joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1404dc497
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
cmp dil, r11b
mov qword [rax + 8], rbx
cmp r14b, 0x7f
mov qword [rax + 0x10], rbp
cmc
mov qword [rax + 0x18], rsi
cmc
jmp 0x1404dc4b4
mov qword [rax + 0x20], rdi
jmp 0x1404dc4bf
push r14
sub rsp, 0x40
jmp 0x1404dc4ca
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r14d, r14d
bsf rbx, r11
shr bl, cl
cmovg bx, r10w
mov rbx, rax
jmp 0x1404dc4eb
test rax, rax
je 0x1404dc669
mov rsi, rax
cmp bpl, 0xea
test r8b, 0x30
jmp 0x1404dc504
cmp word [rax], r14w
jmp 0x1404dc50d
je 0x1404dc552
or rax, 0xffffffffffffffff
jmp 0x1404dc51c
inc rax
jmp 0x1404dc524
cmp word [rsi + rax*2], r14w
jne 0x1404dc51c
lea rsi, [rsi + rax*2]
jmp 0x1404dc538
add rsi, 2
test r9b, r14b
cmp r10b, 0x30
cmp word [rsi], r14w
jmp 0x1404dc54c
jne 0x1404dc513
mov qword [rsp + 0x38], r14
rcl r9w, cl
sub rsi, rbx
rol r9b, 0x94
shr r8b, 0xa0
mov qword [rsp + 0x30], r14
shl r9b, cl
add rsi, 2
cmp cl, r10b
adc r9b, 0xc4
add r8b, al
sar rsi, 1
sbb r8w, cx
test r9w, 0x4e5a
mov r8, rbx
mov r9d, esi
clc
test r12d, 0x773f5177
mov dword [rsp + 0x28], r14d
stc
xor edx, edx
stc
mov qword [rsp + 0x20], r14
cmc
jmp 0x1404dc5af
sub ecx, ecx
jmp 0x1404dc5b6
call fcn.1404ccb79
movsxd rbp, eax
test eax, eax
jmp 0x1404dc5c5
je 0x1404dc669
mov rcx, rbp
call fcn.1404ccab1
mov rdi, rax
test r8b, 0x56
test rax, rax
je 0x1404dc654
mov qword [rsp + 0x38], r14
inc r8w
mov r9d, esi
rcl r8b, 0xaa
bt r8, 0x54
adc r8, 0x713167cc
mov qword [rsp + 0x30], r14
bt r8w, si
mov r8, rbx
jmp 0x1404dc612
mov dword [rsp + 0x28], ebp
jmp 0x1404dc61b
xor edx, edx
sub ecx, ecx
jmp 0x1404dc624
mov qword [rsp + 0x20], rax
jmp 0x1404dc62e
call fcn.1404ccb79
test eax, eax
je 0x1404dc654
mov rsi, rdi
movzx di, spl
movzx rdi, r11w
mov rdi, r14
jmp 0x1404dc64f
jmp 0x1404dc657
mov rsi, r14
mov rcx, rdi
jmp 0x1404dc65f
call fcn.1404cca27
jmp 0x1404dc672
mov rsi, r14
jmp 0x1404dc672
test rbx, rbx
jmp 0x1404dc67a
je 0x1404dc68e
mov rcx, rbx
jmp 0x1404dc688
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
movsx di, cl
bsr esi, ecx
mov rsi, qword [rsp + 0x60]
movsx r14, cx
mov rbp, qword [rsp + 0x58]
ror r14b, cl
mov rdi, qword [rsp + 0x68]
xor r14b, 0x5a
rcr r14b, 0xa2
add rsp, 0x40
movzx r14d, bp
jmp 0x1404dc6ce
pop r14
jmp 0x1404dc6d5
ret
Function at 0x1404dc6d6
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
test r11, rcx
cmp r8w, r13w
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
cmp dx, 0xa47
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
sub esi, esi
test r10, rdx
shr bx, 0
btr ebx, 0x79
mov rbx, rax
stc
cmp r10b, r11b
test rax, rax
je 0x1404dc7fc
mov rbp, rax
cmp word [rax], si
jmp 0x1404dc724
je 0x1404dc772
or rax, 0xffffffffffffffff
jmp 0x1404dc733
inc rax
cmp word [rbp + rax*2], si
jne 0x1404dc733
lea rbp, [rbp + rax*2]
cmp sp, ax
jmp 0x1404dc755
add rbp, 2
clc
jmp 0x1404dc763
cmp word [rbp], si
jmp 0x1404dc76c
jne 0x1404dc72a
sub rbp, rbx
bt rcx, 0xe6
add rbp, 2
jmp 0x1404dc783
sar rbp, 1
btr cx, 0x64
shrd ecx, r10d, 0xd6
neg cx
add rbp, rbp
mov ecx, 0x7ada64c6
setno ch
mov rcx, rbp
jmp 0x1404dc7a6
call fcn.1404ccab1
mov rdi, rax
cmp r13, 0x69fd1933
clc
test rax, rax
jmp 0x1404dc7be
je 0x1404dc7e2
mov r8, rbp
mov dl, 0x9a
mov rdx, rbx
mov ch, 0x9d
movsxd rcx, esp
mov rcx, rax
jmp 0x1404dc7da
call fcn.1404a6b00
mov rsi, rdi
xor ecx, ecx
jmp 0x1404dc7e9
call fcn.1404cca27
mov rcx, rbx
jmp 0x1404dc7f6
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rbx, qword [rsp + 0x30]
mov rax, rsi
xchg rbp, rdi
mov rsi, qword [rsp + 0x40]
cmp r13d, 0x46181375
add bpl, 0xf6
mov rbp, qword [rsp + 0x38]
adc dil, bl
rcl dil, 0x2e
add rsp, 0x20
movzx rdi, r11w
pop rdi
ret
Function at 0x1404df793
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
movzx eax, cx
movsx ax, bl
push rdi
movsxd rax, r9d
movsx ax, bl
push r14
cbw
movzx eax, r14w
mov eax, 0x1450
jmp 0x1404df7c0
call fcn.14044c18a
sub rsp, rax
mov eax, 0x68d767ca
not bp
mov rax, qword [0x1400b7288]
xor rax, rsp
rol r10b, cl
add r14b, bpl
mov qword [rsp + 0x1440], rax
movsxd r10, edx
cmp dl, bpl
mov rdi, rcx
sbb dh, 0xfd
cdqe
movsx edx, si
mov rax, r10
dec dh
xor rcx, rax
mov ebp, r9d
bt cx, dx
cmp r8d, 0x30452d05
sar rax, 6
rol dl, cl
lea rcx, [0x1400ba940]
and r10d, 0x3f
cmc
bswap r14w
add rbp, r8
mov rsi, r8
test r14w, cx
movzx r14, bp
mov rax, qword [rcx + rax*8]
setbe dl
sub r14b, 0x4f
lea rdx, [r10 + r10*8]
ror r14b, 0x15
mov r14, qword [rax + rdx*8 + 0x28]
jmp 0x1404df855
sub eax, eax
mov qword [rdi], rax
cmp r10b, 0x99
mov dword [rdi + 8], eax
cmp r9w, 0xcef
cmp r8, rbp
jmp 0x1404df86f
jae 0x1404df962
lea rbx, [rsp + 0x40]
cmp rsi, rbp
jmp 0x1404df882
jae 0x1404df8dc
mov al, byte [rsi]
inc rsi
stc
test rdx, 0x2e6d6a5d
cmp al, 0xa
jne 0x1404df8b0
inc dword [rdi + 8]
jmp 0x1404df8a5
mov byte [rbx], 0xd
jmp 0x1404df8ad
inc rbx
mov byte [rbx], al
movsx eax, bx
movsxd rax, edi
inc rbx
movsx ax, r14b
rol al, cl
lea rax, [rsp + 0x143f]
cmc
cmp esi, r9d
cmp rbx, rax
jmp 0x1404df8d6
jb 0x1404df87a
and qword [rsp + 0x20], 0
inc dx
ror r8w, cl
lea rax, [rsp + 0x40]
rol r9b, cl
sub ebx, eax
not r9b
lea r9, [rsp + 0x30]
cdq
mov r8d, ebx
lea rdx, [rsp + 0x40]
not rcx
movsx cx, dil
movsx rcx, r9w
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404df920
je 0x1404df950
mov eax, dword [rsp + 0x30]
test dx, ax
add dword [rdi + 4], eax
cmp eax, ebx
jmp 0x1404df937
jb 0x1404df962
cmp rsi, rbp
jmp 0x1404df945
jb 0x1404df875
jmp 0x1404df962
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
shl cx, cl
bt ecx, r10d
xor al, sil
mov rax, rdi
rcr cx, cl
adc ch, 0xa1
btr cx, r11w
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x1404df980
call fcn.1404a2f20
lea r11, [rsp + 0x1450]
mov rbx, qword [r11 + 0x20]
cmove edi, r15d
mov rbp, qword [r11 + 0x30]
mov rsp, r11
movzx r14w, sil
bswap edi
pop r14
movsx rsi, r12w
movzx edi, r14w
movzx rsi, r9w
pop rdi
sete sil
pop rsi
jmp 0x1404df9bc
ret
Function at 0x1404df9bd
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
cwde
mov ax, r15w
movsx eax, r8w
push rdi
push r14
xchg al, ah
lahf
mov eax, 0x1450
jmp 0x1404df9ea
call fcn.14044c18a
sub rsp, rax
rcl bpl, 0xba
mov rax, qword [0x1400b7288]
rcl bp, cl
movzx r14, r11w
sar r10d, cl
xor rax, rsp
shl dil, 0x11
movsx di, sil
jmp 0x1404dfa18
mov qword [rsp + 0x1440], rax
cmc
movsx rsi, r11w
sbb dil, 0x1e
movsxd r10, edx
shr dil, cl
rcl rsi, cl
mov rdi, rcx
cdqe
bt bp, 0x33
mov rax, r10
shl bp, cl
mov ebp, r9d
sar rax, 6
lea rcx, [0x1400ba940]
shl r14, 0x7a
and r10d, 0x3f
test r10b, al
cwd
lea rbp, [rbp + r8]
cqo
xchg edx, edx
sar sil, cl
mov rsi, r8
neg r14w
sar r14b, 0x70
add dl, bpl
mov rax, qword [rcx + rax*8]
or dx, r13w
lea rdx, [r10 + r10*8]
mov r14, qword [rax + rdx*8 + 0x28]
jmp 0x1404dfa92
xor eax, eax
cmc
cmp bp, r9w
mov qword [rdi], rax
mov dword [rdi + 8], eax
cmp dx, cx
test cl, bpl
cmp r14b, 0x80
cmp r8, rbp
jmp 0x1404dfab1
jae 0x1404dfbe6
lea rbx, [rsp + 0x40]
stc
cmp rsi, rbp
jmp 0x1404dfac5
jae 0x1404dfb35
movzx eax, word [rsi]
add rsi, 2
test ch, 0xec
cmp dil, r9b
cmp ax, 0xa
jmp 0x1404dfae1
jne 0x1404dfb10
add dword [rdi + 8], 2
clc
test dil, cl
mov cx, 0x276b
mov ecx, 0xd
mov word [rbx], cx
cmp r8b, r10b
add rbx, 2
test r11b, 0xa8
test si, bp
cmp r14d, 0x71b94a50
mov word [rbx], ax
bswap ax
add rbx, 2
lea rax, [rsp + 0x143e]
test r15b, 0x65
clc
cmp rbx, rax
jmp 0x1404dfb2f
jb 0x1404dfabd
and qword [rsp + 0x20], 0
lea rax, [rsp + 0x40]
jmp 0x1404dfb4e
sub rbx, rax
movsx r9, bp
sal cx, cl
lea r9, [rsp + 0x30]
cqo
sub dx, r12w
sar rbx, 1
cmp r15b, dil
lea rdx, [rsp + 0x40]
mov r8, 0xf86232c
add ebx, ebx
cmovae r8w, r8w
jmp 0x1404dfb85
mov rcx, r14
movsx r8, r14w
setno r8b
jmp 0x1404dfb95
mov r8d, ebx
jmp 0x1404dfb9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404dfbaa
je 0x1404dfbdb
mov eax, dword [rsp + 0x30]
test r14d, 0x595a4dfb
cmp spl, r13b
test ebp, r10d
add dword [rdi + 4], eax
stc
cmp eax, ebx
jb 0x1404dfbe6
cmp rsi, rbp
jb 0x1404dfab7
jmp 0x1404dfbe6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rdi], eax
rcl ch, 0x81
mov rax, rdi
rol ch, 0xe4
mov rcx, qword [rsp + 0x1440]
xor rcx, rsp
jmp 0x1404dfbfc
call fcn.1404a2f20
lea r11, [rsp + 0x1450]
mov bpl, r8b
bswap bx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
movsxd rdi, edx
movsx esi, cx
cmovo rdi, rax
mov rsp, r11
bswap edi
setnp r14b
xchg edi, r14d
pop r14
setg sil
movsx di, r9b
bswap rdi
pop rdi
pop rsi
jmp 0x1404dfc42
ret
Function at 0x1404dfc43
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
cdqe
mov qword [rsp + 0x18], rbp
bswap ax
movzx rax, bp
movsx ax, r9b
push rsi
cwde
push rdi
push r12
cwde
push r14
cdqe
cwde
movsx rax, r8w
push r15
mov eax, 0x1470
jmp 0x1404dfc76
call fcn.14044c18a
sub rsp, rax
mov rax, qword [0x1400b7288]
movsx r15d, di
adc r12w, 0x5f1e
xor rax, rsp
mov qword [rsp + 0x1460], rax
xadd r15w, r10w
bt ax, 0xf3
movsxd r10, edx
movzx ax, r8b
mov rbx, rcx
mov rax, r10
test r13b, 0x4c
ror dil, 0x19
mov r14d, r9d
rcl r12b, cl
sar rax, 6
cmp spl, 0x7d
lea rcx, [0x1400ba940]
movsx r12d, r14w
shl r12b, cl
movzx edi, bx
and r10d, 0x3f
add r14, r8
or rdx, 0x5a850fbd
stc
shr r12w, cl
mov r15, r8
mov rdi, r8
neg r12
or r12d, r13d
mov rax, qword [rcx + rax*8]
or r12w, 0x31e0
lea rdx, [r10 + r10*8]
sar r12d, 0xb8
cmovge r12w, r10w
and r12w, r11w
mov r12, qword [rax + rdx*8 + 0x28]
cmc
xor eax, eax
test r11w, di
mov qword [rbx], rax
cmp r8, r14
jmp 0x1404dfd2a
mov dword [rbx + 8], eax
jmp 0x1404dfd32
jae 0x1404dfef3
lea rax, [rsp + 0x50]
test cl, bpl
cmp rdi, r14
jmp 0x1404dfd48
jae 0x1404dfdba
movzx ecx, word [rdi]
add rdi, 2
cmp cx, 0xa
jmp 0x1404dfd5e
jne 0x1404dfd81
mov edx, 0xd
cmp r9d, esp
cmp r8w, 0x5a2a
mov word [rax], dx
stc
add rax, 2
stc
cmp r10w, 0x3e1e
mov word [rax], cx
bsr cx, di
rcr ch, cl
movzx ecx, r12w
add rax, 2
add cx, r10w
rol cl, cl
and rcx, 0x7377686
lea rcx, [rsp + 0x6f8]
jmp 0x1404dfdac
cmp rax, rcx
jmp 0x1404dfdb4
jb 0x1404dfd40
and qword [rsp + 0x38], 0
adc r9, rbp
xor r8w, bx
lea rcx, [rsp + 0x50]
dec r8
add r8b, 5
shr r8w, cl
and qword [rsp + 0x30], 0
bswap r9w
bsr r8w, r13w
test bx, ax
lea r8, [rsp + 0x50]
and r9b, spl
sub rax, rcx
inc cx
mov dword [rsp + 0x28], 0xd55
sets cl
lea rcx, [rsp + 0x700]
btr r9d, 4
xor r9b, 0x75
sar rax, 1
clc
setle r9b
cmovo r9w, r10w
mov qword [rsp + 0x20], rcx
rol r9b, 0x74
mov r9d, eax
sbb rcx, 0x4d886f37
mov ecx, 0xfde9
sub edx, edx
jmp 0x1404dfe3f
call fcn.1404ccb79
mov ebp, eax
jmp 0x1404dfe4b
test eax, eax
je 0x1404dfee3
xor esi, esi
test eax, eax
jmp 0x1404dfe5c
je 0x1404dfec5
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x700]
sal cl, 0xdb
bts r9d, r13d
mov ecx, esi
bts r8d, r15d
lea r9, [rsp + 0x40]
xor r8b, sil
dec r8b
mov r8d, ebp
cmp bpl, r14b
add rdx, rcx
or cl, 0x9c
bswap cx
btc ecx, esi
mov rcx, r12
cmc
sub r8d, esi
jmp 0x1404dfea6
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jmp 0x1404dfeb3
je 0x1404dfee3
add esi, dword [rsp + 0x40]
cmp esi, ebp
jb 0x1404dfe62
mov eax, edi
clc
test bp, dx
sub eax, r15d
mov dword [rbx + 4], eax
cmp bp, r8w
stc
cmp rdi, r14
jmp 0x1404dfede
jmp 0x1404dfd32
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
sal al, 0xd5
bts ax, r11w
mov rax, rbx
or ecx, 0x71aa1a2e
btr cx, r12w
sar ecx, cl
mov rcx, qword [rsp + 0x1460]
cmp si, cx
clc
xor rcx, rsp
jmp 0x1404dff17
call fcn.1404a2f20
lea r11, [rsp + 0x1470]
movsx r15w, dl
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
movsx rsi, bx
movzx r12, di
mov rsp, r11
movsxd r12, r15d
pop r15
pop r14
pop r12
movzx esi, r13w
pop rdi
setae sil
pop rsi
ret
Function at 0x1404e35ec
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
sar r8b, cl
xor bl, sil
push rdi
xor bx, 0x2328
sub rsp, 0x20
mov rbx, rdx
movzx rdi, sp
movsx r8w, dl
not di
lea r9, [0x1400c8ea8]
cwd
cdq
mov edi, ecx
cdq
not cx
mov ch, 5
lea rdx, [0x1400cf748]
movzx r8w, al
movsx r8, r13w
movzx rcx, r8w
mov ecx, 3
movzx r8, r8w
movsx r8, r15w
movzx r8w, r11b
lea r8, [0x1400c8ea0]
jmp 0x1404e3655
call fcn.1404e3770
mov rdx, rbx
ror cx, cl
sal ecx, 0x70
xor ch, 0x2c
mov ecx, edi
cmp sil, r10b
cmc
test rax, rax
jmp 0x1404e3674
je 0x1404e3685
call qword [case.0x1404e35ce.0]
jmp 0x1404e368b
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
bt edi, 0x11
add rsp, 0x20
pop rdi
jmp 0x1404e369e
ret
Function at 0x1404e7712
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
adc r10w, 0x17cc
sub rsp, 0x30
xor eax, eax
sal r10w, cl
mov r10d, ecx
test dl, r11b
test rdx, rdx
jmp 0x1404e7732
jne 0x1404e776b
call fcn.1404b8a35
mov ebx, 0x16
mov dword [rax], ebx
jmp 0x1404e7749
call fcn.1404b970a
mov eax, ebx
movsx rbx, r13w
bsr ebx, ecx
add rsp, 0x30
jmp 0x1404e7764
pop rbx
jmp 0x1404e776a
ret
test r8, r8
jmp 0x1404e7773
je 0x1404e7738
movzx ecx, byte [rsp + 0x60]
test si, r14w
mov word [rdx], ax
btr ax, 0x2b
lea rax, [rcx + 1]
clc
cmp r8, rax
jmp 0x1404e7797
ja 0x1404e77ac
call fcn.1404b8a35
mov ebx, 0x22
jmp 0x1404e7742
lea eax, [r9 - 2]
clc
jmp 0x1404e77b6
mov ebx, 0x22
cmp eax, ebx
ja 0x1404e7738
mov byte [rsp + 0x60], cl
add ch, ah
mov ecx, r10d
bsf bx, r12w
sal bx, 8
add rsp, 0x30
jmp 0x1404e77e6
pop rbx
jmp 0x1404e77ec
jmp 0x1404e77f1
mov qword [rsp + 8], rbx
test dl, r9b
sub ebx, 0x643d2731
bsf bx, r12w
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
movsx r10, si
rcl r10, 0xa8
shld r10d, ecx, 0xf2
push rdi
jmp 0x1404e7827
push r14
mov r10, 0x28242c0a
test bpl, 0xa6
push r15
xor ebp, 0x18a35cf3
movzx bp, r8b
seta bpl
sub rsp, 0x20
sub r15d, r15d
mov ebp, r9d
bsf ebx, ebp
mov rdi, r8
mov r11, rdx
bsr r10d, esp
cmc
sbb r10, 0x519468c5
mov r10, rdx
or bl, r10b
mov ebx, r15d
cmc
cmp byte [rsp + 0x60], r15b
jmp 0x1404e7878
je 0x1404e78b8
lea eax, [r15 + 0x2d]
xadd r10w, r8w
shl sil, cl
shl r14w, 0xa9
neg ecx
test r12, r13
mov word [rdx], ax
bts r14w, r13w
test ah, bl
sbb r8d, r12d
lea ebx, [rax - 0x2c]
movzx r9d, r8w
lea r10, [rdx + 2]
movzx r9, r12w
bsf rax, r14
sbb r8b, 0x4d
mov r8, r10
movzx r14d, dx
mov sil, r14b
clc
xor edx, edx
lea rsi, [r10 + 2]
btr rax, rdx
mov eax, ecx
and r14, 0x7b10039b
seto r9b
mov r9, r10
cmp r9b, 0x22
div ebp
sar cl, cl
cmp r13, rbx
setl r14b
mov ecx, eax
sar ax, cl
cmp edx, 9
lahf
cmove r14w, sp
movzx r14, ax
mov eax, 0x57
mov r14d, r14d
cmovo r14w, dx
movsxd r14, r11d
lea r14d, [rax - 0x27]
jmp 0x1404e7917
cmovbe ax, r14w
jmp 0x1404e7921
inc rbx
clc
cmc
jmp 0x1404e792b
add ax, dx
cmc
mov word [r10], ax
test ecx, ecx
jmp 0x1404e793a
je 0x1404e7952
mov r10, rsi
cmc
cmp rbx, rdi
jmp 0x1404e794c
jb 0x1404e78c3
cmp rbx, rdi
jmp 0x1404e795a
jb 0x1404e798b
mov word [r11], r15w
jmp 0x1404e7969
call fcn.1404b8a35
mov ebx, 0x22
jmp 0x1404e7978
mov dword [rax], ebx
jmp 0x1404e797f
call fcn.1404b970a
mov eax, ebx
jmp 0x1404e79e6
mov word [rsi], r15w
movzx rcx, bp
test bpl, 0x87
movzx eax, word [r8]
btc rcx, 0x58
shl ch, 0
movzx ecx, word [r9]
cmp cx, sp
mov word [r9], ax
clc
cmc
test al, sil
sub r9, 2
cmp r14b, 0x42
mov word [r8], cx
test esp, 0x5b50d3f
stc
jmp 0x1404e79cb
add r8, 2
cmp r8, r9
jmp 0x1404e79d7
jb 0x1404e7997
xor eax, eax
test dil, 0x31
shr di, cl
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
sar r15d, cl
bt r14w, bp
shl edi, 0x74
add rsp, 0x20
movsx r14w, r10b
movzx di, spl
pop r15
movsxd r14, ecx
pop r14
movzx di, r15b
pop rdi
jmp 0x1404e7a20
ret
Function at 0x140001540
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140040020]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [0x14003a548]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1400015c2
lea rdx, [0x14003a558]
mov qword [rsp + 0x40], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400015bd
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 4
lea r8, [rsp + 0x30]
mov rcx, rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x1b]
call rbx
test eax, eax
js 0x1400015bd
cmp dword [rsp + 0x30], 0
jne 0x1400015bd
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14000cd30
add rsp, 0x48
ret

Function at 0x1400015e0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x58
mov rax, qword [0x140040020]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rcx, [0x14003a548]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14000166c
lea rdx, [0x14003a558]
mov qword [rsp + 0x50], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140001667
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 8
lea r8, [rsp + 0x30]
mov rcx, rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x16]
call rbx
test eax, eax
js 0x140001667
cmp qword [rsp + 0x30], 0
je 0x140001667
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14000cd30
add rsp, 0x58
ret
Function at 0x1400017b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm7
mov rax, qword [0x140040020]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
movsxd rbp, edx
xor ecx, ecx
call fcn.1400131e8
mov rcx, rax
call fcn.1400131d0
mov edx, ebp
mov rcx, rbx
call fcn.140001ea0
mov r14, rax
call fcn.140001fd0
mov r15, rax
call fcn.1400131a4
mov edi, eax
and edi, 0x800000ff
jge 0x140001822
dec edi
or edi, 0xffffff00
inc edi
movd xmm6, edi
call fcn.1400131a4
mov ebx, eax
and ebx, 0x8000000f
jge 0x14000183c
dec ebx
or ebx, 0xfffffff0
inc ebx
movd xmm7, ebx
call fcn.1400131a4
xor ecx, ecx
xor esi, esi
test ebp, ebp
jle 0x1400018e1
cmp ebp, 8
jb 0x1400018e1
mov rdx, rbp
xorps xmm2, xmm2
and rdx, 0xfffffffffffffff8
xorps xmm1, xmm1
mov r8, r14
nop word [rax + rax]
movd xmm0, dword [r8]
add ecx, 8
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
pslld xmm0, xmm6
psrad xmm0, xmm7
pxor xmm2, xmm0
movd xmm0, dword [r8 + 4]
punpcklbw xmm0, xmm0
add r8, 8
punpcklwd xmm0, xmm0
mov rax, r8
psrad xmm0, 0x18
sub rax, r14
pslld xmm0, xmm6
psrad xmm0, xmm7
pxor xmm1, xmm0
cmp rax, rdx
jl 0x140001870
pxor xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
pxor xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 4
pxor xmm1, xmm0
movd esi, xmm1
movsxd rax, ecx
cmp rax, rbp
jge 0x140001907
nop dword [rax]
movsx edx, byte [rax + r14]
mov ecx, edi
shl edx, cl
inc rax
mov ecx, ebx
sar edx, cl
xor esi, edx
cmp rax, rbp
jl 0x1400018f0
call fcn.1400131a4
mov ebx, eax
and ebx, 0x80000007
jge 0x14000191d
dec ebx
or ebx, 0xfffffff8
inc ebx
call fcn.1400015e0
mov ecx, ebx
shr esi, cl
movzx ebx, sil
call fcn.1400131a4
mov rax, qword [r14]
cmp rax, qword [r15]
jne 0x140001971
movzx eax, word [r14 + 8]
cmp ax, word [r15 + 8]
jne 0x140001971
inc ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x30
mov qword [rsp + 0x20], 0
mov rcx, rax
lea r8, [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
cmp eax, 0xc0000516
je 0x1400019a2
test bl, 1
lea eax, [rbx + 1]
mov rcx, r14
cmovne eax, ebx
test al, 1
jne 0x140001995
call fcn.14000cd50
mov rcx, r15
call fcn.14000cd50
mov eax, 1
jmp 0x1400019a4
call fcn.14000cd50
mov rcx, r15
call fcn.14000cd50
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14000cd30
mov rbx, qword [rsp + 0xd0]
movaps xmm6, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x70]
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400019e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, rcx
movaps xmmword [rsp + 0x30], xmm6
xor ecx, ecx
movaps xmmword [rsp + 0x20], xmm7
movsxd r15, edx
call fcn.1400131e8
mov rcx, rax
call fcn.1400131d0
mov edx, r15d
mov rcx, rbx
call fcn.140001ea0
mov r12, rax
call fcn.140001fd0
mov qword [rsp + 0x80], rax
call fcn.1400131a4
mov ebp, eax
and ebp, 0x8000007f
jge 0x140001a4c
dec ebp
or ebp, 0xffffff80
inc ebp
movd xmm7, ebp
call fcn.1400131a4
mov esi, eax
and esi, 0x8000001f
jge 0x140001a66
dec esi
or esi, 0xffffffe0
inc esi
movd xmm6, esi
call fcn.1400131a4
mov r14d, eax
and r14d, 0x8000007f
jge 0x140001a85
dec r14d
or r14d, 0xffffff80
inc r14d
xor edi, edi
mov ebx, edi
mov ecx, edi
test r15d, r15d
jle 0x140001b21
cmp r15d, 8
jb 0x140001b21
mov rdx, r15
xorps xmm2, xmm2
and rdx, 0xfffffffffffffff8
xorps xmm1, xmm1
mov r8, r12
nop
movd xmm0, dword [r8]
add ecx, 8
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
pslld xmm0, xmm7
psrad xmm0, xmm6
pxor xmm2, xmm0
movd xmm0, dword [r8 + 4]
punpcklbw xmm0, xmm0
add r8, 8
punpcklwd xmm0, xmm0
mov rax, r8
psrad xmm0, 0x18
sub rax, r12
pslld xmm0, xmm7
psrad xmm0, xmm6
pxor xmm1, xmm0
cmp rax, rdx
jl 0x140001ab0
pxor xmm1, xmm2
movdqa xmm0, xmm1
psrldq xmm0, 8
pxor xmm1, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 4
pxor xmm1, xmm0
movd ebx, xmm1
movsxd rdx, ecx
cmp rdx, r15
jge 0x140001b47
nop dword [rax]
movsx eax, byte [rdx + r12]
mov ecx, ebp
shl eax, cl
inc rdx
mov ecx, esi
sar eax, cl
xor ebx, eax
cmp rdx, r15
jl 0x140001b30
call fcn.1400131a4
and eax, 0x8000000f
jge 0x140001b5a
dec eax
or eax, 0xfffffff0
inc eax
mov ecx, eax
and r14d, 0xffffffc0
shl ebx, cl
and ebx, 0xfe
call fcn.1400131a4
mov rbp, qword [rsp + 0x80]
mov r8d, 0xf
mov rdx, rbp
mov rcx, r12
call fcn.14000f6d0
test eax, eax
jne 0x140001b8c
inc ebx
xor ebx, r14d
mov eax, 0xaaaaaaab
mul ebx
lea esi, [rbx + 1]
mov rcx, r15
shr edx, 1
lea edx, [rdx + rdx*2]
cmp ebx, edx
cmovne esi, ebx
call fcn.14000cd58
mov rbx, rax
test r15d, r15d
jle 0x140001bd5
mov r8, r12
mov rdx, rax
sub r8, rax
nop dword [rax]
movzx ecx, dil
inc edi
xor cl, byte [r8 + rdx]
mov byte [rdx], cl
lea rdx, [rdx + 1]
cmp edi, r15d
jl 0x140001bc0
mov eax, 0xaaaaaaab
mov rcx, r12
mul esi
shr edx, 1
lea eax, [rdx + rdx*2]
cmp esi, eax
je 0x140001c04
call fcn.14000cd50
mov rcx, rbp
call fcn.14000cd50
mov rcx, rbx
call fcn.14000cd50
mov eax, 1
jmp 0x140001c1b
call fcn.14000cd50
mov rcx, rbp
call fcn.14000cd50
mov rcx, rbx
call fcn.14000cd50
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x20]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret