joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401038c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm2, xmmword [rcx]
movdqa xmm1, xmm2
movdqu xmmword [rdx], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm3, xmm1
pxor xmm0, xmm2
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 1
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x10], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm2, xmm1
pxor xmm0, xmm3
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 2
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqa xmm1, xmm2
movdqu xmmword [rdx + 0x20], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm3, xmm1
pxor xmm0, xmm2
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x30], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm2, xmm1
pxor xmm0, xmm3
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 8
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqa xmm1, xmm2
movdqu xmmword [rdx + 0x40], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm3, xmm1
pxor xmm0, xmm2
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 0x10
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x50], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm2, xmm1
pxor xmm0, xmm3
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0x20
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqu xmmword [rdx + 0x60], xmm2
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 0x40
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x70], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm2, xmm1
pxor xmm0, xmm3
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0x80
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqa xmm1, xmm2
movdqu xmmword [rdx + 0x80], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
pxor xmm0, xmm2
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 0x1b
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x90], xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm2, xmm1
pxor xmm0, xmm3
pxor xmm2, xmm0
pslldq xmm1, 4
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0x36
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqu xmmword [rdx + 0xa0], xmm2
ret
Function at 0x140136090
Capabilities:
Get storage device properties

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1401bb548]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rdx
mov rbp, rcx
mov rsi, qword [0x1401c27e8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [rsi + 0x3d8]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x48], rcx
xor edi, edi
mov qword [rsp + 0x58], rdi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rax
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
mov r10, qword [rax]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x96
mov qword [rsp + 0x20], r8
mov edx, 0x2d1400
mov r9d, 0x96
mov rcx, rbp
call qword [r10 + 0x340]
test eax, eax
jne 0x14013616c
mov edx, 0xc8
mov rcx, qword [rsp + 0x50]
call qword [rsi + 0x3d0]
test eax, eax
jne 0x140136171
mov dword [rsp + 0x78], edi
xor r9d, r9d
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x58]
mov rcx, rbp
call qword [rsi + 0x3c8]
test eax, eax
je 0x140136171
mov edi, 1
mov rcx, qword [rsp + 0x50]
call qword [rsi + 0x348]
nop
mov eax, edi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140172c20
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x140139190
Capabilities:
Check for software breakpoints

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx + 8]
mov rcx, qword [rcx + 0x10]
cmp rax, rcx
je 0x1401391b2
mov rdx, qword [rax]
cmp byte [rdx], 0xcc
je 0x1401391b9
add rax, 8
cmp rax, rcx
jne 0x1401391a1
xor al, al
add rsp, 0x28
ret
call fcn.14009aa10
mov dword [rax], 0xb
mov al, 1
add rsp, 0x28
ret

Function at 0x14013e1d0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
jmp 0x14013e210
push rbx
push rsi
sub rsp, 0x58
mov rax, qword [0x1401bb548]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rcx - 1]
mov rsi, rdx
mov rbx, rcx
cmp rax, 0xfffffffffffffffd
ja 0x14013e3e7
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14013e3d8
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x14013e3d8
movsxd rcx, dword [rbx + 0x3c]
add rcx, rbx
cmp dword [rcx], 0x4550
jne 0x14013e3d8
movzx eax, word [rcx + 0x18]
mov edx, 0x10b
mov qword [rsp + 0x48], r14
cmp dx, ax
jne 0x14013e28c
mov eax, 0x78
lea r14, [rax + rcx]
jmp 0x14013e2a4
mov edx, 0x20b
cmp dx, ax
jne 0x14013e2a1
mov eax, 0x88
lea r14, [rax + rcx]
jmp 0x14013e2a4
xor r14d, r14d
mov eax, dword [r14]
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x40], r15
test eax, eax
je 0x14013e3c9
cmp dword [r14 + 4], 0
je 0x14013e3c9
mov r15d, dword [rbx + rax + 0x1c]
lea rdi, [rbx + rax]
add r15, rbx
cmp rsi, 0x10000
jae 0x14013e2ef
sub si, word [rdi + 0x10]
jmp 0x14013e361
mov ebp, dword [rdi + 0x20]
lea r12, [0x14013df40]
mov r8d, dword [rdi + 0x18]
add rbp, rbx
mov rdx, rbp
mov qword [rsp + 0x28], rbx
mov r9d, 4
mov qword [rsp + 0x20], r12
mov rcx, rsi
call fcn.1401826b0
mov rdx, rax
test rax, rax
jne 0x14013e350
mov eax, dword [rdi + 0x18]
lea r9d, [rdx + 4]
mov rdx, rbp
mov qword [rsp + 0x28], rbx
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], eax
mov rcx, rsi
mov qword [rsp + 0x20], r12
call fcn.1401827c0
mov rdx, rax
test rax, rax
je 0x14013e3c9
mov ecx, dword [rdi + 0x24]
sub rdx, rbp
shr rdx, 2
add rcx, rbx
movzx esi, word [rcx + rdx*2]
movzx eax, si
cmp eax, dword [rdi + 0x14]
jae 0x14013e3c9
mov edx, dword [r14]
movzx eax, si
mov ecx, dword [r15 + rax*4]
cmp ecx, edx
jb 0x14013e3c3
add edx, dword [r14 + 4]
cmp ecx, edx
jae 0x14013e3c3
lea rdx, [rbx + rcx]
mov rcx, rbx
call fcn.14013df80
test rax, rax
je 0x14013e3c9
mov rbp, qword [rsp + 0x80]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x88]
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140172c20
add rsp, 0x58
pop rsi
pop rbx
ret
lea rax, [rbx + rcx]
jmp 0x14013e390
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14013e390
mov ecx, 0x7e
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14013e3af
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14013e3af
Function at 0x14013e210
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
jmp 0x14013e210
push rbx
push rsi
sub rsp, 0x58
mov rax, qword [0x1401bb548]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rcx - 1]
mov rsi, rdx
mov rbx, rcx
cmp rax, 0xfffffffffffffffd
ja 0x14013e3e7
mov edx, 0x400
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x14013e3d8
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x14013e3d8
movsxd rcx, dword [rbx + 0x3c]
add rcx, rbx
cmp dword [rcx], 0x4550
jne 0x14013e3d8
movzx eax, word [rcx + 0x18]
mov edx, 0x10b
mov qword [rsp + 0x48], r14
cmp dx, ax
jne 0x14013e28c
mov eax, 0x78
lea r14, [rax + rcx]
jmp 0x14013e2a4
mov edx, 0x20b
cmp dx, ax
jne 0x14013e2a1
mov eax, 0x88
lea r14, [rax + rcx]
jmp 0x14013e2a4
xor r14d, r14d
mov eax, dword [r14]
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x40], r15
test eax, eax
je 0x14013e3c9
cmp dword [r14 + 4], 0
je 0x14013e3c9
mov r15d, dword [rbx + rax + 0x1c]
lea rdi, [rbx + rax]
add r15, rbx
cmp rsi, 0x10000
jae 0x14013e2ef
sub si, word [rdi + 0x10]
jmp 0x14013e361
mov ebp, dword [rdi + 0x20]
lea r12, [0x14013df40]
mov r8d, dword [rdi + 0x18]
add rbp, rbx
mov rdx, rbp
mov qword [rsp + 0x28], rbx
mov r9d, 4
mov qword [rsp + 0x20], r12
mov rcx, rsi
call fcn.1401826b0
mov rdx, rax
test rax, rax
jne 0x14013e350
mov eax, dword [rdi + 0x18]
lea r9d, [rdx + 4]
mov rdx, rbp
mov qword [rsp + 0x28], rbx
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], eax
mov rcx, rsi
mov qword [rsp + 0x20], r12
call fcn.1401827c0
mov rdx, rax
test rax, rax
je 0x14013e3c9
mov ecx, dword [rdi + 0x24]
sub rdx, rbp
shr rdx, 2
add rcx, rbx
movzx esi, word [rcx + rdx*2]
movzx eax, si
cmp eax, dword [rdi + 0x14]
jae 0x14013e3c9
mov edx, dword [r14]
movzx eax, si
mov ecx, dword [r15 + rax*4]
cmp ecx, edx
jb 0x14013e3c3
add edx, dword [r14 + 4]
cmp ecx, edx
jae 0x14013e3c3
lea rdx, [rbx + rcx]
mov rcx, rbx
call fcn.14013df80
test rax, rax
je 0x14013e3c9
mov rbp, qword [rsp + 0x80]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x88]
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140172c20
add rsp, 0x58
pop rsi
pop rbx
ret
lea rax, [rbx + rcx]
jmp 0x14013e390
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14013e390
mov ecx, 0x7e
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14013e3af
mov ecx, 0x7f
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14013e3af

Function at 0x14013e930
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
call fcn.14013ec70
xor edi, edi
lea rdx, [rbx + 0x94]
cmp byte [rbx + 0x40], dil
lea rcx, [rbx + 0x44]
mov r9d, edi
mov qword [rsp + 0x20], rdx
setne r9b
mov rdx, rax
lea r8d, [rdi + 0x10]
call fcn.140101440
xorps xmm0, xmm0
movups xmmword [rbx + 0x94], xmm0
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14013e982
mov rdi, qword [rbx + 8]
movsxd r8, eax
lea rcx, [rbx + 0x44]
mov r9, rdi
mov rdx, rdi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.140101030
Function at 0x14013f9d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
xor esi, esi
mov r14, rdx
mov rdi, rcx
test rcx, rcx
je 0x14013fab1
cmp word [rcx + 0x38], si
je 0x14013fab1
cmp word [rcx + 0x3a], si
je 0x14013fab1
cmp qword [rcx + 0x40], rsi
je 0x14013fab1
mov qword [rsp + 0x30], rbx
lea rbx, [0x14008324c]
mov qword [rsp + 0x38], rbp
mov r11d, dword [rbx - 0xc]
test r11d, r11d
je 0x14013faa7
movzx eax, word [rdi + 0x38]
shr eax, 1
cmp eax, r11d
jne 0x14013fa9e
mov rbp, qword [rdi + 0x40]
xor eax, eax
mov r10, qword [rbx - 8]
test r11d, r11d
je 0x14013fa8c
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax + rax]
movzx r8d, byte [rcx + rbp]
lea ecx, [r8 + 0x20]
movzx r9d, cl
lea edx, [r8 - 0x41]
movzx ecx, byte [r10]
cmp dl, 0x19
cmova r9d, r8d
cmp cl, 0x3f
je 0x14013fa82
cmp cl, 0x2a
je 0x14013fa82
xor r9b, 0x33
cmp r9b, cl
jne 0x14013fa9e
inc eax
inc r10
cmp eax, r11d
jb 0x14013fa50
test r14, r14
je 0x14013fa9e
mov rcx, qword [rdi + 0x50]
call r14
test eax, eax
je 0x14013fa9e
or esi, dword [rbx]
add rbx, 0x14
jmp 0x14013fa20
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140140290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x140140290
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1401bb548]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor edi, edi
mov dword [rbp + 7], 0x767d677f
lea rcx, [rbp + 7]
mov qword [rbp - 1], rdi
mov dword [rbp + 0xb], 0x32382435
mov dword [rbp + 0xf], 0x717c0f6a
lea edx, [rdi + 6]
mov dword [rbp + 0x13], 0x777d5260
mov dword [rbp + 0x17], 0x73782d33
mov dword [rbp + 0x1b], 0x18044a44
call fcn.1401441b0
lea rdx, [rbp - 1]
lea rcx, [rbp + 7]
call fcn.140143110
mov qword [rbp - 0x13], rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x37], xmm1
mov qword [rbp + 0x1f], rdi
test rax, rax
je 0x1401403fc
lea edx, [rdi + 6]
mov qword [rsp + 0xa0], rbx
lea rcx, [rbp + 7]
mov dword [rbp + 7], 0x746b767a
mov dword [rbp + 0xb], 0x624f663c
mov dword [rbp + 0xf], 0x5b6d1f23
mov dword [rbp + 0x13], 0x717b6c7b
mov dword [rbp + 0x17], 0x6e3d3e
mov dword [rbp + 0x1b], 0x18044a44
call fcn.1401441b0
lea rdx, [rbp - 1]
mov qword [rbp - 1], rdi
lea rcx, [rbp + 7]
call fcn.140143110
xorps xmm0, xmm0
mov rbx, rax
movups xmmword [rbp + 7], xmm0
movups xmmword [rbp + 0x17], xmm0
movups xmmword [rbp + 0x27], xmm0
movups xmmword [rbp + 0x37], xmm0
test rax, rax
je 0x1401403f8
lea r9, [rbp - 9]
mov dword [rbp - 0x17], edi
lea edx, [rdi + 0xe]
mov dword [rbp - 9], edi
lea r8d, [rdi + 0x40]
mov rcx, rax
call fcn.14014a5c0
test eax, eax
je 0x1401403f8
mov eax, dword [rbp - 0x11]
lea r9, [rbp - 9]
mov r8d, dword [rbp - 9]
lea edx, [rdi + 0xe]
mov word [rbp - 0x19], 0x25ff
mov rcx, rbx
movsd xmm0, qword [rbp - 0x19]
movsd qword [rbx], xmm0
mov dword [rbx + 8], eax
movzx eax, word [rbp - 0xd]
mov word [rbx + 0xc], ax
call fcn.14014a5c0
mov al, 1
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140172c20
mov rdi, qword [rsp + 0xa8]
add rsp, 0x90
pop rbp
ret
xor al, al
jmp 0x1401403d3
jmp 0x1401403db

Function at 0x1401422d0
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
call fcn.140142300
test rax, rax
jne 0x1401422f9
test rbx, rbx
je 0x1401422f9
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140143b60
add rsp, 0x20
pop rbx
ret
Function at 0x14014b750
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1401bb548]
xor rax, rsp
mov qword [rbp - 0x10], rax
movzx ebx, cl
test cl, cl
jne 0x14014b7bd
mov rax, qword [0x1401c2c00]
test rax, rax
je 0x14014b78a
mov rax, qword [0x1401c2c00]
jmp 0x14014b7d0
mov dword [rbp - 0x48], 0x6c610d6a
mov dword [rbp - 0x44], 0x6c7c7b47
mov dword [rbp - 0x40], 0x694d2535
mov dword [rbp - 0x3c], 0x79732736
mov dword [rbp - 0x38], 0x795b6766
mov dword [rbp - 0x34], 0x6e2432
mov dword [rbp - 0x30], 0x18044a44
jmp 0x14014b811
mov rax, qword [0x1401c2c08]
test rax, rax
je 0x14014b7e0
mov rax, qword [0x1401c2c08]
xor rax, 0x180f0214
test rax, rax
je 0x14014b81f
jmp 0x14014b88c
mov dword [rbp - 0x48], 0x6d6a0f6a
mov dword [rbp - 0x44], 0x6b765179
mov dword [rbp - 0x40], 0x46662d24
mov dword [rbp - 0x3c], 0x6f69382d
mov dword [rbp - 0x38], 0x4c6a7075
mov dword [rbp - 0x34], 0x65672a31
mov dword [rbp - 0x30], 0x18044a37
mov dword [rbp - 0x4c], 0x32382435
mov dword [rbp - 0x50], 0x767d677f
mov edx, 9
lea rcx, [rbp - 0x50]
call fcn.1401441b0
lea rdx, [rbp - 0x60]
mov qword [rbp - 0x60], 0
lea rcx, [rbp - 0x50]
call fcn.140143110
mov qword [rbp - 0x60], 0
xorps xmm0, xmm0
mov rdx, rax
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
test rax, rax
je 0x14014b88c
test bl, bl
jne 0x14014b87c
mov rcx, rax
xor rcx, 0x180f0214
mov qword [0x1401c2c00], rcx
jmp 0x14014b88c
xor rax, 0x180f0214
mov qword [0x1401c2c08], rax
mov rax, rdx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140172c20
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x140181ef0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1401bb548]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r15, r8
mov rbp, rdx
mov r12, rcx
mov qword [rsp + 0x20], rcx
xorps xmm0, xmm0
lea r14, [r8 + 1]
movdqu xmmword [rsp + 0x28], xmm0
xor esi, esi
mov qword [rsp + 0x38], rsi
xor ebx, ebx
test r14, r14
je 0x140181fb3
movabs rax, 0x7fffffffffffffff
cmp r14, rax
ja 0x14018212d
cmp r14, 0x1000
jb 0x140181f83
lea rcx, [r14 + 0x27]
cmp rcx, r14
jbe 0x140182133
call fcn.1401724f0
test rax, rax
je 0x140182139
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140181f8e
mov rcx, r14
call fcn.1401724f0
mov rbx, rax
mov rdi, rbx
mov qword [rsp + 0x28], rbx
lea rsi, [rbx + r14]
mov qword [rsp + 0x38], rsi
mov r8, r14
xor edx, edx
mov rcx, rbx
call fcn.140174eb0
mov qword [rsp + 0x30], rsi
jmp 0x140181fb8
mov rdi, qword [rsp + 0x28]
test rbp, rbp
je 0x140182097
test rbx, rbx
je 0x140182097
xor r8d, r8d
test r15, r15
je 0x140182092
cmp r15, 0x40
jb 0x14018206c
lea rcx, [r15 - 1]
add rcx, rbx
lea rax, [rbp - 1]
add rax, r15
cmp rbx, rax
ja 0x140181ff8
cmp rcx, rbp
jae 0x14018206c
mov rax, r15
and eax, 0x3f
mov r9, r15
sub r9, rax
movdqa xmm2, xmmword [0x140088100]
lea rax, [rbx + 0x10]
mov rcx, rbp
sub rcx, rbx
nop word [rax + rax]
movdqu xmm0, xmmword [rcx + rax - 0x10]
pxor xmm0, xmm2
movdqu xmmword [rax - 0x10], xmm0
movdqu xmm1, xmmword [rcx + rax]
pxor xmm1, xmm2
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rcx + rax + 0x10]
pxor xmm0, xmm2
movdqu xmmword [rax + 0x10], xmm0
movdqu xmm1, xmmword [rcx + rax + 0x20]
pxor xmm1, xmm2
movdqu xmmword [rax + 0x20], xmm1
add r8, 0x40
lea rax, [rax + 0x40]
cmp r8, r9
jb 0x140182020
cmp r8, r15
jae 0x140182092
lea rcx, [rbx + r8]
sub rbp, rbx
mov rdx, r15
sub rdx, r8
nop dword [rax]
movzx eax, byte [rcx + rbp]
xor al, 0x67
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140182080
mov byte [r15 + rbx], 0
mov qword [r12 + 0x18], 0
mov qword [r12 + 0x20], 0xf
mov byte [r12 + 8], 0
lea rax, [0x140073a48]
mov qword [r12], rax
movsxd r8, r15d
mov rdx, rdi
mov rcx, r12
call fcn.1400f6ff0
nop
test rdi, rdi
je 0x1401820fe
sub rsi, rdi
mov rax, rdi
cmp rsi, 0x1000
jb 0x1401820f2
add rsi, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140182127
mov rdx, rsi
mov rcx, rdi
call fcn.140172530
nop
mov rax, r12
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140172c20
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.14010d210
nop
call fcn.14009dda0
int3
call fcn.14009dbf0
int3
call fcn.14010d210
int3
Function at 0x140182140
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
mov r9, rcx
test rcx, rcx
je 0x14018222a
test rdx, rdx
je 0x14018222a
xor ecx, ecx
test r8, r8
je 0x140182225
cmp r8, 0x40
jb 0x140182201
lea rdx, [r8 - 1]
lea rax, [r8 - 1]
add rdx, r10
add rax, r9
cmp r10, rax
ja 0x140182189
cmp rdx, r9
jae 0x140182201
mov r11, r8
mov qword [rsp], rbx
and r11, 0xffffffffffffffc0
movdqa xmm2, xmmword [0x140088100]
lea rax, [r10 + 0x10]
mov rdx, r9
sub rdx, r10
nop word [rax + rax]
movdqu xmm0, xmmword [rdx + rax - 0x10]
add rcx, 0x40
movdqu xmm1, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm0, xmm2
pxor xmm1, xmm2
movdqu xmmword [rax - 0x50], xmm0
movdqu xmm0, xmmword [rdx + rax - 0x30]
movdqu xmmword [rax - 0x40], xmm1
pxor xmm0, xmm2
movdqu xmm1, xmmword [rdx + rax - 0x20]
movdqu xmmword [rax - 0x30], xmm0
pxor xmm1, xmm2
movdqu xmmword [rax - 0x20], xmm1
cmp rcx, r11
jb 0x1401821b0
mov rbx, qword [rsp]
cmp rcx, r8
jae 0x140182225
sub r9, r10
lea rax, [rcx + r10]
mov rdx, r8
sub rdx, rcx
nop
movzx ecx, byte [rax + r9]
lea rax, [rax + 1]
xor cl, 0x67
mov byte [rax - 1], cl
sub rdx, 1
jne 0x140182210
mov byte [r10 + r8], 0
add rsp, 8
ret
Function at 0x1402c0ef0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1402c0efd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1402c0f0d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1402c0ef5
lea eax, [rcx + 1]
jmp 0x1402c0f1b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1402c0f2e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1402c0f14
sub eax, 3
jb 0x1402c0f4e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1402c0f9d
sar eax, 1
movsxd rbp, eax
jb 0x1402c0f84
jmp 0x1402c0f5c
add ebx, ebx
jne 0x1402c0f5a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1402c0f84
inc ecx
add ebx, ebx
jne 0x1402c0f6a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1402c0f84
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1402c0f7d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1402c0f6c
add ecx, 2
jmp 0x1402c0f89
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1402c0eb2
jmp 0x1402c0efd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x2bd000]
mov eax, dword [rdi]
or eax, eax
je 0x1402c0ffd
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x2c2ecc]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1402c0fad
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1402c0ff7
mov qword [rbx], rax
add rbx, 8
jmp 0x1402c0fcd
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1402c1041
cmp al, 0xef
ja 0x1402c1029
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1402c1009
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1402c1018
mov eax, dword [rdi]
add rdi, 4
jmp 0x1402c1018
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.1402c10c0], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.1402c10c0
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1402c10b0
sub rsp, 0xffffffffffffff80
jmp 0x1400013d0
Function at 0x1400037c0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1250
call fcn.140065c40
sub rsp, rax
mov rax, qword [0x140089168]
xor rax, rsp
mov qword [rsp + 0x1240], rax
mov rsi, rcx
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov edx, 0x1000
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x1400038e4
mov ebp, dword [rsp + 0x20]
xor ebx, ebx
shr ebp, 2
test ebp, ebp
je 0x1400038e4
mov r8d, dword [rsp + rbx*4 + 0x30]
test r8d, r8d
je 0x1400038da
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1400038da
mov r9d, 0x104
lea r8, [rsp + 0x1030]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x1400038d1
lea rcx, [rsp + 0x1030]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x140003873
cmp qword [rsi + 0x18], 8
mov r8, rsi
mov rdx, qword [rsi + 0x10]
jb 0x14000388e
mov r8, qword [rsi]
cmp rdx, rax
jne 0x1400038d1
lea rax, [rsp + 0x1030]
test rdx, rdx
je 0x1400038c4
lea rcx, [rsp + 0x1030]
sub r8, rcx
nop dword [rax + rax]
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x1400038d1
add rax, 2
sub rdx, 1
jne 0x1400038b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x1400038e6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, ebp
jb 0x140003820
xor al, al
mov rcx, qword [rsp + 0x1240]
xor rcx, rsp
call fcn.1400653e0
lea r11, [rsp + 0x1250]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret