joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001dd00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x14001de54
cmp r9, 4
jb 0x14001dd4a
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x14001dd30
xor r11d, r11d
test r9, r9
je 0x14001de54
cmp r9, 0x40
jb 0x14001de33
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x14001dd7c
cmp rdx, r8
jae 0x14001de33
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x14001dd91
cmp rdx, r10
jae 0x14001de33
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp], rdi
mov rdi, r9
and rdi, 0xffffffffffffffc0
mov rdx, r10
lea rax, [r8 + 0x10]
sub rdx, r8
mov rbx, rcx
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rdi
jb 0x14001ddc0
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
cmp r11, r9
jae 0x14001de54
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x14001de40
add rsp, 8
ret
Function at 0x14003d454
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14003d280
Function at 0x140003208
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003252
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003252
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003252
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003252
cmp dword [rcx + 0x84], 0xe
jbe 0x140003252
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003254
xor al, al
add rsp, 0x28
ret
Function at 0x1800025d0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rbp, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002677
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002677
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0xdc8afaef
lea rdx, [r11 + r9*4]
mov ecx, dword [rdx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180002672
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180002650
cmp r8d, 0x1217e54d
je 0x18000267c
test r9d, r9d
jne 0x180002630
mov rax, qword [rax]
jmp 0x180002600
mov ecx, dword [rbx + 0x24]
mov edx, dword [rbx + 0x1c]
add rcx, r10
add rdx, r10
movzx ecx, word [rcx + r9*2]
mov eax, dword [rdx + rcx*4]
mov rcx, rbp
add rax, r10
call rax
mov rcx, 0xffffffffffffffff
lea rsi, [rax + 1]
mov eax, 2
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.18000ff50
mov rcx, qword gs:[0x60]
mov rdi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov r11d, dword [rdx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x180002745
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x180002745
mov ebx, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
lea rdx, [rbx + r9*4]
mov r8d, dword [rdx + r10]
mov edx, 0x5d722e1c
add r8, r10
movzx eax, byte [r8]
inc r8
test al, al
je 0x180002740
nop
movsx eax, al
lea r8, [r8 + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [r8 - 1]
test al, al
jne 0x180002720
cmp edx, 0xe7b993f8
je 0x18000274a
test r9d, r9d
jne 0x180002700
mov rcx, qword [rcx]
jmp 0x1800026d0
mov ecx, dword [r11 + 0x24]
mov r8, rsi
add rcx, r10
mov rdx, rbp
movzx r9d, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + r9*4]
mov rcx, rdi
add rax, r10
call rax
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180002790
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002837
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002837
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xcd10c6f
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002832
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002810
cmp r8d, 0x5e457f73
je 0x18000283c
test r9d, r9d
jne 0x1800027f0
mov rax, qword [rax]
jmp 0x1800027c0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x30]
add rax, r10
call rax
movd xmm0, dword [rsp + 0x30]
mov rax, rsi
movd xmm2, dword [rsp + 0x34]
mov rbx, qword [rsp + 0x38]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm2, xmm2
cvtps2pd xmm1, xmm0
cvtps2pd xmm0, xmm2
movsd qword [rsi], xmm1
movsd qword [rsi + 8], xmm0
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180002c20
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x110
movaps xmmword [rax - 0x18], xmm6
mov r14, r8
movaps xmmword [rax - 0x28], xmm7
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm8
mov rbp, rcx
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
movaps xmmword [rax - 0x68], xmm11
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov edi, dword [r9 + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180002cf7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180002cf7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xd8db5217
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002cf2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002cd0
cmp r8d, 0xa0f61215
je 0x180002cfc
test r9d, r9d
jne 0x180002cb0
mov rax, qword [rax]
jmp 0x180002c80
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r10
call rax
movsd xmm7, qword [rsi]
mov rcx, rbp
movsd xmm8, qword [rsi + 8]
addsd xmm7, qword [0x180012be0]
addsd xmm8, qword [0x180012be0]
movups xmm9, xmmword [0x180012b18]
movups xmm10, xmmword [0x180019328]
movaps xmm11, xmmword [r14]
movaps xmm6, xmmword [rsi]
call fcn.1800025d0
cmp word [rax], 0
je 0x180002d76
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp word [rax + rcx*2], 0
jne 0x180002d60
xor edx, edx
add ecx, 1
je 0x180002d7a
mov rdx, rax
jmp 0x180002d7a
xor edx, edx
mov ecx, edx
mov rax, qword [0x1800157c8]
movaps xmm0, xmmword [0x180012e60]
mov rbx, qword [0x180015820]
mov qword [rsp + 0x20], rax
mov rax, qword [0x1800197e0]
movsd qword [rsp + 0x38], xmm6
unpckhpd xmm6, xmm6
movsd qword [rsp + 0x40], xmm6
movsd qword [rsp + 0x80], xmm7
movsd qword [rsp + 0x88], xmm8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x68], 0
mov word [rsp + 0x90], 0x100
mov byte [rsp + 0x92], 1
movups xmmword [rsp + 0x48], xmm0
movups xmmword [rsp + 0x58], xmm11
movups xmmword [rsp + 0x6c], xmm10
movups xmmword [rsp + 0x94], xmm9
test rax, rax
jne 0x180002e28
mov rax, qword [0x180015940]
lea r8, str.Canvas.K2_DrawText
add rax, 0x1216928
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x1800197e0], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x268]
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r14
ret
Function at 0x180002e80
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x100
movaps xmmword [rax - 0x18], xmm6
mov r14, r8
movaps xmmword [rax - 0x28], xmm7
mov rsi, rdx
movaps xmmword [rax - 0x38], xmm8
mov rbp, rcx
movaps xmmword [rax - 0x48], xmm9
movaps xmmword [rax - 0x58], xmm10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd r9, dword [r10 + 0x3c]
mov edi, dword [r9 + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180002f47
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180002f47
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x4be2c2e5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002f42
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002f20
cmp r8d, 0x503ab4b7
je 0x180002f4c
test r9d, r9d
jne 0x180002f00
mov rax, qword [rax]
jmp 0x180002ed0
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rbp
add rax, r10
call rax
movsd xmm7, qword [rsi]
mov rcx, rbp
movsd xmm8, qword [rsi + 8]
addsd xmm7, qword [0x180012be0]
addsd xmm8, qword [0x180012be0]
movups xmm9, xmmword [0x180012b18]
movups xmm10, xmmword [0x180019328]
movaps xmm6, xmmword [rsi]
call fcn.1800025d0
cmp word [rax], 0
je 0x180002fc6
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x180002fb0
xor edx, edx
add ecx, 1
je 0x180002fca
mov rdx, rax
jmp 0x180002fca
xor edx, edx
mov ecx, edx
mov rax, qword [0x1800157c8]
movaps xmm0, xmmword [0x180012e60]
mov rbx, qword [0x180015820]
mov qword [rsp + 0x20], rax
mov rax, qword [0x1800197e0]
movsd qword [rsp + 0x38], xmm6
unpckhpd xmm6, xmm6
movsd qword [rsp + 0x40], xmm6
movsd qword [rsp + 0x80], xmm7
movsd qword [rsp + 0x88], xmm8
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x68], 0
mov word [rsp + 0x90], 0x101
mov byte [rsp + 0x92], 1
movups xmmword [rsp + 0x48], xmm0
movaps xmm0, xmmword [r14]
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x6c], xmm10
movups xmmword [rsp + 0x94], xmm9
test rax, rax
jne 0x18000307b
mov rax, qword [0x180015940]
lea r8, str.Canvas.K2_DrawText
add rax, 0x1216928
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call rax
mov qword [0x1800197e0], rax
mov r9, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, rax
mov rcx, rbx
call qword [r9 + 0x268]
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop r14
ret
Function at 0x140001d20
Capabilities:
Encode data using base64

Disassembly:
push rbx
mov r11, r8
xor r9d, r9d
xor r8b, r8b
xor eax, eax
mov rbx, rcx
test edx, edx
je 0x140001e2b
mov qword [rsp + 0x10], rsi
lea rsi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mov qword [rsp + 0x18], rdi
mov edi, edx
nop dword [rax + rax]
movzx r10d, byte [rbx]
mov edx, r9d
test r9d, r9d
je 0x140001db5
sub edx, 1
je 0x140001d92
cmp edx, 1
jne 0x140001dcc
movzx r8d, r8b
mov ecx, r10d
shr rcx, 6
and r8d, 0xf
shl r8, 2
xor r9d, r9d
or r8, rcx
movzx ecx, byte [r8 + rsi]
mov byte [rax + r11], cl
inc eax
mov ecx, r10d
and ecx, 0x3f
jmp 0x140001dc2
movzx r8d, r8b
mov rcx, r10
and r8d, 3
shr rcx, 4
shl r8, 4
mov r9d, 2
or r8, rcx
movzx ecx, byte [r8 + rsi]
jmp 0x140001dc6
mov rcx, r10
mov r9d, 1
shr rcx, 2
movzx ecx, byte [rcx + rsi]
mov byte [rax + r11], cl
inc eax
inc rbx
mov edx, eax
mov r8, r10
sub rdi, 1
jne 0x140001d50
mov rdi, qword [rsp + 0x18]
mov eax, edx
sub r9d, 1
je 0x140001e04
cmp r9d, 1
jne 0x140001e26
mov rax, r10
and eax, 0xf
movzx eax, byte [rsi + rax*4]
mov byte [rdx + r11], al
lea eax, [rdx + 1]
jmp 0x140001e1f
mov rax, r10
and eax, 3
add rax, rax
movzx eax, byte [rsi + rax*8]
mov byte [rdx + r11], al
lea eax, [rdx + 1]
mov byte [rax + r11], 0x3d
inc eax
mov byte [rax + r11], 0x3d
inc eax
mov rsi, qword [rsp + 0x10]
mov ecx, eax
mov byte [rcx + r11], 0
pop rbx
ret

Function at 0x140003a00
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1400a5010]
xor rax, rsp
mov qword [rbp + 0x80], rax
push rsi
call fcn.140a72fe2
mov rcx, rax
lea r8, [rsp + 0x30]
mov edx, 0x20
call fcn.140a8ae2b
jg 0x140003a82
test byte [rbp - 0x38aa8b40], 0x44
and al, 0x38
add dword [rax], eax
add byte [rax], al
lea r8, [rsp + 0x3c]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
push rbx
call fcn.1400decf2
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 0x10]
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call fcn.1401527be
stosb byte [rdi], al
push rcx
call fcn.140a99804
mov rcx, qword [rsp + 0x30]
push rdx
call fcn.140176e04
lea rcx, [0x14009b838]
jmp fcn.1401130d3
Function at 0x140006d70
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r15, rdx
mov rsi, rcx
sub r15, rcx
mov r9d, 4
mov qword [rsp + 0x38], r15
nop dword [rax]
mov r8d, 4
nop word [rax + rax]
movzx eax, byte [r15 + rcx]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x140006db0
sub r9, 1
jne 0x140006da0
mov r15, qword [rsp + 0x40]
mov r12b, 1
lea r10, str.cw
mov r8, rsi
mov r9d, 4
nop
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r10]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x140006df0
inc r8
sub r9, 1
jne 0x140006de0
movzx eax, byte [rsi + 5]
movzx ecx, byte [rsi + 1]
mov byte [rsi + 1], al
movzx eax, byte [rsi + 9]
mov byte [rsi + 5], al
movzx eax, byte [rsi + 0xd]
mov byte [rsi + 9], al
movzx eax, byte [rsi + 0xa]
mov byte [rsi + 0xd], cl
movzx ecx, byte [rsi + 2]
mov byte [rsi + 2], al
movzx eax, byte [rsi + 0xe]
mov byte [rsi + 0xa], cl
movzx ecx, byte [rsi + 6]
mov byte [rsi + 6], al
movzx eax, byte [rsi + 0xf]
mov byte [rsi + 0xe], cl
movzx ecx, byte [rsi + 3]
mov byte [rsi + 3], al
movzx eax, byte [rsi + 0xb]
mov byte [rsi + 0xf], al
movzx eax, byte [rsi + 7]
mov byte [rsi + 0xb], al
mov byte [rsi + 7], cl
cmp r12b, 0xa
je 0x140006f7e
lea r14, [rsi + 2]
lea ebp, [rdx + 4]
nop dword [rax]
nop word [rax + rax]
movzx edi, byte [r14 - 2]
movzx r8d, byte [r14 - 1]
movzx edx, dil
movzx ebx, byte [r14 + 1]
xor dl, r8b
movzx r10d, byte [r14]
lea r14, [r14 + 4]
movzx eax, dl
movzx r9d, bl
shr al, 7
add dl, dl
movzx eax, al
xor r9b, r10b
imul ecx, eax, 0x1b
movzx r11d, r9b
xor r11b, dil
xor r11b, r8b
xor cl, dl
movzx edx, r8b
xor cl, dil
xor dl, r10b
xor cl, r11b
movzx eax, dl
mov byte [r14 - 6], cl
xor dil, bl
shr al, 7
add dl, dl
movzx eax, al
imul ecx, eax, 0x1b
movzx eax, r9b
shr al, 7
add r9b, r9b
movzx eax, al
xor cl, dl
xor cl, r8b
xor cl, r11b
mov byte [r14 - 5], cl
imul ecx, eax, 0x1b
movzx eax, dil
shr al, 7
add dil, dil
movzx eax, al
xor cl, r9b
xor cl, r10b
xor cl, r11b
mov byte [r14 - 4], cl
imul ecx, eax, 0x1b
xor cl, dil
xor cl, bl
xor cl, r11b
mov byte [r14 - 3], cl
sub rbp, 1
jne 0x140006e80
movzx r8d, r12b
lea r9d, [rbp + 4]
shl r8, 4
mov rax, rsi
sub r8, rsi
add r8, r15
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x140006f60
sub r9, 1
jne 0x140006f50
inc r12b
jmp 0x140006dce
mov r15, qword [rsp + 0x38]
mov edx, 4
nop dword [rax + rax]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [r15 + rsi + 0xa0]
xor byte [rsi], al
inc rsi
sub rcx, 1
jne 0x140006fa0
sub rdx, 1
jne 0x140006f90
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140006fd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
mov ebx, 4
mov rax, qword gs:[0x58]
add rbx, qword [rax]
lea r15, [0x1400a9200]
mov eax, dword [rbx]
cmp dword [0x1400aa59c], eax
jle 0x140007087
lea rcx, [0x1400aa59c]
call fcn.140007e68
cmp dword [0x1400aa59c], 0xffffffff
jne 0x140007087
call fcn.140007c18
mov dword [0x1400aa584], 0xffffffff
mov dword [0x1400a9204], eax
mov r8d, 1
nop dword [rax]
nop word [rax + rax]
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, r8d
mov dword [r15 + r8*4 + 4], eax
inc r8
cmp r8, 0x270
jb 0x140007050
mov dword [0x1400a9200], 0x270
lea rcx, [0x1400aa59c]
call fcn.140007e08
xor r13d, r13d
mov eax, dword [rbx]
cmp dword [0x1400aa588], eax
jle 0x1400070c6
lea rcx, [0x1400aa588]
call fcn.140007e68
cmp dword [0x1400aa588], 0xffffffff
jne 0x1400070c6
mov dword [0x1400aa590], r13d
mov dword [0x1400aa594], 0x68
lea rcx, [0x1400aa588]
call fcn.140007e08
mov rax, rdi
cmp qword [rdi + 0x18], 8
jb 0x1400070d3
mov rax, qword [rdi]
mov qword [rdi + 0x10], r13
mov word [rax], r13w
mov ebp, 5
cmp qword [rdi + 0x18], rbp
jae 0x1400070fb
mov rbx, qword [rdi + 0x10]
mov edx, ebp
sub rdx, rbx
mov rcx, rdi
call fcn.140007440
mov qword [rdi + 0x10], rbx
mov r12d, 0x80000000
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [0x1400aa590]
lea eax, [rcx - 0x80000000]
lea r14d, [rcx + r12]
cmp ecx, r12d
cmovae r14d, eax
mov ecx, dword [0x1400aa594]
lea eax, [rcx - 0x80000000]
lea ebx, [rcx + r12]
cmp ecx, r12d
cmovae ebx, eax
sub ebx, r14d
mov rcx, r15
cmp ebx, 0xffffffff
jne 0x140007151
call fcn.1400078e0
mov ecx, eax
jmp 0x140007188
inc ebx
call fcn.1400078e0
mov esi, ebx
mov ecx, eax
imul rcx, rsi
cmp ecx, ebx
jae 0x140007184
mov eax, ebx
neg eax
xor edx, edx
div ebx
mov ebx, edx
cmp ecx, edx
jae 0x140007184
mov rcx, r15
call fcn.1400078e0
mov ecx, eax
imul rcx, rsi
cmp ecx, ebx
jb 0x140007172
shr rcx, 0x20
lea edx, [r14 + rcx]
lea eax, [rdx + r12]
lea ecx, [rdx - 0x80000000]
cmp edx, r12d
cmovae ecx, eax
movsxd rax, ecx
lea rcx, [0x14009bf00]
movzx r9d, word [rcx + rax*2]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x1400071d9
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 8
jb 0x1400071cc
mov rax, qword [rdi]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r13w
jmp 0x1400071e1
mov rcx, rdi
call fcn.1400075c0
sub rbp, 1
jne 0x140007110
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400078e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140007941
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140007900
mov ecx, dword [r10]
jmp 0x140007a2a
cmp ecx, 0x4e0
jb 0x140007a2a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140007960
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400079b0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140008864
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
push rdi
call fcn.140132a2a
test rax, rax
je 0x1400088ae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400088ae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400088ae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400088ae
cmp dword [rcx + 0x84], 0xe
jbe 0x1400088ae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400088b0
xor al, al
add rsp, 0x28
ret
Function at 0x1400117b0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea rsi, [rcx + rdx]
mov rbx, rcx
mov edi, 0x1505
cmp rcx, rsi
jae 0x14001148b
movzx ecx, byte [rbx]
call fcn.140020ea0
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x140011470
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
movzx eax, dil
add rsp, 0x20
pop rdi
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1400117e6
call fcn.140022000
test al, al
jne 0x1400117e6
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140011a80
mov rdx, qword [rsp + 0x30]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x140011450
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140020f10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movzx ebp, byte [rcx]
mov rsi, rdx
mov rbx, rcx
test bpl, bpl
je 0x140020f5e
movzx ecx, byte [rsi]
test cl, cl
je 0x140020f5e
call fcn.140020ea0
movzx ecx, bpl
movzx edi, al
call fcn.140020ea0
cmp al, dil
jne 0x140020f83
movzx ebp, byte [rbx + 1]
inc rbx
inc rsi
test bpl, bpl
jne 0x140020f32
xor ecx, ecx
mov eax, ecx
cmp byte [rbx], al
sete al
cmp byte [rsi], cl
setne cl
xor eax, ecx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor eax, eax
jmp 0x140020f6e