joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2904eb221
Capabilities:
Encode data using base64

Disassembly:
push rcx
shr cx, 8
nop
andps xmm2, xmm3
andps xmm11, xmm5
rcpps xmm5, xmm2
emms
psrlq mm1, 0x2d
pop rcx
mov qword [rsp + 8], rcx
push r11
nop
psrld mm1, 0xf
inc r11d
emms
push rax
adc r11d, eax
nop
emms
push r8
psllq mm4, 0x59
shl r8, 0x14
push r13
pslld mm7, 0x3f
pop r13
emms
emms
pop r8
pcmpgtw mm2, mm4
emms
paddw mm2, mm1
pop rax
dec r11d
not r11d
nop
sbb r11, 2
pop r11
mov qword [rsp + 0x10], rdx
push rax
maxps xmm1, xmm14
sar rax, 0xc
emms
neg al
mulss xmm5, xmm14
maxss xmm4, xmm0
emms
pop rax
mov qword [rsp + 0x18], r8
push r15
paddd mm5, mm2
push rcx
emms
push rax
neg cx
pop rax
pmaddwd mm5, mm7
pop rcx
psrlq mm7, 0x1f
pop r15
mov qword [rsp + 0x20], r9
push r10
por mm1, mm3
push r14
maxps xmm7, xmm2
rol r14w, 7
pop r14
nop
pop r10
sub rsp, 0x64
push r10
emms
push r9
emms
push rcx
psraw mm0, 0x21
push r12
rcl r10b, 2
pop r12
shr r9d, 7
pop rcx
shl r9d, 0x16
pop r9
sub r10b, 0xd
pop r10
mov rcx, 0x17226fcb
push rdx
por mm3, mm6
sar dl, 0xa
psrlw mm1, 0x18
emms
shl dx, 6
dec edx
movaps xmm12, xmm7
mov dx, 0x13
psubsb mm7, mm0
rcr dl, 7
nop
movhlps xmm3, xmm14
pop rdx
call fcn.2904e8620
push r12
nop
orps xmm2, xmm9
push r13
rcl r12, 0xe
punpckldq mm3, mm7
push r14
packuswb mm5, mm3
emms
push r11
psrld mm2, 5
emms
push rcx
psrlq mm2, 0x5f
movaps xmm10, xmm13
pop rcx
nop
minps xmm15, xmm12
pop r11
punpckhwd mm0, mm2
inc r12d
pop r14
rcr r13d, 0xf
not r13b
pop r13
nop
not r12
pop r12
add rsp, 0x64
push r9
dec r9
push rcx
nop
push r8
emms
pop r8
shl cx, 0xa
pop rcx
nop
pop r9
mov rcx, qword [rsp + 8]
cmp r12, 0x64
jne 0x2904eb3de
push r10
mov r10, 3
push r14
pop r14
dec r10
jne 0x2904eb3a2
pop r10
jmp 0x2904eb407
push r14
packssdw mm1, mm6
push r15
psrlw mm0, 0x65
push r8
emms
push r13
rcpps xmm1, xmm3
pop r13
paddw mm0, mm3
pop r8
mov r14, 5
pop r15
neg r14d
pop r14
push rbx
pcmpgtd mm5, mm2
sar rbx, 5
inc ebx
push r11
nop
nop
mov r11, rbx
push rcx
inc ebx
rol bx, 0x13
push r12
sbb r11d, 2
dec rcx
pop r12
nop
mov r11, rcx
and r11b, cl
pop rcx
sbb r11b, bl
psrlw mm0, 0x4f
pop r11
nop
pmaxub mm0, mm5
pop rbx
mov rdx, qword [rsp + 0x10]
push r15
psllq mm1, 0x4c
psrlw mm6, 0x45
sbb r15w, 6
orps xmm13, xmm4
psrad mm6, 0x35
push r12
neg r12b
addps xmm8, xmm10
orps xmm1, xmm9
sbb r15d, r12d
push rbx
subps xmm4, xmm12
neg r12w
emms
push r10
emms
paddsw mm1, mm4
push rdx
nop
pop rdx
xor r12w, r15w
shl r12, 6
pop r10
maxss xmm3, xmm5
sbb r12b, 0x16
emms
pop rbx
ucomiss xmm0, xmm6
psrld mm2, 0x13
psadbw mm0, mm1
neg r15d
pop r12
psrld mm7, 0x2b
rcr r15b, 0x13
emms
maxps xmm14, xmm6
rol r15d, 5
pop r15
mov r8, qword [rsp + 0x18]
push r10
dec r10
paddb mm0, mm1
pcmpeqd mm5, mm3
push rax
psrld mm6, 0x5f
psubsb mm5, mm3
pmaxsw mm6, mm0
push r13
not r13
ror r13, 5
push r15
xchg r13, r15
test r10b, al
pop r15
emms
mov r13, 0x10
xorps xmm6, xmm7
pop r13
psrlq mm4, 0x3d
nop
pop rax
pcmpeqb mm7, mm6
nop
pop r10
mov r9, qword [rsp + 0x20]
cmp r12d, 5
jne 0x2904eb514
push rcx
pslld mm0, 0x2f
pop rcx
jmp 0x2904eb51c
push r9
psllq mm6, 0x49
pop r9
push rax
nop
pop rax
jmp rax
Function at 0x2904f1750
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push r10
psrlw mm0, 3
push r13
psrad mm7, 0x50
push r14
nop
push r8
emms
push rbx
nop
pop rbx
xorps xmm14, xmm6
pop r8
paddusw mm3, mm5
pop r14
psrad mm4, 0x3d
pop r13
emms
pop r10
cmp r12b, 0x3c
jne 0x2904f1788
push rcx
neg rcx
pop rcx
jmp 0x2904f1790
push r13
pslld mm2, 0x41
pop r13
push r10
andps xmm10, xmm3
pop r10
mov rax, qword gs:[0x60]
push rcx
inc ecx
nop
push rbx
emms
pcmpgtw mm1, mm6
push r12
nop
sbb bl, 0xb
push rax
mov r12w, 0xb
mulss xmm5, xmm6
pop rax
psrld mm2, 0x21
mulss xmm3, xmm1
pop r12
psrlq mm5, 0x68
neg cx
pop rbx
andnps xmm6, xmm5
pcmpeqw mm5, mm3
pop rcx
movzx eax, byte [rax + 2]
mov dword [rcx], eax
push r15
emms
pslld mm5, 0x32
psllq mm2, 0x68
addps xmm10, xmm3
rcl r15d, 0xc
push r14
sar r15d, 9
inc r15d
inc r14
inc r15d
push r8
add r15b, r8b
xchg r15, r14
psrad mm6, 0x12
push r11
addss xmm3, xmm12
paddb mm2, mm3
push rbx
dec r14d
pop rbx
dec r15
psrld mm1, 0x11
pop r11
psubsb mm2, mm0
rcr r8b, 2
psrlw mm2, 0x4d
pop r8
emms
shl r14d, 3
addps xmm14, xmm4
psllq mm3, 0x61
pop r14
psrld mm4, 0x46
nop
psadbw mm7, mm3
mulss xmm5, xmm6
not r15b
pop r15
ret
Function at 0x2904f2c91
Capabilities:
Authenticate hmac

Disassembly:
cmp r12d, r8d
jne 0x2904f2d22
push r11
dec r11
psrad mm5, 0x27
paddsb mm4, mm7
push r15
xchg r11, r15
mov r15w, r11w
pslld mm0, 0x48
push r10
sbb r15w, 1
emms
push r9
dec r15d
emms
pop r9
psrlw mm6, 0x62
orps xmm15, xmm1
dec r10
pop r10
mov r11w, 3
pslld mm3, 0x30
pop r15
sbb r11d, 0xb
dec r11d
pop r11
jmp 0x2904f2d8a
push r10
shr r10d, 8
nop
pmaddwd mm1, mm3
psrld mm5, 0x5c
emms
push r9
not r10
punpckhbw mm6, mm7
emms
psraw mm4, 0x68
push r8
test r10w, r9w
packssdw mm6, mm4
emms
push rax
nop
punpcklwd mm1, mm4
push rcx
test eax, r10d
pop rcx
pslld mm2, 0x64
mulss xmm3, xmm10
pop rax
emms
xor r9, r10
paddusw mm2, mm7
pop r8
sub r9b, 0x15
sbb r9b, r10b
test r10d, r9d
emms
pop r9
nop
maxss xmm7, xmm9
movss xmm8, xmm7
emms
pslld mm0, 0x64
pop r10
push rcx
not ecx
push rbx
emms
push r8
xchg bx, r8w
pop r8
cmp cx, bx
pop rbx
psubw mm0, mm7
pop rcx
push r15
mov r15, 2
push r8
push rbx
pop rbx
pop r8
dec r15
jne 0x2904f2da9
pop r15
push r12
movhlps xmm7, xmm8
push r11
sbb r12d, 5
push r15
rol r11b, 4
push rdx
punpckldq mm7, mm1
push rax
psrld mm5, 0x1c
push r13
inc edx
push r10
xor r12, rax
pop r10
pmulhuw mm1, mm4
pop r13
rcpps xmm2, xmm11
pop rax
psadbw mm6, mm2
pop rdx
psrld mm6, 0x1b
pop r15
emms
pop r11
pandn mm2, mm5
pop r12
push r14
emms
pcmpgtw mm0, mm3
push r12
punpckldq mm4, mm2
paddusw mm0, mm1
push r8
psubusw mm0, mm4
packsswb mm3, mm4
push r15
minps xmm7, xmm0
movups xmm12, xmm6
pop r15
psubusw mm0, mm4
emms
pop r8
maxps xmm3, xmm4
mulps xmm4, xmm8
pop r12
shr r14w, 6
pand mm7, mm2
pop r14
cmp r12d, r8d
jne 0x2904f2e66
push r11
pmaxub mm1, mm3
push r15
adc r11, r15
psrad mm1, 0x2a
pop r15
ror r11b, 2
pop r11
jmp 0x2904f2e75
push rax
nop
push rbx
sar bx, 3
not ax
pop rbx
por mm4, mm6
pop rax
push r9
psraw mm4, 0x50
push r13
psrad mm7, 0xa
xorps xmm3, xmm0
pop r13
rcpss xmm6, xmm13
pop r9
cmp r12d, r9d
jne 0x2904f2ee7
cmp r12d, 0x66
jne 0x2904f2ea1
push r13
pxor mm2, mm6
pop r13
jmp 0x2904f2ea5
push rcx
shl cl, 1
pop rcx
push rax
inc rax
pop rax
jmp 0x2904f2f26
cmp r12d, r8d
jne 0x2904f2f01
push rbx
shr bx, 9
push r8
neg ebx
dec rbx
pop r8
rol bx, 5
pop rbx
jmp 0x2904f2f11
push r13
rol r13d, 0xa
push rcx
nop
emms
pop rcx
neg r13d
pop r13
push r14
not r14
push r9
xchg r9, r14
inc r9
pop r9
psraw mm4, 0x14
pop r14
push r11
nop
inc r11
neg r11b
psllq mm0, 0x61
push r13
nop
comiss xmm5, xmm11
sbb r13b, 0x13
push rdx
emms
test dl, r13b
push r14
dec r13
pop r14
psrlw mm1, 0x1c
inc r13
pop rdx
dec r11
emms
rcpps xmm14, xmm11
pop r13
psraw mm1, 0x36
emms
pxor mm6, mm3
nop
pop r11
push rcx
shr cl, 3
rcpps xmm4, xmm11
not ecx
movups xmm1, xmm10
nop
push r11
shl r11w, 8
nop
punpckhwd mm2, mm5
rcl r11, 1
emms
pop r11
psrlw mm2, 0x1c
psrlw mm4, 0x69
psrld mm4, 0x5e
emms
nop
psrld mm5, 0xf
pop rcx
cmp r12w, 0x26
jne 0x2904f2faf
push r11
addps xmm0, xmm6
pop r11
jmp 0x2904f2fb4
push rax
shr eax, 6
pop rax
push rcx
psrld mm1, 0x3f
pop rcx
push r12
mov r12, 1
push rbx
pop rbx
dec r12
jne 0x2904f2fc3
pop r12
ret
Function at 0x2904f5f80
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rcx, rdx
push r10
punpckhwd mm7, mm3
subps xmm7, xmm6
push r12
emms
pop r12
paddb mm6, mm3
psllq mm4, 0x67
pop r10
mov qword [rsi + 8], rdx
test rdx, rdx
je 0x2904f6113
push r8
paddusw mm7, mm1
andps xmm4, xmm6
nop
nop
push r13
maxss xmm12, xmm5
nop
mov r8d, 1
mov r13, 0x12
pop r13
psubw mm6, mm7
emms
nop
shr r8w, 3
pop r8
call fcn.2904f0030
mov rbx, rax
push r8
paddb mm6, mm2
mov r8, 7
emms
push r15
emms
andps xmm0, xmm12
push rcx
por mm5, mm0
pop rcx
mov r8, r15
nop
pop r15
packsswb mm3, mm1
dec r8
shr r8w, 0x16
pop r8
call fcn.2904f3796
cmp r12w, 0x3a
jne 0x2904f6048
push rax
dec rax
push r9
punpcklbw mm4, mm2
dec rax
pop r9
rol al, 1
pop rax
jmp 0x2904f6059
push rbx
por mm0, mm6
push r14
and ebx, r14d
xor bl, r14b
pop r14
emms
pop rbx
push rdx
dec rdx
push r11
ucomiss xmm3, xmm13
movlhps xmm14, xmm3
pop r11
pmaddwd mm6, mm1
pop rdx
call fcn.2904f3eec
lea eax, [rbx + rbx]
mov edx, 0xfffc
cmp eax, edx
cmova eax, edx
mov word [rsi], ax
push r15
psllq mm3, 0x55
push rdx
nop
movlhps xmm10, xmm6
push r13
shr r13b, 0x13
rcr dl, 0x12
psrlw mm2, 0x16
push r10
paddusb mm0, mm4
rcpss xmm4, xmm13
sub r10, 0xb
sbb r13, r15
pop r10
pcmpgtb mm7, mm1
paddsb mm1, mm3
psraw mm1, 0x10
pop r13
psraw mm2, 0xb
psraw mm6, 0x18
pop rdx
sbb r15d, 0x15
pop r15
mov eax, dword [rsi]
add eax, 2
mov word [rsi + 2], ax
push r11
rcl r11b, 4
dec r11d
push r10
mulss xmm4, xmm0
shl r11b, 5
push r15
movups xmm13, xmm5
nop
push r8
xadd r10b, r8b
paddsw mm0, mm3
pop r8
adc r15d, r10d
ucomiss xmm0, xmm10
pop r15
psrlw mm7, 0x1d
not r11b
pop r10
pminsw mm7, mm0
pcmpeqd mm0, mm6
pop r11
jmp 0x2904f6117
xor eax, eax
mov dword [rsi], eax
push rdx
dec edx
push rax
paddsb mm0, mm3
emms
pop rax
mov edx, 0xc
pop rdx
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.2904f3e98
Function at 0x2904f7cbe
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x38
push r10
not r10b
push rax
nop
pslld mm3, 0x41
push r11
psraw mm0, 0x1e
rcpps xmm5, xmm10
emms
push r12
addps xmm9, xmm12
dec r11
rcl r12d, 5
not r11w
pop r12
shr r10, 9
cmp r11w, r10w
nop
pop r11
maxps xmm8, xmm15
test r10, rax
pop rax
sar r10w, 6
pop r10
mov word [rsp + 0x2a], 0x6737
mov byte [rsp + 0x2c], 0
push r8
nop
push r15
emms
push r10
emms
push r9
paddd mm3, mm1
push rax
pmulhuw mm7, mm1
push rcx
and r15b, cl
pop rcx
add r9b, r15b
pop rax
sbb r15b, 0xb
pop r9
nop
pop r10
nop
pop r15
nop
pop r8
mov word [rsp + 0x2d], 0x7c32
mov byte [rsp + 0x2f], 0
push r9
psrlw mm1, 0x29
pslld mm6, 0x57
pslld mm3, 0x17
pmulhuw mm3, mm7
pmulhuw mm0, mm3
andnps xmm11, xmm15
minps xmm13, xmm14
pop r9
lea rbx, [rsp + 0x2a]
lea rdx, [rsp + 0x2d]
mov rcx, rbx
call sub.msvcrt.dll__mbscmp
test eax, eax
jne 0x2904f7e29
mov rax, rbx
lea rdx, [rsp + 0x2c]
push r9
paddb mm5, mm4
push rcx
inc ecx
emms
push r13
not ecx
xadd r13b, cl
nop
push r8
nop
emms
mov r8b, 3
subss xmm3, xmm5
push r11
emms
ror r11d, 8
psllq mm5, 0x32
pcmpeqd mm7, mm3
emms
pop r11
emms
rcpss xmm6, xmm2
ror r8w, 0x15
packssdw mm0, mm5
pop r8
minps xmm14, xmm9
pslld mm5, 0x55
dec rcx
pop r13
movups xmm0, xmm5
emms
pop rcx
movss xmm4, xmm12
pop r9
xor byte [rax], 0x61
push rcx
neg cl
push rdx
psrad mm7, 0x5b
push r9
dec r9d
push rax
pand mm2, mm3
push r11
dec ecx
push r8
shl ecx, 3
pop r8
emms
pop r11
psrad mm5, 0x2f
pop rax
nop
pop r9
mov edx, 8
pop rdx
nop
pop rcx
inc rax
cmp rax, rdx
jne 0x2904f7d8c
jmp 0x2904f7e87
push r8
ror r8d, 0xe
push r12
pcmpgtw mm6, mm0
subps xmm0, xmm10
push r13
rcr r8b, 0x13
or r12b, r13b
sbb r13b, r12b
push r10
not r13w
nop
nop
emms
push rbx
pcmpeqb mm0, mm3
dec r10
dec r10
sbb r10b, r13b
paddb mm0, mm5
pop rbx
not r13d
emms
neg r13b
psrlw mm0, 0x5f
pop r10
not r8w
or r12, r8
dec r12d
pop r13
psadbw mm1, mm6
shl r8w, 4
pop r12
emms
pop r8
push rax
paddsb mm0, mm2
inc rax
andnps xmm12, xmm7
movlhps xmm7, xmm6
push r12
subps xmm14, xmm11
punpckhbw mm6, mm1
neg rax
ror ax, 0x13
pop r12
nop
addps xmm8, xmm1
addss xmm2, xmm8
emms
pop rax
rdtsc
mov ebx, edx
mov esi, eax
push r13
dec r13d
psraw mm5, 0x6b
mulps xmm9, xmm3
push r8
cmp r8b, r13b
nop
push r9
neg r8
pop r9
emms
emms
pop r8
emms
emms
shl r13d, 0x13
pop r13
call sym.VerifyPenSourceCaps.dll_TickOfflineSubtractCount
shl rbx, 0x20
or rbx, rsi
push r13
dec r13d
psraw mm5, 0x6b
mulps xmm9, xmm3
push r8
cmp r8b, r13b
nop
push r9
neg r8
pop r9
emms
emms
pop r8
emms
emms
shl r13d, 0x13
pop r13
call sym.VerifyPenSourceCaps.dll_TickOfflineSubtractCount
movzx eax, bx
add rax, 0x1f0000
add rsp, 0x38
pop rbx
pop rsi
ret
Function at 0x100075150
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x100080558], rdi
je 0x1000751b0
cmp rax, rdi
jne 0x1000751a3
mov r12d, 1
jmp 0x1000751b0
mov ecx, 0x3e8
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_Sleep]
jmp 0x100075189
mov eax, dword [0x100080550]
cmp eax, 1
jne 0x1000751c5
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x10007522c
mov eax, dword [0x100080550]
cmp eax, ebx
jne 0x100075222
mov dword [0x100080550], 1
lea r13, [0x100001b48]
lea rdi, [0x100001b30]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x100075214
cmp eax, ebx
jne 0x100075214
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x100075209
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1000751f2
cmp eax, ebx
je 0x10007522c
mov eax, 0xff
jmp 0x100075374
mov dword [0x10007f924], 1
mov eax, dword [0x100080550]
cmp eax, 1
jne 0x100075254
lea rdx, [0x100001b28]
lea rcx, [0x100001ab8]
call sub.msvcrt.dll__initterm
mov dword [0x100080550], 2
cmp r12d, ebx
jne 0x100075263
mov rax, rbx
xchg qword [0x100080558], rax
cmp qword [0x100080570], rbx
je 0x10007528b
lea rcx, [0x100080570]
call fcn.1000756ac
cmp eax, ebx
je 0x10007528b
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100080570]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x1000752a1
mov eax, 0xff
jmp 0x100075374
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x100075326
cmp word [rcx], bx
je 0x1000752bc
cmp edx, ebx
jne 0x100075326
cmp word [rcx], bx
je 0x1000752d2
cmp word [rcx], 0x20
ja 0x1000752d2
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1000752bc
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x100000000]
call fcn.1000337b8
mov dword [0x10007f920], eax
cmp dword [0x10007f904], ebx
jne 0x100075310
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x10007f924], ebx
jne 0x100075324
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x10007f920]
jmp 0x100075374
cmp word [rcx], 0x22
jne 0x100075339
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1000752ad
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call fcn.1001f9000
add rsp, 0x28
jmp 0x100075150
Function at 0x1401820f0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1401820fd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14018210d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1401820f5
lea eax, [rcx + 1]
jmp 0x14018211b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14018212e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140182114
sub eax, 3
jb 0x14018214e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14018219d
sar eax, 1
movsxd rbp, eax
jb 0x140182184
jmp 0x14018215c
add ebx, ebx
jne 0x14018215a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140182184
inc ecx
add ebx, ebx
jne 0x14018216a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140182184
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14018217d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14018216c
add ecx, 2
jmp 0x140182189
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1401820b2
jmp 0x1401820fd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xa8600
mov dl, 0x21
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x1401821ed
cmp rsi, rcx
jae 0x1401821f5
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x1401821d4
cmp al, 0x8f
ja 0x1401821d4
cmp byte [rsi - 2], 0xf
je 0x1401821da
sub al, 0xe8
cmp al, 1
ja 0x1401821be
cmp rsi, rcx
jae 0x1401821f5
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x1401821c4
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x1401821f5
lodsb al, byte [rsi]
jmp 0x1401821d4
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x17e000]
mov eax, dword [rdi]
or eax, eax
je 0x14018225e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x19cf0c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140182202
jns 0x140182237
movzx rdx, word [rdi]
add rdi, 2
jmp 0x140182241
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140182258
mov qword [rbx], rax
add rbx, 8
jmp 0x140182222
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140182298
cmp al, 0xef
ja 0x14018228a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14018226a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x140182279
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x24f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1401822ec
sub rsp, 0xffffffffffffff80
jmp 0x14005b530
Function at 0x140004884
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.140012b50
mov r15, qword [0x140020514]
cmp r15, 1
jne 0x140004953
push qword [0x140020604]
pop rcx
call fcn.14000dd04
mov r15, rax
and r15, r15
jle 0x1400048e9
mov rcx, qword [0x140020604]
call fcn.14000dd0c
mov rcx, qword [0x140020604]
call fcn.14000dd20
or rax, rax
je 0x1400048e9
mov rbp, qword [0x14002060c]
push qword [rbp + 0x10]
pop rcx
call fcn.14000e1bc
jmp 0x1400048c6
push qword [0x1400205f4]
pop rcx
call fcn.14000dd04
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x140004953
push 5
push 0
push 1
push qword [0x1400205f4]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009060
mov rcx, qword [0x1400205f4]
call fcn.14000dd0c
mov rcx, qword [0x1400205f4]
call fcn.14000dd20
or rax, rax
je 0x140004953
mov rbp, qword [0x1400205fc]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x140004930
mov rax, 1
jmp 0x14000495f
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006b38
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020640]
call fcn.1400123b8
lea rcx, [0x140021210]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
add bh, bh
invalid
add bh, bh
adc esp, dword [rsi]
add bh, bh
adc esp, dword [rsi]
add bh, bh
adc esp, dword [rcx + rax]
call qword [rcx]
and al, byte [rcx]
call qword [rax]
and byte [rcx], al
dec dword [rsi]
sbb eax, 0x1b0bff01
add bh, bh
or dword [rax], ebx
add bh, bh
or byte [0x1530bf5be], dl
add bh, bh
invalid
add al, 0xe
add bh, bh
add ecx, dword [0x14b07f5d2]
add bh, bh
add al, 0xd
add edi, edi
or byte [rbx], dl
add bh, bh
or byte [rdx + rax], dl
dec dword [rax]
adc al, 2
dec dword [rax]
adc al, 1
dec dword [rax]
adc al, 1
add edi, edi
or dword [0x1550df5f3], edx
add edi, edi
or dword [0x1550df5f3], edx
add edi, edi
or byte [0x1550df5fa], dl
add edi, edi
or dword [0x1560ef603], edx
add bh, bh
or dl, byte [rsi]
add bh, bh
or dl, byte [rsi]
add bh, bh
or dl, byte [rsi]
add bh, bh
or dl, byte [rsi]
add bh, bh
or dl, byte [rsi]
add bh, bh
invalid
Function at 0x14007363a
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1400a32e0
mov rax, rcx
neg rcx
test rax, 7
je 0x1400a32fd
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x1400a3358
test al, 7
jne 0x1400a32f0
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x1400a3311
mov rdx, qword [rax - 8]
test dl, dl
je 0x1400a3382
test dh, dh
je 0x1400a337c
shr rdx, 0x10
test dl, dl
je 0x1400a3376
test dh, dh
je 0x1400a3370
shr rdx, 0x10
test dl, dl
je 0x1400a336a
test dh, dh
je 0x1400a3364
shr edx, 0x10
test dl, dl
je 0x1400a335e
test dh, dh
jne 0x1400a3311
lea rax, [rax + rcx - 1]
ret
lea rax, [rax + rcx - 2]
ret
lea rax, [rax + rcx - 3]
ret
lea rax, [rax + rcx - 4]
ret
lea rax, [rax + rcx - 5]
ret
lea rax, [rax + rcx - 6]
ret
lea rax, [rax + rcx - 7]
ret
lea rax, [rax + rcx - 8]
ret

Function at 0x140073973
Capabilities:
Get thread local storage value

Disassembly:
jmp 0x1400977e0
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.140097160
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x14009781f
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140204020]
jmp 0x140097829
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
add rsp, 0x48
ret