joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140030630
Capabilities:
Get memory capacity

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
mov rax, qword [0x14012a050]
xor rax, rsp
mov qword [rsp + 0xa0], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x78], rax
lea rsi, [rsp + 0x78]
mov ecx, 9
mov rdx, rsi
mov r8d, 8
call fcn.140030100
call qword [sym.imp.USER32.dll_GetCapture]
mov qword [rsp + 0x78], rax
mov ecx, 0xa
mov rdx, rsi
mov r8d, 8
call fcn.140030100
call qword [sym.imp.USER32.dll_GetClipboardOwner]
mov qword [rsp + 0x78], rax
mov ecx, 0xb
mov rdx, rsi
mov r8d, 8
call fcn.140030100
mov ecx, 0x1cbf
call qword [sym.imp.USER32.dll_GetQueueStatus]
mov dword [rsp + 0x74], eax
lea rdx, [rsp + 0x74]
mov ecx, 0xc
mov r8d, 4
call fcn.140030100
lea rsi, [rsp + 0x68]
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, 0xd
mov rdx, rsi
mov r8d, 8
call fcn.140030100
lea rsi, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, 6
mov rdx, rsi
mov r8d, 0x38
call fcn.140030100
lea rsi, [rsp + 0x98]
lea r14, [rsp + 0x90]
lea rdi, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov qword [rsp + 0x20], rsi
lea rbx, [rsp + 0x80]
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov ecx, 0xe
mov rdx, rbx
mov r8d, 0x20
call fcn.140030100
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x20], rsi
mov rcx, rax
mov rdx, rbx
mov r8, rdi
mov r9, r14
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov ecx, 0xf
mov rdx, rbx
mov r8d, 0x20
call fcn.140030100
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400ba340
nop
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140036f60
Capabilities:
Get session user name

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov edx, 0x3a
call fcn.1400414f0
cmp byte [rax], 0
je 0x140036f84
mov rcx, rax
add rsp, 0x20
pop rsi
jmp fcn.14004a3a0
mov rcx, rsi
mov edx, 0x3b
call fcn.1400412a0
test al, al
je 0x140036f9f
add rsp, 0x20
pop rsi
jmp fcn.14007a3e0
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x140038fd0
Capabilities:
Set registry value

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov ebp, dword [rsp + 0x70]
mov rcx, r8
mov edx, r9d
call fcn.140041360
cmp eax, 1
je 0x14003903c
cmp eax, 2
je 0x140039045
cmp eax, 3
jne 0x14003904e
mov rcx, rbx
mov edx, ebp
call fcn.1400414f0
lea rcx, str.custom:
mov rdx, rax
xor r8d, r8d
call fcn.140042610
mov rbx, rax
mov rcx, rdi
mov rdx, rsi
mov r8, rax
call fcn.14003cc20
mov rcx, rbx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.140043590
lea r8, str.implicit
jmp 0x140039055
lea r8, str.explicit
jmp 0x140039055
lea r8, str.none
mov rcx, rdi
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
jmp fcn.14003cc20

Function at 0x14003cc20
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x14003cc2d
mov rcx, qword [rcx]
jmp fcn.140046840
ret

Function at 0x14003cc30
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x14003cc3d
mov rcx, qword [rcx]
jmp fcn.1400466f0
ret
Function at 0x14003ccf0
Capabilities:
Query or enumerate registry value

Disassembly:
test rcx, rcx
je 0x14003ccfd
mov rcx, qword [rcx]
jmp fcn.140046750
xor eax, eax
ret

Function at 0x14003cfd0
Capabilities:
Set registry value

Disassembly:
test rcx, rcx
je 0x14003cfe0
mov r8, qword [r8]
mov rcx, qword [rcx]
jmp fcn.140046840
ret

Function at 0x14003d020
Capabilities:
Delete registry key

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14012a050]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp dword [0x14012de30], 6
jb 0x14002b052
jne 0x14002b007
cmp dword [0x14012de34], 0
je 0x14002b052
call fcn.14003e010
test eax, eax
je 0x14002b065
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400ef000]
lea r9, [0x1400eeff0]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x14002b052
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400ba340
nop
add rsp, 0x38
ret
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400ba340
nop
add rsp, 0x38
jmp 0x14002ab90
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x20], 0
lea r9, str.SoftwareSimonTathamPuTTYSessions
xor ecx, ecx
mov dl, 1
mov r8, 0xffffffff80000001
call fcn.140046460
test rax, rax
je 0x14003d08f
mov rdi, rax
call fcn.140043bc0
mov rbx, rax
mov rcx, rsi
mov rdx, rax
call fcn.14007a5e0
mov rdx, qword [rbx]
mov rcx, rdi
call sub.ADVAPI32.dll_RegDeleteKeyA
mov rcx, rbx
call fcn.140043cc0
mov rcx, rdi
call sub.ADVAPI32.dll_RegCloseKey
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp 0x14002afe0
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x14003d920
Capabilities:
Delete registry key

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov qword [rsp + 0x20], 0
lea r9, str.SoftwareSimonTathamPuTTYSshHostCAs
xor ecx, ecx
mov dl, 1
mov r8, 0xffffffff80000001
call fcn.140046460
test rax, rax
je 0x14003d978
mov rdi, rax
call fcn.140043bc0
mov rbx, rax
mov rcx, rsi
mov rdx, rax
call fcn.14007a5e0
mov rdx, qword [rbx]
mov rcx, rdi
call sub.ADVAPI32.dll_RegDeleteKeyA
mov rcx, rbx
call fcn.140043cc0
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x14003e210
Capabilities:
Check if file exists
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rsi, r8
mov rdi, rcx
test edx, edx
je 0x14003e26f
xor eax, eax
xor ecx, ecx
cmp edx, 2
setne al
sete cl
lea r8d, [rax + rax*2]
mov eax, 0x40000000
mov edx, 0x80000000
cmove edx, eax
mov eax, ecx
shl eax, 7
xor ecx, 3
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x30], 0
mov rcx, rdi
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsi], rax
cmp rax, 0xffffffffffffffff
setne al
jmp 0x14003e2af
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14003e2a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14003e2a6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140047ad0
lea rcx, str.Unable_to_delete__s:__s
mov rdx, rdi
mov r8, rax
call fcn.1400071e0
mov qword [rsi], 0xffffffffffffffff
xor eax, eax
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x1400465c0
Capabilities:
Query or enumerate registry key

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov ebp, edx
mov rbx, rcx
mov rax, qword [0x14012a050]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0x105
mov edi, 0x105
mov ecx, 0x105
mov edx, 1
xor r8d, r8d
call fcn.1400434f0
mov rsi, rax
mov r15, qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea r14, [rsp + 0x38]
nop
mov rcx, rbx
mov edx, ebp
mov r8, rsi
mov r9d, edi
call r15
cmp eax, 0xea
jne 0x140046653
mov r9, qword [rsp + 0x38]
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], 1
mov r8d, 1
mov rcx, rsi
mov rdx, r14
call fcn.1400435a0
mov rsi, rax
mov rdi, qword [rsp + 0x38]
jmp 0x140046610
test eax, eax
je 0x140046661
mov rcx, rsi
call fcn.140043590
xor esi, esi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400ba340
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140046680
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x14012a050]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x34]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rsp + 0x30]
xor ecx, 4
or ecx, eax
mov eax, dword [rsp + 0x34]
xor eax, 4
or eax, ecx
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ba340
mov eax, ebx
add rsp, 0x40
pop rbx
ret

Function at 0x1400466f0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x14012a050]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x34], r8d
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
sete bl
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400ba340
mov eax, ebx
add rsp, 0x40
pop rbx
ret
Function at 0x140079120
Capabilities:
Create thread

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r15d, r9d
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
mov rax, qword [0x14012a050]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ecx, 1
mov edx, 0x1050
xor r8d, r8d
call fcn.1400434f0
mov rsi, rax
mov dword [rax], 0
lea r14, [rax + 8]
mov qword [rax + 8], rbp
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsi + 0x20], rax
mov qword [rsi + 0x1048], rbx
mov byte [rsi + 0x2a], 0
mov word [rsi + 0x28], 0
mov qword [rsi + 0x30], rdi
mov dword [rsi + 0x38], r15d
cmp qword [0x14012a0a0], 0xffffffffffffffff
jne 0x1400791ec
lea rax, [0x14012df70]
mov qword [0x14012df70], rax
mov qword [0x14012df78], rax
lea rcx, [0x14012df80]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x14012a0a0], rax
lea rdx, [0x140079aa0]
mov rcx, rax
xor r8d, r8d
call fcn.14002cde0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x140079250]
xor ecx, ecx
xor edx, edx
mov r9, r14
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140079220
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsi + 0x2b], 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400ba340
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140079480
Capabilities:
Create thread

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r15d, r9d
mov rbx, r8
mov rdi, rdx
mov rbp, rcx
mov rax, qword [0x14012a050]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov ecx, 1
mov edx, 0x1050
xor r8d, r8d
call fcn.1400434f0
mov rsi, rax
mov dword [rax], 1
lea r14, [rax + 8]
mov qword [rax + 8], rbp
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rsi + 0x20], rax
mov dword [rsi + 0x28], 0
mov qword [rsi + 0x30], rbx
lea rcx, [rsi + 0x58]
call fcn.14004a3f0
mov dword [rsi + 0x80], 0
mov qword [rsi + 0x88], rdi
mov qword [rsi + 0x90], rsi
mov dword [rsi + 0x38], r15d
cmp qword [0x14012a0a0], 0xffffffffffffffff
jne 0x140079563
lea rax, [0x14012df70]
mov qword [0x14012df70], rax
mov qword [0x14012df78], rax
lea rcx, [0x14012df80]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [0x14012a0a0], rax
lea rdx, [0x140079aa0]
mov rcx, rax
xor r8d, r8d
call fcn.14002cde0
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r8, [0x1400795c0]
xor ecx, ecx
xor edx, edx
mov r9, r14
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x140079597
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400ba340
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14007a3e0
Capabilities:
Get session user name

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x14012a050]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [0x14012dfb0], 0
je 0x14007a40f
mov rsi, qword [0x14012dfa8]
test rsi, rsi
jne 0x14007a459
jmp 0x14007a4ba
lea rcx, str.secur32.dll
call fcn.1400462c0
mov rsi, rax
lea rcx, str.sspicli.dll
call fcn.1400462c0
test rsi, rsi
je 0x14007a444
lea rdx, str.GetUserNameExA
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rsi, rax
jmp 0x14007a446
xor esi, esi
mov qword [0x14012dfa8], rsi
mov byte [0x14012dfb0], 1
test rsi, rsi
je 0x14007a4ba
mov dword [rsp + 0x2c], 0
lea rdi, [rsp + 0x2c]
mov ecx, 8
xor edx, edx
mov r8, rdi
call rsi
mov ecx, dword [rsp + 0x2c]
mov edx, 1
xor r8d, r8d
call fcn.1400434f0
mov rsi, rax
mov ecx, 8
mov rdx, rax
mov r8, rdi
call qword [0x14012dfa8]
test al, al
je 0x14007a4b2
mov rcx, rsi
mov edx, 0x40
call fcn.1400bbfe8
test rax, rax
je 0x14007a512
mov byte [rax], 0
jmp 0x14007a512
mov rcx, rsi
call fcn.140043590
mov dword [rsp + 0x2c], 0
lea rdx, [rsp + 0x2c]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x14007a4d9
mov ecx, dword [rsp + 0x2c]
jmp 0x14007a4e6
mov dword [rsp + 0x2c], 0x100
mov ecx, 0x100
mov edx, 1
xor r8d, r8d
call fcn.1400434f0
mov rsi, rax
lea rdx, [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x14007a512
mov rcx, rsi
call fcn.140043590
xor esi, esi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400ba340
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x14007a930
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x38
cmp qword [0x14012dfb8], 0
jne 0x14007a9b1
mov edx, dword [0x14012dfc0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r9d, eax
cmp qword [0x14012dfc0], r9
ja 0x14007a9b1
lea rsi, [0x14012dfc0]
mov rdi, qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop dword [rax + rax]
mov rcx, qword [0x14012dfb8]
mov byte [rsp + 0x28], 0
mov qword [rsp + 0x20], 1
mov r8d, 1
mov rdx, rsi
call fcn.1400435a0
mov qword [0x14012dfb8], rax
mov edx, dword [0x14012dfc0]
mov rcx, rax
call rdi
mov r9d, eax
cmp qword [0x14012dfc0], r9
jbe 0x14007a970
mov rax, qword [0x14012dfb8]
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x14007c9e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx]
cmp rax, qword [rdx]
je 0x14007ca11
lea rcx, str.x0__nw__x1__nw
lea rdx, str._home_simon_mem_.build_workdirs_bob_u160jzna_putty_crypto_mpint.c
mov r8d, 0xa6
call fcn.1400cb1fc
and ebx, 1
neg rbx
mov qword [rsp + 0x28], rbx
cmp qword [rdi], 0
je 0x14007ca61
xor eax, eax
nop word cs:[rax + rax]
nop
mov rcx, qword [rdi + 8]
mov rdx, qword [rsi + 8]
mov rdx, qword [rdx + rax*8]
xor rdx, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x28]
and rcx, rdx
mov rdx, qword [rdi + 8]
xor qword [rdx + rax*8], rcx
mov rdx, qword [rsi + 8]
xor qword [rdx + rax*8], rcx
add rax, 1
cmp rax, qword [rdi]
jb 0x14007ca30
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140088b10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
mov r10, qword [rcx]
mov r9, qword [rdx]
jmp 0x140088b31
cmp bl, byte [r9]
jne 0x140088c7d
add r10, 1
add r9, 1
mov bl, byte [r10]
test bl, bl
je 0x140088c87
cmp bl, 0x2a
je 0x140088c87
cmp r9, r8
jae 0x140088c81
cmp bl, 0x3f
je 0x140088b29
cmp bl, 0x5b
je 0x140088b80
cmp bl, 0x5c
jne 0x140088b20
mov al, byte [r10 + 1]
test al, al
je 0x140088c9b
cmp al, byte [r9]
jne 0x140088c7d
add r10, 2
add r9, 1
jmp 0x140088b31
lea rax, [r10 + 1]
mov r11b, byte [r10 + 1]
add r10, 2
cmp r11b, 0x5e
cmovne r10, rax
xor esi, esi
jmp 0x140088bb1
add r10, 1
cmp byte [r9], bl
sete al
and sil, 1
or sil, al
movzx ebx, byte [r10]
cmp bl, 0x5c
je 0x140088bd0
cmp bl, 0x5d
jne 0x140088bd9
jmp 0x140088c67
movzx ebx, byte [r10 + 1]
add r10, 1
mov eax, 0xfffffffe
test bl, bl
je 0x140088ca0
cmp byte [r10 + 1], 0x2d
jne 0x140088ba0
movzx edi, byte [r10 + 2]
cmp dil, 0x5c
je 0x140088c20
mov r14d, 2
cmp dil, 0x5d
je 0x140088c94
test dil, dil
jne 0x140088c30
jmp 0x140088ca0
movzx edi, byte [r10 + 3]
mov r14d, 3
test dil, dil
je 0x140088ca0
add r10, r14
add r10, 1
movzx eax, byte [r9]
cmp bl, dil
movzx ebx, bl
movzx edi, dil
mov ebp, edi
cmovb ebp, ebx
cmova edi, ebx
cmp dil, al
movzx edi, sil
mov esi, 1
cmovb esi, edi
cmp bpl, al
cmova esi, edi
jmp 0x140088bb1
cmp r11b, 0x5e
sete al
test sil, 1
sete bl
xor bl, al
je 0x140088b29
xor eax, eax
jmp 0x140088ca0
xor eax, eax
test bl, bl
jne 0x140088ca0
mov qword [rcx], r10
mov qword [rdx], r9
mov eax, 1
jmp 0x140088ca0
mov eax, 0xfffffffd
jmp 0x140088ca0
mov eax, 0xffffffff
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140090e90
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
mov r9, qword [rdx + 8]
test r9, r9
je 0x140090f03
mov r8, qword [rdx]
xor r10d, r10d
nop word cs:[rax + rax]
nop dword [rax + rax]
movzx ecx, byte [r8 + r10]
xor ecx, eax
mov eax, ecx
and eax, 0xf
shr ecx, 4
imul edx, eax, 0x11111044
xor edx, ecx
imul r11d, eax, 0x8840020
imul ecx, eax, 0x4220000
xor ecx, r11d
xor ecx, edx
and edx, 0xf
shr ecx, 4
imul eax, edx, 0x11111044
imul r11d, edx, 0x8840020
xor r11d, eax
imul eax, edx, 0x4220000
xor eax, ecx
xor eax, r11d
add r10, 1
cmp r9, r10
jne 0x140090eb0
ret

Function at 0x140090f10
Capabilities:
Encode data using xor

Disassembly:
mov r9, qword [rcx + 8]
test r9, r9
je 0x140090f84
mov r8, qword [rcx]
xor r10d, r10d
xor eax, eax
nop word cs:[rax + rax]
nop dword [rax + rax]
movzx edx, byte [r8 + r10]
xor edx, eax
mov eax, edx
and eax, 0xf
shr edx, 4
imul ecx, eax, 0x11111044
xor ecx, edx
imul r11d, eax, 0x8840020
imul edx, eax, 0x4220000
xor edx, r11d
xor edx, ecx
and ecx, 0xf
shr edx, 4
imul eax, ecx, 0x11111044
imul r11d, ecx, 0x8840020
xor r11d, eax
imul eax, ecx, 0x4220000
xor eax, edx
xor eax, r11d
add r10, 1
cmp r9, r10
jne 0x140090f30
ret
xor eax, eax
ret
Function at 0x1400ba1d0
Capabilities:
Encode data using xor

Disassembly:
mov r8, qword [rdx]
bswap r8
xor r8, qword [rcx + 0x70]
mov qword [rcx + 0x70], r8
mov r9, qword [rdx + 8]
bswap r9
xor r9, qword [rcx + 0x78]
pxor xmm0, xmm0
xor r10d, r10d
mov edx, r9d
and edx, 1
mov rax, r9
shr rax, 1
mov qword [rcx + 0x78], rax
neg rdx
movdqu xmm1, xmmword [rcx + r10 + 0x90]
movq xmm2, rdx
pshufd xmm2, xmm2, 0x44
pand xmm2, xmm1
pxor xmm2, xmm0
and eax, 1
shr r9, 2
mov qword [rcx + 0x78], r9
neg rax
movdqu xmm1, xmmword [rcx + r10 + 0xa0]
movq xmm0, rax
pshufd xmm0, xmm0, 0x44
pand xmm0, xmm1
pxor xmm0, xmm2
add r10, 0x20
cmp r10, 0x400
jne 0x1400ba1f0
xor r9d, r9d
nop dword [rax]
mov eax, r8d
and eax, 1
mov rdx, r8
shr rdx, 1
mov qword [rcx + 0x70], rdx
neg rax
movdqu xmm1, xmmword [rcx + r9 + 0x490]
movq xmm2, rax
pshufd xmm2, xmm2, 0x44
pand xmm2, xmm1
pxor xmm2, xmm0
and edx, 1
shr r8, 2
mov qword [rcx + 0x70], r8
neg rdx
movdqu xmm1, xmmword [rcx + r9 + 0x4a0]
movq xmm0, rdx
pshufd xmm0, xmm0, 0x44
pand xmm0, xmm1
pxor xmm0, xmm2
add r9, 0x20
cmp r9, 0x400
jne 0x1400ba260
movdqu xmmword [rcx + 0x70], xmm0
ret

Function at 0x1400ba854
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 7
call fcn.1400bac78
nop
mov ecx, 7
call fcn.1400bac78
mov ecx, ebx
call fcn.1400c7bd4
nop
mov ecx, ebx
call fcn.1400c7be0
nop
int3
mov r13, rsp
movabs r14, 0xb3f73862a48a38d5
fcmovnb st(0), st(4)
and r13w, 0xf610
test byte [rax + 0x31], 0xc9
mov cx, 0x632f
fxsave64 [r13]
mov rbp, qword [r13 + 8]
dec rcx
xor qword [rbp + rcx*8 + 0x25], r14
test rcx, rcx
jne 0x1400ba879
xor dword [rbp - 0x45], 0xb6f6b96d
jmp 0x1400ba82c

Function at 0x1400d0120
Capabilities:
Encode data using xor

Disassembly:
test al, 0xc7
movabs dword [0x2886a090139d83dd], eax
adc byte [rbx + 0x5f6fa62d], al
sub dword [0xc66c70cd], 0x28
sub dword [0xc66c70cd], 0x28
adc byte [rbp + rsi - 0x385fbdc7], dl
outsd dx, dword [rsi]
xchg ebp, eax
loopne 0x1400d01ae
jns 0x1400d0114
call 0x15406d885
push 0xffffffff86e054de
cld
pushfq
xor eax, 0xfcd10061
cwde
invalid
nop
sbb eax, 0x523e68a8
call 0x120a1657d
pushfq
cwde
invalid
Function at 0x1400033e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000343d
lea rbx, [0x140062c60]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140003424
cmp r10, 2
jb 0x140003424
cmp byte [r9], r8b
jne 0x140003424
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140003400
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000347f
lea rbx, [0x140062c60]
cmp r8b, 0x23
jne 0x140003463
cmp byte [r9], r8b
jne 0x140003463
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003450
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1400035c0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x1400035da
mov qword [r8], 0
lea rdx, [0x1400627c0]
call fcn.140003490
mov rbx, rax
test rax, rax
jne 0x1400035fa
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x1400036d1
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400036d1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x1400036d1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400036d1
cmp rdi, 0xffffffffffffffff
je 0x1400036d1
mov rax, qword [0x1402ad0c0]
test rax, rax
je 0x14000366e
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x1400036d1
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x1400036be
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1402ad0c0]
test rax, rax
je 0x1400036b3
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400036da
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x1400036cc
mov qword [r14], rdi
mov rax, rsi
jmp 0x1400036dc
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret