joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401e9210
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
mov r10, qword [0x140549260]
xor edi, edi
xor eax, eax
mov qword [rcx], rdi
mov word [rbp - 4], ax
mov rbx, rcx
mov qword [rcx + 8], rdi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], rdi
mov qword [rcx + 0x28], rdi
mov qword [rcx + 0x30], rdi
mov qword [rcx + 0x38], rdi
mov qword [rcx + 0x40], rdi
mov qword [rcx + 0x48], rdi
mov qword [rcx + 0x50], rdi
mov qword [rcx + 0x58], rdi
mov qword [rcx + 0x60], rdi
mov qword [rcx + 0x68], rdi
mov qword [rcx + 0x70], rdi
mov dword [rbp - 0x30], 0x210024
mov dword [rbp - 0x2c], 0x47004b
mov dword [rbp - 0x28], 0x250045
mov dword [rbp - 0x24], 0x620074
mov dword [rbp - 0x20], 0x60006f
mov dword [rbp - 0x1c], 0x7f0079
mov dword [rbp - 0x18], 0x74007e
mov dword [rbp - 0x14], 0x62002e
mov dword [rbp - 0x10], 0x650065
mov dword [rbp - 0xc], 0x6b0077
mov dword [rbp - 8], 0x310034
nop dword [rax]
movsxd rcx, eax
xor word [rbp + rcx*2 - 0x30], ax
inc eax
cmp eax, 0x16
jb 0x1401e92c0
xor r9d, r9d
mov word [rbp - 4], di
xor edx, edx
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call r10
mov qword [rbx + 0x78], rdi
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x60
pop rbp
ret
Function at 0x1401ec300
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x170
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0xff
call fcn.1403ccc50
xorps xmm0, xmm0
xor edi, edi
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
call fcn.140140f70
lea rcx, [rax + 0x42d0]
call fcn.140182638
test al, al
jne 0x1401ec540
mov qword [rsp + 0x190], rbx
mov qword [rsp + 0x168], rbp
mov qword [rsp + 0x160], rsi
call fcn.140140f70
lea rbp, [rax + 0x178]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1401ec3f7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1401ec3f7
mov esi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x782bdb73
lea rcx, [rsi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1401ec3f2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1401ec3d0
cmp r8d, 0x4d6b85af
je 0x1401ec3fc
test r9d, r9d
jne 0x1401ec3b0
mov rax, qword [rax]
jmp 0x1401ec380
mov ecx, dword [rbx + 0x24]
mov rdx, rbp
add rcx, r10
movzx r8d, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
mov rbx, 0xffffffffffffffff
add rcx, r10
mov eax, dword [rcx + r8*4]
mov rcx, rbx
add rax, r10
call rax
mov rsi, qword [rsp + 0x160]
mov rbp, qword [rsp + 0x168]
test eax, eax
je 0x1401ec491
call fcn.140140f70
cmp dword [rax + 0x178], edi
je 0x1401ec491
movdqa xmm0, xmmword [0x1404cefd0]
mov ecx, edi
movdqu xmmword [rsp + 0x30], xmm0
nop dword [rax]
nop dword [rax + rax]
movsxd rax, ecx
xor byte [rsp + rax + 0x30], cl
inc ecx
cmp ecx, 0xf
jb 0x1401ec460
mov byte [rsp + 0x3f], dil
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rsp + rdi + 0x30]
mov byte [rsp + rdi + 0x60], al
lea rdi, [rdi + 1]
test al, al
jne 0x1401ec480
lea rax, [rsp + 0x60]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1401ec496
test rbx, rbx
mov rbx, qword [rsp + 0x190]
je 0x1401ec540
call fcn.140140f70
lea rcx, [rax + 0x42d0]
call fcn.140182638
test al, al
jne 0x1401ec540
call fcn.140140f70
cmp byte [rax + 0x4342], 0
je 0x1401ec4ec
call fcn.140140f70
call fcn.1401c1060
call fcn.140140f70
lea rcx, [rsp + 0x60]
call fcn.1401c0750
call fcn.140140f70
lea rcx, [rax + 0x42d0]
call fcn.140182638
test al, al
jne 0x1401ec540
xor r8d, r8d
lea r9, [rsp + 0x180]
mov dl, 1
lea ecx, [r8 + 0x13]
call qword [0x140549258]
lea rax, [rsp + 0x188]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
mov ecx, 0xc0000005
call qword [0x1405491b8]
lea rcx, [rsp + 0x40]
call fcn.140194884
add rsp, 0x170
pop rdi
ret
Function at 0x1401ed6d0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r8d, edx
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.kernel32.dll_OpenProcess]
mov rcx, rax
mov edx, 2
mov rsi, rax
call qword [0x140549270]
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1401ed787
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1401ed787
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x651a8216
lea rax, [rdi + r9*4]
mov eax, dword [rax + r10]
add rax, r10
movzx edx, byte [rax]
inc rax
test dl, dl
je 0x1401ed782
nop
movsx edx, dl
lea rax, [rax + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rax - 1]
test dl, dl
jne 0x1401ed760
cmp r8d, 0xff4c6bac
je 0x1401ed78c
test r9d, r9d
jne 0x1401ed740
mov rcx, qword [rcx]
jmp 0x1401ed710
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rcx, rsi
add rax, r10
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp rax
Function at 0x1401f1ab0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x140549030]
mov rdi, rcx
lea rcx, [rsp + 0x68]
xor ebx, ebx
mov qword [rsp + 0x28], rcx
mov r8, rdx
xor ecx, ecx
mov dword [rsp + 0x68], ebx
xor r9d, r9d
mov dword [rsp + 0x20], ebx
xor edx, edx
call rax
mov rbp, qword [0x140549020]
mov rsi, rax
xor eax, eax
mov word [rsp + 0x50], 0x3131
mov byte [rsp + 0x52], al
mov edx, ebx
nop
movsxd rcx, edx
xor byte [rsp + rcx + 0x50], dl
inc edx
cmp edx, 2
jb 0x1401f1b00
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x52], al
call fcn.1403d6dc0
xor ecx, ecx
mov word [rsp + 0x60], 0x3631
mov byte [rsp + 0x62], cl
nop dword [rax]
movsxd rcx, ebx
xor byte [rsp + rcx + 0x60], bl
inc ebx
cmp ebx, 2
jb 0x1401f1b30
mov r8d, eax
mov byte [rsp + 0x62], 0
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.1403d6cb0
mov edx, eax
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call rbp
mov rdx, qword [rdi + 0x38]
lea rcx, [rdi + 0x30]
cmp rdx, qword [rdi + 0x40]
je 0x1401f1b85
mov eax, dword [rsp + 0x68]
mov dword [rdx], eax
add qword [rcx + 8], 4
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
lea r8, [rsp + 0x68]
call fcn.1401f4b60
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401f2a60
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x78
xorps xmm0, xmm0
mov r10, rcx
movups xmmword [rsp + 0x28], xmm0
mov r9, qword [rsp + 0x30]
movups xmmword [rsp + 8], xmm0
nop dword [rax]
test r9, r9
jne 0x1401f2a9c
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x20]
jmp 0x1401f2aa1
mov rcx, qword [rsp + 0x10]
movups xmm1, xmmword [rcx]
mov r9, qword [rcx + 0x20]
movaps xmmword [rsp + 0x10], xmm1
test r9, r9
je 0x1401f2b05
movsxd rax, dword [r9 + 0x3c]
xor r8d, r8d
add rax, r9
movzx ecx, word [rax + 0x14]
movzx r11d, word [rax + 6]
add rcx, 0x24
test r11d, r11d
je 0x1401f2a80
add rax, rcx
test dword [rax + 0x18], 0x20000000
je 0x1401f2aef
mov edx, dword [rax]
add rdx, r9
cmp rdx, r10
ja 0x1401f2aef
mov ecx, dword [rax - 4]
add rcx, rdx
cmp r10, rcx
jb 0x1401f2afd
inc r8d
add rax, 0x28
cmp r8d, r11d
jb 0x1401f2ad1
jmp 0x1401f2a80
mov rax, r9
add rsp, 0x78
ret
xor eax, eax
add rsp, 0x78
ret
Function at 0x1401f2b10
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
xorps xmm0, xmm0
mov r12, r8
movups xmmword [rbp - 0x11], xmm0
mov rsi, qword [rbp - 9]
mov r13, rdx
mov r14, rcx
movups xmmword [rbp - 0x31], xmm0
movups xmmword [rbp + 0x1f], xmm0
test rsi, rsi
jne 0x1401f2b6c
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rcx, qword [rax + 0x20]
jmp 0x1401f2b70
mov rcx, qword [rbp - 0x29]
movups xmm1, xmmword [rcx]
mov rsi, qword [rcx + 0x20]
xor r15d, r15d
movsd xmm0, qword [rcx + 0x50]
movaps xmmword [rbp - 0x29], xmm1
movsd qword [rbp + 0x27], xmm0
test rsi, rsi
je 0x1401f2c1a
test r14, r14
je 0x1401f2c1d
mov rbx, qword [rbp + 0x27]
mov r10, r14
test rbx, rbx
je 0x1401f2b50
cmp word [r14], r15w
je 0x1401f2b50
movzx edi, word [rbx]
mov r11, rbx
neg r11
mov rax, rbx
test di, di
je 0x1401f2c05
nop dword [rax]
lea rcx, [r11 + rax]
movzx edx, word [rcx + r10]
test dx, dx
je 0x1401f2c05
movzx r9d, word [rax]
lea ecx, [rdx - 0x61]
cmp cx, 0x19
lea r8d, [rdx - 0x20]
cmova r8w, dx
lea ecx, [r9 - 0x61]
cmp cx, 0x19
lea edx, [r9 - 0x20]
cmova dx, r9w
cmp r8w, dx
jne 0x1401f2c05
add rax, 2
cmp word [rax], r15w
jne 0x1401f2bc0
jmp 0x1401f2c1d
cmp word [rax], r15w
je 0x1401f2c1d
add r10, 2
cmp word [r10], r15w
jne 0x1401f2bb5
jmp 0x1401f2b50
mov rsi, r15
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x1401f2d0d
movsxd rax, dword [rsi + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
jne 0x1401f2d0d
mov ecx, 0x20b
cmp cx, word [rax + 0x18]
jne 0x1401f2d0d
movzx r9d, word [rax + 6]
lea r10, [rax + 0x108]
mov edx, r15d
test r9d, r9d
je 0x1401f2d0f
movsxd rax, edx
mov dword [rbp + 0x7f], 0x7b67752e
mov word [rbp + 0x83], 0x70
lea rcx, [rax + rax*4]
lea r8, [r10 + rcx*8]
mov ecx, r15d
nop dword [rax]
nop word [rax + rax]
movsxd rax, ecx
xor byte [rbp + rax + 0x7f], cl
inc ecx
cmp ecx, 5
jb 0x1401f2c90
movzx eax, byte [r8]
mov byte [rbp + 0x84], r15b
cmp al, byte [rbp + 0x7f]
je 0x1401f2cb7
inc edx
cmp edx, r9d
jl 0x1401f2c65
jmp 0x1401f2d0f
mov ebx, dword [r8 + 8]
mov edx, dword [r8 + 0xc]
add rdx, rsi
mov qword [r12], rbx
mov qword [r13], rdx
test rbx, rbx
je 0x1401f2cfd
mov r9d, 4
mov r8d, 0x3000
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov r15, rax
call fcn.1403ccc50
mov rdx, qword [r13]
mov rbx, qword [r12]
mov r8, rbx
mov rcx, r15
call fcn.1403cc5a0
mov rax, r15
jmp 0x1401f2d0f
xor eax, eax
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140200480
Capabilities:
Set registry value

Disassembly:
mov dword [rsp + 0x18], r8d
sub rsp, 0x38
cmp qword [rdx + 0x18], 8
jb 0x140200493
mov rdx, qword [rdx]
mov rcx, qword [rcx]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 4
mov r9d, 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.advapi32.dll_RegSetValueExW]
add rsp, 0x38
ret

Function at 0x1402004c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov r14, r8
cmp qword [r8 + 0x18], 8
mov rbx, rdx
mov r15, rcx
mov dword [rsp + 0x70], r13d
jb 0x1402004f7
mov r8, qword [r8]
mov rcx, qword [rcx]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
xor edx, edx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9d, [rdx + 8]
call qword [sym.imp.advapi32.dll_RegGetValueW]
mov ecx, dword [rsp + 0x70]
mov rsi, r13
mov r12d, eax
mov ebp, ecx
mov rdi, r13
test ecx, ecx
je 0x14020057c
cmp rcx, 0x1000
jb 0x14020055f
add rcx, 0x27
cmp rcx, rbp
jbe 0x1402005e9
call fcn.1403caaf4
test rax, rax
je 0x1402005e3
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140200567
call fcn.1403caaf4
mov rsi, rax
mov r8, rbp
lea rdi, [rsi + rbp]
xor edx, edx
mov rcx, rsi
call fcn.1403ccc50
mov ecx, dword [rsp + 0x70]
test r12d, r12d
jne 0x1402005b7
test ecx, ecx
je 0x1402005b7
cmp qword [r14 + 0x18], 8
jb 0x14020058f
mov r14, qword [r14]
mov rcx, qword [r15]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov r9d, 8
mov qword [rsp + 0x28], rsi
mov r8, r14
xor edx, edx
mov qword [rsp + 0x20], r13
call qword [sym.imp.advapi32.dll_RegGetValueW]
mov qword [rbx], rsi
lea r11, [rsp + 0x40]
mov qword [rbx + 8], rdi
mov rax, rbx
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov qword [rbx + 0x10], rdi
mov rbx, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.1403d7020
int3
call fcn.1401391d8
int3
Function at 0x140203180
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push rsi
push r12
push r13
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140549208]
xor ebx, ebx
mov r13, r8
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 1]
mov r12, rcx
call rax
mov rsi, rax
lea rdx, [rax - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x14020330a
mov r8, qword [0x140549280]
xor edx, edx
mov qword [rsp + 0xa0], rdi
mov rcx, rax
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x60], r15
call r8
mov r15d, eax
mov r14d, eax
test eax, eax
jne 0x14020320a
mov edi, ebx
jmp 0x140203231
mov r9d, 4
mov r8d, 0x3000
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov r8, r14
xor edx, edx
mov rcx, rax
mov rdi, rax
call fcn.1403ccc50
mov rax, qword [0x140549160]
lea r9, [rbp + 0x48]
mov r8d, r15d
mov dword [rbp + 0x48], ebx
mov rdx, rdi
mov qword [rsp + 0x20], rbx
mov rcx, rsi
call rax
mov r15, qword [rsp + 0x60]
test eax, eax
jne 0x1402032f2
call qword [sym.imp.kernel32.dll_GetLastError]
movdqa xmm0, xmmword [0x1404cf190]
mov r9d, eax
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x7a653163
mov dword [rbp - 0x1c], 0x27367d60
mov dword [rbp - 0x18], 0x423c60
nop word [rax + rax]
movsxd rax, ebx
xor byte [rbp + rax - 0x30], bl
inc ebx
cmp ebx, 0x1b
jb 0x140203290
mov r8, r12
mov byte [rbp - 0x15], 0
lea rdx, [rbp - 0x30]
xor ecx, ecx
call fcn.1401a7f70
mov r8, r14
xor edx, edx
mov rcx, rdi
call fcn.1403ccc50
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.kernel32.dll_VirtualFree]
mov rcx, rsi
call qword [0x140549178]
xor al, al
mov rdi, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x68]
add rsp, 0x70
pop r13
pop r12
pop rsi
pop rbx
pop rbp
ret
mov rax, qword [rbp + 0x38]
mov rcx, rsi
mov qword [r13], r14
mov qword [rax], rdi
call qword [0x140549178]
mov al, 1
jmp 0x1402032d9
call qword [sym.imp.kernel32.dll_GetLastError]
movdqa xmm0, xmmword [0x1404cf180]
mov r9d, eax
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x7a653163
mov dword [rbp - 0x1c], 0x27367d60
mov dword [rbp - 0x18], 0x423c60
nop word [rax + rax]
movsxd rax, ebx
xor byte [rbp + rax - 0x30], bl
inc ebx
cmp ebx, 0x1b
jb 0x140203340
mov r8, r12
mov byte [rbp - 0x15], 0
lea rdx, [rbp - 0x30]
xor ecx, ecx
call fcn.1401a7f70
xor al, al
add rsp, 0x70
pop r13
pop r12
pop rsi
pop rbx
pop rbp
ret
Function at 0x140203370
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
mov eax, dword [rsp + 0xa0]
mov rsi, r8
mov r10, qword [0x140549208]
mov rbp, rdx
mov r14, rcx
xor ebx, ebx
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov edx, 0x10000000
mov dword [rsp + 0x20], r9d
mov rcx, rsi
xor r9d, r9d
call r10
mov rdi, rax
lea rdx, [rax - 1]
cmp rdx, 0xfffffffffffffffd
ja 0x1402033f9
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], ebx
mov r8d, ebp
mov qword [rsp + 0x20], rbx
mov rdx, r14
mov rcx, rax
call qword [0x140549200]
mov rcx, rdi
call qword [0x140549178]
mov al, 1
jmp 0x140203454
call qword [sym.imp.kernel32.dll_GetLastError]
movdqa xmm0, xmmword [0x1404cfed0]
mov r9d, eax
movdqa xmm1, xmmword [0x1404cfce0]
xor eax, eax
mov byte [rsp + 0x66], al
movdqu xmmword [rsp + 0x44], xmm0
mov word [rsp + 0x64], 0x7905
movdqu xmmword [rsp + 0x54], xmm1
nop dword [rax + rax]
movsxd rax, ebx
xor byte [rsp + rax + 0x44], bl
inc ebx
cmp ebx, 0x22
jb 0x140203430
mov r8, rsi
mov byte [rsp + 0x66], 0
lea rdx, [rsp + 0x44]
xor ecx, ecx
call fcn.1401a7f70
xor al, al
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140203470
Capabilities:
Access peb ldr_data
Check if file exists
Delete file
Encode data using xor
Get file attributes
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x60
mov rbx, rcx
call qword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14020359f
mov rcx, rbx
call fcn.1403e0638
mov rcx, rbx
call qword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14020359f
mov rcx, rbx
call qword [sym.imp.kernel32.dll_DeleteFileA]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14020359f
xor ecx, ecx
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rcx
mov eax, 0x614
mov qword [rsp + 0x38], rcx
mov word [rsp + 0x40], ax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x30], rbx
mov rax, qword gs:[0x60]
mov qword [rsp + 0x70], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140203577
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140203577
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x8bd38e82
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140203572
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140203550
cmp r8d, 0x7513365f
je 0x14020357c
test r9d, r9d
jne 0x140203530
mov rax, qword [rax]
jmp 0x140203500
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x20]
add rax, r10
call rax
mov rdi, qword [rsp + 0x70]
add rsp, 0x60
pop rbx
ret
Function at 0x1402035b0
Capabilities:
Access peb ldr_data
Check if file exists
Delete file
Encode data using xor
Get file attributes
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x280
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x80]
mov r8d, 0xff
call fcn.1403ccc50
call fcn.140141104
xor edx, edx
lea rcx, [rsp + 0x180]
mov r8d, 0x100
call fcn.1403ccc50
mov r9, 0xffffffffffffffff
nop word [rax + rax]
inc r9
cmp word [rbx + r9*2], 0
jne 0x140203600
xor edi, edi
lea rax, [rsp + 0x180]
mov qword [rsp + 0x38], rdi
mov r8, rbx
mov qword [rsp + 0x30], rdi
xor edx, edx
mov dword [rsp + 0x28], 0x100
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov ecx, edi
nop dword [rax + rax]
movzx eax, byte [rsp + rcx + 0x180]
mov byte [rsp + rcx + 0x80], al
lea rcx, [rcx + 1]
test al, al
jne 0x140203640
lea rcx, [rsp + 0x80]
call qword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14020379a
lea rcx, [rsp + 0x80]
call fcn.1403e0638
lea rcx, [rsp + 0x80]
call qword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14020379a
lea rcx, [rsp + 0x80]
call qword [sym.imp.kernel32.dll_DeleteFileA]
lea rcx, [rsp + 0x80]
call qword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14020379a
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], rax
mov eax, 0x614
mov word [rsp + 0x60], ax
mov dword [rsp + 0x48], 3
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], rdi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140203777
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140203777
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x20e86e94
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140203772
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140203750
cmp r8d, 0xf47fc401
je 0x14020377c
test r9d, r9d
jne 0x140203730
mov rax, qword [rax]
jmp 0x140203700
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x40]
add rax, r10
call rax
mov rbx, qword [rsp + 0x290]
add rsp, 0x280
pop rdi
ret
Function at 0x140203d60
Capabilities:
Encode data using xor
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
xor ebx, ebx
mov r14, rdx
mov qword [rbp - 0x30], rbx
mov rdi, rcx
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x30], rbx
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
mov rax, qword [0x140549248]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80
mov rcx, rdi
mov dword [rsp + 0x20], 3
call rax
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140203e07
mov rcx, rdi
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
shr eax, 4
test al, 1
je 0x140203f20
mov rax, qword [0x140549248]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0x2000000
mov edx, 0x100
mov rcx, rdi
mov dword [rsp + 0x20], 3
call rax
mov rsi, rax
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140203f20
mov rax, qword [0x140549298]
lea r9, [rbp + 0x30]
lea r8, [rbp + 0x38]
mov rcx, rsi
lea rdx, [rbp - 0x30]
call rax
test eax, eax
je 0x140203ed1
mov rax, qword [0x140549248]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0x100
mov rcx, r14
mov dword [rsp + 0x20], 3
call rax
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140203ea9
mov rcx, r14
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
shr eax, 4
test al, 1
je 0x140203edf
mov rax, qword [0x140549248]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov dword [rsp + 0x28], 0x2000000
mov edx, 0x100
mov rcx, r14
mov dword [rsp + 0x20], 3
call rax
mov rdi, rax
lea rax, [rdi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140203edf
lea r9, [rbp + 0x30]
mov rcx, rdi
lea r8, [rbp + 0x38]
lea rdx, [rbp - 0x30]
call qword [0x1405492a8]
mov rcx, rdi
call qword [0x140549178]
mov rcx, rsi
call qword [0x140549178]
jmp 0x140203f6d
call qword [sym.imp.kernel32.dll_GetLastError]
movdqa xmm0, xmmword [0x1404d0300]
mov r8d, eax
xor eax, eax
mov dword [rbp - 0x18], 0x337a6579
mov byte [rbp - 0x10], al
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x14], 0x4f336d24
nop dword [rax + rax]
movsxd rax, ebx
xor byte [rbp + rax - 0x28], bl
inc ebx
cmp ebx, 0x18
jb 0x140203f10
jmp 0x140203f5e
call qword [sym.imp.kernel32.dll_GetLastError]
movdqa xmm0, xmmword [0x1404d0300]
mov r8d, eax
xor eax, eax
mov dword [rbp - 0x18], 0x337a6579
mov byte [rbp - 0x10], al
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x14], 0x4f336d24
nop dword [rax]
movsxd rax, ebx
xor byte [rbp + rax - 0x28], bl
inc ebx
cmp ebx, 0x18
jb 0x140203f50
lea rdx, [rbp - 0x28]
mov byte [rbp - 0x10], 0
xor ecx, ecx
call fcn.1401a7f70
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret