joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000dc00
Capabilities:
Hash data with crc32

Disassembly:
mov rdx, rcx
xor r8d, r8d
mov rcx, qword [0x1401a6bd0]
mov rcx, qword [rcx + 0x12b8]
jmp fcn.14000dc70

Function at 0x14000dc70
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [rcx + 0x108]
mov r9, r8
movsxd r8, dword [rcx + 0x100]
mov r10, rdx
xor ecx, ecx
mov rdx, r9
sub rdx, r10
test r9, r9
mov r8d, dword [rax + r8*4 - 4]
cmove rdx, rcx
mov rcx, r10
jmp fcn.1400108c0

Function at 0x14000dd70
Capabilities:
Hash data with crc32

Disassembly:
mov rax, rdx
xor r9d, r9d
sub rdx, rcx
test rax, rax
cmove rdx, r9
jmp fcn.1400108c0

Function at 0x140010870
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rcx
not r8d
test rdx, rdx
je 0x1400108ad
lea r10, [0x140129a40]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r10 + rcx*4]
sub rdx, 1
jne 0x140010890
not r8d
mov eax, r8d
ret

Function at 0x1400108c0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14001091d
lea rbx, [0x140129a40]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140010904
cmp r10, 2
jb 0x140010904
cmp byte [r9], r8b
jne 0x140010904
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400108e0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14001095f
lea rbx, [0x140129a40]
cmp r8b, 0x23
jne 0x140010943
cmp byte [r9], r8b
jne 0x140010943
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140010930
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x140033a90
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
mov r10, rdx
movzx r9d, cx
mov eax, 0x5e6ea9af
shr ecx, 0x10
mul r8d
mov ebx, r8d
mov esi, r8d
shr edx, 0xb
imul eax, edx, 0x15b0
sub ebx, eax
test r8d, r8d
je 0x140033bce
mov qword [rsp + 0x20], rdi
xor edx, edx
cmp ebx, 7
jbe 0x140033b39
lea r8d, [rdx + 7]
movzx eax, byte [r10]
add edx, 8
add r9d, eax
add r8d, 8
movzx eax, byte [r10 + 1]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 2]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 3]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 4]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 5]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 6]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 7]
add ecx, r9d
add r9d, eax
add r10, 8
add ecx, r9d
cmp r8d, ebx
jb 0x140033ad2
xor r8d, r8d
xor r11d, r11d
cmp edx, ebx
jae 0x140033b96
mov eax, ebx
sub eax, edx
cmp eax, 2
jb 0x140033b83
mov eax, ebx
sub eax, edx
sub eax, 2
shr eax, 1
inc eax
mov edi, eax
lea edx, [rdx + rax*2]
nop dword [rax]
movzx eax, byte [r10]
add r9d, eax
movzx eax, byte [r10 + 1]
add r8d, r9d
add r10, 2
add r9d, eax
add r11d, r9d
sub rdi, 1
jne 0x140033b60
cmp edx, ebx
jae 0x140033b90
movzx eax, byte [r10]
add r9d, eax
add ecx, r9d
inc r10
lea eax, [r11 + r8]
add ecx, eax
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
sub esi, ebx
mov ebx, 0x15b0
jne 0x140033ac7
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
shl ecx, 0x10
lea eax, [r9 + rcx]
pop rsi
ret
Function at 0x1400514a0
Capabilities:
Hash data with crc32

Disassembly:
mov eax, edx
lea r8, str.SCROLLX
test eax, eax
lea rdx, str.SCROLLY
cmove rdx, r8
xor r8d, r8d
jmp fcn.14000dc70

Function at 0x14005a3e0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
test dword [rcx + 0x10], 0x100000
mov r9, rdx
je 0x14005a417
xor r8d, r8d
mov qword [rsp + 0x20], rbx
xor edx, edx
mov rcx, r9
call fcn.1400108c0
mov ecx, eax
mov ebx, eax
call fcn.140013480
mov eax, ebx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rax, qword [0x1401a6bd0]
xor r8d, r8d
mov rcx, qword [rax + 0x12b8]
add rsp, 0x28
jmp fcn.14000dc70
Function at 0x140085150
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x50
mov rax, qword [rcx + 8]
mov ebp, r8d
mov ecx, 0x3e80000
mov rbx, qword [rax + 0x2f0]
mov rax, qword [rdx + 0x80]
movzx edx, word [rdx + 0x68]
movzx edi, word [rax + 0x18]
mov eax, 0x40000
shl edi, 0x10
cmp edi, eax
cmovl edi, eax
shl edx, 0x10
call fcn.140073a20
mov dword [rsp + 0x24], eax
mov ecx, eax
cmp eax, 0x28f
jge 0x1400851a6
xor eax, eax
add rsp, 0x50
pop rdi
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0x24]
mov qword [rsp + 0x80], rsi
mov esi, dword [rbx + 0x28]
mov qword [rsp + 0x48], r12
mov r12d, dword [rbx + 0x3c]
mov qword [rsp + 0x40], r13
mov r13d, dword [rbx + 0x38]
mov dword [rsp + 0x88], eax
mov eax, dword [rbx + 0x2c]
mov qword [rsp + 0x38], r14
mov r14d, dword [rbx + 0x40]
mov dword [rsp + 0x70], eax
mov eax, dword [rbx + 0x34]
mov qword [rsp + 0x30], r15
mov r15d, dword [rbx + 0x30]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x20], r12d
test ebp, ebp
jg 0x1400851fd
mov ebp, 0x4b0000
jmp 0x14008520b
shl ebp, 0x10
mov edx, ecx
mov ecx, ebp
call fcn.1400764c0
mov ebp, eax
bsr ecx, ebp
bsr eax, edi
shl r12d, 0x10
add eax, ecx
cmp eax, 0x2e
jl 0x140085221
mov eax, r12d
jmp 0x14008522a
mov edx, edi
mov ecx, ebp
call fcn.1400764c0
mov r9d, dword [rsp + 0x88]
mov ecx, r9d
shl ecx, 0x10
cmp eax, ecx
jge 0x140085246
shl esi, 0x10
mov ecx, esi
jmp 0x140085335
mov r8d, dword [rsp + 0x70]
mov edx, r8d
shl edx, 0x10
mov dword [rsp + 0x88], edx
cmp eax, edx
jge 0x1400852a4
mov ebx, r8d
mov edx, edi
sub ebx, r9d
call fcn.140073a20
mov ecx, ebp
sub ecx, eax
test ebx, ebx
je 0x140085294
sub r15d, esi
mov r8d, ebx
mov edx, r15d
call fcn.1400763b0
shl esi, 0x10
mov edx, edi
mov ecx, esi
mov ebx, eax
call fcn.140073a20
add ebx, eax
jmp 0x14008533e
mov esi, dword [rsp + 0x78]
mov ebx, esi
mov r8d, dword [rsp + 0x70]
shl ebx, 0x10
jmp 0x1400852b1
mov esi, dword [rsp + 0x78]
mov ebx, esi
shl ebx, 0x10
cmp eax, ebx
jge 0x1400852f0
mov ecx, dword [rsp + 0x88]
mov r12d, esi
mov edx, edi
sub r12d, r8d
call fcn.140073a20
mov ecx, ebp
sub ecx, eax
test r12d, r12d
je 0x1400852f5
sub r13d, r15d
mov r8d, r12d
mov edx, r13d
call fcn.1400763b0
shl r15d, 0x10
mov edx, edi
mov ecx, r15d
mov ebx, eax
call fcn.140073a20
add ebx, eax
jmp 0x14008533e
cmp eax, r12d
jge 0x14008532e
mov r15d, dword [rsp + 0x20]
mov edx, edi
mov ecx, ebx
call fcn.140073a20
sub ebp, eax
sub r15d, esi
je 0x14008532e
sub r14d, r13d
mov r8d, r15d
mov edx, r14d
mov ecx, ebp
call fcn.1400763b0
shl r13d, 0x10
mov edx, edi
mov ecx, r13d
mov ebx, eax
call fcn.140073a20
add ebx, eax
jmp 0x14008533e
shl r14d, 0x10
mov ecx, r14d
mov edx, edi
call fcn.140073a20
mov ebx, eax
mov edx, dword [rsp + 0x24]
mov ecx, ebx
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rbp
pop rbx
jmp fcn.140073a20
Function at 0x1400b27c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov r14, qword [rsp + 0x30]
mov r10, r9
mov rdi, qword [rcx]
mov rbp, r8
mov rsi, rcx
movzx ebx, word [r14]
cmp rdi, rdx
jb 0x1400b27f4
xor eax, eax
jmp 0x1400b284e
sub edx, edi
mov eax, edx
cmp r10, rax
cmova r10, rax
xor r9d, r9d
test r10, r10
je 0x1400b2840
mov r11d, r9d
nop word [rax + rax]
movzx eax, byte [r11 + rdi]
mov r8d, ebx
shr r8d, 8
inc r9d
xor r8d, eax
mov edx, 0x58bf
add eax, ebx
mov byte [r11 + rbp], r8b
imul ecx, eax, 0x3193
mov r11d, r9d
sub edx, ecx
movzx ebx, dx
cmp r11, r10
jb 0x1400b2810
lea rcx, [rdi + r10]
mov eax, r9d
mov qword [rsi], rcx
mov word [r14], bx
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x1400c6330
Capabilities:
Hash data using murmur3

Disassembly:
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
ret
Function at 0x1400c6ae0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r10d, r8d
mov r11d, r8d
mov ebx, r8d
mov edi, r8d
mov eax, edx
mov esi, edx
cdq
mov r14, r9
and edx, 0xf
add eax, edx
sar eax, 4
mov r8d, eax
shl r8d, 4
movsxd r8, r8d
add r8, rcx
neg eax
movsxd rdx, eax
je 0x1400c6bda
mov r9, rdx
shl r9, 4
add r9, 8
add r9, r8
neg rdx
nop word [rax + rax]
imul eax, dword [r9 - 8], 0x239b961b
lea r9, [r9 + 0x10]
rol eax, 0xf
imul ecx, eax, 0xab0e9789
imul eax, dword [r9 - 0x14], 0xab0e9789
xor ecx, r10d
ror ecx, 0xd
add ecx, r11d
rol eax, 0x10
lea r10d, [rcx*4 + 0x561ccd1b]
add r10d, ecx
imul ecx, eax, 0x38b34ae5
imul eax, dword [r9 - 0x10], 0x38b34ae5
xor ecx, r11d
ror ecx, 0xf
add ecx, ebx
ror eax, 0xf
lea r11d, [rcx*4 + 0xbcaa747]
add r11d, ecx
imul ecx, eax, 0xa1e38b93
imul eax, dword [r9 - 0xc], 0xa1e38b93
xor ecx, ebx
rol ecx, 0xf
add ecx, 0xeaf5d271
ror eax, 0xe
add ecx, edi
lea ebx, [rcx + rcx*4]
imul ecx, eax, 0x239b961b
xor ecx, edi
rol ecx, 0xd
add ecx, r10d
lea edi, [rcx*4 + 0x32ac3b17]
add edi, ecx
sub rdx, 1
jne 0x1400c6b40
xor eax, eax
mov ecx, esi
and ecx, 0xf
dec ecx
cmp ecx, 0xe
ja case.default.0x1400c6bfe
lea r9, sym.MZ_zr7iIs_34_qy_x_v_N_K_W9oJ1_wtRG5_p_UtM_
mov edx, dword [r9 + rcx*4 + 0xc6d3c]
add rdx, r9
jmp rdx
movzx eax, byte [r8 + 0xe]
shl eax, 0x10
movzx ecx, byte [r8 + 0xd]
shl ecx, 8
xor eax, ecx
movzx ecx, byte [r8 + 0xc]
xor ecx, eax
imul eax, ecx, 0xa1e38b93
ror eax, 0xe
imul eax, eax, 0x239b961b
xor edi, eax
movzx eax, byte [r8 + 0xb]
shl eax, 0x18
movzx ecx, byte [r8 + 0xa]
shl ecx, 0x10
xor eax, ecx
movzx ecx, byte [r8 + 9]
shl ecx, 8
xor eax, ecx
movzx ecx, byte [r8 + 8]
xor ecx, eax
imul eax, ecx, 0x38b34ae5
ror eax, 0xf
imul eax, eax, 0xa1e38b93
xor ebx, eax
movzx eax, byte [r8 + 7]
shl eax, 0x18
movzx ecx, byte [r8 + 6]
shl ecx, 0x10
xor eax, ecx
movzx ecx, byte [r8 + 5]
shl ecx, 8
xor eax, ecx
movzx ecx, byte [r8 + 4]
xor ecx, eax
imul eax, ecx, 0xab0e9789
rol eax, 0x10
imul eax, eax, 0x38b34ae5
xor r11d, eax
movzx eax, byte [r8 + 3]
shl eax, 0x18
movzx ecx, byte [r8 + 2]
shl ecx, 0x10
xor eax, ecx
movzx ecx, byte [r8 + 1]
shl ecx, 8
xor eax, ecx
movzx ecx, byte [r8]
xor ecx, eax
imul eax, ecx, 0x239b961b
rol eax, 0xf
imul eax, eax, 0xab0e9789
xor r10d, eax
xor r10d, esi
xor r11d, esi
xor edi, esi
xor ebx, esi
add r10d, edi
add r10d, ebx
add r10d, r11d
lea ecx, [r11 + r10]
call fcn.1400c6330
lea ecx, [rbx + r10]
mov r9d, eax
call fcn.1400c6330
lea ecx, [rdi + r10]
mov r8d, eax
call fcn.1400c6330
mov ecx, r10d
mov edx, eax
call fcn.1400c6330
mov rbx, qword [rsp + 0x30]
add eax, edx
mov rsi, qword [rsp + 0x38]
add eax, r8d
mov rdi, qword [rsp + 0x40]
add eax, r9d
mov dword [r14], eax
lea ecx, [r9 + rax]
mov dword [r14 + 4], ecx
lea ecx, [r8 + rax]
add eax, edx
mov dword [r14 + 8], ecx
mov dword [r14 + 0xc], eax
add rsp, 0x20
pop r14
ret
Function at 0x1400d5620
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8d, r8d
jmp 0x1400d5630
mov r9, rdx
test rdx, rdx
jne 0x1400d563b
xor eax, eax
ret
lea r11, [0x140150950]
not ecx
cmp r8, 8
jb 0x1400d570d
mov r10, r8
shr r10, 3
imul rax, r10, 0xfffffffffffffff8
add r8, rax
nop dword [rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1400d5660
test r8, r8
je 0x1400d573d
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x1400d5720
not ecx
mov eax, ecx
ret
Function at 0x1400faa30
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
xor al, al
mov ecx, dword [rcx + 0x7c]
cmp ecx, 0xffffffff
je 0x1400fabe4
nop dword [rax + rax]
cmp ecx, 0x7c
je 0x1400fabe4
cmp ecx, 0x29
jne 0x1400faa7d
cmp dword [rbx + 0x1c], 0
jne 0x1400fabe4
test dword [rbx + 0x80], 0x10000000
je 0x1400fabfd
jmp 0x1400fabb9
cmp ecx, 0x2e
jne 0x1400faa90
lea rcx, [rbx + 0x40]
call fcn.1400fa020
jmp 0x1400fabc6
cmp ecx, 0x5c
jne 0x1400faaf4
mov rcx, rbx
call fcn.140101530
test byte [rbx + 0x80], 0x80
je 0x1400faae7
movzx eax, byte [rbx + 0x78]
cmp al, 0x62
jne 0x1400faac4
lea rcx, [rbx + 0x40]
call fcn.1400fa820
mov rcx, rbx
call fcn.140101530
jmp 0x1400fabd6
cmp al, 0x42
jne 0x1400faae7
lea rcx, [rbx + 0x40]
call fcn.1400fa820
lea rcx, [rbx + 0x40]
call fcn.1401014c0
mov rcx, rbx
call fcn.140101530
jmp 0x1400fabd6
mov rcx, rbx
call fcn.1400fad70
jmp 0x1400fabce
cmp ecx, 0x5b
jne 0x1400fab1f
mov rcx, rbx
call fcn.140101530
mov rcx, rbx
call fcn.1400fc010
mov edx, 0x5d
mov rcx, rbx
lea r8d, [rdx - 0x59]
call fcn.1400fed10
jmp 0x1400fabce
cmp ecx, 0x28
jne 0x1400fab53
mov rcx, rbx
call fcn.140101530
mov rcx, rbx
call fcn.1401042e0
mov edx, 0x29
mov rcx, rbx
movzx edi, al
lea r8d, [rdx - 0x24]
call fcn.1400fed10
test dil, dil
je 0x1400fabd6
jmp 0x1400fabce
cmp ecx, 0x5e
jne 0x1400fab6b
lea rcx, [rbx + 0x40]
call fcn.1400f9d80
mov rcx, rbx
call fcn.140101530
jmp 0x1400fabd6
cmp ecx, 0x24
jne 0x1400fab83
lea rcx, [rbx + 0x40]
call fcn.1400fa120
mov rcx, rbx
call fcn.140101530
jmp 0x1400fabd6
lea eax, [rcx - 0x2a]
cmp eax, 1
jbe 0x1400fabef
cmp ecx, 0x3f
je 0x1400fabef
cmp ecx, 0x7b
je 0x1400fabef
cmp ecx, 0x7d
jne 0x1400faba8
test dword [rbx + 0x80], 0x10000000
je 0x1400fac0b
jmp 0x1400fabb9
cmp ecx, 0x5d
jne 0x1400fabb9
test dword [rbx + 0x80], 0x10000000
je 0x1400fac19
movzx edx, byte [rbx + 0x78]
lea rcx, [rbx + 0x40]
call fcn.1400f9d90
mov rcx, rbx
call fcn.140101530
mov rcx, rbx
call fcn.1401016d0
mov ecx, dword [rbx + 0x7c]
mov al, 1
cmp ecx, 0xffffffff
jne 0x1400faa50
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov edx, 0xa
mov rcx, rbx
call fcn.1400fecc0
int3
mov edx, 5
mov rcx, rbx
call fcn.1400fecc0
int3
mov edx, 6
mov rcx, rbx
call fcn.1400fecc0
int3
mov edx, 4
mov rcx, rbx
call fcn.1400fecc0
int3
Function at 0x140118720
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
xor esi, esi
mov rbx, r8
mov rdi, r8
mov rbp, rdx
and rbx, 0xfffffffffffffff0
je 0x140118771
nop dword [rax]
lea rcx, [rsp + 0x30]
call fcn.1401187b0
pxor xmm0, xmmword [rsi + rbp]
movdqu xmmword [rsi + rbp], xmm0
add rsi, 0x10
cmp rsi, rbx
jne 0x140118750
mov ecx, dword [rsp + 0x30]
cmp rsi, rdi
je 0x140118795
lea rbx, [rsi + rbp]
sub rdi, rsi
nop dword [rax]
call fcn.140118700
xor byte [rbx], al
lea rbx, [rbx + 1]
mov ecx, eax
sub rdi, 1
jne 0x140118780
jmp 0x140118797
mov eax, ecx
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14011c810
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x1401a31e8]
xor rax, rsp
mov qword [rbp], rax
mov rdi, rcx
mov qword [rsp + 0x40], rcx
mov dword [rsp + 0x38], 1
mov rax, qword gs:[0x30]
mov r14, qword [rax + 0x60]
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
xor r15d, r15d
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], 0xf
mov byte [rcx], r15b
mov dword [rsp + 0x38], 1
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov ecx, 0x8c
call fcn.1401fa7c6
int3
Function at 0x14011f3d0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x228]
sub rsp, 0x300
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1401a31e8]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov r12, rcx
mov qword [rsp + 0x60], rcx
mov dword [rsp + 0x38], 1
mov rax, qword gs:[0x30]
mov r13, qword [rax + 0x60]
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
xor ebx, ebx
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], 0xf
mov byte [rcx], bl
mov dword [rsp + 0x38], 1
movdqa xmm0, xmmword [str.IPCAIPCAIPCAIPCAMCFGMCFGMCFGMCFGUEFIUEFIUEFIUEFI]
movdqu xmmword [rsp + 0x50], xmm0
mov eax, dword [rsp + 0x50]
mov dword [rbp - 0x68], eax
mov qword [rbp - 0x64], rbx
lea r9, [rsp + 0x34]
lea r8d, [rbx + 0x14]
lea rdx, [rbp - 0x68]
lea ecx, [rbx + 0x4c]
push rsi
call 0x140339003
mov ecx, eax
movdqa xmm6, xmmword [0x140152480]
movdqu xmmword [rsp + 0x50], xmm6
mov eax, dword [rsp + 0x50]
cmp ecx, eax
je 0x14011f4bd
movdqa xmm0, xmmword [0x140152440]
movdqu xmmword [rsp + 0x50], xmm0
mov eax, dword [rsp + 0x50]
cmp ecx, eax
je 0x14011f4bd
movdqa xmm0, xmmword [0x140152470]
movdqu xmmword [rsp + 0x50], xmm0
mov eax, dword [rsp + 0x50]
cmp ecx, eax
jne 0x140120050
mov r8d, dword [rsp + 0x34]
xor edx, edx
mov rcx, qword [r13 + 0x30]
call 0x1402edaaf
int3
mov rax, r12
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.1401110d0
lea r11, [rsp + 0x300]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1401c86e0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1401c870d
xor al, al
jmp 0x1401c886f
mov rax, qword [0x1401e96c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1401e96c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1401e96d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1401e96d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1401e96e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1401e96e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1401e96f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1401e96f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1401e9700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1401c8861
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1401c87b9
mov r11d, 2
jmp 0x1401c87dd
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1401c87d3
mov r11d, 1
jmp 0x1401c87dd
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x1401c8885
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1401c8822
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1401c883a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1401c884a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1401c8858
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x1401c87a0
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1401c886a
Function at 0x14001123a
Capabilities:
Check for peb beingdebugged flag

Disassembly:
jmp 0x140017cb0
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1400360f3]
call fcn.1400116b8
mov rax, qword gs:[0x60]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 2]
test eax, eax
je 0x140017ced
mov eax, 1
jmp 0x140017cef
xor eax, eax
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x1400113a7
Capabilities:
Check for peb ntglobalflag flag

Disassembly:
jmp 0x140017a20
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400360f3]
call fcn.1400116b8
mov rax, qword gs:[0x60]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov eax, dword [rax + 0xbc]
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x24]
and eax, 0x70
test eax, eax
je 0x140017a68
mov eax, 1
jmp 0x140017a6a
xor eax, eax
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1400113bb
Capabilities:
Terminate process

Disassembly:
jmp 0x14001ed40
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400114b0
Capabilities:
Parse pe header

Disassembly:
jmp 0x140020090
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400200b0
xor al, al
jmp 0x140020131
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400200c3
xor al, al
jmp 0x140020131
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400200ed
xor al, al
jmp 0x140020131
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140020101
xor al, al
jmp 0x140020131
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140020113
xor al, al
jmp 0x140020131
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14002012f
xor al, al
jmp 0x140020131
mov al, 1
add rsp, 0x38
ret
Function at 0x140011622
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
jmp 0x140017470
push rbp
push rsi
push rdi
sub rsp, 0x240
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x58
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14002f280]
xor rax, rbp
mov qword [rbp + 0x218], rax
lea rcx, [0x1400360f3]
call fcn.1400116b8
mov qword [rbp + 8], 0
mov dword [rbp + 0x24], 0
mov qword [rbp + 0x48], 0
lea rax, [rbp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rax, [rbp + 0x1a0]
lea rcx, [rbp + 0x68]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x30
rep movsb byte [rdi], byte [rsi]
lea rcx, [rbp + 0x1a0]
call fcn.1400112da
mov qword [rbp + 0xb8], 4
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, qword [rbp + 0xb8]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x14001752e
xor eax, eax
jmp 0x1400175a3
mov r8d, 1
mov edx, 0xc3
mov rcx, qword [rbp + 0x48]
call fcn.140011523
mov eax, dword [rbp + 0x6c]
lea r9, [rbp + 0x24]
mov r8d, 0x140
mov edx, eax
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140017563
xor eax, eax
jmp 0x1400175a3
call qword [rbp + 0x48]
jmp 0x140017585
mov r9d, 0x8000
xor r8d, r8d
lea rdx, [rbp + 0x48]
mov rcx, 0xffffffffffffffff
call fcn.1400116e5
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1400293e0]
call fcn.14001159b
mov rax, rdi
mov rcx, qword [rbp + 0x218]
xor rcx, rbp
call fcn.140011343
lea rsp, [rbp + 0x220]
pop rdi
pop rsi
pop rbp
ret