joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a45e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x1405fadb0]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
movsxd rsi, r8d
lea rcx, [rsp + 0x48]
call fcn.1401949f0
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140195180
xor edi, edi
mov dword [rsp + 0x88], esi
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rsp + 0x40]
movups xmmword [rsp + 0x68], xmm1
movups xmmword [rsp + 0x78], xmm0
cmp rdx, 8
jb 0x1401a4685
mov rcx, qword [rsp + 0x28]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401a4680
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401a47b8
call fcn.140194698
mov r11, qword [rsp + 0x78]
lea r8, [rsp + 0x68]
mov qword [rsp + 0xe0], rbp
movabs rdx, 0xcbf29ce484222325
mov rbp, qword [rsp + 0x68]
mov rcx, rdi
mov qword [rsp + 0xa8], r14
mov r14, qword [rsp + 0x80]
lea r9, [r11 + r11]
cmp r14, 8
mov qword [rsp + 0xa0], r15
lea r15, [rbx + 0x18]
cmovae r8, rbp
test r9, r9
je 0x1401a46f4
movabs r10, 0x100000001b3
movzx eax, byte [rcx + r8]
inc rcx
xor rdx, rax
imul rdx, r10
cmp rcx, r9
jb 0x1401a46e0
mov rax, qword [rbx + 0x30]
mov rcx, rsi
xor rcx, rdx
and rcx, qword [rbx + 0x48]
add rcx, rcx
mov r10, qword [rax + rcx*8 + 8]
cmp r10, qword [rbx + 0x20]
je 0x1401a4769
mov rbx, qword [rax + rcx*8]
cmp qword [r10 + 0x28], 8
lea rax, [r10 + 0x10]
jb 0x1401a4723
mov rax, qword [r10 + 0x10]
cmp r14, 8
lea r8, [rsp + 0x68]
cmovae r8, rbp
cmp r11, qword [r10 + 0x20]
jne 0x1401a475b
mov rdx, r11
test r11, r11
je 0x1401a4755
sub r8, rax
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x1401a475b
add rax, 2
sub rdx, 1
jne 0x1401a4741
cmp esi, dword [r10 + 0x30]
je 0x1401a4766
cmp r10, rbx
je 0x1401a4769
mov r10, qword [r10 + 8]
jmp 0x1401a4714
mov rdi, r10
mov r14, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0xe0]
test rdi, rdi
je 0x1401a478b
lea rdx, [rsp + 0x68]
mov rcx, r15
call fcn.1401a4c70
lea rcx, [rsp + 0x68]
call fcn.140178880
mov r15, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1401af7a0
add rsp, 0xb0
pop rdi
pop rsi
pop rbx
ret
call fcn.1401f6690
int3
Function at 0x1401a47c0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x190
mov rax, qword [0x1405fadb0]
xor rax, rsp
mov qword [rsp + 0x180], rax
xorps xmm0, xmm0
mov rdi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x108
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
call fcn.1401e8980
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov byte [rsp + 0x20], 0
mov rdx, rdi
call fcn.1401a15f0
test eax, eax
jne 0x1401a486c
mov eax, 0x5a4d
cmp word [rsp + 0x30], ax
jne 0x1401a486c
movsxd rdx, dword [rsp + 0x6c]
lea r9, [rsp + 0x70]
mov rcx, qword [rbx + 8]
add rdx, rdi
mov r8d, 0x108
mov byte [rsp + 0x20], 0
call fcn.1401a15f0
test eax, eax
jne 0x1401a486c
cmp dword [rsp + 0x70], 0x4550
sete al
jmp 0x1401a486e
xor al, al
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1401af7a0
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x190
pop rdi
ret

Function at 0x1401a4c70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 8
mov rbx, rcx
mov r11, qword [rdx + 0x10]
mov r10, rdx
jb 0x1401a4c8e
mov r10, qword [rdx]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
add r11, r11
je 0x1401a4cc4
movabs rcx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, r11
jb 0x1401a4cb0
movsxd rdi, dword [rdx + 0x20]
mov r8, rdx
xor rdi, r9
lea rdx, [rsp + 0x20]
mov r9, rdi
mov rcx, rbx
call fcn.1401a59f0
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1401a4d55
mov r8, qword [rbx + 0x30]
and r8, rdi
shl r8, 4
add r8, qword [rbx + 0x18]
mov rax, qword [r8]
cmp qword [r8 + 8], rdx
jne 0x1401a4d1b
cmp rax, rdx
jne 0x1401a4d11
mov rax, qword [rbx + 8]
mov qword [r8], rax
mov qword [r8 + 8], rax
jmp 0x1401a4d26
mov rax, qword [rdx + 8]
mov qword [r8 + 8], rax
jmp 0x1401a4d26
cmp rax, rdx
jne 0x1401a4d26
mov rax, qword [rdx]
mov qword [r8], rax
mov r8, qword [rdx]
lea rcx, [rbx + 8]
dec qword [rcx + 8]
mov rax, qword [rdx + 8]
mov qword [rax], r8
mov rax, qword [rdx + 8]
mov qword [r8 + 8], rax
call fcn.1401a5b70
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1401a5300
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
mov r12, r9
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov r8, qword [r8 + 0x10]
mov r10, r14
cmp qword [r14 + 0x18], 8
jb 0x1401a532e
mov r10, qword [r14]
movabs rcx, 0xcbf29ce484222325
xor edx, edx
add r8, r8
je 0x1401a5364
movabs r9, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + r10]
xor rcx, rax
imul rcx, r9
inc rdx
cmp rdx, r8
jb 0x1401a5350
movsxd rbp, dword [r14 + 0x20]
xor rbp, rcx
mov r9, rbp
mov r8, r14
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1401a59f0
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1401a5394
mov qword [rdi], rax
mov byte [rdi + 8], 0
jmp 0x1401a54dd
movabs rax, 0x38e38e38e38e38e
cmp qword [rsi + 0x10], rax
je 0x1401a54f1
lea r13, [rsi + 8]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], 0
mov ecx, 0x48
call fcn.14019465c
mov rbx, rax
mov qword [rsp + 0x38], rax
mov rdx, r14
lea rcx, [rax + 0x10]
call fcn.1401785e0
mov ecx, dword [r14 + 0x20]
mov dword [rbx + 0x30], ecx
xor edx, edx
mov qword [rbx + 0x38], rdx
mov qword [rbx + 0x40], rdx
mov rcx, qword [r12]
mov qword [rbx + 0x38], rcx
mov rax, qword [r12 + 8]
mov qword [rbx + 0x40], rax
mov qword [r12], rdx
mov qword [r12 + 8], rdx
mov rcx, qword [rsi + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1401a5417
cvtsi2ss xmm0, rcx
jmp 0x1401a542c
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x1401a543f
cvtsi2ss xmm1, rcx
jmp 0x1401a5454
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
seta al
test al, al
je 0x1401a5486
mov rcx, rsi
call fcn.1401a4d70
mov r9, rbp
lea r8, [rbx + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1401a59f0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc qword [rsi + 0x10]
mov qword [rbx], rdx
mov qword [rbx + 8], r8
mov qword [r8], rbx
mov qword [rdx + 8], rbx
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x30]
and rax, rbp
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r13]
jne 0x1401a54bf
mov qword [rcx + rax*8], rbx
jmp 0x1401a54d1
cmp r9, rdx
jne 0x1401a54ca
mov qword [rcx + rax*8], rbx
jmp 0x1401a54d6
cmp qword [rcx + rax*8 + 8], r8
jne 0x1401a54d6
mov qword [rcx + rax*8 + 8], rbx
mov qword [rdi], rbx
mov byte [rdi + 8], 1
mov rax, rdi
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, str.unordered_map_set_too_long
call fcn.1401caf80
int3
Function at 0x1401a55d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov r9, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x1401a55fb
mov r8, qword [r8]
movabs rcx, 0xcbf29ce484222325
xor r13d, r13d
mov edx, r13d
add r9, r9
je 0x1401a5634
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rdx + r8]
xor rcx, rax
imul rcx, r10
inc rdx
cmp rdx, r9
jb 0x1401a5620
movsxd rbp, dword [r14 + 0x20]
xor rbp, rcx
mov r9, rbp
mov r8, r14
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1401a59f0
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1401a5664
mov qword [rdi], rax
mov byte [rdi + 8], r13b
jmp 0x1401a578d
movabs rax, 0x38e38e38e38e38e
cmp qword [rsi + 0x10], rax
je 0x1401a57a8
lea r12, [rsi + 8]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r13
mov ecx, 0x48
call fcn.14019465c
mov rbx, rax
mov qword [rsp + 0x38], rax
mov rdx, r14
lea rcx, [rax + 0x10]
call fcn.1401785e0
mov ecx, dword [r14 + 0x20]
mov dword [rbx + 0x30], ecx
mov qword [rbx + 0x38], r13
mov qword [rbx + 0x40], r13
mov rcx, qword [rsi + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x1401a56c7
cvtsi2ss xmm0, rcx
jmp 0x1401a56dc
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x1401a56ef
cvtsi2ss xmm1, rcx
jmp 0x1401a5704
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
seta al
test al, al
je 0x1401a5736
mov rcx, rsi
call fcn.1401a4d70
mov r9, rbp
lea r8, [rbx + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1401a59f0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc qword [rsi + 0x10]
mov qword [rbx], rdx
mov qword [rbx + 8], r8
mov qword [r8], rbx
mov qword [rdx + 8], rbx
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x30]
and rax, rbp
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r12]
jne 0x1401a576f
mov qword [rcx + rax*8], rbx
jmp 0x1401a5781
cmp r9, rdx
jne 0x1401a577a
mov qword [rcx + rax*8], rbx
jmp 0x1401a5786
cmp qword [rcx + rax*8 + 8], r8
jne 0x1401a5786
mov qword [rcx + rax*8 + 8], rbx
mov qword [rdi], rbx
mov byte [rdi + 8], 1
mov rax, rdi
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.unordered_map_set_too_long
call fcn.1401caf80
int3
Function at 0x1401b0980
Capabilities:
Check os version

Disassembly:
mov ecx, dword [0x1405ffbc8]
test ecx, ecx
jne 0x1401b09e9
mov r8, qword gs:[0x60]
test r8, r8
jne 0x1401b099f
cmp ecx, 0x3e
setae al
ret
mov edx, dword [r8 + 0x11c]
mov ecx, dword [r8 + 0x118]
cmp edx, 0xa
jb 0x1401b09cf
nop dword [rax]
nop word [rax + rax]
mov eax, 0xcccccccd
mul edx
shr edx, 3
cmp edx, 0xa
jae 0x1401b09c0
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*2]
mov dword [0x1405ffbc8], ecx
movzx eax, word [r8 + 0x120]
mov dword [0x1405ffbcc], eax
cmp ecx, 0x3e
setae al
ret

Function at 0x1401b09f0
Capabilities:
Check os version

Disassembly:
mov ecx, dword [0x1405ffbc8]
test ecx, ecx
jne 0x1401b0a59
mov r8, qword gs:[0x60]
test r8, r8
jne 0x1401b0a0f
cmp ecx, 0x3f
setae al
ret
mov edx, dword [r8 + 0x11c]
mov ecx, dword [r8 + 0x118]
cmp edx, 0xa
jb 0x1401b0a3f
nop dword [rax]
nop word [rax + rax]
mov eax, 0xcccccccd
mul edx
shr edx, 3
cmp edx, 0xa
jae 0x1401b0a30
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*2]
mov dword [0x1405ffbc8], ecx
movzx eax, word [r8 + 0x120]
mov dword [0x1405ffbcc], eax
cmp ecx, 0x3f
setae al
ret

Function at 0x1401b0a60
Capabilities:
Check os version

Disassembly:
mov ecx, dword [0x1405ffbc8]
test ecx, ecx
jne 0x1401b0ac9
mov r8, qword gs:[0x60]
test r8, r8
jne 0x1401b0a7f
cmp ecx, 0x64
setae al
ret
mov edx, dword [r8 + 0x11c]
mov ecx, dword [r8 + 0x118]
cmp edx, 0xa
jb 0x1401b0aaf
nop dword [rax]
nop word [rax + rax]
mov eax, 0xcccccccd
mul edx
shr edx, 3
cmp edx, 0xa
jae 0x1401b0aa0
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*2]
mov dword [0x1405ffbc8], ecx
movzx eax, word [r8 + 0x120]
mov dword [0x1405ffbcc], eax
cmp ecx, 0x64
setae al
ret

Function at 0x1401b0ad0
Capabilities:
Check os version

Disassembly:
mov eax, dword [0x1405ffbc8]
test eax, eax
je 0x1401b0ae2
mov ecx, dword [0x1405ffbcc]
jmp 0x1401b0b39
mov rcx, qword gs:[0x60]
test rcx, rcx
je 0x1401b0b49
mov edx, dword [rcx + 0x11c]
mov r8d, dword [rcx + 0x118]
cmp edx, 0xa
jb 0x1401b0b1f
nop dword [rax]
nop word [rax + rax]
mov eax, 0xcccccccd
mul edx
shr edx, 3
cmp edx, 0xa
jae 0x1401b0b10
lea eax, [r8 + r8*4]
lea eax, [rdx + rax*2]
mov dword [0x1405ffbc8], eax
movzx ecx, word [rcx + 0x120]
mov dword [0x1405ffbcc], ecx
cmp eax, 0x64
jb 0x1401b0b49
cmp ecx, 0x55f0
jb 0x1401b0b49
mov al, 1
ret
xor al, al
ret

Function at 0x1401b0b50
Capabilities:
Check os version

Disassembly:
mov eax, dword [0x1405ffbc8]
mov rdx, rcx
test eax, eax
jne 0x1401b0bb9
mov rcx, qword gs:[0x60]
test rcx, rcx
jne 0x1401b0b79
test rdx, rdx
je 0x1401b0b76
mov dword [rdx], 0x2c
xor eax, eax
ret
mov edx, dword [rcx + 0x11c]
mov r8d, dword [rcx + 0x118]
cmp edx, 0xa
jb 0x1401b0b9f
nop dword [rax + rax]
mov eax, 0xcccccccd
mul edx
shr edx, 3
cmp edx, 0xa
jae 0x1401b0b90
lea eax, [r8 + r8*4]
lea eax, [rdx + rax*2]
mov dword [0x1405ffbc8], eax
movzx ecx, word [rcx + 0x120]
mov dword [0x1405ffbcc], ecx
ret
Function at 0x1401b0bd0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov esi, edx
cmp qword [rcx + 0x18], 8
jb 0x1401b0bfd
mov rcx, qword [rcx]
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x1c]
mov rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.1401b3000
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea r14, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x50], r14
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x4c], edx
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
cmp dword [rsp + rcx + 0x60], 0
je 0x1401b0c5e
mov ebx, 0x20000001
jmp 0x1401b0d43
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1401b2eb0
mov rdx, qword [rsp + 0x38]
add rdx, qword [rsp + 0x30]
cmp rdx, 0x1000
jge 0x1401b0c94
lea rcx, [rsp + 0x50]
call fcn.1401b3290
mov ebx, 0x20000002
jmp 0x1401b0d43
lea rdx, [0x1405ceaa8]
mov ecx, 0x1000
call fcn.1401cc6a0
mov rbx, rax
test rax, rax
je 0x1401b0d3e
xor edx, edx
mov r8d, 0x1000
mov rcx, rax
call fcn.1401e8980
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.1401b2cb0
mov r8d, 0x1000
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1401b2b60
lea rcx, [rsp + 0x50]
call fcn.1401b3290
mov eax, 0x5a4d
cmp word [rbx], ax
je 0x1401b0d06
mov rcx, rbx
call fcn.140194698
mov ebx, 0x20000003
jmp 0x1401b0d43
movsxd rax, dword [rbx + 0x3c]
cmp eax, 0x1000
jg 0x1401b0cf7
mov rdi, rax
cmp dword [rax + rbx], 0x4550
jne 0x1401b0cf7
mov eax, 0x2000
mov rcx, rbx
test word [rdi + rbx + 0x16], ax
je 0x1401b0cfa
call fcn.140194698
movzx eax, word [rdi + rbx + 4]
cmp eax, esi
jne 0x1401b0cff
xor ebx, ebx
jmp 0x1401b0d43
mov ebx, 0x20000004
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x50], r14
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rsp + rcx + 0x4c], edx
lea rcx, [rsp + 0x60]
call fcn.1401b3330
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x50], rax
mov rcx, qword [rsp + 0x50]
movsxd rdx, dword [rcx + 4]
lea r8d, [rdx - 0x18]
mov dword [rsp + rdx + 0x4c], r8d
lea rax, vtable.std::ios_base.0
mov qword [rbp], rax
lea rcx, [rbp]
call fcn.1401cd050
nop
mov eax, ebx
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x1401b0dd0
Capabilities:
Parse pe header

Disassembly:
cmp edx, 0x1000
jae 0x1401b0dde
mov eax, 0x20000002
ret
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401b0e1b
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x1000
jg 0x1401b0e1b
add rax, rcx
cmp dword [rax], 0x4550
jne 0x1401b0e1b
mov ecx, 0x2000
test word [rax + 0x16], cx
je 0x1401b0e1b
movzx ecx, word [rax + 4]
mov edx, 0x20000003
xor eax, eax
cmp ecx, r8d
cmovne eax, edx
ret
mov eax, 0x20000003
ret
Function at 0x1401b15b0
Capabilities:
Check os version

Disassembly:
movzx r9d, dl
test ecx, ecx
jne 0x1401b15d4
test dl, dl
je 0x1401b15c8
lea rcx, [0x1405fee80]
jmp 0x1401b6530
lea rcx, [0x1405fef10]
jmp 0x1401b6530
cmp ecx, 1
jne 0x1401b165b
mov ecx, dword [0x1405ffbc8]
test ecx, ecx
jne 0x1401b1639
mov r8, qword gs:[0x60]
test r8, r8
je 0x1401b165b
mov edx, dword [r8 + 0x11c]
mov ecx, dword [r8 + 0x118]
cmp edx, 0xa
jb 0x1401b161f
nop dword [rax + rax]
mov eax, 0xcccccccd
mul edx
shr edx, 3
cmp edx, 0xa
jae 0x1401b1610
lea eax, [rcx + rcx*4]
lea ecx, [rdx + rax*2]
mov dword [0x1405ffbc8], ecx
movzx eax, word [r8 + 0x120]
mov dword [0x1405ffbcc], eax
cmp ecx, 0x3d
jne 0x1401b165b
test r9b, r9b
je 0x1401b164f
lea rcx, [0x1405fefa0]
jmp 0x1401b6530
lea rcx, [0x1405ff030]
jmp 0x1401b6530
xorps xmm0, xmm0
ret
movss xmm0, dword [rcx + 0x80]
ucomiss xmm0, dword [0x1402240cc]
jp 0x1401b6543
je 0x1401b654c
add rcx, 0x60
jmp 0x1401cd370
ret
movss xmm0, dword [rcx + 0x10]
ret

Function at 0x1401b1660
Capabilities:
Check os version

Disassembly:
sub rsp, 0x28
mov dl, 1
lea rcx, [0x1405fef10]
call 0x1401b64e0
mov dl, 1
lea rcx, [0x1405fee80]
call 0x1401b64e0
mov edx, dword [0x1405ffbc8]
test edx, edx
jne 0x1401b16d9
mov rcx, qword gs:[0x60]
test rcx, rcx
je 0x1401b16fe
mov edx, dword [rcx + 0x11c]
mov r8d, dword [rcx + 0x118]
cmp edx, 0xa
jb 0x1401b16bf
nop word [rax + rax]
mov eax, 0xcccccccd
mul edx
shr edx, 3
cmp edx, 0xa
jae 0x1401b16b0
lea eax, [r8 + r8*4]
lea edx, [rdx + rax*2]
mov dword [0x1405ffbc8], edx
movzx eax, word [rcx + 0x120]
mov dword [0x1405ffbcc], eax
cmp edx, 0x3d
jne 0x1401b16fe
mov dl, 1
lea rcx, [0x1405ff030]
call 0x1401b64e0
mov dl, 1
lea rcx, [0x1405fefa0]
add rsp, 0x28
jmp 0x1401b64e0
add rsp, 0x28
ret
mov byte [rcx + 0x84], dl
ret
Function at 0x1401b3b90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1401b3bc1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x1401b3c3b
mov rdi, r14
mov rcx, rbx
call fcn.1401b06e0
test rax, rax
jle 0x1401b3c13
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1401e82d0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1401b3c2b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1401b3c33
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1401b3bd5
sub r14, rdi
jmp 0x1401b3d1f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1401b3c52
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1401b3c54
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1401b3c86
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1401e82d0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1401b3d1c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1401b3cc1
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x1401b3cfd
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1401fb490
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x1401b3d1c
cmp rbp, rax
ja 0x1401b3cd0
test rbp, rbp
je 0x1401b3d1c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1401fb490
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x1401ba4b4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x1405e8998]
test rax, rax
je 0x1401ba4fe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401ba4fe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401ba4fe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401ba4fe
cmp dword [rcx + 0x84], 0xe
jbe 0x1401ba4fe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401ba500
xor al, al
add rsp, 0x28
ret
Function at 0x1401bdfe0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1405fadb0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r14, rdx
mov ecx, dword [0x1405ff518]
mov rax, qword gs:[0x58]
mov edx, 0x1d8
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1405fff00], ecx
jg 0x1401be1e2
mov rax, qword [0x1405ffef8]
test rax, rax
je 0x1401be048
mov rcx, r14
call rax
jmp 0x1401be1b9
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rax
mov dword [rsp + 0x70], eax
xor ebp, ebp
mov dword [rsp + 0x50], ebp
call fcn.14019a4d0
mov rsi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
lea edx, [rbp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140178440
mov rdi, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x18
mov qword [rsp + 0x48], 0x1f
movups xmm0, xmmword [str.NtQueryInformationThread]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1405e2e00]
movsd qword [rax + 0x10], xmm0
mov byte [rax + 0x18], bpl
call fcn.1401ba6d0
lea r15, [rsi + 0x40]
mov rcx, r15
call qword [0x1405e8838]
movabs rdx, 0xcbf29ce484222325
mov ecx, ebp
movabs r8, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rcx + rdi]
xor rdx, rax
imul rdx, r8
inc rcx
cmp rcx, 0x18
jb 0x1401be0e0
mov rcx, qword [rsi + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [rsi + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r12, qword [rsi + 8]
cmp rbx, r12
je 0x1401be152
mov rsi, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1401be132
mov rdx, qword [rdx]
cmp rax, 0x18
jne 0x1401be147
mov r8, rax
mov rcx, rdi
call fcn.1401e81d0
test eax, eax
je 0x1401be155
cmp rbx, rsi
je 0x1401be152
mov rbx, qword [rbx + 8]
jmp 0x1401be120
mov rbx, rbp
test rbx, rbx
je 0x1401be191
cmp rbx, r12
je 0x1401be191
mov rbx, qword [rbx + 0x30]
mov rcx, r15
call qword [0x1405e8b10]
test rbx, rbx
je 0x1401be19a
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x1c
lea r8, [rsp + 0x58]
xor edx, edx
mov rcx, r14
call rbx
mov ebx, eax
jmp 0x1401be19f
mov rcx, r15
call qword [0x1405e8b10]
mov ebx, 0xc0000138
shr ebx, 0x1f
mov edx, 0x20
mov rcx, rdi
call fcn.140194698
xor bl, 1
cmovne ebp, dword [rsp + 0x64]
mov eax, ebp
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1401af7a0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
lea rcx, [0x1405fff00]
call fcn.1401afa44
cmp dword [0x1405fff00], 0xffffffff
jne 0x1401be032
lea rcx, str.kernel32.dll
call qword [0x1405e8998]
mov rcx, rax
lea rdx, str.GetThreadId
call qword [0x1405e89b0]
mov qword [0x1405ffef8], rax
lea rcx, [0x1405fff00]
call fcn.1401afadc
jmp 0x1401be032
Function at 0x1401be230
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov r14, r8
mov rbx, rdx
mov rsi, rcx
call fcn.1401ba6d0
lea rcx, [rsi + 0x40]
call qword [0x1405e8838]
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
mov r10, qword [rbx + 0x10]
jb 0x1401be26e
mov rdx, qword [rbx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x1401be2a3
movabs r8, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
inc rcx
xor r9, rax
imul r9, r8
cmp rcx, r10
jb 0x1401be290
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1401ac6f0
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x1401be2dc
cmp rbx, qword [rsi + 8]
je 0x1401be2dc
mov rbx, qword [rbx + 0x30]
lea rcx, [rsi + 0x40]
call qword [0x1405e8b10]
test rbx, rbx
je 0x1401be2e6
mov rcx, qword [r14]
call rbx
jmp 0x1401be2e8
lea rcx, [rsi + 0x40]
call qword [0x1405e8b10]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret