joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004c0b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14004c0f2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x14004c0fa
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14004c10b
jmp 0x14004c122
xor r10d, r10d
jmp 0x14004c1ad
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14004c122
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14004c139
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14004c159
add r11, r8
jmp 0x14004c28a
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14004c222
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14004c1d0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x14004c240
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14004c252
jmp 0x14004c26c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14004c26c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14004c286
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140068020
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140068040
test al, 1
je 0x1400681a6
test al, 2
jne 0x1400681a6
test al, 8
jne 0x140068084
mov rdi, qword [rsi + 0x20]
xor ecx, ecx
call fcn.1401d91c0
test rax, rax
je 0x14006809e
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
jmp 0x1400680a1
test al, 0x10
je 0x140068104
mov rax, qword [rsi + 0x60]
test rax, rax
je 0x1400681a6
mov rcx, qword [rsi + 0x68]
call qword [rax + 0x10]
jmp 0x140068104
xorps xmm6, xmm6
lea rdi, [rsi + 0x28]
mov rcx, qword [rsi + 0x28]
add rcx, 0xfffffffffffffffe
cmp rcx, 3
mov eax, 1
cmovb rax, rcx
cmp rax, 1
je 0x1400680e5
test rax, rax
jne 0x1400680ed
mov r8, qword [rsi + 0x30]
test r8, r8
je 0x1400680ed
cmp qword [rsi + 0x38], 0
je 0x1400680ed
mov rcx, qword [0x1402d9150]
xor edx, edx
call sub.kernel32.dll_HeapFree
jmp 0x1400680ed
mov rcx, rdi
call fcn.140067e20
mov qword [rdi], 4
xor ecx, ecx
call fcn.1401d91c0
test rax, rax
je 0x140068104
movups xmmword [rax + 0x20], xmm6
mov rax, 0xffffffffffffffc0
lock xadd qword [rsi], rax
cmp rax, 0x3f
jbe 0x1400681a6
and rax, 0xffffffffffffffc0
cmp rax, 0x40
jne 0x140068164
mov rcx, qword [rsi + 0x28]
add rcx, 0xfffffffffffffffe
cmp rcx, 3
mov eax, 1
cmovb rax, rcx
cmp rax, 1
je 0x140068170
test rax, rax
jne 0x140068179
mov r8, qword [rsi + 0x30]
test r8, r8
je 0x140068179
cmp qword [rsi + 0x38], 0
je 0x140068179
mov rcx, qword [0x1402d9150]
xor edx, edx
call sub.kernel32.dll_HeapFree
jmp 0x140068179
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [rsi + 0x28]
call fcn.140067e20
mov rax, qword [rsi + 0x60]
test rax, rax
je 0x140068189
mov rcx, qword [rsi + 0x68]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
ud2
Function at 0x140068ad0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rcx, rcx
je 0x140068b7f
mov rbx, rdx
mov rdi, rcx
lea rsi, [rcx + 0x10]
mov rcx, rsi
call sub.kernel32.dll_AcquireSRWLockExclusive
movzx eax, byte [rdi + 0x18]
test al, al
jne 0x140068d16
cmp dword [rdi + 0x58], 0x3b9aca00
je 0x140068be4
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_QueryPerformanceCounter
test eax, eax
je 0x140068d11
mov r14, qword [rsp + 0x20]
mov rcx, qword [0x1402d9130]
test rcx, rcx
jne 0x140068b69
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_QueryPerformanceFrequency
test eax, eax
je 0x140068d11
mov rcx, qword [rsp + 0x20]
mov qword [0x1402d9130], rcx
test rcx, rcx
je 0x140068d16
mov rax, r14
or rax, rcx
shr rax, 0x20
je 0x140068b89
mov rax, r14
xor edx, edx
div rcx
jmp 0x140068b90
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov eax, r14d
xor edx, edx
div ecx
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x140068bb4
xor edx, edx
div rcx
mov rcx, rax
jmp 0x140068bba
xor edx, edx
div ecx
mov ecx, eax
add rcx, r8
mov rax, rcx
shr rax, 9
movabs rdx, 0x44b82fa09b5a53
mul rdx
shr rdx, 0xb
imul eax, edx, 0x3b9aca00
sub ecx, eax
mov qword [rdi + 0x50], rdx
mov dword [rdi + 0x58], ecx
cmp dword [rdi + 0x48], 0x3b9aca00
jne 0x140068c16
lea rcx, [rdi + 0x20]
cmp qword [rcx], 0
je 0x140068d00
add qword [rdi + 0x28], rbx
cmp dword [rdi + 0x38], 0x3b9aca00
jne 0x140068d00
call fcn.140068d20
jmp 0x140068d00
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_QueryPerformanceCounter
test eax, eax
je 0x140068d11
mov r14, qword [rsp + 0x20]
mov rcx, qword [0x1402d9130]
test rcx, rcx
jne 0x140068c72
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_QueryPerformanceFrequency
test eax, eax
je 0x140068d11
mov rcx, qword [rsp + 0x20]
mov qword [0x1402d9130], rcx
test rcx, rcx
je 0x140068d16
mov rax, r14
or rax, rcx
shr rax, 0x20
je 0x140068c88
mov rax, r14
xor edx, edx
div rcx
jmp 0x140068c8f
mov eax, r14d
xor edx, edx
div ecx
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x140068cb3
xor edx, edx
div rcx
mov rcx, rax
jmp 0x140068cb9
xor edx, edx
div ecx
mov ecx, eax
add rcx, r8
mov rax, rcx
shr rax, 9
movabs rdx, 0x44b82fa09b5a53
mul rdx
shr rdx, 0xb
imul rax, rdx, 0x3b9aca00
sub rcx, rax
cmp rdx, qword [rdi + 0x40]
jb 0x140068d00
jne 0x140068ceb
cmp dword [rdi + 0x48], ecx
ja 0x140068d00
mov dword [rdi + 0x48], 0x3b9aca00
lea rcx, [rdi + 0x20]
cmp qword [rcx], 0
jne 0x140068bfb
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1401f2d54
call sub.kernel32.dll_GetLastError
ud2
Function at 0x140085990
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x1401f5178]
test ecx, ecx
je 0x1400859c0
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x1400859d9
cmp qword [rax + 8], 0
je 0x1400859d9
add rax, 0x10
jmp 0x140085ab7
lea rcx, [0x1401f5160]
call fcn.1401c6a80
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jae 0x1400859b0
mov ecx, dword [0x1401f5178]
test ecx, ecx
je 0x140085a98
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je case.0x140083c94.341
mov rdi, rax
test rax, rax
jne 0x140085a6a
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140085a2b
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140085ace
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0x18
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140085ace
add byte [rax], al
invalid
mov rdi, rax
lea rax, [0x1401f5160]
lea eax, [0x1401f5160]
mov qword [rdi], rax
mov qword [rdi + 8], 0
mov ecx, dword [0x1401f5178]
invalid
invalid
test ecx, ecx
je 0x140085abe
dec ecx
mov rdx, rdi
call fcn.1401f2dc4
invalid
invalid
test rsi, rsi
je case.0x140083c94.334
mov rcx, qword [rsi]
mov qword [rsi], 0
add byte [rax], al
add byte [rax - 0x7b], cl
leave
je 0x140085a86
mov rcx, qword [rsi + 8]
jmp 0x140085a86
xor ecx, ecx
lea rax, [rdi + 0x10]
mov qword [rdi + 8], 1
mov dword [rdi + 8], 1
mov qword [rdi + 0x10], rcx
jmp 0x140085ab7
lea rcx, [0x1401f5160]
call fcn.1401c6a80
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
adc ebx, edx
invalid
add byte [rax - 0x7d], cl
clc
add dword [rdi], ecx
test dword [rbx - 1], eax
invalid
invalid
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1401f5160]
call fcn.1401c6a80
mov ecx, eax
jmp 0x140085a62
ud2
Function at 0x140088a40
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x1401f5038]
test ecx, ecx
je 0x140088a70
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x140088a89
cmp qword [rax + 8], 0
je 0x140088a89
add rax, 0x10
jmp 0x140088bac
lea rcx, [0x1401f5020]
call fcn.1401c6a80
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jae 0x140088a60
mov ecx, dword [0x1401f5038]
test ecx, ecx
je 0x140088b8d
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x140088baa
mov rdi, rax
test rax, rax
jne 0x140088b1e
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x140088adb
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x140088bc6
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0x28
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x140088bc6
mov rdi, rax
lea rax, [0x1401f5020]
mov qword [rdi], rax
mov qword [rdi + 8], 0
mov ecx, dword [0x1401f5038]
test ecx, ecx
je 0x140088bb3
dec ecx
mov rdx, rdi
call fcn.1401f2dc4
test rsi, rsi
je 0x140088b56
mov rax, qword [rsi]
mov qword [rsi], 0
cmp rax, 1
jne 0x140088b56
mov r9, qword [rsi + 8]
movzx r8d, byte [rsi + 0x10]
movzx edx, byte [rsi + 0x11]
movzx eax, word [rsi + 0x16]
mov word [rsp + 0x24], ax
mov eax, dword [rsi + 0x12]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsi + 0x18]
jmp 0x140088b60
xor ecx, ecx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
mov qword [rdi + 8], 1
lea rax, [rdi + 0x10]
mov qword [rdi + 0x10], r9
mov byte [rdi + 0x18], r8b
mov byte [rdi + 0x19], dl
mov edx, dword [rsp + 0x20]
mov dword [rdi + 0x1a], edx
movzx edx, word [rsp + 0x24]
mov word [rdi + 0x1e], dx
mov qword [rdi + 0x20], rcx
jmp 0x140088bac
lea rcx, [0x1401f5020]
call fcn.1401c6a80
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x140088aa8
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1401f5020]
call fcn.1401c6a80
mov ecx, eax
jmp 0x140088b16
ud2
Function at 0x1400ef300
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r13, rdx
mov rbx, rcx
mov rdi, qword [rcx]
mov r12, qword [rcx + 0x10]
test r12, r12
je 0x1400ef375
mov rax, r12
shr rax, 0x3d
jne 0x1400ef371
lea r15, [r12*4]
test r15, r15
je 0x1400ef37d
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x1400ef35f
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400ef371
mov rcx, rax
mov qword [0x1402d9150], rax
xor edx, edx
mov r8, r15
call sub.kernel32.dll_HeapAlloc
mov r14, rax
test rax, rax
jne 0x1400ef383
ud2
lea r15, [r12*4]
mov r14d, 4
mov rcx, r14
mov rdx, rdi
mov r8, r15
call sub.msvcrt.dll_memcpy
mov r8, qword [r13 + 0x30]
mov rax, qword [r13 + 0x158]
and eax, 0x3f
mov r9, r8
mov ecx, eax
shr r9, cl
lea rcx, [rbx + 0x18]
test r9, r9
je 0x1400ef4b0
mov rcx, qword [rcx]
and ecx, 0x3f
xor edx, edx
jmp 0x1400ef3c8
inc rdx
cmp rdx, r9
je 0x1400ef3fc
mov r10, rdx
shl r10, cl
cmp rdx, r12
je 0x1400ef371
mov esi, dword [r14 + rdx*4]
cmp esi, r10d
je 0x1400ef3c0
nop dword [rax]
mov r11d, esi
mov esi, esi
shr rsi, cl
cmp rsi, r12
jae 0x1400ef371
mov esi, dword [r14 + rsi*4]
cmp esi, r10d
jne 0x1400ef3e0
mov dword [rdi + rdx*4], r11d
jmp 0x1400ef3c0
lea rcx, [rbx + 0x18]
test r9, r9
je 0x1400ef4b0
mov rdx, qword [r13 + 0x150]
mov qword [rsp + 0x40], rdx
test rdx, rdx
je 0x1400ef4b0
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], r13
mov r15, qword [r13 + 0x20]
mov qword [rsp + 0x28], rcx
mov rdx, qword [rcx]
and edx, 0x3f
xor ebx, ebx
movabs rbp, 0x7ffffffffff
nop word cs:[rax + rax]
mov r13, rbx
inc rbx
mov ecx, eax
shl r13, cl
mov r11, qword [rsp + 0x40]
cmp r13, r8
jae 0x1400ef371
mov rsi, qword [r15 + r13*8]
mov r10, rsi
shr r10, 0x2b
mov ecx, edx
shr r10, cl
cmp r10, r12
jae 0x1400ef371
mov ecx, dword [rdi + r10*4]
shl rcx, 0x2b
and rsi, rbp
or rsi, rcx
mov qword [r15 + r13*8], rsi
inc r13
dec r11
jne 0x1400ef460
cmp rbx, r9
jne 0x1400ef450
mov rbx, qword [rsp + 0x38]
mov r13, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
mov rax, qword [r13 + 0x48]
test rax, rax
je 0x1400ef4f2
mov rdx, qword [r13 + 0x38]
mov rcx, qword [rcx]
and ecx, 0x3f
xor r8d, r8d
nop word cs:[rax + rax]
mov r9d, dword [rdx + r8*4]
shr r9, cl
cmp r9, r12
jae 0x1400ef371
mov r9d, dword [rdi + r9*4]
mov dword [rdx + r8*4], r9d
inc r8
cmp rax, r8
jne 0x1400ef4d0
jmp 0x1400ef4f7
test r12, r12
je 0x1400ef508
mov rcx, qword [0x1402d9150]
xor edx, edx
mov r8, r14
call sub.kernel32.dll_HeapFree
cmp qword [rbx + 8], 0
je 0x1400ef530
mov r8, qword [rbx]
mov rcx, qword [0x1402d9150]
xor edx, edx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400f07a0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov ecx, dword [0x1401f5078]
test ecx, ecx
je 0x1400f07d0
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jb 0x1400f07e9
cmp qword [rax + 8], 0
je 0x1400f07e9
add rax, 0x10
jmp 0x1400f08d4
lea rcx, [0x1401f5060]
call fcn.1401c6a80
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 2
jae 0x1400f07c0
mov ecx, dword [0x1401f5078]
test ecx, ecx
je 0x1400f08b5
dec ecx
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
je 0x1400f08d2
mov rdi, rax
test rax, rax
jne 0x1400f087a
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x1400f083b
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x1400f08eb
mov rcx, rax
mov qword [0x1402d9150], rax
mov r8d, 0x18
xor edx, edx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x1400f08eb
mov rdi, rax
lea rax, [0x1401f5060]
mov qword [rdi], rax
mov qword [rdi + 8], 0
mov ecx, dword [0x1401f5078]
test ecx, ecx
je 0x1400f08db
dec ecx
mov rdx, rdi
call fcn.1401f2dc4
test rsi, rsi
je 0x1400f0890
mov rcx, qword [rsi + 8]
cmp qword [rsi], 0
mov qword [rsi], 0
jne 0x1400f08a3
mov ecx, 1
lock xadd qword [0x1401f5058], rcx
test rcx, rcx
je 0x1400f08eb
lea rax, [rdi + 0x10]
mov qword [rdi + 8], 1
mov qword [rdi + 0x10], rcx
jmp 0x1400f08d4
lea rcx, [0x1401f5060]
call fcn.1401c6a80
mov ecx, eax
call sub.kernel32.dll_TlsGetValue
cmp rax, 1
jne 0x1400f0808
xor eax, eax
add rsp, 0x28
pop rdi
pop rsi
ret
lea rcx, [0x1401f5060]
call fcn.1401c6a80
mov ecx, eax
jmp 0x1400f0872
ud2
Function at 0x1401119a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rdx]
mov rbx, qword [rdx + 8]
mov rax, qword [r15 + 0xa0]
mov r14, qword [rdx + 0x10]
mov rcx, r14
test rax, rax
je 0x1401119e5
mov rcx, r14
sub rcx, rax
jbe 0x1401119df
cmp byte [rbx + rax], 0xc0
jge 0x1401119e5
jmp 0x140111af3
jne 0x140111af3
test rcx, rcx
je 0x140111af3
movzx ecx, byte [rbx + rax]
test cl, cl
jns 0x140111a4c
mov edx, ecx
and edx, 0x1f
movzx r9d, byte [rbx + rax + 1]
and r9d, 0x3f
cmp cl, 0xdf
jbe 0x140111a44
movzx r8d, byte [rbx + rax + 2]
shl r9d, 6
and r8d, 0x3f
or r8d, r9d
cmp cl, 0xf0
jb 0x140111a68
movzx ecx, byte [rbx + rax + 3]
and edx, 7
shl edx, 0x12
shl r8d, 6
and ecx, 0x3f
or ecx, r8d
or ecx, edx
cmp ecx, 0x110000
jne 0x140111a4c
jmp 0x140111af3
shl edx, 6
or edx, r9d
mov ecx, edx
cmp ecx, 0x5c
jne 0x140111a76
mov rcx, rsi
mov rdx, rdi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.140109a00
shl edx, 0xc
or r8d, edx
mov ecx, r8d
cmp ecx, 0x5c
je 0x140111a51
lea rcx, [rsp + 0x28]
mov rdx, rdi
call fcn.140109650
mov rax, qword [r15 + 0xa0]
test rax, rax
je 0x140111a9e
sub r14, rax
jbe 0x140111a9c
cmp byte [rbx + rax], 0xc0
jge 0x140111a9e
jmp 0x140111af3
jne 0x140111af3
test r14, r14
je 0x140111af3
movzx ebp, byte [rbx + rax]
test bpl, bpl
jns 0x140111b08
mov ecx, ebp
and ecx, 0x1f
movzx r8d, byte [rbx + rax + 1]
and r8d, 0x3f
cmp bpl, 0xdf
jbe 0x140111af7
movzx edx, byte [rbx + rax + 2]
shl r8d, 6
and edx, 0x3f
or edx, r8d
cmp bpl, 0xf0
jb 0x140111b01
movzx ebp, byte [rbx + rax + 3]
and ecx, 7
shl ecx, 0x12
shl edx, 6
and ebp, 0x3f
or ebp, edx
or ebp, ecx
cmp ebp, 0x110000
jne 0x140111b08
ud2
shl ecx, 6
or ecx, r8d
mov ebp, ecx
jmp 0x140111b08
shl ecx, 0xc
or edx, ecx
mov ebp, edx
movups xmm0, xmmword [rsp + 0x28]
movups xmm1, xmmword [rsp + 0x38]
movups xmm2, xmmword [rsp + 0x48]
movups xmmword [rsi + 0x28], xmm2
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov rcx, rdi
call fcn.140109810
mov dword [rsi + 0x38], ebp
mov byte [rsi + 0x3c], 0
mov byte [rsi + 0x70], 2
mov dword [rsi], 0x22
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14011d5d0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, r8
mov rsi, rcx
mov r14, r8
sub r14, rdx
shr r14, 3
sub rbx, rdx
je 0x14011d72e
movabs rax, 0x7ffffffffffffff9
cmp rbx, rax
jae 0x14011d7c6
mov rdi, rdx
movzx eax, byte [0x1402d9160]
mov rcx, qword [0x1402d9150]
test rcx, rcx
jne 0x14011d633
call sub.kernel32.dll_GetProcessHeap
test rax, rax
je 0x14011d7c6
mov rcx, rax
mov qword [0x1402d9150], rax
xor edx, edx
mov r8, rbx
call sub.kernel32.dll_HeapAlloc
test rax, rax
je 0x14011d7c6
cmp rbx, 0xa0
jb 0x14011d6a9
lea rcx, [rax + r14*8]
add rcx, 0xfffffffffffffff8
xor edx, edx
cmp rcx, rax
jb 0x14011d6ab
lea rcx, [rax + 4]
lea r8, [rax + r14*8]
add r8, 0xfffffffffffffffc
cmp r8, rcx
jb 0x14011d6ab
movabs rcx, 0x1ffffffffffffffe
lea r8, [r14 - 1]
lea r9, [rcx + 1]
cmp r8, r9
ja 0x14011d6ab
mov rdx, rbx
and rdx, 0xfffffffffffffff8
lea r8, [rdi + rdx]
cmp rax, r8
jae 0x14011d74a
mov r8, rax
add r8, rdx
cmp r8, rdi
jbe 0x14011d74a
xor edx, edx
mov rcx, rdx
or rcx, 1
test bl, 8
je 0x14011d6da
mov r8d, dword [rdi + rdx*8]
mov r9d, dword [rdi + rdx*8 + 4]
cmp r8d, r9d
mov r10d, r9d
cmovb r10d, r8d
cmova r9d, r8d
mov dword [rax + rdx*8], r10d
mov dword [rax + rdx*8 + 4], r9d
mov rdx, rcx
cmp r14, rcx
je 0x14011d735
nop
mov ecx, dword [rdi + rdx*8]
mov r8d, dword [rdi + rdx*8 + 4]
cmp ecx, r8d
mov r9d, r8d
cmovb r9d, ecx
cmova r8d, ecx
mov dword [rax + rdx*8], r9d
mov dword [rax + rdx*8 + 4], r8d
mov ecx, dword [rdi + rdx*8 + 8]
mov r8d, dword [rdi + rdx*8 + 0xc]
cmp ecx, r8d
mov r9d, r8d
cmovb r9d, ecx
cmova r8d, ecx
mov dword [rax + rdx*8 + 8], r9d
mov dword [rax + rdx*8 + 0xc], r8d
add rdx, 2
cmp r14, rdx
jne 0x14011d6e0
mov rcx, rdx
jmp 0x14011d735
xor ecx, ecx
mov eax, 4
mov qword [rsi], rax
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rcx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
and rcx, r14
xor edx, edx
movdqa xmm0, xmmword [0x1401fc920]
nop word [rax + rax]
movdqu xmm1, xmmword [rdi + rdx*8]
pshufd xmm2, xmm1, 0xe8
pshufd xmm1, xmm1, 0xed
movdqa xmm3, xmm2
pxor xmm3, xmm0
movdqa xmm4, xmm1
pxor xmm4, xmm0
pcmpgtd xmm4, xmm3
movdqa xmm3, xmm4
pandn xmm3, xmm1
movdqa xmm5, xmm4
pandn xmm5, xmm2
pand xmm2, xmm4
por xmm2, xmm3
pand xmm4, xmm1
por xmm4, xmm5
punpckldq xmm2, xmm4
movdqu xmmword [rax + rdx*8], xmm2
add rdx, 2
cmp rcx, rdx
jne 0x14011d760
mov rdx, rcx
cmp r14, rcx
je 0x14011d735
jmp 0x14011d6ab
ud2
Function at 0x140151640
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140151660
test al, 1
je 0x140151777
test al, 2
jne 0x140151777
test al, 8
jne 0x1401516a4
mov rdi, qword [rsi + 0x28]
xor ecx, ecx
call fcn.1401d91c0
test rax, rax
je 0x1401516c4
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
jmp 0x1401516c7
test al, 0x10
je 0x1401516e7
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x140151777
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x10]
jmp 0x1401516e7
xorps xmm6, xmm6
lea rcx, [rsi + 0x30]
call fcn.14014f350
mov byte [rsi + 0xa8], 4
xor ecx, ecx
call fcn.1401d91c0
test rax, rax
je 0x1401516e7
movups xmmword [rax + 0x20], xmm6
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401db990
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140151777
jne 0x14015176b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14015172f
mov rcx, rdi
call fcn.140062fd0
lea rcx, [rsi + 0x30]
call fcn.14014f350
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x14015174e
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
ud2

Function at 0x140151780
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1401517a0
test al, 1
je 0x1401518b7
test al, 2
jne 0x1401518b7
test al, 8
jne 0x1401517e4
mov rdi, qword [rsi + 0x28]
xor ecx, ecx
call fcn.1401d91c0
test rax, rax
je 0x140151804
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
jmp 0x140151807
test al, 0x10
je 0x140151827
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x1401518b7
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x10]
jmp 0x140151827
xorps xmm6, xmm6
lea rcx, [rsi + 0x30]
call fcn.14014f350
mov byte [rsi + 0xa8], 4
xor ecx, ecx
call fcn.1401d91c0
test rax, rax
je 0x140151827
movups xmmword [rax + 0x20], xmm6
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.1401dbc30
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x1401518b7
jne 0x1401518ab
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14015186f
mov rcx, rdi
call fcn.14014d110
lea rcx, [rsi + 0x30]
call fcn.14014f350
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x14015188e
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x1402d9150]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
ud2