joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001ce0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x17]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x17
jb 0x140001ce6
mov rax, rcx
ret

Function at 0x140001cfc
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x13]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x13
jb 0x140001d02
mov rax, rcx
ret

Function at 0x140001d18
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xe]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xe
jb 0x140001d1e
mov rax, rcx
ret

Function at 0x140001d34
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x12]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x12
jb 0x140001d3a
mov rax, rcx
ret

Function at 0x140001d50
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x11]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x11
jb 0x140001d56
mov rax, rcx
ret

Function at 0x140001d6c
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x10]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x10
jb 0x140001d72
mov rax, rcx
ret

Function at 0x140001d88
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x15]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x15
jb 0x140001d8e
mov rax, rcx
ret

Function at 0x140001da4
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x14]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0x14
jb 0x140001daa
mov rax, rcx
ret

Function at 0x140001dc0
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 9]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 9
jb 0x140001dc6
mov rax, rcx
ret

Function at 0x140001ddc
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xc]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xc
jb 0x140001de2
mov rax, rcx
ret

Function at 0x140001df8
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0xd]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 0xd
jb 0x140001dfe
mov rax, rcx
ret

Function at 0x140001e14
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x12]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 9
jb 0x140001e1a
mov rax, rcx
ret

Function at 0x140001e38
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 2]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 2
jb 0x140001e3e
mov rax, rcx
ret

Function at 0x140003088
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 5]
inc r8d
xor byte [rdx], al
inc rdx
cmp r8d, 5
jb 0x14000308e
mov rax, rcx
ret

Function at 0x1400030a4
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 0x4a]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 0x25
jb 0x1400030aa
mov rax, rcx
ret
Function at 0x1400030c8
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov rdx, rcx
mov al, byte [rdx + 8]
inc r8d
xor al, byte [rdx]
movsx eax, al
mov word [rdx], ax
lea rdx, [rdx + 2]
cmp r8d, 4
jb 0x1400030ce
mov rax, rcx
ret

Function at 0x140003cb4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x10]
sub rsp, 0x110
movdqa xmm0, xmmword [0x1400074e0]
lea r9, [rbp + 0x38]
movdqa xmm1, xmmword [0x1400074d0]
lea rdx, [rbp - 0x28]
xor edi, edi
mov dword [rbp - 8], 0xcc9bd7a0
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp + 0x38], rdi
movdqu xmmword [rbp - 0x18], xmm1
mov dword [rbp - 4], 0xa82513ce
mov byte [rbp], 0x6a
call fcn.1400026d0
mov ecx, 0x200
mov dword [rbp + 0x30], edi
call fcn.140001094
mov rbx, rax
mov rax, qword [section..data]
test rax, rax
jne 0x140003d46
mov ecx, 0x118
call fcn.140001094
test rax, rax
je 0x140003d3c
mov rcx, rax
call fcn.1400013b4
jmp 0x140003d3f
mov rax, rdi
mov qword [section..data], rax
mov r8, qword [rbp + 0x38]
or r9d, 0xffffffff
mov dword [rsp + 0x28], 0x100
xor edx, edx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rbx
call qword [rax + 0x78]
lea rcx, [rsp + 0x40]
mov qword [rbp + 0x38], rdi
mov dword [rsp + 0x40], 0xffebff87
mov dword [rsp + 0x44], 0x4cffca
mov dword [rsp + 0x48], 0xffd60005
mov dword [rsp + 0x4c], 0xfffaff8b
mov dword [rsp + 0x50], 0x4b007e
mov dword [rsp + 0x54], 0xffdfffd0
mov dword [rsp + 0x58], 0x7c0005
mov dword [rsp + 0x5c], 0x2dffba
mov dword [rsp + 0x60], 0xffa3ffa5
mov dword [rsp + 0x64], 0x1e0058
mov dword [rsp + 0x68], 0x590029
mov dword [rsp + 0x6c], 0xfff90035
mov dword [rsp + 0x70], 0xffa3ff9d
mov dword [rsp + 0x74], 0x6006d
mov dword [rsp + 0x78], 0xffe5ff91
mov dword [rsp + 0x7c], 0x1e
mov dword [rbp - 0x80], 0x70fffb
mov dword [rbp - 0x7c], 0x1fffd2
mov dword [rbp - 0x78], 0xb10024
mov dword [rbp - 0x74], 0xac00dd
mov dword [rbp - 0x70], 0x3d0078
mov dword [rbp - 0x6c], 0xb200ef
mov dword [rbp - 0x68], 0x5300ce
mov dword [rbp - 0x64], 0xe1002e
mov dword [rbp - 0x60], 0x6700ea
mov dword [rbp - 0x5c], 0x8e0051
mov dword [rbp - 0x58], 0xc00048
mov dword [rbp - 0x54], 0x750094
mov dword [rbp - 0x50], 0x4c0026
mov dword [rbp - 0x4c], 0x10061
mov dword [rbp - 0x48], 0xa800d4
mov dword [rbp - 0x44], 0x5500c1
mov dword [rbp - 0x40], 0xf50062
mov dword [rbp - 0x3c], 0x7d0087
mov dword [rbp - 0x38], 0x9f0063
mov dword [rbp - 0x34], 0xe70016
mov dword [rbp - 0x30], 0x24002a
mov dword [rbp - 0x2c], 0xf6ad8e59
call fcn.1400030a4
lea r8, [rbp + 0x38]
mov rcx, rbx
lea rdx, [rsp + 0x40]
lea r9, [rbp + 0x30]
call fcn.140001e54
mov rax, qword [rbp + 0x38]
test rax, rax
je 0x140003efe
lea rcx, [rbp - 0x28]
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x28], rax
call fcn.1400038cc
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0xd542514d
mov dword [rsp + 0x34], 0x2b3000b7
mov dword [rsp + 0x38], 0xb7bb
mov dword [rsp + 0x3c], 0xdaa96f5
call fcn.140003088
cmp qword [rbp - 0x18], rdi
je 0x140003efe
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x28]
call fcn.1400037c0
mov rbx, qword [rsp + 0x140]
add rsp, 0x110
pop rdi
pop rsi
pop rbp
ret
Function at 0x14075b790
Capabilities:
Terminate process

Disassembly:
sar bh, 1
rcl al, 1
nop
mov es, word [r8]
call rax
rol byte [rbx + 0xe], 1
cmp esp, esp
rcl al, 1
ror byte [rsi], 1
cmp esp, esp
nop
rcl al, 1
rcl al, 1
cmp esp, esp
nop
rcl r8b, 1
shl ah, 1
nop
invalid
cld
pop r11
jmp 0x14075b79d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14075b7ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14075b795
lea eax, [rcx + 1]
jmp 0x14075b7bb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14075b7ce
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14075b7b4
sub eax, 3
jb 0x14075b7ee
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14075b83d
sar eax, 1
movsxd rbp, eax
jb 0x14075b824
jmp 0x14075b7fc
add ebx, ebx
jne 0x14075b7fa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14075b824
inc ecx
add ebx, ebx
jne 0x14075b80a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14075b824
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14075b81d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14075b80c
add ecx, 2
jmp 0x14075b829
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14075b752
jmp 0x14075b79d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x758000]
mov eax, dword [rdi]
or eax, eax
je 0x14075b8a9
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x75b1e4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14075b84d
jns 0x14075b882
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14075b88c
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14075b8a3
mov qword [rbx], rax
add rbx, 8
jmp 0x14075b86d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14075b8ed
cmp al, 0xef
ja 0x14075b8d5
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14075b8b5
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x14075b8c4
mov eax, dword [rdi]
add rdi, 4
jmp 0x14075b8c4
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x24f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14075b941
sub rsp, 0xffffffffffffff80
jmp 0x1406f0dfc
Function at 0x1407c1058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1407c11df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1407c1089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407c106f
add dl, dl
jne 0x1407c1096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407c10f6
xor eax, eax
add dl, dl
jne 0x1407c10a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407c11ad
add dl, dl
jne 0x1407c10b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407c10c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407c10d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407c10dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407c10ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1407c107e
mov eax, 1
add dl, dl
jne 0x1407c1106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407c1113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407c10fb
sub eax, ebx
mov ebx, 1
jne 0x1407c114c
mov ecx, 1
add dl, dl
jne 0x1407c112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407c113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407c1123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407c107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1407c1168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1407c1175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407c115d
cmp eax, 0x7d00
jae 0x1407c119b
cmp eax, 0x500
jb 0x1407c1196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407c107e
cmp eax, 0x7f
ja 0x1407c119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1407c107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407c11d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1407c107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14000157c
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.140001728
movzx eax, al
test eax, eax
jne 0x1400015d0
cmp qword [rsp + 0x30], 0
jne 0x1400015d0
cmp qword [rsp + 0x28], 0
jne 0x1400015d0
mov eax, 0xc0000001
jmp 0x14000171c
mov rax, qword [rsp + 0xb0]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 0x38
rep stosb byte [rdi], al
mov rax, qword [rsp + 0xb8]
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x70], xmm0
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 8]
mov dword [rsp + 0x80], eax
mov dl, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ExAcquireResourceExclusiveLite]
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlLookupElementGenericTableAvl]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x140001659
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
xor eax, eax
jmp 0x14000171c
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 8], rcx
jne 0x14000169d
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
cmp qword [rax], rcx
je 0x1400016a4
mov ecx, 3
int 0x29
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x40]
cmp qword [rsp + 0x48], rax
jne 0x1400016d2
mov byte [rsp + 0x20], 1
jmp 0x1400016d7
mov byte [rsp + 0x20], 0
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlDeleteElementGenericTableAvl]
movzx eax, al
test eax, eax
je 0x14000170b
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x40], 0
jbe 0x14000170b
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x40]
dec eax
mov rcx, qword [rsp + 0x28]
mov dword [rcx + 0x40], eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ExReleaseResourceLite]
xor eax, eax
jmp 0x14000171c
add rsp, 0xa0
pop rdi
ret
Function at 0x140001cc8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov eax, dword [0x140005538]
lea r9, [rbp - 0x1a]
movsd xmm0, qword [0x140005530]
xor esi, esi
mov dword [rbp - 0x12], eax
mov r8d, esi
movzx eax, word [0x14000553c]
mov edi, 0x8d3dcb09
mov word [rbp - 0xe], ax
movsd qword [rbp - 0x1a], xmm0
mov eax, edi
mul r8d
shr edx, 5
movzx eax, dx
imul ecx, eax, 0x3a
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x38
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 7
jl 0x140001d0e
lea rcx, [rbp - 0x1a]
call fcn.140003794
mov rbx, rax
test rax, rax
je 0x140001eef
movsd xmm0, qword [0x140005550]
lea r9, [rbp - 0x30]
mov cl, byte [0x140005558]
mov r8d, esi
movsd qword [rbp - 0x30], xmm0
mov byte [rbp - 0x28], cl
mov eax, edi
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
inc r8d
sub al, cl
add al, 0x38
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x140001d6a
movsd xmm0, qword [0x140005540]
lea r9, [rbp - 0x25]
mov al, byte [0x140005548]
mov r8d, esi
movsd qword [rbp - 0x25], xmm0
mov byte [rbp - 0x1d], al
mov eax, edi
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
inc r8d
sub al, cl
add al, 0x38
xor byte [r9], al
inc r9
cmp r8d, 9
jl 0x140001dab
lea r8, [rbp - 0x30]
mov rcx, rbx
lea rdx, [rbp - 0x25]
call fcn.1400021c0
test rax, rax
je 0x140001ded
add rax, 8
jmp 0x140001e9e
movzx eax, word [0x140005578]
lea r9, [rbp - 0x25]
movsd xmm0, qword [str._ABCDE]
mov r8d, esi
mov word [rbp - 0x1d], ax
mov al, byte [0x14000557a]
mov byte [rbp - 0x1b], al
movsd qword [rbp - 0x25], xmm0
mov eax, edi
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
inc r8d
sub al, cl
add al, 0x38
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x140001e15
movzx eax, word [0x140005568]
lea r9, [rbp - 0x30]
movsd xmm0, qword [0x140005560]
mov r8d, esi
mov word [rbp - 0x28], ax
mov al, byte [0x14000556a]
mov byte [rbp - 0x26], al
movsd qword [rbp - 0x30], xmm0
mov eax, edi
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
inc r8d
sub al, cl
add al, 0x38
xor byte [r9], al
inc r9
cmp r8d, 0xb
jl 0x140001e61
lea r8, [rbp - 0x25]
mov rcx, rbx
lea rdx, [rbp - 0x30]
call fcn.1400021c0
test rax, rax
je 0x140001eef
add rax, 0xd
movsxd rcx, dword [rax + 3]
add rcx, rax
lea rbx, [rcx + 7]
test rbx, rbx
je 0x140001eef
mov edi, dword [rbx + 0x2c]
mov eax, 0xc0000001
test edi, edi
je 0x140001ef4
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExDeleteLookasideListEx]
mov word [rsp + 0x38], si
mov r9d, 1
mov dword [rsp + 0x30], 0x63734943
xor r8d, r8d
mov qword [rsp + 0x28], rdi
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x20], esi
call qword [sym.imp.ntoskrnl.exe_ExInitializeLookasideListEx]
jmp 0x140001ef4
mov eax, 0xc0000001
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140001f0c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
movups xmm0, xmmword [str.o_RPI_Mn2_0D]
movzx eax, word [0x140005598]
lea r9, [rbp - 0x1c]
mov r13, rcx
mov word [rbp - 4], ax
movups xmmword [rbp - 0x1c], xmm0
xor r8d, r8d
mov ebx, 0x8d3dcb09
movsd xmm0, qword [0x140005590]
movsd qword [rbp - 0xc], xmm0
mov eax, ebx
mul r8d
shr edx, 5
movzx eax, dx
imul ecx, eax, 0x3a
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x38
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0xd
jl 0x140001f5d
lea rcx, [rbp - 0x1c]
call fcn.140003794
mov r10, rax
test rax, rax
je 0x140002118
cmp byte [0x1400055b9], 0
movsd xmm0, qword [0x1400055b0]
movzx ecx, word [0x1400055b8]
movsd qword [rbp - 0x30], xmm0
mov word [rbp - 0x28], cx
je 0x140001fe8
xor r8d, r8d
lea r9, [rbp - 0x30]
mov eax, ebx
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
inc r8d
sub al, cl
add al, 0x38
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x140001fc4
cmp byte [0x1400055a9], 0
movsd xmm0, qword [0x1400055a0]
movzx eax, word [0x1400055a8]
movsd qword [rbp - 0x26], xmm0
mov word [rbp - 0x1e], ax
je 0x140002034
xor r8d, r8d
lea r9, [rbp - 0x26]
mov eax, ebx
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
inc r8d
sub al, cl
add al, 0x38
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x140002010
lea r8, [rbp - 0x30]
mov rcx, r10
lea rdx, [rbp - 0x26]
call fcn.1400021c0
test rax, rax
je 0x14000213f
movsxd rcx, dword [rax + 3]
add rax, 7
add rax, rcx
je 0x14000213f
lea r14, [rax - 8]
test r14, r14
je 0x14000213f
lea r15, [rax - 0x18]
test r15, r15
je 0x14000213f
mov edi, dword [r15]
test edi, edi
je 0x14000213f
mov rbx, qword [r14]
xor esi, esi
cmp rbx, r14
je 0x140002118
test rbx, rbx
je 0x140002107
mov rdx, qword [r13 + 8]
mov rcx, qword [rbx + 0x18]
call fcn.1400032e4
test rax, rax
je 0x140002107
mov rcx, qword [rbx]
cmp qword [rcx + 8], rbx
jne 0x140002138
mov rax, qword [rbx + 8]
cmp qword [rax], rbx
jne 0x140002138
mov qword [rax], rcx
xorps xmm0, xmm0
mov qword [rcx + 8], rax
xorps xmm1, xmm1
movups xmmword [rbx + 0x10], xmm0
lea rcx, [rbx + 0x50]
movups xmmword [rbx + 0x20], xmm1
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x40], xmm1
cmp qword [rcx], 0
je 0x1400020f0
movsxd r8, dword [rbx + 0x5c]
xor edx, edx
call fcn.140004ac0
lea rcx, [rbx + 0x60]
cmp qword [rcx], 0
je 0x140002105
movsxd r8, dword [rbx + 0x6c]
xor edx, edx
call fcn.140004ac0
inc esi
mov rbx, qword [rbx]
cmp rbx, r14
jne 0x140002091
test esi, esi
jle 0x140002118
sub edi, esi
mov dword [r15], edi
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov ecx, 3
int 0x29
mov eax, 0xc0000001
jmp 0x14000211a
Function at 0x1400021c0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, rcx
mov r12, r8
xor ecx, ecx
mov r13, rdx
mov r9d, ecx
mov esi, ecx
movsxd rbx, dword [r15 + 0x3c]
add rbx, r15
movzx edi, word [rbx + 0x14]
add rdi, rbx
cmp cx, word [rbx + 6]
jae 0x1400022b3
movzx ebp, word [0x1400054e0]
mov r14d, dword [0x1400054dc]
mov eax, esi
lea r10, [rax + rax*4]
cmp dword [rdi + r10*8 + 0x18], 0x45474150
je 0x140002272
mov dword [rsp + 0x50], r14d
lea r11, [rsp + 0x50]
mov word [rsp + 0x54], bp
mov r8d, ecx
mov eax, 0x8d3dcb09
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
inc r8d
sub al, cl
add al, 0x38
xor byte [r11], al
inc r11
cmp r8d, 6
jl 0x140002235
mov eax, dword [rdi + r10*8 + 0x18]
cmp eax, dword [rsp + 0x50]
jne 0x1400022a0
mov al, byte [rdi + r10*8 + 0x1c]
cmp al, byte [rsp + 0x54]
jne 0x1400022a0
mov ecx, dword [rdi + r10*8 + 0x24]
mov r9, r12
mov edx, dword [rdi + r10*8 + 0x20]
add rcx, r15
mov r8, r13
call fcn.140002148
mov r9, rax
test rax, rax
jne 0x1400022b3
movzx ebp, word [0x1400054e0]
mov r14d, dword [0x1400054dc]
movzx ecx, word [rbx + 6]
inc esi
cmp esi, ecx
mov ecx, 0
jb 0x140002212
mov rbx, qword [rsp + 0x58]
mov rax, r9
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1400022d4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x70
mov r10, qword [0x1400070a8]
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
test r10, r10
jne 0x1400023d2
cmp byte [0x14000534b], 0
mov r10d, 0x8d3dcb09
movups xmm0, xmmword [str.uTyTLDhV257___b_3K]
mov eax, dword [0x140005348]
mov dword [rbp - 0x20], eax
movups xmmword [rbp - 0x30], xmm0
je 0x14000235a
xor r8d, r8d
lea r9, [rbp - 0x30]
mov eax, r10d
mul r8d
shr edx, 5
movsx eax, dl
imul ecx, eax, 0x3a
mov al, r8b
inc r8d
sub al, cl
add al, 0x38
xor byte [r9], al
inc r9
cmp r8d, 0x14
jl 0x140002335
movups xmm0, xmmword [0x140005318]
movzx eax, word [0x140005330]
lea r9, [rbp - 0x1c]
mov word [rbp - 4], ax
xor r8d, r8d
movups xmmword [rbp - 0x1c], xmm0
movsd xmm0, qword [0x140005328]
movsd qword [rbp - 0xc], xmm0
mov eax, r10d
mul r8d
shr edx, 5
movzx eax, dx
imul ecx, eax, 0x3a
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x38
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0xd
jl 0x140002384
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x1c]
call fcn.140003890
mov qword [0x1400070a8], rax
mov r10, rax
test rax, rax
jne 0x1400023d2
mov eax, 0xc0000002
jmp 0x1400023fa
mov rax, qword [rbp + 0x40]
mov r9, rbx
mov qword [rsp + 0x30], rax
mov r8, rdi
mov al, byte [rbp + 0x38]
mov rdx, rsi
mov byte [rsp + 0x28], al
mov rcx, r14
mov rax, qword [rbp + 0x30]
mov qword [rsp + 0x20], rax
call r10
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret