joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008c18c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xa0
xor r12d, r12d
mov r14, r9
mov r15, r8
mov ebx, edx
mov rsi, rcx
test rcx, rcx
je 0x14008c3a5
call fcn.14008b6ec
test eax, eax
jne 0x14008c1d4
lea eax, [r12 + 2]
jmp 0x14008c37c
lea rcx, [0x1403ce9a8]
mov qword [rbp - 0x41], r12
mov qword [rbp - 0x49], rcx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, 1
lock xadd dword [rbp - 0x41], eax
test eax, eax
jne 0x14008c209
cmp dword [rbp - 0x3d], r12d
jne 0x14008c398
call sub.KERNEL32.dll_GetCurrentThreadId
mov dword [rbp - 0x3d], eax
mov rdx, rsi
mov qword [rbp + 0x67], r12
lea rcx, [rbp - 0x39]
mov dword [rbp + 0x47], r12d
call fcn.14008b9b0
mov ecx, dword [rax]
mov dword [rbp + 0x47], ecx
mov r10, qword [rax + 8]
mov qword [rax + 8], r12
mov rcx, qword [rbp + 0x67]
mov qword [rbp + 0x67], r10
test rcx, rcx
je 0x14008c248
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
mov r10, qword [rbp + 0x67]
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x14008c266
mov qword [rbp - 0x31], r12
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140118f85.0]
mov r10, qword [rbp + 0x67]
mov edi, dword [rbp + 0x47]
test edi, edi
je 0x14008c296
test r10, r10
je 0x14008c286
mov qword [rbp + 0x67], r12
mov rcx, r10
mov rdx, qword [r10]
mov rax, qword [rdx + 8]
call qword [case.0x140118f85.0]
lea rcx, [rbp - 0x49]
call fcn.1400261e0
mov eax, edi
jmp 0x14008c37c
cmp ebx, 0x4b
jb 0x14008c32b
mov eax, 0x51eb851f
mul ebx
shr edx, 3
imul ecx, edx, 0x19
cmp ebx, ecx
jne 0x14008c32b
lea rax, vtable.Mso::Logging::StructuredObject_wchar_t_const____ptr64__1_.0
mov edx, 0x3a7
mov qword [rbp - 0x11], rax
mov r8d, 0x32
lea rax, [0x1402cb338]
mov qword [rbp - 9], rax
mov rax, qword [rsi + 0x10]
mov rcx, qword [rax]
lea rax, vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov qword [rbp - 0x29], rax
lea rax, [0x1402cf9a8]
mov qword [rbp - 0x21], rax
lea rax, [rbp - 0x11]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
lea rax, str.ExcessiveOrapiValEnumeration
mov qword [rbp - 1], rcx
mov ecx, 0x269a202
mov qword [rsp + 0x20], rax
mov word [rbp + 7], r12w
mov dword [rbp - 0x19], ebx
mov word [rbp - 0x15], r12w
call fcn.14000ed9c
mov r10, qword [rbp + 0x67]
mov rax, qword [rbp + 0x6f]
mov r9, r14
mov rcx, qword [r10 + 0x10]
mov r8, r15
mov qword [rsp + 0x38], r12
mov edx, ebx
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov rcx, qword [rbp + 0x67]
mov ebx, eax
test rcx, rcx
je 0x14008c371
mov qword [rbp + 0x67], r12
mov rdx, qword [rcx]
mov rax, qword [rdx + 8]
call qword [case.0x140118f85.0]
lea rcx, [rbp - 0x49]
call fcn.1400261e0
mov eax, ebx
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
xor edx, edx
mov ecx, 0x131f4c4
call fcn.140025d34
int3
xor edx, edx
mov ecx, 0x23023a1
call fcn.140025d34
int3
Function at 0x14008dd18
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edx, 1
mov rbx, rcx
lea r8d, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
xor esi, esi
mov rdi, rax
test rax, rax
je 0x14008dd79
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x14008dd79
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x14008dd79
cmp word [rax + 2], si
je 0x14008dd79
cmp dword [rax + 0x28], 0xfeef04bd
jne 0x14008dd79
add rax, 0x30
jmp 0x14008dd80
lea rax, [0x1402d3af0]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14008eae8
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x1403bf028]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x118
call fcn.140238d40
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x14008eb36
mov edx, 0x323658
jmp 0x14008eb65
cmp dword [rsp + 0x24], 6
jae 0x14008eb59
mov rax, qword [str.x___]
lea rcx, str.x___
mov edx, 0x323659
mov rax, qword [rax]
call qword [case.0x140118f85.0]
cmp dword [rsp + 0x30], 2
je 0x14008eb7c
mov edx, 0x32365a
mov rax, qword [str.x___]
lea rcx, str.x___
mov rax, qword [rax]
call qword [case.0x140118f85.0]
mov eax, dword [rsp + 0x24]
movzx ecx, word [rsp + 0x134]
movzx edx, word [rsp + 0x138]
mov dword [rbx], eax
mov eax, dword [rsp + 0x28]
mov dword [rbx + 4], eax
mov eax, dword [rsp + 0x2c]
mov dword [rbx + 8], eax
mov eax, 0x110
test ax, dx
mov dword [rbx + 0xc], ecx
mov cl, byte [rsp + 0x13a]
mov rax, rbx
mov byte [rbx + 0x10], cl
setne cl
shr dx, 8
and dl, 1
mov byte [rbx + 0x11], cl
mov byte [rbx + 0x12], dl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1402361b0
add rsp, 0x150
pop rbx
ret

Function at 0x14009206c
Capabilities:
Get hostname

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1403bf028]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
movdqa xmm1, xmmword [0x140333fe0]
xor edi, edi
mov word [rbp - 0x28], di
mov byte [rbp - 0x50], dil
movups xmm0, xmmword [rbp - 0x28]
movups xmmword [rbp - 0x48], xmm0
movups xmmword [rbp - 0x38], xmm1
xor edx, edx
lea r8d, [rdi + 0x20]
lea rcx, [rbp - 0x28]
call fcn.140238d40
mov dword [rbp - 0x60], 0x10
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x1400920e8
mov cl, byte [rbp - 0x50]
mov byte [rbx], cl
jmp 0x1400920f8
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x48]
call fcn.14000b3a4
mov byte [rbx], 1
movups xmm0, xmmword [rbp - 0x48]
movups xmmword [rbx + 8], xmm0
movups xmm1, xmmword [rbp - 0x38]
mov rax, rbx
movups xmmword [rbx + 0x18], xmm1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1402361b0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140092130
Capabilities:
Connect to wmi namespace via wbemlocator
Reference wmi statements

Disassembly:
mov r11, rsp
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], rdi
mov rbx, rcx
xor edi, edi
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], rdi
lea rax, [rbp + 0x18]
mov qword [r11 - 0x48], rax
lea r9, [0x1402d6440]
xor edx, edx
lea r8d, [rdi + 1]
lea rcx, [0x1402d64b0]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
je 0x1400921b8
mov qword [rbx], rdi
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x140092198
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140118f85.0]
nop
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x1400921b3
mov qword [rbp + 0x18], rdi
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140118f85.0]
nop
jmp 0x1400922cb
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x1400922e0
mov rax, qword [rcx]
lea rdx, [rbp + 0x20]
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ROOTCIMV2
mov rax, qword [rax + 0x18]
call qword [case.0x140118f85.0]
test eax, eax
je 0x14009223d
mov qword [rbx], rdi
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x14009221d
mov qword [rbp + 0x20], rdi
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140118f85.0]
nop
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x140092238
mov qword [rbp + 0x18], rdi
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140118f85.0]
nop
jmp 0x1400922cb
mov dword [rsp + 0x38], edi
mov qword [rsp + 0x30], rdi
mov eax, 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
lea edx, [rax + 7]
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
je 0x1400922a5
mov qword [rbx], rdi
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x140092288
mov qword [rbp + 0x20], rdi
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140118f85.0]
nop
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x1400922a3
mov qword [rbp + 0x18], rdi
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140118f85.0]
nop
jmp 0x1400922cb
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x20], rdi
mov qword [rbx], rax
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x1400922cb
mov qword [rbp + 0x18], rdi
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140118f85.0]
nop
mov rax, rbx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
xor edx, edx
mov ecx, 0x152139a
call fcn.140025d34
nop
jmp 0x1400922ef
nop
Function at 0x1400931ac
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rdi, rcx
mov dword [rbp + 0x40], 0x40
mov ecx, 0x80
mov r14d, edx
call fcn.140261ad4
xor r15d, r15d
mov rsi, rax
test rax, rax
je 0x140093291
lea r8, [rbp + 0x40]
mov qword [rbp + 0x48], rax
mov rdx, rax
mov word [rax], r15w
mov ecx, r14d
call qword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
jne 0x140093351
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
je 0x1400932ab
cmp eax, 0x534
je 0x140093289
cmp eax, 0x54b
je 0x140093289
mov dword [rbp - 8], eax
lea rcx, vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov qword [rbp - 0x30], rcx
lea rax, method.Mso::Logging::StructuredObject_unsigned_int__1_.virtual_0
mov qword [rbp - 0x18], rax
lea rcx, str.EXTENDED_NAME_FORMAT
mov qword [rbp - 0x28], rcx
lea rax, [rbp - 0x30]
mov qword [rsp + 0x30], rax
lea rcx, str.LastError
lea rax, [rbp - 0x18]
mov qword [rbp - 0x10], rcx
mov qword [rsp + 0x28], rax
mov ecx, 0x11ce1a1
lea rax, str.GetUserNameExW_failed_1
mov dword [rbp - 0x20], r14d
mov qword [rsp + 0x20], rax
mov word [rbp - 0x1c], r15w
mov word [rbp - 4], r15w
call fcn.1400934a8
mov rcx, rsi
call fcn.140261814
mov qword [rdi], r15
mov rbx, qword [rsp + 0xa0]
mov rax, rdi
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, dword [rbp + 0x40]
add rcx, rcx
call fcn.140261ad4
mov rcx, rsi
mov rbx, rax
call fcn.140261814
test rbx, rbx
je 0x140093291
lea r8, [rbp + 0x40]
mov rdx, rbx
mov ecx, r14d
call qword [sym.imp.Secur32.dll_GetUserNameExW]
test al, al
jne 0x14009337d
lea rcx, vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov dword [rbp - 8], r14d
mov qword [rbp - 0x18], rcx
lea rcx, str.EXTENDED_NAME_FORMAT
mov qword [rbp - 0x10], rcx
mov word [rbp - 4], r15w
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.LastError
mov word [rbp - 0x1c], r15w
mov dword [rbp - 0x20], eax
lea rax, method.Mso::Logging::StructuredObject_unsigned_int__1_.virtual_0
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, str.GetUserNameExW_failed_2
mov qword [rbp - 0x28], rcx
mov ecx, 0x11ce1a2
mov qword [rsp + 0x20], rax
call fcn.1400934a8
mov rcx, rbx
jmp 0x14009328c
mov eax, dword [rbp + 0x40]
lea rcx, [rbp + 0x48]
lea rdx, [rax*2 + 2]
call fcn.140147aa8
mov rbx, qword [rbp + 0x48]
test al, al
jne 0x14009337d
test rbx, rbx
je 0x14009337d
mov rcx, rbx
mov rbx, r15
call fcn.140261814
mov qword [rdi], rbx
jmp 0x140093294
Function at 0x140097274
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
lea r9, [rdi + 0x10]
cmp qword [r9 + 0x18], 8
mov r10, r9
mov r11, qword [r9 + 0x10]
jb 0x1400972a1
mov r10, qword [r9]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r11, r11
je 0x1400972d0
movzx eax, byte [rdx + r10]
movabs rbx, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, rbx
cmp rdx, r11
jb 0x1400972b2
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x140097308
cmp qword [rcx + rdx*8], rdi
jne 0x1400972fd
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x140097301
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140097315
cmp qword [rcx + rdx*8], rdi
jne 0x140097315
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rcx, r9
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.140096c70
mov rcx, rdi
call fcn.140261814
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400a72cc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
xor r9d, r9d
movabs rcx, 0xcbf29ce484222325
movzx eax, byte [r9 + rdi + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, rdx
cmp r9, 8
jb 0x1400a72f1
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1400a7349
cmp qword [rcx + rdx*8], rdi
jne 0x1400a733e
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x1400a7342
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400a7356
cmp qword [rcx + rdx*8], rdi
jne 0x1400a7356
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x18]
dec qword [r8 + 0x10]
call fcn.1400a7140
mov rcx, rdi
call fcn.140261814
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a760c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rdi
push r14
push r15
sub rsp, 0x40
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rbx, r9
mov r9, r8
mov r14, rdx
mov rsi, rcx
movabs rcx, 0xcbf29ce484222325
xor edx, edx
movzx eax, byte [rdx + r9]
xor rcx, rax
movabs r8, 0x100000001b3
imul rcx, r8
inc rdx
cmp rdx, 8
jb 0x1400a7644
mov r8, qword [rsi + 0x30]
and r8, rcx
mov rax, r8
add rax, rax
mov rcx, qword [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov r10, qword [rcx + rax*8]
cmp r10, rdi
je 0x1400a7689
mov rdi, qword [rcx + rax*8 + 8]
mov rdi, qword [rdi]
mov rdx, rdi
cmp rdx, r10
je 0x1400a76db
mov rdi, qword [rdi + 8]
mov rdx, rdi
mov rax, qword [rdi + 0x10]
cmp qword [r9], rax
jne 0x1400a768c
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
lea rcx, [rbx + 0x18]
call fcn.1400a7140
mov rcx, rbx
call fcn.140261814
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x1400a7800
mov qword [rsp + 0x20], rbx
mov r9, qword [rbx]
cmp rdx, r9
je 0x1400a7715
mov rax, qword [rbx + 8]
mov qword [rax], r9
mov rax, qword [r9 + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rbx
mov rcx, qword [rdx + 8]
mov rax, qword [r9 + 8]
mov qword [rdx + 8], rax
mov rax, qword [rbx + 8]
mov qword [r9 + 8], rax
mov qword [rbx + 8], rcx
add r8, r8
mov r9, qword [rsi + 0x18]
mov rax, qword [r9 + r8*8]
cmp rax, qword [rsi + 8]
jne 0x1400a7735
mov qword [r9 + r8*8], rbx
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x1400a7764
cmp rax, rdx
jne 0x1400a7740
mov qword [r9 + r8*8], rbx
jmp 0x1400a7764
mov rax, qword [r9 + r8*8 + 8]
mov rcx, qword [rax]
mov qword [r9 + r8*8 + 8], rcx
cmp rcx, rbx
je 0x1400a7764
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x140333fc4]
test rax, rax
jns 0x1400a7785
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x1400a7796
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x1400a77f5
cmp rdx, 0x200
jae 0x1400a77ae
shl rdx, 3
jmp 0x1400a77c0
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x1400a77c0
add rdx, rdx
mov rcx, rsi
call fcn.140035658
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x1400a77f5
mov r15, qword [rax + 8]
mov rdi, qword [rsi + 8]
mov rdi, qword [rdi]
lea r8, [rdi + 0x10]
mov r9, rdi
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400a760c
cmp rdi, r15
jne 0x1400a77d5
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1400ab9dc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rdi, rdx
cmp qword [r9 + 0x18], 0x10
mov r11, rcx
mov rbx, qword [r9 + 0x10]
jb 0x1400ab9fe
mov r9, qword [r9]
xor r10d, r10d
movabs rcx, 0xcbf29ce484222325
test rbx, rbx
je 0x1400aba2e
movzx eax, byte [r10 + r9]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r10
imul rcx, rdx
cmp r10, rbx
jb 0x1400aba10
mov rdx, qword [r11 + 0x30]
and rdx, rcx
mov rcx, qword [r11 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x1400aba66
cmp qword [rcx + rdx*8], r8
jne 0x1400aba5b
mov rax, qword [r11 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r11 + 0x18]
mov rax, qword [r11 + 8]
jmp 0x1400aba5f
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400aba73
cmp qword [rcx + rdx*8], r8
jne 0x1400aba73
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r11 + 8]
mov rdx, rdi
call fcn.1400aba90
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x1400ae530
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rax - 0x38], 0xfffffffffffffffe
mov rbx, rcx
xor r14d, r14d
mov dword [rax + 0x18], r14d
lea r8, [rax + 0x18]
lea rdx, [0x1403ce4c0]
lea ecx, [r14 + 3]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeExW]
mov esi, eax
test eax, eax
jne 0x1400ae576
mov qword [rbx], r14
mov qword [rbx + 8], r14
jmp 0x1400ae62a
mov rcx, rsi
call fcn.140261ad4
mov rdi, rax
test rax, rax
je 0x1400ae638
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.140238d40
mov qword [rsp + 0x20], rdi
mov r9d, esi
xor r8d, r8d
lea rdx, [0x1403ce4c0]
lea ecx, [r8 + 3]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoExW]
mov rcx, rdi
test eax, eax
jne 0x1400ae5c3
mov qword [rbx], r14
mov qword [rbx + 8], r14
jmp 0x1400ae624
mov qword [rsp + 0x88], r14
mov dword [rsp + 0x78], r14d
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x88]
lea rdx, [0x1402b537c]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
jne 0x1400ae5f7
mov qword [rbx], r14
mov qword [rbx + 8], r14
jmp 0x1400ae621
cmp dword [rsp + 0x78], 0x34
jne 0x1400ae5ee
mov rcx, qword [rsp + 0x88]
movzx eax, word [rcx + 0xa]
mov dword [rbx], eax
movzx eax, word [rcx + 8]
mov dword [rbx + 4], eax
movzx eax, word [rcx + 0xe]
mov dword [rbx + 8], eax
movzx eax, word [rcx + 0xc]
mov dword [rbx + 0xc], eax
mov rcx, rdi
call fcn.140261814
nop
mov rax, rbx
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.140147a48
nop
jmp 0x1400ae640
nop
nop
nop
nop
Function at 0x1400af770
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r13
push r14
xor r10d, r10d
mov rsi, r8
mov ebx, edx
mov rdi, rcx
mov r11d, r10d
test rcx, rcx
je 0x1400af918
test r8, r8
je 0x1400af918
mov r14, qword [rsp + 0x38]
test r14, r14
je 0x1400af918
test edx, edx
je 0x1400af8fc
mov ecx, r10d
lea r13, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov al, byte [rdi]
dec ebx
mov byte [rsp + rcx + 0x18], al
inc rdi
inc rcx
inc r11d
cmp rcx, 3
jne 0x1400af84b
cmp r9d, 4
jb 0x1400af853
movzx edx, byte [rsp + 0x1a]
mov r11d, r10d
movzx eax, byte [rsp + 0x18]
movzx ecx, byte [rsp + 0x19]
shr rax, 2
shr rcx, 4
mov al, byte [r13 + rax*2]
mov byte [r8], al
mov al, byte [rsp + 0x18]
shl al, 4
or rcx, rax
and ecx, 0x3f
mov al, byte [r13 + rcx*2]
mov cl, byte [rsp + 0x19]
mov byte [r8 + 1], al
mov eax, edx
shr rax, 6
and edx, 0x3f
shl cl, 2
or rcx, rax
and ecx, 0x3f
mov al, byte [r13 + rcx*2]
mov rcx, r10
mov byte [r8 + 2], al
mov al, byte [r13 + rdx*2]
mov byte [r8 + 3], al
add r8, 4
add r9d, 0xfffffffc
test ebx, ebx
jne 0x1400af7c3
test r11d, r11d
jle 0x1400af8fa
cmp r9d, 4
jb 0x1400af8f7
movzx edi, byte [rsp + 0x19]
cmp r11d, 1
movzx ebx, byte [rsp + 0x1a]
mov dl, 0x3d
movzx eax, byte [rsp + 0x18]
cmovle edi, r10d
cmp r11d, 2
movzx ecx, dil
cmovle ebx, r10d
shr rax, 2
shr rcx, 4
mov al, byte [r13 + rax*2]
mov byte [r8], al
mov al, byte [rsp + 0x18]
shl al, 4
or rcx, rax
and ecx, 0x3f
mov al, byte [r13 + rcx*2]
mov byte [r8 + 1], al
cmp r11d, 1
jle 0x1400af8d1
mov al, dil
movzx ecx, bl
shl al, 2
shr rcx, 6
or rcx, rax
and ecx, 0x3f
mov al, byte [r13 + rcx*2]
jmp 0x1400af8d3
mov al, dl
mov byte [r8 + 2], al
cmp r11d, 2
jle 0x1400af8e8
movzx eax, bl
and eax, 0x3f
mov dl, byte [r13 + rax*2]
mov byte [r8 + 3], dl
mov r11d, r10d
add r8, 4
add r9d, 0xfffffffc
test r11d, r11d
jne 0x1400af907
cmp r9d, 1
jb 0x1400af907
mov byte [r8], r10b
jmp 0x1400af90d
mov r10d, 0x800700ea
sub r8d, esi
mov eax, r10d
mov dword [r14], r8d
jmp 0x1400af91d
mov eax, 0x80070057
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r14
pop r13
ret
Function at 0x1400bb5e8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [r8 + 0x18], 0x10
mov r15, rdx
mov r14, qword [r8 + 0x10]
mov rdx, r8
mov rdi, r8
mov rbp, rcx
jb 0x1400bb61e
mov rdx, qword [r8]
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
test r14, r14
je 0x1400bb64c
movzx eax, byte [rcx + rdx]
movabs r9, 0x100000001b3
xor r8, rax
inc rcx
imul r8, r9
cmp rcx, r14
jb 0x1400bb62f
mov rax, qword [rbp + 0x18]
mov r12, qword [rbp + 0x30]
mov rbp, qword [rbp + 8]
and r12, r8
add r12, r12
mov qword [rsp + 0x50], rax
mov rbx, qword [rax + r12*8]
cmp qword [rax + r12*8], rbp
jne 0x1400bb672
mov rax, rbp
jmp 0x1400bb67a
mov rax, qword [rax + r12*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1400bb6ef
cmp qword [rdi + 0x18], 0x10
lea rsi, [rbx + 0x10]
mov rdx, rdi
jb 0x1400bb690
mov rdx, qword [rdi]
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
mov r13, qword [rsi + 0x10]
jb 0x1400bb6a1
mov rcx, qword [rsi]
cmp r13, r14
jne 0x1400bb6b2
mov r8, r13
call fcn.140239710
test eax, eax
je 0x1400bb6bc
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x50]
jmp 0x1400bb667
cmp qword [rsi + 0x18], 0x10
jb 0x1400bb6c6
mov rsi, qword [rsi]
cmp qword [rdi + 0x18], 0x10
jb 0x1400bb6d0
mov rdi, qword [rdi]
cmp r14, r13
jne 0x1400bb6e7
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call fcn.140239710
test eax, eax
je 0x1400bb6ea
mov rbx, rbp
mov qword [r15], rbx
jmp 0x1400bb6f2
mov qword [r15], rbp
mov rbx, qword [rsp + 0x58]
mov rax, r15
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret