joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002840
Capabilities:
Enumerate threads
Resume thread

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov esi, ecx
lea rdx, str.Resumed_all_threads_in_process_with_ID:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140001260
mov rcx, rax
mov edx, esi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140001490]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140002912
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x140002909
mov qword [rsp + 0x68], rbx
nop dword [rax]
cmp dword [rsp + 0x2c], esi
jne 0x1400028f2
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbx, rax
test rax, rax
je 0x1400028f2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1400028c0
mov rbx, qword [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140003580
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x140004034
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000407e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000407e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000407e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000407e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000407e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004080
xor al, al
add rsp, 0x28
ret
Function at 0x1400111e5
Capabilities:
Terminate process

Disassembly:
jmp 0x140012fc0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011271
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014310
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014330
xor al, al
jmp 0x1400143b1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014343
xor al, al
jmp 0x1400143b1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001436d
xor al, al
jmp 0x1400143b1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014381
xor al, al
jmp 0x1400143b1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014393
xor al, al
jmp 0x1400143b1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400143af
xor al, al
jmp 0x1400143b1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400096c0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1400096e2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14000975c
mov rdi, r14
mov rcx, rbx
call fcn.14000c920
test rax, rax
jle 0x140009734
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.14003a990
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000974c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140009754
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1400096f6
sub r14, rdi
jmp 0x14000983f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140009773
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140009775
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400097a7
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14003a990
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000983c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400097e2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14000981d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140046a9c
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14000983c
cmp rbp, rax
ja 0x1400097f0
test rbp, rbp
je 0x14000983c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140046a9c
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140020e30
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140020ec7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140020ec7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140020ec2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140020ea0
cmp r8d, 0xc98b9e00
je 0x140020ecc
test r9d, r9d
jne 0x140020e80
mov rax, qword [rax]
jmp 0x140020e50
mov rax, qword gs:[0x60]
mov ecx, dword [rbx + 0x24]
add rcx, r10
mov rax, qword [rax + 0x18]
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
mov rax, qword [rax + 0x10]
add rcx, r10
mov esi, dword [rcx + rdx*4]
add rsi, r10
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140020f77
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140020f77
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140020f72
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140020f50
cmp r8d, 0x98d87e10
je 0x140020f7c
test r9d, r9d
jne 0x140020f30
mov rax, qword [rax]
jmp 0x140020f00
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
xor edx, edx
mov rcx, rax
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp rax
Function at 0x140023a40
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x14007e090]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140023af7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140023af7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140023af2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140023ad0
cmp r8d, 0x6dd8a845
je 0x140023afc
test r9d, r9d
jne 0x140023ab0
mov rax, qword [rax]
jmp 0x140023a80
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov rcx, qword gs:[0x60]
mov rsi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140023ba7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140023ba7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rax, [rdi + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x140023ba2
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x140023b80
cmp r8d, 0x4cfe97c1
je 0x140023bac
test r9d, r9d
jne 0x140023b60
mov rcx, qword [rcx]
jmp 0x140023b30
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x20]
add rax, r10
mov rcx, rsi
call rax
cmp dword [rsp + 0x20], 0
setne al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140038af0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140027cf0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov r9, qword [r8]
mov rbp, rdx
add r9, 2
mov rsi, r8
movabs r14, 0xaaaaaaaaaaaaaaab
mov r8b, 0x3d
mov rax, r14
mov rdi, rcx
mul r9
xor ebx, ebx
shr rdx, 1
shl rdx, 2
call fcn.14000aa50
cmp qword [rdi + 0x18], 0x10
mov r8, rdi
jb 0x140027d48
mov r8, qword [rdi]
mov r10, qword [rsi]
mov rax, r14
mul r10
mov r9, r10
lea rsi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
shr rdx, 1
lea rcx, [rdx + rdx*2]
sub r9, rcx
sub r10, r9
je 0x140027dee
lea rcx, [r10 - 1]
mov rax, r14
mul rcx
lea r11, [rbp + 2]
shr rdx, 1
inc rdx
movzx eax, byte [r11 - 1]
movzx ecx, byte [r11 - 2]
lea r11, [r11 + 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [r11 - 3]
shl rcx, 8
or rcx, rax
mov rax, rcx
shr rax, 0x12
movzx eax, byte [rax + rsi]
mov byte [r8 + rbx], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rsi]
mov byte [r8 + rbx + 1], al
mov rax, rcx
shr rax, 6
and ecx, 0x3f
and eax, 0x3f
movzx eax, byte [rax + rsi]
mov byte [r8 + rbx + 2], al
movzx eax, byte [rcx + rsi]
mov byte [r8 + rbx + 3], al
add rbx, 4
sub rdx, 1
jne 0x140027d82
test r9, r9
je 0x140027e5a
movzx eax, byte [r10 + rbp]
sub r9, 1
je 0x140027e0b
movzx edx, byte [r10 + rbp + 1]
shl eax, 8
or edx, eax
jmp 0x140027e0d
mov edx, eax
mov eax, edx
mov ecx, edx
shr eax, 0xa
shr ecx, 2
test r9, r9
cmove eax, ecx
movzx eax, byte [rax + rsi]
mov byte [r8 + rbx], al
je 0x140027e44
mov eax, edx
and edx, 0xf
shr eax, 4
and eax, 0x3f
shl edx, 2
movzx eax, byte [rax + rsi]
mov byte [r8 + rbx + 1], al
movzx edx, byte [rdx + rsi]
jmp 0x140027e55
and edx, 3
shl edx, 4
movzx eax, byte [rdx + rsi]
mov dl, 0x3d
mov byte [rbx + r8 + 1], al
mov byte [r8 + rbx + 2], dl
mov rbx, qword [rsp + 0x40]
mov rax, rdi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x140027e80
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push rbx
push rdi
push r12
push r14
sub rsp, 0x68
mov rax, qword [0x14007e090]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, qword [r8]
xor r12d, r12d
mov qword [rsp + 0x28], rcx
mov r14, rdx
mov rbx, rcx
test rdi, rdi
jne 0x140027ed2
xorps xmm0, xmm0
lea rdx, [0x140072a23]
movups xmmword [rcx], xmm0
xor r8d, r8d
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], r12
call fcn.14000e5d0
jmp 0x140028032
mov qword [rsp + 0x98], rbp
mov rcx, rdi
mov qword [rsp + 0xa8], rsi
mov rsi, r12
mov qword [rsp + 0x60], r15
and ecx, 3
jne 0x140027f05
cmp byte [rdi + rdx - 1], 0x3d
lea rax, [rdi + rdx]
je 0x140027f09
mov rbp, r12
mov r15, r12
jmp 0x140027f22
lea rax, [rdx + rdi]
mov ebp, 1
cmp rcx, 2
ja 0x140027f1f
cmp byte [rax - 2], 0x3d
jne 0x140027f1f
mov r15, r12
jmp 0x140027f22
mov r15, rbp
sub rdi, rbp
lea rcx, [rsp + 0x30]
and rdi, 0xfffffffffffffffc
xor r8d, r8d
mov rdx, rdi
shr rdx, 2
lea rax, [r15 + rdx*2]
add rdx, rax
add rdx, rbp
call fcn.14000aa50
cmp qword [rsp + 0x48], 0x10
lea r9, [rsp + 0x30]
lea r10, [0x140074840]
cmovae r9, qword [rsp + 0x30]
test rdi, rdi
je 0x140027fc6
lea rdx, [rdi - 1]
shr rdx, 2
lea r8, [r14 + 2]
inc rdx
movzx eax, byte [r8 - 2]
lea r8, [r8 + 4]
mov ecx, dword [r10 + rax*4]
movzx eax, byte [r8 - 5]
shl ecx, 6
or ecx, dword [r10 + rax*4]
movzx eax, byte [r8 - 4]
shl ecx, 6
or ecx, dword [r10 + rax*4]
movzx eax, byte [r8 - 3]
shl ecx, 6
or ecx, dword [r10 + rax*4]
mov eax, ecx
sar eax, 0x10
mov byte [r9 + rsi], al
mov eax, ecx
sar eax, 8
mov byte [r9 + rsi + 1], al
mov byte [r9 + rsi + 2], cl
add rsi, 3
sub rdx, 1
jne 0x140027f73
test rbp, rbp
mov rbp, qword [rsp + 0x98]
je 0x140028014
movzx eax, byte [rdi + r14]
movzx ecx, byte [rdi + r14 + 1]
mov edx, dword [r10 + rax*4]
shl edx, 6
or edx, dword [r10 + rcx*4]
shl edx, 0xc
mov eax, edx
sar eax, 0x10
mov byte [r9 + rsi], al
test r15, r15
je 0x140028014
movzx eax, byte [rdi + r14 + 2]
sar edx, 8
mov ecx, dword [r10 + rax*4]
shl ecx, 6
sar ecx, 8
or dl, cl
mov byte [r9 + rsi + 1], dl
movups xmm0, xmmword [rsp + 0x30]
mov r15, qword [rsp + 0x60]
movups xmm1, xmmword [rsp + 0x40]
mov rsi, qword [rsp + 0xa8]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140038af0
add rsp, 0x68
pop r14
pop r12
pop rdi
pop rbx
ret
Function at 0x140029030
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400290c7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400290c7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400290c2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1400290a0
cmp r8d, 0x491e0a9c
je 0x1400290cc
test r9d, r9d
jne 0x140029080
mov rax, qword [rax]
jmp 0x140029050
mov ecx, dword [rbx + 0x24]
movabs rdi, 0x935689b4884a23c2
add rcx, r10
mov qword [rsp + 0x48], rdi
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
movabs rbx, 0xa971e50dccc93a05
add rcx, r10
mov qword [rsp + 0x40], rbx
mov eax, dword [rcx + rdx*4]
movabs rcx, 0xa971e50dccba5666
mov qword [rsp + 0x20], rcx
add rax, r10
mov qword [rsp + 0x28], rdi
lea rcx, [rsp + 0x20]
movdqa xmm0, xmmword [rsp + 0x20]
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm0
call rax
lea rdx, str._n___________________________________________________n_____________________________________________n___________________________________________n_____________________________________________n______________________________________________n____________________________________________n____________________________________________n____________________________________________n_________________________________________by_w._________________________________________________n
lea rcx, [0x14007f960]
call fcn.14000d920
mov qword [rsp + 0x38], rdi
lea rdx, [rsp + 0x30]
movabs rcx, 0xa971e50dccc93a0f
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rcx
mov rcx, rax
movdqa xmm0, xmmword [rsp + 0x30]
mov qword [rsp + 0x58], rdi
pxor xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.14000d920
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x140029b60
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140029bf7
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140029bf7
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140029bf2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140029bd0
cmp r8d, 0x491e0a9c
je 0x140029bfc
test r9d, r9d
jne 0x140029bb0
mov rax, qword [rax]
jmp 0x140029b80
mov ecx, dword [rdi + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
movabs rdx, 0xe8a3516040b383b6
mov qword [rsp + 0x48], rdx
movabs rcx, 0xa971e50dccc93a05
mov qword [rsp + 0x50], rcx
add rax, r10
movabs rcx, 0x935689b4884a23c2
mov qword [rsp + 0x78], rdx
mov qword [rsp + 0x58], rcx
movabs rcx, 0x2dea9497da668b87
movdqa xmm0, xmmword [rsp + 0x50]
mov qword [rsp + 0x60], rcx
movabs rcx, 0x9be088ae0f1cbdac
mov qword [rsp + 0x68], rcx
movabs rcx, 0x39e284c902fcc9c9
movdqa xmm1, xmmword [rsp + 0x60]
mov qword [rsp + 0x70], rcx
movabs rcx, 0x86518322eca55f41
mov qword [rsp + 0x20], rcx
movabs rcx, 0xfd3fdee8b20903b3
mov qword [rsp + 0x28], rcx
movabs rcx, 0x4a85f8cba911e4e3
pxor xmm0, xmmword [rsp + 0x20]
mov qword [rsp + 0x30], rcx
movabs rcx, 0xb58eedd67a6fe1df
mov qword [rsp + 0x38], rcx
movabs rcx, 0x39e284c9769aa0ae
pxor xmm1, xmmword [rsp + 0x30]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [rsp + 0x70]
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmmword [rsp + 0x30], xmm1
call rax
call fcn.140022a10
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140029d87
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140029d87
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rdi]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140029d82
nop dword [rax]
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140029d60
cmp r8d, 0xcded1a85
je 0x140029d8c
test r9d, r9d
jne 0x140029d40
mov rax, qword [rax]
jmp 0x140029d10
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 0x29a
add rax, r10
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
jmp rax
Function at 0x140034a30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140034a91
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140034a50
mov ecx, dword [r10]
jmp 0x140034b7a
cmp ecx, 0x4e0
jb 0x140034b7a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140034ab0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140034b00
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret