joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001200
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x48
xor ecx, ecx
mov edx, 0xfb8650ab
call fcn.180040490
xor ecx, ecx
call rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x18000126c
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x30]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp dword [rax], 0x4550
jne 0x18000126a
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0x28]
add rax, rcx
mov qword [rsp + 0x40], rax
call qword [rsp + 0x40]
mov dword [rsp + 0x2c], eax
jmp 0x180001274
jmp 0x18000126c
mov dword [rsp + 0x2c], 0
mov eax, dword [rsp + 0x2c]
add rsp, 0x48
ret

Function at 0x1800012f0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rax
mov dword [rsp + 4], ecx
mov eax, dword [rsp + 4]
and eax, 0xffffffff
mov dword [0x18007b3e0], eax
mov dword [0x18007a950], 1
cmp dword [0x18007a950], 0x270
jge 0x1800013a7
mov eax, dword [0x18007a950]
sub eax, 1
cdqe
lea rcx, [0x18007b3e0]
mov eax, dword [rcx + rax*4]
mov ecx, dword [0x18007a950]
add ecx, 0xa91d5d8a
sub ecx, 1
sub ecx, 0xa91d5d8a
movsxd rcx, ecx
lea rdx, [0x18007b3e0]
mov ecx, dword [rdx + rcx*4]
shr ecx, 0x1e
xor eax, ecx
imul eax, eax, 0x6c078965
add eax, dword [0x18007a950]
movsxd rcx, dword [0x18007a950]
lea rdx, [0x18007b3e0]
mov dword [rdx + rcx*4], eax
movsxd rax, dword [0x18007a950]
lea rcx, [0x18007b3e0]
mov ecx, dword [rcx + rax*4]
and ecx, 0xffffffff
lea rdx, [0x18007b3e0]
mov dword [rdx + rax*4], ecx
mov eax, dword [0x18007a950]
add eax, 1
mov dword [0x18007a950], eax
jmp 0x18000130c
pop rax
ret
Function at 0x18000b3b0
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x90
mov qword [rsp + 0x68], r9
mov dword [rsp + 0x5c], r8d
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x88], rcx
mov byte [rsp + 0x43], 0
mov rcx, qword [rsp + 0x60]
call fcn.18004e230
mov r14, rax
xor ecx, ecx
mov edx, 0xfc5900db
call fcn.180040490
mov rdi, rax
mov ecx, 0xafeb14b7
call fcn.18002c000
mov ebx, eax
mov ecx, 0xefeb14b6
call fcn.18002c000
mov ebp, eax
mov ecx, 0xefeb14b5
call fcn.18002c000
mov esi, eax
mov ecx, 0xefeb1437
call fcn.18002c000
mov rcx, r14
mov edx, ebx
mov r8d, ebp
xor r9d, r9d
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x30], 0
call rdi
mov qword [rsp + 0x50], rax
mov rax, 0xffffffffffffffff
cmp qword [rsp + 0x50], rax
je 0x18000b5bf
lea rcx, [rsp + 0x70]
call fcn.18004e3b0
lea rcx, [rsp + 0x70]
mov edx, 0x1000
call fcn.180050790
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x44], 0
jmp 0x18000b48b
cmp qword [rsp + 0x68], 0
je 0x18000b4ac
mov rcx, qword [rsp + 0x68]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x18000b4ac
jmp 0x18000b586
lea rcx, [rsp + 0x70]
call fcn.18004eab0
mov rsi, rax
lea rcx, [rsp + 0x70]
call fcn.18004e230
mov rdi, rax
mov rbx, qword [rsp + 0x88]
mov ecx, 0x13
mov edx, 0xf4555ae5
call fcn.180040490
lea r9, [rsp + 0x44]
mov rcx, rbx
mov rdx, rdi
mov r8d, esi
call rax
cmp eax, 0
jne 0x18000b4f7
jmp 0x18000b586
cmp dword [rsp + 0x44], 0
jne 0x18000b52b
mov rsi, qword [rsp + 0x50]
mov ecx, 0x1a243730
call fcn.18002c000
xor ecx, ecx
mov edx, eax
call fcn.180040490
mov rcx, rsi
call rax
mov ecx, 0xb6
call fcn.180048680
mov byte [rsp + 0x43], al
jmp 0x18000b586
mov esi, dword [rsp + 0x44]
lea rcx, [rsp + 0x70]
call fcn.18004e230
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x4c]
mov rdx, rax
mov r8d, esi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 0
je 0x18000b567
mov eax, dword [rsp + 0x44]
cmp eax, dword [rsp + 0x4c]
je 0x18000b569
jmp 0x18000b586
mov eax, dword [rsp + 0x44]
add eax, dword [rsp + 0x48]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
cmp eax, dword [rsp + 0x5c]
jbe 0x18000b581
jmp 0x18000b586
jmp 0x18000b489
mov rsi, qword [rsp + 0x50]
xor ecx, ecx
mov edx, 0xff1bb685
call fcn.180040490
mov rcx, rsi
call rax
test byte [rsp + 0x43], 1
jne 0x18000b5b5
mov rcx, qword [rsp + 0x60]
call fcn.18004e230
mov rcx, rax
call fcn.18003bff0
lea rcx, [rsp + 0x70]
call fcn.18004e290
mov al, byte [rsp + 0x43]
and al, 1
movzx eax, al
add rsp, 0x90
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x180014240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
sub rsp, 0xb8
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x78], rcx
mov rsi, qword [rsp + 0x78]
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x88]
call fcn.18004e3b0
mov rax, qword [rsp + 0x28]
cmp rax, qword [rsp + 0x58]
jae 0x180014337
lea rcx, [rsp + 0xa0]
call fcn.180056660
mov r8, qword [rsp + 0x58]
sub r8, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x80]
add rdx, qword [rsp + 0x28]
lea r9, [rsp + 0xa0]
mov rcx, rsi
call fcn.180024310
mov dword [rsp + 0x44], eax
movsxd rax, dword [rsp + 0x44]
add rax, qword [rsp + 0x28]
mov qword [rsp + 0x28], rax
mov ecx, 0x38
call fcn.1800144a0
mov rdi, rax
mov rcx, rdi
call fcn.180057bc0
lea rcx, [rsp + 0x68]
mov rdx, rdi
call fcn.1800522f0
lea rcx, [rsp + 0x68]
call fcn.18004e230
lea rdx, [rsp + 0xa0]
mov rcx, rax
call fcn.180057d50
lea rcx, [rsp + 0x88]
lea rdx, [rsp + 0x68]
call fcn.18005d480
lea rcx, [rsp + 0x68]
call fcn.180055100
lea rcx, [rsp + 0xa0]
call fcn.180051710
jmp 0x180014276
call fcn.1800552b0
lea rdx, [rsp + 0x88]
mov rcx, rax
call fcn.180007730
mov dword [rsp + 0x40], eax
cmp eax, 0
jge 0x180014370
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x20], eax
mov ecx, 0xefeb14b6
call fcn.18002c000
mov dword [rsp + 0x24], eax
jmp 0x180014455
lea rax, [rsp + 0x88]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x30]
call fcn.18004ede0
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x60]
call fcn.18004f330
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x60]
call fcn.18004e770
test al, 1
jne 0x1800143b3
jmp 0x180014444
lea rcx, [rsp + 0x30]
call fcn.18004e230
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.18004e230
add rax, 0x18
mov rcx, rax
call fcn.180052710
test al, 1
jne 0x1800143de
jmp 0x1800143f0
mov dword [rsp + 0x20], 0xffffffff
mov dword [rsp + 0x24], 1
jmp 0x180014455
mov rcx, qword [rsp + 0x48]
call fcn.18004e230
add rax, 0x18
mov rcx, rax
xor edx, edx
call fcn.1800596c0
mov eax, dword [rax + 1]
mov dword [rsp + 0x3c], eax
mov esi, dword [rsp + 0x3c]
mov ecx, 0xe7e31cbf
call fcn.18002c000
cmp esi, eax
je 0x180014433
mov dword [rsp + 0x20], 0xffffffff
mov dword [rsp + 0x24], 1
jmp 0x180014455
jmp 0x180014435
lea rcx, [rsp + 0x30]
call fcn.18004fe80
jmp 0x18001439b
mov rax, qword [rsp + 0x28]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], 1
lea rcx, [rsp + 0x88]
call fcn.18005baf0
mov eax, dword [rsp + 0x20]
add rsp, 0xb8
pop rdi
pop rsi
ret
Function at 0x180029740
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov eax, dword [rsp + 0xc8]
mov rax, qword [rsp + 0xc0]
mov dword [rsp + 0x64], r9d
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x58], rcx
mov byte [rsp + 0x53], 0
mov ecx, 0xefeb14b5
call fcn.18002c000
mov dword [rsp + 0x54], eax
mov rcx, 0xffffffffffffffff
call fcn.18002b810
test al, 1
jne 0x180029790
jmp 0x18002979d
mov eax, dword [rsp + 0x54]
or eax, 0x100
mov dword [rsp + 0x54], eax
mov ebp, dword [rsp + 0x54]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x58]
mov ecx, 0xefeb14be
call fcn.18002c000
mov ebx, eax
mov ecx, 0x1dcca47c
call fcn.18002c000
mov ecx, ebx
mov edx, eax
call fcn.180040490
lea rbx, [rsp + 0x58]
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], 0
call rax
cmp eax, 0
jne 0x180029858
mov eax, dword [rsp + 0xc8]
mov rbp, qword [rsp + 0xc0]
mov r9d, dword [rsp + 0x64]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x20], rbp
mov dword [rsp + 0x28], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, 0
jne 0x18002983f
mov byte [rsp + 0x53], 1
mov rsi, qword [rsp + 0x58]
mov ecx, 9
mov edx, 0xf7b4b739
call fcn.180040490
mov rcx, rsi
call rax
mov al, byte [rsp + 0x53]
and al, 1
movzx eax, al
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x18004aac0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov dword [0x18007a950], 0
lea rcx, [0x18007b3e0]
mov edx, 0x9c0
call fcn.180032940
lea rcx, [0x18007a550]
mov edx, 0x400
call fcn.180032940
mov dword [0x18007bdb0], 0
mov dword [0x18007a544], 0
mov dword [0x18007a548], 0x9908b0df
mov dword [rsp + 0x2c], 0
mov dword [rsp + 0x30], 0
cmp dword [rsp + 0x30], 0x100
jge 0x18004ac05
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x2c], eax
mov ecx, 0xefeb14bf
call fcn.18002c000
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jle 0x18004abd9
mov eax, dword [rsp + 0x2c]
mov ecx, 0xffffffff
xor ecx, 1
mov edx, eax
xor edx, ecx
and edx, eax
cmp edx, 0
je 0x18004abb1
mov ebx, dword [rsp + 0x2c]
shr ebx, 1
mov edi, ebx
xor edi, 0xffffffff
and edi, 0x1dff64ee
mov ebp, 0xffffffff
xor ebp, 0x1dff64ee
and ebx, ebp
mov ecx, 0xedb88320
call fcn.18003b5c0
mov esi, eax
and esi, 0x1dff64ee
mov ecx, 0x2539797
call fcn.18002c000
and eax, ebp
or edi, ebx
or esi, eax
xor edi, esi
mov dword [rsp + 0x2c], edi
jmp 0x18004abc7
mov esi, dword [rsp + 0x2c]
mov ecx, 0xefeb14b6
call fcn.18002c000
mov ecx, eax
shr esi, cl
mov dword [rsp + 0x2c], esi
jmp 0x18004abc9
mov eax, dword [rsp + 0x34]
add eax, 0xffffffff
mov dword [rsp + 0x34], eax
jmp 0x18004ab46
mov eax, dword [rsp + 0x2c]
movsxd rcx, dword [rsp + 0x30]
lea rdx, [0x18007a550]
mov dword [rdx + rcx*4], eax
mov esi, dword [rsp + 0x30]
mov ecx, 0xefeb14b6
call fcn.18002c000
add esi, eax
mov dword [rsp + 0x30], esi
jmp 0x18004ab22
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x180057100
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rcx
mov rsi, qword [rsp + 0x40]
mov qword [rsp + 0x50], rsi
mov rcx, rsi
call fcn.18005b380
movabs rcx, 0x58b28f05efeb14a7
call fcn.18004d3a0
mov rcx, rax
call fcn.1800144a0
mov rdi, rax
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
call fcn.18004ecb0
mov qword [rsp + 0x38], rdi
mov rax, rsi
add rax, 8
mov r9, qword [rsp + 0x38]
lea r8, [0x180052b80]
xor ecx, ecx
xor ecx, ecx
mov edx, 0x20000
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsi], rax
cmp qword [rsi], 0
jne 0x1800571a3
mov rsi, qword [rsp + 0x38]
cmp rsi, 0
je 0x1800571a1
mov rcx, rsi
call fcn.18004e4f0
mov rcx, rsi
call fcn.180040520
jmp 0x1800571a3
mov rax, qword [rsp + 0x50]
add rsp, 0x58
pop rdi
pop rsi
ret
Function at 0x1400cc63c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x14010beb8], rbx
je 0x1400cc6a3
cmp rax, rbx
jne 0x1400cc696
mov ebx, 1
mov esi, ebx
jmp 0x1400cc6a8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400cc67b
mov ebx, 1
mov eax, dword [0x14010bec0]
cmp eax, ebx
jne 0x1400cc6c0
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x1400cc72c
mov eax, dword [0x14010bec0]
test eax, eax
jne 0x1400cc721
mov dword [0x14010bec0], ebx
lea r15, [0x1400d8b58]
lea rdi, [0x1400d8b40]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x1400cc713
test eax, eax
jne 0x1400cc717
cmp qword [rdi], r14
je 0x1400cc708
mov rax, qword [rdi]
mov rcx, qword [case.0x14006d218.0]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1400cc6ea
test eax, eax
je 0x1400cc727
mov eax, 0xff
jmp 0x1400cc882
mov dword [0x140109a30], ebx
mov edi, 0x1f
mov eax, dword [0x14010bec0]
cmp eax, ebx
jne 0x1400cc753
lea rdx, [0x1400d8b38]
lea rcx, [0x1400d89c8]
call sub.msvcrt.dll__initterm
mov dword [0x14010bec0], 2
test esi, esi
jne 0x1400cc761
mov rax, r14
xchg qword [0x14010beb8], rax
cmp qword [0x14010bed8], r14
je 0x1400cc794
lea rcx, [0x14010bed8]
call fcn.1400cd190
test eax, eax
je 0x1400cc794
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14010bed8]
mov r9, qword [case.0x14006d218.0]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x1400cc7ad
mov eax, 0xff
jmp 0x1400cc882
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x1400cc833
test ax, ax
je 0x1400cc7c8
test edx, edx
jne 0x1400cc833
sub ax, bx
cmp ax, di
ja 0x1400cc7de
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x1400cc7c8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140003830
mov dword [0x140109a2c], eax
cmp dword [0x140109a50], r14d
jne 0x1400cc81c
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140109a30], r14d
jne 0x1400cc831
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140109a2c]
jmp 0x1400cc882
cmp ax, 0x22
jne 0x1400cc847
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400cc7b6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.1401b4000
add rsp, 0x28
jmp 0x1400cc63c
Function at 0x140001700
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
cmp word [rcx], 0
mov r8, rdx
mov r9, rcx
je 0x14000173e
movzx edx, word [rcx]
lea eax, [rdx - 0x41]
lea ecx, [rdx + 0x20]
cmp eax, 0x19
movabs rax, 0x100000001b3
cmova ecx, edx
mov edx, ecx
lea rcx, [r9 + 2]
xor rdx, r8
imul rdx, rax
call fcn.140001700
mov r8, rax
mov rax, r8
add rsp, 0x28
ret

Function at 0x140001f58
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
and qword [rcx + 0x28], 0
mov rbx, rcx
and qword [rcx + 0x30], 0
movabs rdi, 0xacd80f50f7102617
mov rcx, rdi
movabs rdx, 0x69d265fe6b1c110f
call fcn.140002cfc
lea rcx, [0x140001108]
call rax
movabs rdx, 0xc17e07475e9f97e5
mov rcx, rdi
call fcn.140002cfc
movabs rdx, 0x7cbbe8aeac1f99e3
mov qword [rbx], rax
mov rcx, rdi
call fcn.140002cfc
movabs rdi, 0xbb7bb9a74c2f14fb
mov qword [rbx + 8], rax
mov rcx, rdi
movabs rdx, 0x404caedc462f1214
mov rsi, rax
call fcn.140002cfc
movabs rdx, 0x7f8fb52001d24882
mov qword [rbx + 0x10], rax
mov rcx, rdi
call fcn.140002cfc
movabs rdx, 0x44f0fb5bc5073405
mov qword [rbx + 0x18], rax
movabs rcx, 0x1c08fd93d1714208
call fcn.140002cfc
mov qword [rbx + 0x20], rax
lea rdi, [rbx + 0x38]
xor al, al
mov byte [rdi], 0
test rsi, rsi
je 0x140002070
mov dword [rbp - 0x10], 0x888e989a
xor eax, eax
mov dword [rbp - 0xc], 0x8c848794
mov dword [rbp - 8], 0x928e8094
mov word [rbp - 4], 0xcb
xor byte [rbp + rax - 0x10], 0xcb
inc rax
cmp rax, 0xd
jb 0x14000204d
mov r8d, 0x10
mov byte [rbp - 3], 0
mov rdx, rdi
lea rcx, [rbp - 0x10]
call rsi
mov al, byte [rdi]
xor ecx, ecx
mov dword [rbp + 0x10], 0x76716467
mov word [rbp + 0x14], 0x7753
mov byte [rbp + 0x16], cl
test al, al
je 0x1400020c2
xor edx, edx
mov eax, edx
and eax, 0x8000000f
jge 0x140002098
dec eax
or eax, 0xfffffff0
inc eax
cdqe
mov cl, byte [rax + rbx + 0x38]
xor cl, byte [rbp + rdx + 0x10]
xor cl, 6
mov byte [rbp + rdx + 0x10], cl
inc rdx
cmp rdx, 6
jb 0x140002088
lea rdx, [rbp + 0x10]
mov byte [rbp + 0x16], 0
mov rcx, rbx
call fcn.140002e54
mov rsi, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
Function at 0x1400020dc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
xor eax, eax
mov dword [rbp - 0x10], 0xa6adb887
mov byte [rbp - 2], al
xor ebx, ebx
mov rdi, rcx
mov dword [rbp - 0xc], 0xa6adbe8d
mov dword [rbp - 8], 0xafa784bc
mov word [rbp - 4], 0xc889
xor byte [rbp + rax - 0x10], 0xc8
inc rax
cmp rax, 0xe
jb 0x140002118
mov byte [rbp - 2], bl
lea rsi, [0x140003d5c]
mov rax, qword [rsi]
lea rcx, [0x140001138]
mov rdx, qword [rax + 0x18]
call rdx
test rax, rax
je 0x140002158
mov rcx, qword [rsi]
lea rdx, [rbp - 0x10]
mov r8, qword [rcx + 0x20]
mov rcx, rax
call r8
jmp 0x14000215b
mov rax, rbx
mov qword [rdi], rax
xor eax, eax
mov byte [rbp - 2], al
mov dword [rbp - 0x10], 0xbba7a48b
mov dword [rbp - 0xc], 0xadbe8dad
mov dword [rbp - 8], 0xa784bca6
mov word [rbp - 4], 0xc8af
xor byte [rbp + rax - 0x10], 0xc8
inc rax
cmp rax, 0xe
jb 0x14000217e
mov byte [rbp - 2], bl
lea rcx, [0x140001138]
mov rax, qword [rsi]
mov rdx, qword [rax + 0x18]
call rdx
test rax, rax
je 0x1400021b7
mov rcx, qword [rsi]
lea rdx, [rbp - 0x10]
mov r8, qword [rcx + 0x20]
mov rcx, rax
call r8
jmp 0x1400021ba
mov rax, rbx
mov qword [rdi + 8], rax
xor eax, eax
mov byte [rbp - 2], al
mov dword [rbp - 0x10], 0xaca9ad9a
mov dword [rbp - 0xc], 0xa6adbe8d
mov dword [rbp - 8], 0xafa784bc
mov word [rbp - 4], 0xc889
xor byte [rbp + rax - 0x10], 0xc8
inc rax
cmp rax, 0xe
jb 0x1400021de
mov byte [rbp - 2], bl
lea rcx, [0x140001138]
mov rax, qword [rsi]
mov rdx, qword [rax + 0x18]
call rdx
test rax, rax
je 0x140002217
mov rcx, qword [rsi]
lea rdx, [rbp - 0x10]
mov r8, qword [rcx + 0x20]
mov rcx, rax
call r8
jmp 0x14000221a
mov rax, rbx
mov qword [rdi + 0x10], rax
mov rax, rbx
mov dword [rbp - 0x10], 0x87bfae8c
mov dword [rbp - 0xc], 0x8ebfb8aa
mov dword [rbp - 8], 0xb9a4b9b9
mov word [rbp - 4], 0xcb
xor byte [rbp + rax - 0x10], 0xcb
inc rax
cmp rax, 0xd
jb 0x14000223c
mov byte [rbp - 3], bl
lea rcx, [0x140001148]
mov rax, qword [rsi]
mov rdx, qword [rax + 0x18]
call rdx
test rax, rax
je 0x140002276
mov rcx, qword [rsi]
lea rdx, [rbp - 0x10]
mov r8, qword [rcx + 0x20]
mov rcx, rax
call r8
mov rbx, rax
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov qword [rdi + 0x18], rbx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop rbp
ret
Function at 0x140002cfc
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov r12, rdx
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x10
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140002da0
xor r13d, r13d
movabs r9, 0xcbf29ce484222325
movabs r10, 0x100000001b3
mov r8, qword [rbx + 0x60]
cmp word [r8], r13w
jne 0x140002d5d
mov rax, r9
jmp 0x140002d93
movzx edx, word [r8]
lea ecx, [rdx + 0x20]
lea eax, [rdx - 0x41]
cmp eax, 0x19
cmova ecx, edx
mov edx, ecx
lea rcx, [r8 + 2]
xor rdx, r9
imul rdx, r10
call fcn.140001700
movabs r9, 0xcbf29ce484222325
movabs r10, 0x100000001b3
cmp rsi, rax
je 0x140002dbf
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140002d4e
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rbx, qword [rbx + 0x30]
mov r14d, r13d
movsxd rax, dword [rbx + 0x3c]
mov edi, dword [rax + rbx + 0x88]
add rdi, rbx
mov ebp, dword [rdi + 0x20]
mov esi, dword [rdi + 0x24]
add rbp, rbx
mov r15d, dword [rdi + 0x1c]
add rsi, rbx
add r15, rbx
cmp dword [rdi + 0x18], r13d
jbe 0x140002da0
mov ecx, dword [rbp]
add rcx, rbx
cmp byte [rcx], r13b
jne 0x140002dfd
mov rax, r9
jmp 0x140002e1a
movsx rdx, byte [rcx]
xor rdx, r9
imul rdx, r10
inc rcx
call fcn.140003acc
movabs r9, 0xcbf29ce484222325
cmp rax, r12
jne 0x140002e27
movzx eax, word [rsi]
cmp eax, dword [rdi + 0x14]
jb 0x140002e48
inc r14d
add rbp, 4
add rsi, 2
cmp r14d, dword [rdi + 0x18]
jae 0x140002da0
movabs r10, 0x100000001b3
jmp 0x140002ded
mov eax, dword [r15 + rax*4]
add rax, rbx
jmp 0x140002da2
Function at 0x1400036d8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
movdqa xmm0, xmmword [0x140001420]
mov r14, rdx
movdqu xmmword [rax - 0x48], xmm0
mov dword [rax - 0x38], 0xd2b7a6ab
mov rsi, rcx
xor eax, eax
mov byte [rsp + 0x54], al
xor r12d, r12d
xor byte [rsp + rax + 0x40], 0xd2
inc rax
cmp rax, 0x14
jb 0x140003717
mov byte [rsp + 0x54], r12b
lea r13, [0x140003d5c]
mov rax, qword [r13]
lea rcx, [0x140001118]
mov rdx, qword [rax + 0x18]
call rdx
test rax, rax
je 0x14000375f
mov rcx, qword [r13]
lea rdx, [rsp + 0x40]
mov r8, qword [rcx + 0x20]
mov rcx, rax
call r8
mov rbp, rax
jmp 0x140003762
mov rbp, r12
mov rdx, qword [r14]
mov rdi, r12
shr rdx, 1
mov ecx, r12d
mov r14, qword [r14 + 0x10]
je 0x140003794
mov r8, r14
cmp word [r8], r12w
je 0x14000378d
inc ecx
add r8, 2
movsxd rax, ecx
cmp rax, rdx
jb 0x140003777
jmp 0x140003794
lea ebx, [rcx + 1]
test ebx, ebx
jne 0x140003796
mov ebx, edx
mov qword [rsp + 0x38], r12
mov r9d, ebx
mov qword [rsp + 0x30], r12
mov r8, r14
mov dword [rsp + 0x28], r12d
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], r12
call rbp
movsxd r15, eax
test eax, eax
jle 0x14000382a
mov rdx, qword [r13]
mov rcx, r15
mov r10, qword [rdx + 8]
call r10
mov qword [rsp + 0x38], r12
mov r9d, ebx
mov qword [rsp + 0x30], r12
mov r8, r14
mov dword [rsp + 0x28], r15d
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rax
mov rdi, rax
call rbp
test eax, eax
jle 0x14000382a
mov rbx, qword [rsi + 0x10]
movsxd rbp, eax
lea rcx, [rbx + rbp]
cmp rcx, qword [rsi + 8]
ja 0x14000382a
dec eax
mov r8, rbp
movsxd rcx, eax
mov rdx, rdi
mov byte [rcx + rdi], r12b
mov rcx, qword [rsi + 0x10]
add rcx, qword [rsi]
call fcn.140003d18
add qword [rsi + 0x10], rbp
jmp 0x14000382e
movzx ebx, r12w
test rdi, rdi
je 0x14000383d
mov rdx, qword [r13]
mov rcx, rdi
call qword [rdx + 0x10]
lea r11, [rsp + 0x60]
movzx eax, bx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140003acc
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
cmp byte [rcx], 0
mov rax, rdx
je 0x140003af5
movsx rdx, byte [rcx]
xor rdx, rax
movabs rax, 0x100000001b3
imul rdx, rax
inc rcx
call fcn.140003acc
add rsp, 0x28
ret