joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009a804
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x88
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx edi, byte [rcx]
lea rbp, [rcx + 0x10]
mov rax, qword [rcx + 0x28]
mov r14, r9
mov r10, qword [rcx + 0x30]
mov r11, r8
mov r13, qword [rsp + 0xf0]
mov r12, rdx
mov qword [rsp + 0x48], r8
mov rbx, rcx
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], r10
test dil, 0x40
jne 0x14009a884
mov r8, r10
mov rdx, rbp
call qword [case.0x14004a846.0]
inc qword [rbx + 0x20]
mov r10, qword [rsp + 0x50]
mov r11, qword [rsp + 0x48]
mov r8d, edi
xor edi, edi
and r8d, 7
mov ecx, edi
mov byte [rbx], r8b
lea r15d, [rdi + 0xf]
sub r15d, r8d
cmp r15d, 0xf
jae 0x14009a8be
mov edx, r15d
add rdx, rbx
mov r9d, r8d
movzx eax, byte [rdx]
or rcx, rax
mov byte [rdx], dil
shl rcx, 8
inc rdx
sub r9, 1
jne 0x14009a8a8
movzx eax, byte [rbx + 0xf]
or rcx, rax
mov byte [rbx + 0xf], 1
cmp rcx, r14
je 0x14009a8d6
or eax, 0xffffffff
jmp 0x14009aa55
lea rax, [r14 + 0xf]
or rax, 8
shr rax, 3
add qword [rbx + 0x20], rax
movabs rax, 0x2000000000000000
cmp qword [rbx + 0x20], rax
jbe 0x14009a900
mov eax, 0xfffffffe
jmp 0x14009aa55
mov rsi, r14
shr rsi, 4
test rsi, rsi
je 0x14009a984
mov qword [rsp + 0x28], rbp
mov r9, r10
mov r8, rsi
mov qword [rsp + 0x20], rbx
mov rdx, r11
mov rcx, r12
mov rax, r13
call qword [case.0x14004a846.0]
shl rsi, 4
add qword [rsp + 0x48], rsi
add r12, rsi
sub r14, rsi
je 0x14009a9f2
shr rsi, 4
lea r8, [rbx + 0x10]
mov r9, 0xfffffffffffffff8
mov rdx, rdi
sub r9, rbx
dec r8
movzx ecx, sil
shr rsi, 8
movzx eax, byte [r8]
add rdx, rax
lea rax, [r9 + r8]
add rdx, rcx
mov byte [r8], dl
shr rdx, 8
test rax, rax
je 0x14009a984
test rsi, rsi
jne 0x14009a955
test rdx, rdx
jne 0x14009a955
test r14, r14
je 0x14009a9f2
mov edx, edi
mov rcx, rdi
mov al, byte [rcx + r12]
inc edx
xor byte [rcx + rbx + 0x10], al
mov ecx, edx
cmp rcx, r14
jb 0x14009a98e
mov rsi, qword [rsp + 0x50]
mov rdx, rbp
mov r13, qword [rsp + 0x58]
mov r8, rsi
mov rax, r13
mov rcx, rbp
call qword [case.0x14004a846.0]
mov r8, rsi
lea rdx, [rsp + 0x60]
mov rcx, rbx
mov rax, r13
call qword [case.0x14004a846.0]
test r14, r14
je 0x14009a9fc
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
mov al, byte [rcx + r12]
inc edi
xor al, byte [rsp + rcx + 0x60]
mov byte [rcx + rdx], al
mov ecx, edi
cmp rcx, r14
jb 0x14009a9dc
jmp 0x14009a9fc
mov r13, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x50]
mov eax, 0x10
cmp r15d, eax
jae 0x14009aa19
sub eax, r15d
mov ecx, r15d
mov r8d, eax
add rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r8, rsi
lea rdx, [rsp + 0x60]
mov rcx, rbx
mov rax, r13
call qword [case.0x14004a846.0]
lea rcx, [rsp + 0x60]
mov edx, 2
sub rcx, rbx
mov rax, qword [rcx + rbp - 0x10]
xor qword [rbp], rax
lea rbp, [rbp + 8]
sub rdx, 1
jne 0x14009aa3a
mov al, byte [rsp + 0x40]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14024c6d0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14009aa78
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x88
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rsp + 0x70], rax
movzx edi, byte [rcx]
lea rbp, [rcx + 0x10]
mov rax, qword [rsp + 0xf0]
mov r14, r9
mov r13, qword [rcx + 0x28]
mov r11, r8
mov r12, qword [rcx + 0x30]
mov r10, rdx
mov qword [rsp + 0x50], r8
mov rbx, rcx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x40], dil
test dil, 0x40
jne 0x14009aaf7
mov r8, r12
mov rdx, rbp
mov rax, r13
call qword [case.0x14004a846.0]
mov r10, qword [rsp + 0x48]
mov r11, qword [rsp + 0x50]
mov r8d, edi
xor edi, edi
and r8d, 7
mov ecx, edi
mov byte [rbx], r8b
lea r15d, [rdi + 0xf]
sub r15d, r8d
cmp r15d, 0xf
jae 0x14009ab31
mov edx, r15d
add rdx, rbx
mov r9d, r8d
movzx eax, byte [rdx]
or rcx, rax
mov byte [rdx], dil
shl rcx, 8
inc rdx
sub r9, 1
jne 0x14009ab1b
movzx eax, byte [rbx + 0xf]
or rcx, rax
mov byte [rbx + 0xf], 1
cmp rcx, r14
je 0x14009ab49
or eax, 0xffffffff
jmp 0x14009ac7f
mov rsi, r14
shr rsi, 4
test rsi, rsi
je 0x14009abd1
mov rax, qword [rsp + 0x58]
mov r9, r12
mov qword [rsp + 0x28], rbp
mov r8, rsi
mov rdx, r11
mov qword [rsp + 0x20], rbx
mov rcx, r10
call qword [case.0x14004a846.0]
shl rsi, 4
add qword [rsp + 0x48], rsi
add qword [rsp + 0x50], rsi
sub r14, rsi
je 0x14009ac26
shr rsi, 4
lea r8, [rbx + 0x10]
mov r9, 0xfffffffffffffff8
mov rdx, rdi
sub r9, rbx
dec r8
movzx ecx, sil
shr rsi, 8
movzx eax, byte [r8]
add rdx, rax
lea rax, [r9 + r8]
add rdx, rcx
mov byte [r8], dl
shr rdx, 8
test rax, rax
je 0x14009abd1
test rsi, rsi
jne 0x14009aba2
test rdx, rdx
jne 0x14009aba2
test r14, r14
je 0x14009ac26
mov r8, r12
lea rdx, [rsp + 0x60]
mov rcx, rbx
mov rax, r13
call qword [case.0x14004a846.0]
test r14, r14
je 0x14009ac14
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
mov r8, qword [rsp + 0x50]
mov al, byte [rcx + rdx]
inc edi
xor al, byte [rsp + rcx + 0x60]
mov byte [r8 + rcx], al
xor byte [rcx + rbx + 0x10], al
mov ecx, edi
cmp rcx, r14
jb 0x14009abfc
mov r8, r12
mov rdx, rbp
mov rcx, rbp
mov rax, r13
call qword [case.0x14004a846.0]
mov eax, 0x10
cmp r15d, eax
jae 0x14009ac43
sub eax, r15d
mov ecx, r15d
mov r8d, eax
add rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r8, r12
lea rdx, [rsp + 0x60]
mov rcx, rbx
mov rax, r13
call qword [case.0x14004a846.0]
lea rcx, [rsp + 0x60]
mov edx, 2
sub rcx, rbx
mov rax, qword [rcx + rbp - 0x10]
xor qword [rbp], rax
lea rbp, [rbp + 8]
sub rdx, 1
jne 0x14009ac64
mov al, byte [rsp + 0x40]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14024c6d0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14009d114
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
mov eax, 0xc8
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov r9d, 2
lea rdx, [rsp + 0x70]
xor ecx, ecx
lea r8d, [r9 + 0x3e]
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
jne 0x14009d163
movsd xmm2, qword [0x14031bb48]
lea edx, [rax + 0x40]
lea rcx, [rsp + 0x70]
call fcn.14009d078
cmp dword [0x140363850], 0
je 0x14009d19e
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x14009d183
and dword [0x140363850], eax
jmp 0x14009d19e
xorps xmm2, xmm2
lea rcx, [rsp + 0x28]
mov edx, 8
call fcn.14009d078
cmp dword [0x140363850], 0
jne 0x14009d1ba
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorps xmm2, xmm2
lea rcx, [rsp + 0x20]
mov edx, 4
mov dword [rsp + 0x20], eax
call fcn.14009d078
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
movsd xmm2, qword [0x14031bb30]
lea rcx, [rsp + 0x30]
mov edx, 0x40
call fcn.14009d078
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
movsd xmm2, qword [0x14031bb30]
lea rcx, [rsp + 0x24]
mov edx, 4
mov dword [rsp + 0x24], eax
call fcn.14009d078
mov eax, 1
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14024c6d0
add rsp, 0xc8
ret
Function at 0x14009dc34
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, qword [rbp + 0x60]
mov rsi, rcx
mov r13, qword [rbp + 0x68]
mov r15, rdx
mov qword [rbp - 0x28], r9
xor r12d, r12d
mov r14d, r8d
mov qword [rbp - 0x20], r13
movzx eax, byte [rbx + 1]
movzx r9d, byte [rbx]
movzx edx, byte [rbx + 4]
movzx ecx, byte [rbx + 7]
mov edi, dword [r13]
shl eax, 8
or r9d, eax
shl ecx, 8
movzx eax, byte [rbx + 2]
shl eax, 0x10
or r9d, eax
movzx eax, byte [rbx + 3]
shl eax, 0x18
or r9d, eax
movzx eax, byte [rbx + 5]
shl eax, 8
or edx, eax
mov dword [rbp - 0x30], r9d
movzx eax, byte [rbx + 6]
or ecx, eax
mov byte [rbp - 0x18], r9b
shl ecx, 0x10
mov eax, r9d
shr eax, 8
or edx, ecx
mov byte [rbp - 0x17], al
mov eax, r9d
shr eax, 0x10
mov byte [rbp - 0x16], al
mov eax, r9d
shr eax, 0x18
mov byte [rbp - 0x15], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0x13], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0x12], al
mov eax, edx
shr eax, 0x18
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0x14], dl
mov byte [rbp - 0x11], al
test r8d, r8d
je 0x14009ddd4
mov r13, qword [rbp - 0x28]
sub r15, rsi
mov r8b, dl
mov r10b, r9b
dec r14d
test edi, edi
jne 0x14009dd7a
mov rdx, r13
lea rcx, [rbp - 0x30]
call fcn.14009d75c
mov r9d, dword [rbp - 0x30]
mov eax, r9d
mov edx, dword [rbp - 0x2c]
mov r10b, byte [rbp - 0x30]
mov r8b, byte [rbp - 0x2c]
shr eax, 8
mov byte [rbp - 0x17], al
mov eax, r9d
shr eax, 0x10
mov byte [rbp - 0x16], al
mov eax, r9d
shr eax, 0x18
mov byte [rbp - 0x15], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0x13], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0x12], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 0x11], al
inc r12d
mov byte [rbp - 0x18], r10b
mov byte [rbp - 0x14], r8b
movsxd rax, edi
mov cl, byte [rbp + rax - 0x18]
xor cl, byte [rsi]
mov byte [r15 + rsi], cl
inc rsi
inc edi
and edi, 7
test r14d, r14d
jne 0x14009dd1a
mov r13, qword [rbp - 0x20]
test r12d, r12d
je 0x14009ddd4
mov eax, r9d
mov byte [rbx], r10b
shr eax, 8
mov byte [rbx + 1], al
mov eax, r9d
shr eax, 0x10
mov byte [rbx + 2], al
mov eax, edx
shr eax, 8
mov byte [rbx + 5], al
mov eax, edx
shr eax, 0x10
shr r9d, 0x18
shr edx, 0x18
mov byte [rbx + 7], dl
mov byte [rbx + 3], r9b
mov byte [rbx + 4], r8b
mov byte [rbx + 6], al
mov dword [r13], edi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14024c6d0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400a3230
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0xa8
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x120]
lea r15, [0x1402786d0]
mov r13, qword [rsp + 0x128]
lea edi, [rdx - 1]
mov r10, qword [rsp + 0x110]
test rax, rax
mov ebx, r9d
mov qword [rsp + 0x40], r8
cmovne r15, rax
mov dword [rsp + 0x30], ebx
test r13, r13
mov qword [rsp + 0x38], r10
mov r12, rcx
cmove r13, r15
test r15, r15
jne 0x1400a32d0
mov edx, QueryPathOfRegTypeLib
mov dword [rsp + 0x20], 0x139
lea r9, str.opensourceopensslcryptoevpevp_lib.c
lea ecx, [r15 + 6]
lea r8d, [rdx - 3]
call fcn.14008b944
mov r10, qword [rsp + 0x38]
or esi, 0xffffffff
jmp 0x1400a32d4
mov esi, dword [r15 + 8]
lea ecx, [rsi + rsi]
mov ebp, edi
sub ebp, ecx
lea eax, [rbp - 1]
cmp ebx, eax
jle 0x1400a330b
mov dword [rsp + 0x20], 0x3a
mov r8d, WSAStartup
lea r9, str.opensourceopensslcrypto_rsa_rsa_oaep.c
mov edx, QueryPathOfRegTypeLib
mov ecx, 4
call fcn.14008b944
jmp 0x1400a346d
lea eax, [rcx + 1]
cmp edi, eax
jge 0x1400a3322
mov dword [rsp + 0x20], 0x40
mov r8d, 0x78
jmp 0x1400a32f0
movsxd rdx, dword [rsp + 0x118]
lea rbx, [r12 + 1]
mov byte [r12], 0
xor r9d, r9d
movsxd r14, esi
mov rcx, r10
mov qword [rsp + 0x20], r15
lea rax, [r14 + r12]
lea r12, [rax + 1]
mov qword [rsp + 0x38], rax
mov r8, r12
call fcn.14008ca4c
test eax, eax
je 0x1400a346d
movsxd r15, dword [rsp + 0x30]
xor edx, edx
sub ebp, r15d
dec ebp
movsxd r8, ebp
mov rbp, qword [rsp + 0x38]
lea rcx, [rbp + 1]
add rcx, r14
call sub.VCRUNTIME140.dll_memset
mov rdx, qword [rsp + 0x40]
mov eax, edi
sub eax, r15d
movsxd rcx, edi
sub rcx, r15
mov r8d, r15d
sub rcx, r14
sub eax, esi
cdqe
inc rcx
add rcx, rbp
mov byte [rax + rbp], 1
call sub.VCRUNTIME140.dll_memcpy
mov edx, esi
mov rcx, rbx
call fcn.14009d0cc
test eax, eax
jle 0x1400a346d
sub edi, esi
lea rdx, str.opensourceopensslcrypto_rsa_rsa_oaep.c
mov ecx, edi
mov r8d, 0x55
call fcn.1400b140c
mov rbp, rax
test rax, rax
jne 0x1400a33e9
mov dword [rsp + 0x20], 0x57
lea r8d, [rax + 0x41]
jmp 0x1400a32f0
mov r9d, esi
mov qword [rsp + 0x20], r13
mov r8, rbx
mov edx, edi
mov rcx, rbp
call fcn.1400a389c
test eax, eax
js 0x1400a3465
movsxd rdx, edi
test edi, edi
jle 0x1400a3421
mov r9, rbp
mov rcx, r12
sub r9, r12
mov al, byte [r9 + rcx]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1400a3412
mov r9d, edi
mov qword [rsp + 0x20], r13
mov r8, r12
lea rcx, [rsp + 0x50]
mov edx, esi
call fcn.1400a389c
test eax, eax
js 0x1400a3465
test esi, esi
jle 0x1400a3456
lea rdx, [rsp + 0x50]
sub rdx, rbx
mov cl, byte [rdx + rbx]
xor byte [rbx], cl
inc rbx
sub r14, 1
jne 0x1400a3448
mov rcx, rbp
call fcn.1400b16a4
mov eax, 1
jmp 0x1400a346f
mov rcx, rbp
call fcn.1400b16a4
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14024c6d0
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400a40bc
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
mov eax, 0x30
call fcn.14024eae0
sub rsp, rax
mov r10, rcx
cmp dword [rsp + 0x60], r9d
jne 0x1400a4153
mov al, byte [r8]
sub al, 0x6a
cmp al, 1
ja 0x1400a4153
cmp byte [r8], 0x6b
lea rdx, [r8 + 1]
jne 0x1400a4127
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x1400a4107
mov cl, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x1400a4107
cmp cl, 0xbb
jne 0x1400a4117
inc eax
cmp eax, ebx
jl 0x1400a40f2
sub ebx, eax
test eax, eax
jne 0x1400a412b
mov dword [rsp + 0x20], 0x85
jmp 0x1400a411f
mov dword [rsp + 0x20], 0x7d
mov r8d, 0x8a
jmp 0x1400a4161
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x1400a4144
mov dword [rsp + 0x20], 0x8d
mov r8d, 0x8b
jmp 0x1400a4161
mov r8d, ebx
mov rcx, r10
call sub.VCRUNTIME140.dll_memcpy
mov eax, ebx
jmp 0x1400a4178
mov dword [rsp + 0x20], WSACleanup
mov r8d, 0x89
mov edx, 0x80
lea r9, str.opensourceopensslcrypto_rsa_rsa_x931.c
lea ecx, [rdx - 0x7c]
call fcn.14008b944
or eax, 0xffffffff
add rsp, 0x30
pop rbx
ret
Function at 0x1400ac704
Capabilities:
Hash data using sha1

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x90
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rsp + 0x80], rax
test r8, r8
lea rsi, [0x140378e88]
mov rdi, rdx
mov rbx, rcx
cmovne rsi, r8
lea rcx, [rsp + 0x20]
xor edx, edx
lea r8d, [rdx + 0x60]
call sub.VCRUNTIME140.dll_memset
mov r8, rdi
mov dword [rsp + 0x20], 0x67452301
mov rdx, rbx
mov dword [rsp + 0x24], 0xefcdab89
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 0x98badcfe
mov dword [rsp + 0x2c], 0x10325476
mov dword [rsp + 0x30], 0xc3d2e1f0
call fcn.1400ab068
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400ab180
mov rax, qword [sub.VCRUNTIME140.dll_memset]
lea rcx, [rsp + 0x20]
xor edx, edx
lea r8d, [rdx + 0x60]
call qword [case.0x14004a846.0]
mov rax, rsi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14024c6d0
add rsp, 0x90
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400b3430
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0xa60
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rsp + 0xa50], rax
mov rbx, rcx
xor esi, esi
lea rcx, [rsp + 0x50]
mov word [rsp + 0x250], si
xor edx, edx
mov r8d, 0x200
call sub.VCRUNTIME140.dll_memset
or r9, 0xffffffffffffffff
lea rcx, [rsp + 0x250]
mov r8, rbx
mov edx, 0x400
mov edi, esi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
mov ebx, esi
lea ebp, [rsi + 0x5c]
mov edx, ebp
lea rcx, [rsp + 0x250]
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
test rax, rax
je 0x1400b34c1
inc edi
mov qword [rsp + rbx*8 + 0x50], rax
inc rbx
mov word [rax], si
cmp rbx, 0x40
jge 0x1400b34eb
test rax, rax
je 0x1400b34eb
lea r8, [rsp + 0x20]
xor edx, edx
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
je 0x1400b349f
cmp dword [rsp + 0x20], esi
jl 0x1400b349f
cmp edi, 0x40
jl 0x1400b353a
xor eax, eax
mov rcx, qword [rsp + 0xa50]
xor rcx, rsp
call fcn.14024c6d0
lea r11, [rsp + 0xa60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov rax, qword [rsp + rbx*8 + 0x48]
lea rcx, [rsp + 0x250]
dec rbx
xor edx, edx
mov word [rax], bp
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400b3542
cmp rbx, 1
jg 0x1400b351b
jmp 0x1400b354f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1400b34f0
mov eax, 1
jmp 0x1400b34f2
Function at 0x1400b4d38
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x30
call fcn.14024eae0
sub rsp, rax
mov rsi, rdx
mov rdi, rcx
lea rdx, [rcx + 0x50]
lea rcx, [rsp + 0x20]
call fcn.1400b5034
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [r9 + rsi]
movabs rcx, 0x100000001b3
xor r8, rax
inc r9
imul r8, rcx
cmp r9, 8
jb 0x1400b4d71
mov rcx, qword [rdi + 0x30]
mov rdx, qword [rdi + 0x18]
and rcx, r8
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
cmp rax, qword [rdi + 8]
je 0x1400b4dc3
mov r8, qword [rdx + rcx*8]
mov rcx, qword [rsi]
jmp 0x1400b4dbb
cmp rax, r8
je 0x1400b4dc3
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1400b4db2
jmp 0x1400b4dc5
xor eax, eax
test rax, rax
cmove rax, qword [rdi + 8]
cmp rax, qword [rdi + 8]
je 0x1400b4e1f
mov rbx, qword [rax + 0x18]
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [rdi + 0x48]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x1400b4e0b
and qword [rbx + 0x18], 0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14004a846.0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rdx, rsi
mov rcx, rdi
call fcn.1400b50a0
lea rcx, [rsp + 0x20]
call fcn.1400b4fc0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b4e3c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x40
call fcn.14024eae0
sub rsp, rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
lea rdx, [rcx + 0x50]
lea rcx, [rsp + 0x28]
call fcn.1400b5034
movabs r10, 0xcbf29ce484222325
mov rdx, r10
xor r9d, r9d
movabs rbp, 0x100000001b3
movzx eax, byte [r9 + rbx]
xor rdx, rax
imul rdx, rbp
inc r9
cmp r9, 8
jb 0x1400b4e8a
mov r8, qword [rsi + 0x30]
mov rcx, r8
and rcx, rdx
mov rdx, qword [rsi + 0x18]
add rcx, rcx
mov rax, qword [rdx + rcx*8 + 8]
mov r11, qword [rsi + 8]
cmp rax, r11
je 0x1400b4ed8
mov r9, qword [rdx + rcx*8]
mov rcx, qword [rbx]
jmp 0x1400b4ed0
cmp rax, r9
je 0x1400b4ed8
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1400b4ec7
jmp 0x1400b4eda
xor eax, eax
test rax, rax
cmove rax, r11
cmp rax, r11
jne 0x1400b4eef
mov byte [rdi + 8], 0
jmp 0x1400b4f9a
xor ecx, ecx
movzx eax, byte [rcx + rbx]
xor r10, rax
imul r10, rbp
inc rcx
cmp rcx, 8
jb 0x1400b4ef1
and r8, r10
add r8, r8
mov r9, qword [rdx + r8*8 + 8]
cmp r9, r11
je 0x1400b4f2f
mov rcx, qword [rdx + r8*8]
mov rax, qword [rbx]
jmp 0x1400b4f27
cmp r9, rcx
je 0x1400b4f2f
mov r9, qword [r9 + 8]
cmp rax, qword [r9 + 0x10]
jne 0x1400b4f1e
jmp 0x1400b4f32
xor r9d, r9d
test r9, r9
cmove r9, r11
mov rax, qword [rsi + 0x40]
mov r11, qword [rax]
mov r10, qword [r9 + 0x18]
cmp r10, r11
je 0x1400b4f77
mov rax, qword [r10]
cmp r10, rax
je 0x1400b4f77
cmp r11, rax
je 0x1400b4f77
mov r8, qword [r10 + 8]
mov qword [r8], rax
mov rdx, qword [rax + 8]
mov qword [rdx], r11
mov rcx, qword [r11 + 8]
mov qword [rcx], r10
mov qword [r11 + 8], rdx
mov qword [rax + 8], r8
mov qword [r10 + 8], rcx
mov rax, qword [r9 + 0x18]
mov rbx, qword [rax + 0x18]
test rbx, rbx
je 0x1400b4f93
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x14004a846.0]
mov qword [rdi], rbx
mov byte [rdi + 8], 1
lea rcx, [rsp + 0x28]
call fcn.1400b4fc0
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400b50a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
mov eax, 0x20
call fcn.14024eae0
sub rsp, rax
mov r10, rdx
lea ebx, [rax - 0x1f]
mov r11, rcx
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [r9 + rdx]
movabs rcx, 0x100000001b3
xor r8, rax
add r9, rbx
imul r8, rcx
cmp r9, 8
jb 0x1400b50c5
mov rdx, qword [r11 + 0x30]
mov rax, qword [r11 + 8]
and rdx, r8
mov r8, qword [r11 + 0x18]
add rdx, rdx
mov rcx, qword [r8 + rdx*8 + 8]
cmp rcx, rax
je 0x1400b5117
mov r9, qword [r10]
jmp 0x1400b510f
cmp rcx, qword [r8 + rdx*8]
je 0x1400b5117
mov rcx, qword [rcx + 8]
cmp r9, qword [rcx + 0x10]
jne 0x1400b5105
jmp 0x1400b5119
xor ecx, ecx
test rcx, rcx
je 0x1400b5167
cmp qword [r8 + rdx*8 + 8], rcx
jne 0x1400b513c
cmp qword [r8 + rdx*8], rcx
jne 0x1400b5131
mov qword [r8 + rdx*8], rax
jmp 0x1400b5135
mov rax, qword [rcx + 8]
mov qword [r8 + rdx*8 + 8], rax
jmp 0x1400b5149
cmp qword [r8 + rdx*8], rcx
jne 0x1400b5149
mov rax, qword [rcx]
mov qword [r8 + rdx*8], rax
mov rdx, qword [rcx]
dec qword [r11 + 0x10]
mov rax, qword [rcx + 8]
mov qword [rax], rdx
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400b5169
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400b5174
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
mov eax, 0x40
call fcn.14024eae0
sub rsp, rax
mov r15, r8
mov r14, rdx
mov rdi, rcx
lea rdx, [rcx + 0x50]
lea rcx, [rsp + 0x30]
call fcn.1400b5034
movabs rcx, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [r9 + r14]
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
inc r9
cmp r9, 8
jb 0x1400b51b9
mov rdx, qword [rdi + 0x30]
and rdx, rcx
add rdx, rdx
mov rcx, qword [rdi + 0x18]
mov rax, qword [rcx + rdx*8 + 8]
cmp rax, qword [rdi + 8]
je 0x1400b520b
mov r8, qword [rcx + rdx*8]
mov rcx, qword [r14]
jmp 0x1400b5203
cmp rax, r8
je 0x1400b520b
mov rax, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
jne 0x1400b51fa
jmp 0x1400b520d
xor eax, eax
test rax, rax
cmove rax, qword [rdi + 8]
cmp rax, qword [rdi + 8]
je 0x1400b5226
mov rdx, r14
mov rcx, rdi
call fcn.1400b4d38
lea rbx, [rdi + 0x40]
cmp qword [rdi + 0x10], 0x20
jb 0x1400b5285
mov rax, qword [rbx]
mov rdx, qword [rax + 8]
add rdx, 0x10
mov rcx, rdi
call fcn.1400b50a0
mov rax, qword [rbx]
mov rsi, qword [rax + 8]
mov rcx, qword [rsi]
dec qword [rbx + 8]
mov rax, qword [rsi + 8]
mov qword [rax], rcx
mov rax, qword [rsi + 8]
mov qword [rcx + 8], rax
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x1400b527c
and qword [rsi + 0x18], 0
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14004a846.0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [rbx]
mov rbp, qword [rax]
movabs rax, 0x7ffffffffffffff
cmp qword [rbx + 8], rax
jne 0x1400b52a9
lea rcx, str.list_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov qword [rsp + 0x20], rbx
and qword [rsp + 0x28], 0
mov ecx, 0x20
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
jne 0x1400b52ce
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xbad_alloc_void_]
int3
mov rax, qword [r14]
mov qword [rsi + 0x10], rax
mov rcx, qword [r15]
mov qword [rsi + 0x18], rcx
test rcx, rcx
je 0x1400b52ee
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [case.0x14004a846.0]
nop
inc qword [rbx + 8]
mov rax, qword [rbp + 8]
mov qword [rsi], rbp
mov qword [rsi + 8], rax
mov qword [rbp + 8], rsi
mov qword [rax], rsi
mov rax, qword [rbx]
mov rbx, qword [rax]
mov r8, r14
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400b5344
mov rcx, qword [rax]
mov qword [rcx + 0x18], rbx
lea rcx, [rsp + 0x30]
call fcn.1400b4fc0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret