joyce8/EMBER2024-capa huggingface dataset:
Function at 0x459180
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45922f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x0060d878]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers

Function at 0x4640c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0060d64c], 0
je 0x4640ce
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x4640e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0060d64c], 0
je 0x4640f5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x464100
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0060d64c], 0
je 0x464135
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0060dbe0]
aesenc xmm0, xmmword [0x0060dbf0]
aesenc xmm0, xmmword [0x0060dc00]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x464140
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x0060d64c], 0
je 0x464176
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0060dbe0]
aesenc xmm0, xmmword [0x0060dbf0]
aesenc xmm0, xmmword [0x0060dc00]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback

Function at 0x465a60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov rdx, 2
jmp sym.sigtramp

Function at 0x465e60
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x465e94
mov rcx, 0x28
jmp 0x465e9f
shl rcx, 3
add rcx, 0x1480
mov qword [0x0060d878], rcx
pop rbp
ret
Function at 0x479f40
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47a17b
push rbp
mov rbp, rsp
sub rsp, 0x78
mov ebx, dword [rax + 0x2c]
test ebx, ebx
jne 0x479fda
mov qword [rsp + 0x88], rax
lea rbx, [0x004ea4c0]
mov rcx, rax
lea rax, [0x005ba780]
call sym.sync._Map_.Load
test cl, cl
jne 0x479fc3
mov rax, qword [rsp + 0x88]
call sym.reflect._rtype_.String
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x30]
lea rbx, [0x005181c8]
call sym.runtime.concatstring2
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rbx
call sym.reflect.typesByString
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x479ff7
lea rdx, [0x004e7e20]
cmp rax, rdx
jne 0x479fe5
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
call sym.reflect.resolveTypeOff
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x004d4760]
call sym.runtime.panicdottypeE
inc rdx
cmp rbx, rdx
jle 0x47a041
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x479ff4
lea rax, [0x005ba780]
lea rbx, [0x004ea4c0]
lea rdi, [0x004e7e20]
nop dword [rax + rax]
call sym.sync._Map_.LoadOrStore
lea rdx, [0x004e7e20]
cmp rax, rdx
jne 0x47a16b
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
nop
ret
lea rcx, [0x004cdd00]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rcx
lea rax, [0x004d8e40]
call sym.runtime.newobject
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x0060d8b0], 0
nop
je 0x47a09b
mov rbx, rax
lea rax, [0x004d8e40]
call sym.runtime.wbMove
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
mov rax, qword [rsp + 0x50]
call sym.internal_abi.NewName
call sym.reflect.addReflectOff
mov rsi, qword [rsp + 0x60]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x47a102
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
test rax, rax
jle 0x47a0f4
mov dword [rsi + 0x10], edx
cmp dword [0x0060d8b0], 0
je 0x47a123
call sym.runtime.gcWriteBarrier2
mov qword [r11], rcx
mov rdx, qword [rsi + 0x30]
mov qword [r11 + 8], rdx
mov qword [rsi + 0x30], rcx
lea rax, [0x005ba780]
lea rbx, [0x004ea4c0]
lea rdi, [0x004e7e20]
nop dword [rax]
call sym.sync._Map_.LoadOrStore
lea rdx, [0x004e7e20]
cmp rax, rdx
jne 0x47a15c
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x004d4760]
call sym.runtime.panicdottypeE
mov rbx, rdx
lea rcx, [0x004d4760]
call sym.runtime.panicdottypeE
nop
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.reflect._rtype_.ptrTo
Function at 0x4836e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4837aa
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0060d878]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x48378f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004d0e80]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x48377e
mov edi, 1
lea rsi, [0x004d0e80]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005198c8]
lea rsi, [0x00518f68]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString
Function at 0x4b0ee0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4b0ef7
inc rax
cmp rax, 4
jge 0x4b0f0f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4b0ef4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4b0f20
inc rax
cmp rax, 4
jge 0x4b0f2e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4b0f57
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4b0f3b
jmp 0x4b0f1d
Function at 0x4ba540
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x4ba5ab
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x4ba564
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x4ba581
cmp rdx, 0
je 0x4ba5cd
test rdx, 0xf
je 0x4ba55d
test rdx, 7
jne 0x4ba581
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x4ba55d
ret
Function at 0x4bbdc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4bbdff
jb 0x4bbe14
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x4bbe80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4bbf54
jb 0x4bbfb3
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 1
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 2
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 2
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 4
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 4
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 8
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 8
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 0x10
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 0x10
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 0x20
call sym._expand_key_256a
aeskeygenassist xmm1, xmm0, 0x20
call sym._expand_key_256b
aeskeygenassist xmm1, xmm2, 0x40
call sym._expand_key_256a
jmp 0x4bc021
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call sym._expand_key_192a
aeskeygenassist xmm1, xmm2, 2
call sym._expand_key_192b
aeskeygenassist xmm1, xmm2, 4
call sym._expand_key_192a
aeskeygenassist xmm1, xmm2, 8
call sym._expand_key_192b
aeskeygenassist xmm1, xmm2, 0x10
call sym._expand_key_192a
aeskeygenassist xmm1, xmm2, 0x20
call sym._expand_key_192b
aeskeygenassist xmm1, xmm2, 0x40
call sym._expand_key_192a
aeskeygenassist xmm1, xmm2, 0x80
call sym._expand_key_192b
jmp 0x4bc021
aeskeygenassist xmm1, xmm0, 1
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 2
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 4
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 8
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x10
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x20
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x40
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x80
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x1b
call sym._expand_key_128
aeskeygenassist xmm1, xmm0, 0x36
call sym._expand_key_128
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4bc02e
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x180001000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x18001a008]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rdi, rdx
mov esi, ecx
mov rdx, qword [rdx]
lea rcx, [rsp + 0x60]
mov r8d, 0x100
call fcn.180005690
mov rdx, qword [rdi]
lea rcx, [rsp + 0x60]
mov r8d, 0x100
call fcn.180005c0c
lea rdx, [0x180001240]
lea rcx, [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerA]
mov qword [0x18001bc90], rax
test rax, rax
je 0x18000121d
mov qword [rsp + 0x180], rbx
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov rcx, qword [0x18001bc90]
lea rdx, [rsp + 0x20]
xor ebx, ebx
mov dword [rsp + 0x20], 0x10
mov dword [rsp + 0x30], ebx
mov dword [0x18001bc98], 2
mov dword [rsp + 0x24], 2
mov qword [rsp + 0x28], 7
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x38], 0xbb8
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov rcx, qword [0x18001bc90]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x10
mov dword [0x18001bc98], 4
mov dword [rsp + 0x44], 4
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], 0xbb8
call qword [sym.imp.ADVAPI32.dll_SetServiceStatus]
cmp esi, 1
jle 0x180001134
mov rdx, qword [rdi + 8]
lea rcx, [rsp + 0x60]
mov r8d, 0x100
call fcn.180005690
mov rdx, qword [rdi + 8]
lea rcx, [rsp + 0x60]
mov r8d, 0x100
call fcn.180005c0c
lea r9, str.AX_MDxMZ
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [r9 + rcx], bl
jne 0x180001142
movdqa xmm2, xmmword [str._b_b_b_b_b_b_b_b_b_b_b_b_b_b_b_b]
mov r8d, ebx
test ecx, ecx
jle 0x1800011d3
cmp ecx, 0x40
jb 0x1800011d3
mov edx, ecx
and edx, 0x8000003f
jge 0x180001170
dec edx
or edx, 0xffffffc0
inc edx
mov eax, ecx
sub eax, edx
movsxd rdx, eax
nop word [rax + rax]
movdqu xmm0, xmmword [rbx + r9]
add r8d, 0x40
pxor xmm0, xmm2
movdqu xmmword [rbx + r9], xmm0
movdqu xmm1, xmmword [rbx + r9 + 0x10]
pxor xmm1, xmm2
movdqu xmmword [rbx + r9 + 0x10], xmm1
movdqu xmm0, xmmword [rbx + r9 + 0x20]
pxor xmm0, xmm2
movdqu xmmword [rbx + r9 + 0x20], xmm0
movdqu xmm0, xmmword [rbx + r9 + 0x30]
pxor xmm0, xmm2
movdqu xmmword [rbx + r9 + 0x30], xmm0
add rbx, 0x40
cmp rbx, rdx
jl 0x180001180
mov rbx, qword [rsp + 0x180]
movsxd rax, r8d
movsxd rdx, ecx
cmp rax, rdx
jge 0x1800011fd
nop word [rax + rax]
xor byte [rax + r9], 8
inc rax
cmp rax, rdx
jl 0x1800011f0
call fcn.1800013d0
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [0x18001bc98]
cmp eax, 3
je 0x18000121d
cmp eax, 1
jne 0x180001202
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1800018b0
mov rsi, qword [rsp + 0x190]
add rsp, 0x170
pop rdi
ret
Function at 0x140001770
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rsp + 0x4c]
mov r8, rdi
sub r8, rdx
nop dword [rax + rax]
movzx ecx, word [rdx]
movzx eax, word [rdx + r8]
sub ecx, eax
jne 0x1400017d4
add rdx, 2
test eax, eax
jne 0x1400017c0
test ecx, ecx
je 0x1400017fb
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400017b0
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
mov eax, dword [rsp + 0x28]
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret

Function at 0x140001810
Capabilities:
Get file size
Read file on windows

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001851
xor eax, eax
add rsp, 0x40
pop rdi
ret
mov qword [rsp + 0x50], rbx
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x58], rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
movsxd rbx, eax
mov rdx, rbx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov rdx, rax
mov r8d, ebx
mov rcx, rdi
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rbx, qword [rsp + 0x50]
test eax, eax
je 0x1400018c4
cmp dword [rsi], 0x905a4d
jne 0x1400018c4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x8000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rsi, qword [rsp + 0x58]
xor eax, eax
add rsp, 0x40
pop rdi
ret

Function at 0x140001a60
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x28
movsxd rdx, ecx
lea rcx, [0x140001a10]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [0x14008bf70]
add rsp, 0x28
ret
Function at 0x14000aca0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14000ad01
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14000acc0
mov ecx, dword [r9]
jmp 0x14000ade8
cmp ecx, 0x4e0
jb 0x14000ade8
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14000ad20
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14000ad70
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14000b530
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14000b564
mov eax, esi
lea ecx, [rax - 0x4a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14000b550
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14000b130
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14000b589
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14000a750
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000b603
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b5fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b5fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006d83c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000b610
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x14000b644
mov eax, esi
lea ecx, [rax - 0x4a]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x14000b630
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14000b130
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14000b669
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14000a750
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000b6e3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b6de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b6de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006d83c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret