joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400026f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401158b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov byte [rsp + 0x30], r8b
mov rdi, rdx
mov r8d, ecx
mov ecx, 0x1fffff
xor edx, edx
mov rsi, r9
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 0x40
mov rdx, rdi
mov rbx, rax
lea rax, [rsp + 0x34]
lea r8d, [r9 - 0x3f]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea r8, [rsp + 0x30]
mov r9d, 1
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsi + 0x18], 0x10
jb 0x140002787
mov rcx, qword [rsi]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsi + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsi + 0x10], 0
mov eax, edi
mov byte [rsi], 0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400104e0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400027c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401158b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov word [rsp + 0x30], r8w
mov rdi, rdx
mov r8d, ecx
mov ecx, 0x1fffff
xor edx, edx
mov rsi, r9
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 0x40
mov rdx, rdi
mov rbx, rax
lea rax, [rsp + 0x34]
lea r8d, [r9 - 0x3e]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea r8, [rsp + 0x30]
mov r9d, 2
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsi + 0x18], 0x10
jb 0x140002858
mov rcx, qword [rsi]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsi + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsi + 0x10], 0
mov eax, edi
mov byte [rsi], 0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400104e0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x140002890
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401158b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x34], r8d
mov rdi, rdx
mov r8d, ecx
mov ecx, 0x1fffff
xor edx, edx
mov rsi, r9
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 0x40
mov rdx, rdi
mov rbx, rax
lea rax, [rsp + 0x30]
lea r8d, [r9 - 0x3c]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea r8, [rsp + 0x34]
mov r9d, 4
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsi + 0x18], 0x10
jb 0x140002927
mov rcx, qword [rsi]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsi + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsi + 0x10], 0
mov eax, edi
mov byte [rsi], 0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400104e0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret

Function at 0x140002960
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1401158b0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, rdx
mov r8d, ecx
xor edx, edx
mov ecx, 0x1fffff
movss dword [rsp + 0x34], xmm2
mov rsi, r9
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 0x40
mov rdx, rdi
mov rbx, rax
lea rax, [rsp + 0x30]
lea r8d, [r9 - 0x3c]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea r8, [rsp + 0x34]
mov r9d, 4
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsi + 0x18], 0x10
jb 0x1400029f8
mov rcx, qword [rsi]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsi + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsi + 0x10], 0
mov eax, edi
mov byte [rsi], 0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400104e0
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x140002a30
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401158b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rdx
mov r8d, ecx
xor edx, edx
mov ecx, 0x1fffff
movsd qword [rsp + 0x38], xmm2
mov rsi, r9
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 0x40
mov rdx, rdi
mov rbx, rax
lea rax, [rsp + 0x30]
lea r8d, [r9 - 0x38]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea r8, [rsp + 0x38]
mov r9d, 8
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsi + 0x18], 0x10
jb 0x140002ac8
mov rcx, qword [rsi]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsi + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsi + 0x10], 0
mov eax, edi
mov byte [rsi], 0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400104e0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140002b00
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401158b0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r8
mov rdi, rdx
mov r8d, ecx
mov ecx, 0x1fffff
xor edx, edx
mov rsi, r9
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r9d, 0x40
mov rdx, rdi
mov rbx, rax
lea rax, [rsp + 0x30]
lea r8d, [r9 - 0x38]
mov rcx, rbx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea r8, [rsp + 0x38]
mov r9d, 8
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsi + 0x18], 0x10
jb 0x140002b97
mov rcx, qword [rsi]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov qword [rsi + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsi + 0x10], 0
mov eax, edi
mov byte [rsi], 0
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400104e0
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000e1a0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x68
mov rax, qword [0x1401158b0]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor edi, edi
mov rbp, rdx
mov rdx, qword [rsp + 0xc0]
mov r15d, r9d
mov r14, r8
mov ebx, ecx
mov qword [rsp + 0x50], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x48], rdi
mov byte [rsp + 0x38], dil
cmp byte [rdx], dil
jne 0x14000e1ee
mov r8d, edi
jmp 0x14000e1fb
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], dil
jne 0x14000e1f2
lea rcx, [rsp + 0x38]
call fcn.14000b7d0
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
cmp qword [rsp + 0x50], 0x10
mov rbx, qword [rsp + 0x48]
mov r8d, 5
lea rcx, [rsp + 0x38]
mov rsi, rax
cmovae rcx, qword [rsp + 0x38]
cmp rbx, r8
mov dword [rsp + 0x30], edi
cmovb r8, rbx
test r8, r8
jne 0x14000e248
mov eax, edi
jmp 0x14000e254
lea rdx, [0x140013314]
call sub.MSVCR110.dll_memcmp
cdqe
test rax, rax
jne 0x14000e266
cmp rbx, 5
jb 0x14000e2a2
mov eax, edi
setne al
test eax, eax
jne 0x14000e2a2
lea rax, [rsp + 0x30]
mov r9d, 0x40
mov r8, r15
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov r9, r15
mov r8, r14
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x50], 0x10
jb 0x14000e2bd
mov rcx, qword [rsp + 0x38]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
mov eax, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400104e0
add rsp, 0x68
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000fa60
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x1401158b0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r13d, r8d
mov rbp, rdx
mov r8d, ecx
mov ecx, 0x1fffff
xor edx, edx
mov rsi, r9
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edi, edi
mov r12b, 1
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x30], rdi
mov ebx, edi
movzx r15d, r12b
movzx r14d, r12b
test rax, rax
je 0x14000fcd2
mov qword [rsp + 0x68], reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x50], bl
cmp byte [rsi], bl
jne 0x14000fade
mov r8d, edi
jmp 0x14000faeb
or r8, 0xffffffffffffffff
inc r8
cmp byte [rsi + r8], bl
jne 0x14000fae2
lea rcx, [rsp + 0x50]
mov rdx, rsi
call fcn.14000b7d0
cmp qword [rsp + 0x68], 0x10
mov rbx, qword [rsp + 0x60]
mov r8d, 4
lea rcx, [rsp + 0x50]
cmovae rcx, qword [rsp + 0x50]
cmp rbx, r8
cmovb r8, rbx
test r8, r8
jne 0x14000fb24
mov eax, edi
jmp 0x14000fb30
lea rdx, [0x14001330c]
call sub.MSVCR110.dll_memcmp
cdqe
test rax, rax
jne 0x14000fb42
cmp rbx, 4
jb 0x14000fba9
mov eax, edi
setne al
test eax, eax
jne 0x14000fba9
mov rsi, r13
mov r13, qword [rsp + 0x38]
nop
mov r9d, 0x3000
mov r8, rsi
xor edx, edx
mov rcx, r13
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
jne 0x14000fb7b
inc edi
cmp edi, 5
jl 0x14000fb50
xor dil, dil
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rsp + 0x68], 0x10
jb 0x14000fb99
mov rcx, qword [rsp + 0x50]
call sub.MSVCR110.dll_void___cdecl_operator_delete_void____ptr64_
test dil, dil
je 0x14000fcd2
xor eax, eax
jmp 0x14000fcd5
test rbp, rbp
jne 0x14000fbb3
mov ebp, 0x7fff
mov rax, r13
mov r13, qword [rsp + 0x38]
mov rsi, rbp
mov qword [rsp + 0x40], rax
nop word [rax + rax]
mov r9d, 0x3000
mov r8, rax
mov rdx, rsi
mov rcx, r13
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
test rax, rax
je 0x14000fc1b
cmp rax, rsi
je 0x14000fc1b
sub rax, rbp
cmp rax, 0x7fffffff
jb 0x14000fb7e
mov rax, rbp
sub rax, rbx
cmp rax, 0x7fffffff
jb 0x14000fb7e
test r14b, r14b
je 0x14000fc65
test r12b, r12b
je 0x14000fcbc
mov rax, qword [rsp + 0x48]
test r15b, r15b
movzx r14d, r14b
cmovne r14d, edi
add rax, 0xffff
movabs rcx, 0x7fffffffffffffff
mov esi, eax
mov qword [rsp + 0x48], rax
add rsi, rbp
cmp rsi, rcx
jae 0x14000fc60
cmp rax, 0x7fffffff
jb 0x14000fcae
xor r12b, r12b
jmp 0x14000fcbc
test r15b, r15b
je 0x14000fcae
test r12b, r12b
mov ecx, 1
movzx r14d, r14b
cmovne r14d, ecx
mov rcx, qword [rsp + 0x30]
mov rsi, rbp
add rcx, 0xffff
mov eax, ecx
mov qword [rsp + 0x30], rcx
sub rsi, rax
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
jae 0x14000fcab
cmp rcx, 0x7fffffff
jb 0x14000fcae
xor r15b, r15b
mov rax, qword [rsp + 0x40]
test r12b, r12b
jne 0x14000fbd0
mov rax, qword [rsp + 0x40]
test r15b, r15b
jne 0x14000fbd0
mov dil, 1
jmp 0x14000fb7e
mov rax, rbx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400104e0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400106b4
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov dword [rax - 0x18], r15d
call qword [sym.imp.MSVCR110.dll___crtGetShowWindowMode]
movzx r14d, ax
mov rcx, qword gs:[0x30]
mov rdx, qword [rcx + 8]
mov esi, r15d
xor eax, eax
lock cmpxchg qword [0x140115f28], rdx
je 0x14001070b
cmp rax, rdx
jne 0x140010709
mov ebx, 1
mov esi, ebx
jmp 0x140010710
jmp 0x1400106ee
mov ebx, 1
mov eax, dword [0x140115f30]
cmp eax, ebx
jne 0x140010728
mov edi, 0x1f
mov ecx, edi
call sub.MSVCR110.dll__amsg_exit
jmp 0x140010764
mov eax, dword [0x140115f30]
test eax, eax
jne 0x140010759
mov dword [0x140115f30], ebx
lea rdx, [0x1400123d8]
lea rcx, [0x1400123b8]
call sub.MSVCR110.dll__initterm_e
test eax, eax
je 0x14001075f
mov eax, 0xff
jmp 0x14001088f
mov dword [0x140115974], ebx
mov edi, 0x1f
mov eax, dword [0x140115f30]
cmp eax, ebx
jne 0x14001078b
lea rdx, [0x1400123b0]
lea rcx, [0x140012358]
call sub.MSVCR110.dll__initterm
mov dword [0x140115f30], 2
test esi, esi
jne 0x140010799
mov rax, r15
xchg qword [0x140115f28], rax
cmp qword [0x140115f38], r15
je 0x1400107c4
lea rcx, [0x140115f38]
call fcn.140010bb0
test eax, eax
je 0x1400107c4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140115f38]
call rax
mov rax, qword [sym.imp.MSVCR110.dll__wcmdln]
mov rcx, qword [rax]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x140010840
cmp word [rcx], r15w
je 0x1400107e7
test edx, edx
jne 0x140010840
movzx eax, word [rcx]
sub ax, bx
cmp ax, di
ja 0x1400107fd
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400107e7
movzx r9d, r14w
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.14000fd00
mov dword [0x140115970], eax
cmp dword [0x140115990], r15d
jne 0x140010829
mov ecx, eax
call qword [sym.imp.MSVCR110.dll_exit]
cmp dword [0x140115974], r15d
jne 0x14001083e
call qword [sym.imp.MSVCR110.dll__cexit]
mov eax, dword [0x140115970]
jmp 0x14001088f
cmp word [rcx], 0x22
jne 0x140010854
mov eax, r15d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400107d7
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140010c30
add rsp, 0x28
jmp 0x1400106b4
Function at 0x121f31cd995
Capabilities:
Parse pe header

Disassembly:
sub dword [rsp + r11*2 + 0xd], ecx
lea r8, [rcx + r8 - 0x7b14b715]
mov edx, r11d
adc rdx, 0xffffffffe9be6581
jbe 0x121f31f434b
xor bp, r10w
sar edx, cl
mov qword [rsp + r11], rdx
movsx eax, dl
not bp
xchg rdx, rax
xor bp, 0x50a4
div eax
xor ax, ax
inc bp
dec byte [rsp + r11*4 + 0x16]
xadd word [rsp + r11*8], ax
xchg al, r11b
rol bp, 1
xchg byte [rsp + rdx - 0x158fe2], cl
mov dword [rsp + r11 - 0x78], edi
xor r10w, bp
bswap rdx
neg al
mov ebx, dword [rsp + rcx - 0x7b14b7f1]
lea rbp, [rsp + rbp + 0x18]
ror r11, cl
sar rcx, 0x77
mov rax, qword [rcx + rbp]
mov qword [r9 + rcx - 4], rax
sal edx, 0x4c
lea r9, [r9 + rcx*2 - 4]
not byte [rsp + r11*2 - 0x1effff]
push r11
neg byte [rsp + rcx + 0x1c]
pop rax
pop r11
pop rdi
pop rbp
jno fcn.121f31faad4
movsx r11d, dx
adc r11, rbp
movsxd rdi, edi
cdq
adc rsi, rdi
add rdx, rsi
jmp rdx

Function at 0x121f31d1f8c
Capabilities:
Manually build aes constants

Disassembly:
inc rbx
mov qword [rsp], 0xb2e950e
shr word [rsp + 1], 1
xor ebp, 0x733ecd23
mov qword [rsp + 8], 0x7923b404
push 0x992c096
dec rdi
lea rsp, [rsp + 0x28]
jne 0x121f321ae20
mov eax, 0x1483730d
movsx edi, ax
pop r8

Function at 0x121f31d43dc
Capabilities:
Parse pe header

Disassembly:
neg bpl
sub bpl, bl
mov qword [rsp + rdx], rbx
sub bl, byte [rsp + rdx*8]
rol bpl, 1
call fcn.121f321d3d6
push 0xffffffffd2b00fbb
mov edx, dword [rsp + 2]
lea rax, [rdx + rdx*8 + 0x7356637]
sub r8, 4
shr qword [rsp], 0xf9
mov r11d, dword [r8 + riz]
jne 0x121f31cd8bc
mov ebp, 0x3a9da43c
bts bp, bp
lea r8, [rbp + r8 - 0x3a9db440]
lea rax, [rbp*4 - 0x3f553b55]
rol eax, 0x8b
mov eax, dword [r8 + rax - 0xcacdd59]
lea rcx, [rbp + rbp - 0x2ddf64cd]
push rbp
xor eax, r10d
mov ebx, ecx
lea rbx, [rcx + rbx*4 - 0x5a446ed1]
movsx edx, bx
dec eax
movsx edi, cl
and word [rsp + rbp*2 - 0x753b6875], di
xor eax, 0x1ebfbaaa
jmp 0x121f32272c9
rol eax, 3
neg eax
rol eax, 1
not di
sal edi, cl
pop r11
push r10
call fcn.121f3202397

Function at 0x121f31d4d48
Capabilities:
Encrypt data using chaskey
Parse pe header

Disassembly:
xor r10, r11
bts rbx, rbx
or ecx, 0xe11ff513
jge 0x121f31e65ff
mov qword [rax + r9 - 0x88a000c], r11
lea r9, [rax + r9 - 0x88a000c]
pop rdi
pop r11
pop rcx
js fcn.121f31faad4

Function at 0x121f31d5c7e
Capabilities:
Manually build aes constants

Disassembly:
xor qword [rsp + rdi*2 - 0x5527a3f8], 0xffffffff993e589d
xor r11b, 0x1c
add r11b, 0x23
xadd bx, dx
neg r11b
rol r11b, 1
xor ebp, 0x3e9d833c
xchg qword [rsp + rdi - 0x2a93d1f8], rdi
xor r10b, r11b
lea r9, [r9 + rdi + 0x66135946]
btr rdi, rdi
shl bl, 0x24
cbw
mov word [r9 + rbx - 0x250a1cf0], r11w
push rbx
pop rax
pop rbp
pop rcx
pop r11
jbe fcn.121f31faad4
Function at 0x121f31d5cd3
Capabilities:
Manually build aes constants

Disassembly:
mov qword [rsp + rdi*2 - 0x177eac40], rbp
xor cx, 0x2234
push rdi
lea rbx, [rax*4 - 0x3269844e]
neg bx
xor r10w, cx
lea rcx, [rsp + rcx + 0x20]
lea r11, [rbp + rbx - 0x4ffb74ec]
neg rbx
mov di, word [rcx + rdi - 0xbbf5620]
sbb rbx, qword [rsp + rax*8 + 0x5df80094]
xchg r11d, ebx
rol byte [rsp + rax + 0xbbf0026], 3
mov word [r9 + rax + 0xbbf000e], di
cdqe
neg word [rsp + rax + 0xbbf0025]
mov ebx, dword [r8 + rax + 0xbbf000a]
jae 0x121f3207b67
mov ebx, 0xb416f1b9
mov edx, ebx
mov dx, word [r9 + riz]
not bl
sub bl, bl
mov ax, word [r9 + riz + 2]
mov r11d, ebx
and dx, ax
not dx
jmp 0x121f321addb
xadd rbp, r11
lea r8, [rax + r8 + 0xbbf000a]
seta bpl
bts r11, r11
shr dword [rsp + rax*8 + 0x5df80091], 0x5e
xor ebx, r10d
neg ebx
bts bp, ax
add byte [rsp + rax + 0xbbf002a], r11b
or ax, 0x2834
lea ebx, [rax + rbx + 0x11cb34a7]
mul al
not ebx
xor ebx, 0x58b8b881
mov qword [rsp + rax + 0xbbf1788], r10
sar eax, 0x2b
movzx edi, bp
xor dword [rsp + rbp - 0x6165d0e9], ebx
movsx r10d, r11b
mov r10, qword [rsp + rbp - 0x6165d0e9]
bswap r11d
movsxd rbx, ebx
cbw
add rsi, rbx
xadd qword [rsp + r11 - 0x10560100], r11
movsx ecx, r11w
mov bx, word [r9 + r11 - 0xbbf5622]
mov ax, word [rbp + r9 - 0x6165d101]
sets byte [rsp + r11*4 - 0x2efd586b]
not bx
not ax
jnp 0x121f31fbe6d
mov word [r9 + riz + 2], dx
mov edi, dword [r8 + riz - 4]
movsx eax, bl
bts r11d, 0x20
lea r8, [r8 + rax*2 - 4]
mov ebp, r11d
mov edx, eax
xor edi, r10d
mov ecx, eax
sub bl, 0xbf
neg edi
call fcn.121f31fef61
Function at 0x121f31e94c7
Capabilities:
Encrypt data using chaskey
Parse pe header

Disassembly:
sub rbx, r11
sbb ebp, dword [rsp + rcx + 0xa]
mov word [rcx + r9 - 1], dx
or r11w, 0x2530
not rcx
lea r8, [rcx + r8 - 2]
mov r11d, dword [r8 + rcx*4 + 8]
sub bl, bpl
lea rdi, [rbx + rcx*8 - 0x717512e0]
xor r11d, r10d
xor rdi, qword [rsp + rcx + 0xa]
mov edx, 0x96a54831
lea r11d, [r11 + rcx - 0xc30d339]
xor dl, bh
ror r11d, 3
pop rbx
btr edi, 0xaf
shl dl, 0x22
neg r11d
add ecx, 0xb7bdbd3a
xchg word [rsp + rdi - 0x63541fbe], bp
rol r11d, 3
lea rbp, [rbp*2 - 0x467104f2]
mov ax, word [rdx + r8 - 6]
mov qword [rsp + rdx*4], rdx
lea r8, [r8 + rdx*2 - 6]
rol rcx, cl
xor ax, r10w
xor bl, 0x9f
add bx, di
xor ax, cx
lea rbx, [rbx + rcx*2 + 0x7acfb30]
sar ecx, 0x21
adc ax, dx
rol rdi, cl
rol dl, 0xe1
jae 0x121f3212789
bswap r11d
lea r11d, [r11 + rcx - 0x1f1a80ca]
dec cl
ror bl, 0xe6
movsx ebp, dx
not r11d
mul ax
adc dx, bx
sbb r11d, 0xf08eb189
mul rcx
add rdx, 0xffffffffd5b6b632
xadd rcx, rbx
rol r11d, 2
sal rcx, 0x34
sbb cx, bx
push r10
movsx edi, dl
idiv rcx
xor dword [rsp + rbx*4 - 0x60], r11d
imul dil
jb 0x121f321e78a
mov ecx, 0x5126198b
movzx ebp, cx
call fcn.121f3206295
pop r10
movsxd rbp, ebp
or ax, 0x801
rol rax, cl
ror rdi, cl
add rsi, rbp
add dil, al
jmp rsi
movsx ebx, bpl
sub ebp, ecx
bts rcx, rcx
lea r9, [r9 + rcx*2 - 4]
jae 0x121f31e1451
mov r11d, 0x80b6e515
movsx edx, r11w
sub r8, 4
movzx eax, r11w
mov r11d, dword [rax + r8 - 0xe515]
call fcn.121f31f0b7d
or edx, dword [r8 + rdx*2 - 5]
xchg qword [rsp + 8], rax
add rax, 0x14de5
jmp rax
inc ecx
jle 0x121f31ec8dd
xor r10w, ax
movzx ebp, cl
pop rbx
add rax, rsp
dec r11
shl edx, 0xb1
mov edi, dword [rax + rdx]
xor ecx, edx
mov dword [r9 + rdx*2], edi
shr rbp, 0xbd
shl r11, 0xac
xchg ebx, r11d
or rdx, rsi
jmp rdx
rol ax, 1
dec qword [rsp + rdx]
xadd dword [rsp + rdx + 1], r11d
sbb ax, 0xf8b0
jmp 0x121f3211f29

Function at 0x121f31f371d
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
pop r10
movsxd rbx, ebx
and dil, bpl
imul rbp
sar rbp, 0x26
adc rsi, rbx
bswap eax
xchg rbp, rdx
mov ebx, 0x68174530
mov rdi, qword [r9 + rdx*2]
sub bp, bx
cwd
js 0x121f32005bd
add r11d, 0xd20cedb7
mov qword [rax + r9 - 0x908d7ce], rdi
lea r9, [rax + r9 - 0x908d7ce]
pop r11
pop rcx
pop rax
pop rdi
jl fcn.121f31faad4
call fcn.121f31ea46d
mov eax, 0xeebfe68c
call fcn.121f31dafd8
mov qword [r9 + rcx*4 - 0x1a4c8], rax
xadd rdx, rbx
mov ebx, dword [r8 + rcx*2 - 0xd268]
mov eax, 0x3b34888d
xor ebx, r10d
xchg r11b, al
cbw
dec ebx
cbw
btc rcx, rcx
rol ebx, 1
bswap r11d
xchg rbp, rdx
and ax, 0x6916
neg ebx
mov edi, 0x78a0e0b0
lea ebx, [rbx + r11 - 0x39496351]
div al
push r10
rol bp, 0xe4
xor dword [rsp + rdi - 0x78a0e0b0], ebx
movzx r10d, bp
neg ax
js 0x121f31cde98
lea r9, [r9 + rdx*4 - 0x3fff4]
movzx ebx, word [rdx + r8 - 0x10005]
dec ebp
lea r8, [r8 + rbp*2 - 0x175a6]
imul cl
xor bx, r10w
neg bx
not rax
imul r11d, ebp
ror bx, 1
shl bpl, 0xc1
add bx, dx
xor bx, 0x641e
xor r10w, bx
sal r11d, 0x99
ror r11, cl
cqo
adc rbx, rsp
add bpl, 8
add r11, 0xffffffffc801c6aa
mov qword [rbx + rdx + 1], rdi
xor bp, cx
lea rdi, [rbp + rcx + 0x89a84ae]
mul eax
jmp rsi
Function at 0x121f31f5f20
Capabilities:
Authenticate hmac
Encrypt data using chaskey
Execute anti-debugging instructions
Parse pe header

Disassembly:
xor r10b, cl
xadd r11b, al
and edx, edi
dec word [rsp + r11 - 0x1b7]
lea rcx, [rsp + rcx + 0x20]
movzx di, byte [rcx + r11*4 - 0x73c]
mov word [r9 + r11 - 0x1d3], di
lea r9, [r9 + r11 - 0x1d3]
lea rdi, [rbp + rbp*4 + 0x32a43624]
mul r11d
pop rbx
pop rdx
pop rax
pop rbp
jo fcn.121f31faad4

Function at 0x121f321212f
Capabilities:
Parse pe header

Disassembly:
pop rdx
ror word [rsp + rdi + 4], 4
xor r10b, bl
lea rbx, [rsp + rbx + 0x10]
movzx edx, r11b
ror bp, 0x4d
mov qword [rdi + rbx], rax
shl word [rsp + rdx - 0x4e], 0x64
movzx ecx, byte [rsp + rdi + 0xa]
lea r8, [rbp + r8 - 0x60a0dc0d]
movsx ebx, byte [rsp + rbp - 0x60a0dc07]
sar qword [rsp + rdi*8], 0x7b
bt edi, 0x8b
mov edx, dword [r8 + rdi*2]
xor edx, r10d
xor edx, 0x322ef63a
bt rbp, 0x19
inc edx
not r11
xor edx, 0x7ab9551f
movsx eax, bp
shr byte [rsp + rdi + 0xb], 0x47
adc edx, edi
not rbx
mov qword [rsp + rdi*2 + 8], r10
sar word [rsp + rdi + 1], 0x4e
sal qword [rsp + rdi], 0x6e
rol al, 0xe1
xor dword [rsp + rdi + 8], edx
ror rbp, 0x23
mov r10, qword [rsp + rdi*4 + 8]
movsxd rdx, edx

Function at 0x121f3214fed
Capabilities:
Manually build aes constants

Disassembly:
call fcn.121f31f9b16
jle 0x121f3228ee6
xor ax, r10w
not ax
sar ebx, 0x39
sal ebx, 0x52
adc edi, edi
adc ax, r11w
btr rdi, 0x9c
not ax
cmovae r11, rdx
shl dl, 6
sar dl, 0x63
rol ax, 1
sal ebp, 0x50
rol r11w, 0x2e
xadd dx, r11w
xor r10w, ax
btr rbx, rdx
movsx ecx, bx
bts ebx, 0x3d
adc rax, rsp
mov rbp, qword [r11 + rax - 0x18eff8]
shl ecx, 0xac
adc di, cx
xor dil, 2
mov qword [r9 + r11 - 0x18eff8], rbp
mov eax, dword [r8 + r11*4 - 0x63bfe8]
lea r8, [r8 + r11*4 - 0x63bfe8]
xor eax, r10d
movzx ebp, bx
ror di, 7
xadd r11d, ebx
lea eax, [rax + r11 - 0x58d54a86]
not bx
xor r11b, cl
xadd rdi, rbp
ror eax, 2
not eax
imul dx, dx
jo 0x121f321bc36
mov edi, 0xbd9905bb
call fcn.121f31d3c41
add rax, rdx
call fcn.121f31df78d
not rcx
xor edx, r10d
sub edx, 0x1787332b
sal qword [rsp + 8], 0x57
xor rbp, rcx
mov eax, dword [rsp + 0xc]
ror edx, cl
and cl, r11b
neg edx
pop rbx
add rbx, 0xffffffffffffdea4
jmp rbx
inc rax
call fcn.121f31eb759