joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100401bf0
Capabilities:
Identify system language via api

Disassembly:
mov dword [rsp + 8], ecx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x60
mov qword [rsp + 0x58], 0xfffffffffffffffe
lea rax, [rsp + 0x78]
mov qword [rsp + 0x50], rax
cmp byte [0x10040c988], 0
jne 0x100401c5f
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov ecx, 0x409
cmp ax, cx
je 0x100401c51
mov rcx, rbx
call fcn.100406a80
test rax, rax
cmove rax, rbx
mov rbx, rax
mov qword [0x10040c990], rbx
mov byte [0x10040c988], 1
lea rcx, [0x10040c040]
mov rax, qword [0x10040c040]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov r8d, dword [rsp + 0x70]
mov rdx, qword [0x10040c990]
lea rcx, [rsp + 0x40]
call fcn.100401ef0
test eax, eax
jne 0x100401ceb
mov r8, qword [0x10040c990]
test r8, r8
je 0x100401cbb
mov r8d, dword [rsp + 0x70]
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.100401ef0
test eax, eax
jne 0x100401ceb
mov r8, qword [0x10040c990]
mov edx, dword [rsp + 0x70]
lea rcx, str.Could_not_find_string__d_in_module__p_n
call qword [sym.imp.MSVCR100.dll_wprintf]
mov r8, qword [0x10040c990]
mov edx, dword [rsp + 0x70]
lea rcx, str.Could_not_find_string__d_in_module__p_n
call qword [sym.imp.MSVCR100.dll_wprintf]
mov rbx, qword [rsp + 0x40]
jmp 0x100401d3c
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rbx, qword [rsp + 0x40]
mov rdx, rbx
mov ecx, 0x500
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x100401d3c
mov edx, eax
mov rcx, qword [rsp + 0x48]
call fcn.100401d70
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x100401d58
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
add rsp, 0x60
pop rbx
ret
Function at 0x100402270
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
sub rsp, 0x38
lea rax, [rsp + 0x68]
mov rbx, rcx
lea rdx, [0x100408830]
xor esi, esi
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004023a0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rdi
mov rdi, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x60]
lea rdx, str.ErrorReportingDir
mov rcx, rdi
xor r8d, r8d
mov dword [rsp + 0x58], 0x208
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100402319
mov eax, dword [rsp + 0x60]
cmp eax, 1
je 0x1004022fb
cmp eax, 2
jne 0x100402319
mov edx, dword [rsp + 0x58]
test rbx, rbx
je 0x100402356
test edx, edx
je 0x100402353
test dl, 1
jne 0x100402319
mov eax, edx
shr rax, 1
cmp word [rbx + rax*2 - 2], si
je 0x100402356
lea rdx, [0x100408888]
mov ecx, 0x104
sub rdx, rbx
nop dword [rax + rax]
lea rax, [rcx + 0x7ffffefa]
test rax, rax
je 0x10040237a
movzx eax, word [rdx + rbx]
test ax, ax
je 0x10040237a
mov word [rbx], ax
add rbx, 2
dec rcx
jne 0x100402330
jmp 0x10040237f
mov word [rbx], si
shr edx, 1
mov ecx, 0x104
cmp edx, ecx
jb 0x100402374
mov edx, ecx
lea r8, [0x100408888]
mov rcx, rbx
call fcn.100401010
jmp 0x100402386
mov word [rbx + rdx*2], si
jmp 0x100402386
test rcx, rcx
jne 0x100402383
sub rbx, 2
mov word [rbx], si
test rdi, rdi
je 0x100402394
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x30]
add rsp, 0x38
pop rsi
pop rbx
ret
lea rdx, [0x100408888]
mov ecx, 0x104
sub rdx, rbx
nop
lea rax, [rcx + 0x7ffffefa]
test rax, rax
je 0x1004023df
movzx eax, word [rdx + rbx]
test ax, ax
je 0x1004023df
mov word [rbx], ax
add rbx, 2
dec rcx
jne 0x1004023b0
sub rbx, 2
mov word [rbx], si
add rsp, 0x38
pop rsi
pop rbx
ret
test rcx, rcx
jne 0x1004023e8
sub rbx, 2
mov word [rbx], si
add rsp, 0x38
pop rsi
pop rbx
ret

Function at 0x100402400
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x10040c020]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
call fcn.100402270
lea rdx, [0x1004088b8]
lea rcx, [rsp + 0x20]
mov r9, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x100402484
lea rdx, [0x100408800]
mov ecx, 0x104
sub rdx, rbx
lea rax, [rcx + 0x7ffffefa]
test rax, rax
je 0x100402476
movzx eax, word [rdx + rbx]
test ax, ax
je 0x100402476
mov word [rbx], ax
add rbx, 2
dec rcx
jne 0x100402453
jmp 0x10040247b
test rcx, rcx
jne 0x10040247f
sub rbx, 2
xor eax, eax
mov word [rbx], ax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.100405cd0
add rsp, 0x240
pop rbx
ret
Function at 0x100402b80
Capabilities:
Check os version

Disassembly:
sub rsp, 0x158
mov rax, qword [0x10040c020]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov eax, dword [0x10040c0a8]
test eax, eax
jg 0x100402c42
xor ecx, ecx
or eax, 0xffffffff
lock cmpxchg dword [0x10040c0a8], ecx
jne 0x100402c22
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x114
call sub.MSVCR100.dll_memset
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x100402beb
mov dword [0x10040c0a8], 2
jmp 0x100402c42
cmp dword [rsp + 0x2c], 6
jb 0x100402bdf
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.GetTickCount64
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x10040c998], rax
mov dword [0x10040c0a8], 1
jmp 0x100402c42
mov eax, dword [0x10040c0a8]
test eax, eax
jg 0x100402c42
nop dword [rax]
call qword [sym.imp.KERNEL32.dll_SwitchToThread]
mov r11d, dword [0x10040c0a8]
test r11d, r11d
jle 0x100402c30
mov eax, dword [0x10040c0a8]
cmp eax, 1
jne 0x100402c6b
call qword [0x10040c998]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.100405cd0
add rsp, 0x158
ret
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.100405cd0
add rsp, 0x158
ret

Function at 0x100404060
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rcx
test rcx, rcx
je 0x1004040b4
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x100404070
mov r10d, 0xffffffff
add rax, rax
je 0x1004040b0
lea r11, [0x100408f60]
nop dword [rax]
movzx edx, byte [r9]
mov ecx, r10d
inc r9
xor rdx, rcx
shr ecx, 8
movzx r8d, dl
mov r10d, dword [r11 + r8*4]
xor r10d, ecx
dec rax
jne 0x100404090
mov eax, r10d
ret
xor eax, eax
ret

Function at 0x1004041c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor edi, edi
lea r10, [0x100408800]
mov rbx, rdx
mov dword [rsp + 0x58], 0x208
mov r9d, 0x104
mov r8, rdx
sub r10, rdx
mov dword [rsp + 0x50], edi
nop
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x100404215
movzx eax, word [r10 + r8]
test ax, ax
je 0x100404215
mov word [r8], ax
add r8, 2
dec r9
jne 0x1004041f0
jmp 0x10040421a
test r9, r9
jne 0x10040421e
sub r8, 2
lea rax, [rsp + 0x58]
mov word [r8], di
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
lea rdx, str.SharedCode
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1004042a3
cmp dword [rsp + 0x50], 1
jne 0x100404293
mov ecx, dword [rsp + 0x58]
test cl, 1
jne 0x100404293
cmp ecx, 2
jb 0x100404293
shr rcx, 1
cmp word [rbx + rcx*2 - 2], di
je 0x100404276
cmp rcx, 0x104
jae 0x100404283
mov word [rbx + rcx*2], di
mov eax, edi
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov eax, 0x8007007a
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov eax, 0x8007000b
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
jle 0x1004042ad
movzx eax, ax
or eax, 0x80070000
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x100404df0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rdi, rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov r9d, 0xa0
mov qword [rsp + 0x40], r9
or r8d, 0xffffffff
lea r10, [rcx + 0x18]
mov qword [rsp + 0x30], r10
lea r12, [0x100408f60]
nop word [rax + rax]
mov rax, r9
dec r9
mov qword [rsp + 0x40], r9
test rax, rax
je 0x100404e74
mov ecx, r8d
movzx eax, byte [r10]
xor rcx, rax
movzx edx, cl
mov eax, r8d
shr eax, 8
mov r8d, dword [r12 + rdx*4]
xor r8d, eax
inc r10
mov qword [rsp + 0x30], r10
jmp 0x100404e40
mov dword [rdi + 0xb8], r8d
mov rcx, qword [rdi + 0x38]
call fcn.100404060
mov dword [rdi + 0xc0], eax
mov rcx, qword [rdi + 0x40]
call fcn.100404060
mov dword [rdi + 0xc4], eax
lea rcx, [rdi + 0x1378]
call fcn.100405870
mov esi, eax
mov dword [rsp + 0x20], eax
test eax, eax
jne 0x100404ec1
lea rcx, [rdi + 0x13a0]
call fcn.100405870
mov esi, eax
mov dword [rsp + 0x20], eax
mov rcx, qword [rdi + 0x90]
call fcn.100404060
mov dword [rdi + 0xd4], eax
mov rcx, qword [rdi + 0x98]
call fcn.100404060
mov dword [rdi + 0xd8], eax
mov rcx, qword [rdi + 0x58]
call fcn.100404060
mov dword [rdi + 0xd0], eax
mov rcx, qword [rdi + 0x20]
call fcn.100404060
mov dword [rdi + 0xbc], eax
mov rcx, qword [rdi + 0x48]
call fcn.100404060
mov dword [rdi + 0xc8], eax
mov rcx, qword [rdi + 0x50]
call fcn.100404060
mov dword [rdi + 0xcc], eax
mov rcx, qword [rdi + 0x60]
call fcn.100404060
mov dword [rdi + 0xdc], eax
mov rcx, qword [rdi + 0x68]
call fcn.100404060
mov dword [rdi + 0xe0], eax
lea r15, [rdi + 0x1120]
mov ebx, r14d
mov dword [rsp + 0x24], ebx
mov r9d, 0x220
mov qword [rsp + 0x50], r9
or r8d, 0xffffffff
mov r10, r15
mov qword [rsp + 0x38], r15
nop word [rax + rax]
mov rax, r9
dec r9
mov qword [rsp + 0x50], r9
test rax, rax
je 0x100404fa1
movzx ecx, byte [r10]
mov eax, r8d
xor rcx, rax
movzx edx, cl
shr eax, 8
mov r8d, dword [r12 + rdx*4]
xor r8d, eax
inc r10
mov qword [rsp + 0x38], r10
jmp 0x100404f70
mov eax, dword [r15 + 0x228]
add eax, r8d
add ebx, eax
mov dword [rsp + 0x24], ebx
mov r11d, r14d
mov dword [rsp + 0x28], r14d
nop dword [rax]
cmp r11d, dword [r15 + 0x228]
jae 0x100405032
mov r10d, 0xb3c
mov qword [rsp + 0x48], r10
or r9d, 0xffffffff
mov eax, r11d
imul rax, rax, 0xb3c
add rax, qword [r15 + 0x220]
mov qword [rsp + 0x58], rax
nop
mov rcx, r10
dec r10
mov qword [rsp + 0x48], r10
test rcx, rcx
je 0x100405021
movzx edx, byte [rax]
mov ecx, r9d
xor rdx, rcx
movzx r8d, dl
shr ecx, 8
mov r9d, dword [r12 + r8*4]
xor r9d, ecx
inc rax
mov qword [rsp + 0x58], rax
jmp 0x100404ff0
add ebx, r9d
mov dword [rsp + 0x24], ebx
inc r11d
mov dword [rsp + 0x28], r11d
jmp 0x100404fc0
mov dword [rdi + 0x1350], ebx
mov rcx, qword [rdi + 0x1360]
call fcn.100404060
mov dword [rdi + 0x1368], eax
jmp 0x10040506c
test esi, esi
cmovns esi, r14d
mov eax, esi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret
Function at 0x100405870
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
xor ebx, ebx
mov r11, qword [rcx + 0x18]
lea rdi, [0x100408f60]
mov qword [rsp + 0x30], r11
test r11, r11
je 0x1004058ee
lea r10, [r11 + 0xc]
mov eax, dword [r10]
shl rax, 4
add rax, 0xc
mov qword [rsp + 0x20], rax
or r9d, 0xffffffff
mov qword [rsp + 0x28], r10
nop
mov rcx, rax
dec rax
mov qword [rsp + 0x20], rax
test rcx, rcx
je 0x1004058e5
mov edx, r9d
movzx ecx, byte [r10]
xor rdx, rcx
movzx r8d, dl
mov ecx, r9d
shr ecx, 8
mov r9d, dword [rdi + r8*4]
xor r9d, ecx
inc r10
mov qword [rsp + 0x28], r10
jmp 0x1004058b0
mov dword [r11 + 8], r9d
mov r11, qword [r11]
jmp 0x100405887
jmp 0x100405909
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x100405dab
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x10040c020]
jne 0x100405cea
rol rcx, 0x10
test cx, 0xffff
jne 0x100405ce6
repz ret
ror rcx, 0x10
jmp 0x100405d04
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x10040c1a0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x10040c298]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x100405d89
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x10040c1a0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x100405dab
mov rax, qword [rsp + 0x88]
mov qword [0x10040c298], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x10040c238], rax
mov rax, qword [0x10040c298]
mov qword [0x10040c110], rax
mov rax, qword [rsp + 0x90]
mov qword [0x10040c220], rax
mov dword [0x10040c100], 0xc0000409
mov dword [0x10040c104], 1
mov rax, qword [0x10040c020]
mov qword [rsp + 0x68], rax
mov rax, qword [0x10040c028]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x10040c198], eax
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100408530]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x10040c198], 0
jne 0x100405e32
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140026070
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x14002616e
xchg r8, rbx
mov qword [rsp + 0x10], r8
xchg rbx, r8
mov qword [rsp + 0x18], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
xchg rbx, rdx
mov rdx, rbx
xchg rdx, rbx
xchg r14, rcx
mov rdi, r14
xchg rcx, r14
mov esi, r8d
sub rdi, rdx
mov rbp, rcx
add rdi, 0xf0
dec rsi
shr rsi, 3
shr rsi, 1
inc rsi
nop dword [rax]
xchg rcx, rbx
movups xmm0, xmmword [rcx]
xchg rbx, rcx
xchg rbx, rdx
mov rbx, rbp
xchg rdx, rbx
mov rcx, rbx
call fcn.140026810
mov ecx, 0x7a463e65
sub ecx, 0x38a98a15
add ecx, 0x7b3fcde
add ecx, 0x1fe311dd
xor ecx, 0xebb87cd
sub ecx, 0x678844b6
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140026117
sub rdi, 0x10
xchg rbp, rbx
movups xmmword [rbx + 0xf0], xmm0
xchg rbx, rbp
sub rsi, 1
jne 0x1400260cd
mov rdi, qword [rsp + 0x30]
xchg r9, rbx
mov r9, qword [rsp + 0x38]
xchg rbx, r9
xchg rbp, r12
mov r12, qword [rsp + 0x40]
xchg rbp, r12
add rsp, 0x20
nop
add rsp, 8
mov rsi, qword [rsp - 8]
ret

Function at 0x140026170
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg rbx, r12
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov edi, r8d
xchg r12, rbx
mov r12, rdx
xchg rbx, r12
lea r9, [rcx + 0xf0]
xchg rcx, rsi
mov rcx, rsi
xchg rsi, rcx
test r8d, r8d
je 0x140026242
dec rdi
shr rdi, 3
shr rdi, 1
inc rdi
nop dword [rax]
nop word [rax + rax]
xchg rbx, rdx
mov rax, rdx
xchg rdx, rbx
sub r9, rbx
mov edx, 0x39ab8c69
sub edx, 0x10d7e2d2
add edx, 0x86301df
xor edx, 0x5124e2a9
sub edx, 0x2c6efa5c
sub edx, 0x33a34f73
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140026205
xchg rsi, r15
mov rdx, r15
xchg rsi, r15
mov rcx, rbx
call fcn.1400262e0
xchg r9, rbx
mov rbx, r9
xchg rbx, r9
add rbx, 0x10
sub rdi, 1
jne 0x1400261d1
movups xmm0, xmmword [r9]
xchg rbx, r10
mov r10, qword [rsp + 0x30]
xchg r10, rbx
mov rbp, qword [rsp + 0x38]
xchg rsi, r11
movups xmmword [r11 + 0xf0], xmm0
xchg r11, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400279f0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
xchg r9, rdx
mov rbx, r9
xchg r9, rdx
mov r10, rcx
test r8b, 0xf
je 0x140027a2d
xor al, al
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
push rcx
push rbx
push rax
push rdx
push rax
push rcx
push rbx
push rdx
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
ret
xor edx, edx
test r8d, r8d
je 0x140027add
movdqa xmm2, xmmword [rsp]
nop
movdqu xmm1, xmmword [rdx + rbx]
test edx, edx
jne 0x140027a54
movdqu xmm2, xmmword [r10 + 0x200]
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
pxor xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0x1f2e1e4a
xor ecx, 0x9195832
xor ecx, 0x778f0bc2
sub ecx, 0x1654184d
sub ecx, 0x3dee09c0
xor ecx, 0x3e9bcf11
sub ecx, 0x33ede4af
nop dword [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027a96
aesdeclast xmm0, xmmword [r10 + 0x1e0]
pxor xmm0, xmm2
movdqa xmm2, xmm1
xchg r13, rdx
movups xmmword [r13 + r9], xmm0
xchg r13, rdx
nop
add edx, 0x7c44d4b4
sub edx, 0x7c44d4a4
cmp edx, r8d
jb 0x140027a3e
xchg rsi, rbx
mov rsi, qword [rsp + 0x20]
xchg rsi, rbx
mov al, 0x6b
xor al, 0x48
xor al, 0x27
xor al, 0x78
sub al, 0x52
add al, 0x35
add al, 0x16
xor al, 0x49
sub al, 0x3b
add rsp, 0x10
push rax
push rdx
push rbx
push rdx
push rbx
push rcx
xchg qword [rsp + 0x30], rdi
add rsp, 0x38
ret
Function at 0x1400289e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg r8, rdx
mov rbx, rdx
xchg rdx, r8
mov rdi, rdx
xchg rcx, rsi
mov rcx, rsi
xchg rsi, rcx
jne 0x140028a72
nop
mov r8, qword [rbx + 0x10]
xchg rdi, rdx
mov rdi, rdx
xchg rdx, rdi
mov rcx, rsi
call fcn.1400289e0
xchg rcx, r15
mov r15, rbx
xchg rcx, r15
mov edx, 0x5d28bc4f
sub edx, 0xf1dd0a
sub edx, 0x4df694d3
xor edx, 0x3d5aa8ce
sub edx, 0xe52d94e
sub edx, 0x1258448a
sub edx, 0x126fc4b4
mov rbx, qword [rbx]
call fcn.1401fcb00
cmp byte [rbx + 0x19], 0
je 0x140028a19
mov rbx, qword [rsp + 0x30]
xchg r14, rsi
mov r14, qword [rsp + 0x38]
xchg rsi, r14
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140029900
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rbx, rdx
push rdi
sub rsp, 0x20
xchg rcx, r12
mov rdi, r12
xchg r12, rcx
xor ebx, ebx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x14002997f
mov rdx, qword [rdi + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x140029962
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140029a3d
xchg rcx, rbx
mov rbx, r8
xchg rcx, rbx
call fcn.1401fcb00
xchg rbx, rcx
mov qword [rdi + 0x18], rcx
xchg rcx, rbx
mov qword [rdi + 0x20], rbx
xchg r13, rbx
mov qword [rdi + 0x28], r13
xchg r13, rbx
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
xchg r11, rbx
mov qword [rax], r11
xchg rbx, r11
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400299f3
nop dword [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x7cf16971
sub edx, 0x35fc9b42
add edx, 0xfbcbefb
xor edx, 0x7e988c05
add edx, 0x1e0d3254
sub edx, 0x4bf6457
add edx, 0xc9deb50
xor edx, 0x28a1d715
sub edx, 0x66b56d51
call fcn.1401fcb00
xchg r12, rbx
mov rcx, r12
xchg rbx, r12
test rbx, rbx
jne 0x1400299a4
mov rcx, qword [rdi + 8]
mov edx, 0x7eda0c60
xor edx, 0x6684946c
add edx, 0x5e8fb6a6
sub edx, 0x6b56d744
xor edx, 0x724a157a
sub edx, 0x1962fb21
sub edx, 0x449e8d5
sub edx, 0x5c307e06
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
jmp fcn.1401fcb00
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14002cab0
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
xchg r9, rsi
mov qword [rsp + 0x18], r9
xchg r9, rsi
mov qword [rsp + 0x20], rdi
nop
sub rsp, 8
mov qword [rsp], r14
sub rsp, 0x30
xchg rsi, rcx
mov rcx, rsi
xchg rcx, rsi
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x60]
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
mov qword [rsp + 0x40], rbx
sub rcx, 0xffffffffffffff38
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x3d81c567
xor dword [rsp + 0x20], 0x4c9d9fe0
xor dword [rsp + 0x20], 0x4988083d
add dword [rsp + 0x20], 0x2a92dc31
sub dword [rsp + 0x20], 0x57ebf9b5
add dword [rsp + 0x20], 0x635cf552
xor dword [rsp + 0x20], 0x60fc5467
sub dword [rsp + 0x20], 0xe647ee7
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b720
test eax, eax
js 0x14002cb70
cmp qword [rsp + 0x40], rbx
je 0x14002cb70
lea eax, [rbx + 1]
jmp 0x14002ccb9
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0x70], 2
jbe 0x14002cbb9
mov eax, 0x59d5b495
sub eax, 0x2ccdadad
add eax, 0x2983e6f5
sub eax, 0x16bbc930
xor eax, 0x599b657d
sub eax, 0x23f153b1
sub eax, 0x230e190
sub eax, 0x36ea96c8
xor eax, 0x93e75c5
jmp 0x14002ccb9
cmp dword [rcx + 0x74], ebx
jbe 0x14002cbea
mov eax, 0x35ef6778
add eax, 0x1e7d8dc2
xor eax, 0x12b1e51c
sub eax, 0xfbb39e7
xor eax, 0x142e87a7
sub eax, 0xaaf6388
xor eax, 0x185fee13
jmp 0x14002ccb9
cmp byte [rdi + 2], bl
je 0x14002cc1b
mov eax, 0x4c4f2ae2
sub eax, 0x14c77d65
xor eax, 0x3974d6fc
add eax, 0x5c862f22
xor eax, 0x1ea4c836
sub eax, 0x36d6903
xor eax, 0x726ff996
jmp 0x14002ccb9
cmp r14d, 0xa
jb 0x14002cc6c
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002cc6c
mov eax, 0x5e7d2370
sub eax, 0x1f0ba412
xor eax, 0x78f30f40
add eax, 0x365b6dc
xor eax, 0x68954d80
sub eax, 0x1a9eb79d
xor eax, 0x3d9aa218
add eax, 0x25fcec8c
xor eax, 0x6040fe59
jmp 0x14002ccb9
lea rcx, [rsi + 0xb8]
mov edx, 0x4b1ce3a5
sub edx, 0x286dc1b4
add edx, 0x364613bc
xor edx, 0x119b83f7
add edx, 0x2d434c19
sub edx, 0xb3a305d
sub edx, 0x142f2348
sub edx, 0x3892a0ff
add edx, 0x7ae38bca
call fcn.14002c080
jmp 0x14002ccb7
mov eax, ebx
xchg rbx, rcx
mov rcx, qword [rsp + 0x48]
xchg rcx, rbx
xchg rsi, rbp
mov rbp, qword [rsp + 0x50]
xchg rsi, rbp
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x14002daa0
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
xchg rbx, rcx
mov rcx, rbx
xchg rcx, rbx
cmp byte [rcx + 6], 0
je 0x14002daca
xor eax, eax
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rbx
ret
cmp byte [rcx + 1], 0
je 0x14002db09
mov eax, 0x19f8ed0c
xor eax, 0xb6e823e
add eax, 0x37959dd4
xor eax, 0x2a4172aa
sub eax, 0x536ccc11
add eax, 0x2376d3e6
sub eax, 0x3077877e
add rsp, 0x20
push rdx
push rdx
xchg qword [rsp + 0x10], rbx
pop rdx
pop rdx
add rsp, 8
ret
cmp byte [rcx], 0
je 0x14002db47
mov eax, 0x1f475317
xor eax, 0x6bb85bba
xor eax, 0xcf08470
sub eax, 0x279c924b
sub eax, 0x2704675b
xor eax, 0x296e9333
add rsp, 0x20
nop
add rsp, 8
mov rbx, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx + 4], 0
je 0x14002db85
mov eax, 0x33dea94
add eax, 0x50166f58
sub eax, 0x4bd68a5
sub eax, 0x4e068f16
add eax, 0x5cd8a986
sub eax, 0x5d690bb0
add rsp, 0x20
nop
xchg qword [rsp], rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
mov edx, 0x9eb92a5
add edx, 0x555e99b
add edx, 0x250c0993
xor edx, 0x1e15b5fe
sub edx, 0x1f04478d
sub edx, 0xb53e89c
mov ecx, dword [rcx + 0xc]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
int3