joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002e5c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov r10, rcx
xor r9d, r9d
test rcx, rcx
jne 0x140002e86
xor eax, eax
jmp 0x140002f45
mov qword [rsp + 8], r9
mov qword [rsp + 0x10], r9
movsxd rax, dword [rcx + 0x3c]
test r8b, r8b
je 0x140002ea2
add rcx, 0x88
jmp 0x140002ea6
add rcx, 0x78
add rcx, rax
mov ecx, dword [rcx]
add rcx, r10
mov esi, dword [rcx + 0x1c]
add rsi, r10
mov r8d, dword [rcx + 0x20]
add r8, r10
mov qword [rsp + 8], r8
mov edx, dword [rcx + 0x24]
add rdx, r10
mov qword [rsp + 0x10], rdx
test r14d, 0xffff0000
jne 0x140002edd
movzx eax, r14w
sub eax, dword [rcx + 0x10]
jmp 0x140002f16
mov ecx, dword [rcx + 0x18]
mov dword [rsp], ecx
mov eax, ecx
dec ecx
mov dword [rsp], ecx
test eax, eax
je 0x140002f38
mov eax, dword [r8]
add rax, r10
mov rdi, r14
sub rdi, rax
movzx r11d, byte [rax]
movzx ebx, byte [rax + rdi]
sub r11d, ebx
jne 0x140002f0e
inc rax
test ebx, ebx
jne 0x140002efa
test r11d, r11d
jne 0x140002f24
movzx eax, word [rdx]
mov r9d, dword [rsi + rax*4]
add r9, r10
mov qword [rsp + 0x18], r9
jmp 0x140002f38
add r8, 4
mov qword [rsp + 8], r8
add rdx, 2
mov qword [rsp + 0x10], rdx
jmp 0x140002ee3
jmp 0x140002f42
mov rax, r9
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x140003908
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x14000a460]
xor rax, rsp
mov qword [rsp + 0x240], rax
xor esi, esi
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
js 0x1400039a1
mov rcx, qword [rsp + 0x20]
mov ebx, 0xc0000001
call qword [sym.imp.ntoskrnl.exe_PsGetProcessImageFileName]
mov rcx, qword [rsp + 0x20]
mov rdi, rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call fcn.140006dc0
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdi + rcx], sil
jne 0x140003978
lea r8d, [rcx + 1]
mov rcx, rdi
lea rdx, [rsp + 0x30]
call fcn.140005e50
lea rcx, [rsp + 0x30]
call fcn.140001758
test al, al
cmovne ebx, esi
mov eax, ebx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140006b10
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140003d10
Capabilities:
Get file attributes
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xe0
mov rax, qword [0x14000a460]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rdx, [0x1400077f0]
lea rcx, [rbp - 9]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and qword [rbp + 0xf], 0
lea rax, [rbp - 9]
xorps xmm0, xmm0
mov qword [rbp + 0x17], rax
movdqu xmmword [rbp + 0x27], xmm0
mov dword [rbp + 7], 0x30
mov dword [rbp + 0x1f], 0x240
mov rax, cr8
test al, al
je 0x140003d76
mov eax, 0xc0000001
jmp 0x140003e75
and dword [rsp + 0x50], 0
lea r9, [rbp - 0x19]
and qword [rsp + 0x48], 0
lea r8, [rbp + 7]
mov dword [rsp + 0x40], 0x20
lea rcx, [rbp - 0x29]
mov dword [rsp + 0x38], 1
mov edx, 0x80000000
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
js 0x140003e73
mov rcx, qword [rbp - 0x29]
lea r8, [rbp + 0x37]
and dword [rbp + 0x37], 0
lea rdx, [rbp - 0x19]
xor eax, eax
mov dword [rsp + 0x20], 5
mov qword [rbp + 0x3b], rax
mov qword [rbp + 0x43], rax
mov dword [rbp + 0x4b], eax
lea r9d, [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
mov ebx, eax
test eax, eax
js 0x140003e69
mov eax, dword [rbp + 0x3f]
mov cl, 1
mov edx, eax
mov dword [0x14000a728], eax
call fcn.1400044d8
and qword [rsp + 0x40], 0
lea rcx, [rbp - 0x21]
and dword [rbp - 0x1d], 0
xor r9d, r9d
and dword [rbp - 0x21], 0
xor r8d, r8d
mov qword [rsp + 0x38], rcx
xor edx, edx
mov ecx, dword [0x14000a728]
mov dword [rsp + 0x30], ecx
mov rcx, qword [rbp - 0x29]
mov qword [rsp + 0x28], rax
mov qword [0x14000a720], rax
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov ebx, eax
test eax, eax
jns 0x140003e69
mov rcx, qword [0x14000a720]
call fcn.140004528
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140006b10
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe0
pop rbp
ret
Function at 0x140003e94
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov eax, 0x5a4d
mov r8d, edx
mov rbp, rcx
cmp word [rcx], ax
je 0x140003ec5
or eax, 0xffffffff
jmp 0x140003fdc
movsxd rsi, dword [rcx + 0x3c]
add rsi, rbp
cmp dword [rsi], 0x4550
jne 0x140003ebd
mov eax, 0x78
mov ecx, 0x20b
cmp word [rsi + 0x18], cx
mov rcx, rsi
lea edx, [rax + 0x10]
cmove eax, edx
mov r12d, dword [rax + rsi]
mov edx, r12d
mov eax, dword [rax + rsi + 4]
mov dword [rsp + 0x78], eax
call fcn.140003ff4
or edi, 0xffffffff
cmp eax, edi
je 0x140003fda
mov ebx, eax
mov rcx, rsi
add rbx, rbp
mov eax, dword [rbx + 0x18]
mov edx, dword [rbx + 0x1c]
mov dword [rsp + 0x60], eax
call fcn.140003ff4
mov edx, dword [rbx + 0x24]
mov rcx, rsi
mov r15d, eax
call fcn.140003ff4
mov edx, dword [rbx + 0x20]
mov rcx, rsi
mov r14d, eax
call fcn.140003ff4
cmp r15d, edi
je 0x140003fda
cmp r14d, edi
je 0x140003fda
cmp eax, edi
je 0x140003fda
lea rbx, [r14 + rbp]
mov r14d, eax
lea r13, [r15 + rbp]
add r14, rbp
xor r15d, r15d
cmp dword [rsp + 0x60], r15d
jbe 0x140003fda
mov edx, dword [r14]
mov rcx, rsi
call fcn.140003ff4
cmp eax, edi
je 0x140003fbc
mov ecx, eax
movzx eax, word [rbx]
add rcx, rbp
mov edx, dword [r13 + rax*4]
cmp edx, r12d
jb 0x140003f9b
mov eax, dword [rsp + 0x78]
add eax, r12d
cmp edx, eax
jb 0x140003fbc
mov r10, qword [rsp + 0x70]
sub r10, rcx
movzx eax, byte [rcx]
movzx r9d, byte [rcx + r10]
sub eax, r9d
jne 0x140003fb8
inc rcx
test r9d, r9d
jne 0x140003fa3
test eax, eax
je 0x140003fd0
inc r15d
add r14, 4
add rbx, 2
cmp r15d, dword [rsp + 0x60]
jae 0x140003fda
jmp 0x140003f6f
mov rcx, rsi
call fcn.140003ff4
mov edi, eax
mov eax, edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140003ff4
Capabilities:
Enumerate pe sections

Disassembly:
movzx eax, word [rcx + 0x14]
lea r9, [rcx + 0x18]
movzx r11d, word [rcx + 6]
add r9, rax
xor r10d, r10d
test r11d, r11d
je 0x140004028
mov ecx, dword [r9 + 0xc]
cmp ecx, edx
ja 0x14000401c
add ecx, dword [r9 + 8]
cmp ecx, edx
ja 0x14000402c
add r9, 0x28
inc r10d
cmp r10d, r11d
jl 0x14000400c
or eax, 0xffffffff
ret
mov ecx, dword [r9 + 0x14]
or eax, 0xffffffff
sub ecx, dword [r9 + 0xc]
add edx, ecx
cmp edx, r8d
cmovb eax, edx
ret
Function at 0x140004d6c
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
cmp dword [0x14000a7c8], 0
movzx ebx, r8w
movzx edi, dx
movzx esi, cx
jne 0x140004e06
and qword [r11 - 0x68], 0
lea rax, [0x140004b2c]
and qword [rbp + 7], 0
lea r8, [rbp + 0x27]
and qword [rbp + 0x2f], 0
lea rcx, [rbp + 7]
and qword [rbp + 0x37], 0
xorps xmm0, xmm0
mov dword [0x14000a7c8], r9d
mov edx, 0x1fffff
mov qword [r11 - 0x70], rax
xor r9d, r9d
and qword [r11 - 0x78], 0
mov dword [rbp + 0x27], 0x30
mov dword [rbp + 0x3f], 0x200
movdqu xmmword [rbp + 0x47], xmm0
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
jns 0x140004dfc
xor al, al
jmp 0x140004ebd
mov rcx, qword [rbp + 7]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov edx, dword [0x14000a450]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov qword [0x14000a7d0], rax
test rax, rax
je 0x140004e84
mov r8d, dword [0x14000a450]
lea rdx, [0x140004534]
mov rcx, rax
call fcn.140006ec0
and qword [rsp + 0x30], 0
lea rax, [0x140004bb0]
and qword [rbp + 0x2f], 0
lea r8, [rbp + 0x27]
and qword [rbp + 0x37], 0
lea rcx, [rbp + 7]
mov qword [rsp + 0x28], rax
xorps xmm0, xmm0
and qword [rsp + 0x20], 0
xor r9d, r9d
mov edx, 0x1fffff
mov dword [rbp + 0x27], 0x30
mov dword [rbp + 0x3f], 0x200
movdqu xmmword [rbp + 0x47], xmm0
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
lea rdx, [rbp + 0xf]
lea rcx, [0x14000bda0]
call qword [sym.imp.ntoskrnl.exe_KeAcquireInStackQueuedSpinLock]
lea rcx, [rbp + 0xf]
mov word [0x14000a7bc], si
mov word [0x14000a7c0], di
mov word [0x14000a7c4], bx
mov byte [0x14000a7b8], 1
call qword [sym.imp.ntoskrnl.exe_KeReleaseInStackQueuedSpinLock]
mov al, 1
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x140005498
Capabilities:
Create thread

Disassembly:
sub rsp, 0x78
cmp qword [0x14000a808], 0
je 0x1400054aa
mov al, 1
jmp 0x14000551a
cmp byte [0x14000a800], 0
jne 0x1400054b7
xor al, al
jmp 0x14000551a
and qword [rsp + 0x30], 0
lea rax, [0x140005520]
and qword [rsp + 0x48], 0
lea r8, [rsp + 0x40]
and qword [rsp + 0x50], 0
lea rcx, [0x14000a808]
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor r9d, r9d
mov edx, 0x1fffff
mov byte [0x14000a801], 1
mov dword [rsp + 0x40], 0x30
mov dword [rsp + 0x58], 0x200
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
setns al
add rsp, 0x78
ret

Function at 0x140005c60
Capabilities:
Create thread

Disassembly:
sub rsp, 0x78
cmp qword [0x14000a828], 0
je 0x140005c72
mov al, 1
jmp 0x140005cce
and qword [rsp + 0x30], 0
lea rax, [0x14000565c]
and qword [rsp + 0x48], 0
lea r8, [rsp + 0x40]
and qword [rsp + 0x50], 0
lea rcx, [0x14000a828]
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
xor r9d, r9d
mov edx, 0x1fffff
mov dword [rsp + 0x40], 0x30
mov dword [rsp + 0x58], 0x200
movdqu xmmword [rsp + 0x60], xmm0
call qword [sym.imp.ntoskrnl.exe_PsCreateSystemThread]
test eax, eax
setns al
add rsp, 0x78
ret
Function at 0x140006308
Capabilities:
Hash data with crc32

Disassembly:
xor ecx, ecx
lea rdx, [0x14000a830]
mov eax, ecx
mov r8d, 8
test al, 1
je 0x140006326
shr eax, 1
xor eax, 0xedb88320
jmp 0x140006328
shr eax, 1
sub r8, 1
jne 0x140006319
mov dword [rdx], eax
inc ecx
add rdx, 4
cmp ecx, 0x100
jb 0x140006311
ret

Function at 0x1400065e0
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rsi, rdx
mov dword [rbp + 0x17], 0x30
xor edx, edx
mov r14, rcx
lea rcx, [rbp + 0x1f]
mov edi, 0xc0000001
lea r8d, [rdx + 0x28]
call fcn.140006dc0
and qword [rbp + 0x67], 0
xor eax, eax
and dword [rbp + 7], 0
mov dword [rbp + 0xb], eax
mov qword [rbp + 0xf], rax
test r14, r14
je 0x14000673d
test rsi, rsi
je 0x14000673d
mov edx, 0x1018
xor ecx, ecx
mov r8d, 0x52454e4d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
jne 0x140006664
mov edi, 0xc0000017
jmp 0x14000672e
xor eax, eax
mov rdi, rbx
mov ecx, 0x1018
mov edx, 0x800
rep stosb byte [rdi], al
and qword [rbx + 8], rax
lea rcx, [rbx + 0x14]
mov byte [rbx], al
movzx eax, word [rsi]
mov dword [rbx + 0x10], eax
movzx r9d, word [rsi]
mov r8, qword [rsi + 8]
shr r9, 1
call fcn.140005dcc
and dword [rsp + 0x50], 0
lea r9, [rbp + 7]
and qword [rsp + 0x48], 0
lea r8, [rbp + 0x17]
and qword [rbp + 0x1f], 0
lea rcx, [rbp + 0x67]
mov dword [rsp + 0x40], 0x28
mov eax, 1
mov dword [rsp + 0x38], eax
xorps xmm0, xmm0
mov dword [rsp + 0x30], eax
mov edx, 0x110000
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rbp + 0x17], 0x30
mov dword [rbp + 0x2f], 0x240
mov qword [rbp + 0x27], r14
movdqu xmmword [rbp + 0x37], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov edi, eax
test eax, eax
js 0x140006720
mov rcx, qword [rbp + 0x67]
lea rdx, [rbp + 7]
mov r9d, 0x1018
mov dword [rsp + 0x20], 0xa
mov r8, rbx
call qword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov edi, eax
mov edx, 0x52454e4d
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rbp + 0x67]
test rcx, rcx
je 0x14000673d
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea r11, [rsp + 0xa0]
not edi
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
shr edi, 0x1f
mov al, dil
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140006870
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push rbp
lea rbp, [r11 - 0x5f]
sub rsp, 0xa0
and dword [rbp + 0x17], 0
lea r9, [rbp + 0x17]
xor eax, eax
mov qword [rbp + 0x37], rcx
and dword [rsp + 0x50], eax
lea rcx, [rbp + 0x67]
and qword [r11 - 0x60], rax
mov edi, r8d
and qword [rbp + 0x2f], rax
lea r8, [rbp + 0x27]
mov dword [rsp + 0x40], 0x860
mov rsi, rdx
mov dword [rsp + 0x38], 3
xorps xmm0, xmm0
mov dword [rsp + 0x30], 1
mov edx, 0x40100000
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], rax
mov dword [rbp + 0x1b], eax
mov qword [rbp + 0x1f], rax
mov dword [rbp + 0x27], 0x30
mov dword [rbp + 0x3f], 0x240
movdqu xmmword [rbp + 0x47], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
js 0x140006938
and qword [rsp + 0x40], 0
lea rax, [rbp + 0x17]
and qword [rsp + 0x38], 0
xor r9d, r9d
mov rcx, qword [rbp + 0x67]
xor r8d, r8d
mov dword [rsp + 0x30], edi
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
mov ebx, eax
mov rcx, qword [rbp + 0x67]
test rcx, rcx
je 0x140006947
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea r11, [rsp + 0xa0]
not ebx
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
shr ebx, 0x1f
mov al, bl
mov rbx, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x14001c54b
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
call fcn.1400dca94
js 0x14001c58f
int3
xor r11d, r11d
mov qword [rsp + 0x50], r12
mov byte [rsp], 0x41
mov byte [rsp + 1], 0x42
mov byte [rsp + 2], 0x43
lea r12, [r8 + rax]
mov byte [rsp + 3], 0x44
mov byte [rsp + 4], 0x45
mov byte [rsp + 5], 0x46
mov byte [rsp + 6], 0x47
mov byte [rsp + 7], 0x48
mov byte [rsp + 8], 0x49
mov byte [rsp + 9], 0x4a
mov byte [rsp + 0xa], 0x4b
mov byte [rsp + 0xb], 0x4c
mov byte [rsp + 0xc], 0x4d
mov byte [rsp + 0xd], 0x4e
mov byte [rsp + 0xe], 0x4f
mov byte [rsp + 0xf], 0x50
mov byte [rsp + 0x10], 0x51
mov byte [rsp + 0x11], 0x52
mov byte [rsp + 0x12], 0x53
mov byte [rsp + 0x13], 0x54
mov byte [rsp + 0x14], 0x55
mov byte [rsp + 0x15], 0x56
mov byte [rsp + 0x16], 0x57
mov byte [rsp + 0x17], 0x58
mov byte [rsp + 0x18], 0x59
mov byte [rsp + 0x19], 0x5a
mov byte [rsp + 0x1a], 0x61
mov byte [rsp + 0x1b], 0x62
mov byte [rsp + 0x1c], 0x63
mov byte [rsp + 0x1d], 0x64
mov byte [rsp + 0x1e], 0x65
mov byte [rsp + 0x1f], 0x66
mov byte [rsp + 0x20], 0x67
mov byte [rsp + 0x21], 0x68
mov byte [rsp + 0x22], 0x69
mov byte [rsp + 0x23], 0x6a
mov byte [rsp + 0x24], 0x6b
mov byte [rsp + 0x25], 0x6c
mov byte [rsp + 0x26], 0x6d
mov byte [rsp + 0x27], 0x6e
mov byte [rsp + 0x28], 0x6f
mov byte [rsp + 0x29], 0x70
mov byte [rsp + 0x2a], 0x71
mov byte [rsp + 0x2b], 0x72
mov byte [rsp + 0x2c], 0x73
mov byte [rsp + 0x2d], 0x74
mov byte [rsp + 0x2e], 0x75
mov byte [rsp + 0x2f], 0x76
mov byte [rsp + 0x30], 0x77
mov byte [rsp + 0x31], 0x78
mov byte [rsp + 0x32], 0x79
mov byte [rsp + 0x33], 0x7a
mov byte [rsp + 0x34], 0x30
mov byte [rsp + 0x35], 0x31
mov byte [rsp + 0x36], 0x32
mov byte [rsp + 0x37], 0x33
mov byte [rsp + 0x38], 0x34
mov byte [rsp + 0x39], 0x35
mov byte [rsp + 0x3a], 0x36
mov byte [rsp + 0x3b], 0x37
mov byte [rsp + 0x3c], 0x38
mov byte [rsp + 0x3d], 0x39
mov byte [rsp + 0x3e], 0x2b
mov byte [rsp + 0x3f], 0x2f
mov rcx, r8
mov rdx, r11
test rbx, rbx
je 0x14001c7b1
add r8, 4
nop dword [rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14001c709
mov r11d, 2
jmp 0x14001c72d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14001c723
mov r11d, 1
jmp 0x14001c72d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, r12
ja 0x14001c7d4
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14001c772
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14001c78a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14001c79a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14001c7a8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14001c6f0
sub rcx, rsi
mov al, 1
mov qword [rbp], rcx
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor al, al
jmp 0x14001c7ba
Function at 0x14001c560
Capabilities:
Contain obfuscated stackstrings
Encode data using base64
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14001c58c
xor al, al
jmp 0x14001c7bf
mov rax, qword [r9]

Function at 0x1400362b0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rcx
test rax, 7
je 0x1400362cd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x140036328
test al, 7
jne 0x1400362c0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1400362e1
mov rdx, qword [rax - 8]
test dl, dl
je 0x140036352
test dh, dh
je 0x14003634c
shr rdx, 0x10
test dl, dl
je 0x140036346
test dh, dh
je 0x140036340
shr rdx, 0x10
test dl, dl
je 0x14003633a
test dh, dh
je 0x140036334
shr edx, 0x10
test dl, dl
je 0x14003632e
test dh, dh
jne 0x1400362e1
lea rax, [rcx + rax - 1]
ret
lea rax, [rcx + rax - 2]
ret
lea rax, [rcx + rax - 3]
ret
lea rax, [rcx + rax - 4]
ret
lea rax, [rcx + rax - 5]
ret
lea rax, [rcx + rax - 6]
ret
lea rax, [rcx + rax - 7]
ret
lea rax, [rcx + rax - 8]
ret
Function at 0x14010e1f3
Capabilities:
Encode data using xor

Disassembly:
call fcn.1400c5464
mov dh, 0x4f
mov bl, 0xa6
mov bh, 0x8c
sbb al, dh
pop rsi
call 0x161787104
pop rsi
mov eax, 0xa1ddd1c3
mov gs, word [rbx + rbx + 0x31]
jne 0x1400af7fe
xchg esi, eax
cmp al, 0x93
mov ch, 0xe5
popfq
mov esi, 0xc5593b54
mov cl, 0x86
push rsp
jae 0x1400af7fe
add byte es:[rsp + riz*8 + 0xe342619], cl
invalid
loopne 0x1400af80c
mov edx, 0xde6e1a39
invalid
in al, dx
xchg ebx, eax
xchg ah, dh
pop rbp
outsd dx, dword [rsi]
xor dword [r8 - 0x30], 0x2e
jae 0x1400af894
in al, 0xcc
ficomp word [rcx + 0x39]
fidivr word [rax - 0x3c]
test ah, al
out 0xe, al
pushfq
fdiv qword [rax - 0x7e]
invalid
invalid
mov r10, qword [rsp + r10 - 0x1bc35a8c]
mov cl, 0x87
mov qword [rsp + 0x38], 0xfffffffffb229609
lea rcx, [rcx + rcx*2 - 0x59c17b73]
jbe 0x1401203d8
add qword [rsp + 0x58], 0x20b3d715
mov rcx, qword [rsp + 0x18]
and dword [rsp + 0x58], 0xf61a3687
test byte [rsp + 0x38], 7
jno 0x140159b8d
push rcx
call fcn.14015a39a
sub byte [rsp + 0x58], 0x2f
add qword [rsp + 8], 0xffffffffbfeddd7b
add word [rsp + 0x38], 0xd328
call fcn.140019f9b
push r13
push 0x7aa55fb6
xchg qword [rsp + 0x40], rbx
mov r8, qword [rsp + r8 - 0x6af51855]
and r12, qword [rsp + 8]
ja 0x14017294a
cmc
jmp 0x140159c21
sub dh, byte [rsi - 0x4d]
sbb eax, dword [edi - 0x49]
call 0xd9442fb3
adc ebp, dword [rsi]
push rbx
in al, 0xbe
add eax, 0x2c8745ba
cmp byte [rax - 0x7d62a088], 0xb9
call 0x12476ef72
pop rbp
push rax
and dword [rbx], esp
loopne 0x140159c59
fistp word [0xf6573ad9]
movabs al, byte [0x9c1a655829ab8eae]
or al, 0x2a
dec byte [rbx + rbp*4]
stc
movsd dword [rdi], dword [rsi]
invalid
ret 0x5309
and al, dl
cdq
sbb eax, 0x4ef12b82
mov dword [rdi], edx
and al, 0xc
shl byte [rax], 1
test al, 0xf
wait
movabs ax, word [0x4f92ea7e9a276725]
cmpsb byte [rsi], byte [rdi]
test eax, 0x855794ac
mov ecx, 0x14345ed1
jbe 0x14015d793
pop rdx
jle 0x14015d717
mov esi, 0x5905439a
pop rcx
invalid
or byte [rsi + rcx], dl
sbb dword [rdx + 0x40], eax
adc byte [rbx], ch
imul cl
loop 0x14015d763
push 0x5a41367c
lahf
mov rsi, fs
leave
invalid
cwde
cmp byte [rbx + 0x16], bh

Function at 0x14012267e
Capabilities:
Encode data using xor

Disassembly:
call fcn.14001dd97
rcr esi, cl
lea esp, [rax - 0x67ba813d]
mov bl, 0x5e
pop rbp
add dword [rbx - 0x3a], ebp
in eax, 0x69
sti
xchg byte [rbp - 0x4f], bl
xor edi, esi
int 0x11
mov ebx, 0x830995d7
jg 0x140122687
ret
sbb byte [rbx], al
push rsi
xor al, 0xe0
ror qword [rax], cl
mov edi, 0xfffc94d8
jrcxz 0x1401226c0
invalid
cld
rol byte [rax], 1
in al, 0xcc
lock and dh, byte [rdx + rdx*8 - 0x7436d2d]
cld
adc al, 0x93
add al, 0x98
mov esi, 0xdd889c85
or bl, byte [rdi + 0x1c14df3c]
ja 0x12e1daccc
xor eax, 0x22a4fea5
wait
mov byte [rax], al
push rcx
cli
invalid

Function at 0x140179d91
Capabilities:
Packed with generic packer

Disassembly:
xchg qword [rsp + 0x58], rdi
mov r15, qword [rsp + 0x18]
call fcn.1400d39ba
Function at 0x14017f54c
Capabilities:
Encode data using xor

Disassembly:
call fcn.14011f52b
iretd
mov rsi, qword [rsp + 0x18]
mov rsi, qword [rsi]
add r14w, 0x8f1a
mov qword [rsp + 0x18], r14
neg r14b
push r10
mov r10, qword [rsp + 0x20]
lea rsi, [rsi + 0x3429969b]
push r8
test r10, r10
mov r8, r14
jb 0x140008918
and byte [rsp + 0x28], 0x81
push 0x65103f23
bswap r10
call fcn.1401b561c
wait
add al, 0x93
sbb al, 0x4e
jmp 0x14017f5eb
mov word [rbx + rdx*2 - 0x73fb2ac], ds
cmpsd dword [rsi], dword [rdi]
invalid

Function at 0x1401acb73
Capabilities:
Encode data using xor

Disassembly:
jne 0x140192d00
or dword [rdx - 0x5e0f514e], edx
or esp, ebx
pop rax
test al, 0xc9
shl byte [rax + rsi*8], 1
movabs byte [0x59a67c98a5238b25], al
pop rcx
wait
xchg esp, eax
mov byte [rsi + 0x4b], dh
xchg dword [rdi], edi
invalid

Function at 0x1401b63e7
Capabilities:
Packed with generic packer

Disassembly:
mov r13, qword [rsp + 0x30]
jae 0x14009e450
cmpsb byte [rsi], byte [rdi]
adc al, 0x93
mov cl, 0xed
xchg ecx, eax
mov esi, 0x7d414368
or dword [rsi], edi
in al, dx
retf
popfq
jge 0x1400ad158
jmp 0x1401b63a9