joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
xor rdx, rdx
push rcx
push rsi
mov rdx, qword gs:[rdx + 0x60]
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
xor r9, r9
movzx rcx, word [rdx + 0x4a]
mov rsi, qword [rdx + 0x50]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov r8d, dword [rax + 0x20]
push rax
mov ecx, dword [rax + 0x18]
add r8, rdx
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
add rax, rdx
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021
Function at 0x140003120
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
mov rdi, r9
mov r11, r8
mov r10, rdx
mov rsi, rcx
movzx r9d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
movzx eax, byte [r8 + 1]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 2]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 3]
xor r9, rax
imul r9, rcx
mov r8, qword [rsi + 0x30]
and r8, r9
mov rbx, qword [rsi + 8]
add r8, r8
mov rcx, qword [rsi + 0x18]
mov rax, qword [rcx + r8*8]
cmp rbx, rax
je 0x14000320b
mov rbx, qword [rcx + r8*8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x14000320b
mov ecx, dword [r11]
nop dword [rax]
mov rbx, qword [rbx + 8]
cmp ecx, dword [rbx + 0x10]
je 0x1400031d0
cmp rbx, rax
jne 0x1400031c0
jmp 0x14000320b
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [rsi + 0x10]
lea rcx, [rdi + 0x10]
call fcn.140001460
mov rcx, rdi
call fcn.14000b84c
mov rax, qword [rsp + 0x68]
mov qword [rax], rbx
mov byte [rax + 8], 0
jmp 0x140003342
mov qword [rsp + 0x28], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x140003245
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [rsi + 8]
jne 0x140003262
mov qword [rdx + r8*8], rdi
mov rax, qword [rsi + 0x18]
mov qword [rax + r8*8 + 8], rdi
jmp 0x140003291
cmp rax, rbx
jne 0x14000326d
mov qword [rdx + r8*8], rdi
jmp 0x140003291
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rdi
je 0x140003291
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [rsi + 0x10]
mov rdx, qword [rsi + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x14005ecfc]
test rax, rax
jns 0x1400032b2
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x1400032c3
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [rsi]
jbe 0x140003337
cmp rdx, 0x200
jae 0x1400032df
lea rdx, [rdx*8]
jmp 0x1400032f1
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x1400032f1
add rdx, rdx
mov rcx, rsi
call fcn.140002290
mov rax, qword [rsi + 8]
cmp qword [rax], rax
je 0x140003332
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
nop dword [rax + rax]
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
lea r8, [rbx + 0x10]
mov r9, rbx
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.140003120
cmp rbx, qword [rsp + 0x20]
jne 0x140003310
mov r10, qword [rsp + 0x68]
mov qword [r10], rdi
mov byte [r10 + 8], 1
mov rax, r10
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140003480
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov r9, rcx
movzx r8d, byte [r8 + 0x10]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov rsi, rdx
xor r8, rax
movzx eax, byte [rdi + 0x11]
mov rdx, qword [r9 + 0x30]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdi + 0x12]
imul r8, rcx
xor r8, rax
movzx eax, byte [rdi + 0x13]
imul r8, rcx
xor r8, rax
imul r8, rcx
mov rcx, qword [r9 + 0x18]
and rdx, r8
shl rdx, 4
add rcx, rdx
cmp qword [rcx + 8], rdi
jne 0x140003516
cmp qword [rcx], rdi
jne 0x14000350c
mov rax, qword [r9 + 8]
mov qword [rcx], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x140003521
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x140003521
cmp qword [rcx], rdi
jne 0x140003521
mov rax, qword [rdi]
mov qword [rcx], rax
mov rax, qword [rdi + 8]
lea rcx, [rdi + 0x10]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r9 + 0x10]
call fcn.140001460
mov rcx, rdi
call fcn.14000b84c
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140004c10
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x2d8]
sub rsp, 0x3c0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14006b1e0]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov rdi, rcx
movdqa xmm0, xmmword [0x14005ed00]
movdqu xmmword [rbp + 0x90], xmm0
xor esi, esi
mov word [rbp + 0x80], si
mov word [rbp + 0xa0], si
mov r8d, 0x104
lea rdx, [rbp + 0xa0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140004c9c
lea edx, [rsi + 0x5c]
lea rcx, [rbp + 0xa0]
call fcn.14002afe4
test rax, rax
je 0x140004ca3
mov word [rax], si
jmp 0x140004ca3
mov word [rbp + 0xa0], si
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x58], 7
mov word [rbp + 0x40], si
lea rax, [rbp + 0xa0]
or rdx, 0xffffffffffffffff
nop
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140004cc0
lea rcx, [rbp + 0x40]
cmp rdx, 7
ja 0x140004cf2
mov qword [rbp + 0x50], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
lea rdx, [rbp + 0xa0]
call fcn.14002a930
mov word [rbp + rbx + 0x40], si
jmp 0x140004cff
lea r9, [rbp + 0xa0]
call fcn.1400029f0
nop
movabs r14, 0x7fffffffffffffff
cmp qword [rbp + 0x50], 0
je 0x140004e01
mov edx, 3
lea r8d, [rdx - 2]
lea rcx, [rsp + 0x40]
call fcn.140006590
nop
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 8
cmovae rdx, qword [rbp + 0x40]
mov r8, qword [rbp + 0x50]
lea rcx, [rsp + 0x50]
call fcn.1400084a0
lea rdx, [0x14005de08]
mov rcx, rax
call fcn.140007c00
mov rcx, rax
lea rdx, str.RadeonInstaller.exe
call fcn.140007c00
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x58]
call fcn.140007800
cmp qword [rdi + 0x18], 8
jb 0x140004d7a
mov rdi, qword [rdi]
lea r8, [rbp + 0x60]
cmp qword [rbp + 0x78], 8
cmovae r8, qword [rbp + 0x60]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rsi
mov r9, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rbx, rax
mov rcx, qword [rbp + 0x78]
cmp rcx, 8
jb 0x140004df5
inc rcx
mov rdx, qword [rbp + 0x60]
cmp rcx, r14
ja 0x140004def
add rcx, rcx
cmp rcx, 0x1000
jb 0x140004de5
test dl, 0x1f
jne 0x140004def
mov rax, qword [rdx - 8]
cmp rax, rdx
jae 0x140004def
sub rdx, rax
sub rdx, 8
cmp rdx, 0x1f
ja 0x140004def
mov rdx, rax
mov rcx, rdx
call fcn.14000b84c
jmp 0x140004df5
call fcn.140030cc0
nop
lea rcx, [rsp + 0x40]
call fcn.140004e80
jmp 0x140004e05
mov ebx, dword [rsp + 0x30]
mov rax, qword [rbp + 0x58]
cmp rax, 8
jb 0x140004e51
inc rax
mov rcx, qword [rbp + 0x40]
cmp rax, r14
ja 0x140004e4b
add rax, rax
cmp rax, 0x1000
jb 0x140004e44
test cl, 0x1f
jne 0x140004e4b
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x140004e4b
sub rcx, rax
sub rcx, 8
cmp rcx, 0x1f
ja 0x140004e4b
mov rcx, rax
call fcn.14000b84c
jmp 0x140004e51
call fcn.140030cc0
nop
mov eax, ebx
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.14000b460
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140008b00
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x188
mov rax, qword [0x14006b1e0]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r8d, 0x11c
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.14002b210
mov dword [rsp + 0x50], 0x114
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14002b210
lea rcx, [rsp + 0x50]
call fcn.140008ad0
cmp dword [rsp + 0x54], 0xa
jne 0x140008b6a
cmp dword [rsp + 0x58], 0
jb 0x140008b6a
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
jmp 0x140008b75
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [rsp + 0x20]
cmp eax, 9
je 0x140008b89
movzx eax, word [rsp + 0x20]
cmp eax, 6
jne 0x140008b8d
mov al, 1
jmp 0x140008b9e
call fcn.140008bc0
test eax, eax
je 0x140008b9c
mov al, 1
jmp 0x140008b9e
xor al, al
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14000b460
add rsp, 0x188
ret

Function at 0x14000dd64
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14000dd77
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14000e394
lea rdx, [0x140068bd0]
lea rcx, [rsp + 0x20]
call fcn.14002b500
int3

Function at 0x14001a020
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x14006e57c]
xor edx, edx
jmp fcn.14000dd64

Function at 0x14001a9e0
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x14006e57c]
jmp fcn.14000dd64

Function at 0x14002ba00
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, [0x140053180]
xor ecx, ecx
lea r8, [0x140053178]
lea rdx, str.FlsAlloc
call fcn.14002b828
mov rbx, rax
test rax, rax
je 0x14002ba40
mov rcx, rax
call fcn.14000c224
mov rcx, rdi
call rbx
jmp 0x14002ba46
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14002baa8
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x140053190]
mov ecx, 2
lea r8, [0x140053188]
lea rdx, str.FlsGetValue
call fcn.14002b828
mov rdi, rax
test rax, rax
je 0x14002bae9
mov rcx, rax
call fcn.14000c224
mov ecx, ebx
call rdi
jmp 0x14002baf1
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14002bafc
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x140053198]
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x140053190]
call fcn.14002b828
mov rsi, rax
test rax, rax
je 0x14002bb48
mov rcx, rax
call fcn.14000c224
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x14002bb53
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140005950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x140005ae4
mov r15, qword [rsp + 0x60]
lea r9d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x140005ae4
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r9w, dx
jae 0x1400059eb
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x140005b0b
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x140005a02
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x140005a02
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140005a15
movzx r8d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x140005a62
mov r8d, eax
cmp eax, 0x800
jae 0x140005a2f
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x140005a62
cmp eax, 0x10000
jae 0x140005a49
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x140005a62
shr r8d, 0x12
mov r10d, 3
movzx r11d, sil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r9d
cmp rdx, rcx
jl 0x140005ae4
add qword [r14], 2
test sil, sil
jne 0x140005a83
cmp r10d, 3
jae 0x140005a8f
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
test r9d, r9d
je 0x140005ac1
lea r8d, [r10 + r10*2]
add r8d, r8d
nop dword [rax + rax]
sub r8d, 6
mov edx, eax
mov ecx, r8d
dec r9d
shr edx, cl
mov rcx, qword [rbx]
and dl, 0x3f
or dl, 0x80
mov byte [rcx], dl
inc qword [rbx]
test r9d, r9d
jg 0x140005aa0
shr eax, 0xa
mov r9d, 1
test sil, sil
mov ecx, r9d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x14000599f
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x140005af2
Function at 0x14023a9cb
Capabilities:
Encode data using xor

Disassembly:
xor ecx, ecx
test rax, rax
mov qword [rsp], 0xffffffffdd1af1b9
lea rsp, [rsp + 0x10]
je 0x14023aa2d
lea r8, [0x14023cbf8]
mov r11d, 0x1d0a0db4
push r11
neg r11
movzx r11d, byte [rbp + r11*4 + 0x742836d0]
xor r11d, ecx
and r11d, 0xff
mov r11d, dword [r8 + r11*4]
neg dword [rsp + 1]
shr ecx, 8
xor ecx, r11d
inc rbp
xor ecx, 0x7035c380
dec rax
lea rsp, [rsp + 8]
jne 0x14023a9ea
call fcn.14023f2f3
Function at 0x1400110b9
Capabilities:
Hide graphical window

Disassembly:
jmp 0x140011a30
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x208
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x3a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x228]
mov rax, qword [0x14001d008]
xor rax, rbp
mov qword [rbp + 0x198], rax
lea rcx, [0x1400230f4]
call fcn.1400113b1
lea rax, str.Window_Class
mov qword [rbp + 8], rax
lea rax, [rbp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x48
rep stosb byte [rdi], al
mov rax, qword [rbp + 0x1c0]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x70], rax
lea rax, [0x1400110fa]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x60], 6
lea rcx, [rbp + 0x30]
call qword [sym.imp.USER32.dll_RegisterClassW]
mov qword [rsp + 0x58], 0
mov rax, qword [rbp + 0x1c0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x300
mov dword [rsp + 0x30], 0x556
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
mov r9d, 0xcf0000
lea r8, str.Window
mov rdx, qword [rbp + 8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov qword [0x14001d170], rax
mov edx, dword [rbp + 0x1d8]
mov rcx, qword [0x14001d170]
call qword [sym.imp.USER32.dll_ShowWindow]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x98]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jle 0x140011b82
lea rcx, [rbp + 0x98]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x98]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x140011b4d
lea rcx, [rbp - 0x60]
lea rdx, [0x14001ac40]
call fcn.140011343
mov rcx, qword [rbp + 0x198]
xor rcx, rbp
call fcn.1400111e5
lea rsp, [rbp + 0x1a8]
pop rdi
pop rbp
ret

Function at 0x140011230
Capabilities:
Terminate process

Disassembly:
jmp 0x140013060
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400112b7
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400143f0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014410
xor al, al
jmp 0x140014491
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014423
xor al, al
jmp 0x140014491
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001444d
xor al, al
jmp 0x140014491
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014461
xor al, al
jmp 0x140014491
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014473
xor al, al
jmp 0x140014491
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001448f
xor al, al
jmp 0x140014491
mov al, 1
add rsp, 0x38
ret
Function at 0x1400021f0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140002212
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14000228c
mov rdi, r14
mov rcx, rbx
call fcn.140003a80
test rax, rax
jle 0x140002264
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1400c1bc0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000227c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140002284
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140002226
sub r14, rdi
jmp 0x14000236f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400022a3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400022a5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400022d7
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400c1bc0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000236c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140002312
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000234d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1400c7770
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14000236c
cmp rbp, rax
ja 0x140002320
test rbp, rbp
je 0x14000236c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1400c7770
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140004d70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x140121218]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ebx, ebx
lea r9, [rsp + 0x20]
xor r8d, r8d
mov dword [rsp + 0x20], ebx
xor edx, edx
mov edi, ebx
call fcn.140004d50
cmp eax, 0xc0000004
jne 0x140004def
test rdi, rdi
je 0x140004dbd
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov rdi, rax
call fcn.140004d50
cmp eax, 0xc0000004
je 0x140004da7
test eax, eax
jns 0x140004e10
test rdi, rdi
je 0x140004e15
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x140004ec8
test rdi, rdi
jne 0x140004e1c
xor eax, eax
jmp 0x140004ec8
mov r10d, dword [rdi]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], r14
test r10d, r10d
je 0x140004ea6
lea r9, [rdi + 0x2e]
movabs rsi, 0x100000001b3
movabs rbp, 0xacff7963fae19fa3
movabs r14, 0xcbf29ce484222325
nop word [rax + rax]
movzx r8d, word [r9]
mov rdx, r14
add r8, 0x30
mov eax, ebx
imul r11, rax, 0x128
add r8, r11
add r8, rdi
nop word [rax + rax]
movsx rcx, byte [r8]
lea r8, [r8 + 1]
xor rdx, rcx
imul rdx, rsi
test cl, cl
jne 0x140004e80
cmp rdx, rbp
je 0x140004ee0
inc ebx
add r9, 0x128
cmp ebx, r10d
jb 0x140004e60
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400bf510
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [r11 + rdi + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, rbx
jmp 0x140004eb9