joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ce320
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
movzx eax, word [0x1401eff10]
lea r9, [rsp + 0x20]
vmovups xmm0, xmmword [str.pWQbQk_VSI_2___F]
mov word [rsp + 0x30], ax
xor r8d, r8d
mov al, byte [0x1401eff12]
mov byte [rsp + 0x32], al
vmovups xmmword [rsp + 0x20], xmm0
mov eax, 0x29e4129f
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
inc r8d
sub al, cl
add al, 0x34
xor byte [r9], al
inc r9
cmp r8d, 0x13
jl 0x1400ce352
mov rax, qword [0x140346108]
test rax, rax
jne 0x1400ce3a2
lea rcx, [0x1401e8f58]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [0x140346108], rax
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400ce3ed
mov edx, 4
lea r9, [rsp + 0x50]
mov rcx, rax
lea r8d, [rdx + 0x3c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsp + 0x50]
lea r9, [rsp + 0x50]
mov edx, 4
mov dword [rbx], 0x1ee7c0de
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
add rsp, 0x40
pop rbx
ret
Function at 0x1400d0174
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x460
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x438
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0x238
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
lea ecx, [rdx + 8]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x20]
mov rcx, rax
mov rbp, rax
lea rbx, [rsi + 8]
call sub.KERNEL32.dll_Module32FirstW
xor edi, edi
jmp 0x1400d0201
mov rdx, qword [rbx]
cmp rdx, qword [rsi + 0x10]
je 0x1400d01e7
mov rax, qword [rsp + 0x38]
mov qword [rdx], rax
add qword [rbx], 8
jmp 0x1400d01f4
lea r8, [rsp + 0x38]
mov rcx, rsi
call fcn.1400c7738
lea rdx, [rsp + 0x20]
mov rcx, rbp
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1400d01d0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx]
lea r11, [rsp + 0x460]
cmp qword [rsi], rcx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
setne dil
mov rsi, qword [r11 + 0x20]
lea eax, [rdi - 1]
mov rsp, r11
pop rdi
ret
Function at 0x1400d162c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x12d8]
mov eax, 0x13d8
call fcn.1401df8b0
sub rsp, rax
lea r14, [rbp + 0x1318]
movabs r15, 0xff00ff00ff00ff00
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x30], r14
mov rax, qword [r14]
xor rax, r15
mov qword [rsp + 0x20], rax
and qword [r14], 0
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
or dword [rbp + 0x12c4], 0xffffffff
mov dword [rsp + 0x44], eax
mov r12d, 1
mov edx, r12d
mov r8d, 0x270
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x44], eax
add rdx, r12
cmp rdx, r8
jb 0x1400d1697
mov dword [rsp + 0x40], r8d
mov r13d, 0xffffff9c
mov dword [rbp + 0x1328], r13d
mov dword [rbp + 0x132c], 0x64
mov dword [rbp + 0x1320], 0
lea rcx, [rbp + 0x1330]
call fcn.140057480
mov rdi, qword [rbp + 0x1330]
add rdi, 0x5f5e100
lea rcx, [rbp + 0x1338]
call fcn.140057480
cmp qword [rax], rdi
jge 0x1400d17d3
mov esi, 0x186a0
mov r9d, 0x64
mov r8d, r13d
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x1328]
call fcn.1400c7c94
mov ebx, eax
test eax, eax
cmove ebx, r12d
mov r9d, 0x64
mov r8d, r13d
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x1328]
call fcn.1400c7c94
mov ecx, dword [rbp + 0x1320]
add ecx, eax
mov dword [rbp + 0x1320], ecx
mov r9d, 0x64
mov r8d, r13d
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x1328]
call fcn.1400c7c94
mov ecx, dword [rbp + 0x1320]
imul ecx, eax
mov dword [rbp + 0x1320], ecx
mov r9d, 0x64
mov r8d, r13d
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x1328]
call fcn.1400c7c94
mov ecx, dword [rbp + 0x1320]
sub ecx, eax
mov dword [rbp + 0x1320], ecx
mov eax, dword [rbp + 0x1320]
cdq
idiv ebx
mov dword [rbp + 0x1320], eax
mov eax, dword [rbp + 0x1320]
cdq
idiv ebx
mov dword [rbp + 0x1320], edx
sub rsi, r12
jne 0x1400d170c
jmp 0x1400d16f2
mov eax, dword [rbp + 0x1320]
mov dword [0x1403460f8], eax
mov rax, qword [rsp + 0x20]
xor rax, r15
mov qword [r14], rax
add rsp, 0x13d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400d180c
Capabilities:
Encode data using xor

Disassembly:
push rbp
lea rbp, [rsp - 0x90]
sub rsp, 0x190
vmovsd xmm0, qword [0x1401f14a0]
vmovsd qword [rsp + 0x30], xmm0
mov eax, dword [0x1401f14a8]
mov dword [rsp + 0x38], eax
mov al, byte [0x1401f14ac]
mov byte [rsp + 0x3c], al
xor r8d, r8d
lea r9, [rsp + 0x30]
mov eax, 0x29e4129f
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r8b
sub al, cl
add al, 0x34
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 0xd
jl 0x1400d1847
lea rcx, [rsp + 0x30]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
mov cl, 1
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsDebuggerPresent]
mov cl, 1
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsDebuggerPresent]
mov cl, 1
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsDebuggerPresent]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsProtected]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsVirtualMachinePresent]
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x60], xmm0
vmovdqu xmm1, xmmword [0x1401f27d0]
vmovdqu xmmword [rsp + 0x70], xmm1
mov byte [rsp + 0x60], 0
xor r8d, r8d
lea rdx, str.C:WindowsSystem32driversetchosts
lea rcx, [rsp + 0x40]
call fcn.1400c70b4
nop
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 7
cmova rcx, qword [rsp + 0x40]
call fcn.1401e10b8
shr rax, 0x20
test eax, eax
jne 0x1400d1966
lea rcx, [rsp + 0x40]
call fcn.140081b80
mov dword [rsp + 0x20], 1
mov r9d, 0x40
lea r8d, [r9 - 0x3e]
lea rdx, str.C:WindowsSystem32driversetchosts
lea rcx, [rbp - 0x80]
call fcn.1400800a0
nop
mov rax, qword [rbp - 0x80]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x80]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator_bool_void_const___ptr64]
test al, al
je 0x1400d194c
lea rdx, str.SPN___Wiped_Due_To_An_Possiable_Auth_Vulnerability
lea rcx, [rbp - 0x80]
call fcn.140083370
call qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
nop
lea rcx, [rbp - 0x80]
call fcn.140060f20
nop
add rsp, 0x190
pop rbp
ret
lea r8, [rsp + 0x40]
mov edx, eax
lea rcx, str.remove
call fcn.1400de6c0
int3
Function at 0x1400d86ec
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rdx
mov rdi, rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
mov r8d, dword [0x14034c9f0]
mov rax, qword gs:[0x58]
mov rsi, qword [rax + r8*8]
mov r15d, 0x1398
mov eax, dword [r15 + rsi]
mov r12d, reloc.WS2_32.dll_recv
test al, 1
jne 0x1400d8787
or eax, 1
mov dword [r15 + rsi], eax
mov ebx, r12d
add rbx, rsi
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
or dword [rbx + 0x1384], 0xffffffff
mov dword [rbx + 4], eax
mov edx, 1
lea r8, [rbx + 8]
mov r9d, 0x270
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [r8], eax
inc rdx
lea r8, [r8 + 4]
cmp rdx, r9
jb 0x1400d8764
mov dword [rbx], r9d
xor ebx, ebx
mov eax, dword [r15 + rsi]
mov ebp, 0x13a0
mov ecx, reloc.WS2_32.dll_ntohs
test al, 2
jne 0x1400d87a9
or eax, 2
mov dword [r15 + rsi], eax
mov qword [rsi + rbp], rbx
mov qword [rsi + rbp + 8], rcx
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rcx
mov byte [rdi], bl
mov dword [rsp + 0x20], 1
cmp r14, rcx
jbe 0x1400d87de
mov r8b, byte [rsp + 0x70]
mov rdx, r14
mov rcx, rdi
call fcn.1400c8318
mov qword [rdi + 0x10], rbx
jmp 0x1400d87e7
test r14, r14
je 0x1400d8889
mov ebx, r12d
add rbx, rsi
mov qword [rsp + 0x78], rbx
dec r14
mov r13, qword [0x1402df088]
mov r12, qword [rsi + rbp]
mov rdx, qword [rsi + rbp + 8]
sub rdx, r12
cmp rdx, 0xffffffffffffffff
jne 0x1400d882c
mov rcx, rbx
call fcn.1400ca980
mov r15d, eax
shl r15, 0x20
mov rcx, rbx
call fcn.1400ca980
mov eax, eax
or r15, rax
jmp 0x1400d883c
inc rdx
lea rcx, [rsp + 0x78]
call fcn.1400ca87c
mov r15, rax
lea rax, [r15 + r13]
mov r9b, byte [rax + r12]
mov rcx, qword [rdi + 0x10]
cmp rcx, qword [rdi + 0x18]
jae 0x1400d886e
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400d8863
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400d8880
mov r8b, byte [rsp + 0x70]
mov edx, 1
mov rcx, rdi
call fcn.140084470
test r14, r14
jne 0x1400d87f2
mov rax, rdi
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d88d4
Capabilities:
Encode data using xor
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
xor edi, edi
mov r10, rcx
test rcx, rcx
je 0x1400d894d
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x10]
call fcn.1400ca238
mov r8, rax
cmp byte [rax + 6], dil
je 0x1400d893c
mov r9d, edi
mov r11, rax
mov ecx, r9d
mov eax, 0x29e4129f
mul r9d
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
movsx eax, cl
imul ecx, eax, 0x37
mov al, r9b
inc r9d
sub al, cl
add al, 0x34
xor byte [r11], al
inc r11
cmp r9d, 7
jl 0x1400d890c
mov r9d, reloc.WS2_32.dll_recv
mov rdx, r10
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov edx, reloc.WS2_32.dll_ntohl
mov dword [rbp - 0x10], 0xdb31c031
xor ecx, ecx
mov dword [rbp - 0xc], 0xd231c931
mov r8d, 0x1000
mov dword [rbp - 8], 0xed31e431
mov word [rbp - 4], 0xe4ff
lea r9d, [rdx + 0x32]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x1400d89ac
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp - 0x10]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
call rbx
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
call rdi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x1400da338
Capabilities:
Set console window title

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov edi, 5
lea rbx, [0x1402df068]
call fcn.1400d0360
mov rdx, qword [0x1402df078]
mov r8, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, r8
jae 0x1400da39b
lea rcx, [rdx + 1]
cmp r8, 0xf
mov qword [0x1402df078], rcx
mov rcx, rbx
cmova rcx, qword [0x1402df068]
mov byte [rcx + rdx], al
mov byte [rcx + rdx + 1], 0
jmp 0x1400da3b0
mov r8b, byte [rsp + 0x30]
mov r9b, al
mov edx, 1
mov rcx, rbx
call fcn.140084470
sub rdi, 1
jne 0x1400da35f
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rbx, qword [0x1402df068]
mov rcx, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
Function at 0x1400de50c
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
lea r10, [rcx + 0x9c4]
mov r9, rcx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov edx, eax
add r10, 4
mov r11d, dword [r10]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1400de523
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
mov eax, r11d
mov r8, r10
mov edx, eax
add r10, 4
mov r11d, dword [r10]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1400de570
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and dword [r9], ebx
mov rbx, qword [rsp + 8]
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
shr edx, 1
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
ret
Function at 0x1400deb04
Capabilities:
Access peb ldr_data
Check for debugger via api
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
and dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x30], 0
je 0x1400ded07
mov byte [0x1403460f0], 1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1400debaf
mov edx, dword [r10 + 0x18]
test edx, edx
je 0x1400debaf
mov ebx, dword [r10 + 0x20]
dec edx
mov r11d, 0x811c9dc5
lea rcx, [rbx + rdx*4]
mov r9d, dword [rcx + r8]
add r9, r8
mov cl, byte [r9]
inc r9
test cl, cl
je 0x1400debab
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r9]
inc r9
test cl, cl
jne 0x1400deb8b
cmp r11d, 0xcded1a85
je 0x1400debb4
test edx, edx
jne 0x1400deb6e
mov rax, qword [rax]
jmp 0x1400deb4a
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1400dec46
mov edx, dword [r10 + 0x18]
test edx, edx
je 0x1400dec46
mov ebx, dword [r10 + 0x20]
dec edx
mov r11d, 0x811c9dc5
lea rcx, [rbx + rdx*4]
mov r9d, dword [rcx + r8]
add r9, r8
mov cl, byte [r9]
inc r9
test cl, cl
je 0x1400dec42
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r9]
inc r9
test cl, cl
jne 0x1400dec22
cmp r11d, 0xe80fd3a
je 0x1400dec4b
test edx, edx
jne 0x1400dec05
mov rax, qword [rax]
jmp 0x1400debe1
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x1400decdd
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x1400decdd
mov edi, dword [r9 + 0x20]
dec edx
mov r11d, 0x811c9dc5
lea rcx, [rdi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x1400decd9
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x1400decb9
cmp r11d, 0xa52bcaf9
je 0x1400dece2
test edx, edx
jne 0x1400dec9c
mov rax, qword [rax]
jmp 0x1400dec78
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov dword [0], 0xdead
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ded14
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor ebx, ebx
mov ecx, 0xbeef
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400ded32
test ebx, ebx
je 0x1400deef7
mov byte [0x1403460f0], 1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1400dedaf
mov edx, dword [r10 + 0x18]
test edx, edx
je 0x1400dedaf
mov ebx, dword [r10 + 0x20]
dec edx
lea rcx, [rbx + rdx*4]
mov r9d, dword [rcx + r8]
add r9, r8
mov r11d, 0x811c9dc5
jmp 0x1400ded98
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r9]
inc r9
test cl, cl
jne 0x1400ded8b
cmp r11d, 0xcded1a85
je 0x1400dedb4
test edx, edx
jne 0x1400ded76
mov rax, qword [rax]
jmp 0x1400ded52
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
xor ecx, ecx
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1400dee3e
mov edx, dword [r10 + 0x18]
test edx, edx
je 0x1400dee3e
mov ebx, dword [r10 + 0x20]
dec edx
lea rcx, [rbx + rdx*4]
mov r9d, dword [rcx + r8]
add r9, r8
mov r11d, 0x811c9dc5
jmp 0x1400dee27
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r9]
inc r9
test cl, cl
jne 0x1400dee1a
cmp r11d, 0xe80fd3a
je 0x1400dee43
test edx, edx
jne 0x1400dee05
mov rax, qword [rax]
jmp 0x1400dede1
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
xor ecx, ecx
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x1400deecd
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x1400deecd
mov edi, dword [r9 + 0x20]
dec edx
lea rcx, [rdi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov r11d, 0x811c9dc5
jmp 0x1400deeb6
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x1400deea9
cmp r11d, 0xa52bcaf9
je 0x1400deed2
test edx, edx
jne 0x1400dee94
mov rax, qword [rax]
jmp 0x1400dee70
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov dword [0], 0xdead
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400df16c
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400df359
mov byte [0x1403460f0], 1
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1400df201
mov edx, dword [r10 + 0x18]
test edx, edx
je 0x1400df201
mov ebx, dword [r10 + 0x20]
dec edx
mov r11d, 0x811c9dc5
lea rcx, [rbx + rdx*4]
mov r9d, dword [rcx + r8]
add r9, r8
mov cl, byte [r9]
inc r9
test cl, cl
je 0x1400df1fd
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r9]
inc r9
test cl, cl
jne 0x1400df1dd
cmp r11d, 0xcded1a85
je 0x1400df206
test edx, edx
jne 0x1400df1c0
mov rax, qword [rax]
jmp 0x1400df19c
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r10d, dword [rcx + r8 + 0x88]
add r10, r8
cmp r10, r8
je 0x1400df298
mov edx, dword [r10 + 0x18]
test edx, edx
je 0x1400df298
mov ebx, dword [r10 + 0x20]
dec edx
mov r11d, 0x811c9dc5
lea rcx, [rbx + rdx*4]
mov r9d, dword [rcx + r8]
add r9, r8
mov cl, byte [r9]
inc r9
test cl, cl
je 0x1400df294
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r9]
inc r9
test cl, cl
jne 0x1400df274
cmp r11d, 0xe80fd3a
je 0x1400df29d
test edx, edx
jne 0x1400df257
mov rax, qword [rax]
jmp 0x1400df233
mov ecx, dword [r10 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r8
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x1400df32f
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x1400df32f
mov edi, dword [r9 + 0x20]
dec edx
mov r11d, 0x811c9dc5
lea rcx, [rdi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x1400df32b
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x1400df30b
cmp r11d, 0xa52bcaf9
je 0x1400df334
test edx, edx
jne 0x1400df2ee
mov rax, qword [rax]
jmp 0x1400df2ca
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
call rax
mov dword [0], 0xdead
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400df6bc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
vmovups xmm0, xmmword [0x1401efec8]
mov eax, dword [0x1401efed8]
xor edi, edi
cmp word [0x1401efeda], di
mov ebx, 0x29e4129f
vmovups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], eax
je 0x1400df729
mov r8d, edi
lea r9, [rsp + 0x20]
mov eax, ebx
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movzx eax, ax
imul ecx, eax, 0x37
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x34
xor word [r9], ax
lea r9, [r9 + 2]
cmp r8d, 0xa
jl 0x1400df6f6
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r8, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400df7d3
mov ecx, dword [0x1401efef0]
lea r10, [rsp + 0x34]
vmovups xmm0, xmmword [0x1401efee0]
mov al, byte [0x1401efef6]
mov r9d, edi
mov dword [rsp + 0x44], ecx
movzx ecx, word [0x1401efef4]
mov word [rsp + 0x48], cx
vmovups xmmword [rsp + 0x34], xmm0
mov byte [rsp + 0x4a], al
mov eax, ebx
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x37
mov al, r9b
inc r9d
sub al, cl
add al, 0x34
xor byte [r10], al
inc r10
cmp r9d, 0x17
jl 0x1400df77b
lea rdx, [rsp + 0x34]
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x1400df7d3
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
lea edx, [r9 + 0x11]
call rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
Function at 0x1400e15f0
Capabilities:
Enumerate pe sections

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
movsxd rdi, dword [r8 + 0x3c]
xor r12d, r12d
add rdi, r8
mov qword [rdx], r12
mov r15, r8
mov qword [rdx + 8], r12
mov rbx, rdx
mov dword [rdx + 0x10], r12d
mov r14d, r12d
movzx eax, word [rdi + 0x14]
lea rsi, [rdi + 0x18]
add rsi, rax
cmp r12w, word [rdi + 6]
jae 0x1400e1721
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r12
or r8, 0xffffffffffffffff
mov qword [rbp - 0x10], r12
inc r8
cmp byte [rsi + r8], r12b
jne 0x1400e1658
mov rdx, rsi
lea rcx, [rbp - 0x28]
call fcn.140083fc0
mov rdx, qword [rbp - 0x10]
lea rax, [rbp - 0x28]
mov rcx, qword [rbp - 0x28]
cmp rdx, 0xf
cmova rax, rcx
cmp qword [rbp - 0x18], 5
jne 0x1400e16de
cmp dword [rax], 0x7865742e
jne 0x1400e16de
cmp byte [rax + 4], 0x74
jne 0x1400e16de
mov r9d, dword [rsi + 0xc]
mov r8d, r12d
mov r11d, dword [rsi + 8]
add r9, r15
mov qword [rbp - 0x40], rsi
mov r10, r12
mov qword [rbp - 0x38], r9
test r11, r11
je 0x1400e16c7
movzx eax, byte [r9 + r10]
inc r10
crc32 r8d, eax
cmp r10, r11
jb 0x1400e16b4
vmovups xmm0, xmmword [rbp - 0x40]
mov dword [rbp - 0x30], r8d
vmovsd xmm1, qword [rbp - 0x30]
vmovups xmmword [rbx], xmm0
vmovsd qword [rbx + 0x10], xmm1
cmp rdx, 0xf
jbe 0x1400e170d
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400e1708
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400e1742
call fcn.1401df894
movzx eax, word [rdi + 6]
inc r14d
add rsi, 0x28
cmp r14d, eax
jl 0x1400e1643
lea r11, [rsp + 0x60]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3