joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140b1b5e7
Capabilities:
Encode data using xor

Disassembly:
test dh, cl
mov rdx, rcx
setl cl
add qword [rsp], 0xffffffffffb7dfea
movabs rcx, 0x556247b83e3064cb
mov cl, dl
push 0x63bb2e62
not word [rsp]
movzx rdx, byte [rsp]
sub cl, byte [rsp + 6]
and edx, 0x87453cf
setl byte [rsp]
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x20], 0xfffffffff9ab4658
test dword [rsp], ecx
setg cl
sub cx, word [rsp]
mov dword [rsp], ecx
sub ecx, ecx
jl 0x1405fab31
add dword [rsp], 0xea538d4
push 0x2ced1ccf
push rcx
push rdx
neg rcx
add byte [rsp + 0x18], 0x14
jb 0x140b1b623
movabs rdx, 0x72c22b0743bc2080
or qword [rsp + 0x10], rcx
test byte [rsp + 0x18], 0xbc
jo 0x140b49df5
push rsi
and dword [rsp + 0x10], 0x52cc27ba
mov rsi, rdx
push rdi
mov qword [rsp + 0x18], 0x2ab32fd8
mov rdx, qword [rsp + 0x10]
mov rsi, qword [rsp + 8]
lea rsp, [rsp + 0x30]
ret

Function at 0x140b29c9d
Capabilities:
Encode data using xor

Disassembly:
jle 0x140b336b8
test r13d, 0x3fc6af0
setb byte [rsp + 0x30]
mov r13w, word [rsp + 0xa]
sub r13d, 0xe19411f
and r13w, 0x2d67
jl 0x1405717a4
mov word [rsp + 0x30], 0x1244
xor dword [rsp + 8], 0x4c974cf8
mov byte [rsp + 8], 0x87
add qword [rsp + 8], r13
neg r13b
or qword [rsp + 0x30], r13
xor word [rsp + 0x30], 0x73e7
xor word [rsp + 8], 0x5bba
add qword [rsp], 0x4f9142
or qword [rsp + 0x30], 0x5fb159e3
setle r13b
jg 0x140622948
adc dl, byte [rax]
jge 0x140b3377c
or dh, byte [rbx - 0x78]
invalid
xadd ecx, ecx
push qword [rdi + 0x72f54a6a]
or byte [rdi], ch
invalid

Function at 0x140b38a68
Capabilities:
Authenticate hmac

Disassembly:
sete byte [rsp + 0x28]
or word [rsp + 8], 0x22d7
or word [rsp + 8], 0x1ee3
sub byte [rsp + 0x28], 0xe1
jo 0x1405efe2e
test qword [rsp + 0x10], 0x65847253
mov qword [rsp + 0x10], 0x1e7d1b25
call fcn.1405a017b
add word [rsp + 0x20], 0x7f42
and dword [rsp + 0x20], 0x39ba0a69
or byte [rsp + 0x28], 0x2c
or dword [rsp + 0x20], 0x36636338
seto byte [rsp + 0x28]
or qword [rsp + 0x28], 0x21547368
sub dword [rsp + 0x28], 0x5dd26312
sub byte [rsp + 0x28], 0xb9
sub word [rsp + 0x20], 0x6ec0
or word [rsp + 0x28], 0x6876
and dword [rsp + 0x28], 0x44fc5d29
cmp byte [rsp + 0x20], 0x4a
mov word [rsp + 0x20], 0x7353
jno 0x140b411bc
cmp dword [rsp + 0x60], 0x1682404c
setb byte [rsp + 0x60]
not byte [rsp + 0x60]
sete byte [rsp + 0x60]
xor dword [rsp + 0x60], 0xfd667f7
and word [rsp + 0x60], 0x79e
or qword [rsp + 0x60], 0x16c62d6e
setg byte [rsp + 0x60]
cmp dword [rsp + 0x60], 0x3425126
setbe byte [rsp + 0x60]
and dword [rsp + 0x60], 0x38336ed
mov word [rsp + 0x60], 0x797c
sub qword [rsp + 0x60], 0x2c91655a
and word [rsp + 0x60], 0x77c6
test dword [rsp + 0x60], 0x36f320e5
push qword [rsp + 0x68]
popfq
lea rsp, [rsp + 0x70]
call fcn.140bbb007

Function at 0x140b39a75
Capabilities:
Encode data using xor

Disassembly:
push r11
push r12
mov r11, r12
mov dword [rsp], r11d
push r13
mov r13, qword [rsp + 8]
jb 0x140adcf66
test r12d, 0x50864d71
push r11
movsx r12, word [rsp]
push r14
movsx r13, word [rsp + 0x18]
call fcn.140abcc85
lea r12, [r12 + r12 + 0x16d91764]
pushfq
test r12b, 0xfa
jno 0x1405c2b41
Function at 0x140b464f0
Capabilities:
Encode data using xor

Disassembly:
not r13w
movabs rcx, 0x6bce0cb402e056b9
push r14
setae r10b
movabs r14, 0x1df4392806257f0d
mov rbp, qword [rsp + 0x30]
xor r10w, 0x2ecf
pop r14
bswap r13d
sub r10b, 0x67
neg r13d
add qword [rsp + 0x18], 0x1411d
mov ecx, r13d
neg cl
test r13d, ecx
bswap r13d
bswap ecx
not r10w
call fcn.140a5f2ab
or byte [rax + 0x12], bh
fcompi st(3)
mov bl, 0x40
movabs byte [0xeab7f44d0118d794], al
add bl, byte [rcx + 0x73]
xor dword [rdx + 0x64], edi
cmp dword [rbp + 0x36], esi
loope 0x140b46558
invalid

Function at 0x140b4f219
Capabilities:
Authenticate hmac

Disassembly:
not word [rsp + 0x60]
sets byte [rsp + 0x60]
neg qword [rsp + 0x60]
test cx, 0x7c4
lea rbp, [rbp + rbp*8 + 0x4d3f68cb]
not bp
call fcn.140a98d77

Function at 0x140b4f23d
Capabilities:
Authenticate hmac

Disassembly:
lea rcx, [rcx + rcx*8 + 0x75101aad]
lea rcx, [rcx*4 + 0x460e4f27]
not cl
call int.14059b09a
Function at 0x1408edf6d
Capabilities:
Encode data using xor

Disassembly:
push 0xffffffffc28d8eba
lea rsp, [rsp + 0x30]
je 0x1408e3f22
mov ecx, 0x1f209ca5
ror ecx, cl
btc ecx, 7
push rsi
ror cx, 0xe1
lea rsi, [0x1409128a0]
movzx ecx, byte [rax]
xor ecx, edx
push 0xffffffff839e7ea6
and ecx, 0xff
mov ecx, dword [rsi + rcx*4]
inc dword [rsp + 4]
sar word [rsp + 5], 0x85
shr edx, 8
sal qword [rsp], 0x7b
neg dword [rsp + 3]
sal byte [rsp + 7], 4
xor edx, ecx
push 0xffffffff8037d082
inc rax
neg byte [rsp + 0xb]
xor edx, 0x809019ba
dec r10
lea rsp, [rsp + 0x10]
jne 0x1408edf94
push 0x6f9c7501
jmp 0x1408e3f11

Function at 0x1408f5fc8
Capabilities:
Encode data using base64

Disassembly:
neg rcx
rol sil, 1
dec cx
xor sil, cl
imul cx, cx
btc cx, 0x91
rol cl, 2
xor sil, 0x2e
push rcx
btc rcx, 0x31
inc sil
rol cx, cl
or ecx, 0xe11ae98f
js 0x14090a8d6
push r10
mov r10d, 0xbf3a4fb4
push r10
call fcn.14090d104
mov ecx, 0x2c2c35b5
lea rsi, [rcx*8 + 0x77b68103]
lea r9, [rcx + r9 - 0x2c2c35b6]
and rsi, rsi
lea rcx, [rcx*2 - 0x4cf27f65]
movzx esi, byte [r9 + rcx*2 - 0x16cbd80a]
btr cx, 0x3f
lea rcx, [rcx + rcx*2 - 0x38c95b6a]
sal cx, 0xb
xor sil, bpl
or cx, cx
xor sil, 0xbc
btc ecx, ecx
jb 0x1408fb1a6
adc sil, 0x2b
dec cx
jge 0x1408d381c
sub r9, 2
mov r11d, 0x4b91733d
and r11b, r11b
movzx edi, word [r11 + r9 - 0x4b91733d]
xor di, bp
dec r11d
add r11w, r11w
xor di, 0xc184
inc r11b
shl r11, 0x55
rol di, 1
xor bpl, sil
btc ecx, ecx
jb 0x14091369d
Function at 0x1400073c0
Capabilities:
Move file

Disassembly:
push rbx
push rsi
push rdi
push r12
push r15
sub rsp, 0x60
mov rax, qword [0x140086240]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r15, qword [rdx + 0x10]
lea rsi, [rcx + 0x20]
mov r12, qword [rsi + 0x10]
movabs rbx, 0x7ffffffffffffffe
mov rax, rbx
mov rdi, rdx
sub rax, r15
cmp rax, r12
jb 0x140007554
cmp qword [rdx + 0x18], 7
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0x58], r13
mov r13, rdx
mov qword [rsp + 0x50], r14
jbe 0x140007422
mov r13, qword [rdx]
cmp qword [rsi + 0x18], 7
jbe 0x14000742c
mov rsi, qword [rsi]
lea rbp, [r12 + r15]
mov eax, 7
lea r14, [rsp + 0x28]
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x28], xmm0
movdqu xmmword [rsp + 0x38], xmm1
cmp rbp, rax
jbe 0x14000748e
mov rax, rbp
or rax, 7
cmp rax, rbx
ja 0x14000746b
mov ecx, 0xa
mov rbx, rax
cmp rax, rcx
cmovb rbx, rcx
inc rbx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
mov qword [rsp + 0x20], rbx
call fcn.140013490
mov r14, rax
lea rax, [rbx - 1]
mov qword [rsp + 0x28], r14
lea rbx, [r15 + r15]
mov qword [rsp + 0x38], rbp
mov r8, rbx
mov qword [rsp + 0x40], rax
mov rdx, r13
mov rcx, r14
call fcn.1400683e0
lea rcx, [rbx + r14]
mov rdx, rsi
lea r8, [r12 + r12]
call fcn.1400683e0
mov r13, qword [rsp + 0x58]
lea rdx, [rsp + 0x28]
xor eax, eax
mov word [r14 + rbp*2], ax
cmp qword [rsp + 0x40], 7
mov r14, qword [rsp + 0x50]
cmova rdx, qword [rsp + 0x28]
cmp qword [rdi + 0x18], 7
mov rbp, qword [rsp + 0xa0]
jbe 0x1400074ee
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x140007535
mov rcx, qword [rsp + 0x28]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007530
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000754e
call fcn.14003f0f8
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14003f0d0
add rsp, 0x60
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.140045efc
int3
call fcn.140001e80
int3
Function at 0x1400089e0
Capabilities:
Enumerate disk volumes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x140086240]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rdx
mov qword [rsp + 0x48], rdx
mov dword [rsp + 0x20], 1
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
xor esi, esi
mov qword [rdx], rsi
mov qword [rdx + 8], rsi
mov qword [rdx + 0x10], rsi
mov dword [rsp + 0x20], 1
mov edx, 0x104
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140008b68
nop dword [rax]
lea rcx, [rsp + 0x50]
mov rax, 0xffffffffffffffff
nop dword [rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], 0
jne 0x140008a60
cmp word [rsp + rax*2 + 0x4e], 0x5c
jne 0x140008a8c
lea rax, [rax*2 - 2]
cmp rax, 0x208
jae 0x140008b90
mov word [rsp + rax + 0x50], si
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140008ab0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.140013bf0
nop
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140008af7
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rsp + 0x28], si
add qword [rbx + 8], 0x20
jmp 0x140008b09
lea r8, [rsp + 0x28]
mov rcx, rbx
call fcn.140016790
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x140008b42
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008b3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008b96
call fcn.14003f0f8
mov r8d, 0x104
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x140008a50
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindVolumeClose]
nop
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14003f0d0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14003f2ec
nop
call fcn.140045efc
int3
Function at 0x14000ada0
Capabilities:
Hash data via bcrypt

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140086240]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x48], rdx
lea rcx, [rsp + 0x48]
mov rsi, r9
mov rbx, r8
mov rdi, rdx
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x48], rbp
xor r8d, r8d
mov qword [rsp + 0x50], rbp
lea rdx, str.SHA256
call qword [sym.imp.bcrypt.dll_BCryptOpenAlgorithmProvider]
test eax, eax
jne 0x14000ae4b
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x30], ebp
xor r9d, r9d
mov dword [rsp + 0x28], ebp
xor r8d, r8d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.bcrypt.dll_BCryptCreateHash]
test eax, eax
jne 0x14000ae3e
mov rcx, qword [rsp + 0x50]
xor r9d, r9d
mov r8d, esi
mov rdx, rbx
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x14000ae58
call qword [sym.imp.bcrypt.dll_BCryptDestroyHash]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
mov qword [rdi], rbp
mov qword [rdi + 8], rbp
mov qword [rdi + 0x10], rbp
jmp 0x14000aebc
xor r9d, r9d
lea rdx, [rsp + 0x58]
lea r8d, [r9 + 0x20]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
mov rcx, qword [rsp + 0x50]
test eax, eax
jne 0x14000ae38
call qword [sym.imp.bcrypt.dll_BCryptDestroyHash]
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.bcrypt.dll_BCryptCloseAlgorithmProvider]
mov edx, 0x20
mov qword [rdi], rbp
mov rcx, rdi
mov qword [rdi + 8], rbp
mov qword [rdi + 0x10], rbp
call fcn.140015a50
mov rbx, qword [rdi]
lea rdx, [rsp + 0x58]
mov rcx, rbx
mov r8d, 0x20
call fcn.1400683e0
lea rax, [rbx + 0x20]
mov qword [rdi + 8], rax
mov rax, rdi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14003f0d0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000b380
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x140086240]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [rcx + 0x10]
mov rsi, rdx
sub rax, qword [rcx]
mov rbx, rcx
mov qword [rsp + 0x20], 0x100
cmp rax, 0x100
jae 0x14000b3cb
lea rdx, [rsp + 0x20]
call fcn.1400137b0
mov edx, 0x100
mov rcx, rbx
call fcn.14000ed70
mov rax, qword [rbx + 0x28]
sub rax, qword [rbx + 0x18]
mov qword [rsp + 0x20], 0x100
cmp rax, 0x100
jae 0x14000b3ff
lea rdx, [rsp + 0x20]
lea rcx, [rbx + 0x18]
call fcn.1400137b0
mov edx, 0x100
lea rcx, [rbx + 0x18]
call fcn.14000ed70
mov ebp, dword [rsi + 8]
sub ebp, dword [rsi]
xor r9d, r9d
mov r10d, r9d
mov r11d, r9d
nop dword [rax + rax]
mov rax, qword [rbx]
lea r11, [r11 + 1]
mov byte [r11 + rax - 1], r10b
mov eax, r10d
mov rcx, qword [rbx + 0x18]
cdq
idiv ebp
mov rax, qword [rsi]
inc r10d
movsxd r8, edx
movzx eax, byte [r8 + rax]
mov byte [r11 + rcx - 1], al
cmp r10d, 0x100
jl 0x14000b420
mov rdx, r9
nop word [rax + rax]
mov rax, qword [rbx + 0x18]
mov r8, qword [rbx]
movzx eax, byte [rax + rdx]
movzx r10d, byte [r8 + rdx]
add eax, r9d
add eax, r10d
and eax, 0x800000ff
jge 0x14000b486
dec eax
or eax, 0xffffff00
inc eax
movsxd r9, eax
movzx eax, byte [r9 + r8]
mov byte [r8 + rdx], al
inc rdx
mov byte [r9 + r8], r10b
cmp rdx, 0x100
jl 0x14000b460
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14003f0d0
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x14000b4d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r8, r8
je 0x14000b581
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
xor eax, eax
mov rbp, r8
mov r9d, eax
mov esi, eax
mov rdi, rdx
mov rbx, rcx
nop dword [rax]
inc eax
and eax, 0x800000ff
jge 0x14000b512
dec eax
or eax, 0xffffff00
inc eax
mov r8, qword [rbx]
movsxd r10, eax
movzx r11d, byte [r8 + r10]
add r9d, r11d
and r9d, 0x800000ff
jge 0x14000b536
dec r9d
or r9d, 0xffffff00
inc r9d
movsxd rdx, r9d
inc esi
movzx ecx, byte [rdx + r8]
mov byte [r8 + r10], cl
mov byte [rdx + r8], r11b
mov r8, qword [rbx]
movzx edx, byte [rdx + r8]
movzx ecx, byte [r8 + r10]
add rdx, rcx
movzx ecx, dl
movzx edx, byte [rcx + r8]
xor byte [rdi], dl
inc rdi
movsxd rcx, esi
cmp rcx, rbp
jb 0x14000b500
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x14000ba60
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14000ba82
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14000bafc
mov rdi, r14
mov rcx, rbx
call fcn.1400112a0
test rax, rax
jle 0x14000bad4
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1400683e0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000baec
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14000baf4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14000ba96
sub r14, rdi
jmp 0x14000bbdf
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14000bb13
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000bb15
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000bb47
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1400683e0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000bbdc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000bb82
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000bbbd
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140049f4c
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14000bbdc
cmp rbp, rax
ja 0x14000bb90
test rbp, rbp
je 0x14000bbdc
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140049f4c
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140012280
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rbp, r8
mov rsi, rdx
mov rdi, rcx
cmp rdx, r8
je 0x140012476
cmp qword [rdx + 0x28], 7
lea r8, [rdx + 0x10]
mov rax, qword [rcx + 8]
mov r9, qword [r8 + 0x10]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r14
mov r14, qword [rcx + 0x18]
mov qword [rsp + 0x70], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x68], rax
jbe 0x1400122e0
mov r8, qword [r8]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
movabs r10, 0x100000001b3
add r9, r9
je 0x140012314
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor rdx, rax
imul rdx, r10
cmp rcx, r9
jb 0x140012300
mov r15, qword [rdi + 0x30]
mov rbx, qword [rsi]
and r15, rdx
shl r15, 4
mov rdx, rsi
add r15, r14
mov r13, qword [r15]
mov r12, qword [r15 + 8]
call fcn.140001ab0
dec qword [rdi + 0x10]
cmp rsi, r12
je 0x140012361
nop dword [rax]
mov r14, rbx
cmp rbx, rbp
je 0x140012378
mov rdx, rbx
mov rbx, qword [rbx]
call fcn.140001ab0
dec qword [rdi + 0x10]
cmp r14, r12
jne 0x140012340
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x70]
cmp r13, rsi
mov r13, qword [rsp + 0x68]
jne 0x140012391
mov qword [r15], r12
mov rax, r12
jmp 0x140012394
cmp r13, rsi
jne 0x140012380
mov qword [r15], rbx
mov rax, qword [rsp + 0x68]
mov qword [rax], rbx
mov qword [rbx + 8], rax
jmp 0x14001245d
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x140012455
nop dword [rax]
nop word [rax + rax]
cmp qword [rbx + 0x28], 7
lea r8, [rbx + 0x10]
mov r9, qword [r8 + 0x10]
mov rsi, rbx
jbe 0x1400123c5
mov r8, qword [r8]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r9, r9
je 0x1400123f9
movabs r13, 0x100000001b3
movzx eax, byte [r8 + rdx]
inc rdx
xor rcx, rax
imul rcx, r13
cmp rdx, r9
jb 0x1400123e0
mov r13, qword [rsp + 0x68]
mov r15, qword [rdi + 0x30]
mov rdx, rbx
mov rbx, qword [rbx]
and r15, rcx
shl r15, 4
add r15, r14
mov r14, qword [r15 + 8]
call fcn.140001ab0
dec qword [rdi + 0x10]
cmp rsi, r14
je 0x14001243c
nop
mov rsi, rbx
cmp rbx, rbp
je 0x140012452
mov rdx, rbx
mov rbx, qword [rbx]
call fcn.140001ab0
dec qword [rdi + 0x10]
cmp rsi, r14
jne 0x140012420
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
je 0x140012455
mov r14, qword [rsp + 0x78]
jmp 0x1400123b0
mov qword [r15], rbx
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x20]
mov rax, rbp
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003540c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x14002283a
movzx eax, byte [rcx + rdx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x14002281d
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x140022808

Function at 0x140035420
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
xor r8d, r8d
movabs rax, 0xcbf29ce484222325
test r9, r9
je 0x1400170d4
movabs r10, 0x100000001b3
movzx edx, byte [rcx + r8]
inc r8
xor rax, rdx
imul rax, r10
cmp r8, r9
jb 0x1400170c0
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x1400170a0

Function at 0x14003fee0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003ff2a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003ff2a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003ff2a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003ff2a
cmp dword [rcx + 0x84], 0xe
jbe 0x14003ff2a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003ff2c
xor al, al
add rsp, 0x28
ret

Function at 0x140051df4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140051bf0

Function at 0x140055dc8
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140055dde
mov al, 1
jmp 0x140055e3e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140055def
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140055e3c
mov ecx, dword [rcx + 0x18]
nop
call fcn.14005fe10
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140055e3c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140055e3c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140055e3c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140055e3e
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140059de4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.14003fb00
sub rsp, rax
mov rax, qword [0x140086240]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.140055ca8
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x140059e33
mov rax, rbp
jmp 0x140059f3b
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x8b670]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14005b804
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x8b670]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x140059f37
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140059f37
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14005b804
test rax, rax
js 0x140059f37
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x140059f37
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140059f29
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140059f29
cmp byte [rcx], 0xd
jne 0x140059f0f
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140059f1e
cmp byte [rcx + 1], 0xa
jne 0x140059f1e
inc rcx
jmp 0x140059f1e
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x86690]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140059ef1
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x140059f3b
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14003f0d0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret