joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b510
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000b56d
lea rbx, [0x14012abc0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14000b554
cmp r10, 2
jb 0x14000b554
cmp byte [r9], r8b
jne 0x14000b554
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14000b530
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000b5af
lea rbx, [0x14012abc0]
cmp r8b, 0x23
jne 0x14000b593
cmp byte [r9], r8b
jne 0x14000b593
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14000b580
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x14000b6f0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000b70a
mov qword [r8], 0
lea rdx, [0x14013493c]
call fcn.14000b5c0
mov rbx, rax
test rax, rax
jne 0x14000b72a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.14009779c
mov esi, eax
cmp eax, 0xffffffff
je 0x14000b7fa
xor edx, edx
mov r8d, 2
mov rcx, rbx
call fcn.140098294
test eax, eax
jne 0x14000b7fa
mov rcx, rbx
call fcn.14009779c
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000b7fa
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.140098294
test eax, eax
jne 0x14000b7fa
cmp rdi, 0xffffffffffffffff
je 0x14000b7fa
mov rax, qword [0x1401553b8]
test rax, rax
je 0x14000b79c
inc dword [rax + 0xec]
mov rcx, rdi
call fcn.14009e660
mov rsi, rax
test rax, rax
je 0x14000b7fa
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.140099000
mov rcx, rbx
cmp rax, rdi
je 0x14000b7e8
call fcn.140097f8c
mov rax, qword [0x1401553b8]
test rax, rax
je 0x14000b7de
dec dword [rax + 0xec]
mov rcx, rsi
call fcn.140091c68
jmp 0x14000b802
call fcn.140097f8c
test r14, r14
je 0x14000b7f5
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000b804
mov rcx, rbx
call fcn.140097f8c
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14000e050
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0xd0]
lea r8, [0x14012abc0]
movsxd rcx, dword [rcx + 0xc8]
mov r11d, edx
shr r11d, 0x18
mov r9d, edx
shr r9d, 8
mov r10d, edx
shr r10d, 0x10
mov ebx, dword [rax + rcx*4 - 4]
not ebx
movzx eax, dl
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r9b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, r10b
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
mov rax, qword [0x1401553b8]
xor ebx, dword [r8 + rcx*4]
movzx ecx, bl
shr ebx, 8
xor rcx, r11
xor ebx, dword [r8 + rcx*4]
not ebx
cmp dword [rax + 0x3ef4], ebx
jne 0x14000e0dc
mov dword [rax + 0x3ef8], ebx
cmp dword [rax + 0x3f40], ebx
jne 0x14000e0eb
mov byte [rax + 0x3f44], 1
cmp dword [rax + 0x3edc], ebx
jne 0x14000e102
movsxd r8, edx
mov ecx, ebx
mov edx, 4
call fcn.140020720
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x14000e110
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
movss xmm0, dword [rcx + 0xe8]
lea r10, [0x14012abc0]
mov rax, qword [rcx + 0xd0]
movss xmm1, dword [rcx + 0xec]
movss xmm2, dword [rdx]
movss xmm4, dword [rdx + 8]
subss xmm2, xmm0
movss xmm3, dword [rdx + 4]
subss xmm4, xmm0
movss xmm0, dword [rdx + 0xc]
subss xmm3, xmm1
movsxd rcx, dword [rcx + 0xc8]
subss xmm0, xmm1
movd r8d, xmm2
movss dword [rsp], xmm2
mov r9d, dword [rax + rcx*4 - 4]
movzx eax, byte [rsp]
not r9d
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
movss dword [rsp + 4], xmm3
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
movss dword [rsp + 8], xmm4
movss dword [rsp + 0xc], xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 4]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm3
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm4
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
shr eax, 8
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
mov eax, r8d
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
movzx eax, byte [rsp + 0xc]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
movd r8d, xmm0
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
xor rcx, rax
shr r9d, 8
mov eax, r8d
shr eax, 8
movzx edx, al
mov eax, r8d
xor r9d, dword [r10 + rcx*4]
movzx ecx, r9b
xor rdx, rcx
shr r9d, 8
shr eax, 0x10
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
movzx edx, al
mov rax, qword [0x1401553b8]
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
movzx ecx, r9b
shr r9d, 8
mov edx, r8d
shr rdx, 0x18
xor rdx, rcx
xor r9d, dword [r10 + rdx*4]
not r9d
cmp dword [rax + 0x3ef4], r9d
jne 0x14000e310
mov dword [rax + 0x3ef8], r9d
cmp dword [rax + 0x3f40], r9d
jne 0x14000e320
mov byte [rax + 0x3f44], 1
mov eax, r9d
add rsp, 0x18
ret
Function at 0x1400185a0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8, qword [0x1401553b8]
lea r10, [0x14012abc0]
movsxd r9, ecx
mov rbx, qword [r8 + 0x3ea8]
add rbx, 0xc8
movsxd rdx, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, r9b
movzx ecx, dil
xor rcx, rax
shr edi, 8
mov eax, r9d
shr eax, 8
movzx edx, al
mov eax, r9d
xor edi, dword [r10 + rcx*4]
movzx ecx, dil
xor rdx, rcx
shr edi, 8
shr eax, 0x10
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
movzx edx, al
xor rdx, rcx
xor edi, dword [r10 + rdx*4]
movzx ecx, dil
shr edi, 8
mov edx, r9d
shr rdx, 0x18
xor rdx, rcx
xor edi, dword [r10 + rdx*4]
not edi
cmp dword [r8 + 0x3edc], edi
jne 0x140018645
mov r8, r9
mov edx, 4
mov ecx, edi
call fcn.140020720
mov r8d, dword [rbx]
mov ecx, dword [rbx + 4]
cmp r8d, ecx
jne 0x140018679
inc r8d
test ecx, ecx
je 0x140018662
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x140018667
mov eax, 8
cmp eax, r8d
mov rcx, rbx
cmovg r8d, eax
mov edx, r8d
call fcn.140021820
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14001a160
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14014e0c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1401553b8]
mov edi, ecx
cmp byte [rbx + 0x424d], 0
jne 0x14001a1c1
cmp byte [rbx + 0x424e], 0
jne 0x14001a1c1
movsx r9d, word [rbx + 0x532e]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.14000b490
test dil, 1
je 0x14001a2e8
jmp 0x14001a24c
movss xmm1, dword [rbx + 0x38b0]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x532e]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1401371d8]
mov edx, 0x10
mulss xmm1, dword [0x1401371b8]
addss xmm0, dword [rbx + 0xd94]
addss xmm1, dword [rbx + 0xd98]
mov qword [rbx + 0x3fc8], rax
mov dword [rbx + 0x3fb4], 1
movss dword [rbx + 0x3fc0], xmm0
movss dword [rbx + 0x3fc4], xmm1
movss xmm0, dword [rbx + 0x390c]
mulss xmm0, dword [0x1401370e4]
or dword [rbx + 0x3fb0], 0x41
movss dword [rbx + 0x4010], xmm0
call fcn.14000b490
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14001a2a0
lea r11, [0x14012abc0]
nop dword [rax]
cmp r9b, 0x23
jne 0x14001a283
cmp byte [r8], r9b
jne 0x14001a283
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001a270
not ecx
call fcn.1400132d0
test rax, rax
je 0x14001a2e8
cmp byte [rax + 0x8e], 0
je 0x14001a2e8
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x532e]
mov edx, 0x10
movsx r9d, word [rbx + 0x532e]
call fcn.14000b490
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.140015990
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14008bd40
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140023a70
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x140023c1e
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x140155778]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x140155788]
lea rdx, [rdi + rdi]
call fcn.1400235a0
mov rax, qword [0x140155778]
lea r9, [rdi - 1]
mov qword [0x1401557a0], r9
mov qword [0x1401557a8], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x140023c13
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x140155788]
mov r9, qword [r11]
cmp r9, rbx
jne 0x140023b5f
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x140023bd4
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x140023b9c
mov r10, qword [rdx]
cmp r10, rax
je 0x140023b96
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x140023bd4
cmp r9, rdx
je 0x140023bb0
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x140023be8
cmp r9, rdx
jne 0x140023ba1
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x140023c0e
mov r9, qword [0x1401557a0]
jmp 0x140023b10
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x140023bd4
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.14008a860
int3
Function at 0x14004b680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x14014e0c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r8, rcx
test al, al
je 0x14004b6c0
cmp al, 0x25
jne 0x14004b6b4
cmp byte [r8 + 1], al
jne 0x14004b6c0
inc r8
movzx eax, byte [r8 + 1]
inc r8
test al, al
jne 0x14004b6a7
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x14004b81d
cmp byte [r8 + 1], dl
je 0x14004b81d
lea r11, [rsp + 0x28]
mov r9, r8
nop
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x14004b6fd
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x14004b725
sub dl, 0x61
cmp dl, 0x19
ja 0x14004b717
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x14004b725
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x14004b6e0
jmp 0x14004b728
inc r9
cmp r8, r9
jae 0x14004b75f
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x14004b754
bt rdx, rax
jb 0x14004b75a
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x14004b740
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x28]
mov edx, 0x40
lea rcx, [rsp + 0x50]
movq r9, xmm3
call fcn.14000b490
cmp byte [rsp + 0x50], 0x20
lea rcx, [rsp + 0x50]
jne 0x14004b798
nop
inc rcx
cmp byte [rcx], 0x20
je 0x14004b790
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14004b80c
movzx r8d, byte [rcx]
movzx eax, r8b
cmp r8b, 0x2d
jne 0x14004b7b8
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, byte [rax]
cmp al, 0x2b
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
movzx eax, byte [rdx]
cmp al, 0x30
jl 0x14004b7fa
movss xmm2, dword [0x1401371c0]
cmp al, 0x39
ja 0x14004b7fa
movsx eax, byte [rdx]
inc rdx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x14004b7d4
cmp r8b, 0x2d
jne 0x14004b818
xorps xmm1, xmmword [0x1401377d0]
movaps xmm0, xmm1
jmp 0x14004b820
call fcn.14009f0dc
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14004b820
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14008bd40
add rsp, 0xa0
pop rbx
ret
Function at 0x14004b840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x14014e0c0]
xor rax, rsp
mov qword [rsp + 0x90], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r8, rcx
test al, al
je 0x14004b880
cmp al, 0x25
jne 0x14004b874
cmp byte [r8 + 1], al
jne 0x14004b880
inc r8
movzx eax, byte [r8 + 1]
inc r8
test al, al
jne 0x14004b867
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x14004b9d7
cmp byte [r8 + 1], dl
je 0x14004b9d7
lea r11, [rsp + 0x28]
mov r9, r8
nop
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x14004b8bd
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x14004b8e5
sub dl, 0x61
cmp dl, 0x19
ja 0x14004b8d7
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x14004b8e5
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x14004b8a0
jmp 0x14004b8e8
inc r9
cmp r8, r9
jae 0x14004b91f
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x14004b914
bt rdx, rax
jb 0x14004b91a
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x14004b900
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x28]
mov edx, 0x40
lea rcx, [rsp + 0x50]
call fcn.14000b490
cmp byte [rsp + 0x50], 0x20
lea rcx, [rsp + 0x50]
jne 0x14004b958
nop dword [rax + rax]
inc rcx
cmp byte [rcx], 0x20
je 0x14004b950
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x14004b9ca
movzx r8d, byte [rcx]
movzx eax, r8b
cmp r8b, 0x2d
jne 0x14004b978
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, byte [rax]
cmp al, 0x2b
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
movzx eax, byte [rdx]
cmp al, 0x30
jl 0x14004b9b8
movsd xmm2, qword [0x140137168]
cmp al, 0x39
ja 0x14004b9b8
movsx eax, byte [rdx]
inc rdx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x14004b994
cmp r8b, 0x2d
jne 0x14004b9d2
xorps xmm1, xmmword [0x1401377c0]
movaps xmm0, xmm1
jmp 0x14004b9da
call fcn.14009f0dc
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x14004b9da
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14008bd40
add rsp, 0xa0
pop rbx
ret
Function at 0x140055ea0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x14014e0c0]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov r12, rcx
mov qword [rsp + 0x58], rcx
xor edi, edi
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.1400bb630
mov dword [rsp + 0x58], 0x104
call fcn.140055160
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov r8d, 0x1a
lea rdx, str.QueryFullProcessImageNameW
lea rcx, [rsp + 0x20]
call fcn.140001d60
nop
call fcn.140070830
lea rcx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x20]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x38]
cmp rsi, 0xf
cmova rdx, rbx
movabs r9, 0xcbf29ce484222325
mov ecx, edi
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x140055f83
movabs r10, 0x100000001b3
nop
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x140055f70
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x48]
mov rcx, r15
call fcn.140055a80
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140055fa8
cmp rdx, qword [r15 + 8]
je 0x140055fa8
mov rdi, qword [rdx + 0x30]
lea rcx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
cmp rsi, 0xf
jbe 0x140055fea
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140055fe2
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400560db
mov rcx, rbx
call fcn.14008bfa0
test rdi, rdi
je 0x140056008
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x60]
xor edx, edx
call rdi
jmp 0x14005601a
mov r8d, dword [rsp + 0x58]
lea rdx, [rsp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140056040
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.140053c20
nop
lea rdx, [rsp + 0x20]
mov rcx, r12
call fcn.140055d90
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 7
jbe 0x1400560a7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400560a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400560d5
call fcn.14008bfa0
mov rax, r12
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14008bd40
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140092088
int3
call fcn.140092088
int3
Function at 0x140058e70
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x1a0
mov rax, qword [0x14014e0c0]
xor rax, rsp
mov qword [rsp + 0x190], rax
xorps xmm0, xmm0
mov rbx, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0x108
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call fcn.1400bb630
mov rax, qword [rdi + 8]
mov qword [rsp + 0x30], 0
test rbx, rbx
je 0x140058f5e
mov rax, qword [rax + 0x70]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x40]
mov r9d, 0x40
mov rdx, rbx
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x140058f5e
mov eax, 0x5a4d
cmp word [rsp + 0x40], ax
jne 0x140058f5e
movsxd rdx, dword [rsp + 0x7c]
mov rax, qword [rdi + 8]
mov qword [rsp + 0x30], 0
add rdx, rbx
je 0x140058f5e
mov rax, qword [rax + 0x70]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
mov r9d, 0x108
lea r8, [rsp + 0x80]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
jne 0x140058f5e
cmp dword [rsp + 0x80], 0x4550
sete al
jmp 0x140058f60
xor al, al
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14008bd40
mov rbx, qword [rsp + 0x1c0]
add rsp, 0x1a0
pop rdi
ret
Function at 0x140059410
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rdi
push r12
sub rsp, 0xd0
mov rax, qword [0x14014e0c0]
xor rax, rsp
mov qword [rsp + 0xa8], rax
mov rbp, rcx
movsxd r12, r8d
lea rcx, [rsp + 0x60]
call fcn.140055c80
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140056330
xor edi, edi
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x30], xmm1
movups xmmword [rsp + 0x90], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 7
mov word [rax], di
mov rdx, qword [rsp + 0x58]
mov dword [rsp + 0xa0], r12d
cmp rdx, 7
jbe 0x1400594d1
mov rcx, qword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400594c2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400596c4
call fcn.14008bfa0
movups xmm1, xmmword [rsp + 0x30]
movups xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x100], rbx
lea rdx, [rsp + 0x80]
mov qword [rsp + 0xc8], rsi
movq rax, xmm1
mov qword [rsp + 0xc0], r13
movabs rbx, 0xcbf29ce484222325
mov qword [rsp + 0xb8], r14
mov r9, rbx
movq r14, xmm0
mov qword [rsp + 0xb0], r15
movdqa xmm0, xmm1
lea rsi, [rax + rax]
psrldq xmm0, 8
mov rcx, rdi
movq r15, xmm0
movabs r13, 0x100000001b3
cmp r15, 7
cmova rdx, r14
test rsi, rsi
je 0x140059563
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
xor r9, rax
imul r9, r13
cmp rcx, rsi
jb 0x140059550
xor r9, r12
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x18]
call fcn.14005aae0
cmp qword [rax + 8], rdi
je 0x140059643
cmp r15, 7
lea rcx, [rsp + 0x80]
cmova rcx, r14
test rsi, rsi
je 0x1400595b3
nop dword [rax + rax]
movzx eax, byte [rcx + rdi]
inc rdi
xor rbx, rax
imul rbx, r13
cmp rdi, rsi
jb 0x1400595a0
xor rbx, r12
lea r8, [rsp + 0x80]
mov r9, rbx
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x18]
call fcn.14005aae0
mov rdi, qword [rax + 8]
test rdi, rdi
je 0x140059643
mov rdx, qword [rbp + 0x48]
and rdx, rbx
shl rdx, 4
add rdx, qword [rbp + 0x30]
mov rax, qword [rdx]
cmp qword [rdx + 8], rdi
jne 0x14005960c
cmp rax, rdi
jne 0x140059602
mov rax, qword [rbp + 0x20]
mov qword [rdx], rax
mov qword [rdx + 8], rax
jmp 0x140059617
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
jmp 0x140059617
cmp rax, rdi
jne 0x140059617
mov rax, qword [rdi]
mov qword [rdx], rax
mov rdx, qword [rdi]
lea rcx, [rdi + 0x10]
dec qword [rbp + 0x28]
mov rax, qword [rdi + 8]
mov qword [rax], rdx
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
call fcn.14005abc0
mov edx, 0x48
mov rcx, rdi
call fcn.14008bfa0
mov r13, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0x100]
cmp r15, 7
jbe 0x140059692
lea rdx, [r15*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x14005968a
mov r14, qword [r14 - 8]
add rdx, 0x27
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400596be
mov rcx, r14
call fcn.14008bfa0
mov r14, qword [rsp + 0xb8]
mov r15, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14008bd40
add rsp, 0xd0
pop r12
pop rdi
pop rbp
ret
call fcn.140092088
int3
call fcn.140092088
int3
Function at 0x14005c560
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
xor esi, esi
mov rcx, qword [rcx + 0x10]
movzx edi, dl
test rcx, rcx
je 0x14005c58c
jle 0x14005c588
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbx + 0x10], rsi
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14005c5a1
jle 0x14005c59d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], rsi
mov rcx, qword [rbx]
test rcx, rcx
je 0x14005c5b4
jle 0x14005c5b1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rsi
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x14005c5c9
jle 0x14005c5c5
call qword [sym.imp.KERNEL32.dll_ReleaseActCtx]
mov qword [rbx + 0x48], rsi
mov qword [rbx + 0x20], rsi
mov qword [rbx + 0x28], rsi
test dil, dil
jne 0x14005c628
lea rax, [rbx + 0xf8]
mov qword [rax + 0x10], rsi
cmp qword [rax + 0x18], 7
jbe 0x14005c5eb
mov rax, qword [rax]
mov word [rax], si
cmp byte [rbx + 0x1c], sil
je 0x14005c610
add rbx, 0x118
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14005c608
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14005c617
add rbx, 0x118
mov qword [rbx + 0x10], rsi
cmp qword [rbx + 0x18], 7
jbe 0x14005c625
mov rbx, qword [rbx]
mov word [rbx], si
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret