joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140008c30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x140117100]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x98], rdx
mov rcx, rdx
call fcn.140002cd0
cmp qword [rbx + 0x18], 0xf
jbe 0x140008c83
mov rsi, qword [rbx]
mov rbp, rsi
add rbp, qword [rbx + 0x10]
mov rdi, rsi
jmp 0x140008c90
mov rsi, rbx
mov rbp, qword [rbx + 0x10]
add rbp, rbx
mov rdi, rbx
cmp rdi, rbp
je 0x140008cab
sub rsi, rdi
movsx ecx, byte [rdi]
call fcn.1400b2d6c
mov byte [rdi + rsi], al
inc rdi
cmp rdi, rbp
jne 0x140008c98
mov r8, qword [rbx + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140008cbc
mov rdx, qword [rbx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r8, r8
je 0x140008cf3
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x140008ce0
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.14000dd30
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140008d1b
cmp rcx, qword [r14 + 8]
je 0x140008d1b
mov rbp, qword [rcx + 0x30]
jmp 0x140008dd5
mov rcx, qword [r14 + 0x48]
sub rcx, qword [r14 + 0x40]
movabs rax, 0x8888888888888889
imul rcx
lea rbp, [rcx + rdx]
sar rbp, 6
mov rax, rbp
shr rax, 0x3f
add rbp, rax
mov r8, rbx
lea rdx, [rsp + 0x88]
mov rcx, r14
call fcn.14000d390
mov rcx, qword [rax]
mov qword [rcx + 0x30], rbp
lea rcx, [rsp + 0x30]
call fcn.14000b1f0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], 0
mov rdi, qword [r14 + 0x48]
cmp rdi, qword [r14 + 0x50]
je 0x140008dac
mov qword [rsp + 0x20], rdi
mov rdx, rbx
mov rcx, rdi
call fcn.14000a620
nop
lea rcx, [rdi + 0x20]
lea rdx, [rsp + 0x30]
call fcn.14000f1f0
nop
add qword [r14 + 0x48], 0x78
jmp 0x140008dc1
lea r9, [rsp + 0x30]
mov r8, rbx
mov rdx, rdi
lea rcx, [r14 + 0x40]
call fcn.14000eaf0
nop
lea rcx, [rsp + 0x70]
call fcn.14000b780
lea rcx, [rsp + 0x30]
call fcn.1400066f0
imul rdi, rbp, 0x78
add rdi, qword [r14 + 0x40]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140008e13
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140008e0e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140008e52
mov rcx, r8
call fcn.1400aae3c
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
lea rax, [rdi + 0x20]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400aaba0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.1400b2360
int3
Function at 0x1400093b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1400093d2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14000944c
mov rdi, r14
mov rcx, rbx
call fcn.14000b1d0
test rax, rax
jle 0x140009424
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1400dd750
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000943c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x140009444
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1400093e6
sub r14, rdi
jmp 0x14000952f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140009463
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140009465
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140009497
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400dd750
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000952c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400094d2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000950d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400b5e34
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14000952c
cmp rbp, rax
ja 0x1400094e0
test rbp, rbp
je 0x14000952c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400b5e34
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x14000d390
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, r8
mov r15, rdx
mov r13, rcx
mov r8, qword [r8 + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000d3be
mov rdx, qword [rbx]
movabs rdi, 0xcbf29ce484222325
xor r12d, r12d
mov ecx, r12d
test r8, r8
je 0x14000d3f3
movabs r9, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor rdi, rax
imul rdi, r9
inc rcx
cmp rcx, r8
jb 0x14000d3e0
mov r9, rdi
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, r13
call fcn.14000dd30
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x14000d41c
mov qword [r15], rcx
mov byte [r15 + 8], r12b
jmp 0x14000d5c1
movabs rax, 0x492492492492492
cmp qword [r13 + 0x10], rax
je 0x14000d5dc
lea rbp, [r13 + 8]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], r12
mov ecx, gethostname
call fcn.1400aabc0
mov rsi, rax
mov qword [rsp + 0x38], rax
mov rdx, rbx
lea rcx, [rax + 0x10]
call fcn.14000a620
mov qword [rsi + 0x30], r12
mov rcx, qword [r13 + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x14000d474
cvtsi2ss xmm0, rcx
jmp 0x14000d489
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [r13 + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x14000d49c
cvtsi2ss xmm1, rcx
jmp 0x14000d4b1
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [r13]
seta al
test al, al
je 0x14000d569
mov rcx, r13
call fcn.14000d890
mov rax, qword [r13 + 0x30]
and rax, rdi
add rax, rax
mov rdx, qword [r13 + 0x18]
mov rbx, qword [rdx + rax*8 + 8]
mov rcx, qword [rbp]
cmp rbx, rcx
jne 0x14000d4f5
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], r12
jmp 0x14000d55e
mov r12, qword [rdx + rax*8]
mov rbp, qword [rsi + 0x20]
nop dword [rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14000d512
mov rdx, qword [rdx]
lea rcx, [rsi + 0x10]
cmp qword [rsi + 0x28], 0xf
jbe 0x14000d521
mov rcx, qword [rsi + 0x10]
cmp rbp, rax
jne 0x14000d532
mov r8, rbp
call fcn.1400de190
test eax, eax
je 0x14000d53d
cmp rbx, r12
je 0x14000d54c
mov rbx, qword [rbx + 8]
jmp 0x14000d500
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
jmp 0x14000d55a
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], 0
lea rbp, [r13 + 8]
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc qword [r13 + 0x10]
mov qword [rsi], rdx
mov qword [rsi + 8], r8
mov qword [r8], rsi
mov qword [rdx + 8], rsi
mov rcx, qword [r13 + 0x18]
mov rax, qword [r13 + 0x30]
and rax, rdi
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [rbp]
jne 0x14000d5a2
mov qword [rcx + rax*8], rsi
jmp 0x14000d5b4
cmp r9, rdx
jne 0x14000d5ad
mov qword [rcx + rax*8], rsi
jmp 0x14000d5b9
cmp qword [rcx + rax*8 + 8], r8
jne 0x14000d5b9
mov qword [rcx + rax*8 + 8], rsi
mov qword [r15], rsi
mov byte [r15 + 8], 1
mov rax, r15
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.unordered_map_set_too_long
call fcn.1400a9c58
int3
Function at 0x14000fb60
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x140117100]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov r13, rcx
mov qword [rsp + 0x80], rcx
mov rcx, rdx
mov r15, rdx
xor r12d, r12d
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r14, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
lea rdx, [rsp + 0x80]
mov rcx, r15
mov rbp, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [rsp + 0x8c]
mov rcx, r14
mov ebx, dword [rsp + 0x88]
mov r8d, esi
mov edx, ebx
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rdx, rax
mov rcx, rbp
mov rdi, rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov dword [rsp + 0x40], 0xcc0020
mov r9d, ebx
mov dword [rsp + 0x38], r12d
xor r8d, r8d
mov dword [rsp + 0x30], r12d
xor edx, edx
mov qword [rsp + 0x28], r14
mov rcx, rbp
mov dword [rsp + 0x20], esi
call qword [sym.imp.GDI32.dll_BitBlt]
xorps xmm0, xmm0
mov dword [rsp + 0x58], Ordinal_45
movups xmmword [r13], xmm0
mov eax, esi
mov ecx, 1
movups xmmword [r13 + 0x10], xmm0
neg eax
mov dword [rsp + 0x70], ecx
movups xmmword [r13 + 0x20], xmm0
lea r9d, [r12 + 0x18]
mov r8d, ebx
movups xmmword [r13 + 0x30], xmm0
mov edx, esi
mov rcx, r13
movups xmmword [r13 + 0x40], xmm0
mov dword [rsp + 0x5c], ebx
movups xmmword [r13 + 0x50], xmm0
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x64], 0x200001
mov dword [rsp + 0x6c], r12d
mov dword [rsp + 0x74], 2
mov dword [rsp + 0x78], 3
mov dword [rsp + 0x7c], 4
call qword [sym.imp.opencv_world470.dll_public:_void___cdecl_cv::Mat::constructor_int__int__int____ptr64]
mov rdx, qword [r13 + 0x10]
lea rax, [rsp + 0x58]
mov dword [rsp + 0x30], r12d
mov r9d, esi
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rdx
mov rcx, rbp
mov rdx, rdi
call qword [sym.imp.GDI32.dll_GetDIBits]
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r14
mov rcx, r15
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rax, r13
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400aaba0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140011350
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13d0
call fcn.1400ab630
sub rsp, rax
mov rax, qword [0x140117100]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
mov edi, edx
mov ebx, ecx
call fcn.1400aa734
mov r9d, eax
movabs rcx, 0x5851f42d4c957f2d
movabs rax, 0x5555555555555555
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x13b8], rax
mov r8d, 1
mov rax, r9
shr rax, 0x3e
xor r9, rax
imul r9, rcx
add r9, r8
mov qword [rsp + r8*8 + 0x38], r9
inc r8
cmp r8, 0x138
jb 0x1400113b2
lea eax, [rbx - 0x80000000]
mov dword [rsp + 0x30], 0x138
mov ebp, 0x80000000
lea rcx, [rsp + 0x30]
cmp ebx, ebp
lea esi, [rbx + rbp]
cmovae esi, eax
lea ebx, [rdi + rbp]
cmp edi, ebp
lea eax, [rdi - 0x80000000]
cmovae ebx, eax
sub ebx, esi
cmp ebx, 0xffffffff
jne 0x140011410
call fcn.140011a00
jmp 0x140011469
inc ebx
call fcn.140011a00
mov rcx, rax
mov eax, ebx
mul rcx
mov r8, rdx
mov rcx, rax
cmp rax, rbx
jae 0x14001145b
xor edx, edx
mov eax, ebx
neg rax
div rbx
mov rdi, rdx
cmp rcx, rdx
jae 0x14001145b
nop dword [rax]
lea rcx, [rsp + 0x30]
call fcn.140011a00
mov rcx, rax
mov rax, rbx
mul rcx
mov r8, rdx
cmp rax, rdi
jb 0x140011440
mov ecx, 0x40
mov rax, r8
and ecx, 0x3f
shr rax, cl
lea edx, [rsi + rax]
cmp edx, ebp
lea ecx, [rdx - 0x80000000]
lea eax, [rdx + rbp]
cmovae eax, ecx
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.1400aaba0
lea r11, [rsp + 0x13d0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140011570
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
cmp cl, 0x20
je 0x140011631
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140117100]
xor rax, rsp
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x40], rax
mov esi, r9d
movups xmmword [rsp + 0x30], xmm0
movzx edi, r8b
mov ebx, edx
call qword [sym.imp.USER32.dll_VkKeyScanA]
movzx ecx, al
xor edx, edx
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov r8d, Ordinal_45
mov dword [rsp + 0x20], 1
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2c], 8
mov word [rsp + 0x2a], ax
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
xor r9d, r9d
mov r8b, reloc.WLDAP32.dll_Ordinal_32
mov edx, esi
movzx ecx, dil
call fcn.140011570
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, Ordinal_45
mov dword [rsp + 0x2c], 0xa
lea rdx, [rsp + 0x20]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400aaba0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140011640
Capabilities:
Log keystrokes

Disassembly:
test cx, cx
je 0x1400116fa
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140117100]
xor rax, rsp
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movzx ecx, cl
mov ebx, edx
xor eax, eax
xor edx, edx
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x20], xmm0
mov esi, r9d
movzx edi, r8w
movups xmmword [rsp + 0x30], xmm0
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov r8d, Ordinal_45
mov dword [rsp + 0x20], 1
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2c], 8
mov word [rsp + 0x2a], ax
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
xor r8d, r8d
xor r9d, r9d
mov edx, esi
movzx ecx, di
call fcn.140011640
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, Ordinal_45
mov dword [rsp + 0x2c], 0xa
lea rdx, [rsp + 0x20]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400aaba0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140011700
Capabilities:
Log keystrokes

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140117100]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
xorps xmm0, xmm0
xor edx, edx
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x20], xmm0
lea ecx, [rax + 0x11]
movups xmmword [rsp + 0x30], xmm0
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov r8d, Ordinal_45
mov dword [rsp + 0x20], 1
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2c], 8
mov word [rsp + 0x2a], ax
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
xor r9d, r9d
mov r8b, reloc.WLDAP32.dll_Ordinal_32
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov cl, 0x67
call fcn.140011570
mov r8d, Ordinal_45
mov dword [rsp + 0x2c], 0xa
lea rdx, [rsp + 0x20]
lea ecx, [r8 - 0x27]
call qword [sym.imp.USER32.dll_SendInput]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400aaba0
add rsp, 0x58
ret

Function at 0x1400117a0
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0xf8
mov rax, qword [0x140117100]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x74], xmm0
mov dword [r11 - 0x24], eax
xor r9d, r9d
mov qword [rsp + 0x60], rax
xor r8d, r8d
lea rax, [rsp + 0x50]
xor edx, edx
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
movups xmmword [r11 - 0x74], xmm0
mov dword [rsp + 0x20], eax
movups xmmword [r11 - 0x64], xmm0
movups xmmword [r11 - 0x54], xmm0
movups xmmword [r11 - 0x44], xmm0
movups xmmword [r11 - 0x34], xmm0
mov dword [rsp + 0x70], WSAGetLastError
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400aaba0
add rsp, 0xf8
ret
Function at 0x140011a00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x138
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140011a67
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
lea r8, [r8 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x140011a22
mov ecx, dword [r10]
jmp 0x140011b76
cmp ecx, 0x270
jb 0x140011b76
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
nop word [rax + rax]
mov r9, qword [rbx + 8]
lea rbx, [rbx + 8]
mov rdx, r9
xor rdx, rax
and rdx, 0xffffffff80000000
xor rdx, r9
movzx eax, dl
and al, 1
neg al
mov rax, r9
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx + 0x4d8]
xor rcx, rdx
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x140011aa0
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov r9, qword [rbx]
mov r8, qword [rbx + 8]
lea rbx, [rbx + 8]
xor r9, r8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rbx - 0xea8]
xor rcx, r9
mov r9, r8
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x140011af1
mov rdx, qword [r10 + 8]
xor rdx, qword [r10 + 0x1380]
mov rdi, qword [rsp]
and rdx, 0xffffffff80000000
xor rdx, qword [r10 + 8]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret

Function at 0x140015910
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14001596d
lea rbx, [0x1400fb4f0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140015954
cmp r10, 2
jb 0x140015954
cmp byte [r9], r8b
jne 0x140015954
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140015930
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400159af
lea rbx, [0x1400fb4f0]
cmp r8b, 0x23
jne 0x140015993
cmp byte [r9], r8b
jne 0x140015993
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140015980
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x140015af0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140015b0a
mov qword [r8], 0
lea rdx, [0x140100ee4]
call fcn.1400159c0
mov rbx, rax
test rax, rax
jne 0x140015b2a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.1400b6920
mov esi, eax
cmp eax, 0xffffffff
je 0x140015bf8
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.1400b6204
test eax, eax
jne 0x140015bf8
mov rcx, rbx
call fcn.1400b6920
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140015bf8
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.1400b6204
test eax, eax
jne 0x140015bf8
cmp rdi, 0xffffffffffffffff
je 0x140015bf8
mov rax, qword [0x140119fa8]
test rax, rax
je 0x140015b9a
inc dword [rax + 0xf4]
mov rcx, rdi
call fcn.1400bf1b8
mov rsi, rax
test rax, rax
je 0x140015bf8
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.1400b5e34
mov rcx, rbx
cmp rax, rdi
je 0x140015be6
call fcn.1400b2b04
mov rax, qword [0x140119fa8]
test rax, rax
je 0x140015bdc
dec dword [rax + 0xf4]
mov rcx, rsi
call fcn.1400b5a10
jmp 0x140015c00
call fcn.1400b2b04
test r14, r14
je 0x140015bf3
mov qword [r14], rdi
mov rax, rsi
jmp 0x140015c02
mov rcx, rbx
call fcn.1400b2b04
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400197f0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
lea r11, [0x1400fb4f0]
mov rax, qword [rcx + 0xf8]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x140019886
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.14002d040
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140019890
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xf8]
lea r9, [0x1400fb4f0]
movss xmm2, dword [rcx + 0x110]
movss xmm3, dword [rcx + 0x114]
movsxd rcx, dword [rcx + 0xf0]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret