joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400669a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x140a195e0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x140a1906f], 0
je 0x1400669d6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x140a19940]
aesenc xmm0, xmmword [0x140a19950]
aesenc xmm0, xmmword [0x140a19960]
movq rax, xmm0
ret
jmp 0x14000a580

Function at 0x140310170
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1409b51a0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140310190
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140310198
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140310190
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x1403101e5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1403101dc
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140310190
add rax, 0x28
cmp rax, r9
jne 0x1403101c8
xor eax, eax
ret

Function at 0x1403101f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1409b51a0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140310210
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140310218
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x140310210
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x1403102a0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1409b51a0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1403102c0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1403102c8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x140007620
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1403e9f40]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1403ea5a0]
mov edi, edx
mov esi, ecx
cmp byte [rbx + 0x4a5d], 0
jne 0x140007688
cmp byte [rbx + 0x4a5e], 0
jne 0x140007688
movsx r9d, word [rbx + 0x5b5a]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.14000cd10
test sil, 1
je 0x1400077b9
jmp 0x140007721
movss xmm1, dword [rbx + 0x3898]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400e09b0]
xor eax, eax
mov edx, reloc.WS2_32.dll_recv
mulss xmm1, dword [0x1400e09a0]
addss xmm0, dword [rbx + 0xdfc]
addss xmm1, dword [rbx + 0xe00]
or dword [rbx + 0x47a8], 1
mov qword [rbx + 0x47c0], rax
movss dword [rbx + 0x47b8], xmm0
mov dword [rbx + 0x47ac], 1
movss dword [rbx + 0x47bc], xmm1
movss xmm0, dword [rbx + 0x3900]
mov rax, qword [0x1403ea5a0]
mulss xmm0, dword [0x1400e0950]
or dword [rax + 0x47a8], 0x40
movss dword [rax + 0x4808], xmm0
movsx r9d, word [rbx + 0x5b5a]
call fcn.14000cd10
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140007771
lea r11, [0x1400df210]
cmp r9b, 0x23
jne 0x140007754
cmp byte [r8], r9b
jne 0x140007754
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140007741
not ecx
call fcn.14000b830
test rax, rax
je 0x1400077b9
cmp byte [rax + 0xae], 0
je 0x1400077b9
mov byte [rax + 0xb5], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xd0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x5b5a]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x5b5a]
call fcn.14000cd10
or edi, 0x20c0347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.1400047f0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400d9060
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14000b780
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x1403ea5a0]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14000b7e3
mov qword [rsp], rbx
lea rbx, [0x1400df210]
nop dword [rax]
cmp r9b, 0x23
jne 0x14000b7c3
cmp byte [r8], r9b
jne 0x14000b7c3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14000b7b0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5bb8]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x14000b817
mov r10, qword [r10 + 0x5bc0]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14000b81e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x14000b804
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x14004dde0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1403e9f40]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14004deb3
cmp byte [rcx + 0x71], 0
je 0x14004deb3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14004deaf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004de74
sub eax, 1
je 0x14004de78
cmp eax, 2
jne 0x14004deaf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400d9060
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14004dea6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14004deaf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14004de5c
xor al, al
jmp 0x14004de5c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400d9060
add rsp, 0x60
pop rbx
ret
Function at 0x14004e0e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1403e9f40]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x14004e10d
xor eax, eax
jmp 0x14004e276
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x14004e14d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x14004e14d
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x14004e26e
cmp qword [rdi + 0x80], 0
je 0x14004e269
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x14004e187
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x14004e1b2
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14004e26e
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14004e221
sub eax, 1
je 0x14004e221
cmp eax, 2
jne 0x14004e269
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x14004e26e
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x14004e24f
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14004e269
lea rax, [rsp + 0x50]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x14004e26e
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400d9060
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14004ea20
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x14004ea42
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x14004ea51
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x28], rbx
mov rbx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x14004eaa2
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x14004eb11
mov rcx, rbp
call int.14004def0
cmp rbx, 0xfff
jbe 0x14004eaf1
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x14004eb2a
cmp rbx, rax
ja 0x14004eac0
test rdi, rdi
je 0x14004eb11
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x28]
mov rax, rsi
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rsi, rbx
jmp 0x14004eb14
invalid
Function at 0x14004eb30
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x14004eb51
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x14004ebcc
test rax, rax
jle 0x14004ebac
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x14004ebcc
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14004ebcc
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
idiv dword [rbx]
ret 0x3174
je 0x1401ed128

Function at 0x14004f770
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rdx + 0x3f], 0
mov rbx, rcx
je 0x14004f796
xor eax, eax
lea r8d, [rax + 0x76]
xor byte [rdx + rax], r8b
inc rax
cmp rax, 0x3e
jb 0x14004f781
mov byte [rdx + 0x3f], 0
call fcn.14004ec10
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400627a0
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x40
mov rcx, qword [0x1403eafd0]
xor ebx, ebx
mov eax, dword [0x1403eaf44]
mov dword [0x1403eaf40], eax
test rcx, rcx
jne 0x14006294a
mov rax, qword gs:[0x60]
mov r11d, 0xf4d8b55
mov qword [rsp + 0x60], rbp
mov ebp, ebx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x38], rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov r12, qword [rcx + 0x10]
mov rsi, r12
nop
movups xmm0, xmmword [rsi + 0x58]
movd eax, xmm0
sub ax, 8
test ebp, ebp
je 0x14006284c
psrldq xmm0, 8
mov edx, 0x811c9dc5
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x140062844
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x140062830
cmp edx, ebp
jne 0x140062913
mov r9, qword [rsi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rcx, qword [rax + r9 + 0x88]
mov r15, rcx
mov r10d, ecx
shr r15, 0x20
add r10, r9
cmp r10, r9
je 0x140062913
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x140062913
mov r14d, dword [r10 + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [r14 + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400628c7
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1400628b0
cmp edx, r11d
je 0x1400628d3
test r8d, r8d
jne 0x140062890
jmp 0x140062913
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov ecx, dword [rcx + rdx*4]
add rcx, r9
cmp rcx, r10
jbe 0x140062925
lea rax, [r15 + r10]
cmp rcx, rax
jae 0x140062925
mov ebp, 0x811c9dc5
mov rsi, r12
mov dword [rsp + 0x58], ebp
mov dword [rsp + 0x5c], ebp
mov r11, qword [rsp + 0x58]
shr r11, 0x20
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r12
jne 0x140062800
mov rcx, rbx
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov qword [0x1403eafd0], rcx
call rcx
mov ecx, dword [0x1403eaf40]
mov dword [0x1403eaf44], eax
test ecx, ecx
je 0x1400629ab
sub eax, ecx
cmp eax, 0x1770
jbe 0x1400629ab
mov dword [rsp + 0x50], 0x1c151e22
mov word [rsp + 0x54], 0x100
nop dword [rax]
nop dword [rax + rax]
lea eax, [rbx + 0x76]
xor byte [rsp + rbx + 0x50], al
inc rbx
cmp rbx, 4
jb 0x140062980
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x55], 0
call fcn.140069bc0
mov qword [0], 1
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x140062a30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140062a53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x76]
xor byte [rcx + rax], dl
inc rax
cmp rax, 4
jb 0x140062a40
mov byte [rcx + 5], 0
mov rax, rcx
ret
Function at 0x140069bc0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdi, rcx
mov dword [rsp + 0x20], 0x160a0513
xor edx, edx
mov dword [rsp + 0x24], 0x5d465b08
mov word [rsp + 0x28], 0x100
nop dword [rax]
lea eax, [rdx + 0x76]
xor byte [rsp + rdx + 0x20], al
inc rdx
cmp rdx, 8
jb 0x140069bf0
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x29], 0
mov rcx, rbx
call fcn.14004ec10
mov rdx, rdi
mov rcx, rbx
call fcn.14004ec10
lea rdx, [0x14004f0c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140069cb7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140069cb7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140069cb2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140069c90
cmp r8d, 0x2fa62ca8
je 0x140069cbc
test r9d, r9d
jne 0x140069c70
mov rax, qword [rax]
jmp 0x140069c40
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 0xbb8
add rax, r10
call rax
mov rbx, qword [rsp + 0x40]
mov qword [0], 1
add rsp, 0x30
pop rdi
ret
Function at 0x1400736e0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x88
mov rax, qword [0x1403e9f40]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r10, qword [0x1403eb008]
xor r11d, r11d
mov qword [rsp + 0x58], r11
test r10, r10
jne 0x1400738bd
mov rax, qword gs:[0x60]
mov r10d, 0xdf6a51c
mov qword [rsp + 0x98], rbp
mov ebp, r11d
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x90], rbx
mov r12, qword [rcx + 0x10]
mov rsi, r12
mov qword [rsp + 0x70], r15
nop dword [rax]
movups xmm0, xmmword [rsi + 0x58]
movd eax, xmm0
sub ax, 8
test ebp, ebp
je 0x1400737ac
psrldq xmm0, 8
mov edx, 0x811c9dc5
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x1400737a4
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x140073790
cmp edx, ebp
jne 0x140073872
mov r9, qword [rsi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rcx, qword [rax + r9 + 0x88]
mov r15, rcx
mov ebx, ecx
shr r15, 0x20
add rbx, r9
cmp rbx, r9
je 0x140073872
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140073872
mov r14d, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [r14 + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140073827
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140073810
cmp edx, r10d
je 0x140073833
test r8d, r8d
jne 0x1400737f0
jmp 0x140073872
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov r10d, dword [rcx + rdx*4]
add r10, r9
cmp r10, rbx
jbe 0x140073884
lea rax, [rbx + r15]
cmp r10, rax
jae 0x140073884
mov ebp, 0x811c9dc5
mov rsi, r12
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], ebp
mov r10, qword [rsp + 0x50]
shr r10, 0x20
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r12
jne 0x140073760
mov r10, r11
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
mov rdi, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov qword [0x1403eb008], r10
movdqa xmm0, xmmword [str._6_:.8__]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0xdfd4d3c2
mov dword [rsp + 0x44], 0xd2d4c4c8
mov word [rsp + 0x48], Ordinal_211
mov byte [rsp + 0x4a], 1
nop word [rax + rax]
lea eax, [r11 + 0x76]
xor byte [rsp + r11 + 0x30], al
inc r11
cmp r11, 0x19
jb 0x1400738f0
lea rax, [rsp + 0x58]
mov byte [rsp + 0x4a], 0
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, 0xffffffff80000002
call r10
test eax, eax
jne 0x140073939
mov qword [0], 1
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400d9060
add rsp, 0x88
ret