joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400681a0
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbp, qword [0x1401f7040]
mov rax, qword [rbp]
mov qword [rsp + 0x38], rax
mov eax, dword [rcx]
mov rbx, rcx
mov rsi, rdx
test rdx, rdx
je 0x1400682e8
cmp eax, 1
je 0x14006820d
call fcn.1400670b0
lea r12, [rax + 8]
mov rdi, rax
mov rcx, r12
call fcn.1400669e0
mov r13d, dword [rbx]
test r13d, r13d
je 0x140068230
cmp r13d, 1
jne 0x1400682c0
mov rcx, r12
call fcn.140066cb0
test rdi, rdi
je 0x14006820d
mov rcx, rdi
call fcn.140067450
xor eax, eax
mov rdx, qword [rsp + 0x38]
sub rdx, qword [rbp]
jne 0x14006833b
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rax, [0x140067530]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.1400677d0
mov ecx, dword [0x140125a78]
mov r13, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call r13
test rax, rax
je 0x140068328
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x30], rax
lock or qword [rsp], 0
call fcn.1400677d0
mov ecx, dword [0x140125a78]
call r13
test rax, rax
je 0x140068310
lea rdx, [rsp + 0x20]
mov qword [rax + 0x18], rdx
lock or qword [rsp], 0
call rsi
call fcn.1400677d0
mov ecx, dword [0x140125a78]
call r13
test rax, rax
je 0x1400682f8
mov rdx, qword [rsp + 0x30]
mov qword [rax + 0x18], rdx
mov dword [rbx], 1
jmp 0x1400681f8
mov ecx, 2
call qword [fcn.140064d90]
mov r9d, r13d
mov r8, rbx
lea rdx, str._once__p_is__d_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x1400681f8
mov eax, 0x16
jmp 0x14006820f
call fcn.140067880
test rax, rax
jne 0x1400682a9
jmp 0x1401081de
call fcn.140067880
test rax, rax
jne 0x140068285
jmp 0x1401081cf
call fcn.140067880
test rax, rax
jne 0x14006825f
jmp 0x1401081c5
call fcn.14005c290
nop
nop word cs:[rax + rax]
nop dword [rax]
mov rax, qword [pe_dos_header]
ud2
lea rax, [rsp + 0x20]
mov qword [0], rax
ud2
mov rax, qword [rsp + 0x30]
mov qword [0], rax
ud2

Function at 0x1400685c0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.1400677d0
mov ecx, dword [0x140125a78]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140068638
lea rbp, [rbx + 0x68]
xor r12d, r12d
mov rcx, rbp
call fcn.140066fc0
cmp esi, dword [rbx + 0x48]
jae 0x140068613
mov rax, qword [rbx + 0x58]
cmp byte [rax + rsi], 0
je 0x140068613
mov rax, qword [rbx + 0x50]
mov r12, qword [rax + rsi*8]
mov rcx, rbp
call fcn.140067000
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call fcn.140067880
mov rbx, rax
jmp 0x1400685ed
Function at 0x140068650
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call fcn.1400677d0
mov ecx, dword [0x140125a78]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140068750
lea r13, [rbx + 0x68]
mov rcx, r13
call fcn.140066fc0
cmp esi, dword [rbx + 0x48]
jae 0x1400686d0
mov rdi, qword [rbx + 0x50]
mov qword [rdi + rsi*8], r12
mov rax, qword [rbx + 0x58]
mov rcx, r13
mov byte [rax + rsi], 1
call fcn.140067000
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r15d, [rsi + 1]
mov rcx, qword [rbx + 0x50]
movsxd r14, r15d
lea rdx, [r14*8]
call sub.msvcrt.dll_realloc
mov rdi, rax
test rax, rax
je 0x14006875d
mov rcx, qword [rbx + 0x58]
mov rdx, r14
call sub.msvcrt.dll_realloc
mov r14, rax
test rax, rax
je 0x14006875d
mov eax, dword [rbx + 0x48]
mov edx, r15d
sub edx, eax
lea rcx, [rdi + rax*8]
lea r8, [rdx*8]
xor edx, edx
call sub.msvcrt.dll_memset
mov ecx, dword [rbx + 0x48]
mov r8d, r15d
xor edx, edx
mov rax, rcx
add rcx, r14
sub r8d, eax
call sub.msvcrt.dll_memset
mov qword [rbx + 0x50], rdi
mov qword [rbx + 0x58], r14
mov dword [rbx + 0x48], r15d
jmp 0x14006869f
call fcn.140067880
mov rbx, rax
jmp 0x14006868a
mov rcx, r13
call fcn.140067000
mov eax, 0xc
jmp 0x1400686bd

Function at 0x1400687e0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.1400677d0
mov ecx, dword [0x140125a78]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140068808
mov rax, qword [rax + 0x30]
add rsp, 0x28
ret
call fcn.140067880
test rax, rax
jne 0x1400687fa
add rsp, 0x28
ret

Function at 0x140068870
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.1400677d0
mov ecx, dword [0x140125a78]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140068898
add rax, 0x18
add rsp, 0x28
ret
call fcn.140067880
test rax, rax
jne 0x14006888a
jmp 0x14006888e

Function at 0x1400689b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14021fc48]
test eax, eax
jne 0x1400689c8
xor eax, eax
add rsp, 0x28
ret
call fcn.1400677d0
mov ecx, dword [0x140125a78]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400689f8
mov edx, dword [rax + 0x20]
test edx, edx
jg 0x1400689be
test byte [rax + 0x40], 3
je 0x1400689be
mov eax, dword [rax + 0x44]
and eax, 1
jmp 0x1400689c0
call fcn.140067880
test rax, rax
jne 0x1400689de
jmp 0x1400689be

Function at 0x140068a10
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.1400677d0
mov ecx, dword [0x140125a78]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140068a50
test ebx, ebx
jle 0x140068a40
lock add dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
lock sub dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
call fcn.140067880
test rax, rax
jne 0x140068a2d
add rsp, 0x20
pop rbx
ret
Function at 0x140068b40
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.1400677d0
mov ecx, dword [0x140125a78]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140068bb8
test byte [rbx + 0x40], 0xc
jne 0x140068b6f
mov eax, dword [0x14021fc48]
test eax, eax
jne 0x140068b80
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.1400669e0
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x140068ba3
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x140068ba3
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x140068bcc
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140066cb0
call fcn.140067880
mov rbx, rax
test rax, rax
jne 0x140068b5f
add rsp, 0x28
pop rbx
pop rsi
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x140068bea
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.140066cb0
call fcn.140068a60
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x140068c70
call fcn.140066770
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x140068ca8
call fcn.1400677d0
mov ecx, dword [0x140125a78]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140068d00
test esi, esi
je 0x140068c86
call fcn.140068b40
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140068ce0
mov edx, edi
call fcn.140066840
call fcn.140068b40
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.1400677d0
mov ecx, dword [0x140125a78]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140068cf0
call fcn.140068b40
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140068b40
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.1400677d0
mov ecx, dword [0x140125a78]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140068c45
call fcn.140067880
mov rbx, rax
jmp 0x140068c45
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140068c5e
call fcn.140067880
jmp 0x140068c86
call fcn.140067880
mov rbx, rax
jmp 0x140068c41
Function at 0x140068c00
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.1400677d0
mov ecx, dword [0x140125a78]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140068bb8
test byte [rbx + 0x40], 0xc
jne 0x140068b6f
mov eax, dword [0x14021fc48]
test eax, eax
jne 0x140068b80
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.1400669e0
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x140068ba3
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x140068ba3
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x140068bcc
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140066cb0
call fcn.140067880
mov rbx, rax
test rax, rax
jne 0x140068b5f
add rsp, 0x28
pop rbx
pop rsi
ret
and eax, 0xfffffff3
mov rcx, qword [rbx + 0x30]
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x140068bea
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.140066cb0
call fcn.140068a60
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x140068c70
call fcn.140066770
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x140068ca8
call fcn.1400677d0
mov ecx, dword [0x140125a78]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140068d00
test esi, esi
je 0x140068c86
call fcn.140068b40
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140068ce0
mov edx, edi
call fcn.140066840
call fcn.140068b40
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.1400677d0
mov ecx, dword [0x140125a78]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140068cf0
call fcn.140068b40
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140068b40
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.1400677d0
mov ecx, dword [0x140125a78]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
jne 0x140068c45
call fcn.140067880
mov rbx, rax
jmp 0x140068c45
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140068c5e
call fcn.140067880
jmp 0x140068c86
call fcn.140067880
mov rbx, rax
jmp 0x140068c41

Function at 0x140068d10
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
call fcn.1400677d0
mov ecx, dword [0x140125a78]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x140068d80
test esi, esi
je 0x140068d60
call fcn.140068b40
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140068d90
mov edx, esi
call fcn.140066840
call fcn.140068b40
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140068b40
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140068b40
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140067880
mov rbx, rax
jmp 0x140068d31
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140068d4a
Function at 0x1400ccf20
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sub.msvcrt.dll__fileno_1
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sub.msvcrt.dll__read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x1400ccf68
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x1400ccf3a
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140009444
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, rcx
xor r9d, r9d
movabs rcx, 0xcbf29ce484222325
movzx eax, byte [r9 + rdi + 0x10]
movabs rdx, 0x100000001b3
xor rcx, rax
inc r9
imul rcx, rdx
cmp r9, 4
jb 0x140009469
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1400094c1
cmp qword [rcx + rdx*8], rdi
jne 0x1400094b6
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x1400094ba
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400094ce
cmp qword [rcx + rdx*8], rdi
jne 0x1400094ce
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
lea rcx, [rdi + 0x18]
dec qword [r8 + 0x10]
call fcn.140001fec
mov rcx, rdi
call fcn.14000b2c4
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140009934
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1400160d0]
lea rcx, [0x1400160d0]
mov rax, qword [rax + 0x18]
call qword [case.0x14000c4be.0]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov r8, rdi
lea rdx, str._sDiagnosticsHub.StandardCollector.Proxy.dll
lea rcx, [rsp + 0x50]
call fcn.140009ad4
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140009a0b
lea rcx, [rsp + 0x50]
call fcn.140009a54
mov r8, rdi
lea rdx, str._s_amd64DiagnosticsHub.StandardCollector.Proxy.dll
lea rcx, [rsp + 0x50]
call fcn.140009ad4
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140009a0b
lea rcx, [rsp + 0x50]
call fcn.140009a54
lea r9, str.Team_ToolsDiagnosticsHubCollector
mov r8, rdi
lea rdx, str._s_s_amd64DiagnosticsHub.StandardCollector.Proxy.dll
lea rcx, [rsp + 0x50]
call fcn.140009ad4
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140009a0b
mov edi, 0x80070057
jmp 0x140009a1e
mov rdx, rsi
mov rcx, rbx
call fcn.14000966c
mov edi, eax
test eax, eax
js 0x140009a1e
xor edi, edi
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140009a3f
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x14000c4be.0]
mov eax, edi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14000b2b0
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push r14
push r15
sub r12, r12
add r12, 0x60
mov r14, qword gs:[r12]
push r11
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
std
sub dword [rax - 0x5b], 0xa536c0a2
movabs al, byte [0xa50968813e2d34c0]
sub dword [rax - 0x1c], 0xe4af81fd
sti
mov bh, 0x68
test ebp, ebp
and ebp, dword [rbx + 0x6881fdd0]
in al, 0xfd
sub dword [rax - 7], 0xe479816b
invalid
sub dword [rax - 0x1c], 0xe46881fd
sub dword [rax - 0x1c], 0x86881b3
std
sub dword [rax - 0x1c], 0xe46881fd
sub qword [rax - 0x1c], 0xffffffffa86881fd
std
sub dword [rax - 0x1c], 0xf6881fd
jne 0x14002323a
push 0x6881bbe4
invalid
Function at 0x140026060
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x140026178
xchg rbx, r9
mov qword [rsp + 0x10], r9
xchg rbx, r9
mov qword [rsp + 0x18], rbp
nop
push 0x298a967c
mov qword [rsp], rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
xchg rbx, r14
mov r14, rdx
xchg rbx, r14
mov rdi, rcx
mov esi, r8d
sub rdi, rdx
xchg rbx, rbp
mov rbx, rcx
xchg rbp, rbx
add rdi, 0xf0
dec rsi
shr rsi, 2
shr rsi, 2
inc rsi
nop dword [rax]
movups xmm0, xmmword [rbx]
mov rdx, rbp
xchg rbx, r11
mov rcx, r11
xchg rbx, r11
call fcn.140026810
mov ecx, 0x453ee577
xor ecx, 0x4dfb015
add ecx, 0x2956c724
sub ecx, 0x43ae1920
xor ecx, 0x83f187b
xor ecx, 0x161e5623
sub ecx, 0x18b89c14
xor ecx, 0x7b5aeac5
xor ecx, 0x5ba85bff
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140026115
neg rdi
sub rdi, 0xfffffffffffffff0
neg rdi
xchg rdx, rbp
movups xmmword [rdx + 0xf0], xmm0
xchg rdx, rbp
sub rsi, 1
jne 0x1400260bf
xchg r9, rdi
mov r9, qword [rsp + 0x30]
xchg rdi, r9
xchg r15, rbx
mov r15, qword [rsp + 0x38]
xchg r15, rbx
xchg rdx, rbp
mov rdx, qword [rsp + 0x40]
xchg rdx, rbp
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rsi
ret

Function at 0x140026180
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r11, rbp
mov qword [rsp + 0x10], r11
xchg rbp, r11
mov qword [rsp + 0x18], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov edi, r8d
xchg rdi, rbx
mov rdi, rdx
xchg rdi, rbx
lea r9, [rcx + 0xf0]
mov rsi, rcx
test r8d, r8d
je 0x14002624e
dec rdi
shr rdi, 2
shr rdi, 1
shr rdi, 1
inc rdi
nop dword [rax]
nop word [rax + rax]
xchg rcx, rax
mov rcx, rbx
xchg rcx, rax
sub r9, rbx
mov edx, 0x33cd4540
sub edx, 0x23964fe3
xor edx, 0x2acc7751
add edx, 0x232d2444
xor edx, 0x31837ee5
xor edx, 0x6fa4d8a5
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140026211
xchg rsi, rdx
mov rsi, rdx
xchg rdx, rsi
xchg rcx, r9
mov r9, rbx
xchg rcx, r9
call fcn.1400262f0
mov r9, rbx
add rbx, 0x10
sub rdi, 1
jne 0x1400261df
xchg r9, rcx
movups xmm0, xmmword [rcx]
xchg r9, rcx
xchg rbx, rbp
mov rbp, qword [rsp + 0x30]
xchg rbp, rbx
mov rbp, qword [rsp + 0x38]
xchg rsi, rdi
movups xmmword [rdi + 0xf0], xmm0
xchg rsi, rdi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400279a0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
xchg rdi, rbx
mov qword [rsp + 8], rdi
xchg rbx, rdi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x10
xchg rdx, rbx
mov rdx, rbx
xchg rbx, rdx
mov r10, rcx
test r8b, 0xf
je 0x1400279ed
xor al, al
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
push rcx
xchg qword [rsp + 8], rdi
add rsp, 0x10
nop
add rsp, 8
jmp qword [rsp - 8]
xor edx, edx
test r8d, r8d
je 0x140027a99
movdqa xmm2, xmmword [rsp]
nop
xchg rdx, r11
movdqu xmm1, xmmword [r11 + rbx]
xchg r11, rdx
test edx, edx
jne 0x140027a21
xchg r8, r10
movdqu xmm2, xmmword [r8 + 0x200]
xchg r8, r10
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
pxor xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0x223a4569
add ecx, 0x7c782b7
add ecx, 0x2eaab41a
add ecx, 0x8f70a1a
add ecx, 0x2e899f5
xor ecx, 0x648c2044
nop dword [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027a5d
aesdeclast xmm0, xmmword [r10 + 0x1e0]
pxor xmm0, xmm2
movdqa xmm2, xmm1
xchg r10, rdx
movups xmmword [r10 + r9], xmm0
xchg r10, rdx
sub edx, 0xfffffff0
cmp edx, r8d
jb 0x1400279fe
mov rbx, qword [rsp + 0x20]
mov al, 0x19
sub al, 0xf
add al, 0x24
add al, 0x34
xor al, 0x2c
sub al, 0x4d
add rsp, 0x10
push rax
push rdx
push rax
push rax
push rax
push rdx
push rcx
xchg qword [rsp + 0x38], rdi
pop rcx
pop rdx
pop rax
pop rax
pop rax
pop rdx
pop rax
add rsp, 8
ret
Function at 0x14002ca40
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
xchg r8, rbx
mov qword [rsp + 0x10], r8
xchg rbx, r8
mov qword [rsp + 0x18], rsi
xchg rdx, rdi
mov qword [rsp + 0x20], rdx
xchg rdi, rdx
push r14
sub rsp, 0x30
xchg rsi, rcx
mov rcx, rsi
xchg rcx, rsi
mov rax, qword gs:[0x30]
xchg rdi, r12
mov r12, qword [rax + 0x60]
xchg r12, rdi
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
xchg rbx, r9
mov qword [rsp + 0x40], r9
xchg r9, rbx
add rcx, 0x1ecc2120
sub rcx, 0x1ecc2058
xchg rbx, r8
mov qword [rsp + 0x28], r8
xchg rbx, r8
mov dword [rsp + 0x20], 0x4484ab2
add dword [rsp + 0x20], 0x3b1d20dc
xor dword [rsp + 0x20], 0x7c89e1f6
add dword [rsp + 0x20], 0x20a4d898
add dword [rsp + 0x20], 0x140fa03e
add dword [rsp + 0x20], 0x738816e
sub dword [rsp + 0x20], 0x7b54b22b
add dword [rsp + 0x20], 0x73be9cde
sub dword [rsp + 0x20], 0x78436f67
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b710
test eax, eax
js 0x14002cb20
cmp qword [rsp + 0x40], rbx
je 0x14002cb20
lea eax, [rbx + 1]
jmp 0x14002cc49
mov rax, qword gs:[0x60]
xchg r9, rcx
mov r9, qword [rax + 0x30]
xchg rcx, r9
cmp dword [rcx + 0x70], 2
jbe 0x14002cb60
mov eax, 0x67daff92
sub eax, 0x3e920f63
xor eax, 0x1fccbb8d
add eax, 0x14fe1309
add eax, 0xb56cdb5
xor eax, 0x56d92c62
jmp 0x14002cc49
cmp dword [rcx + 0x74], ebx
jbe 0x14002cb91
mov eax, 0x2c69a01d
xor eax, 0x2f87a0fb
add eax, 0x3922ec36
xor eax, 0x45781a80
sub eax, 0x76b27361
add eax, 0x479ed952
sub eax, 0x49555d8a
jmp 0x14002cc49
cmp byte [rdi + 2], bl
je 0x14002cbc7
mov eax, 0x3ec99704
add eax, 0x17a3a5a6
sub eax, 0x4a157e44
add eax, 0xf4eeab0
xor eax, 0x5ddf3e7e
xor eax, 0x29bd0aaf
xor eax, 0x1efc5a6b
sub eax, 0x7138c7a8
jmp 0x14002cc49
cmp r14d, 0xa
jb 0x14002cc0e
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002cc0e
mov eax, 0x27dd6f2a
add eax, 0x44223cc6
sub eax, 0x4c02269c
sub eax, 0xb8c234
add eax, 0x5191090d
sub eax, 0x76ed3da
xor eax, 0x6966f85b
jmp 0x14002cc49
lea rcx, [rsi + 0xb8]
mov edx, 0x1a44a6a2
sub edx, 0x17c56371
add edx, 0x6848fb1a
xor edx, 0x127d3eaf
sub edx, 0x6d926fc8
add edx, 0x8e77087d
call fcn.14002c050
jmp 0x14002cc47
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
xchg rdi, r12
mov r12, qword [rsp + 0x58]
xchg r12, rdi
add rsp, 0x30
push rcx
push rcx
push rbx
push rcx
push rax
push rbx
push rcx
xchg qword [rsp + 0x38], r14
pop rcx
pop rbx
pop rax
pop rcx
pop rbx
pop rcx
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]