joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400207ac
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
mov eax, 0x2020
call fcn.140024fc0
sub rsp, rax
xor r14d, r14d
mov rsi, r8
mov rbx, rcx
test r9, r9
je 0x1400207df
mov byte [r9], r14b
mov rcx, qword [rsp + 0x2050]
test rcx, rcx
je 0x1400207ef
mov byte [rcx], r14b
test rbx, rbx
je 0x1400208a4
movzx eax, word [rbx]
test ax, ax
je 0x1400208a4
movsxd rbp, dword [rsp + 0x2058]
mov rdi, r14
mov r8d, r14d
add rbx, 2
cmp ax, 0x3d
jne 0x140020834
test rsi, rsi
je 0x140020840
test rdi, rdi
jne 0x140020840
test r9, r9
je 0x14002082f
mov byte [r9], 1
mov rdi, rdx
jmp 0x14002084f
cmp ax, 0xd
je 0x140020861
cmp ax, 0xa
je 0x140020865
mov word [rdx], ax
add rdx, 2
lea eax, [rbp - 2]
cmp r8d, eax
jge 0x14002085c
movzx eax, word [rbx]
inc r8d
test ax, ax
jne 0x140020812
jmp 0x140020865
mov byte [rcx], 1
jmp 0x140020865
add rbx, 2
mov word [rdx], r14w
test rsi, rsi
je 0x14002089f
mov word [rsi], r14w
test rdi, rdi
je 0x14002089f
mov r8d, 0x1000
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r8, rbp
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.140013f60
mov word [rdi], r14w
mov rax, rbx
jmp 0x1400208a6
xor eax, eax
lea r11, [rsp + 0x2020]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret

Function at 0x1400208c4
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov ebx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
xor ecx, ecx
test eax, eax
sete bl
test eax, eax
jne 0x140020930
mov rcx, qword [rsp + 0x50]
mov rdx, rdi
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rsp + 0x58]
cmp eax, 1
mov rdx, qword [rsp + 0x50]
sete bl
mov rax, qword [rcx]
mov rax, qword [rax + 0x28]
call qword [0x14003f510]
jmp 0x140020933
mov word [rdi], cx
mov al, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140023574
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
and dword [0x140061c80], 0
mov edx, 1
mov rbx, rcx
mov byte [0x14005a85c], 1
mov byte [0x14005a85d], 1
call qword [sym.imp.USER32.dll_ShowWindow]
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 2]
call fcn.1400011a0
cmp qword [0x140072310], 0
jne 0x1400235bf
cmp byte [0x14005a862], 0
je 0x1400235c8
cmp dword [0x14005a858], 0
jne 0x1400235dd
xor r9d, r9d
mov edx, 0x111
mov rcx, rbx
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
add rsp, 0x20
pop rbx
ret

Function at 0x1400236b0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x1050
call fcn.140024fc0
sub rsp, rax
xor edi, edi
mov rbx, rcx
cmp byte [0x140063c98], dil
je 0x140023782
cmp word [0x140063c9a], di
je 0x140023782
mov r8d, 0x800
lea rdx, [rsp + 0x50]
lea rcx, [0x140063c9a]
call fcn.140021ef8
lea rax, [rsp + 0x1068]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, str.SoftwareWinRAR_SFX
lea rax, [rsp + 0x1070]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140023782
mov rcx, rbx
call fcn.14002b768
lea r9d, [rdi + 1]
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea ecx, [rax*2 + 2]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x1070]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x1070]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x1060]
add rsp, 0x1050
pop rdi
ret

Function at 0x140023794
Capabilities:
Set environment variable

Disassembly:
push rbx
mov eax, 0x2020
call fcn.140024fc0
sub rsp, rax
mov rbx, rcx
mov rdx, rcx
lea rcx, str.sfxcmd
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r8d, 0x1000
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140013c78
mov rbx, rax
test rax, rax
je 0x1400237f6
movzx ecx, word [rax]
jmp 0x1400237dd
add rbx, 2
movzx ecx, word [rbx]
call fcn.140013da0
test al, al
jne 0x1400237d6
mov rdx, rbx
lea rcx, str.sfxpar
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x2020
pop rbx
ret
Function at 0x1400248e4
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x14002495c
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x14002495c
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x14002495c
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x140024950
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x14002496e
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x14002493e
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x14002495e

Function at 0x1400258fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140025946
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140025946
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140025946
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140025946
cmp dword [rcx + 0x84], 0xe
jbe 0x140025946
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140025948
xor al, al
add rsp, 0x28
ret

Function at 0x140031664
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140031454
Function at 0x140036654
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140036684
xor eax, eax
jmp 0x140036747
mov rbp, rbx
cmp word [rax], si
je 0x1400366a9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140036690
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14003668c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400365a4
movsxd r14, eax
test eax, eax
jne 0x1400366e7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14003667d
mov rcx, r14
call fcn.140032f00
mov rdi, rax
test rax, rax
jne 0x140036700
xor ecx, ecx
call fcn.140032d54
jmp 0x1400366dc
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400365a4
test eax, eax
jne 0x140036731
mov rcx, rdi
call fcn.140032d54
jmp 0x14003673b
xor ecx, ecx
call fcn.140032d54
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020640]
call fcn.1400123b8
lea rcx, [0x140021210]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push rax
xchg ebp, eax
xchg r15, rax
adc dword [rax - 0x78], esp
movsd dword [rdi], dword [rsi]
in al, dx
jmp 0xcedc6933
sub bl, byte [rdx + 0x361e25fe]
movabs al, byte [0xddb83971adfa16b8]
xchg ecx, eax
or r11b, byte [r9]
iretd
loopne case.0x140007272.8
xchg ecx, eax
jb 0x14003f717
pop rcx
test byte [rbp - 9], dl
shr byte [rbx + 0x783ea885], 0xa6
and dword [rdx - 0x3a], ebp
xlatb
xor eax, dword [rbx - 0x43]
mov ebp, 0xca7f5da2
ror byte [rcx - 0x70], 0x13
invalid
jle 0x1aba38427
invalid
mov ebp, 0xca7f5da2
ror byte [rcx - 0x70], 0x13
invalid
outsd dx, dword [rsi]
and al, 0xbf
and al, 0xbf
and al, 0xbf
mov byte [rbx], cl
invalid
retf
mov ebp, 0xe8b1fcde
xor bh, byte [rcx + rax*8]
hlt
lodsb al, byte [rsi]
invalid
movabs dword [0x831809e5d587ad79], eax
invalid
xchg ebp, edx
in eax, 9
sbb byte [rbx - 0x77e853a], al
jle 0x14003f776
jmp 0x18ea65bb4
or eax, 0xfc388559
fdivr dword [rbx + 0x1f1180c7]
push rbp
invalid
loope 0x14003f7d9
enter 0x5e95, 0xffffffffffffffa8
and dword [rbx - 0x3478dd95], ecx
insb byte [rdi], dx
and dh, ah
or al, 0x68
jbe 0x14003f764
stosb byte [rdi], al
pop rdx
cwde
mov ch, 0x77
adc dh, cl
sub byte [rsi], dh
mov ecx, gs
push rsi
invalid
jno 0x14003f789
xchg esi, eax
adc edx, dword [rdx + 0x24]
sub eax, 0xa4a03ccc
xor ch, byte [rax + 0x2a1b5eb2]
invalid
Function at 0x1400111fe
Capabilities:
Terminate process

Disassembly:
jmp 0x140013150
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011285
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014490
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400144b0
xor al, al
jmp 0x140014531
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400144c3
xor al, al
jmp 0x140014531
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400144ed
xor al, al
jmp 0x140014531
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014501
xor al, al
jmp 0x140014531
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014513
xor al, al
jmp 0x140014531
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001452f
xor al, al
jmp 0x140014531
mov al, 1
add rsp, 0x38
ret
Function at 0x140026040
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x140026157
xchg rbp, rbx
mov qword [rsp + 0x10], rbp
xchg rbp, rbx
xchg rbp, rsi
mov qword [rsp + 0x18], rsi
xchg rbp, rsi
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
xchg r11, rdi
mov qword [rsp + 0x30], r11
xchg rdi, r11
xchg rdx, r8
mov rbx, r8
xchg r8, rdx
xchg rcx, rbp
mov rdi, rbp
xchg rbp, rcx
mov esi, r8d
sub rdi, rdx
mov rbp, rcx
sub rdi, 0x68c3ce22
add rdi, 0x68c3cf12
dec rsi
shr rsi, 2
shr rsi, 1
shr rsi, 1
inc rsi
nop dword [rax]
xchg rbx, r13
movups xmm0, xmmword [r13]
xchg rbx, r13
xchg rsi, rdx
mov rsi, rbp
xchg rsi, rdx
mov rcx, rbx
call fcn.1400267f0
mov ecx, 0x3d55ffc6
xor ecx, 0x34579b3c
sub ecx, 0x3ea83e0
add ecx, 0x753117be
sub ecx, 0x264d5ed8
xor ecx, 0x557340ab
sub ecx, 0x688da9b
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140026106
add rdi, 0xfffffffffffffff0
movups xmmword [rbp + 0xf0], xmm0
sub rsi, 1
jne 0x1400260b4
xchg rdi, r9
mov r9, qword [rsp + 0x30]
xchg rdi, r9
mov rbx, qword [rsp + 0x38]
xchg r9, rbp
mov r9, qword [rsp + 0x40]
xchg r9, rbp
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rsi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140026160
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rbp
mov qword [rsp + 0x10], rdx
xchg rdx, rbp
xchg rsi, r12
mov qword [rsp + 0x18], r12
xchg r12, rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov edi, r8d
mov rbx, rdx
lea r9, [rcx + 0xf0]
xchg rsi, r8
mov r8, rcx
xchg r8, rsi
test r8d, r8d
je 0x140026236
dec rdi
shr rdi, 4
inc rdi
nop dword [rax]
nop word [rax + rax]
mov rax, rbx
sub r9, rbx
mov edx, 0x4b89c97a
xor edx, 0x4ea48f31
add edx, 0x70feb016
add edx, 0x24ae8c6
sub edx, 0x26a3d6cb
sub edx, 0x4f171621
add edx, 0x2c86ca23
sub edx, 0x2f42bc4e
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400261f9
xchg r10, rsi
mov rdx, r10
xchg rsi, r10
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.1400262d0
mov r9, rbx
sub rbx, 0xfffffffffffffff0
sub rdi, 1
jne 0x1400261bf
xchg r9, r11
movups xmm0, xmmword [r11]
xchg r11, r9
mov rbx, qword [rsp + 0x30]
xchg rbp, rbx
mov rbx, qword [rsp + 0x38]
xchg rbp, rbx
xchg rdx, rsi
movups xmmword [rdx + 0xf0], xmm0
xchg rdx, rsi
xchg rsi, r9
mov r9, qword [rsp + 0x40]
xchg rsi, r9
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1400279a0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rbx, rdi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x10
xchg r11, rbx
mov r11, rdx
xchg rbx, r11
xchg r9, rcx
mov r10, r9
xchg rcx, r9
test r8b, 0xf
je 0x1400279f9
xor al, al
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
push rdx
push rax
push rax
push rdx
push rdx
push rbx
push rax
xchg qword [rsp + 0x38], rdi
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]
xor edx, edx
test r8d, r8d
je 0x140027aae
movdqa xmm2, xmmword [rsp]
nop
xchg rdx, rsi
movdqu xmm1, xmmword [rsi + rbx]
xchg rsi, rdx
test edx, edx
jne 0x140027a2c
xchg r10, r13
movdqu xmm2, xmmword [r13 + 0x200]
xchg r10, r13
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
pxor xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0x55521650
xor ecx, 0x17af83df
xor ecx, 0x25bcd238
sub ecx, 0x669672a0
add ecx, 0xc0af19a
sub ecx, 0x52228f1
sub ecx, 0x7939db3
nop dword [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027a6e
aesdeclast xmm0, xmmword [r10 + 0x1e0]
pxor xmm0, xmm2
movdqa xmm2, xmm1
movups xmmword [rdx + r9], xmm0
nop
sub edx, 0x7654dc2d
add edx, 0x7654dc3d
cmp edx, r8d
jb 0x140027a0a
mov rbx, qword [rsp + 0x20]
mov al, 0x11
add al, 4
add al, 0x54
sub al, 0x25
sub al, 0xb
xor al, 0xb
xor al, 0x33
add rsp, 0x10
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1400298c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
nop
push 0x6b010144
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
xor ebx, ebx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x140029953
mov rdx, qword [rdi + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x140029936
xchg r10, r8
mov r10, qword [rcx - 8]
xchg r10, r8
nop
sub rdx, 0x741e7763
add rdx, 0x741e778a
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140029a12
xchg r8, rsi
mov rcx, rsi
xchg rsi, r8
call fcn.1401fc438
xchg rbx, rdx
mov qword [rdi + 0x18], rdx
xchg rdx, rbx
mov qword [rdi + 0x20], rbx
xchg rbx, r14
mov qword [rdi + 0x28], r14
xchg rbx, r14
mov rcx, qword [rdi + 8]
xchg r12, rax
mov r12, qword [rcx + 8]
xchg r12, rax
xchg rbx, rdi
mov qword [rax], rdi
xchg rdi, rbx
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400299c5
nop dword [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x64e85054
add edx, 0x17152aee
sub edx, 0x4db048a
sub edx, 0x4ceb83e1
sub edx, 0x178bf074
add edx, 0x2dec60f2
add edx, 0x9f30f56
xor edx, 0x315e100a
sub edx, 0x7bd46289
call fcn.1401fc438
mov rcx, rbx
test rbx, rbx
jne 0x14002997c
xchg rbx, rcx
mov rbx, qword [rdi + 8]
xchg rbx, rcx
mov edx, 0x6029f43c
sub edx, 0x3c3e5f78
xor edx, 0x1b474f09
sub edx, 0xdcfb432
xor edx, 0x12497d93
xor edx, 0x38945a10
xchg rbx, r8
mov r8, qword [rsp + 0x30]
xchg r8, rbx
add rsp, 0x20
push rcx
push rax
push rdx
xchg qword [rsp + 0x18], rdi
add rsp, 0x20
jmp fcn.1401fc438
push rcx
call 0x140b905ab
int3
Function at 0x14002cb20
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
xchg r10, rsi
mov qword [rsp + 0x18], r10
xchg r10, rsi
xchg rdi, rbp
mov qword [rsp + 0x20], rbp
xchg rdi, rbp
push r14
sub rsp, 0x30
mov rsi, rcx
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x60]
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
mov qword [rsp + 0x40], rbx
add rcx, 0xc8
xchg rbx, rdx
mov qword [rsp + 0x28], rdx
xchg rdx, rbx
mov dword [rsp + 0x20], 0x41efd68c
sub dword [rsp + 0x20], 0x18ecb5e9
xor dword [rsp + 0x20], 0x6a4c1ad6
xor dword [rsp + 0x20], 0x6e8b3dd7
xor dword [rsp + 0x20], 0x44c93245
sub dword [rsp + 0x20], 0x3e1c9fb0
sub dword [rsp + 0x20], 0x2af0962f
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b740
test eax, eax
js 0x14002cbd7
cmp qword [rsp + 0x40], rbx
je 0x14002cbd7
lea eax, [rbx + 1]
jmp 0x14002cd1a
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0x70], 2
jbe 0x14002cc1b
mov eax, 0x55f65ced
xor eax, 0x33007639
xor eax, 0x6287b514
xor eax, 0x408489e6
sub eax, 0xea75f46
add eax, 0x13a1c2e5
sub eax, 0xfc49983
sub eax, 0x3a2ae040
jmp 0x14002cd1a
cmp dword [rcx + 0x74], ebx
jbe 0x14002cc51
mov eax, 0x7d04b5c
add eax, 0x38f47f88
sub eax, 0x3e2ec281
add eax, 0x5caf13f1
sub eax, 0xeaea178
xor eax, 0x1fa92dc6
sub eax, 0x11a74fb5
sub eax, 0x3d980762
jmp 0x14002cd1a
cmp byte [rdi + 2], bl
je 0x14002cc87
mov eax, 0x7833bfc9
sub eax, 0x1f4e92dc
sub eax, 0x2458bfc7
sub eax, 0x14778817
xor eax, 0x64708480
sub eax, 0x1cf20a3a
add eax, 0x1d80d099
xor eax, 0x44f327ea
jmp 0x14002cd1a
cmp r14d, 0xa
jb 0x14002ccd3
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002ccd3
mov eax, 0x2a87126b
xor eax, 0x7802a881
sub eax, 0x2047e37c
add eax, 0x12b2676b
xor eax, 0x3d0beff0
sub eax, 0x1bef99a4
sub eax, 0x66b58ae
sub eax, 0x57a0decf
jmp 0x14002cd1a
lea rcx, [rsi + 0xb8]
mov edx, 0x149e2d0d
xor edx, 0x4b2271cc
sub edx, 0x225886
add edx, 0xe0ec568
sub edx, 0x26932187
xor edx, 0x433da845
add edx, 0x5ac1129c
xor edx, 0xc7708b6c
call fcn.14002c0a0
jmp 0x14002cd18
mov eax, ebx
xchg r12, rbx
mov r12, qword [rsp + 0x48]
xchg rbx, r12
xchg rsi, r13
mov r13, qword [rsp + 0x50]
xchg r13, rsi
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
push rbx
push rax
push rbx
push rbx
push rax
push rbx
xchg qword [rsp + 0x30], r14
pop rbx
pop rax
pop rbx
pop rbx
pop rax
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140033b80
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 0x10], rcx
xchg rcx, rbx
xchg rbp, r11
mov qword [rsp + 0x18], r11
xchg r11, rbp
nop
push r11
mov qword [rsp], rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg r8, rbx
mov r8, rbx
xchg rbx, r8
mov rsi, rdx
xchg rcx, rbx
mov rbp, rbx
xchg rcx, rbx
jne 0x140033c54
xchg rdi, rbx
mov qword [rsp + 0x30], rbx
xchg rdi, rbx
nop dword [rax]
nop dword [rax + rax]
xchg rdx, r8
mov rdx, qword [rbx + 0x10]
xchg r8, rdx
xchg rdx, rsi
mov rsi, rdx
xchg rsi, rdx
xchg r8, rcx
mov r8, rbp
xchg rcx, r8
call fcn.140033b80
xchg rbx, rdi
mov rbx, rdi
xchg rbx, rdi
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004c9a0
mov edx, 0x37e58f80
xor edx, 0x4a6433e9
xor edx, 0x28e240f4
add edx, 0x1cfb6fd6
sub edx, 0x17c9bcdd
xor edx, 0x7564e637
xor edx, 0x2ff149f1
xchg r14, rdi
mov rcx, r14
xchg r14, rdi
call fcn.1401fc438
cmp byte [rbx + 0x19], 0
je 0x140033bd8
mov rdi, qword [rsp + 0x30]
xchg r8, rbx
mov r8, qword [rsp + 0x38]
xchg r8, rbx
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
nop
mov rsi, qword [rsp]
add rsp, 8
ret

Function at 0x140033c80
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg r12, rbx
mov r12, r8
xchg r12, rbx
xchg rsi, r11
mov r11, rdx
xchg r11, rsi
xchg rcx, rbp
mov rcx, rbp
xchg rbp, rcx
jne 0x140033d3c
xchg rdi, r10
mov qword [rsp + 0x30], r10
xchg r10, rdi
nop dword [rax]
nop dword [rax + rax]
xchg rdi, r8
mov rdi, qword [rbx + 0x10]
xchg r8, rdi
xchg r8, rsi
mov rdx, r8
xchg r8, rsi
xchg rcx, rbp
mov rbp, rcx
xchg rbp, rcx
call fcn.140033c80
xchg rdi, rdx
mov rdx, rbx
xchg rdx, rdi
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004c9a0
mov edx, 0x486faea0
xor edx, 0x56753a1d
xor edx, 0x3d12a08e
xor edx, 0x4d10582b
add edx, 0xc6acf7
sub edx, 0x6edf18bf
mov rcx, rdi
call fcn.1401fc438
cmp byte [rbx + 0x19], 0
je 0x140033ccc
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
xchg rbp, rdx
mov rdx, qword [rsp + 0x40]
xchg rbp, rdx
add rsp, 0x20
nop
mov rsi, qword [rsp]
add rsp, 8
ret
Function at 0x1400358f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbx
nop
mov qword [rsp - 8], rsi
sub rsp, 8
push rdi
push r12
push r13
nop
sub rsp, 8
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x30
xchg r15, rdx
mov rdx, r15
xchg r15, rdx
xchg rdi, r14
mov rdi, rcx
xchg r14, rdi
movabs rsi, 0xfffffff5669f921
sub rsi, 0x310dcf22
add rsi, 0x309b5654
add rsi, 0x63b263e
sub rsi, 0x3db51dd8
add rsi, 0x141e42d7
xor rsi, 0x2da98d50
add rsi, 0x7fffffff
xor rsi, 0x60cdb940
cmp rdx, rsi
ja 0x140035b23
xchg r12, r13
mov r13, qword [rcx + 8]
xchg r13, r12
sub r12, qword [rcx]
sar r12, 3
sar r12, 1
mov rcx, qword [rcx + 0x10]
sub rcx, qword [r14]
sar rcx, 3
sar rcx, 1
xchg rcx, r11
mov rdx, r11
xchg r11, rcx
shr rdx, 1
xchg rsi, r9
mov rax, r9
xchg r9, rsi
sub rax, rdx
cmp rcx, rax
ja 0x1400359c7
lea rsi, [rdx + rcx]
cmp rsi, r15
cmovb rsi, r15
mov qword [rsp + 0x88], rsi
xchg rdx, r13
mov r13, rsi
xchg rdx, r13
xchg rcx, rsi
mov rsi, r14
xchg rsi, rcx
call fcn.140053570
mov r13, rax
mov qword [rsp + 0x28], rax
xchg r11, r12
mov rbx, r11
xchg r12, r11
shl rbx, 2
shl rbx, 2
add rbx, rax
mov qword [rsp + 0x20], rbx
xchg r15, rdi
mov r15, rdi
xchg r15, rdi
sub rdi, r12
mov qword [rsp + 0x78], rbx
je 0x140035a6a
nop word [rax + rax]
mov byte [rbx], 0x3f
sub byte [rbx], 0x21
xor byte [rbx], 0x39
xor byte [rbx], 0x6f
xor byte [rbx], 0x32
sub byte [rbx], 6
xor byte [rbx], 0x4a
xor byte [rbx], 0x3e
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004b7e0
nop
nop
add rbx, 0x3e56742
sub rbx, 0x3e56732
mov qword [rsp + 0x78], rbx
sub rdi, 1
jne 0x140035a28
mov r8, qword [r14 + 8]
xchg r8, rdx
mov r8, r13
xchg r8, rdx
mov rcx, qword [r14]
cmp rcx, r8
je 0x140035aba
xor r9d, r9d
movzx eax, byte [rcx]
mov byte [rdx], al
mov rax, qword [rcx + 8]
xchg r14, rax
mov qword [rdx + 8], r14
xchg r14, rax
mov byte [rcx], r9b
mov qword [rcx + 8], r9
lea rdx, [rdx + 0x10]
nop
sub rcx, 0xc11b431
add rcx, 0xc11b441
cmp rcx, r8
jne 0x140035a86
xchg rsi, rcx
mov r9, rcx
xchg rcx, rsi
xchg r8, r14
mov r14, r15
xchg r14, r8
mov rdx, r13
xchg r14, rcx
mov r14, rcx
xchg r14, rcx
add rsp, 0x30
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
nop
xchg qword [rsp], r13
add rsp, 8
push rax
xchg qword [rsp + 8], r12
add rsp, 0x10
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
xchg qword [rsp - 8], rsi
nop
xchg qword [rsp], rbx
add rsp, 8
jmp fcn.1400526c0
call fcn.14002f970
int3
Function at 0x140035ba0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rbp
mov rbp, rdx
xchg rdi, rbp
xchg r10, rbx
mov r10, rcx
xchg r10, rbx
test rdx, rdx
je 0x140035c0d
nop word [rax + rax]
mov byte [rbx], 0x5d
xor byte [rbx], 0x6f
add byte [rbx], 0x1e
xor byte [rbx], 0x36
sub byte [rbx], 8
sub byte [rbx], 0x57
xor byte [rbx], 0x1d
sub byte [rbx], 0x1a
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004b7e0
nop
nop
sub rbx, 0x36944e28
add rbx, 0x36944e38
sub rdi, 1
jne 0x140035bd4
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rcx
push rax
push rdx
push rdx
push rbx
xchg qword [rsp + 0x30], rdi
pop rbx
pop rdx
pop rdx
pop rax
pop rcx
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]