joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bbb90
Capabilities:
Encode data using xor

Disassembly:
neg rsp
sub rsp, 0xfffffffffffffff0
neg rsp
xchg r10, r11
mov qword [rsp], r11
xchg r10, r11
mov qword [rsp + 8], r11
xor r11, r11
lea r10, [rsp + 0x18]
mov rdx, rdx
sub r10, rax
cmovb r10, r11
mov r11, qword gs:[0x10]
cmp r10, r11
mov dword [rsp - 0x28], edx
bnd jae 0x1400bbbf4
and r10w, 0xf000
lea r11, [r11 - 0x1000]
mov byte [r11], 0x7e
xor byte [r11], 0x1b
xor byte [r11], 0x29
sub byte [r11], 0x4c
cmp r10, r11
bnd jne 0x1400bbbd4
xchg rsp, rsp
xchg r10, r15
mov r15, qword [rsp]
xchg r15, r10
mov r11, qword [rsp + 8]
mov dword [rsp - 0x10], edi
sub rsp, 0xfffffffffffffff0
bnd ret
Function at 0x140489b28
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov r9, r9
mov qword [r11 + 8], rbx
xchg r12, rsi
mov qword [r11 + 0x18], r12
xchg r12, rsi
xchg rdi, r13
mov qword [r11 + 0x20], r13
xchg rdi, r13
push rdx
mov qword [rsp], r14
add rsp, 0xffffffffffffffc0
xchg r15, r15
mov rdx, qword [0x1404d04e8]
mov rbx, rcx
movabs rcx, 0x7c1617f5104bf89d
add rcx, 0x1c6b561
add rcx, 0x30773e10
add rcx, 0x7fffffff
add rcx, 0x36666c79
mov dword [rsp + 0x58], 0x835ac4a
add dword [rsp + 0x58], 0x13821897
add dword [rsp + 0x58], 0x1acf21b7
xor dword [rsp + 0x58], 0xfb50997
xor dword [rsp + 0x58], 0x3933ef1f
add rdx, rcx
movabs rax, 0x1456f5755ef865e0
sub rax, 0x567bb5f3
xor rax, 0x6116de55
sub rax, 0x5aa4fe81
add rax, 0x5aa18e73
not rdx
mov rsp, rsp
lea rcx, [r11 - 0x28]
ror rdx, 0x18
ror rdx, 8
ror rdx, 3
ror rdx, 4
ror rdx, 3
ror rdx, 1
add rdx, rax
movabs rax, 0x45d337819667e53
add rax, 0x4ca1005
add rax, 0x407f9
add rax, 0x3e336916
rol rdx, 4
rol rdx, 0x11
rol rdx, 3
rol rdx, 9
rol rdx, 1
rol rdx, 4
add rax, rdx
mov dword [rsp - 0x40], 0x1df7ddc4
lea rdx, [r11 + 0x10]
call rax
lea rdi, [rbx + 8]
xorps xmm0, xmm0
mov dword [rsp - 0x18], 0x50168f0b
xchg r12, rdi
mov qword [rbx], r12
xchg r12, rdi
xor esi, esi
xchg rsi, rsi
xchg r15, rdi
movups xmmword [r15], xmm0
xchg rdi, r15
xchg rbp, rdi
movups xmmword [rbp + 0x10], xmm0
xchg rbp, rdi
xchg rdi, rsp
movups xmmword [rsp + 0x20], xmm0
xchg rdi, rsp
test eax, eax
jne 0x140489c8d
mov r13, r13
xchg r10, rsi
mov qword [rbx + 0x38], r10
xchg rsi, r10
jmp 0x140489daf
lea rax, [rsp + 0x20]
mov dword [rsp - 0x1c], 0xed84fd7
or r14, 0xffffffffffffffff
inc r14
cmp word [rax + r14*2], si
mov dword [rsp - 0x18], ebx
jne 0x140489c9e
mov qword [rbx + 0x38], r14
cmp qword [rbx], rdi
je 0x140489ccd
mov dword [rsp - 0x28], 0x1b7e493e
mov rcx, qword [rbx]
call fcn.1400bb460
cmp r14, 0x18
jbe 0x140489d04
mov dword [rsp - 0x20], ebp
lea rcx, [r14 + r14]
call fcn.1400bb6f0
mov qword [rbx], rax
test rax, rax
xchg rsi, rsi
jne 0x140489d0a
mov qword [rbx], rdi
xchg rbp, rsi
mov rcx, rbp
xchg rbp, rsi
jmp 0x140489d2e
mov qword [rbx], rdi
mov rax, rdi
xorps xmm0, xmm0
mov dword [rsp - 0x3c], 0x7d7e7146
movups xmmword [rax], xmm0
xchg r15, rax
movups xmmword [r15 + 0x10], xmm0
xchg r15, rax
movups xmmword [rax + 0x20], xmm0
xchg rcx, rdx
mov rdx, qword [rbx]
xchg rdx, rcx
mov edx, 0x32f07cb3
add edx, 0x28c0f85e
sub edx, 0x478ac1ca
sub edx, 0x107f362d
cmp qword [rbx + 0x38], rsi
mov r10, r10
jbe 0x140489daf
lea r8, [rsp + 0x20]
sub r8, rcx
mov r8, r8
movzx eax, dx
mov r9d, 0x11fae717
add r9d, 0x167f5304
add r9d, 0x4e1f4cd1
sub r9d, 0x769985ed
and ax, r9w
mov dword [rsp - 0x44], edi
ror edx, 5
ror edx, 2
ror edx, 1
xor ax, word [r8 + rcx]
xchg r8, r8
inc rsi
mov word [rcx], ax
lea rcx, [rcx + 2]
cmp rsi, qword [rbx + 0x38]
mov dword [rsp - 0x18], 0x41e86f98
jb 0x140489d5d
xchg rdx, rsi
mov rdx, qword [rsp + 0x60]
xchg rsi, rdx
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
mov rbx, qword [rsp + 0x50]
mov rdi, rdi
xchg rdi, r13
mov r13, qword [rsp + 0x68]
xchg r13, rdi
neg rsp
add rsp, 0xffffffffffffffc0
neg rsp
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x1404a5874
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rsi, rbx
mov qword [rsp + 0x10], rsi
push rdi
mov dword [rsp - 0x3c], esi
nop
sub rsp, 0x42fd7b3d
add rsp, 0x42fd7b0d
xchg rsi, r13
mov r13, r8
xchg rsi, r13
mov bl, dl
xor edx, edx
mov r8, r8
mov r8d, 0x5dc011fe
xor r8d, 0x4acab2a
xor r8d, 0x3ac19d97
sub r8d, 0x63ad25ab
mov rdi, rcx
xchg r8, r8
call fcn.1400bb9f0
and qword [rdi + 0x198], 0
or r8, 0xffffffffffffffff
xchg rbx, rbx
and qword [rdi + 0x1a0], 0
xchg r13, r8
mov qword [rdi + 0x1a8], r13
xchg r13, r8
xor edx, edx
mov byte [rdi + 0x1b0], bl
mov ecx, edx
mov dword [rsp - 0x1c], ebx
mov eax, 0xc2aa9e8
xor eax, 0x534034fd
xor eax, 0x45e94bfc
xor eax, 0x76e4b671
sub eax, 0x39fd5466
rol eax, cl
mov byte [rdx + rdi + 0x1b1], al
mov dword [rsp - 0x1c], ebp
inc rdx
cmp rdx, 0x20
jb 0x1404a58fa
mov dword [rsp - 0x10], ebx
xchg rsi, rbp
movups xmm0, xmmword [rbp]
xchg rsi, rbp
lea rcx, [rdi + 0x200]
xchg r11, r11
mov byte [rsp + 0x20], 0x77
sub byte [rsp + 0x20], 0x27
xor byte [rsp + 0x20], 0x39
sub byte [rsp + 0x20], 0x69
mov r9d, 0x3d445a42
sub r9d, 0x244015d9
add r9d, 0x4675bcf2
sub r9d, 0x5f7a015a
mov edx, 0x65192f26
sub edx, 0x43fb86e3
xor edx, 0x78fbd720
sub edx, 0x10320de9
xor edx, 0x49ab7179
xchg rdi, r12
movups xmmword [r12 + 0x1d1], xmm0
xchg rdi, r12
movups xmm1, xmmword [rsi + 0x10]
xchg rdi, r13
movups xmmword [r13 + 0x1e1], xmm1
xchg r13, rdi
and qword [rdi + 0x1f8], 0
xchg rcx, rcx
and qword [rcx], 0
and dword [rdi + 0x20c], 0
mov dword [rdi + 0x208], r8d
mov dword [rsp - 0x3c], ebp
xor r8d, r8d
call fcn.1400953b0
and qword [rdi + 0x210], 0
lea rcx, [rdi + 0x218]
mov r15, r15
call fcn.1404a5b58
mov rbx, qword [rsp + 0x40]
mov rax, rdi
xchg rsi, r8
mov r8, qword [rsp + 0x48]
xchg r8, rsi
nop
add rsp, 0x31ad052c
sub rsp, 0x31ad04fc
pop rdi
mov dword [rsp - 0x24], esi
ret
Function at 0x1404c4f64
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r10, rsi
mov qword [rsp + 0x10], r10
xchg rsi, r10
xchg rdi, rdx
mov qword [rsp + 0x18], rdx
xchg rdx, rdi
push rbp
mov rdi, rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
xchg rdi, rsp
mov rbp, rdi
xchg rsp, rdi
nop
sub rsp, 0x74d30a9
add rsp, 0x74d3039
xchg rdi, r15
mov r15, r8
xchg rdi, r15
xchg rdx, r14
mov rdx, r14
xchg r14, rdx
xchg r15, rcx
mov rsi, r15
xchg rcx, r15
movabs r12, 0x338a17a74b77cca6
sub r12, 0xaa93aef
sub r12, 0x3bdf2724
xor r12, 0x2f012b82
cmp r9d, 0x60001
jne 0x1404c518b
mov dword [rsp - 0x44], edx
mov dword [rbp - 0x40], 0x68934503
sub dword [rbp - 0x40], 0x6702cbc
add dword [rbp - 0x40], 0xe5fd886
add dword [rbp - 0x40], 0x2105eba6
xor edx, edx
mov dword [rbp - 0x3c], 0x583b16c0
sub dword [rbp - 0x3c], 0x127cca36
add dword [rbp - 0x3c], 0x1580c7df
add dword [rbp - 0x3c], 0x18bf055f
add dword [rbp - 0x3c], 0x1ec62c5b
mov dword [rbp - 0x38], 0x45c015c0
add dword [rbp - 0x38], 0x293070be
sub dword [rbp - 0x38], 0x11888fd5
sub dword [rbp - 0x38], 0x225c9c2
mov ecx, edx
mov dword [rsp - 0x18], 0x1d44cbe
mov eax, 0x6e1e4068
sub eax, 0xe1098e7
sub eax, 0xc23ccbb
add eax, 0x21636d6b
xor eax, 0x47274403
rol eax, cl
xchg r13, r13
xor al, byte [rbp + rdx - 0x40]
mov byte [rbp + rdx - 0x34], al
inc rdx
xchg rbx, rbx
cmp rdx, 0xc
jb 0x1404c5056
mov r9d, 0x18c270a8
sub r9d, 0x8efbc6d
sub r9d, 0x21e334b
xor r9d, 0x7a56c57b
sub r9d, 0x77e2358c
mov qword [rsp + 0x20], 0x20c1442a
sub qword [rsp + 0x20], 0x1169f02d
add qword [rsp + 0x20], 0x52afbb49
sub qword [rsp + 0x20], 0x3c48ff93
sub qword [rsp + 0x20], 0x25be0fa7
lea r8, [rbp - 0x34]
xchg rdx, rdi
mov rdi, rdx
xchg rdi, rdx
xchg rbx, r14
mov rcx, rbx
xchg r14, rbx
call fcn.1404c3044
xchg r10, rax
mov rbx, r10
xchg r10, rax
lea rdi, [rbp - 0x34]
mov r8, r8
xor eax, eax
lea ecx, [rax + 0xc]
rep stosb byte [rdi], al
test rbx, rbx
xchg r14, r14
je 0x1404c51d0
lea rdx, [rbp - 0x28]
lea rcx, [rbx + 0xc]
mov rbx, rbx
call fcn.1400ab2dc
test dword [rbp - 7], 0x1000
jne 0x1404c51d0
cmp byte [rbp - 0x1d], 0xe8
xchg r8, r8
jne 0x1404c51d0
lea rdx, [rbx + 0xc]
xchg r14, rcx
mov r14, rcx
xchg r14, rcx
call fcn.1400a1c20
mov dword [rsp - 0x10], 0x3d7a5c2e
movzx edx, byte [rbp - 0x28]
add edx, dword [rbp - 0x13]
add edx, eax
mov dword [rsp - 0x28], ebp
mov rax, qword [rsi + 8]
xor rax, r12
add rdx, rax
mov dword [rsp - 0x14], 0x164b42bb
xor rdx, r12
mov qword [rsi + 0x20], rdx
cmp qword [rsi + 0x20], r12
xchg rdx, rdx
setne al
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
xchg rsi, rbp
mov rbp, qword [r11 + 0x28]
xchg rsi, rbp
xchg r13, rdi
mov r13, qword [r11 + 0x30]
xchg r13, rdi
xchg r11, rsp
mov r11, rsp
xchg rsp, r11
nop
mov r14, qword [rsp]
add rsp, 8
pop r12
nop
mov rbp, qword [rsp]
add rsp, 8
ret
xor al, al
jmp 0x1404c5195
Function at 0x1400113f7
Capabilities:
Terminate process

Disassembly:
jmp 0x14001a230
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400114f1
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001b580
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001b5a0
xor al, al
jmp 0x14001b621
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001b5b3
xor al, al
jmp 0x14001b621
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001b5dd
xor al, al
jmp 0x14001b621
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001b5f1
xor al, al
jmp 0x14001b621
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001b603
xor al, al
jmp 0x14001b621
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001b61f
xor al, al
jmp 0x14001b621
mov al, 1
add rsp, 0x38
ret
Function at 0x2fbac162f
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rdi, rcx
mov esi, edx
mov ecx, 0x40000
xor edx, edx
mov rbp, r8
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov r8d, 0xa
xor edx, edx
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test esi, esi
jle 0x2fbac1699
movsxd r9, esi
mov r8, rax
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rbx, rax
xor eax, eax
mov rdx, rax
and edx, 7
mov dl, byte [rbp + rdx]
xor dl, byte [rdi + rax]
mov byte [rbx + rax], dl
inc rax
cmp esi, eax
jg 0x2fbac1682
call fcn.2fbac1616
mov rcx, rbx
call fcn.2fbac13fa
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 0
lea rcx, [rsp + 0x68]
xor r8d, r8d
mov r9, rax
lea rax, [0x2fbac13db]
mov qword [rsp + 0x50], 0
mov edx, 0x1f03ff
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call fcn.2fbac22f3
nop
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x2fbac1ffb
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp dword [0x2fbb150a0], 0
je 0x2fbac201f
mov r8d, 1
jmp 0x2fbac21eb
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
xor edx, edx
mov rcx, qword [rax + 0x10]
xor eax, eax
mov rbx, qword [rcx + 0x30]
test rbx, rbx
je 0x2fbac2083
movsxd rdx, dword [rbx + 0x3c]
mov edx, dword [rbx + rdx + 0x88]
test edx, edx
je 0x2fbac207b
mov eax, edx
add rax, rbx
mov edx, dword [rax + 0xc]
add rdx, rbx
mov r8d, dword [rdx]
or r8d, 0x20202020
cmp r8d, 0x6c64746e
jne 0x2fbac207b
mov edx, dword [rdx + 4]
or edx, 0x20202020
cmp edx, 0x6c642e6c
je 0x2fbac2092
mov rcx, qword [rcx]
mov rdx, rbx
jmp 0x2fbac2034
xor r8d, r8d
test rax, rax
je 0x2fbac21eb
mov rbx, rdx
mov ebp, dword [rax + 0x1c]
mov edi, dword [rax + 0x24]
xor esi, esi
lea r13, [0x2fbb150a8]
mov edx, dword [rax + 0x18]
mov eax, dword [rax + 0x20]
add rdi, rbx
add rbp, rbx
lea r10d, [rdx - 1]
add rax, rbx
lea r12, [rax + r10*4]
add r10, r10
add r10, rdi
mov ecx, dword [r12]
add rcx, rbx
cmp word [rcx], 0x775a
jne 0x2fbac20fc
call fcn.2fbac1f40
mov r11d, esi
inc esi
shl r11, 4
add r11, r13
mov dword [r11], eax
movzx eax, word [r10]
mov eax, dword [rbp + rax*4]
mov qword [r11 + 8], 0
mov dword [r11 + 4], eax
cmp esi, 0x1f4
je 0x2fbac210e
sub r12, 4
lea rax, [r10 - 2]
cmp rdi, r10
je 0x2fbac210e
mov r10, rax
jmp 0x2fbac20be
mov dword [0x2fbb150a0], esi
lea ebp, [rsi - 1]
lea r10, [0x2fbb150a8]
test ebp, ebp
je 0x2fbac2175
lea rdx, [0x2fbb150a0]
xor ecx, ecx
lea eax, [rcx + 1]
mov r8d, dword [rdx + 0xc]
mov rcx, rax
shl rax, 4
add rax, r10
mov r9d, dword [rax + 4]
cmp r8d, r9d
jbe 0x2fbac2169
mov edi, dword [rdx + 8]
mov r11, qword [rdx + 0x10]
mov r12d, dword [rax]
mov dword [rdx + 0xc], r9d
mov r9, qword [rax + 8]
mov dword [rdx + 8], r12d
mov qword [rdx + 0x10], r9
mov dword [rax], edi
mov dword [rax + 4], r8d
mov qword [rax + 8], r11
add rdx, 0x10
cmp ecx, ebp
jb 0x2fbac212b
dec ebp
jmp 0x2fbac211e
mov eax, dword [0x2fbb150ac]
mov r13d, dword [0x2fbb150bc]
xor edi, edi
lea r15, [0x2fbb11840]
sub r13d, eax
lea r12, [rbx + rax]
mov r14d, edi
cmp r13d, edi
jbe 0x2fbac2014
lea rdx, [r12 + rdi]
mov r8d, 3
mov rcx, r15
inc rdi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x2fbac2192
lea rdi, [0x2fbb150a0]
test r14d, r14d
je 0x2fbac2014
add rdi, 0x10
cmp esi, ebp
je 0x2fbac2014
mov ecx, dword [rdi - 4]
mov r8d, r13d
mov edx, r14d
inc ebp
add rcx, rbx
call fcn.2fbac1f68
mov qword [rdi], rax
jmp 0x2fbac21c7
mov eax, r8d
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x2fbac2db0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.2fbac8c90
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.2fbac8c90
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x2fbac2e20
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x2fbb17084]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x2fbac2fd0
mov rax, qword [0x2fbb17088]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x2fbac2e6c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x2fbac2ef7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x2fbac2e50
mov rcx, r12
call fcn.2fbac36c0
mov rbp, rax
test rax, rax
je 0x2fbac302d
mov rax, qword [0x2fbb17088]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.2fbac37f0
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x2fbb17088]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x2fbac3012
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x2fbac2ef0
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x2fbac2f80
add dword [0x2fbb17084], 1
cmp ebx, 8
jae 0x2fbac2f28
test bl, 4
jne 0x2fbac2fe0
test ebx, ebx
je 0x2fbac2f19
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x2fbac3000
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x2fbac2f19
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x2fbac2f5a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x2fbb17088]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x2fbac2ef0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.2fbac2db0
xor edi, edi
jmp 0x2fbac2e77
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x2fbac2f19
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x2fbac2f19
mov rax, qword [0x2fbb17088]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.2fbac2db0
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.2fbac2db0
nop
nop dword [rax]
Function at 0x2fbac3330
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x2fbb170c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x2fbb170a0]
test rbx, rbx
je 0x2fbac3384
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x2fbac337b
test r12, r12
je 0x2fbac337b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x2fbac3360
lea rcx, [0x2fbb170c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x2fbac36c0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x2fbb12590]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x2fbac3739
mov rcx, r10
call fcn.2fbac3590
test eax, eax
je 0x2fbac3739
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x2fbac3736
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x2fbac372d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x2fbac3739
add r8, 0x28
cmp r8, r9
jne 0x2fbac3718
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x140004ca0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x1401310c8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
movzx r10d, byte [rdx]
mov rdi, rdx
xor ebp, ebp
movzx edx, r10b
add dl, dl
mov rsi, rcx
mov ecx, ebp
test dl, dl
jle 0x140004de4
mov rax, rsi
movzx edx, dl
nop
or rcx, qword [rax]
lea rax, [rax + 8]
sub rdx, 1
jne 0x140004ce0
test rcx, rcx
je 0x140004de4
mov qword [rsp + 0xe0], rbx
movzx ebx, r10b
sub bl, 1
movzx ecx, bl
js 0x140004d29
nop word [rax + rax]
movsx rax, cl
mov rdx, qword [rdi + rax*8 + 8]
mov r8, qword [rsi + rax*8]
cmp rdx, r8
ja 0x140004d4e
jb 0x140004d29
sub cl, 1
jns 0x140004d10
xor eax, eax
mov rbx, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400784c0
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
movsx rax, r10b
movzx ecx, bl
lea r9, [rsi + rax*8]
test bl, bl
js 0x140004d29
nop dword [rax]
movsx rax, cl
mov rdx, qword [rdi + rax*8 + 8]
mov r8, qword [r9 + rax*8]
cmp rdx, r8
ja 0x140004d7b
jb 0x140004d29
sub cl, 1
jns 0x140004d60
jmp 0x140004d29
movzx r8d, r10b
lea rcx, [rsp + 0x60]
mov rdx, r9
call fcn.140003000
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call qword [rdi + 0xb8]
mov r8, rdi
lea rcx, [rsp + 0x20]
mov rdx, rsi
call qword [rdi + 0xb0]
mov r8, rbp
test bl, bl
js 0x140004dd6
movsx rdx, bl
shl rdx, 3
nop dword [rax]
mov rcx, qword [rsp + rdx + 0x20]
xor rcx, qword [rsp + rdx + 0x40]
lea rdx, [rdx - 8]
or r8, rcx
sub bl, 1
jns 0x140004dc0
test r8, r8
sete bpl
mov eax, ebp
jmp 0x140004d2b
xor eax, eax
jmp 0x140004d33
Function at 0x140005840
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x100
mov esi, reloc.WS2_32.dll_recv
lea rbx, [rsp]
mov eax, esi
mov r11, rdx
mov rdi, rcx
mov r10d, 2
nop dword [rax]
nop word [rax + rax]
mov ecx, r10d
lea r8d, [r10 - 2]
movzx r8d, byte [r8 + r11]
lea edx, [r10 - 1]
movzx edx, byte [rdx + r11]
lea rbx, [rbx + 4]
shl r8d, 8
or r8d, edx
movzx edx, byte [rcx + r11]
shl r8d, 8
lea ecx, [r10 + 1]
movzx ecx, byte [rcx + r11]
or r8d, edx
shl r8d, 8
add r10d, 4
or r8d, ecx
mov dword [rbx - 4], r8d
sub rsi, 1
jne 0x140005880
lea r11, [rsp + 0x40]
nop
lea ecx, [rax - 0xf]
mov r9d, dword [rsp + rcx*4]
lea r11, [r11 + 4]
lea ecx, [rax - 2]
mov edx, r9d
mov r8d, dword [rsp + rcx*4]
mov r10d, r8d
rol r10d, 0xf
mov ecx, r8d
rol ecx, 0xd
xor r10d, ecx
rol edx, 0xe
mov ecx, r9d
shr r8d, 0xa
ror ecx, 7
xor r10d, r8d
xor edx, ecx
shr r9d, 3
lea ecx, [rax - 0x10]
xor edx, r9d
add r10d, edx
add r10d, dword [rsp + rcx*4]
lea ecx, [rax - 7]
add r10d, dword [rsp + rcx*4]
inc eax
mov dword [r11 - 4], r10d
cmp eax, 0x40
jb 0x1400058d0
mov r9d, dword [rdi + 0x50]
xor r11d, r11d
mov ebx, dword [rdi + 0x54]
mov esi, dword [rdi + 0x58]
mov r12d, dword [rdi + 0x5c]
mov r10d, dword [rdi + 0x60]
lea r15d, [r11 + 0x40]
mov ebp, dword [rdi + 0x64]
mov r14d, dword [rdi + 0x68]
mov r13d, dword [rdi + 0x6c]
lea rdi, [0x14010c1a0]
nop word [rax + rax]
mov r8d, r10d
lea r11, [r11 + 4]
ror r8d, 0xb
mov eax, r10d
rol eax, 7
mov ecx, r10d
xor r8d, eax
not ecx
and ecx, r14d
mov eax, r10d
ror eax, 6
mov edx, r9d
xor r8d, eax
ror edx, 0xd
mov eax, ebp
and eax, r10d
xor ecx, eax
mov eax, r9d
add r8d, ecx
rol eax, 0xa
add r8d, dword [r11 + rdi - 4]
xor edx, eax
add r8d, dword [rsp + r11 - 4]
mov eax, r9d
ror eax, 2
add r8d, r13d
xor edx, eax
mov ecx, ebx
xor ecx, r9d
mov eax, ebx
and eax, r9d
and ecx, esi
xor ecx, eax
mov r13d, r14d
add edx, ecx
mov r14d, ebp
mov ebp, r10d
lea r10d, [r8 + r12]
mov r12d, esi
mov esi, ebx
mov ebx, r9d
lea r9d, [rdx + r8]
sub r15, 1
jne 0x140005960
mov rdi, qword [rsp + 0x140]
add dword [rdi + 0x54], ebx
add dword [rdi + 0x50], r9d
add dword [rdi + 0x58], esi
add dword [rdi + 0x5c], r12d
add dword [rdi + 0x60], r10d
add dword [rdi + 0x64], ebp
add dword [rdi + 0x68], r14d
add dword [rdi + 0x6c], r13d
mov rbx, qword [rsp + 0x148]
add rsp, 0x100
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret