joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012fe0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011429
movzx eax, al
test eax, eax
jne 0x140013000
mov ecx, 7
call fcn.140011393
nop
mov byte [rsp + 0x20], 0
call fcn.1400113a7
mov byte [rsp + 0x21], al
cmp dword [0x14001e860], 1
jne 0x140013024
mov ecx, 7
call fcn.140011393
nop
jmp 0x14001307c
cmp dword [0x14001e860], 0
jne 0x140013077
mov dword [0x14001e860], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.1400111e0
test eax, eax
je 0x140013058
mov eax, 0xff
jmp 0x140013181
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.14001139d
mov dword [0x14001e860], 2
jmp 0x14001307c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001137f
call fcn.14001130c
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1400130d9
mov rcx, qword [rsp + 0x30]
call fcn.140011181
movzx eax, al
test eax, eax
je 0x1400130d9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140025020]
nop
call fcn.140011343
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001310d
mov rcx, qword [rsp + 0x38]
call fcn.140011181
movzx eax, al
test eax, eax
je 0x14001310d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113e3
nop
call fcn.140013230
mov dword [rsp + 0x28], eax
call fcn.1400112df
movzx eax, al
test eax, eax
jne 0x14001312c
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001313b
call fcn.1400113ed
nop
xor edx, edx
mov cl, 1
call fcn.140011172
mov eax, dword [rsp + 0x28]
jmp 0x140013181
add rsp, 0x68
ret
Function at 0x100401610
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x10040169d
mov edx, 0x2f
call sub.msys_2.0.dll_strrchr
mov rsi, rax
test rax, rax
je 0x10040167b
lea rdi, [rax + 1]
mov rax, rdi
sub rax, rbx
cmp rax, 6
jle 0x10040167b
lea rcx, [rsi - 6]
mov r8d, 7
lea rdx, str._.libs_
call sub.msys_2.0.dll_strncmp
test eax, eax
jne 0x10040167b
cmp byte [rsi + 1], 0x6c
jne 0x100401698
cmp byte [rdi + 1], 0x74
jne 0x100401698
cmp byte [rdi + 2], 0x2d
jne 0x100401698
mov rax, qword [sym.imp.msys_2.0.dll_program_invocation_short_name]
lea rbx, [rsi + 4]
mov qword [rax], rbx
mov rax, qword [sym.imp.msys_2.0.dll_program_invocation_name]
mov qword [0x10040c010], rbx
mov qword [rax], rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
mov rbx, rdi
jmp 0x10040167b
call sub.msys_2.0.dll___getreent
mov r8d, 0x37
mov edx, 1
lea rcx, str.A_NULL_argv_0__was_passed_through_an_exec_system_call._n
mov r9, qword [rax + 0x18]
call sub.msys_2.0.dll_fwrite
call sub.msys_2.0.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1004041f0
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
xor ecx, ecx
call fcn.1004045d0
mov r12, rax
test rax, rax
je 0x100404350
lea rdx, str.US_ASCII
mov rcx, rax
call sub.msys_2.0.dll_strcmp
test eax, eax
je 0x1004042b0
lea rdx, [0x10040808a]
mov rcx, r12
call sub.msys_2.0.dll_strcmp
test eax, eax
je 0x10040429c
xor edi, edi
mov esi, 0x17
lea rbp, str.CP1361
jmp 0x10040425e
je 0x100404360
mov rsi, rbx
cmp rdi, rsi
jae 0x10040428c
lea rax, [rsi + rdi]
mov rdx, r12
mov rbx, rax
and rax, 0xfffffffffffffffe
shr rbx, 1
add rax, rbx
lea r13, [rbp + rax*8]
mov rcx, r13
call sub.msys_2.0.dll_strcmp
test eax, eax
jns 0x100404250
lea rdi, [rbx + 1]
cmp rdi, rsi
jb 0x10040425e
cmp byte [r12], 0
lea rax, [0x100408061]
cmove r12, rax
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rcx, str.LC_ALL
call sub.msys_2.0.dll_getenv
test rax, rax
je 0x100404378
cmp byte [rax], 0
je 0x100404378
mov edx, 0x2e
mov rcx, rax
call sub.msys_2.0.dll_strchr
test rax, rax
je 0x100404306
lea r12, [rax + 1]
mov edx, 0x40
mov rcx, r12
call sub.msys_2.0.dll_strchr
test rax, rax
je 0x10040429c
sub rax, r12
mov rbx, rax
cmp rax, 0xc
jbe 0x1004043b8
call qword [sym.imp.KERNEL32.dll_GetACP]
lea r12, [rsp + 0x33]
xor edx, edx
lea r9, str.CP_u
mov dword [rsp + 0x20], eax
mov rcx, r12
mov r8d, 0xd
call sub.msys_2.0.dll___sprintf_chk
mov rdx, r12
lea r12, [0x10040c160]
mov r8d, 0xd
mov rcx, r12
call sub.msys_2.0.dll___strcpy_chk
jmp 0x100404226
lea r12, [0x100408060]
jmp 0x100404239
lea r12, [r13 + 0xc]
mov rax, r12
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rcx, str.LC_CTYPE
call sub.msys_2.0.dll_getenv
test rax, rax
je 0x100404392
cmp byte [rax], 0
jne 0x1004042ce
lea rcx, str.LANG
call sub.msys_2.0.dll_getenv
test rax, rax
je 0x100404306
cmp byte [rax], 0
je 0x100404306
jmp 0x1004042ce
mov rdx, r12
lea r12, [0x10040c160]
mov r9d, 0xd
mov r8, rax
mov rcx, r12
call sub.msys_2.0.dll___memcpy_chk
mov byte [r12 + rbx], 0
jmp 0x10040429c
Function at 0x140030e90
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140030e9d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140030ead
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140030e95
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x140030ec5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140030eb2
sub eax, 3
jb 0x140030edf
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140030f16
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x140030f06
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140030f04
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140030ef3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.140030e52
jmp 0x140030e9d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xba00
mov dl, 6
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x140030f62
cmp rsi, rcx
jae 0x140030f6a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x140030f49
cmp al, 0x8f
ja 0x140030f49
cmp byte [rsi - 2], 0xf
je 0x140030f4f
sub al, 0xe8
cmp al, 1
ja 0x140030f33
cmp rsi, rcx
jae 0x140030f6a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x140030f39
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x140030f6a
lodsb al, byte [rsi]
jmp 0x140030f49
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x2e000]
mov eax, dword [rdi]
or eax, eax
je 0x140030fc7
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x314ec]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140030f77
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140030fc1
mov qword [rbx], rax
add rbx, 8
jmp 0x140030f97
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140031001
cmp al, 0xef
ja 0x140030ff3
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140030fd3
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140030fe2
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140031080], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140031080
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140031070
sub rsp, 0xffffffffffffff80
jmp 0x1400014e0
Function at 0x140001250
Capabilities:
Find process by pid

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx], 0x5fa4c37
mov rbx, rcx
jne 0x1400012f3
movsxd rax, dword [rcx + 4]
test eax, eax
je 0x1400012f3
and qword [r11 + 8], 0
lea rdx, [r11 + 8]
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x1400012f3
mov rdi, qword [0x140004270]
test rdi, rdi
je 0x1400012f3
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdx, qword [rbx + 8]
mov rcx, rdi
mov rsi, qword [rbx + 0x18]
call fcn.140001a28
test rax, rax
je 0x1400012f3
mov ecx, eax
lea r9, [rsp + 0x38]
and ecx, 0xfff
mov edx, 0x1000
sub edx, ecx
mov rcx, rax
cmp edx, esi
cmovl esi, edx
cmp byte [rbx + 0x20], 0
mov rdx, qword [rbx + 0x10]
movsxd r8, esi
je 0x1400012ea
call fcn.140001bac
jmp 0x1400012ef
call fcn.140001840
xor eax, eax
jmp 0x1400012f8
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1400013a4
Capabilities:
Find process by pid

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [0x140004278], 0
mov r13, rcx
jne 0x1400013d2
call fcn.140001504
cmp qword [0x1400042a0], 0
jne 0x140001407
call fcn.140001308
mov rcx, rax
lea r8, [0x140002020]
lea rdx, [0x140002050]
call fcn.1400018c0
movsxd rcx, dword [rax + 8]
mov rax, qword [rcx + rax + 0xc]
mov qword [0x1400042a0], rax
call qword [sym.imp.ntoskrnl.exe_MmGetPhysicalMemoryRanges]
mov rdx, qword [0x140004298]
xor r15d, r15d
mov rcx, qword [0x140004290]
lea rsi, [rax + 8]
lea r12, [rcx + rdx*8]
mov rbx, qword [rsi - 8]
test rbx, rbx
jne 0x140001438
cmp qword [rsi], rbx
je 0x1400014e6
mov rbp, qword [rsi]
sar rbp, 0xc
sar rbx, 0xc
add rbp, rbx
cmp rbx, rbp
jge 0x1400014c7
lea rdi, [rbx + rbx*2]
shl rdi, 4
mov rax, qword [0x1400042a0]
mov r14, qword [rdi + rax]
cmp r14, 2
jb 0x1400014ad
cmp qword [rdi + rax + 8], r12
jne 0x1400014ad
movabs rax, 0xffff800000000000
shr r14, 0xd
or r14, rax
lea rdx, [rsp + 0x58]
mov rax, rbx
shl rax, 0xc
mov qword [0x140004270], rax
mov ecx, dword [r13]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x1400014ad
cmp r14, qword [rsp + 0x58]
je 0x1400014bb
inc rbx
add rdi, 0x30
cmp rbx, rbp
jl 0x140001453
jmp 0x1400014c7
mov rcx, qword [0x140004270]
test rcx, rcx
jne 0x1400014dd
inc r15d
add rsi, 0x10
cmp r15d, 0xc8
jl 0x140001426
jmp 0x1400014e6
mov rax, qword [r13 + 8]
mov qword [rax], rcx
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x13a96f4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x13a96fe
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x13a9727
pop rbp
sub rbp, 0x33
sub rbp, 0xfa96f4
sub rsp, 0x20
jmp 0x13a9746
mov rax, 0xfa96f4
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffff8bb9b205
xor byte [rax], dl
inc rax
dec rcx
jne 0x13a9765
jmp 0x13a977c
mov r12, gs
mov cs, word [rcx + rdi + 0x4d050505]
test ah, al
or eax, 0x4d050504
add al, 0xec
ret 0x9c5
Function at 0x140001000
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea r13, [rsp + 0x48]
xor ebx, ebx
mov rdi, qword [r13]
mov r11, rcx
mov qword [r13], rbx
cmp dword [rcx], ebx
je 0x140001156
mov qword [rax + 8], rbx
lea rax, [rsp + 0x48]
mov r15, qword [rax]
mov qword [rax], rbx
mov rax, qword [0x140005060]
test rax, rax
jne 0x140001103
mov rdx, qword [0x140011088]
lea r9, [rsp + 0x48]
test rdx, rdx
jne 0x140001074
mov rdx, qword [0x140011080]
mov qword [0x140011088], rdx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov esi, dword [rcx + 0x1c]
mov r8d, dword [rcx + 0x20]
add rsi, rdx
mov ebp, dword [rcx + 0x24]
add r8, rdx
mov r14d, dword [rcx + 0x18]
add rbp, rdx
mov edx, ebx
test r14d, r14d
je 0x1400010f2
mov ecx, dword [r8]
movabs r10, 0xcbf29ce484222325
add rcx, qword [0x140011088]
mov al, byte [rcx]
test al, al
je 0x1400010e7
inc rcx
movsx rax, al
xor r10, rax
movabs r12, 0x100000001b3
imul r10, r12
mov al, byte [rcx]
test al, al
jne 0x1400010ba
movabs rax, 0x8a9495b5004b3e52
cmp r10, rax
je 0x140001143
inc edx
add r8, 4
cmp edx, r14d
jb 0x1400010a0
int3
mov qword [r9], rbx
mov rcx, rbx
mov qword [0x140005060], rax
lea rcx, [rsp + 0x48]
mov qword [rcx], r15
lea rdx, [rsp + 0x50]
movsxd rcx, dword [r11]
call qword [0x1400040b0]
test eax, eax
jne 0x140001156
mov rcx, qword [rsp + 0x50]
call sub.ntoskrnl.exe_PsGetProcessSectionBaseAddress
mov rcx, rax
call fcn.1400012cc
mov rcx, qword [rsp + 0x50]
mov qword [0x140011090], rax
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x14000115b
mov eax, edx
movzx ecx, word [rbp + rax*2]
mov eax, dword [rsi + rcx*4]
add rax, qword [0x140011088]
jmp 0x1400010f6
mov ebx, 0xc0000001
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
mov qword [r13], rdi
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140001180
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea rax, [rsp + 0x58]
mov rbp, r9
mov r12, qword [rax]
mov r14, r8
lea rax, [rsp + 0x58]
mov r15, rdx
and qword [rax], 0
mov rax, qword [0x140005058]
test rax, rax
jne 0x140001273
mov r8, qword [0x140011088]
lea r10, [rsp + 0x58]
test r8, r8
jne 0x1400011e5
mov r8, qword [0x140011080]
mov qword [0x140011088], r8
movsxd rax, dword [r8 + 0x3c]
mov edx, dword [rax + r8 + 0x88]
add rdx, r8
mov edi, dword [rdx + 0x1c]
mov r9d, dword [rdx + 0x20]
add rdi, r8
mov esi, dword [rdx + 0x24]
add r9, r8
mov ebx, dword [rdx + 0x18]
add rsi, r8
xor r8d, r8d
test ebx, ebx
je 0x140001264
mov edx, dword [r9]
movabs r11, 0xcbf29ce484222325
add rdx, qword [0x140011088]
mov al, byte [rdx]
test al, al
je 0x140001258
inc rdx
movsx rax, al
xor r11, rax
movabs r13, 0x100000001b3
imul r11, r13
mov al, byte [rdx]
test al, al
jne 0x14000122b
movabs rax, 0x306328ee8e049a39
cmp r11, rax
je 0x1400012bb
inc r8d
add r9, 4
cmp r8d, ebx
jb 0x140001211
int3
xor edx, edx
mov qword [r10], rdx
mov qword [0x140005058], rax
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x20], rbp
and qword [rdx], 0
mov r9d, 1
mov rdx, rcx
mov r8, r14
mov rcx, r15
call qword [0x1400040b0]
mov rbx, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov qword [rcx], r12
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movzx edx, word [rsi + r8*2]
mov eax, dword [rdi + rdx*4]
add rax, qword [0x140011088]
jmp 0x140001267
Function at 0x140001bdc
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor ebx, ebx
lea r12, [rsp + 0x48]
mov rbp, qword [r12]
lea r13, [rsp + 0x48]
mov qword [r13], rbx
mov r14, rcx
mov rax, qword [0x140005060]
test rax, rax
jne 0x140001ccb
mov rdx, qword [0x140011088]
lea r8, [rsp + 0x48]
test rdx, rdx
jne 0x140001c3e
mov rdx, qword [0x140011080]
mov qword [0x140011088], rdx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov r11d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r11, rdx
mov edi, dword [rcx + 0x24]
add r9, rdx
mov esi, dword [rcx + 0x18]
add rdi, rdx
mov edx, ebx
test esi, esi
je 0x140001cba
mov ecx, dword [r9]
movabs r10, 0xcbf29ce484222325
add rcx, qword [0x140011088]
mov al, byte [rcx]
test al, al
je 0x140001cb0
inc rcx
movsx rax, al
xor r10, rax
movabs r15, 0x100000001b3
imul r10, r15
mov al, byte [rcx]
test al, al
jne 0x140001c83
movabs rax, 0x8a9495b5004b3e52
cmp r10, rax
je 0x140001ce8
inc edx
add r9, 4
cmp edx, esi
jb 0x140001c69
int3
mov qword [r8], rbx
mov rcx, rbx
mov qword [0x140005060], rax
mov qword [r13], rbx
lea rdx, [rsp + 0x50]
movsxd rcx, dword [r14]
call qword [0x1400040b0]
test eax, eax
je 0x140001cfb
mov ebx, 0xc0000001
jmp 0x140001d15
mov eax, edx
movzx ecx, word [rdi + rax*2]
mov eax, dword [r11 + rcx*4]
add rax, qword [0x140011088]
jmp 0x140001cbe
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rcx + 0x448]
mov rcx, qword [rcx + 0x450]
mov qword [rcx], rdx
mov qword [rdx + 8], rcx
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov qword [r12], rbp
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140001f80
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea r13, [rsp + 0x58]
xor ebx, ebx
mov r14, qword [r13]
mov rdi, rcx
mov qword [r13], rbx
cmp dword [rcx], ebx
je 0x140002112
cmp qword [0x140011090], rbx
je 0x140002112
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rbx
mov r15, qword [rax]
mov qword [rax], rbx
mov rax, qword [0x140005060]
test rax, rax
jne 0x14000208b
mov rdx, qword [0x140011088]
lea r9, [rsp + 0x58]
test rdx, rdx
jne 0x140001ffa
mov rdx, qword [0x140011080]
mov qword [0x140011088], rdx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov r11d, dword [rcx + 0x1c]
mov r8d, dword [rcx + 0x20]
add r11, rdx
mov esi, dword [rcx + 0x24]
add r8, rdx
mov ebp, dword [rcx + 0x18]
add rsi, rdx
mov edx, ebx
test ebp, ebp
je 0x14000207a
mov ecx, dword [r8]
movabs r10, 0xcbf29ce484222325
add rcx, qword [0x140011088]
mov al, byte [rcx]
test al, al
je 0x140002070
inc rcx
movsx rax, al
xor r10, rax
movabs r12, 0x100000001b3
imul r10, r12
mov al, byte [rcx]
test al, al
jne 0x14000203f
movabs rax, 0x8a9495b5004b3e52
cmp r10, rax
je 0x1400020fc
inc edx
add r8, 4
cmp edx, ebp
jb 0x140002025
int3
mov qword [r9], rbx
mov rcx, rbx
mov qword [0x140005060], rax
lea rcx, [rsp + 0x58]
mov qword [rcx], r15
lea rdx, [rsp + 0x60]
movsxd rcx, dword [rdi]
call qword [0x1400040b0]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140002112
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdx, qword [rdi + 8]
mov rcx, qword [0x140011090]
mov rbp, qword [rdi + 0x18]
call fcn.140001a20
mov rsi, rax
test rax, rax
je 0x140002112
and eax, 0xfff
mov ecx, 0x1000
sub ecx, eax
mov rdx, rbp
call fcn.140001a14
mov rdx, qword [rdi + 0x10]
lea r9, [rsp + 0x68]
mov r8, rax
mov qword [rsp + 0x68], rbx
mov rcx, rsi
call fcn.140001180
jmp 0x140002117
mov eax, edx
movzx ecx, word [rsi + rax*2]
mov eax, dword [r11 + rcx*4]
add rax, qword [0x140011088]
jmp 0x14000207e
mov ebx, 0xc0000001
mov eax, ebx
mov qword [r13], r14
mov rbx, qword [rsp + 0x70]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002134
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
lea r13, [rsp + 0x58]
xor ebx, ebx
mov r14, qword [r13]
mov rdi, rcx
mov qword [r13], rbx
cmp dword [rcx], ebx
je 0x1400022c6
cmp qword [0x140011090], rbx
je 0x1400022c6
lea rax, [rsp + 0x58]
mov qword [rsp + 0x60], rbx
mov r15, qword [rax]
mov qword [rax], rbx
mov rax, qword [0x140005060]
test rax, rax
jne 0x14000223f
mov rdx, qword [0x140011088]
lea r9, [rsp + 0x58]
test rdx, rdx
jne 0x1400021ae
mov rdx, qword [0x140011080]
mov qword [0x140011088], rdx
movsxd rax, dword [rdx + 0x3c]
mov ecx, dword [rax + rdx + 0x88]
add rcx, rdx
mov r11d, dword [rcx + 0x1c]
mov r8d, dword [rcx + 0x20]
add r11, rdx
mov esi, dword [rcx + 0x24]
add r8, rdx
mov ebp, dword [rcx + 0x18]
add rsi, rdx
mov edx, ebx
test ebp, ebp
je 0x14000222e
mov ecx, dword [r8]
movabs r10, 0xcbf29ce484222325
add rcx, qword [0x140011088]
mov al, byte [rcx]
test al, al
je 0x140002224
inc rcx
movsx rax, al
xor r10, rax
movabs r12, 0x100000001b3
imul r10, r12
mov al, byte [rcx]
test al, al
jne 0x1400021f3
movabs rax, 0x8a9495b5004b3e52
cmp r10, rax
je 0x1400022b0
inc edx
add r8, 4
cmp edx, ebp
jb 0x1400021d9
int3
mov qword [r9], rbx
mov rcx, rbx
mov qword [0x140005060], rax
lea rcx, [rsp + 0x58]
mov qword [rcx], r15
lea rdx, [rsp + 0x60]
movsxd rcx, dword [rdi]
call qword [0x1400040b0]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400022c6
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rdx, qword [rdi + 8]
mov rcx, qword [0x140011090]
mov rbp, qword [rdi + 0x18]
call fcn.140001a20
mov rsi, rax
test rax, rax
je 0x1400022c6
and eax, 0xfff
mov ecx, 0x1000
sub ecx, eax
mov rdx, rbp
call fcn.140001a14
mov rdx, qword [rdi + 0x10]
lea r9, [rsp + 0x68]
mov r8, rax
mov qword [rsp + 0x68], rbx
mov rcx, rsi
call fcn.1400022e8
jmp 0x1400022cb
mov eax, edx
movzx ecx, word [rsi + rax*2]
mov eax, dword [r11 + rcx*4]
add rax, qword [0x140011088]
jmp 0x140002232
mov ebx, 0xc0000001
mov eax, ebx
mov qword [r13], r14
mov rbx, qword [rsp + 0x70]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400022e8
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea rax, [rsp + 0x58]
mov rbp, r9
mov r12, qword [rax]
mov r14, r8
lea rax, [rsp + 0x58]
mov r15, rdx
and qword [rax], 0
mov rax, qword [0x140005058]
test rax, rax
jne 0x1400023db
mov r8, qword [0x140011088]
lea r10, [rsp + 0x58]
test r8, r8
jne 0x14000234d
mov r8, qword [0x140011080]
mov qword [0x140011088], r8
movsxd rax, dword [r8 + 0x3c]
mov edx, dword [rax + r8 + 0x88]
add rdx, r8
mov ebx, dword [rdx + 0x1c]
mov r9d, dword [rdx + 0x20]
add rbx, r8
mov edi, dword [rdx + 0x24]
add r9, r8
mov esi, dword [rdx + 0x18]
add rdi, r8
xor r8d, r8d
test esi, esi
je 0x1400023cc
mov edx, dword [r9]
movabs r11, 0xcbf29ce484222325
add rdx, qword [0x140011088]
mov al, byte [rdx]
test al, al
je 0x1400023c0
inc rdx
movsx rax, al
xor r11, rax
movabs r13, 0x100000001b3
imul r11, r13
mov al, byte [rdx]
test al, al
jne 0x140002393
movabs rax, 0x306328ee8e049a39
cmp r11, rax
je 0x140002423
inc r8d
add r9, 4
cmp r8d, esi
jb 0x140002379
int3
xor edx, edx
mov qword [r10], rdx
mov qword [0x140005058], rax
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x20], rbp
and qword [rdx], 0
mov r9d, 2
mov rdx, rcx
mov r8, r14
mov rcx, r15
call qword [0x1400040b0]
mov rbx, qword [rsp + 0x60]
lea rcx, [rsp + 0x58]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov qword [rcx], r12
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
movzx edx, word [rdi + r8*2]
mov eax, dword [rbx + rdx*4]
add rax, qword [0x140011088]
jmp 0x1400023cf