joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1426d60c0
Capabilities:
Terminate process

Disassembly:
xlatb
add al, 0xc8
mov edx, 0xf3873d1f
add eax, 0x4b80812f
xor byte [rax - 0x5a], al
mov ebp, 0xaf740c2
mov eax, dword [rsi + 0x3f3c3d0b]
ja 0x141c43245
lea edx, [rcx + rax*8]
fbld tbyte [rax + 0x42]
cmpxchg dword [r12], ecx
je 0x141c43280
out dx, eax
xchg r8, rax
loopne 0x141c432b9
invalid
stc
and esi, dword [rdi]
retf 0x1686
shl byte [0x1be1e3f87], 1
sbb bh, byte [rdi + 0x1775e73d]
adc byte [rcx], al
sbb dword [rax + 0x84581], edx
or ah, cl
invalid
je 0x141c43264
insd dword [rdi], dx
test byte [rbp - 0x77], cl
invalid
cld
pop r11
jmp 0x1426d60cd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1426d60dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1426d60c5
lea eax, [rcx + 1]
jmp 0x1426d60eb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1426d60fe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1426d60e4
sub eax, 3
jb 0x1426d611e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1426d616d
sar eax, 1
movsxd rbp, eax
jb 0x1426d6154
jmp 0x1426d612c
add ebx, ebx
jne 0x1426d612a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1426d6154
inc ecx
add ebx, ebx
jne 0x1426d613a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1426d6154
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1426d614d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1426d613c
add ecx, 2
jmp 0x1426d6159
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1426d6082
jmp 0x1426d60cd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x26c2000]
mov eax, dword [rdi]
or eax, eax
je 0x1426d61cd
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x26d6000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1426d617d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1426d61c7
mov qword [rbx], rax
add rbx, 8
jmp 0x1426d619d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1426d6211
cmp al, 0xef
ja 0x1426d61f9
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1426d61d9
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1426d61e8
mov eax, dword [rdi]
add rdi, 4
jmp 0x1426d61e8
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x22f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.1426d6290], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.1426d6290
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1426d6280
sub rsp, 0xffffffffffffff80
jmp 0x141c4321c
Function at 0x14103b058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14103b1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14103b089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14103b06f
add dl, dl
jne 0x14103b096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14103b0f6
xor eax, eax
add dl, dl
jne 0x14103b0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14103b1ad
add dl, dl
jne 0x14103b0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14103b0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14103b0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14103b0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14103b0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14103b07e
mov eax, 1
add dl, dl
jne 0x14103b106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14103b113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14103b0fb
sub eax, ebx
mov ebx, 1
jne 0x14103b14c
mov ecx, 1
add dl, dl
jne 0x14103b12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14103b13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14103b123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14103b07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14103b168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14103b175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14103b15d
cmp eax, 0x7d00
jae 0x14103b19b
cmp eax, 0x500
jb 0x14103b196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14103b07e
cmp eax, 0x7f
ja 0x14103b19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14103b07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14103b1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14103b07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14001116d
Capabilities:
Encrypt data using rc4 via systemfunction032

Disassembly:
jmp 0x140012010
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x188
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1a8]
mov rax, qword [0x14001e180]
xor rax, rbp
mov qword [rbp + 0x158], rax
lea rcx, [0x1400230a3]
call fcn.14001139d
nop
mov dword [rbp + 4], 0
mov eax, dword [rbp + 0x190]
mov dword [rbp + 0x28], eax
mov eax, dword [rbp + 0x190]
mov dword [rbp + 0x2c], eax
mov rax, qword [rbp + 0x180]
mov qword [rbp + 0x30], rax
mov eax, dword [rbp + 0x198]
mov dword [rbp + 0x58], eax
mov eax, dword [rbp + 0x198]
mov dword [rbp + 0x5c], eax
mov rax, qword [rbp + 0x188]
mov qword [rbp + 0x60], rax
lea rcx, str.Advapi32
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.SystemFunction032
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbp + 0x88], rax
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x58]
call qword [rbp + 0x88]
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0
je 0x1400120f9
mov edx, dword [rbp + 4]
lea rcx, str.____SystemFunction032_FAILED_With_Error_:_0x_0.8X_n
call fcn.1400111a4
nop
xor eax, eax
jmp 0x1400120fe
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001acc0]
call fcn.140011334
mov rax, rdi
mov rcx, qword [rbp + 0x158]
xor rcx, rbp
call fcn.1400111bd
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret

Function at 0x1400111e0
Capabilities:
Parse pe header

Disassembly:
jmp 0x140011820
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400230a3]
call fcn.14001139d
nop
mov rax, qword [rbp + 0x120]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140011862
xor eax, eax
jmp 0x1400118bb
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x120]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
cmp dword [rax], 0x4550
je 0x14001188b
xor eax, eax
jmp 0x1400118bb
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rbp + 0x120]
add rcx, rax
mov rax, rcx
mov rcx, qword [rbp + 0x128]
mov qword [rcx], rax
mov eax, 1
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140011208
Capabilities:
Terminate process

Disassembly:
jmp 0x140013c30
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x140011299
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014f80
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014fa0
xor al, al
jmp 0x140015021
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014fb3
xor al, al
jmp 0x140015021
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014fdd
xor al, al
jmp 0x140015021
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014ff1
xor al, al
jmp 0x140015021
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015003
xor al, al
jmp 0x140015021
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001501f
xor al, al
jmp 0x140015021
mov al, 1
add rsp, 0x38
ret
Function at 0x1400113e3
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400127d3
mov r10, rcx
nop
mov eax, dword [0x14001e170]
nop
syscall
ret

Function at 0x140012e70
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113c5
movzx eax, al
test eax, eax
jne 0x140012e90
mov ecx, 7
call fcn.14001133e
nop
mov byte [rsp + 0x20], 0
call fcn.140011352
mov byte [rsp + 0x21], al
cmp dword [0x14001e9e8], 1
jne 0x140012eb4
mov ecx, 7
call fcn.14001133e
nop
jmp 0x140012f0c
cmp dword [0x14001e9e8], 0
jne 0x140012f07
mov dword [0x14001e9e8], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.1400111a9
test eax, eax
je 0x140012ee8
mov eax, 0xff
jmp 0x140013011
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.140011348
mov dword [0x14001e9e8], 2
jmp 0x140012f0c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001132a
call fcn.1400112bc
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012f69
mov rcx, qword [rsp + 0x30]
call fcn.140011159
movzx eax, al
test eax, eax
je 0x140012f69
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140024020]
nop
call fcn.1400112f3
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140012f9d
mov rcx, qword [rsp + 0x38]
call fcn.140011159
movzx eax, al
test eax, eax
je 0x140012f9d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011384
nop
call fcn.1400130c0
mov dword [rsp + 0x28], eax
call fcn.140011299
movzx eax, al
test eax, eax
jne 0x140012fbc
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140012fcb
call fcn.14001138e
nop
xor edx, edx
mov cl, 1
call fcn.14001114a
mov eax, dword [rsp + 0x28]
jmp 0x140013011
add rsp, 0x68
ret

Function at 0x140001bf8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c42
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c42
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c42
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c42
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c42
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c44
xor al, al
add rsp, 0x28
ret
Function at 0x1400023a0
Capabilities:
Inspect section memory permissions

Disassembly:
push r15
push r14
mov r14, r8
push r13
mov r13, rdx
push r12
push rbp
push rdi
mov rdi, rcx
mov rcx, rdx
push rsi
mov rsi, r9
push rbx
sub rsp, 0x48
call fcn.140013210
mov rbx, qword [0x140019170]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx]
cmp dword [rax + 0x8a], 0
je 0x140002412
lea rdx, [0x140017090]
mov ecx, 1
call qword [rax + 0x146]
mov r12, rax
test rax, rax
jne 0x140002415
mov rax, qword [rbx]
mov ecx, 1
mov rax, qword [rax + 0x850]
mov edx, dword [rax + 0x68]
call fcn.14000eea0
jmp 0x1400025a5
xor r12d, r12d
xor ebp, ebp
mov r15d, 0x40
mov rax, qword [rdi + 8]
cmp word [rax + 2], bp
jbe 0x1400024e4
movzx edx, bp
mov rcx, qword [rdi]
imul rax, rdx, 0x28
lea rax, [rcx + rax + 0x14]
cmp dword [rax + 0x10], 0
mov qword [rdi + 0x10], rax
jne 0x140002448
inc ebp
jmp 0x14000241d
mov r8d, dword [rax + 0x24]
mov eax, 1
mov ecx, r8d
and ecx, 0xe0000000
je 0x1400024ac
mov eax, 0x10
cmp ecx, 0x20000000
je 0x1400024ac
mov eax, 2
cmp ecx, 0x40000000
je 0x1400024ac
mov eax, 0x20
cmp ecx, 0x60000000
je 0x1400024ac
mov eax, 8
cmp ecx, 0x80000000
je 0x1400024ac
mov eax, pe_nt_image_headers64
cmp ecx, 0xa0000000
je 0x1400024ac
cmp ecx, 0xc0000000
mov eax, 4
cmovne eax, r15d
bt r8d, 0x1a
jae 0x1400024b6
or ah, 2
shl rdx, 4
add rdx, qword [rdi + 0x3c]
mov ecx, 2
mov r9, qword [rdx + 8]
mov dword [rsp + 0x20], eax
mov r8, qword [rdx]
or rdx, 0xffffffffffffffff
call fcn.14000e5f0
test eax, eax
jne 0x140002444
jmp 0x1400025a5
mov r9, qword [rdi + 0x4c]
test r9, r9
jne 0x1400024f2
xor r15d, r15d
jmp 0x140002518
mov dword [rsp + 0x20], 2
mov r8, qword [rdi + 0x44]
or rdx, 0xffffffffffffffff
mov ecx, 2
call fcn.14000e5f0
test eax, eax
jne 0x1400024ed
jmp 0x1400025a5
inc r15d
mov rax, qword [rdi + 8]
mov eax, dword [rax + 0xc]
cmp eax, r15d
jbe 0x140002571
mov ebp, r15d
mov rdx, qword [rdi + 0x20]
imul rbp, rbp, 0x12
lea rcx, [rdx + rbp]
cmp dword [rcx], 0
jne 0x140002546
imul rax, rax, 0x12
mov ecx, dword [rcx + 4]
add rax, rcx
lea rcx, [rdx + rax]
mov r8d, dword [rsp + 0x38]
mov rdx, r13
call fcn.14000e210
test eax, eax
jne 0x140002515
add rbp, qword [rdi + 0x20]
mov rax, qword [rdi + 0x3c]
movzx edx, word [rbp + 0xc]
mov ecx, dword [rbp + 8]
shl rdx, 4
add rcx, qword [rax + rdx - 0x10]
jne 0x1400025a9
mov edx, dword [rsp + 0xb0]
mov ecx, 0x14
call fcn.14000eb70
mov edx, 2
mov r12, rax
mov rcx, rax
call fcn.14000e8f0
mov rcx, r12
mov rdx, r13
call fcn.14000ea20
mov rcx, r12
call fcn.14000ec20
xor eax, eax
jmp 0x14000260d
mov rdx, qword [rdi + 8]
mov r9w, word [rdx + 2]
xor edx, edx
jmp 0x1400025c5
mov r8, qword [rax]
cmp r8, rcx
jbe 0x1400025cd
inc rdx
add rax, 0x10
cmp r9w, dx
ja 0x1400025b6
jmp 0x1400025a5
add r8, qword [rax + 8]
cmp rcx, r8
jae 0x1400025be
imul rdx, rdx, 0x28
mov rax, qword [rdi]
lea rax, [rax + rdx + 0x14]
mov qword [rdi + 0x10], rax
test byte [rax + 0x27], 0x20
je 0x1400025a5
mov r8, rsi
mov rdx, r14
call fcn.140002620
test r12, r12
je 0x140002608
mov rax, qword [rbx]
mov rcx, r12
call qword [rax + 0x14e]
mov eax, 1
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000ba80
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
mov r12, rcx
push rbp
mov rdx, r12
push rdi
push rsi
xor esi, esi
push rbx
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rcx + rax + 0x88]
call 0x140011f40
mov rdx, r12
mov ebx, eax
add rbx, r12
mov ecx, dword [rbx + 0x20]
call 0x140011f40
mov ecx, dword [rbx + 0x24]
mov rdx, r12
mov ebp, eax
call 0x140011f40
mov r15d, dword [rbx + 0x18]
add rbp, r12
mov edi, eax
add rdi, r12
lea r14, [rsi + rsi]
add r14, rdi
cmp r15, rsi
je 0x14000bb41
mov ecx, dword [rbp + rsi*4]
mov rdx, r12
call 0x140011f40
mov r13d, eax
add r13, r12
mov rcx, r13
call fcn.14000c030
cmp eax, 0xa6caa1c5
jne 0x14000bb2d
mov ecx, dword [rbx + 0x1c]
mov rdx, r12
call 0x140011f40
movzx edx, word [r14]
mov eax, eax
add rax, r12
mov ecx, dword [rax + rdx*4]
add rsp, 0x28
mov rdx, r12
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140011f40
mov rcx, r13
inc rsi
call fcn.14000c030
cmp eax, 0xffe885ef
jne 0x14000bad1
jmp 0x14000bafe
add rsp, 0x28
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
cmp dword [rdx + 0x14], eax
ja 0x140011f8a
mov r9w, word [rcx + 6]
xor ecx, ecx
cmp r9w, cx
je 0x140011f88
mov r8d, dword [rdx + 0xc]
cmp eax, r8d
jb 0x140011f80
mov r10d, dword [rdx + 0x10]
add r10d, r8d
cmp r10d, eax
jbe 0x140011f80
add eax, dword [rdx + 0x14]
sub eax, r8d
ret
inc ecx
add rdx, 0x28
jmp 0x140011f5e
xor eax, eax
ret

Function at 0x14000bbb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [0x140019170]
push r12
xor r8d, r8d
push rbp
push rdi
push rsi
push rbx
mov rbx, qword [rax]
mov rax, qword [rbx + 0x7e0]
test rax, rax
je 0x14000bc65
mov r8d, dword [rbx + 0x796]
test r8d, r8d
jne 0x14000bc65
movsxd rdx, dword [rax + 0x3c]
xor ecx, ecx
mov edx, dword [rax + rdx + 0x88]
add rdx, rax
mov edi, dword [rdx + 0x20]
mov r10d, dword [rdx + 0x1c]
mov esi, dword [rdx + 0x24]
mov ebp, dword [rdx + 0x18]
xor edx, edx
add r10, rax
add rdi, rax
add rsi, rax
cmp ebp, ecx
jbe 0x14000bc5e
mov r9d, dword [rdi + rcx*4]
cmp word [rax + r9], 0x775a
jne 0x14000bc59
test rdx, rdx
movzx r9d, word [rsi + rcx*2]
jne 0x14000bc2f
mov edx, dword [r10 + r9*4]
add rdx, rax
jmp 0x14000bc59
mov r9d, dword [r10 + r9*4]
mov r11, rdx
add r9, rax
mov r12, r9
sub r11, r9
sub r12, rdx
cmp rdx, r9
mov r9d, r12d
cmova r9d, r11d
test r8d, r8d
je 0x14000bc56
cmp r8d, r9d
jbe 0x14000bc59
mov r8d, r9d
inc rcx
jmp 0x14000bc0b
mov dword [rbx + 0x796], r8d
pop rbx
mov eax, r8d
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x14000bfe0
Capabilities:
Hash data using djb2

Disassembly:
xor eax, eax
test rcx, rcx
je 0x14000c02d
mov r10, rcx
mov eax, 0x1505
mov r9b, byte [r10]
test edx, edx
jne 0x14000bffc
test r9b, r9b
jne 0x14000c00f
ret
mov r11, r10
sub r11, rcx
cmp edx, r11d
jbe 0x14000c02d
cmp r9b, 1
adc r10, 0
cmp r9b, 0x60
jbe 0x14000c01e
test r8d, r8d
je 0x14000c01e
sub r9d, 0x20
imul eax, eax, 0x21
movzx r9d, r9b
inc r10
add eax, r9d
jmp 0x14000bfef
ret
Function at 0x14000c030
Capabilities:
Hash data using djb2

Disassembly:
mov eax, 0x1505
movsx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14000c046
imul eax, eax, 0x21
add eax, edx
jmp 0x14000c035
ret

Function at 0x14000d230
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
xor eax, eax
push rbx
mov r8b, byte [rdx + rax]
mov byte [rcx + rax], r8b
mov r8b, byte [rdx + rax + 1]
mov byte [rcx + rax + 1], r8b
mov r8b, byte [rdx + rax + 2]
mov byte [rcx + rax + 2], r8b
mov r8b, byte [rdx + rax + 3]
mov byte [rcx + rax + 3], r8b
add rax, 4
cmp rax, 0x20
jne 0x14000d234
mov r11d, 8
lea r10, str.cw
lea rbx, [0x1400191c0]
mov esi, r11d
movzx r9d, byte [rcx + 0x1c]
movzx r8d, byte [rcx + 0x1d]
movzx edx, byte [rcx + 0x1e]
movzx eax, byte [rcx + 0x1f]
and esi, 7
jne 0x14000d2b2
mov sil, byte [r10 + r8]
mov r8b, byte [r10 + rdx]
mov dl, byte [r10 + rax]
mov al, byte [r10 + r9]
mov r9d, r11d
shr r9d, 3
xor sil, byte [rbx + r9]
mov r9d, esi
jmp 0x14000d2c7
cmp esi, 4
jne 0x14000d2c7
mov r9b, byte [r10 + r9]
mov r8b, byte [r10 + r8]
mov dl, byte [r10 + rdx]
mov al, byte [r10 + rax]
xor r9b, byte [rcx]
xor r8b, byte [rcx + 1]
inc r11d
add rcx, 4
xor dl, byte [rcx - 2]
xor al, byte [rcx - 1]
mov byte [rcx + 0x1c], r9b
mov byte [rcx + 0x1d], r8b
mov byte [rcx + 0x1e], dl
mov byte [rcx + 0x1f], al
cmp r11d, 0x3c
jne 0x14000d278
pop rbx
pop rsi
ret

Function at 0x14000d7e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
test rcx, rcx
je 0x14000d816
mov esi, edx
test edx, edx
jne 0x14000d81d
xor eax, eax
jmp 0x14000d90a
movsxd rax, dword [rcx + 0x3c]
mov r12, rcx
xor ebx, ebx
add rax, rcx
mov r9d, dword [rax + 0x88]
mov eax, dword [rax + 0x8c]
lea r15, [rcx + r9]
mov dword [rsp + 0x28], eax
mov eax, dword [r15 + 0x18]
mov r14d, dword [r15 + 0x20]
mov ebp, dword [r15 + 0x1c]
mov r13d, dword [r15 + 0x24]
mov dword [rsp + 0x2c], eax
add r14, rcx
cmp dword [rsp + 0x2c], ebx
jbe 0x14000d816
mov edi, dword [r14 + rbx*4]
mov r8d, 1
xor edx, edx
add rdi, r12
mov rcx, rdi
call fcn.14000bfe0
mov r8d, eax
lea rax, [rbx + 1]
cmp r8d, esi
jne 0x14000d902
add rbx, rbx
add rbx, r12
movzx eax, word [rbx + r13]
lea rax, [r12 + rax*4]
mov eax, dword [rax + rbp]
add rax, r12
mov qword [rsp + 0x38], rax
cmp rax, r15
jae 0x14000d8a8
mov rax, qword [rsp + 0x38]
jmp 0x14000d90a
mov esi, dword [rsp + 0x28]
add rsi, r12
add rsi, r15
cmp rax, rsi
jae 0x14000d8a1
call fcn.140013210
mov qword [rsp + 0x48], rdi
mov word [rsp + 0x40], ax
inc eax
mov word [rsp + 0x42], ax
mov rax, qword [0x140019170]
mov rax, qword [rax]
mov rax, qword [rax + 0xce]
test rax, rax
je 0x14000d816
xor r8d, r8d
lea rdx, [rsp + 0x40]
lea r9, [rsp + 0x38]
mov rcx, r12
call rax
test eax, eax
jns 0x14000d8a1
jmp 0x14000d816
mov rbx, rax
jmp 0x14000d855
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140011f40
Capabilities:
Enumerate pe sections

Disassembly:
push r15
push r14
push r13
push r12
mov r12, rcx
push rbp
mov rdx, r12
push rdi
push rsi
xor esi, esi
push rbx
sub rsp, 0x28
movsxd rax, dword [rcx + 0x3c]
mov ecx, dword [rcx + rax + 0x88]
call 0x140011f40
mov rdx, r12
mov ebx, eax
add rbx, r12
mov ecx, dword [rbx + 0x20]
call 0x140011f40
mov ecx, dword [rbx + 0x24]
mov rdx, r12
mov ebp, eax
call 0x140011f40
mov r15d, dword [rbx + 0x18]
add rbp, r12
mov edi, eax
add rdi, r12
lea r14, [rsi + rsi]
add r14, rdi
cmp r15, rsi
je 0x14000bb41
mov ecx, dword [rbp + rsi*4]
mov rdx, r12
call 0x140011f40
mov r13d, eax
add r13, r12
mov rcx, r13
call fcn.14000c030
cmp eax, 0xa6caa1c5
jne 0x14000bb2d
mov ecx, dword [rbx + 0x1c]
mov rdx, r12
call 0x140011f40
movzx edx, word [r14]
mov eax, eax
add rax, r12
mov ecx, dword [rax + rdx*4]
add rsp, 0x28
mov rdx, r12
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp 0x140011f40
mov rcx, r13
inc rsi
call fcn.14000c030
cmp eax, 0xffe885ef
jne 0x14000bad1
jmp 0x14000bafe
add rsp, 0x28
xor eax, eax
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
cmp dword [rdx + 0x14], eax
ja 0x140011f8a
mov r9w, word [rcx + 6]
xor ecx, ecx
cmp r9w, cx
je 0x140011f88
mov r8d, dword [rdx + 0xc]
cmp eax, r8d
jb 0x140011f80
mov r10d, dword [rdx + 0x10]
add r10d, r8d
cmp r10d, eax
jbe 0x140011f80
add eax, dword [rdx + 0x14]
sub eax, r8d
ret
inc ecx
add rdx, 0x28
jmp 0x140011f5e
xor eax, eax
ret