joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004b400
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14004b45d
lea rbx, [0x1400cd7e0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14004b444
cmp r10, 2
jb 0x14004b444
cmp byte [r9], r8b
jne 0x14004b444
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14004b420
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14004b49f
lea rbx, [0x1400cd7e0]
cmp r8b, 0x23
jne 0x14004b483
cmp byte [r9], r8b
jne 0x14004b483
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14004b470
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x14004b710
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
xor eax, eax
lea r8, [0x1400cdc95]
mov dword [rsp + 0x2c], eax
lea r11, [0x1400cd7e0]
mov qword [rsp + 0x38], rax
mov r10d, 0xffffffff
mov qword [rsp + 0x60], rax
mov rbx, rcx
lea rax, str.Window
mov edx, r10d
mov qword [rsp + 0x20], rax
mov r9b, 0x57
cmp r9b, 0x23
jne 0x14004b766
cmp byte [r8], r9b
jne 0x14004b766
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x14004b753
mov ecx, dword [rbx + 0x30ec]
lea rax, [0x140055e60]
mov edi, dword [rbx + 0x30e8]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x140055fd0]
mov qword [rsp + 0x40], rax
lea rax, [0x140055ef0]
mov qword [rsp + 0x48], rax
lea rax, [0x140055d10]
mov qword [rsp + 0x50], rax
lea rax, [0x1400560c0]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x14004b894
inc edi
test ecx, ecx
je 0x14004b7ea
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x14004b7ef
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x14004b894
mov rax, qword [0x14011dce8]
mov qword [rsp + 0x80], rsi
test rax, rax
je 0x14004b816
inc dword [rax + 0x3bc]
mov rdx, qword [0x14011dcf0]
movsxd rax, edi
lea rcx, [rax + rax*8]
shl rcx, 3
call qword [section..data]
mov rdx, qword [rbx + 0x30f0]
mov rsi, rax
test rdx, rdx
je 0x14004b87f
movsxd rcx, dword [rbx + 0x30e8]
lea r8, [rcx + rcx*8]
mov rcx, rax
shl r8, 3
call fcn.14009c440
mov rcx, qword [rbx + 0x30f0]
test rcx, rcx
je 0x14004b872
mov rax, qword [0x14011dce8]
test rax, rax
je 0x14004b872
dec dword [rax + 0x3bc]
mov rdx, qword [0x14011dcf0]
call qword [0x14011c008]
mov qword [rbx + 0x30f0], rsi
mov rsi, qword [rsp + 0x80]
mov dword [rbx + 0x30ec], edi
movsxd rax, dword [rbx + 0x30e8]
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*8]
mov rax, qword [rbx + 0x30f0]
movups xmmword [rax + rcx*8], xmm0
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movaps xmm1, xmmword [rsp + 0x50]
movups xmmword [rax + rcx*8 + 0x20], xmm0
movsd xmm0, qword [rsp + 0x60]
movups xmmword [rax + rcx*8 + 0x30], xmm1
movsd qword [rax + rcx*8 + 0x40], xmm0
inc dword [rbx + 0x30e8]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140055110
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [0x14011dce8]
cmp byte [rbx + 0x30d0], 0
jne 0x140055261
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14005525a
lea rdx, [0x140109390]
mov qword [rsp + 0x38], rdi
call fcn.14004b160
mov rdi, rax
test rax, rax
je 0x140055255
mov qword [rsp + 0x30], rbp
mov rcx, rax
mov qword [rsp + 0x40], r14
call fcn.1400a2634
mov r14d, eax
cmp eax, 0xffffffff
je 0x140055243
xor edx, edx
mov rcx, rdi
lea r8d, [rdx + 2]
call fcn.1400a1f70
test eax, eax
jne 0x140055243
mov rcx, rdi
call fcn.1400a2634
movsxd rbp, eax
cmp ebp, 0xffffffff
je 0x140055243
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call fcn.1400a1f70
test eax, eax
jne 0x140055243
mov r14, rbp
cmp rbp, 0xffffffffffffffff
je 0x140055243
mov rax, qword [0x14011dce8]
test rax, rax
je 0x1400551d5
inc dword [rax + 0x3bc]
mov rdx, qword [0x14011dcf0]
mov rcx, r14
call qword [section..data]
mov rbp, rax
test rax, rax
je 0x140055243
mov r9, rdi
mov r8, r14
mov edx, 1
mov rcx, rax
call fcn.1400a1ba0
mov rcx, rdi
cmp rax, r14
je 0x14005520f
call fcn.1400a14b8
jmp 0x14005521f
call fcn.1400a14b8
mov rdx, r14
mov rcx, rbp
call fcn.14004c1e0
mov rax, qword [0x14011dce8]
test rax, rax
je 0x140055231
dec dword [rax + 0x3bc]
mov rdx, qword [0x14011dcf0]
mov rcx, rbp
call qword [0x14011c008]
jmp 0x14005524b
mov rcx, rdi
call fcn.1400a14b8
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov byte [rbx + 0x30d0], 1
movss xmm0, dword [rbx + 0x30d4]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x1400552a4
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x30d4], xmm0
jb 0x1400552a4
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x140055293
call fcn.1400530d0
jmp 0x14005529a
mov byte [rbx + 0x3a4], 1
mov dword [rbx + 0x30d4], 0
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x1400594b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x140059641
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x140059520
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14005c700
mov r8d, dword [rbx + 0x80]
mov r9d, edi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.1400571c0
mov dword [rbx + 0x80], 0
jmp 0x14005962d
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.14005cc00
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rsi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rsi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], edi
movsd xmm0, qword [rsi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], edi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], edi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x140066750
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14011c358]
xor rax, rsp
mov qword [rsp + 0x48], rax
call fcn.14004ac20
mov rcx, qword [0x14011dd40]
lea rdx, [rsp + 0x28]
mov rdi, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rsp + 0x30]
sub ecx, dword [rsp + 0x28]
movd xmm1, ecx
mov ecx, dword [rsp + 0x34]
sub ecx, dword [rsp + 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, ecx
lea rcx, [rsp + 0x40]
cvtdq2ps xmm0, xmm0
movss dword [rdi + 8], xmm1
movss dword [rdi + 0xc], xmm0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x40]
xorps xmm1, xmm1
sub rax, qword [0x14011dd48]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x14011dd50]
mov ecx, send
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rdi + 0x10], xmm1
mov rax, qword [rsp + 0x40]
mov qword [0x14011dd48], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, reloc.WS2_32.dll_recv
and al, 1
mov byte [rdi + 0x140], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, send
and al, 1
mov byte [rdi + 0x141], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rdi + 0x143], 0
mov byte [rdi + 0x142], al
call fcn.14004ac20
cmp byte [rax + 0x39b], 0
lea rbx, [rax + 0x128]
je 0x14006687d
cvttss2si ecx, dword [rbx]
lea rdx, [rsp + 0x38]
cvttss2si eax, dword [rax + 0x12c]
mov dword [rsp + 0x38], ecx
mov rcx, qword [0x14011dd40]
mov dword [rsp + 0x3c], eax
call qword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x38]
call qword [sym.imp.USER32.dll_SetCursorPos]
mov dword [rbx], 0xff7fffff
mov dword [rbx + 4], 0xff7fffff
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x1400668ee
mov rdx, qword [0x14011dd40]
cmp rax, rdx
je 0x1400668ae
mov rcx, rax
call qword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x1400668ee
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1400668ee
mov rcx, qword [0x14011dd40]
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x1400668ee
movd xmm0, dword [rsp + 0x20]
movd xmm1, dword [rsp + 0x24]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [rbx], xmm0
movss dword [rbx + 4], xmm1
cmp byte [rdi + 0xc0], 0
je 0x1400668fe
mov eax, 0xffffffff
jmp 0x140066903
call fcn.14004ac30
cmp dword [reloc.WS2_32.dll_htons], eax
je 0x140066916
mov dword [reloc.WS2_32.dll_htons], eax
call fcn.140066940
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14009a320
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x14006dea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14011c358]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x90]
mov rdi, rdx
test eax, eax
movd edx, xmm3
mov r11d, 6
mov rbp, r8
mov r10d, r11d
mov r14, rcx
cmovns r10d, eax
mov eax, edx
and eax, 0x7fffff
shr edx, 0x17
lea r9d, [rax + rax]
test edx, edx
jne 0x14006df00
neg eax
sbb ecx, ecx
and ecx, 0xffffff82
jmp 0x14006df03
lea ecx, [rdx - 0x7f]
mov eax, r9d
mov r15d, 0x2d
bts eax, 0x18
test edx, edx
cmovne r9d, eax
mov eax, ecx
cdq
mov esi, eax
mov eax, 0x2b
xor esi, edx
sub esi, edx
test ecx, ecx
cmovns r15d, eax
cmp esi, 0xa
jae 0x14006df34
lea edx, [rax - 0x27]
jmp 0x14006df3d
cmp esi, 0x64
sbb rdx, rdx
add rdx, r11
mov rcx, rbp
movsxd r8, r10d
sub rcx, rdi
cmp rcx, r8
jge 0x14006df5b
mov qword [r14], rbp
mov dword [r14 + 8], 0x84
jmp 0x14006e0a7
xor eax, eax
test r10d, r10d
setg al
sub rcx, r8
add rax, rdx
cmp rcx, rax
jl 0x14006df4b
mov qword [rsp + 0x70], rbx
cmp r10d, r11d
jge 0x14006df9d
lea r8d, [r9 + r9]
sub r11d, r10d
shl r11d, 2
lea eax, [r8 - 1]
or eax, r9d
movzx ecx, r11b
mov edx, 1
shl edx, cl
and edx, eax
and edx, r8d
add r9d, edx
mov eax, r9d
and r9d, 0xffffff
shr eax, 0x18
add al, 0x30
mov byte [rdi], al
inc rdi
test r10d, r10d
jle 0x14006e024
mov byte [rdi], 0x2e
lea r11, [0x1400d4e58]
mov eax, r9d
lea r8d, [r10 - 1]
shr rax, 0x14
mov ecx, socket
movzx eax, byte [rax + r11]
mov byte [rdi + 1], al
add rdi, 2
test r8d, r8d
je 0x14006e024
mov edx, 0x100000
test ecx, ecx
je 0x14006e00e
lea eax, [rdx - 1]
sub ecx, 4
and r9d, eax
ror edx, 4
mov eax, r9d
shr rax, cl
movzx eax, byte [rax + r11]
mov byte [rdi], al
inc rdi
sub r8d, 1
jne 0x14006dfe6
jmp 0x14006e024
movsxd rbx, r8d
mov edx, 0x30
mov r8, rbx
mov rcx, rdi
call fcn.14009caf0
add rdi, rbx
mov byte [rdi], 0x70
lea r9, [rsp + 0x40]
mov byte [rdi + 1], r15b
add rdi, 2
nop dword [rax]
nop dword [rax + rax]
dec r9
mov eax, 0xcccccccd
mul esi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub sil, cl
add sil, 0x30
mov byte [r9], sil
mov esi, edx
test edx, edx
jne 0x14006e040
lea rbx, [rsp + 0x40]
mov rax, rbp
sub rbx, r9
sub rax, rdi
cmp rax, rbx
jge 0x14006e085
mov dword [r14 + 8], 0x84
jmp 0x14006e09f
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call fcn.14009c440
mov dword [r14 + 8], 0
lea rbp, [rbx + rdi]
mov qword [r14], rbp
mov rbx, qword [rsp + 0x70]
mov rax, r14
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14009a320
lea r11, [rsp + 0x50]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x14006e0d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x14011c358]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x90]
mov rsi, rdx
test eax, eax
movq rdx, xmm3
mov r9, rdx
mov r11d, recv
mov r10d, r11d
movabs rbx, 0xfffffffffffff
cmovns r10d, eax
mov rbp, r8
and r9, rbx
shr rdx, 0x34
mov r14, rcx
test edx, edx
jne 0x14006e143
mov rax, r9
neg rax
sbb ecx, ecx
and ecx, 0xfffffc02
jmp 0x14006e149
lea ecx, [rdx - 0x3ff]
mov rax, r9
movabs r8, 0x10000000000000
or rax, r8
mov r15d, 0x2d
test edx, edx
cmovne r9, rax
mov eax, ecx
cdq
mov edi, eax
mov eax, 0x2b
xor edi, edx
sub edi, edx
test ecx, ecx
cmovns r15d, eax
cmp edi, 0xa
jae 0x14006e183
lea edx, [rax - 0x27]
jmp 0x14006e19c
cmp edi, 0x64
jae 0x14006e18f
mov edx, 5
jmp 0x14006e19c
cmp edi, 0x3e8
sbb rdx, rdx
add rdx, 7
mov rcx, rbp
movsxd r8, r10d
sub rcx, rsi
cmp rcx, r8
jl 0x14006e2db
xor eax, eax
test r10d, r10d
setg al
sub rcx, r8
add rax, rdx
cmp rcx, rax
jl 0x14006e2db
cmp r10d, r11d
jge 0x14006e1f1
lea r8, [r9 + r9]
sub r11d, r10d
shl r11d, 2
lea rax, [r8 - 1]
or rax, r9
movzx ecx, r11b
mov edx, 1
shl rdx, cl
and rdx, rax
and rdx, r8
add r9, rdx
mov rax, r9
and r9, rbx
shr rax, 0x34
add al, 0x30
mov byte [rsi], al
inc rsi
test r10d, r10d
jle 0x14006e282
mov byte [rsi], 0x2e
lea r11, [0x1400d4e58]
mov rax, r9
lea r8d, [r10 - 1]
shr rax, 0x30
mov ecx, 0x30
movzx eax, byte [rax + r11]
mov byte [rsi + 1], al
add rsi, 2
test r8d, r8d
je 0x14006e282
movabs rdx, 0x1000000000000
nop dword [rax]
test ecx, ecx
je 0x14006e26c
lea rax, [rdx - 1]
sub ecx, 4
and r9, rax
ror rdx, 4
mov rax, r9
shr rax, cl
mov eax, eax
movzx eax, byte [rax + r11]
mov byte [rsi], al
inc rsi
sub r8d, 1
jne 0x14006e240
jmp 0x14006e282
movsxd rbx, r8d
mov edx, 0x30
mov r8, rbx
mov rcx, rsi
call fcn.14009caf0
add rsi, rbx
mov byte [rsi], 0x70
lea r9, [rsp + 0x40]
mov byte [rsi + 1], r15b
add rsi, 2
nop dword [rax]
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul edi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub dil, cl
add dil, 0x30
mov byte [r9], dil
mov edi, edx
test edx, edx
jne 0x14006e2a0
lea rbx, [rsp + 0x40]
mov rax, rbp
sub rbx, r9
sub rax, rsi
cmp rax, rbx
jge 0x14006e2e5
mov dword [r14 + 8], 0x84
jmp 0x14006e2ff
mov r8, rbx
mov rdx, r9
mov rcx, rsi
call fcn.14009c440
mov dword [r14 + 8], 0
lea rbp, [rbx + rsi]
mov qword [r14], rbp
mov rax, r14
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14009a320
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1400918f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rbx, r8
mov r14, rcx
mov rcx, qword [rcx]
mov r8d, 0x64
mov rdi, rdx
call fcn.140008030
test eax, eax
jle 0x1400919af
movzx eax, word [rdi + 8]
mov esi, 0
mov ecx, dword [rdi + 4]
mov edx, esi
xor ax, word [rdi]
xor dword [rdi + 0x10], ecx
xor dword [rdi + 0xc], ecx
mov word [rdi + 8], ax
jbe 0x140091960
lea rcx, [rdi + 0x14]
nop word [rax + rax]
mov eax, dword [rdi + 4]
inc edx
xor dword [rcx], eax
lea rcx, [rcx + 4]
cmp edx, dword [rdi + 0xc]
jb 0x140091950
test rbx, rbx
je 0x14009196d
mov eax, dword [rdi + 0x10]
cmp rax, rbx
ja 0x1400919af
mov eax, 0xa7a7
cmp word [rdi + 8], ax
jne 0x1400919af
mov ecx, dword [rdi + 0x10]
mov qword [rdi + 0x70], rcx
call fcn.1400a0b88
mov rdx, rax
mov qword [rdi + 0x68], rax
mov eax, dword [rdi + 0x10]
mov qword [rdi + 0x78], rsi
mov qword [rdi + 0x80], rsi
cmp eax, 0x2000
ja 0x1400919c7
mov rcx, qword [r14]
mov r8d, eax
call fcn.140008030
test eax, eax
jg 0x140091a08
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov rbx, rax
test eax, eax
je 0x140091a08
nop
mov rdx, qword [rdi + 0x68]
mov r8d, ebx
mov rcx, qword [r14]
add rdx, rsi
cmp rbx, 0x2000
jle 0x1400919ec
mov r8d, 0x2000
call fcn.140008030
test eax, eax
jle 0x1400919af
sub rbx, 0x2000
add rsi, 0x2000
test rbx, rbx
jg 0x1400919d0
mov al, 1
jmp 0x1400919b1
Function at 0x1400949a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov rbx, rdx
mov r14, rcx
call fcn.1400af098
mov r9d, eax
mov eax, 0x80008001
imul r9d
add edx, r9d
sar edx, 0xf
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
imul ecx, edx, 0xffff
sub r9d, ecx
mov word [rbx], r9w
call fcn.1400af098
mov r8d, dword [rbx + 0x80]
xor edx, edx
mov ecx, 0xffffffff
mov dword [rbx + 0xc], r8d
div ecx
mov eax, dword [rbx + 0x78]
mov dword [rbx + 0x10], eax
mov eax, 0xa7a7
xor ax, word [rbx]
mov dword [rbx + 4], edx
xor edx, edx
mov word [rbx + 8], ax
test r8d, r8d
je 0x140094a34
lea rcx, [rbx + 0x14]
nop word [rax + rax]
mov eax, dword [rbx + 4]
inc edx
xor dword [rcx], eax
lea rcx, [rcx + 4]
mov r8d, dword [rbx + 0xc]
cmp edx, r8d
jb 0x140094a20
mov eax, dword [rbx + 4]
mov rdx, rbx
xor dword [rbx + 0x10], eax
xor eax, r8d
mov dword [rbx + 0xc], eax
mov r8d, 0x64
mov rcx, qword [r14]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
call fcn.140007ff0
test eax, eax
jle 0x140094a7f
mov rdi, qword [rbx + 0x78]
cmp rdi, 0x2000
ja 0x140094a97
mov rdx, qword [rbx + 0x68]
mov r8d, edi
mov rcx, qword [r14]
call fcn.140007ff0
test eax, eax
jg 0x140094ad8
xor al, al
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
xor esi, esi
test rdi, rdi
jle 0x140094ad8
nop
mov rdx, qword [rbx + 0x68]
mov r8d, edi
mov rcx, qword [r14]
add rdx, rsi
cmp rdi, 0x2000
jbe 0x140094abc
mov r8d, 0x2000
call fcn.140007ff0
test eax, eax
jle 0x140094a7f
sub rdi, 0x2000
add rsi, 0x2000
test rdi, rdi
jg 0x140094aa0
mov rcx, rbx
call fcn.14008a720
mov ecx, 0x400
mov qword [rbx + 0x70], 0x400
call fcn.1400a0b88
mov qword [rbx + 0x68], rax
mov al, 1
mov qword [rbx + 0x78], 0
mov qword [rbx + 0x80], 0
jmp 0x140094a81
Function at 0x140094b10
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140094b32
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x140094bac
mov rdi, r14
mov rcx, rbx
call fcn.1400873e0
test rax, rax
jle 0x140094b84
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.14009c440
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140094b9c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140094ba4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140094b46
sub r14, rdi
jmp 0x140094c8f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140094bc3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140094bc5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140094bf7
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14009c440
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140094c8c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140094c32
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x140094c6d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400a1ba0
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x140094c8c
cmp rbp, rax
ja 0x140094c40
test rbp, rbp
je 0x140094c8c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400a1ba0
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140096050
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x28
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov edi, 1
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x1400961fd
lea rax, [rdx - 1]
mov qword [rsp + 0x50], rbx
mov rbx, qword [rsi + 8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
mov qword [rsp + 0x20], r14
inc ecx
shl rdi, cl
lea rcx, [rsi + 0x18]
lea rdx, [rdi + rdi]
call fcn.140095f10
lea rax, [rdi - 1]
mov qword [rsi + 0x38], rdi
mov qword [rsi + 0x30], rax
mov rax, qword [rsi + 8]
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x1400961c6
mov qword [rsp + 0x58], rbp
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rdi
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rdi
xor r9, rdx
imul r9, rdi
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rbx
jne 0x140096140
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x1400961b5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14009617d
mov r10, qword [rdx]
cmp r10, rax
je 0x140096177
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x1400961b5
cmp r9, rdx
je 0x140096191
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x1400961d7
cmp r9, rdx
jne 0x140096182
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
jne 0x1400960f0
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x1400961b5
lea rcx, str.invalid_hash_bucket_count
call fcn.1400989bc
int3