joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14014ae38
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x14017a608]
xor rax, rsp
mov qword [rbp + 0x140], rax
mov ebx, 0x104
lea r9, [rsp + 0x20]
xor r15d, r15d
lea r8, [rsp + 0x30]
mov edx, ebx
mov esi, r15d
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
nop dword [rax + rax]
cmp eax, ebx
jae 0x14014afdc
test eax, eax
jne 0x14014aeaa
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
jmp 0x14014afe1
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x14014afdc
lea rcx, [rsp + 0x30]
cmp rax, rcx
je 0x14014afdc
mov word [rax], r15w
mov r12d, 0x5c
movzx ecx, word [rsp + 0x30]
lea eax, [rcx - 0x41]
cmp ax, 0x19
jbe 0x14014aee7
lea eax, [rcx - 0x61]
cmp ax, 0x19
ja 0x14014af00
cmp word [rsp + 0x32], 0x3a
jne 0x14014af00
cmp word [rsp + 0x34], r12w
jne 0x14014afdc
lea rsi, [rsp + 0x34]
cmp cx, r12w
jne 0x14014af3c
cmp word [rsp + 0x32], r12w
jne 0x14014af3c
mov edx, r12d
lea rcx, [rsp + 0x34]
call sub.msvcrt.dll_wcschr
test rax, rax
je 0x14014afdc
mov edx, r12d
lea rcx, [rax + 2]
call sub.msvcrt.dll_wcschr
mov rsi, rax
test rax, rax
je 0x14014afdc
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14014af61
test al, 0x10
je 0x14014b011
xor eax, eax
jmp 0x14014afe1
mov rdi, qword [rsp + 0x20]
lea rax, [rsp + 0x30]
cmp rdi, rax
jne 0x14014af77
lea rdi, [rsp + 0x30]
jmp 0x14014af7b
add rdi, 0xfffffffffffffffe
cmp rdi, rsi
je 0x14014afdc
cmp word [rdi], r12w
jne 0x14014afdc
cmp rdi, rsi
jbe 0x14014afdc
mov edx, r12d
mov word [rdi], r15w
lea rcx, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll_wcsrchr]
nop dword [rax + rax]
mov r14, rax
test rax, rax
je 0x14014afdc
movzx ebx, word [rax + 2]
lea rcx, [rsp + 0x30]
mov word [rax + 2], r15w
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
mov word [r14 + 2], bx
cmp eax, 0xffffffff
jne 0x14014b00d
mov rdi, r14
cmp r14, rsi
ja 0x14014af8b
cmp rdi, rsi
ja 0x14014b039
mov eax, 0x7b
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.14014b700
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
test al, 0x10
jne 0x14014afd7
mov eax, 0x10b
jmp 0x14014afe1
cmp word [rdi + 2], r15w
je 0x14014af5a
mov word [rdi], r12w
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], r15w
jne 0x14014b02b
lea rdi, [rdi + rax*2]
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x14014b018
jmp 0x14014ae99
Function at 0x14014b450
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x14017c538], rbx
je 0x14014b4b7
cmp rax, rbx
jne 0x14014b4aa
mov ebx, 1
mov esi, ebx
jmp 0x14014b4bc
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14014b48f
mov ebx, 1
mov eax, dword [0x14017c540]
cmp eax, ebx
jne 0x14014b4d4
mov edi, 0x1f
mov ecx, edi
call sub.msvcrt.dll__amsg_exit
jmp 0x14014b540
mov eax, dword [0x14017c540]
test eax, eax
jne 0x14014b535
mov dword [0x14017c540], ebx
lea r15, [0x140151b60]
lea rdi, [0x140151b48]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14014b527
test eax, eax
jne 0x14014b52b
cmp qword [rdi], r14
je 0x14014b51c
mov rax, qword [rdi]
mov rcx, qword [case.0x140005b13.0]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14014b4fe
test eax, eax
je 0x14014b53b
mov eax, 0xff
jmp 0x14014b696
mov dword [0x14017acc4], ebx
mov edi, 0x1f
mov eax, dword [0x14017c540]
cmp eax, ebx
jne 0x14014b567
lea rdx, [0x140151b40]
lea rcx, [0x140151ab8]
call sub.msvcrt.dll__initterm
mov dword [0x14017c540], 2
test esi, esi
jne 0x14014b575
mov rax, r14
xchg qword [0x14017c538], rax
cmp qword [0x14017c558], r14
je 0x14014b5a8
lea rcx, [0x14017c558]
call fcn.14014be70
test eax, eax
je 0x14014b5a8
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14017c558]
mov r9, qword [case.0x140005b13.0]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14014b5c1
mov eax, 0xff
jmp 0x14014b696
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14014b647
test ax, ax
je 0x14014b5dc
test edx, edx
jne 0x14014b647
sub ax, bx
cmp ax, di
ja 0x14014b5f2
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14014b5dc
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400612fc
mov dword [0x14017acc0], eax
cmp dword [0x14017ace0], r14d
jne 0x14014b630
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14017acc4], r14d
jne 0x14014b645
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14017acc0]
jmp 0x14014b696
cmp ax, 0x22
jne 0x14014b65b
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14014b5ca
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.140213000
add rsp, 0x28
jmp 0x14014b450
Function at 0x14014bd5c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14014bda8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14014bda0
cmp dword [rcx + 0x3c], edx
jl 0x14014bda0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14014bda0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14014bda8
mov rax, rdx
add rsp, 0x18
ret

Function at 0x14014c008
Capabilities:
Print debug messages

Disassembly:
jmp 0x14014c014
push rbx
sub rsp, 0x540
mov rax, qword [0x14017a608]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x14014c091
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x14014c0b1
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.14014b700
add rsp, 0x540
pop rbx
ret

Function at 0x14014c014
Capabilities:
Print debug messages

Disassembly:
jmp 0x14014c014
push rbx
sub rsp, 0x540
mov rax, qword [0x14017a608]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x14014c091
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x14014c0b1
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.14014b700
add rsp, 0x540
pop rbx
ret
Function at 0x140001000
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10d, r8d
mov eax, edx
mov ebx, edx
cdq
xor r10d, 0x971e137b
mov rdi, r9
and edx, 3
mov r11d, 0x95543787
mov r9d, 0x2ad7eb25
add eax, edx
sar eax, 2
lea r8d, [rax*4]
movsxd r8, r8d
add r8, rcx
neg eax
movsxd rcx, eax
je 0x140001088
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [r8 + rcx*4]
imul eax, r11d
rol eax, 0xb
imul eax, r9d
lea r9d, [r9 + r9*4]
xor eax, r10d
add r9d, 0x6bce6396
lea r10d, [rax + rax + 0x52dce729]
add r10d, eax
lea eax, [r11 + 0x18b29dec]
lea r11d, [rax + rax*4]
inc rcx
jne 0x140001050
mov ecx, ebx
xor edx, edx
and ecx, 3
dec ecx
je 0x1400010ad
dec ecx
je 0x1400010a3
dec ecx
jne 0x1400010cc
movzx edx, byte [r8 + 2]
shl edx, 0x10
movzx eax, byte [r8 + 1]
shl eax, 8
xor edx, eax
movzx eax, byte [r8]
xor eax, edx
imul eax, r11d
rol eax, 0xb
imul eax, r9d
xor eax, r10d
lea r10d, [rax + rax + 0x52dce729]
add r10d, eax
xor r10d, ebx
mov rbx, qword [rsp + 8]
mov eax, r10d
shr eax, 0x10
xor eax, r10d
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
mov dword [rdi], eax
mov rdi, qword [rsp + 0x10]
ret
Function at 0x140001514
Capabilities:
Get common file path
Get disk information
Get hostname

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov esi, edx
mov r14, rcx
mov edx, 0x104
lea rcx, [rbp + 0x40]
mov r15d, r8d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
and dword [rsp + 0x38], 0
lea r9, [rbp + 0x188]
and qword [rsp + 0x30], 0
lea rcx, [rbp + 0x40]
and qword [rsp + 0x28], 0
xor r8d, r8d
and qword [rsp + 0x20], 0
xor edx, edx
mov byte [rbp + 0x43], 0
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [rbp + 0x188]
lea eax, [rcx - 0x4dbcdac0]
cmp eax, 0x1e13380
ja 0x140001596
add ecx, 0xb2432541
mov dword [rbp + 0x188], ecx
xor edi, edi
or rbx, 0xffffffffffffffff
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x100
call fcn.140003930
lea rcx, [rsp + 0x40]
call fcn.140001174
test eax, eax
je 0x1400015d6
lea rcx, [rsp + 0x40]
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x1400015c4
test rax, rax
jne 0x140001726
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 2
jb 0x14000159c
lea rdx, [rbp + 0x190]
mov dword [rbp + 0x190], 0x100
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea rax, [rsp + 0x40]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001609
mov rdx, rbx
lea r9, [rbp + 0x180]
mov r8d, 0xb01dface
lea rcx, [rsp + 0x40]
call section..text
mov r8d, dword [rbp + 0x188]
mov edx, dword [rbp + 0x180]
mov eax, edx
shr eax, 0x18
mov byte [rbp + 0x190], al
mov eax, edx
shr eax, 0x10
mov byte [rbp + 0x191], al
mov eax, edx
shr eax, 8
mov byte [rbp + 0x192], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp + 0x188], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp + 0x189], al
mov eax, r8d
shr eax, 8
mov byte [rbp + 0x18a], al
mov byte [rbp + 0x18b], r8b
mov r9d, dword [rbp + 0x188]
mov byte [rbp + 0x193], dl
shl esi, 0x10
xor esi, r15d
mov ecx, esi
xor esi, r8d
xor ecx, edx
mov byte [rbp + 0x18b], cl
mov eax, ecx
shr eax, 0x18
mov byte [rbp + 0x188], al
mov eax, ecx
shr eax, 0x10
mov byte [rbp + 0x189], al
mov eax, ecx
shr eax, 8
mov byte [rbp + 0x18a], al
mov eax, esi
mov edx, dword [rbp + 0x188]
shr eax, 0x18
mov byte [rbp + 0x188], al
mov eax, esi
mov byte [rbp + 0x18b], sil
shr eax, 0x10
mov byte [rbp + 0x189], al
mov eax, esi
shr eax, 8
mov byte [rbp + 0x18a], al
mov ecx, dword [rbp + 0x188]
mov eax, dword [rbp + 0x190]
mov dword [r14], eax
mov dword [r14 + 4], r9d
mov dword [r14 + 8], edx
mov dword [r14 + 0xc], ecx
mov rbx, qword [rsp + 0x298]
add rsp, 0x250
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov byte [rsp + 0x50], 0
jmp 0x140001604
Function at 0x140001c44
Capabilities:
Get common file path
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rdi
sub rsp, 0x150
mov ebx, 1
mov edx, 0x2000
mov ecx, ebx
call fcn.140005f50
mov rsi, rax
test rax, rax
jne 0x140001c80
lea eax, [rbx + 1]
jmp 0x140001d5c
lea rdx, [rsp + 0x160]
mov rcx, rsi
call fcn.1400019e4
mov edi, eax
test eax, eax
jne 0x140001d52
mov r9d, ebx
lea r8d, [rax + 0x1a]
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea rax, [rsp + 0x40]
sub rax, rbx
add rax, rbx
cmp byte [rax], 0
jne 0x140001cb6
movups xmm0, xmmword [str.Line_6PurchasesV2.dat]
lea rcx, [rsp + 0x40]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x14001e890]
movsd qword [rax + 0x10], xmm0
call qword [sym.imp.imagehlp.dll_MakeSureDirectoryPathExists]
test eax, eax
jne 0x140001ce8
mov edi, ebx
jmp 0x140001d52
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140001ce4
mov r8d, dword [rsp + 0x160]
lea r9, [rsp + 0x168]
and qword [rsp + 0x20], 0
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
test ebx, ebx
sete dil
mov rcx, rsi
call fcn.140007f30
mov eax, edi
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400027c0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000280a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000280a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000280a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000280a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000280a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000280c
xor al, al
add rsp, 0x28
ret

Function at 0x140008c60
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140008a5c
Function at 0x14000db24
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14000db54
xor eax, eax
jmp 0x14000dc17
mov rbp, rbx
cmp word [rax], si
je 0x14000db79
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14000db60
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14000db5c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14000da44
movsxd r14, eax
test eax, eax
jne 0x14000dbb7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14000db4d
mov rcx, r14
call fcn.14000a198
mov rdi, rax
test rax, rax
jne 0x14000dbd0
xor ecx, ecx
call fcn.14000a15c
jmp 0x14000dbac
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14000da44
test eax, eax
jne 0x14000dc01
mov rcx, rdi
call fcn.14000a15c
jmp 0x14000dc0b
xor ecx, ecx
call fcn.14000a15c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140014ab0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140014ad8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140014ad8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140025d30
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x140025e23
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
xchg rbx, r15
mov r15, rdx
xchg rbx, r15
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
mov esi, r8d
sub rdi, rdx
xchg rbp, r10
mov r10, rcx
xchg rbp, r10
add rdi, 0xf0
dec rsi
shr rsi, 4
inc rsi
nop dword [rax]
xchg r8, rbx
movups xmm0, xmmword [r8]
xchg rbx, r8
xchg rbp, r9
mov rdx, r9
xchg r9, rbp
xchg rcx, r11
mov r11, rbx
xchg rcx, r11
call fcn.140026330
mov ecx, 0x10
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140025dbe
neg rdi
sub rdi, 0xfffffffffffffff0
neg rdi
xchg rbp, r12
movups xmmword [r12 + 0xf0], xmm0
xchg rbp, r12
sub rsi, 1
jne 0x140025d8b
xchg rdi, r8
mov r8, qword [rsp + 0x30]
xchg rdi, r8
xchg rbx, rbp
mov rbp, qword [rsp + 0x38]
xchg rbp, rbx
xchg r14, rbp
mov r14, qword [rsp + 0x40]
xchg r14, rbp
add rsp, 0x20
push rbx
xchg qword [rsp + 8], rsi
add rsp, 0x10
ret

Function at 0x140025e30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r10, rbp
mov qword [rsp + 0x10], r10
xchg r10, rbp
xchg rsi, rdx
mov qword [rsp + 0x18], rdx
xchg rsi, rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov edi, r8d
xchg rbx, rdx
mov rdx, rbx
xchg rbx, rdx
lea r9, [rcx + 0xf0]
xchg rsi, rdi
mov rdi, rcx
xchg rsi, rdi
test r8d, r8d
je 0x140025ef5
dec rdi
shr rdi, 1
shr rdi, 1
shr rdi, 1
shr rdi, 1
inc rdi
nop dword [rax]
nop word [rax + rax]
xchg r11, rbx
mov rax, r11
xchg r11, rbx
sub r9, rbx
mov edx, 0x10
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140025eb2
xchg rdx, rbp
mov rbp, rsi
xchg rbp, rdx
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.140025f80
xchg r9, r11
mov r11, rbx
xchg r11, r9
sub rbx, 0xfffffffffffffff0
sub rdi, 1
jne 0x140025e9c
xchg rsi, r9
movups xmm0, xmmword [rsi]
xchg rsi, r9
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
xchg rcx, rbp
mov rcx, qword [rsp + 0x38]
xchg rbp, rcx
movups xmmword [rsi + 0xf0], xmm0
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x140027210
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rdx, rbx
push rdi
mov qword [rsp], rdi
sub rsp, 0x10
mov rbx, rdx
mov r10, rcx
test r8b, 0xf
je 0x140027249
xor al, al
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
nop
xchg qword [rsp], rdi
add rsp, 8
ret
xor edx, edx
test r8d, r8d
je 0x1400272cf
movdqa xmm2, xmmword [rsp]
nop
movdqu xmm1, xmmword [rdx + rbx]
test edx, edx
jne 0x140027276
xchg r11, r10
movdqu xmm2, xmmword [r11 + 0x200]
xchg r11, r10
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
xorps xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0xd
nop word [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027294
aesdeclast xmm0, xmmword [r10 + 0x1e0]
xorps xmm0, xmm2
movdqa xmm2, xmm1
xchg rbx, rdx
movups xmmword [rbx + r9], xmm0
xchg rdx, rbx
sub edx, 0xfffffff0
cmp edx, r8d
jb 0x14002725a
xchg rbx, r15
mov r15, qword [rsp + 0x20]
xchg rbx, r15
mov al, 1
add rsp, 0x10
push rbx
push rdx
push rdx
push rdx
push rdx
push rbx
push rcx
push rbx
xchg qword [rsp + 0x40], rdi
pop rbx
pop rcx
pop rbx
pop rdx
pop rdx
pop rdx
pop rdx
pop rbx
add rsp, 8
ret

Function at 0x140027300
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rdi
mov qword [rsp], rbx
sub rsp, 0x10
xchg rsi, rbx
mov rsi, rdx
xchg rbx, rsi
mov r10, rcx
test r8b, 0xf
je 0x140027337
xor al, al
add rsp, 0x10
push rdx
push rax
push rcx
push rcx
xchg qword [rsp + 0x20], rbx
pop rcx
pop rcx
pop rax
pop rdx
add rsp, 8
ret
xor edx, edx
test r8d, r8d
je 0x1400273db
movdqa xmm0, xmmword [rsp]
mov qword [rsp + 0x20], rdi
nop dword [rax + rax]
xchg rdx, r12
movdqu xmm1, xmmword [r12 + rbx]
xchg rdx, r12
test edx, edx
jne 0x140027374
xchg r10, r15
movdqu xmm0, xmmword [r15 + 0x200]
xchg r10, r15
xorps xmm0, xmm1
lea rax, [r10 + 0x10]
xorps xmm0, xmmword [r10 + 0x1e0]
mov ecx, 0xd
nop word [rax + rax]
aesenc xmm0, xmmword [rax]
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x140027392
aesenclast xmm0, xmmword [r10 + 0xe0]
xchg rdx, r12
movups xmmword [r12 + r9], xmm0
xchg r12, rdx
nop
sub edx, 0xedff49f
add edx, 0xedff4af
cmp edx, r8d
jb 0x140027351
xchg r14, rdi
mov r14, qword [rsp + 0x20]
xchg rdi, r14
mov al, 1
add rsp, 0x10
nop
add rsp, 8
xchg qword [rsp - 8], rbx
ret
Function at 0x14002a740
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
xchg rbx, r8
mov qword [rsp + 0x10], r8
xchg rbx, r8
mov qword [rsp + 0x18], rsi
xchg rsi, rdi
mov qword [rsp + 0x20], rsi
xchg rdi, rsi
nop
mov qword [rsp - 8], r14
sub rsp, 8
sub rsp, 0x30
xchg rcx, rbp
mov rsi, rbp
xchg rcx, rbp
mov rax, qword gs:[0x30]
xchg r13, rdi
mov r13, qword [rax + 0x60]
xchg r13, rdi
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
xchg rbx, r12
mov qword [rsp + 0x40], r12
xchg rbx, r12
sub rcx, 0xffffffffffffff38
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.140029de0
test eax, eax
js 0x14002a7db
cmp qword [rsp + 0x40], rbx
je 0x14002a7db
lea eax, [rbx + 1]
jmp 0x14002a868
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0x70], 2
jbe 0x14002a7fc
mov eax, 2
jmp 0x14002a868
cmp dword [rcx + 0x74], ebx
jbe 0x14002a80f
mov eax, 3
jmp 0x14002a868
cmp byte [rdi + 2], bl
je 0x14002a822
mov eax, 4
jmp 0x14002a868
cmp r14d, 0xa
jb 0x14002a84b
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002a84b
mov eax, 8
jmp 0x14002a868
lea rcx, [rsi + 0xb8]
mov edx, 0x99999999
call fcn.14002a1f0
jmp 0x14002a866
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
xchg r9, rdi
mov r9, qword [rsp + 0x58]
xchg r9, rdi
add rsp, 0x30
nop
xchg qword [rsp], r14
add rsp, 8
ret
Function at 0x14005cb60
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rcx
mov rcx, r9
xchg r9, rcx
mov r8d, 0xffffffff
test rcx, rcx
je 0x14005cbdf
cmp byte [rcx], 0
je 0x14005cbdf
test rdx, rdx
jne 0x14005cb94
mov rdx, 0xffffffffffffffff
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x14005cb86
test rdx, rdx
je 0x14005cbdc
xor r10d, r10d
lea r11, [0x140002db0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
xor rcx, rax
shr r8d, 2
shr r8d, 5
shr r8d, 1
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x14005cba6
not r8d
mov eax, r8d
ret

Function at 0x140060030
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rax
mov rbx, qword [rcx + 0x10]
xchg rbx, rax
xchg rsi, rcx
mov rdx, rsi
xchg rcx, rsi
test rax, rax
jne 0x14006004d
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x140060082
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14006007f
xchg rbp, rax
mov rbp, qword [rdx + 0x10]
xchg rbp, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14006005b
xchg r15, rax
mov r15, qword [rdx + 0x10]
xchg r15, rax
mov byte [rdx], 1
ret

Function at 0x140060090
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg r8, rcx
mov rdx, r8
xchg rcx, r8
test rax, rax
jne 0x1400600a9
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x1400600dd
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x1400600da
xchg rcx, r9
mov r9, qword [rdx + 0x10]
xchg r9, rcx
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x1400600b7
xchg r13, rax
mov r13, qword [rdx + 0x10]
xchg r13, rax
mov byte [rdx], 1
ret

Function at 0x140060170
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rax
mov rbp, qword [rcx + 0x10]
xchg rbp, rax
xchg rdx, rcx
mov rcx, rdx
xchg rdx, rcx
test rax, rax
jne 0x140060187
ret
cmp byte [rcx], 0
jne 0x1400601c1
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x1400601be
nop dword [rax + rax]
xchg r13, rax
mov r13, qword [rdx + 0x10]
xchg r13, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14006019a
xchg rcx, rax
mov rcx, qword [rdx + 0x10]
xchg rcx, rax
mov byte [rdx], 1
ret