joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e1c50
Capabilities:
Allocate or change rwx memory
Set console window title

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rbp - 0x20]
call fcn.1400e2068
cmp qword [rax + 0x18], 0xf
jbe 0x1400e1c76
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400e1cbd
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e1cb8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400e1cb8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401df894
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor esi, esi
test rax, rax
je 0x1400e1dab
movsxd rcx, dword [rax + 0x3c]
lea r14d, [rsi + 8]
add rcx, rax
mov qword [rbp + 0x40], rcx
mov ecx, r14d
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, qword [rbp + 0x40]
mov edi, esi
mov qword [rbp + 0x48], rax
movzx eax, word [rcx + 0x14]
lea rbx, [rcx + 0x18]
add rbx, rax
cmp si, word [rcx + 6]
jae 0x1400e1d51
mov edx, Ordinal_41
lea r9, [rbp + 0x30]
mov rcx, rbx
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, dword [rbp + 0x30]
lea r9, [rbp + 0x30]
mov edx, Ordinal_41
mov byte [rbx], al
mov rcx, rbx
mov byte [rbx + 1], sil
mov qword [rbx + 8], rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rbp + 0x40]
inc edi
add rbx, 0x28
movzx ecx, word [rax + 6]
cmp edi, ecx
jb 0x1400e1d03
mov r8, r14
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x48]
call sub.VCRUNTIME140.dll_memcpy
mov r8, r14
lea rcx, [rbp + 0x48]
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea r9, [rbp + 0x38]
mov r8d, 0x40
mov rdx, r14
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8, r14
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [rbp + 0x38]
lea r9, [rbp + 0x38]
mov rdx, r14
lea rcx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400e27dc
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rbx, rcx
mov r9d, 3
lea r8, [0x1401f0614]
xor edx, edx
call fcn.140085a70
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rbp - 0x19]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp - 0x19], reloc.WS2_32.dll_WSASetLastError
mov dword [rbp - 0x15], 0x40
and qword [rbp - 0x11], 0
and qword [rbp - 9], 0
lea rax, str.cmd.exe
mov qword [rbp - 1], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400e2849
mov rax, qword [rbx]
mov qword [rbp + 7], rax
and qword [rbp + 0xf], 0
and dword [rbp + 0x17], 0
and qword [rbp + 0x1f], 0
lea rcx, [rbp - 0x19]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp eax, 1
jne 0x1400e2890
or edx, 0xffffffff
mov rcx, qword [rbp + 0x4f]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rbp + 0x67]
mov rcx, qword [rbp + 0x4f]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rbp + 0x4f]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400e28c6
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400e28c1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400e28e7
mov rcx, r8
call fcn.1401df894
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400ed5b8
Capabilities:
Check for debugger via api

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1400ed5f0
and dword [rsp + 0x30], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
test eax, eax
je 0x1400ed5ec
cmp dword [rsp + 0x30], 1
sete al
jmp 0x1400ed5f2
xor al, al
jmp 0x1400ed5f2
mov al, 1
add rsp, 0x28
ret

Function at 0x1400ed5f8
Capabilities:
Hide thread from debugger

Disassembly:
sub rsp, 0x28
lea rcx, [0x1401e8f58]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400ed633
lea rdx, str.NtSetInformationThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400ed633
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
lea rcx, [r9 - 2]
call rax
add rsp, 0x28
ret
Function at 0x1400f2710
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x1400f2744
mov eax, esi
lea ecx, [rax + 0x31]
xor byte [r8 + rax], cl
inc rax
cmp rax, 5
jb 0x1400f2730
mov byte [r8 + 6], sil
add r8, 5
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400f2220
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400f2769
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140085a70
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400f27e3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f27de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f27de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401df894
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400f27f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x1400f2824
mov eax, esi
lea ecx, [rax + 0x31]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x1400f2810
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400f2220
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400f2849
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140085a70
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400f28c3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f28be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f28be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401df894
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400f28d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 8], sil
je 0x1400f2904
mov eax, esi
lea ecx, [rax + 0x31]
xor byte [r8 + rax], cl
inc rax
cmp rax, 7
jb 0x1400f28f0
mov byte [r8 + 8], sil
add r8, 7
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400f2220
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400f2929
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140085a70
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400f29a3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f299e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f299e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401df894
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400f29b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 9], bl
je 0x1400f29e4
mov ecx, ebx
lea eax, [rcx + 0x31]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x1400f29d0
mov byte [r8 + 9], bl
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.1400f2220
nop
cmp byte [rdi + 9], 0
je 0x1400f2a14
lea eax, [rbx + 0x31]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 8
jb 0x1400f2a01
mov byte [rdi + 9], 0
lea r8, [rdi + 8]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400f2220
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.1400c8ba4
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400f2a84
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f2a7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f2a7e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401df894
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400f2ac4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f2abf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f2abf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401df894
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400f2ad0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x1400f2b04
mov eax, esi
lea ecx, [rax + 0x31]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x1400f2af0
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400f2220
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400f2b29
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140085a70
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400f2ba3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f2b9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f2b9e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401df894
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400f2bb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 0xb], bl
je 0x1400f2be4
mov ecx, ebx
lea eax, [rcx + 0x31]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1400f2bd0
mov byte [r8 + 0xb], bl
add r8, 0xa
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.1400f2220
nop
cmp byte [rdi + 0xb], 0
je 0x1400f2c14
lea eax, [rbx + 0x31]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 0xa
jb 0x1400f2c01
mov byte [rdi + 0xb], 0
lea r8, [rdi + 0xa]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400f2220
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.1400c8ba4
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400f2c84
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f2c7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f2c7e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401df894
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400f2cc4
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f2cbf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f2cbf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401df894
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400f2cd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1400f2d04
mov eax, esi
lea ecx, [rax + 0x31]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x1400f2cf0
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400f2220
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x1400f2d29
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140085a70
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400f2da3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400f2d9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400f2d9e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401df894
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400f8670
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x14033ee00]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rdx
mov r14, rcx
xor ebx, ebx
mov byte [rcx], 3
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
lea ecx, [rbx + 0x20]
call fcn.1401df858
mov rsi, rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rsi
cmp byte [rdi + 0xb], bl
je 0x1400f86d3
nop
lea eax, [rbx + 0x31]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 0xa
jb 0x1400f86c0
mov byte [rdi + 0xb], 0
lea r8, [rdi + 0xa]
lea r9, [rsp + 0x20]
mov rdx, rdi
mov rcx, rsi
call fcn.1400f2220
nop
mov qword [r14 + 8], rsi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401e0060
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret

Function at 0x1400f96a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x1400f96c3
lea edx, [rax + 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x1400f96b0
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.1400f2220
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1400fad70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x1400fad93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x31]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x1400fad80
mov byte [rcx + 5], 0
mov rax, rcx
ret
Function at 0x1400fc970
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rcx
mov ecx, r9d
test r8, r8
je 0x1400fca57
sub r10, rdx
cmp r8, 8
jb 0x1400fca2c
mov rax, r8
lea r9, [rdx + 4]
and rax, 0xfffffffffffffff8
xorps xmm3, xmm3
xorps xmm2, xmm2
movd xmm1, dword [r10 + r9 - 4]
add rcx, 8
movd xmm0, dword [r9 - 4]
lea r9, [r9 + 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklbw xmm0, xmm0
psrad xmm1, 0x18
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
xorps xmm1, xmm0
movd xmm0, dword [r9 - 8]
punpcklbw xmm0, xmm0
orps xmm3, xmm1
movd xmm1, dword [r10 + r9 - 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklwd xmm0, xmm0
psrad xmm1, 0x18
psrad xmm0, 0x18
xorps xmm1, xmm0
orps xmm2, xmm1
cmp rcx, rax
jb 0x1400fc9a0
orps xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
orps xmm2, xmm0
movd r9d, xmm2
cmp rcx, r8
jae 0x1400fca57
lea rax, [rcx + rdx]
sub r8, rcx
nop dword [rax]
nop word [rax + rax]
movsx edx, byte [r10 + rax]
movsx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r9d, edx
sub r8, 1
jne 0x1400fca40
test r9d, r9d
sete al
ret
Function at 0x140105500
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.140105750
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x14010561a
mov rax, qword [0x14033ed40]
cmp qword [rsp + 0x20], rax
jb 0x140105564
mov rax, qword [0x14033ed48]
cmp qword [rsp + 0x20], rax
ja 0x140105564
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x140105526
mov r8d, Ordinal_50
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, Ordinal_50
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x140105595
jmp 0x14010561a
cmp dword [rsp + 0x50], 0x10000
jne 0x1401055fd
cmp qword [rsp + 0x48], 0x10000
jb 0x1401055fd
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1401055db
mov rax, qword [rsp + 0x28]
jmp 0x14010561c
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x1401055eb
xor eax, eax
jmp 0x14010561c
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x140105615
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.140105750
mov qword [rsp + 0x20], rax
jmp 0x140105526
xor eax, eax
add rsp, 0x68
ret

Function at 0x140105630
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.140105790
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x140105746
mov rax, qword [0x14033ed40]
cmp qword [rsp + 0x20], rax
jb 0x14010568b
mov rax, qword [0x14033ed48]
cmp qword [rsp + 0x20], rax
ja 0x14010568b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x14010564d
mov r8d, Ordinal_50
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, Ordinal_50
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
jne 0x1401056bc
jmp 0x140105746
cmp dword [rsp + 0x50], 0x10000
jne 0x140105724
cmp qword [rsp + 0x48], 0x10000
jb 0x140105724
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x140105702
mov rax, qword [rsp + 0x28]
jmp 0x140105748
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
jne 0x140105712
xor eax, eax
jmp 0x140105748
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x140105741
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140105790
mov qword [rsp + 0x20], rax
jmp 0x14010564d
xor eax, eax
add rsp, 0x68
ret
Function at 0x1401057e0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.140105d70
mov qword [rsp + 0x28], 0
cmp qword [0x14034bbd0], 0
jne 0x140105828
cmp qword [0x14034bbc8], 0
je 0x140105828
mov rax, qword [0x14034bbc8]
mov qword [0x14034bbd0], rax
cmp qword [0x14034bbd0], 0
je 0x1401058ce
mov rax, qword [0x14034bbd0]
cmp qword [rax + 0x10], 0
je 0x1401058ce
mov rax, qword [0x14034bbd0]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1401058ce
mov rax, qword [0x14034bbd0]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1401058ce
mov rax, qword [0x14034bbd0]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x140105894
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x14010589b
xor eax, eax
jmp 0x140105a45
mov rax, qword [0x14034bbd0]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x140105a45
mov rax, qword [0x14034bbc8]
mov qword [0x14034bbd0], rax
jmp 0x1401058f0
mov rax, qword [0x14034bbd0]
mov rax, qword [rax + 8]
mov qword [0x14034bbd0], rax
cmp qword [0x14034bbd0], 0
je 0x14010593d
cmp qword [0x14034bbd0], 0
je 0x14010593b
mov rax, qword [0x14034bbd0]
cmp qword [rax + 0x10], 0
je 0x14010593b
mov rax, qword [0x14034bbd0]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x14010593b
mov rax, qword [0x14034bbd0]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x14010593b
jmp 0x14010586c
jmp 0x1401058de
mov rax, qword [rsp + 0x60]
and rax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.140105a50
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x140105a43
mov rax, qword [rsp + 0x48]
mov qword [0x14034bbd0], rax
mov rax, qword [0x14034bbd0]
mov dword [rax], 0x52727464
mov rax, qword [0x14034bbd0]
mov qword [rax + 0x10], 0
mov rax, qword [0x14034bbd0]
mov rcx, qword [0x14034bbc8]
mov qword [rax + 8], rcx
mov rax, qword [0x14034bbd0]
mov qword [0x14034bbc8], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x14034bbd0]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x1401059f4
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x140105a2e
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x1401059ea
mov rax, qword [0x14034bbd0]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x14010586c
xor eax, eax
add rsp, 0x58
ret