joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140090f1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rcx
mov qword [rbp - 0x38], rcx
xor edi, edi
mov qword [rcx], rdi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x48], rdi
mov dword [rbp - 0x28], 0x650076
mov dword [rbp - 0x24], 0x730072
mov dword [rbp - 0x20], 0x6f0069
mov dword [rbp - 0x1c], 0x2e006e
mov dword [rbp - 0x18], 0x6c0064
mov dword [rbp - 0x14], 0x6c
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x48]
call fcn.14009011c
test eax, eax
js 0x140091086
mov byte [rbp - 0x50], dil
xor r9d, r9d
lea r8, str.GetFileVersionInfoSizeExW
lea rdx, [rbp - 0x28]
lea rcx, [0x1401d5078]
call fcn.140090358
mov r9b, 1
lea rdx, [rbp - 0x28]
test eax, eax
jns 0x14009100a
lea rax, [0x140090eb0]
mov qword [0x1401d5078], rax
lea r8, [0x14017ce30]
lea rcx, [0x1401d5070]
call fcn.140090358
test eax, eax
js 0x14009108e
mov r9b, 1
lea r8, [0x14017cde0]
lea rdx, [rbp - 0x28]
lea rcx, [0x1401d5068]
call fcn.140090358
test eax, eax
js 0x14009107e
jmp 0x140091021
lea r8, str.GetFileVersionInfoExW
lea rcx, [0x1401d5080]
call fcn.140090358
test eax, eax
js 0x140091096
mov r9b, 1
lea r8, [0x14017ce48]
lea rdx, [rbp - 0x28]
lea rcx, [0x1401d5088]
call fcn.140090358
test eax, eax
js 0x140091076
mov rdx, qword [rbp - 0x48]
mov rcx, qword [rbx]
mov qword [rbx], rdx
test rcx, rcx
je 0x140091055
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14010fb20
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov ecx, eax
call fcn.14008f678
int3
mov ecx, eax
call fcn.14008f678
nop
mov ecx, eax
call fcn.14008f678
nop
mov ecx, eax
call fcn.14008f678
int3
mov ecx, eax
call fcn.14008f678
int3
Function at 0x140097fd4
Capabilities:
Decode data using base64 via winapi

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 9], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rbp - 1], rcx
mov qword [rbp + 7], rdx
mov r14, qword [rdx + 0x10]
test r14, r14
je 0x1400980d0
mov rsi, rdx
cmp qword [rdx + 0x18], 8
jb 0x14009802b
mov rsi, qword [rdx]
lea rax, [rbp - 1]
mov qword [rbp - 0x19], rax
and qword [rbp - 0x11], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
mov rcx, qword [rbp + 0x5f]
test eax, eax
je 0x14009811e
mov edx, dword [rbp - 1]
lea rcx, [rbp + 0xf]
call fcn.140033b84
nop
lea rax, [rbp - 1]
mov qword [rbp - 0x11], rax
mov r15, qword [rbp + 0xf]
mov qword [rbp - 0x19], r15
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
mov r9, r15
mov r8d, 1
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryW]
mov rcx, qword [rbp + 0x5f]
test eax, eax
je 0x14009810c
mov qword [rbx], r15
mov rdx, qword [rbp + 0x17]
mov qword [rbx + 8], rdx
mov rdx, qword [rbp + 0x1f]
mov qword [rbx + 0x10], rdx
jmp 0x1400980de
and qword [rcx], 0
and qword [rcx + 8], 0
and qword [rcx + 0x10], 0
mov rcx, rdi
call fcn.140006970
mov rax, rbx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14010fb20
mov rbx, qword [rsp + 0xd0]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
lea r8, str.onecore_amcore_smartscreencommoncore_src_string_algo.cpp
mov edx, 0x27
call fcn.1400290d4
nop
lea r8, str.onecore_amcore_smartscreencommoncore_src_string_algo.cpp
mov edx, 0x24
call fcn.1400290d4
int3
Function at 0x1400b6790
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
cmp qword [rdx + 0x18], 8
mov rbx, rcx
mov r10, qword [rdx + 0x10]
mov r8, rdx
jb 0x1400b67c1
mov r8, qword [rdx]
xor r12d, r12d
lea r9, [r10 + r10]
lea rcx, [r9 + r8]
movabs rax, 0xcbf29ce484222325
cmp r8, rcx
mov r11, r8
cmova r9, r12
test r9, r9
je 0x1400b6808
movzx ecx, byte [r11]
movabs rdi, 0x100000001b3
xor rax, rcx
inc r11
mov rcx, r11
sub rcx, r8
imul rax, rdi
cmp rcx, r9
jne 0x1400b67e5
mov rbp, qword [rbx + 0x30]
mov r15, qword [rbx + 0x18]
and rbp, rax
mov r11, qword [rbx + 8]
add rbp, rbp
mov rax, qword [r15 + rbp*8]
cmp qword [r15 + rbp*8], r11
jne 0x1400b6829
mov rcx, r11
jmp 0x1400b6831
mov rcx, qword [r15 + rbp*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400b68f8
cmp qword [rdx + 0x18], 8
lea rcx, [rax + 0x10]
mov r8, rdx
jb 0x1400b684b
mov r8, qword [rdx]
mov r14, qword [rcx + 0x18]
mov r9, rcx
cmp r14, 8
jb 0x1400b685b
mov r9, qword [rcx]
mov rdi, qword [rcx + 0x10]
cmp rdi, r10
jne 0x1400b689c
mov rsi, rdi
test rdi, rdi
je 0x1400b68a4
movzx ecx, word [r9]
movzx ebx, word [r8]
cmp cx, bx
jb 0x1400b689c
sub r9, r8
cmp cx, bx
ja 0x1400b689c
cmp rsi, 1
je 0x1400b68a4
add r8, 2
dec rsi
movzx ecx, word [r8 + r9]
movzx ebx, word [r8]
cmp cx, bx
jae 0x1400b687f
mov rax, qword [rax]
jmp 0x1400b681e
lea rcx, [rax + 0x10]
cmp r14, 8
jb 0x1400b68b1
mov rcx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400b68bb
mov rdx, qword [rdx]
cmp r10, rdi
jne 0x1400b68f8
test r10, r10
je 0x1400b68fb
movzx r8d, word [rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jb 0x1400b68f8
sub rdx, rcx
cmp r8w, r9w
ja 0x1400b68f8
cmp r10, 1
je 0x1400b68fb
add rcx, 2
dec r10
movzx r8d, word [rcx + rdx]
movzx r9d, word [rcx]
cmp r8w, r9w
jae 0x1400b68da
mov rax, r11
cmp rax, r11
je 0x1400b6923
mov rbx, qword [rsp + 0x40]
add rax, 0x30
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
lea rcx, str.invalid_unordered_map_K__T__key
call fcn.140029880
int3
Function at 0x1400c66a0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rbp + 0x3f], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x1400c66db
xor eax, eax
jmp 0x1400c6806
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x1400c6715
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x1400c6715
lea ecx, [r8 - 1]
mov eax, esi
mov dword [rdx], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
jmp 0x1400c6806
cmp qword [rbx + 0x80], 0
je 0x1400c6804
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400c6750
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400c6774
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
cmovne edi, esi
jmp 0x1400c6804
lea r8, [rbp + 7]
mov byte [rbp + 0x17], sil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp + 0x18]
lea r8, [rbp + 0x3f]
mov qword [rsp + 0x30], r8
lea r8, [rbp + 0x1f]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0xf]
mov qword [rsp + 0x20], r8
lea r8, [rbp + 0x17]
call qword [case.0x1400b5e20.0]
test eax, eax
js 0x1400c6804
cmp eax, 1
jle 0x1400c67c9
cmp eax, 3
jne 0x1400c6804
movsx ecx, byte [rbp + 0x17]
jmp 0x1400c675d
mov r14, qword [rbp + 7]
lea rax, [rbp + 0x1f]
sub r14, rax
je 0x1400c67f4
mov r9, qword [rbx + 0x80]
lea rcx, [rbp + 0x1f]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x1400c6804
lea rax, [rbp + 0x17]
mov byte [rbx + 0x71], 1
cmp qword [rbp + 0xf], rax
mov eax, esi
jne 0x1400c6806
mov eax, edi
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14010fb20
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400c6d88
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400c6e3c
cmp byte [rcx + 0x71], 0
je 0x1400c6e3c
or edx, 0xffffffff
call fcn.1400c66a0
cmp eax, 0xffffffff
je 0x1400c6dfd
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [case.0x1400b5e20.0]
test eax, eax
je 0x1400c6e01
sub eax, 1
je 0x1400c6e05
sub eax, 2
je 0x1400c6e3c
xor al, al
jmp 0x1400c6e3e
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400c6e33
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400c6dfd
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400c6e3e
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14010fb20
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400ce028
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov r8, rcx
lea rsi, [rdi + 0x10]
cmp qword [rsi + 0x18], 8
mov rdx, rsi
mov r9, qword [rsi + 0x10]
jb 0x1400ce053
mov rdx, qword [rsi]
add r9, r9
xor r11d, r11d
movabs rax, 0xcbf29ce484222325
mov r10, rdx
lea rcx, [r9 + rdx]
cmp rdx, rcx
cmova r9, r11
test r9, r9
je 0x1400ce099
movzx ecx, byte [r10]
movabs r11, 0x100000001b3
xor rax, rcx
inc r10
mov rcx, r10
sub rcx, rdx
imul rax, r11
cmp rcx, r9
jne 0x1400ce076
mov rdx, qword [r8 + 0x30]
mov rcx, qword [r8 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1400ce0d1
cmp qword [rcx + rdx*8], rdi
jne 0x1400ce0c6
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x1400ce0ca
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400ce0de
cmp qword [rcx + rdx*8], rdi
jne 0x1400ce0de
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
lea rcx, [rsi + 0x20]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
mov rdx, qword [rcx]
mov rax, qword [rdx]
xor edx, edx
call qword [case.0x1400b5e20.0]
mov rcx, rsi
call fcn.140006970
mov edx, 0xb8
mov rcx, rdi
call fcn.140110004
mov qword [r14], rbx
mov rax, r14
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1400d19f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, r9
mov r14, rdx
mov r10, rcx
mov qword [rsp + 0x20], rcx
mov r12, qword [r8 + 0x10]
mov rdx, r8
cmp qword [r8 + 0x18], 8
jb 0x1400d1a3b
mov rdx, qword [r8]
movabs rax, 0xcbf29ce484222325
mov r11, rdx
lea r9, [r12 + r12]
lea rcx, [r9 + rdx]
xor r13d, r13d
cmp rdx, rcx
cmova r9, r13
test r9, r9
je 0x1400d1a82
movzx ecx, byte [r11]
xor rax, rcx
movabs rdi, 0x100000001b3
imul rax, rdi
inc r11
mov rcx, r11
sub rcx, rdx
cmp rcx, r9
jne 0x1400d1a5f
mov r9, qword [r10 + 0x30]
and r9, rax
add r9, r9
mov r15, qword [r10 + 0x18]
mov rdi, qword [r10 + 8]
cmp rdi, qword [r15 + r9*8]
je 0x1400d1b57
mov rdi, qword [r15 + r9*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [r15 + r9*8]
je 0x1400d1b57
mov rdi, qword [rdi + 8]
lea rax, [rdi + 0x10]
mov rcx, rax
cmp qword [rax + 0x18], 8
jb 0x1400d1ac5
mov rcx, qword [rax]
mov r11, r8
cmp qword [r8 + 0x18], 8
jb 0x1400d1ad2
mov r11, qword [r8]
cmp r12, qword [rax + 0x10]
jne 0x1400d1aa6
mov rsi, r12
test r12, r12
je 0x1400d1b10
movzx eax, word [r11]
movzx edx, word [rcx]
cmp ax, dx
jb 0x1400d1aa6
sub r11, rcx
cmp ax, dx
ja 0x1400d1aa6
cmp rsi, 1
je 0x1400d1b10
dec rsi
add rcx, 2
movzx eax, word [r11 + rcx]
movzx edx, word [rcx]
cmp ax, dx
jae 0x1400d1af2
jmp 0x1400d1aa6
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rdx, qword [rbx]
mov rcx, qword [rbx + 8]
mov qword [rdx + 8], rcx
dec qword [r10 + 0x10]
lea rcx, [rbx + 0x30]
call fcn.140006970
lea rcx, [rbx + 0x10]
call fcn.140006970
mov edx, 0x50
mov rcx, rbx
call fcn.140110004
mov qword [r14], rdi
mov byte [r14 + 8], r13b
mov rax, r14
jmp 0x1400d1bec
mov rax, qword [rbx]
cmp rdi, rax
je 0x1400d1b8c
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rcx, qword [r10 + 0x18]
mov rax, qword [rcx + r9*8]
cmp rax, qword [r10 + 8]
jne 0x1400d1ba9
mov qword [rcx + r9*8], rbx
mov rax, qword [r10 + 0x18]
mov qword [rax + r9*8 + 8], rbx
jmp 0x1400d1bd8
cmp rax, rdi
jne 0x1400d1bb4
mov qword [rcx + r9*8], rbx
jmp 0x1400d1bd8
mov rax, qword [rcx + r9*8 + 8]
mov rdx, qword [rax]
mov qword [rcx + r9*8 + 8], rdx
cmp rdx, rbx
je 0x1400d1bd8
mov r8, qword [r10 + 0x18]
mov rax, qword [r8 + r9*8 + 8]
mov rdx, qword [rax + 8]
mov qword [r8 + r9*8 + 8], rdx
mov rcx, r10
call fcn.1400d47d0
nop
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14010fb20
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400d43c0
Capabilities:
Create directory

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 0x21], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
and dword [rbp - 0x29], 0
mov rdx, qword [rcx]
cmp qword [rdx + 0x18], 8
jb 0x1400d43fb
mov rdx, qword [rdx]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov dword [rbp + 0x67], 0x30
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400d441a
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x19], rcx
mov qword [rbp - 0x11], rax
lea r8, [rbp - 0x19]
mov rdx, qword [rsi]
lea rcx, [rbp - 9]
call fcn.1400e78bc
mov rbx, rax
mov ecx, 0x118
call fcn.14011006c
mov qword [rbp + 0x77], rax
lea r8, [rbp + 0x67]
mov rdx, rbx
mov rcx, rax
call fcn.1400de4f8
nop
lea rcx, [rax + 0x10]
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov dword [rbp - 0x29], 3
lea rcx, [rbp - 9]
call fcn.140006970
mov rcx, qword [rdi]
mov rax, qword [rcx]
movsxd rdx, dword [rax + 4]
mov dword [rdx + rcx + 0x14], 6
mov eax, dword [rdx + rcx + 0x10]
and eax, 0x17
mov dword [rdx + rcx + 0x10], eax
and eax, 6
jne 0x1400d44aa
mov rax, rdi
mov rbx, qword [rsp + 0xc8]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
test al, 4
je 0x1400d44b7
lea rbx, str.ios_base::badbit_set
jmp 0x1400d44cb
test al, 2
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
lea rcx, [rbp - 0x19]
call fcn.140035550
mov r8, rax
mov rdx, rbx
lea rcx, [rbp + 0x17]
call fcn.140035400
lea rdx, [0x1401d1e30]
lea rcx, [rbp + 0x17]
call fcn.140111164
int3

Function at 0x1400d8504
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
lea rsi, [r8 + 0x10]
mov rdi, r8
cmp qword [rsi + 0x18], 8
mov r14, rdx
mov r8, qword [rsi + 0x10]
mov r9, rcx
mov rdx, rsi
jb 0x1400d852f
mov rdx, qword [rsi]
add r8, r8
xor r11d, r11d
movabs rax, 0xcbf29ce484222325
mov r10, rdx
lea rcx, [r8 + rdx]
cmp rdx, rcx
cmova r8, r11
test r8, r8
je 0x1400d8575
movzx ecx, byte [r10]
movabs r11, 0x100000001b3
xor rax, rcx
inc r10
mov rcx, r10
sub rcx, rdx
imul rax, r11
cmp rcx, r8
jne 0x1400d8552
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1400d85ad
cmp qword [rcx + rdx*8], rdi
jne 0x1400d85a2
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400d85a6
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400d85ba
cmp qword [rcx + rdx*8], rdi
jne 0x1400d85ba
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
lea rcx, [rsi + 0x20]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
mov qword [r8 + 8], rdx
dec qword [r9 + 0x10]
call fcn.140006970
mov rcx, rsi
call fcn.140006970
mov edx, 0x50
mov rcx, rdi
call fcn.140110004
mov qword [r14], rbx
mov rax, r14
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1400dde2c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, r8
mov r14, rdx
mov r8, rcx
lea rsi, [rbx + 0x10]
cmp qword [rsi + 0x18], 8
mov rdx, rsi
mov r9, qword [rsi + 0x10]
jb 0x1400dde5a
mov rdx, qword [rsi]
add r9, r9
xor r15d, r15d
movabs rax, 0xcbf29ce484222325
mov r10, rdx
lea rcx, [r9 + rdx]
cmp rdx, rcx
cmova r9, r15
test r9, r9
je 0x1400ddea0
movzx ecx, byte [r10]
movabs r11, 0x100000001b3
xor rax, rcx
inc r10
mov rcx, r10
sub rcx, rdx
imul rax, r11
cmp rcx, r9
jne 0x1400dde7d
mov rdx, qword [r8 + 0x30]
mov rcx, qword [r8 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400dded8
cmp qword [rcx + rdx*8], rbx
jne 0x1400ddecd
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x1400dded1
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400ddee5
cmp qword [rcx + rdx*8], rbx
jne 0x1400ddee5
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
lea rbp, [rsi + 0x20]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r8 + 0x10]
mov rcx, qword [rbp + 0x38]
test rcx, rcx
je 0x1400ddf22
mov r8, qword [rcx]
cmp rcx, rbp
setne dl
mov rax, qword [r8 + 0x20]
call qword [case.0x1400b5e20.0]
mov qword [rbp + 0x38], r15
mov rcx, rsi
call fcn.140006970
mov edx, 0x70
mov rcx, rbx
call fcn.140110004
mov rbx, qword [rsp + 0x60]
mov rax, r14
mov qword [r14], rdi
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400ddfcc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
lea r10, [r8 + 0x10]
mov rdi, r8
cmp qword [r10 + 0x18], 8
mov rsi, rdx
mov r8, qword [r10 + 0x10]
mov r9, rcx
mov rdx, r10
jb 0x1400ddff9
mov rdx, qword [r10]
add r8, r8
xor ebx, ebx
movabs rax, 0xcbf29ce484222325
mov r11, rdx
lea rcx, [r8 + rdx]
cmp rdx, rcx
cmova r8, rbx
test r8, r8
je 0x1400de03e
movzx ecx, byte [r11]
movabs rbx, 0x100000001b3
xor rax, rcx
inc r11
mov rcx, r11
sub rcx, rdx
imul rax, rbx
cmp rcx, r8
jne 0x1400de01b
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, rax
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1400de076
cmp qword [rcx + rdx*8], rdi
jne 0x1400de06b
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400de06f
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400de083
cmp qword [rcx + rdx*8], rdi
jne 0x1400de083
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rdx, qword [rdi + 8]
mov rcx, r10
mov rbx, qword [rdi]
mov qword [rdx], rbx
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
mov qword [r8 + 8], rdx
dec qword [r9 + 0x10]
call fcn.1400c37b0
mov edx, 0x40
mov rcx, rdi
call fcn.140110004
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e777c
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rcx
mov qword [rsp + 0x50], rcx
and qword [rsp + 0x50], 0
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140179fd8]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov rcx, qword [rsp + 0x68]
test eax, eax
js 0x1400e7809
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140006594
mov rdx, rax
mov rcx, rbx
call fcn.1400e75b4
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400e77f3
call qword [sym.imp.OLE32.dll_CoTaskMemFree]
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14010fb20
add rsp, 0x60
pop rbx
ret
mov r9d, eax
lea r8, str.onecore_amcore_smartscreencommoncore_srcpath.cpp
mov edx, 0x81
call fcn.1400066b4
int3
Function at 0x1400e7b14
Capabilities:
Hash data via bcrypt

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp + 7], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1401e0fc0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rdx
mov r14, rcx
mov byte [rbp - 0x39], 0
lea rax, [rbp - 0x39]
mov qword [rbp - 0x19], rax
lea rax, [rbp - 0x19]
mov qword [rbp - 0x11], rax
and qword [rbp + 0x17], 0
and qword [rbp + 0x1f], 0
lea rax, [rbp + 0x17]
mov qword [rbp + 0x27], rax
lea rax, [rbp - 0x11]
mov qword [rbp + 0x2f], rax
xor r9d, r9d
lea r8, [rbp + 0x27]
lea rdx, [0x1400e81f0]
lea rcx, [0x1403c74f8]
call qword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x1400e7cdc
mov rbx, qword [rbp + 0x1f]
test rbx, rbx
je 0x1400e7bdc
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
add eax, esi
jne 0x1400e7bdc
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x1400b5e20.0]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
add eax, esi
jne 0x1400e7bdc
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x1400b5e20.0]
mov rax, qword [0x1403c7500]
and qword [rbp + 0xf], 0
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0xf]
mov rcx, qword [rax]
call qword [sym.imp.bcrypt.dll_BCryptCreateHash]
mov rcx, qword [rbp + 0x5f]
test eax, eax
js 0x1400e7cff
mov rax, qword [rdi + 8]
mov rdx, qword [rax]
mov rax, qword [rdi]
mov rcx, qword [rax]
lea rax, [0x140174ab8]
mov qword [rbp - 0x31], rax
mov qword [rbp - 0x29], rcx
mov qword [rbp - 0x21], rdx
mov rsi, qword [rbp + 0xf]
lea rcx, [rbp - 0x31]
mov rax, qword [rax + 8]
call qword [case.0x1400b5e20.0]
mov rbx, rax
lea rcx, [rbp - 0x31]
call fcn.1400e84d0
mov rdi, rax
sub edi, ebx
mov rdx, qword [rbp - 0x31]
lea rcx, [rbp - 0x31]
mov rax, qword [rdx + 8]
call qword [case.0x1400b5e20.0]
mov rdx, rax
xor r9d, r9d
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.bcrypt.dll_BCryptHashData]
mov rcx, qword [rbp + 0x5f]
test eax, eax
js 0x1400e7d29
xor r9d, r9d
lea r8d, [r9 + 0x14]
mov rdx, r14
mov rcx, qword [rbp + 0xf]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
mov rcx, qword [rbp + 0x5f]
test eax, eax
js 0x1400e7d14
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x1400e7cb5
call qword [sym.imp.bcrypt.dll_BCryptDestroyHash]
mov rax, r14
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14010fb20
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
cmp qword [rbp + 0x17], 0
je 0x1400e7cf9
lea rdx, [rbp + 0x17]
lea rcx, [rbp - 9]
call fcn.140028f78
mov rcx, rax
call fcn.1400282c0
int3
call fcn.14002acc0
nop
mov r9d, eax
lea r8, str.onecore_amcore_smartscreencommoncrypto_srchash.cpp
mov edx, 0x1b
call fcn.14003adb0
int3
mov r9d, eax
lea r8, str.onecore_amcore_smartscreencommoncrypto_srchash.cpp
mov edx, 0x27
call fcn.14003adb0
nop
mov r9d, eax
lea r8, str.onecore_amcore_smartscreencommoncrypto_srchash.cpp
mov edx, 0x22
call fcn.14003adb0
int3