joyce8/EMBER2024-capa huggingface dataset:
Function at 0x458d40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00541720]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x00541469], 0
je 0x458d76
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005419e0]
aesenc xmm0, xmmword [0x005419f0]
aesenc xmm0, xmmword [0x00541a00]
movq rax, xmm0
ret
jmp 0x407e00

Function at 0x45aa20
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x45aa54
mov rcx, 0x28
jmp 0x45aa5f
shl rcx, 3
add rcx, 0x1480
mov qword [0x00541680], rcx
pop rbp
ret

Function at 0x45fee0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45ffaa
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00402820
xorps xmm15, xmm15
mov r14, qword [0x00541680]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x45ff8f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0046cee0]
xor ebx, ebx
mov rcx, rdx
call fcn.004428e0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00460240
inc rbx
cmp rcx, rbx
jae 0x45ff7e
mov edi, 1
lea rsi, [0x0046cee0]
call fcn.004429c0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00495b68]
lea rsi, [0x00495840]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00456f00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0045fee0
Function at 0x1400374c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, 0xffffffff
test edx, edx
je 0x1400374fb
mov r9d, edx
lea r10, [0x14005ff60]
nop dword [rax]
nop word [rax + rax]
movzx r8d, byte [rcx]
lea rcx, [rcx + 1]
movzx edx, al
xor r8, rdx
shr eax, 8
xor eax, dword [r10 + r8*4]
sub r9, 1
jne 0x1400374e0
not eax
ret

Function at 0x140037500
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, rcx
mov ebx, 0xffffffff
xor esi, esi
call qword [0x140051da0]
test rax, rax
jle 0x14003756a
mov ebp, esi
lea r14, [0x14005ff60]
nop word [rax + rax]
mov rdx, rbp
mov rcx, rdi
call qword [0x140051de0]
xor al, bl
movzx ecx, al
shr ebx, 8
xor ebx, dword [r14 + rcx*4]
inc esi
mov ebp, esi
mov rcx, rdi
call qword [0x140051da0]
cmp rbp, rax
jl 0x140037540
not ebx
mov rcx, rdi
call qword [0x140051e00]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140037590
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rbp, rcx
lea rdx, [rsp + 0x20]
call qword [0x140051968]
nop
mov ebx, 0xffffffff
xor edi, edi
lea rcx, [rsp + 0x20]
call qword [0x140051da0]
test rax, rax
jle 0x140037611
mov esi, edi
lea r14, [0x14005ff60]
nop word [rax + rax]
mov rdx, rsi
lea rcx, [rsp + 0x20]
call qword [0x140051dd8]
movzx ecx, bl
xor cl, byte [rax]
movzx eax, cl
shr ebx, 8
xor ebx, dword [r14 + rax*4]
inc edi
mov esi, edi
lea rcx, [rsp + 0x20]
call qword [0x140051da0]
cmp rsi, rax
jl 0x1400375e0
not ebx
lea rcx, [rsp + 0x20]
call qword [0x140051e00]
nop
mov rcx, rbp
call qword [0x140051d88]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x140040168
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140051018]
test rax, rax
je 0x1400401b2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400401b2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400401b2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400401b2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400401b2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400401b4
xor al, al
add rsp, 0x28
ret
Function at 0x140465a66
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1404a930e
test r9, r9
push 0xffffffffb13d8f8e
lea rsp, [rsp + 0x20]
je 0x14046cbb4
mov r8d, 0x11aafc0e
lea r8, [r8 + r8*2 - 0x15912d2]
push r11
lea r8, [0x140486170]
movzx r11d, byte [rbx]
push 0x4e256430
ror word [rsp + 4], 0xae
xor r11d, edx
and r11d, 0xff
mov r11d, dword [r8 + r11*4]
rol dword [rsp + 4], 0xc
dec word [rsp + 5]
shr edx, 8
push 0xffffffffa29a9b38
xor edx, r11d
inc rbx
xor edx, 0xa31b4f00
shr dword [rsp + 0xc], 0x77
dec r9
lea rsp, [rsp + 0x10]
jne 0x140465a90
call fcn.14046c5a5
mov rcx, rax
push 0xffffffffb38d3ab2
lea rsp, [rsp + 8]
jmp 0x1404950bf
mov rax, qword [rbp + rbx*8]
jmp 0x14048e09f
jmp 0x140464b9d
setle r11b
add r9, rsp
or r11d, r11d
mov r11w, word [r9]
jl 0x1404894be
mov word [rdi], ax
lea rsp, [rsp + 0x10]
jmp fcn.1404850d1
ror r9w, 1
and r11d, r11d
xor bp, r9w
neg r11d
jno 0x140470070
sub dl, 0xb3
not dl
jmp 0x140499f92
lea rsp, [rsp + 8]
jne 0x1404685bd
mov eax, 0x46bcf904
mov rax, qword [rax + rbp - 0x46bcf904]
jmp 0x14048ff15
jne 0x1404a4568
jmp 0x140465ae3
push 0xffffffffd2918021
xor ebx, eax
and ebx, 0xff
call fcn.1404aa327
call fcn.14046e21a
call fcn.140481863
cmp ebx, 1
jmp 0x14049a32d
call fcn.14046aa77
cmp ebx, 3
jne 0x14049b126
mov r8d, 0x61136a87
push r8
mov qword [rsp + r8 - 0x61136a87], r8
mov r8, rax
lea rsp, [rsp + 8]
jmp 0x1404950bf
mov eax, 0x76292a0f
shr eax, 0x13
dec rax
mov rax, qword [rbp + rbx*8 + 0x20]
push rax
push 0x77a1ab8e
dec ebx
jmp 0x1404a057c
dec r9w
sal r11w, 0xcf
neg r11w
ror r9w, 1
ror r11w, 0xef
xor r9w, 0x462b
or r11d, r11d
sub r11b, r11b
neg r9w
shl r11, 0x52
not r11b
ja 0x140471781
mov r9d, 0x3f182e1c
mov r9, qword [rsp + r9 - 0x3f182e04]
jmp 0x14048af54
call fcn.140487069
mov r11, r8
call fcn.140481c96
jmp 0x140482648
rol dl, 1
neg dl
sal dword [rsp + 0x18], 0xad
dec dl
xor r9b, dl
lea rdx, [rsp + rdx + 0x20]
mov qword [rdx], rdi
lea rsp, [rsp + 0x20]
jmp fcn.14048cc7b
jmp 0x140482426
push 0x6cbed53a
cmp ebx, 4
lea rsp, [rsp + 8]
jne 0x1404950ae
mov r9, rax
call fcn.1404843db
sub rsi, 2
mov r9d, 0x3e24fab1
movzx r9d, word [rsi + r9*2 - 0x7c49f562]
mov r11d, 0xe7aa7c0c
not r11
xor r9w, bp
sar r11b, 0xe4
neg r9w
jmp 0x140496e44
jmp 0x14047a027
jmp fcn.14047d2da
cmp ebx, 2
jne 0x140493c7d
mov edx, 0x34851f33
jmp 0x140497fbe
not edx
mov dword [r11], edx
jmp 0x1404a3098
Function at 0x401000
Capabilities:
Check os version

Disassembly:
sub rsp, 0xc8
mov dword [rsp + 0x2c], 0x94
lea rcx, [rsp + 0x2c]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
cmp dword [rsp + 0x30], 6
jne 0x40102b
cmp dword [rsp + 0x34], 1
sete al
add rsp, 0xc8
ret

Function at 0x4011f0
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x290
mov rbx, rcx
mov esi, edx
lea rcx, str.2.zal_17609686_7d7f_43eb_92b7_0a22909a7abb.
lea rdx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x4012e6
lea r10, [rsp + 0x4c]
lea rdx, [0x004030b6]
mov rcx, r10
call fcn.004013c0
lea rdx, [rsp + 0x17c]
mov rcx, r10
call fcn.00401370
xor r9d, r9d
mov edx, 0x80000000
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov r8d, 1
mov rcx, r10
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, qword [sym.imp.KERNEL32.dll_FindClose]
cmp rax, 0xffffffffffffffff
mov r13, rax
jne 0x401290
mov rcx, r12
call rdi
jmp 0x4012e6
mov r8d, esi
lea r9, [rsp + 0x48]
mov rdx, rbx
mov rcx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, r13
mov esi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call rdi
test esi, esi
je 0x4012e6
mov r8d, dword [rsp + 0x48]
xor eax, eax
cmp r8d, eax
jle 0x4012ea
mov dl, byte [rbx + rax]
lea rcx, [rbx + rax]
inc rax
cmp dl, 0xa
je 0x4012e1
cmp dl, 0xd
jne 0x4012c8
mov byte [rcx], 0
jmp 0x4012ea
xor eax, eax
jmp 0x4012ef
mov eax, 1
add rsp, 0x290
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret

Function at 0x401420
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0xd0
xor edx, edx
mov r8d, 0x68
lea r9, [rsp + 0x68]
mov r10, rcx
mov rcx, r9
call fcn.00401320
lea r11, [rsp + 0x50]
xor edx, edx
mov r8d, 0x18
mov rcx, r11
mov dword [rsp + 0x68], 0x68
mov dword [rsp + 0xa4], 1
mov word [rsp + 0xa8], 0
call fcn.00401320
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], r9
mov rdx, r10
xor r9d, r9d
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4014d7
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x58]
call rbx
nop
add rsp, 0xd0
pop rbx
ret
Function at 0x1400011d0
Capabilities:
Create directory

Disassembly:
mov rax, qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 0x65
call rax
lea rcx, str.:
mov rax, qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add eax, 0x4e7b
xor edx, edx
call rax
ror byte [rax - 0x75], 1
or eax, 0x4e78
mov dword [rsp + 0x2c], eax
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0x40]
invalid
invalid

Function at 0x140001258
Capabilities:
Create directory

Disassembly:
and al, 0x20
cmp r8, rdx
cmp eax, edx
ja 0x1400011b9
jmp 0x1400011b9

Function at 0x140001274
Capabilities:
Terminate process

Disassembly:
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
cmp eax, 4

Function at 0x1400012bc
Capabilities:
Terminate process

Disassembly:
and al, 0xa4
add al, byte [rax]
add cl, ch
ficom word [rax]
push rsi
mov qword [rsp + 0x288], 0x943ca17
mov r9, rdx

Function at 0x1400012d4
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 0x7c], 0xffffffff
mov r10, qword [rsp + 0x298]
mov qword [rsp + 0x298], 0x2921e42d
sub eax, 0x4c2921e4
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]

Function at 0x140001328
Capabilities:
Terminate process

Disassembly:
mov dword [rsp + 0x70], ecx
mov rcx, rsi
mov qword [rsp + 0x68], r10
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x50], r8
call r11
mov edi, 0x200
mov rcx, qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r8d, 0x200
add byte [rdx], al
add byte [rax], al
invalid
invalid
invalid
invalid
Function at 0x140001190
Capabilities:
Create directory

Disassembly:
sub rsp, 0x58
mov eax, 0x3bf255f0
mov rcx, qword [rsp + 0x48]
mov dword [rsp + 0x3c], 0x2fe6135
and al, 0x3c
xor eax, 0x8b02fe61
push rsp
and al, 0x3c

Function at 0x140001224
Capabilities:
Create directory

Disassembly:
push rbx
mov ebp, ebp
sub dword [rax - 0x75], ecx
mov rdx, qword [rsp + 0x30]

Function at 0x140001228
Capabilities:
Create directory

Disassembly:
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, rdx
shl rdx, cl

Function at 0x140001238
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x48], rdx
mov rdx, qword [rsp + 0x40]
sub rdx, 0x67b8bbca
mov eax, dword [rsp + 0x38]
and eax, 0x4169a3e1
mov dword [rsp + 0x54], eax
mov r8, qword [rsp + 0x20]
cmp r8, rdx
cmp eax, edx

Function at 0x140001270
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
add byte [r8], r8b
call rax
cmp eax, 4
jae 0x140001292
mov rax, qword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, 0xfffffffe
call rax
ud2
add rsp, 0x28
ret

Function at 0x1400012a0
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
sub rsp, 0x2a8
in al, dx
test al, 2
add byte [rax], al

Function at 0x1400012b4
Capabilities:
Terminate process

Disassembly:
add byte [rbp + rcx*4 + 0x44], cl
and al, 0x7c
mov dword [rsp + 0x2a4], 0x5610dee9
and al, 0xa4
add al, byte [rax]
add cl, ch
ficom word [rax]
push rsi
mov qword [rsp + 0x288], 0x943ca17
add byte [rdi], dl
retf 0x943
mov r9, rdx
mov dword [rsp + 0x7c], 0xffffffff
invalid
invalid
invalid
invalid

Function at 0x1400012dc
Capabilities:
Terminate process

Disassembly:
mov r10, qword [rsp + 0x298]
mov qword [rsp + 0x298], 0x2921e42d
mov r11, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add byte [r8], r8b

Function at 0x1400012f4
Capabilities:
Terminate process

Disassembly:
cwde
add al, byte [rax]
add byte [rax - 0x39], cl
test byte [rax + rbx*4], ah
add al, byte [rax]
add byte [0x18c2934d5], ch
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add byte [r8], r8b
xor eax, eax
mov esi, eax
mov qword [rsp + 0x70], rcx
mov dword [rsp + 0x70], ecx
mov rcx, rsi
mov qword [rsp + 0x68], r10
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], r9
and al, 0x58

Function at 0x14000131c
Capabilities:
Terminate process

Disassembly:
add al, byte [rax]
add byte [rax - 0x75], cl
or eax, 0x4d22
add byte [rax], al
mov r8d, 0x200

Function at 0x140001324
Capabilities:
Terminate process

Disassembly:
add al, byte [rax]
add byte [rax - 0x75], cl
or eax, 0x4d22
add byte [rax], al
mov r8d, 0x200
Function at 0x14000134c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x48], rcx
mov rcx, rax
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x48]
mov dword [rsp + 0x44], edi
call rax
lea rcx, [rsp + 0x7c]
mov rdx, qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
ror byte [rax + rax], 0x4c
lea ecx, [rsp + 0x7c]
mov r10, qword [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov rcx, r10
mov qword [rsp + 0x30], rdx
mov rdx, r9
mov r9, qword [rsp + 0x30]
mov dword [rsp + 0x2c], eax
call r9
cmp eax, 0
je 0x1400013d7
jmp 0x1400013ae
mov eax, 0xc28d584
mov ecx, eax
invalid
invalid
push rsp
invalid

Function at 0x140001358
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x48], rcx
mov rcx, rax
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x48]
mov dword [rsp + 0x44], edi
call rax
lea rcx, [rsp + 0x7c]
mov rdx, qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
ror byte [rax + rax], 0x4c
lea ecx, [rsp + 0x7c]
mov r10, qword [rsp + 0x60]
mov qword [rsp + 0x38], rcx
mov rcx, r10
mov qword [rsp + 0x30], rdx
mov rdx, r9
mov r9, qword [rsp + 0x30]
mov dword [rsp + 0x2c], eax
call r9
cmp eax, 0
je 0x1400013d7
jmp 0x1400013ae
mov eax, 0xc28d584
mov ecx, eax
invalid
invalid
push rsp
invalid

Function at 0x140001670
Capabilities:
Create directory

Disassembly:
movsb byte [rdi], byte [rsi]
add byte [r8], al
jmp qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
Function at 0x140001000
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov edi, r8d
mov ebx, edx
mov rsi, rcx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001029
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001029
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov r14d, dword [r9 + r11*4]
mov bpl, byte [rax + r14]
test bpl, bpl
je 0x140001094
add r14, r10
mov r15d, 0x16101ce6
movsx ebp, bpl
xor ebp, r15d
imul r15d, ebp, 0x1000193
mov bpl, byte [r14]
inc r14
test bpl, bpl
jne 0x140001072
cmp r15d, 0xe86d51dc
je 0x14000109b
test r11, r11
jne 0x140001056
jmp 0x140001029
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, rsi
call rdx
cmp eax, 0xffffffff
je 0x14000117f
mov ecx, eax
or ecx, edi
not edi
mov rdx, qword gs:[0x60]
mov r8, qword [rdx + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov rdx, qword [r8 + 0x30]
movsxd r9, dword [rdx + 0x3c]
mov r9d, dword [rdx + r9 + 0x88]
test r9, r9
je 0x1400010d9
mov r10d, dword [rdx + r9 + 0x18]
test r10, r10
je 0x1400010d9
mov r14d, dword [rdx + r9 + 0x20]
add r14, rdx
lea r15, [rdx + 1]
dec r10
mov r11d, r10d
mov r12d, dword [r14 + r11*4]
mov bpl, byte [rdx + r12]
test bpl, bpl
je 0x140001146
add r12, r15
mov r13d, 0x1b1f2f4f
movsx ebp, bpl
xor ebp, r13d
imul r13d, ebp, 0x1000193
mov bpl, byte [r12]
inc r12
test bpl, bpl
jne 0x140001123
cmp r13d, 0xd6e8210d
je 0x14000114d
test r11, r11
jne 0x140001107
jmp 0x1400010d9
and eax, edi
test bl, bl
cmovne eax, ecx
mov ecx, dword [rdx + r9 + 0x1c]
mov r8d, dword [rdx + r9 + 0x24]
add rcx, rdx
add r8, rdx
movzx r8d, word [r8 + r11*2]
mov r8d, dword [rcx + r8*4]
add r8, rdx
mov rcx, rsi
mov edx, eax
call r8
test eax, eax
setne al
jmp 0x140001181
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140001d8c
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001da8
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001da8
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x140001e0a
add rdi, r10
mov ebp, 0xb347e1c6
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x140001dee
cmp ebp, 0x76682d34
je 0x140001e11
test r11, r11
jne 0x140001dd5
jmp 0x140001da8
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
xor ecx, ecx
call rdx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001e3f
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001e3f
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x140001ea1
add rdi, r10
mov ebp, 0xcbd6c39
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x140001e85
cmp ebp, 0xff65115f
je 0x140001ea8
test r11, r11
jne 0x140001e6c
jmp 0x140001e3f
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, rsi
call rdx
cmp eax, 0xffffffff
jne 0x140001f70
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001ee0
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001ee0
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov esi, dword [r9 + r11*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x140001f42
add rsi, r10
mov edi, 0xe4b67ba4
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x140001f26
cmp edi, 0x8fa03f6
je 0x140001f49
test r11, r11
jne 0x140001f0d
jmp 0x140001ee0
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov ecx, dword [rcx + rdx*4]
add rcx, rax
call rcx
and eax, 0xfffffffe
cmp eax, 2
jne 0x140001f70
xor eax, eax
jmp 0x140001f72
mov al, 1
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140004124
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x58]
mov qword [rax], rdx
mov qword [rax + 8], r8
mov qword [rax + 0x10], r9
mov qword [rsp + 0x28], rax
mov rax, qword [0x140006188]
test rax, rax
jne 0x1400041ad
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
add rax, 0x10
mov rax, qword [rax]
movzx r8d, word [rax + 0x58]
mov rdx, r8
shr rdx, 1
cmp r8, 2
jb 0x14000415d
mov r8, qword [rax + 0x60]
add rdx, rdx
mov r9d, 0x97ff6ca0
xor r10d, r10d
movsx r11d, byte [r8 + r10]
xor r11d, r9d
imul r9d, r11d, 0x1000193
add r10, 2
cmp rdx, r10
jne 0x140004181
cmp r9d, 0xbf421a0b
jne 0x14000415d
mov rax, qword [rax + 0x30]
mov qword [0x140006188], rax
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
mov r8d, dword [rax + rdx + 0x20]
add r8, rax
lea r10, [rax + 1]
xor r11d, r11d
mov r9d, r11d
mov esi, dword [r8 + r9*4]
mov bl, byte [rax + rsi]
test bl, bl
je 0x1400041f9
add rsi, r10
mov edi, 0x98ff6e33
movsx ebx, bl
xor ebx, edi
imul edi, ebx, 0x1000193
mov bl, byte [rsi]
inc rsi
test bl, bl
jne 0x1400041dd
cmp edi, 0x7ac90b80
je 0x1400041fe
inc r11d
jmp 0x1400041c7
mov r8d, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add r8, rax
add rdx, rax
movzx edx, word [rdx + r9*2]
mov r8d, dword [r8 + rdx*4]
add r8, rax
mov rdx, qword [rsp + 0x28]
call r8
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x180001000
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp qword [rsp + 0x50], 0
jne 0x180001018
xor eax, eax
jmp 0x180001196
mov edx, 0xe6a3605
mov rcx, qword [rsp + 0x50]
call fcn.180002f10
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], 0
xor eax, eax
mov word [rsp + 0x20], ax
xor eax, eax
mov word [rsp + 0x28], ax
jmp 0x180001052
movzx eax, word [rsp + 0x28]
inc ax
mov word [rsp + 0x28], ax
movzx eax, word [rsp + 0x28]
cmp eax, 0x96
jge 0x180001081
movzx eax, word [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax]
cmp eax, 0xc3
jne 0x18000107f
movzx eax, word [rsp + 0x28]
mov word [rsp + 0x20], ax
jmp 0x180001081
jmp 0x180001045
movzx eax, word [rsp + 0x20]
test eax, eax
jne 0x1800010cf
xor eax, eax
mov word [rsp + 0x2c], ax
jmp 0x1800010a0
movzx eax, word [rsp + 0x2c]
inc ax
mov word [rsp + 0x2c], ax
movzx eax, word [rsp + 0x2c]
cmp eax, 0x96
jge 0x1800010cf
movzx eax, word [rsp + 0x2c]
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax]
cmp eax, 0xcc
jne 0x1800010cd
movzx eax, word [rsp + 0x2c]
mov word [rsp + 0x20], ax
jmp 0x1800010cf
jmp 0x180001093
movzx eax, word [rsp + 0x20]
test eax, eax
jne 0x1800010e2
mov rax, qword [rsp + 0x38]
jmp 0x180001196
xor eax, eax
mov word [rsp + 0x24], ax
jmp 0x1800010f8
movzx eax, word [rsp + 0x24]
inc ax
mov word [rsp + 0x24], ax
movzx eax, word [rsp + 0x24]
cmp eax, 0x28
jge 0x180001191
movzx eax, word [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
movzx ecx, word [rsp + 0x24]
sub rax, rcx
movzx eax, byte [rax]
cmp eax, 0xe8
je 0x18000114a
movzx eax, word [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
movzx ecx, word [rsp + 0x24]
sub rax, rcx
movzx eax, byte [rax]
cmp eax, 0xe9
jne 0x18000118c
movzx eax, word [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
movzx ecx, word [rsp + 0x24]
sub rax, rcx
movzx ecx, word [rsp + 0x20]
mov rdx, qword [rsp + 0x30]
add rdx, rcx
mov rcx, rdx
movzx edx, word [rsp + 0x24]
sub rcx, rdx
mov ecx, dword [rcx + 1]
lea rax, [rax + rcx + 5]
sub rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
jmp 0x1800010eb
mov rax, qword [rsp + 0x38]
add rsp, 0x48
ret