joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140059644
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14005965a
mov al, 1
jmp 0x1400596ba
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14005966b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400596b8
mov ecx, dword [rcx + 0x18]
nop
call fcn.140055ff4
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400596b8
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400596b8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400596b8
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400596ba
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14005b26c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x140078f10]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14005b2c3
cmp word [rdx], r13w
jne 0x14005b2c3
or byte [rax + rdi*8 + 0x38], cl
jmp 0x14005b2c8
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x14005b3ed
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x14005b40e
lea r9, [rdx + 2]
cmp cx, r11w
je 0x14005b301
mov rdx, r9
mov word [rbx], cx
jmp 0x14005b328
cmp r9, r8
jae 0x14005b338
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x14005b2e2
jmp 0x14005b3ed
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005b3e2
cmp dword [rsp + 0x80], esi
je 0x14005b3e2
lea r8, [0x140078f10]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x14005b3ba
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x14005b38a
mov word [rbx], r13w
jmp 0x14005b3ea
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x14005b397
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x14005b3ea
cmp word [rsp + 0x70], r13w
jne 0x14005b3c7
cmp rbx, r14
je 0x14005b384
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.14005b18c
cmp word [rsp + 0x70], r13w
je 0x14005b3ed
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140078f10]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x14005b3e7
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x14005b3ed
Function at 0x14005da14
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.14005d4d0
sub rsp, rax
mov rax, qword [0x140077008]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.140051f74
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x14005da63
mov rax, rbp
jmp 0x14005db6b
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x78f10]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14005b184
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x78f10]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x14005db67
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005db67
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14005b184
test rax, rax
js 0x14005db67
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x14005db67
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x14005db59
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x14005db59
cmp byte [rcx], 0xd
jne 0x14005db3f
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14005db4e
cmp byte [rcx + 1], 0xa
jne 0x14005db4e
inc rcx
jmp 0x14005db4e
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x77910]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x14005db21
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x14005db6b
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140040dd0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14005f78c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14005b18c
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14005b18c
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14005f8dc
cmp rax, 0xffffffffffffffff
je 0x14005f8dc
xor edi, edi
test rbp, rbp
jle 0x14005f887
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14004fc5c
mov rbx, rax
test rax, rax
jne 0x14005f814
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14005f87d
mov edx, 0x8000
mov ecx, r14d
call fcn.14004eed8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140057b48
cmp eax, 0xffffffff
je 0x14005f85d
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14005f824
mov edx, r15d
mov ecx, r14d
call fcn.14004eed8
jmp 0x14005f87d
cmp byte [rsi + 0x38], dil
je 0x14005f874
cmp dword [rsi + 0x34], 5
jne 0x14005f874
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14005f87d
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14004fcd4
jmp 0x14005f8f0
jns 0x14005f8f0
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14005b18c
cmp rax, 0xffffffffffffffff
jne 0x14005f8a8
cmp byte [rsi + 0x30], dil
je 0x14005f8f0
mov edi, dword [rsi + 0x2c]
jmp 0x14005f8f0
mov ecx, r14d
call fcn.140055ff4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14005f8f0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14005f8f0
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14005f8e9
mov eax, dword [rsi + 0x2c]
jmp 0x14005f8ee
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14005b18c
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140024744
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140014c30
sub rsp, rax
mov rax, qword [0x14004b080]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14002156c
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x140024793
mov rax, rbp
jmp 0x14002489f
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x59a030]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.140025824
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x59a030]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x14002489b
mov dword [rsp + 0x30], edi
lea r9, [rsp + 0x30]
mov rcx, qword [rcx + r12*8 + 0x28]
lea rdx, [rsp + 0x40]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14002489b
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.140025824
test rax, rax
js 0x14002489b
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x14002489b
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x14002488d
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x14002488d
cmp byte [rcx], 0xd
jne 0x140024873
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140024882
cmp byte [rcx + 1], 0xa
jne 0x140024882
inc rcx
jmp 0x140024882
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x4b4c0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140024855
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x14002489f
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140014220
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1405aadb6
Capabilities:
Set thread local storage value

Disassembly:
push rax
pushf
mov eax, 0x13543a1b
pushf
not eax
add eax, 0xb76e2513
xor eax, 0xff14d20b
rol eax, 0xc5
popf
pushf
not eax
add eax, 0xddd4c561
xor eax, 0x80a662a7
rol eax, 0x33
popf
pushf
not eax
add eax, 0x954de2a1
xor eax, 0xcf37a964
rol eax, 0x76
popf
pushf
not eax
add eax, 0x8d93e849
xor eax, 0xc3ee47b3
rol eax, 0xb7
popf
cmp eax, 2
jne 0x1405aae19
popf
pop rax
jmp 0x1405aaf61
cmp eax, 0
jne 0x1405aae28
popf
pop rax
jmp 0x1405aae46
cmp eax, 3
jne 0x1405aae37
popf
pop rax
jmp 0x1405aafc0
cmp eax, 1
jne 0x1405aae46
popf
pop rax
jmp 0x1405aaf58
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x184e6c3e1]
pushf
sub r9, 0x44e38729
popf
mov edi, ecx
lea rdx, [0x1ad4c51af]
pushf
sub rdx, 0x6d4914f7
popf
mov ecx, 0x473f9488
pushf
not ecx
add ecx, 0xcce75b7d
xor ecx, 0xca20ac3e
rol ecx, 0xae
popf
pushf
not ecx
add ecx, 0xdf16dcc4
xor ecx, 0xe94216b7
rol ecx, 0x64
popf
pushf
not ecx
add ecx, 0x8c4d984e
xor ecx, 0xb927b2ef
rol ecx, 0x2a
popf
lea r8, [0x18ad84759]
pushf
sub r8, 0x4ad50aa9
popf
call fcn.140019bbc
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x1405aaf11
push rax
pushf
mov eax, 0x4e1a3423
pushf
not eax
add eax, 0x9520e9df
xor eax, 0xd66dc986
rol eax, 0x42
popf
pushf
not eax
add eax, 0xea8b5c1f
xor eax, 0xa4dd6f28
rol eax, 0x56
popf
jmp 0x1405aae0a
push rax
pushf
mov eax, 0x423cd813
pushf
not eax
add eax, 0xe415653d
xor eax, 0xee81d08e
rol eax, 0xc3
popf
pushf
not eax
add eax, 0xd6e3e87a
xor eax, 0xa4392300
rol eax, 0x42
popf
pushf
not eax
add eax, 0xd1c656c2
xor eax, 0xf13ef582
rol eax, 0x7b
popf
jmp 0x1405aae0a
call qword [case.0x140668ad2.0]
jmp 0x1405aafc0
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
push rax
pushf
mov eax, 0xf30e8e5
pushf
not eax
add eax, 0xed92e1de
xor eax, 0xa2d642cd
rol eax, 0xc3
popf
pushf
not eax
add eax, 0xe383897d
xor eax, 0xc098f026
rol eax, 0x53
popf
pushf
not eax
add eax, 0x848daebc
xor eax, 0x867d5add
rol eax, 0xa3
popf
pushf
not eax
add eax, 0xaacfd582
xor eax, 0x955bcd1b
rol eax, 0xb2
popf
jmp 0x1405aae0a
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1405db8a7
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xe49e6024
pushf
not eax
add eax, 0xdbfdd811
xor eax, 0xf8dd3e06
rol eax, 0xdd
popf
pushf
not eax
add eax, 0xd5575b17
xor eax, 0xf32005d0
rol eax, 0x1b
popf
pushf
not eax
add eax, 0xf7092e01
xor eax, 0xac06f560
rol eax, 0x70
popf
cmp eax, 4
jne 0x1405db8f7
popf
pop rax
jmp 0x1405dba97
cmp eax, 0
jne 0x1405db906
popf
pop rax
jmp 0x1405db933
cmp eax, 3
jne 0x1405db915
popf
pop rax
jmp 0x1405dba4d
cmp eax, 1
jne 0x1405db924
popf
pop rax
jmp 0x1405db9b5
cmp eax, 2
jne 0x1405db933
popf
pop rax
jmp 0x1405db9ef
cmp byte [rcx + 0x2c], 0
mov rax, rcx
je 0x1405db982
push rax
pushf
mov eax, 0x294e2742
pushf
not eax
add eax, 0x80c0ac67
xor eax, 0x9d92c15a
rol eax, 0x19
popf
pushf
not eax
add eax, 0xcb834650
xor eax, 0xbf5681b7
rol eax, 0xa
popf
pushf
not eax
add eax, 0xc47991a0
xor eax, 0xd865cfd5
rol eax, 0x2f
popf
jmp 0x1405db8e8
push rax
pushf
mov eax, 0xbc67c4da
pushf
not eax
add eax, 0xfe2f89d0
xor eax, 0x9fd7b392
rol eax, 0xa7
popf
pushf
not eax
add eax, 0xefa6122e
xor eax, 0xa76a5e3e
rol eax, 0x24
popf
jmp 0x1405db8e8
xor r10d, r10d
nop dword [rax]
push rax
pushf
mov eax, 0xd8088232
pushf
not eax
add eax, 0xfec4e224
xor eax, 0x8e2633a2
rol eax, 0x77
popf
pushf
not eax
add eax, 0xd4d4ecce
xor eax, 0xab008f97
rol eax, 0x75
popf
jmp 0x1405db8e8
mov r9d, r10d
lea r8d, [r10 - 0x22]
xor r8b, byte [rax + r10]
and r9d, 7
movzx edx, r8b
mov ecx, 0xe01ac352
pushf
not ecx
add ecx, 0xc88baa32
xor ecx, 0xc837a135
rol ecx, 0xb3
popf
pushf
not ecx
add ecx, 0xe54b930c
xor ecx, 0xa5fa90d0
rol ecx, 0xe3
popf
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
or dl, r8b
mov byte [rax + r10], dl
inc r10
cmp r10, 0x2b
jb 0x1405db9ef
mov byte [rax + 0x2c], 0
push rax
pushf
mov eax, 0xeaea330c
pushf
not eax
add eax, 0xb59ba195
xor eax, 0xe0043854
rol eax, 0x41
popf
pushf
not eax
add eax, 0xf5f87903
xor eax, 0xa9b653b9
rol eax, 0x39
popf
pushf
not eax
add eax, 0xa4b26a46
xor eax, 0xbe9ff394
rol eax, 0xfb
popf
jmp 0x1405db8e8
ret
Function at 0x1405e4e7e
Capabilities:
Get thread local storage value

Disassembly:
push rax
pushf
mov eax, 0xe48939a1
pushf
not eax
add eax, 0x9be0f756
xor eax, 0x906c4d66
rol eax, 0x5d
popf
pushf
not eax
add eax, 0xe09d5768
xor eax, 0x8cc855eb
rol eax, 0x21
popf
pushf
not eax
add eax, 0xcb458526
xor eax, 0x9c4a6bd9
rol eax, 0xd8
popf
cmp eax, 2
jne 0x1405e4ece
popf
pop rax
jmp 0x1405e4fea
cmp eax, 0
jne 0x1405e4edd
popf
pop rax
jmp 0x1405e4eec
cmp eax, 1
jne 0x1405e4eec
popf
pop rax
jmp 0x1405e4fde
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1995354fc]
pushf
sub r9, 0x5950185c
popf
mov ecx, 0xb24d2ef3
pushf
not ecx
add ecx, 0xfdb9762b
xor ecx, 0xdd504919
rol ecx, 0x78
popf
pushf
not ecx
add ecx, 0xd7f1d9b7
xor ecx, 0xa95b9dac
rol ecx, 0xbf
popf
lea r8, [0x1b0d1b354]
pushf
sub r8, 0x70ce76bc
popf
lea rdx, [0x183414db3]
pushf
sub rdx, 0x433e1113
popf
call fcn.140019bbc
mov ecx, ebx
test rax, rax
je 0x1405e4f98
push rax
pushf
mov eax, 0xce1663b5
pushf
not eax
add eax, 0xa6f18f9d
xor eax, 0xd03da756
rol eax, 0xd7
popf
pushf
not eax
add eax, 0xdf1a496d
xor eax, 0x9695d626
rol eax, 0x44
popf
jmp 0x1405e4ebf
push rax
pushf
mov eax, 0x3b838dbf
pushf
not eax
add eax, 0xe0b198db
xor eax, 0xea2c33c8
rol eax, 9
popf
pushf
not eax
add eax, 0xcf91079e
xor eax, 0x91c4164f
rol eax, 0x3e
popf
pushf
not eax
add eax, 0xf51398af
xor eax, 0xd65cbb02
rol eax, 0x66
popf
jmp 0x1405e4ebf
add rsp, 0x20
pop rbx
jmp qword [case.0x140668ad2.0]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1405ec548
Capabilities:
Allocate thread local storage

Disassembly:
push rax
pushf
mov eax, 0x497cfd79
pushf
not eax
add eax, 0xa9ecf273
xor eax, 0x891ae3a7
rol eax, 0xf3
popf
pushf
not eax
add eax, 0xa8c92adb
xor eax, 0xedd1df32
rol eax, 0x3e
popf
cmp eax, 2
jne 0x1405ec585
popf
pop rax
jmp 0x1405ec69c
cmp eax, 0
jne 0x1405ec594
popf
pop rax
jmp 0x1405ec5a3
cmp eax, 1
jne 0x1405ec5a3
popf
pop rax
jmp 0x1405ec68d
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1a51768fc]
pushf
sub r9, 0x65142c84
popf
xor ecx, ecx
lea r8, [0x1bf80f042]
pushf
sub r8, 0x7f7db3d2
popf
lea rdx, [0x1bd6f1604]
pushf
sub rdx, 0x7d6bd98c
popf
call fcn.140019bbc
test rax, rax
je 0x1405ec634
push rax
pushf
mov eax, 0x53060be1
pushf
not eax
add eax, 0xe8dc4588
xor eax, 0xb1318c96
rol eax, 0xcf
popf
pushf
not eax
add eax, 0xc0e1f54f
xor eax, 0xd857aa6a
rol eax, 0xcd
popf
pushf
not eax
add eax, 0x8e6bd572
xor eax, 0xc555a5ae
rol eax, 0x55
popf
jmp 0x1405ec576
push rax
pushf
mov eax, 0x3a525490
pushf
not eax
add eax, 0xd82c808e
xor eax, 0x8b8d2e27
rol eax, 0x88
popf
pushf
not eax
add eax, 0x9a00f730
xor eax, 0xf7034eb9
rol eax, 0x16
popf
pushf
not eax
add eax, 0x867374d4
xor eax, 0x96c552d8
rol eax, 0xe
popf
pushf
not eax
add eax, 0xfac09fe2
xor eax, 0xd1a6cdc1
rol eax, 0x95
popf
jmp 0x1405ec576
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [case.0x140668ad2.0]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x1405fcce2
Capabilities:
Authenticate hmac

Disassembly:
push rax
pushf
mov eax, 0x68cc76f9
pushf
not eax
add eax, 0xb0962a01
xor eax, 0xcf60eed3
rol eax, 0x37
popf
pushf
not eax
add eax, 0xa6eece7b
xor eax, 0xa9d01fad
rol eax, 0xe7
popf
pushf
not eax
add eax, 0xb00a0602
xor eax, 0x8e0818e7
rol eax, 0x5e
popf
pushf
not eax
add eax, 0xed10661f
xor eax, 0xcdd8b2ba
rol eax, 0x6b
popf
cmp eax, 4
jne 0x1405fcd45
popf
pop rax
jmp 0x1405fcee7
cmp eax, 0
jne 0x1405fcd54
popf
pop rax
jmp 0x1405fcd81
cmp eax, 3
jne 0x1405fcd63
popf
pop rax
jmp 0x1405fce7a
cmp eax, 1
jne 0x1405fcd72
popf
pop rax
jmp 0x1405fce12
cmp eax, 2
jne 0x1405fcd81
popf
pop rax
jmp 0x1405fce61
push rbx
mov r11d, dword [r8]
mov rbx, rdx
and r11d, 0xfffffff8
mov r9, rcx
test byte [r8], 4
mov r10, rcx
je 0x1405fcdcc
push rax
pushf
mov eax, 0xa21120d1
pushf
not eax
add eax, 0xb1b6fa12
xor eax, 0xe2c13925
rol eax, 0xf6
popf
pushf
not eax
add eax, 0xf88b9d20
xor eax, 0xdf1043e5
rol eax, 0x9f
popf
jmp 0x1405fcd36
push rax
pushf
mov eax, 0x2d6f3ead
pushf
not eax
add eax, 0x9b418789
xor eax, 0x90237b11
rol eax, 0xc2
popf
pushf
not eax
add eax, 0xed789ae8
xor eax, 0xe03bb6ac
rol eax, 0xa2
popf
pushf
not eax
add eax, 0xfcfff806
xor eax, 0xa6de83c5
rol eax, 0x12
popf
jmp 0x1405fcd36
mov eax, dword [r8 + 8]
movsxd r10, dword [r8 + 4]
neg eax
push rcx
not rcx
sub r10, rcx
pop rcx
sub r10, 1
movsxd rcx, eax
and r10, rcx
push rax
pushf
mov eax, 0x74b5f97
pushf
not eax
add eax, 0xbedde1f9
xor eax, 0xf58ce566
rol eax, 0x8c
popf
pushf
not eax
add eax, 0xb44f350d
xor eax, 0xeddec0eb
rol eax, 0xc4
popf
jmp 0x1405fcd36
movsxd rax, r11d
mov rdx, qword [rax + r10]
mov rax, qword [rbx + 0x10]
mov ecx, dword [rax + 8]
mov rax, qword [rbx + 8]
test byte [rcx + rax + 3], 0xf
je 0x1405fcee7
movzx eax, byte [rcx + rax + 3]
and eax, 0xfffffff0
push rax
not rax
sub r9, rax
pop rax
sub r9, 1
push rax
pushf
mov eax, 0xa7832b5c
pushf
not eax
add eax, 0xf29ea1fa
xor eax, 0xac2d0892
rol eax, 0x2f
popf
pushf
not eax
add eax, 0x9948d89b
xor eax, 0xab3f970c
rol eax, 0x31
popf
pushf
not eax
add eax, 0xe0f2d750
xor eax, 0x97a483fd
rol eax, 0x62
popf
pushf
not eax
add eax, 0xa8bc6e0f
xor eax, 0xea028f5d
rol eax, 0xe8
popf
jmp 0x1405fcd36
xor r9, rdx
mov rcx, r9
pop rbx
jmp fcn.14066b1de
Function at 0x1406054f1
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xdb96b882
pushf
not eax
add eax, 0xe65d1773
xor eax, 0xbb2f4a4e
rol eax, 0x33
popf
pushf
not eax
add eax, 0xfbac3e9a
xor eax, 0xfede914d
rol eax, 0x41
popf
pushf
not eax
add eax, 0xf9237ff8
xor eax, 0xac02f80d
rol eax, 0xb8
popf
pushf
not eax
add eax, 0xa8f21d7a
xor eax, 0xf5e3cb7e
rol eax, 0xa2
popf
cmp eax, 4
jne 0x140605554
popf
pop rax
jmp 0x14060574d
cmp eax, 0
jne 0x140605563
popf
pop rax
jmp 0x140605590
cmp eax, 3
jne 0x140605572
popf
pop rax
jmp 0x1406056ed
cmp eax, 1
jne 0x140605581
popf
pop rax
jmp 0x140605628
cmp eax, 2
jne 0x140605590
popf
pop rax
jmp 0x14060565f
cmp byte [rcx + 0x100], 0
mov rax, rcx
je 0x1406055e2
push rax
pushf
mov eax, 0x1a5b27f3
pushf
not eax
add eax, 0xbc285a54
xor eax, 0xbe8a6163
rol eax, 0x38
popf
pushf
not eax
add eax, 0xd34c2dc7
xor eax, 0xdec76171
rol eax, 0x25
popf
pushf
not eax
add eax, 0xb08e5c2e
xor eax, 0xd31d7b6c
rol eax, 0x39
popf
jmp 0x140605545
push rax
pushf
mov eax, 0x9a5ee3ce
pushf
not eax
add eax, 0xce0d9686
xor eax, 0xbad73a49
rol eax, 0x48
popf
pushf
not eax
add eax, 0x99109075
xor eax, 0xa624af06
rol eax, 0xd4
popf
pushf
not eax
add eax, 0xb6b369b5
xor eax, 0xc7d7c781
rol eax, 0xf7
popf
jmp 0x140605545
xor r10d, r10d
nop
push rax
pushf
mov eax, 0xcf9c5d9f
pushf
not eax
add eax, 0xe64084ab
xor eax, 0x96e1f74a
rol eax, 0x63
popf
pushf
not eax
add eax, 0x9f5ad52e
xor eax, 0x9d2c4321
rol eax, 0x35
popf
jmp 0x140605545
mov r9d, r10d
lea r8d, [r10 - 0x22]
xor r8b, byte [rax + r10]
and r9d, 7
movzx edx, r8b
mov ecx, 0x45164599
pushf
not ecx
add ecx, 0xef68114b
xor ecx, 0xc85a151c
rol ecx, 0x71
popf
pushf
not ecx
add ecx, 0xa9ab967e
xor ecx, 0xd31f8e98
rol ecx, 1
popf
pushf
not ecx
add ecx, 0xd820c319
xor ecx, 0xa776ee08
rol ecx, 0x3c
popf
pushf
not ecx
add ecx, 0xef042a8f
xor ecx, 0x9f14dc19
rol ecx, 0x41
popf
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
or dl, r8b
mov byte [rax + r10], dl
inc r10
cmp r10, 0xff
jb 0x14060565f
mov byte [rax + 0x100], 0
push rax
pushf
mov eax, 0x53af5bbb
pushf
not eax
add eax, 0xca2b8f84
xor eax, 0x9d3ae946
rol eax, 0x28
popf
pushf
not eax
add eax, 0xca4f2fcc
xor eax, 0x80629865
rol eax, 0x63
popf
pushf
not eax
add eax, 0xafd7f4b4
xor eax, 0xc62cc00d
rol eax, 0xdf
popf
pushf
not eax
add eax, 0xf387740f
xor eax, 0xcb41fbcb
rol eax, 0x4c
popf
jmp 0x140605545
ret
Function at 0x14060ffe8
Capabilities:
Terminate process

Disassembly:
push rax
pushf
mov eax, 0xa83c937d
pushf
not eax
add eax, 0x89d1f31e
xor eax, 0x88f8fa5e
rol eax, 0x43
popf
pushf
not eax
add eax, 0xdc5acba2
xor eax, 0x90ed9bae
rol eax, 0x86
popf
cmp eax, 2
jne 0x140610025
popf
pop rax
jmp 0x1406100db
cmp eax, 0
jne 0x140610034
popf
pop rax
jmp 0x140610043
cmp eax, 1
jne 0x140610043
popf
pop rax
jmp 0x1406100c9
push rbx
sub rsp, 0x20
mov ebx, ecx
test dl, dl
je 0x140610095
push rax
pushf
mov eax, 0x468fe5e2
pushf
not eax
add eax, 0xde65b95b
xor eax, 0xde7abe2c
rol eax, 8
popf
pushf
not eax
add eax, 0xcb8792f6
xor eax, 0x966f3c0e
rol eax, 0xd6
popf
pushf
not eax
add eax, 0xa7a3bfe5
xor eax, 0xfe0122a4
rol eax, 8
popf
jmp 0x140610016
push rax
pushf
mov eax, 0xf998ffd1
pushf
not eax
add eax, 0xcc86f9d9
xor eax, 0xda38f0d9
rol eax, 0x85
popf
pushf
not eax
add eax, 0xf8837810
xor eax, 0xdde31c4e
rol eax, 0x31
popf
jmp 0x140610016
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
jmp 0x1406100d5
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.1406098ca
mov ecx, ebx
jmp 0x1406100e5
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140612e03
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xe4827132
pushf
not eax
add eax, 0x87c70794
xor eax, 0xe0544791
rol eax, 0xd7
popf
pushf
not eax
add eax, 0xeb112617
xor eax, 0xfba9008d
rol eax, 0x38
popf
pushf
not eax
add eax, 0xbb576b5f
xor eax, 0xc0662a8d
rol eax, 0x43
popf
pushf
not eax
add eax, 0xb1f02951
xor eax, 0xf0afb6ee
rol eax, 0xab
popf
cmp eax, 4
jne 0x140612e66
popf
pop rax
jmp 0x140613058
cmp eax, 0
jne 0x140612e75
popf
pop rax
jmp 0x140612ea2
cmp eax, 3
jne 0x140612e84
popf
pop rax
jmp 0x140612ff7
cmp eax, 1
jne 0x140612e93
popf
pop rax
jmp 0x140612f3a
cmp eax, 2
jne 0x140612ea2
popf
pop rax
jmp 0x140612f97
cmp byte [rcx + 0x100], 0
mov r10, rcx
je 0x140612ef4
push rax
pushf
mov eax, 0xd2fd7059
pushf
not eax
add eax, 0x89bca830
xor eax, 0x98968360
rol eax, 0x1b
popf
pushf
not eax
add eax, 0x90efff5b
xor eax, 0x806e363a
rol eax, 0x7b
popf
pushf
not eax
add eax, 0x8e88c765
xor eax, 0x93904328
rol eax, 0x81
popf
jmp 0x140612e57
push rax
pushf
mov eax, 0xc152813f
pushf
not eax
add eax, 0xf031a50a
xor eax, 0xb8838110
rol eax, 0xff
popf
pushf
not eax
add eax, 0xff539bff
xor eax, 0xfd468855
rol eax, 0xca
popf
pushf
not eax
add eax, 0x81093840
xor eax, 0xf1fc271a
rol eax, 0x11
popf
jmp 0x140612e57
xor eax, eax
nop
push rax
pushf
mov eax, 0xb7be15ec
pushf
not eax
add eax, 0xaed93ba2
xor eax, 0xcfe52de1
rol eax, 0x63
popf
pushf
not eax
add eax, 0xf24f4050
xor eax, 0xc34d2b95
rol eax, 0xb2
popf
pushf
not eax
add eax, 0xb84f6c86
xor eax, 0xbbcac738
rol eax, 0x98
popf
pushf
not eax
add eax, 0xabefccf2
xor eax, 0x9d0b35e2
rol eax, 0x58
popf
jmp 0x140612e57
mov r9d, eax
lea r8d, [rax - 0x22]
xor r8b, byte [r10 + rax]
and r9d, 7
movzx edx, r8b
mov ecx, 0x9f42318a
pushf
not ecx
add ecx, 0xaa3a25a0
xor ecx, 0xbf3227aa
rol ecx, 0xde
popf
pushf
not ecx
add ecx, 0x9fdccebd
xor ecx, 0xb26f59cd
rol ecx, 0xd1
popf
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
or dl, r8b
mov byte [r10 + rax], dl
inc rax
cmp rax, 0xff
jb 0x140612f97
mov byte [r10 + 0x100], 0
push rax
pushf
mov eax, 0x9317d6e8
pushf
not eax
add eax, 0xd6859976
xor eax, 0xc9ba5c75
rol eax, 0x74
popf
pushf
not eax
add eax, 0xffa8c7d7
xor eax, 0xa23e2d19
rol eax, 0xab
popf
pushf
not eax
add eax, 0xb9568974
xor eax, 0xb93279a2
rol eax, 0xc5
popf
pushf
not eax
add eax, 0xcd1643c5
xor eax, 0xf7d2fb95
rol eax, 0xab
popf
jmp 0x140612e57
ret