + 0x30], 0
mov rax, qword [0x005fcc88]
call sym.internal_godebug._Setting_.Value
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
movups xmmword [rsp + 0x50], xmm15
mov qword [rsp + 0x60], 0
lea rcx, [sym.net.goDebugNetDNS.func1]
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x58], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x2b
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0068a510]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x18]
cmp rcx, 0xffffffffffffffff
je 0x4bebd2
mov rdx, qword [rsp + 0x28]
nop dword [rax + rax]
cmp rdx, rcx
jb 0x4bec08
mov qword [rsp + 0x20], rcx
mov rsi, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, rcx
lea rdx, [rsp + 0x50]
call rsi
mov rax, qword [rsp + 0x20]
lea rcx, [rax + 1]
mov rbx, qword [rsp + 0x28]
cmp rbx, rcx
jb 0x4bebfd
mov rsi, qword [rsp + 0x50]
sub rbx, rax
dec rbx
mov rdi, rbx
neg rdi
sar rdi, 0x3f
and rcx, rdi
mov rdi, qword [rsp + 0x38]
lea rax, [rdi + rcx]
lea rdx, [rsp + 0x50]
call rsi
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
lea rdx, [rsp + 0x50]
call rcx
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x68
pop rbp
ret
mov rax, rcx
mov rcx, rbx
call sym.runtime.panicSliceB
call sym.runtime.panicSliceAlen
nop
call sym.runtime.morestack_noctxt.abi0
jmp sym.net.goDebugNetDNS
Function at 0x4cd800
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cd9e0
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x88], r8
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x60], rax
cmp rsi, 2
jne 0x4cd876
cmp word [rdi], 0x7069
jne 0x4cd8d2
mov qword [rsp], r8
mov qword [rsp + 8], r9
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.CountString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0068a510]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
setg al
mov rbx, qword [rsp + 0x68]
mov ecx, eax
mov rax, qword [rsp + 0x60]
jmp 0x4cd8d4
cmp rsi, 3
jne 0x4cd8d2
cmp word [rdi], 0x6374
jne 0x4cd889
cmp byte [rdi + 2], 0x70
je 0x4cd896
cmp word [rdi], 0x6475
jne 0x4cd8d2
cmp byte [rdi + 2], 0x70
jne 0x4cd8d2
mov qword [rsp], r8
mov qword [rsp + 8], r9
mov byte [rsp + 0x10], 0x5b
call sym.internal_bytealg.CountString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0068a510]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
setg al
mov rbx, qword [rsp + 0x68]
mov ecx, eax
mov rax, qword [rsp + 0x60]
jmp 0x4cd8d4
xor ecx, ecx
test cl, cl
je 0x4cd8e5
mov rdx, rax
mov rcx, rbx
nop
jmp 0x4cd986
mov rsi, rax
mov rcx, rbx
jmp 0x4cd908
mov rax, qword [rsp + 0x48]
add rax, 0x10
mov rbx, qword [rsp + 0x30]
dec rbx
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
test rbx, rbx
jle 0x4cd94b
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x48], rax
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
mov rbx, qword [rax + 8]
mov qword [rsp + 0x38], rbx
mov rsi, qword [sym.net.isIPv4]
lea rdx, sym.net.isIPv4
mov rax, rcx
call rsi
test al, al
je 0x4cd8ed
mov rcx, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x38]
jmp 0x4cd957
test rcx, rcx
jbe 0x4cd961
mov rcx, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rcx
add rsp, 0x50
pop rbp
nop
ret
xor eax, eax
mov rcx, rax
call sym.runtime.panicIndex
mov rax, qword [rsp + 0x48]
add rax, 0x10
mov rbx, qword [rsp + 0x30]
dec rbx
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
test rbx, rbx
jle 0x4cd9c0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x48], rax
mov rcx, qword [rax]
mov qword [rsp + 0x28], rcx
mov rbx, qword [rax + 8]
mov qword [rsp + 0x40], rbx
mov rax, rcx
call sym.net.isIPv4
test al, al
jne 0x4cd96b
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x40]
jmp 0x4cd9cc
test rcx, rcx
jbe 0x4cd9d5
mov rcx, qword [rdx]
mov rbx, qword [rdx + 8]
mov rax, rcx
add rsp, 0x50
pop rbp
ret
xor eax, eax
mov rcx, rax
call sym.runtime.panicIndex
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp sym.net.addrList.forResolve
Function at 0x4dfe40
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x4e0025
push rbp
mov rbp, rsp
sub rsp, 0x88
mov qword [rsp + 0x98], rax
mov rbx, qword [rax + 0x18]
test rbx, rbx
je 0x4dff5a
mov rdx, qword [rax + 0x10]
mov rcx, qword [rax + 0x20]
mov rax, rdx
call sym.net.IP.String
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x60], rbx
mov rdx, qword [rsp + 0x98]
mov rdx, qword [rdx + 0x28]
mov rax, rdx
mov ebx, 0xa
call sym.strconv.FormatInt
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x50], rbx
mov rdx, qword [rsp + 0x80]
mov qword [rsp], rdx
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 8], rsi
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0068a510]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4dff27
xor eax, eax
lea rbx, [0x0051e180]
mov ecx, 1
mov rdi, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x60]
lea r8, [0x0051e1bc]
mov r9d, 2
mov r10, qword [rsp + 0x70]
mov r11, qword [rsp + 0x50]
nop dword [rax + rax]
call sym.runtime.concatstring4
jmp 0x4dff51
xor eax, eax
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x0054c4a0]
mov esi, 1
mov r8, qword [rsp + 0x70]
mov r9, qword [rsp + 0x50]
call sym.runtime.concatstring3
add rsp, 0x88
pop rbp
ret
mov rcx, qword [rax + 0x28]
mov ebx, 0xa
mov rax, rcx
call sym.strconv.FormatInt
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rcx]
mov qword [rsp + 0x78], rdx
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x58], rcx
mov qword [rsp], rdx
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 0x3a
nop dword [rax]
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0068a510]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x4dfff5
xor eax, eax
lea rbx, [0x0051e180]
mov ecx, 1
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x58]
lea r8, [0x0051e1bc]
mov r9d, 2
mov r10, qword [rsp + 0x68]
mov r11, qword [rsp + 0x48]
call sym.runtime.concatstring4
jmp 0x4e001c
xor eax, eax
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
lea rdi, [0x0054c4a0]
mov esi, 1
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x48]
call sym.runtime.concatstring3
add rsp, 0x88
pop rbp
ret
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.github.com_things_go_go_socks5_statute._AddrSpec_.String
Function at 0x1400275e0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1400275ed
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1400275fd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1400275e5
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140027615
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140027602
sub eax, 3
jb 0x14002762f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140027666
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140027656
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140027654
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140027643
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.1400275a2
jmp 0x1400275ed
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x12c00
mov dl, 0xe
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1400276b2
cmp rsi, rcx
jae 0x1400276ba
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140027699
cmp al, 0x8f
ja 0x140027699
cmp byte [rsi - 2], 0xf
je 0x14002769f
sub al, 0xe8
cmp al, 1
ja 0x140027683
cmp rsi, rcx
jae 0x1400276ba
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140027689
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1400276ba
lodsb al, byte [rsi]
jmp 0x140027699
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x25000]
mov eax, dword [rdi]
or eax, eax
je 0x140027717
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x271dc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1400276c7
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140027711
mov qword [rbx], rax
add rbx, 8
jmp 0x1400276e7
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140027751
cmp al, 0xef
ja 0x140027743
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140027723
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140027732
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x227]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1400277a5
sub rsp, 0xffffffffffffff80
jmp 0x140001d40
Function at 0x140009038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rbx + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000905c
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400090b3
cmp qword [rcx + rdx*8], rbx
jne 0x1400090a8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400090ac
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400090c0
cmp qword [rcx + rdx*8], rbx
jne 0x1400090c0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x1400090f5
mov rcx, qword [rbx + 0x18]
inc rdx
mov r8d, 2
call fcn.1400020a4
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x37]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b51c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400148a0], eax
call fcn.14000b2a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
cmp dword [0x1400148a0], 0
jne case.default.0x14000b572
mov ecx, 1
call fcn.14000b2a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
test al, 0xdc
and ebx, ebx
adc dl, byte [rdi + 0x5c5e2a73]
cmpsw word [rsi], word [rdi]
pop rsi
pop rdi
invalid
Function at 0x1406908f0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140690a77
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140690921
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140690907
add dl, dl
jne 0x14069092e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14069098e
xor eax, eax
add dl, dl
jne 0x14069093d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140690a45
add dl, dl
jne 0x14069094e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14069095b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140690968
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140690975
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140690982
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140690916
mov eax, 1
add dl, dl
jne 0x14069099e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406909ab
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140690993
sub eax, ebx
mov ebx, 1
jne 0x1406909e4
mov ecx, 1
add dl, dl
jne 0x1406909c6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406909d3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406909bb
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140690916
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140690a00
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140690a0d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406909f5
cmp eax, 0x7d00
jae 0x140690a33
cmp eax, 0x500
jb 0x140690a2e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140690916
cmp eax, 0x7f
ja 0x140690a36
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140690916
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140690a6a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140690916
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14069f058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14069f1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14069f089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14069f06f
add dl, dl
jne 0x14069f096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14069f0f6
xor eax, eax
add dl, dl
jne 0x14069f0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14069f1ad
add dl, dl
jne 0x14069f0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14069f0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14069f0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14069f0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14069f0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14069f07e
mov eax, 1
add dl, dl
jne 0x14069f106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14069f113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14069f0fb
sub eax, ebx
mov ebx, 1
jne 0x14069f14c
mov ecx, 1
add dl, dl
jne 0x14069f12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14069f13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14069f123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14069f07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14069f168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14069f175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14069f15d
cmp eax, 0x7d00
jae 0x14069f19b
cmp eax, 0x500
jb 0x14069f196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14069f07e
cmp eax, 0x7f
ja 0x14069f19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14069f07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14069f1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14069f07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20