joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f2c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x14000f2f0
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x14000f372
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x14000f33e
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x14000f346
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14000f2e5
mov qword [rsp + 8], 0xe3
jmp 0x14000f38a
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x14000f411
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x14000f3db
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x14000f3e3
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x14000f37d
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x14000f465
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x14000f46d
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret

Function at 0x140013214
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001325e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001325e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001325e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001325e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001325e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140013260
xor al, al
add rsp, 0x28
ret
Function at 0x140019000
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
jne 0x140019071
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x848
mov rax, qword [0x14002c3c8]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov r9, rdx
mov edx, 0x400
lea rax, [r11 + 0x18]
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.14001bb24
call fcn.14001a598
lea r8, [rsp + 0x30]
lea rcx, [rax + 0x60]
lea rdx, [0x140029d40]
call fcn.14001a174
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
ret

Function at 0x140019004
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
jne 0x140019071
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x848
mov rax, qword [0x14002c3c8]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov r9, rdx
mov edx, 0x400
lea rax, [r11 + 0x18]
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.14001bb24
call fcn.14001a598
lea r8, [rsp + 0x30]
lea rcx, [rax + 0x60]
lea rdx, [0x140029d40]
call fcn.14001a174
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
ret

Function at 0x140019074
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
jne 0x1400190e5
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x448
mov rax, qword [0x14002c3c8]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov r9, rdx
mov edx, 0x400
lea rax, [r11 + 0x18]
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.14001fb7c
call fcn.14001a598
lea r8, [rsp + 0x30]
lea rcx, [rax + 0x60]
lea rdx, str.Fatal_error_in_launcher:__s_n
call fcn.14001ad2c
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
ret

Function at 0x140019078
Capabilities:
Terminate process

Disassembly:
test ecx, ecx
jne 0x1400190e5
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
sub rsp, 0x448
mov rax, qword [0x14002c3c8]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov r9, rdx
mov edx, 0x400
lea rax, [r11 + 0x18]
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.14001fb7c
call fcn.14001a598
lea r8, [rsp + 0x30]
lea rcx, [rax + 0x60]
lea rdx, str.Fatal_error_in_launcher:__s_n
call fcn.14001ad2c
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
ret
Function at 0x140019150
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r13, rcx
lea r8, [0x140029da0]
lea rdx, [0x14002e4b0]
lea rcx, [rbp + 0x38]
xor r12d, r12d
mov qword [rbp + 0x38], r12
call fcn.14001a100
mov ecx, r12d
test eax, eax
lea rdx, str.Failed_to_open_executable
sete cl
call fcn.140019074
mov rcx, qword [rbp + 0x38]
lea r8d, [r12 + 2]
xor edx, edx
call fcn.14001bbf8
mov rcx, qword [rbp + 0x38]
call fcn.14001b3b8
mov rcx, qword [rbp + 0x38]
movsxd r14, eax
lea edi, [r14 - 0x104]
test edi, edi
cmovs edi, r12d
xor r8d, r8d
mov edx, edi
call fcn.14001bbf8
mov r9, qword [rbp + 0x38]
lea r15d, [r12 + 1]
mov esi, 0x104
mov edx, r15d
mov rcx, r13
mov r8d, esi
call fcn.14001ad0c
mov rcx, r13
mov rdx, rax
call fcn.1400190e8
mov rbx, rax
test rax, rax
je 0x140019229
lea rcx, [rbp - 0x20]
lea r8d, [r12 + 0x14]
mov rdx, rax
call fcn.140024440
movsxd rdi, edi
sub rdi, r13
add rdi, rbx
jmp 0x1400192b0
mov ebx, 0x4100000
mov ecx, ebx
call fcn.14001a4e0
mov rcx, qword [rbp + 0x38]
lea edi, [r14 - 0x4100000]
test edi, edi
mov rsi, rax
cmovs edi, r12d
xor r8d, r8d
mov edx, edi
call fcn.14001bbf8
mov r9, qword [rbp + 0x38]
mov r8d, ebx
mov rdx, r15
mov rcx, rsi
call fcn.14001ad0c
mov rcx, rsi
mov rdx, rax
call fcn.1400190e8
mov ecx, r12d
lea rdx, str.Unable_to_find_an_appended_archive.
test rax, rax
mov rbx, rax
setne cl
call fcn.140019074
lea rcx, [rbp - 0x20]
mov rdx, rbx
mov r8d, 0x14
call fcn.140024440
movsxd rdi, edi
mov rcx, rsi
sub rdi, rsi
add rdi, rbx
call fcn.14001a208
mov esi, 0x104
mov eax, dword [rbp - 0x10]
mov rcx, qword [rbp + 0x38]
xor r8d, r8d
add eax, dword [rbp - 0x14]
sub rdi, rax
mov edx, edi
call fcn.14001bbf8
mov r9, qword [rbp + 0x38]
mov r8, rsi
mov rdx, r15
mov rcx, r13
call fcn.14001ad0c
mov ecx, r12d
lea rdx, str.Unable_to_read_from_file
test rax, rax
setne cl
call fcn.140019074
movzx eax, word [r13]
cmp ax, word [0x140029e0c]
jne 0x140019301
mov r12, r13
jmp 0x140019367
mov rcx, qword [rbp + 0x38]
lea edx, [rdi - 0x104]
test edx, edx
cmovs edx, r12d
xor r8d, r8d
call fcn.14001bbf8
mov r9, qword [rbp + 0x38]
mov r8, rsi
mov rdx, r15
mov rcx, r13
call fcn.14001ad0c
mov ecx, r12d
lea rdx, str.Unable_to_read_from_file
test rax, rax
mov rbx, rax
setne cl
call fcn.140019074
lea r11, [rbx + r13 - 1]
cmp r11, r13
jb 0x140019367
movzx eax, word [0x140029e0c]
cmp word [r11], ax
je 0x140019364
sub r11, r15
cmp r11, r13
jae 0x140019354
jmp 0x140019367
mov r12, r11
mov rcx, qword [rbp + 0x38]
call fcn.14001bf1c
lea r11, [rsp + 0x40]
mov rax, r12
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14001c337
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14002c3c8]
jne 0x14001a01a
rol rcx, 0x10
test cx, 0xffff
jne 0x14001a016
repz ret
ror rcx, 0x10
jmp 0x14001c290
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14002d490]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14002d588]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14001c315
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14002d490]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14001c337
mov rax, qword [rsp + 0x88]
mov qword [0x14002d588], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14002d528], rax
mov rax, qword [0x14002d588]
mov qword [0x14002d400], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14002d510], rax
mov dword [0x14002d3f0], 0xc0000409
mov dword [0x14002d3f4], 1
mov rax, qword [0x14002c3c8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14002c3d0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14002d488], eax
mov ecx, 1
call fcn.140021588
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140028350]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14002d488], 0
jne 0x14001c3be
mov ecx, 1
call fcn.140021588
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400253c8
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x14002c3c8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14001e4b8
xor ebx, ebx
cmp qword [0x14002e3d0], rbx
mov rdi, rax
jne 0x1400254db
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1400255b2
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400255b2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x14002e3d0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x14002e3d8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x14002e3e0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x14002e3f0], rax
test rax, rax
je 0x1400254d2
lea rdx, [0x140029c40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x14002e3e8], rax
jmp 0x1400254e2
mov rax, qword [0x14002e3e8]
jmp 0x1400254e9
mov rax, qword [0x14002e3e8]
mov r11, qword [0x14002e3f0]
cmp rax, rdi
je 0x140025550
cmp r11, rdi
je 0x140025550
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x14002e3f0]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140025550
test rax, rax
je 0x140025550
call rsi
test rax, rax
je 0x14002554a
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
Function at 0x180001990
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0xa0]
mov r8d, edx
mov dword [rbp - 0x64], r8d
mov rdx, rcx
mov qword [rbp - 0x70], rdx
xor ecx, ecx
mov qword [rbp - 0x78], rcx
mov r9d, 2
mov dword [rbp - 0x68], r9d
lea rcx, [rbp - 0x60]
call fcn.180077dc0
mov r8d, dword [rbp - 0x64]
mov rdx, qword [rbp - 0x70]
mov rcx, qword [rbp - 0x78]
mov r9d, dword [rbp - 0x68]
call sub.bcrypt.dll_BCryptGenRandom
mov ebx, eax
lea rcx, [rbp - 0x60]
call fcn.180077e10
test ebx, ebx
jne 0x180001a04
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp ebx, 0xc0000017
je 0x180001a2c
lea rcx, [0x18015d7f0]
call fcn.1800760e0
mov rbx, rax
mov rcx, rbx
call fcn.18000cad0
mov rcx, rbx
call fcn.180076660
int3
lea rcx, [0x18015dcf0]
call fcn.1800760e0
mov rbx, rax
mov rcx, rbx
call fcn.18000fc20
mov rcx, rbx
call fcn.180076660
int3

Function at 0x180001f00
Capabilities:
Inspect section memory permissions

Disassembly:
push rbp
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x50]
mov rbx, rcx
mov eax, dword [rbx + 0x38]
cmp eax, 0xffffffff
jne 0x180001fa7
mov dword [rsp + 0x20], 0x10
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x20]
mov rcx, rbx
mov r9d, 4
call fcn.18003a4a0
mov ecx, eax
test ecx, ecx
jne 0x180001fae
xor eax, eax
mov ecx, 0x40000000
test byte [rbp - 0x10], 0x30
cmove eax, ecx
mov ecx, eax
or ecx, 0x80000000
test byte [rbp - 0x10], 2
cmovne eax, ecx
mov ecx, eax
or ecx, 0x10000000
test dword [rbp - 0x10], 0x800
cmovne eax, ecx
mov ecx, eax
or ecx, 0x8000000
test byte [rbp - 0x10], 4
cmovne eax, ecx
mov ecx, eax
or ecx, 0x4000000
test dword [rbp - 0x10], 0x1000
cmovne eax, ecx
mov ecx, eax
or ecx, 0x20000000
test byte [rbp - 0x10], 8
cmovne eax, ecx
mov dword [rbx + 0x38], eax
add rsp, 0x48
pop rbx
pop rbp
ret
add rsp, 0x48
pop rbx
pop rbp
ret
call fcn.18003a440
mov ecx, eax
lea rdx, [0x180148738]
xor r8d, r8d
call fcn.18002e7c0
mov rcx, rax
call fcn.180076660
int3

Function at 0x180004870
Capabilities:
Query environment variable

Disassembly:
sub rsp, 0x28
test rcx, rcx
je 0x180004882
add rsp, 0x28
jmp fcn.180004c00
lea rcx, [0x180159ac8]
call fcn.18000b100
int3
Function at 0x180004c00
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x20]
xor eax, eax
mov qword [rbp + 0x58], rax
xorps xmm4, xmm4
movaps xmmword [rbp + 0x60], xmm4
movaps xmmword [rbp + 0x70], xmm4
mov qword [rbp + 0x80], rax
mov rax, qword [0x18013e140]
mov qword [rbp + 0x20], rax
mov rbx, rcx
test dword [rsp], esp
sub rsp, 0x100
lea rcx, [rsp + 0x20]
mov qword [rbp + 0x78], rcx
mov dword [rbp + 0x80], 0x80
xor ecx, ecx
mov dword [rbp + 0x70], ecx
mov rcx, qword gs:[0x58]
mov eax, dword [0x180147fbc]
mov edx, 0x10
add rdx, qword [rcx + rax*8]
mov rsi, qword [rdx]
test rsi, rsi
je 0x180004dd2
mov qword [rbp + 0x28], rsi
jmp 0x180004c9f
mov edx, ebx
mov rbx, qword [rbp + 0xd0]
sub edx, dword [rbp + 0x70]
lea rcx, [rbp + 0x68]
call fcn.180029d90
mov rdi, qword [rbp + 0x78]
mov r14d, dword [rbp + 0x80]
mov qword [rbp + 0x60], rdi
test rbx, rbx
je 0x180004cc0
mov qword [rbp + 0xd0], rbx
lea r15, [rbx + 0xc]
jmp 0x180004cca
xor r15d, r15d
mov qword [rbp + 0xd0], rbx
mov qword [rbp + 0x58], r15
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, r15
mov qword [rbp + 0x14], rcx
mov rdx, rdi
mov qword [rbp + 0xc], rdx
mov r8d, r14d
mov dword [rbp + 0x1c], r8d
lea rcx, [rbp + 0x30]
call fcn.180077dc0
mov rcx, qword [rbp + 0x14]
mov rdx, qword [rbp + 0xc]
mov r8d, dword [rbp + 0x1c]
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebx, eax
lea rcx, [rbp + 0x30]
call fcn.180077e10
call sub.KERNEL32.dll_GetLastError
xor edx, edx
mov qword [rbp + 0x58], rdx
mov qword [rbp + 0x60], rdx
mov rsi, qword [rbp + 0x28]
mov dword [rsi + 0x98], eax
mov edx, ebx
movsxd rcx, dword [rbp + 0x80]
cmp rdx, rcx
jle 0x180004d4e
cmp ebx, dword [rbp + 0x80]
ja 0x180004c8a
mov rbx, qword [rbp + 0xd0]
jmp 0x180004c9f
test ebx, ebx
jne 0x180004d5e
cmp dword [rsi + 0x98], 0xcb
je 0x180004d6c
mov dword [rbp + 0x70], ebx
lea rcx, [rbp + 0x68]
call fcn.180029b50
jmp 0x180004da8
mov rbx, qword [rbp + 0x68]
xorps xmm0, xmm0
movups xmmword [rbp + 0x68], xmm0
movups xmmword [rbp + 0x78], xmm0
test rbx, rbx
je 0x180004da6
lea rcx, [0x18015b3f8]
cmp qword [rcx - 8], 0
jne 0x180004de6
mov rcx, qword [0x18013d4e8]
mov rcx, qword [rcx + 8]
mov rdx, rbx
xor r8d, r8d
cmp dword [rcx], ecx
call fcn.18005b6a0
xor eax, eax
lea rcx, [0x18013e140]
mov rcx, qword [rcx]
cmp qword [rbp + 0x20], rcx
je 0x180004dbd
call fcn.180075910
nop
lea rsp, [rbp + 0x88]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, rdx
lea rax, [0x180036050]
call rax
mov rsi, rax
jmp 0x180004c84
call fcn.1800734f5
jmp 0x180004d8e
Function at 0x180005a60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x20]
xorps xmm4, xmm4
movaps xmmword [rbp + 0x10], xmm4
xor eax, eax
mov qword [rbp + 0x20], rax
mov rax, qword [0x18013e140]
mov qword [rbp + 8], rax
mov esi, ecx
mov ebx, edx
mov rdi, r8
mov r14d, dword [rdi + 8]
xor r15d, r15d
cmp r14d, 0x100
jb 0x180005ae6
lea rcx, [0x18015b3f8]
cmp qword [rcx - 8], 0
jne 0x180005bdd
mov rcx, qword [0x18013d4e8]
mov rcx, qword [rcx + 8]
lea edx, [r14 + 1]
cmp dword [rcx], ecx
call fcn.18005b440
mov r15, rax
test r15, r15
jne 0x180005adc
xor r13d, r13d
xor r12d, r12d
jmp 0x180005ae4
lea r13, [r15 + 0x10]
mov r12d, dword [r15 + 8]
jmp 0x180005afb
test dword [rsp], esp
sub rsp, 0x200
lea r13, [rsp + 0x20]
mov r12d, pe_nt_image_headers64
mov qword [rbp + 0x10], r13
mov dword [rbp + 0x18], r12d
lea rdx, [rbp + 0x10]
mov rcx, rdi
call fcn.180015800
cmp r14d, r12d
jae 0x180005bee
mov ecx, r14d
mov word [r13 + rcx*2], 0
xor ecx, ecx
test r12d, r12d
cmovne rcx, r13
mov qword [rbp + 0x20], rcx
cmp r14d, 2
jle 0x180005b67
add r14d, 0xfffffffc
mov edx, esi
rol edx, 5
add esi, edx
mov edx, dword [rcx]
or edx, 0x200020
xor esi, edx
mov edx, ebx
rol edx, 5
add ebx, edx
mov edx, dword [rcx + 4]
or edx, 0x200020
xor ebx, edx
add rcx, 8
cmp r14d, 2
jg 0x180005b36
test r14d, r14d
jle 0x180005b7d
mov edx, ebx
rol edx, 5
add edx, ebx
mov ebx, dword [rcx]
or ebx, 0x200020
xor ebx, edx
xor ecx, ecx
mov qword [rbp + 0x20], rcx
test r15, r15
je 0x180005bae
lea rcx, [0x18015b3f8]
cmp qword [rcx - 8], 0
jne 0x180005be7
mov rcx, qword [0x18013d4e8]
mov rcx, qword [rcx + 8]
mov rdx, r15
xor r8d, r8d
cmp dword [rcx], ecx
call fcn.18005b6a0
imul eax, ebx, 0x5d588b65
add eax, esi
lea rcx, [0x18013e140]
mov rcx, qword [rcx]
cmp qword [rbp + 8], rcx
je 0x180005bcb
call fcn.180075910
nop
lea rsp, [rbp + 0x28]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.1800734f5
jmp 0x180005ab6
call fcn.1800734f5
jmp 0x180005b96
call fcn.180011a40
int3
Function at 0x18000c500
Capabilities:
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rbx, rcx
mov esi, dword [rbx + 0x1c]
mov edi, esi
and edi, 3
cmp esi, 4
jae 0x18000c534
lea rbp, [0x18015b198]
cmp qword [rbp - 8], 0
jne 0x18000c5c1
mov eax, dword [rbp]
add eax, 0x165667b1
jmp 0x18000c550
mov eax, dword [rbx]
rol eax, 1
mov ecx, dword [rbx + 4]
rol ecx, 7
add eax, ecx
mov ecx, dword [rbx + 8]
rol ecx, 0xc
add eax, ecx
mov ecx, dword [rbx + 0xc]
rol ecx, 0x12
add eax, ecx
lea eax, [rax + rsi*4]
test edi, edi
je 0x18000c597
imul ecx, dword [rbx + 0x10], 0xc2b2ae3d
add eax, ecx
rol eax, 0x11
imul eax, eax, 0x27d4eb2f
cmp edi, 1
jbe 0x18000c597
imul ecx, dword [rbx + 0x14], 0xc2b2ae3d
add ecx, eax
rol ecx, 0x11
imul eax, ecx, 0x27d4eb2f
cmp edi, 2
jbe 0x18000c597
imul ecx, dword [rbx + 0x18], 0xc2b2ae3d
add ecx, eax
rol ecx, 0x11
imul eax, ecx, 0x27d4eb2f
mov ecx, eax
shr ecx, 0xf
xor ecx, eax
imul eax, ecx, 0x85ebca77
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul eax, ecx, 0xc2b2ae3d
mov ecx, eax
shr ecx, 0x10
xor eax, ecx
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret
call fcn.180072f65
jmp 0x18000c52a
Function at 0x18001d560
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r14
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm7
movsd xmm6, qword [0x1800ff2b0]
movaps xmm7, xmm6
call fcn.18001d7a0
call fcn.18001a210
test eax, eax
jl 0x18001d74b
lea rbx, [0x18015b348]
cmp qword [rbx - 8], 0
jne 0x18001d76c
movabs rdx, 0x431bde82d7b634db
mov rax, rdx
imul qword [rbx]
mov rcx, rdx
shr rcx, 0x3f
sar rdx, 0x12
lea rsi, [rdx + rcx + 1]
mov ebx, 0xa
mov edi, 8
add edi, edi
lea rcx, [rsp + 0x38]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rbp, qword [rsp + 0x38]
cmp dword [0x180141c50], 0
jne 0x18001d776
test edi, edi
jle 0x18001d5fc
mov r14d, edi
call fcn.18001a210
dec r14d
jne 0x18001d5f2
lea rcx, [rsp + 0x30]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rcx, qword [rsp + 0x30]
sub rcx, rbp
mov rbp, rcx
cmp dword [0x180141c50], 0
jne 0x18001d780
cmp rbp, rsi
jl 0x18001d5cd
xorps xmm0, xmm0
cvtsi2sd xmm0, rbp
xorps xmm1, xmm1
cvtsi2sd xmm1, edi
divsd xmm0, xmm1
ucomisd xmm7, xmm0
jp 0x18001d63e
je 0x18001d64c
ucomisd xmm7, xmm7
jp 0x18001d656
ucomisd xmm0, xmm7
ja 0x18001d656
jmp 0x18001d659
movq rcx, xmm7
test rcx, rcx
jge 0x18001d64a
movaps xmm0, xmm7
movaps xmm7, xmm0
mov ecx, edi
sar ecx, 0x1f
and ecx, 3
add ecx, edi
mov edi, ecx
sar edi, 2
add edi, edi
lea rcx, [rsp + 0x28]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rbp, qword [rsp + 0x28]
cmp dword [0x180141c50], 0
jne 0x18001d78a
test edi, edi
jle 0x18001d69a
mov r14d, edi
call fcn.18001d7a0
dec r14d
jne 0x18001d690
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_QueryPerformanceCounter
mov rax, qword [rsp + 0x20]
sub rax, rbp
mov rbp, rax
cmp dword [0x180141c50], 0
jne 0x18001d794
cmp rbp, rsi
jl 0x18001d66b
xorps xmm0, xmm0
cvtsi2sd xmm0, rbp
xorps xmm1, xmm1
cvtsi2sd xmm1, edi
divsd xmm0, xmm1
ucomisd xmm6, xmm0
jp 0x18001d6dc
je 0x18001d6ea
ucomisd xmm6, xmm6
jp 0x18001d6f4
ucomisd xmm0, xmm6
ja 0x18001d6f4
jmp 0x18001d6f7
movq rax, xmm6
test rax, rax
jge 0x18001d6e8
movaps xmm0, xmm6
movaps xmm6, xmm0
dec ebx
jne 0x18001d5c8
movaps xmm0, xmm7
mulsd xmm0, qword [0x1800ff2b8]
divsd xmm0, xmm6
call fcn.180076db0
mov ecx, 0x1388
cmp eax, 0x1388
cmovg eax, ecx
mov dword [0x18013e2d0], eax
cmp dword [0x18013e2d0], 5
setle al
movzx eax, al
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x60
pop rbx
pop rbp
pop rsi
pop rdi
pop r14
ret
mov dword [0x18013e2d0], 0xffff
xor eax, eax
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
add rsp, 0x60
pop rbx
pop rbp
pop rsi
pop rdi
pop r14
ret
call fcn.1800730de
jmp 0x18001d5a3
call fcn.180076f10
jmp 0x18001d5eb
call fcn.180076f10
jmp 0x18001d61e
call fcn.180076f10
jmp 0x18001d689
call fcn.180076f10
jmp 0x18001d6bc