joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401298f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x140713740]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x58], r9
mov dword [rsp + 0x30], r8d
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rcx
xor ebx, ebx
mov qword [rsp + 0x70], rbx
call fcn.1400fd420
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.NtQueryVirtualMemory
lea rcx, [rsp + 0x38]
call fcn.1400fe440
nop
call fcn.14010e720
lea r13, [r14 + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x38]
mov rbp, qword [rsp + 0x38]
mov r15, qword [rsp + 0x50]
cmp r15, 0xf
cmova r8, rbp
movabs rdx, 0xcbf29ce484222325
mov ecx, ebx
mov rsi, qword [rsp + 0x48]
test rsi, rsi
je 0x1401299c4
movabs r9, 0x100000001b3
nop dword [rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rsi
jb 0x1401299b0
mov rcx, qword [r14 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r14 + 0x18]
mov rdi, qword [rax + rcx*8 + 8]
mov r12, qword [r14 + 8]
cmp rdi, r12
je 0x140129a2e
mov r14, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rdi + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x140129a02
mov rdx, qword [rdx]
lea rcx, [rsp + 0x38]
cmp r15, 0xf
cmova rcx, rbp
cmp rsi, rax
jne 0x140129a20
mov r8, rsi
call fcn.14041c7a0
test eax, eax
je 0x140129a2b
cmp rdi, r14
je 0x140129a2e
mov rdi, qword [rdi + 8]
jmp 0x1401299f0
mov rbx, rdi
test rbx, rbx
cmove rbx, r12
mov rcx, r13
cmp rbx, r12
je 0x140129a81
mov rbx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x140129a87
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx + 8]
call rbx
mov ebx, eax
jmp 0x140129a8c
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
cmp r15, 0xf
jbe 0x140129abf
lea rdx, [r15 + 1]
mov rax, rbp
cmp rdx, 0x1000
jb 0x140129ab7
add rdx, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140129ae2
mov rcx, rbp
call fcn.1403e5198
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1403e5550
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1403eb834
int3
Function at 0x140129bf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x140713740]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x58], r8
mov dword [rsp + 0x34], edx
mov qword [rsp + 0x60], rcx
xor ebx, ebx
mov dword [rsp + 0x68], ebx
call fcn.1400fd420
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov r8d, 0x19
lea rdx, str.NtQueryInformationProcess
lea rcx, [rsp + 0x38]
call fcn.1400fe440
nop
call fcn.14010e720
lea r13, [r14 + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x38]
mov rbp, qword [rsp + 0x38]
mov r15, qword [rsp + 0x50]
cmp r15, 0xf
cmova r8, rbp
movabs rdx, 0xcbf29ce484222325
mov ecx, ebx
mov rsi, qword [rsp + 0x48]
test rsi, rsi
je 0x140129cc4
movabs r9, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rsi
jb 0x140129cb0
mov rcx, qword [r14 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r14 + 0x18]
mov rdi, qword [rax + rcx*8 + 8]
mov r12, qword [r14 + 8]
cmp rdi, r12
je 0x140129d2e
mov r14, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rdi + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x140129d02
mov rdx, qword [rdx]
lea rcx, [rsp + 0x38]
cmp r15, 0xf
cmova rcx, rbp
cmp rsi, rax
jne 0x140129d20
mov r8, rsi
call fcn.14041c7a0
test eax, eax
je 0x140129d2b
cmp rdi, r14
je 0x140129d2e
mov rdi, qword [rdi + 8]
jmp 0x140129cf0
mov rbx, rdi
test rbx, rbx
cmove rbx, r12
mov rcx, r13
cmp rbx, r12
je 0x140129d73
mov rbx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x140129d79
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x30]
mov r8, qword [rsp + 0x58]
mov edx, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 8]
call rbx
mov ebx, eax
jmp 0x140129d7e
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
cmp r15, 0xf
jbe 0x140129db1
lea rdx, [r15 + 1]
mov rax, rbp
cmp rdx, 0x1000
jb 0x140129da9
add rdx, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140129dd4
mov rcx, rbp
call fcn.1403e5198
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1403e5550
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1403eb834
int3
Function at 0x140129de0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x48], r8
mov dword [rsp + 0x24], edx
mov qword [rsp + 0x50], rcx
call fcn.1400fd420
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xor ebx, ebx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov r8d, reloc.WS2_32.dll_socket
lea rdx, str.NtSetInformationProcess
lea rcx, [rsp + 0x28]
call fcn.1400fe440
nop
call fcn.14010e720
lea r13, [r14 + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x28]
mov rbp, qword [rsp + 0x28]
mov r15, qword [rsp + 0x40]
cmp r15, 0xf
cmova r8, rbp
movabs rdx, 0xcbf29ce484222325
mov ecx, ebx
mov rsi, qword [rsp + 0x38]
test rsi, rsi
je 0x140129e95
movabs r9, 0x100000001b3
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rsi
jb 0x140129e81
mov rcx, qword [r14 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r14 + 0x18]
mov rdi, qword [rax + rcx*8 + 8]
mov r12, qword [r14 + 8]
cmp rdi, r12
je 0x140129efe
mov r14, qword [rax + rcx*8]
nop word [rax + rax]
lea rdx, [rdi + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x140129ed2
mov rdx, qword [rdx]
lea rcx, [rsp + 0x28]
cmp r15, 0xf
cmova rcx, rbp
cmp rsi, rax
jne 0x140129ef0
mov r8, rsi
call fcn.14041c7a0
test eax, eax
je 0x140129efb
cmp rdi, r14
je 0x140129efe
mov rdi, qword [rdi + 8]
jmp 0x140129ec0
mov rbx, rdi
test rbx, rbx
cmove rbx, r12
mov rcx, r13
cmp rbx, r12
je 0x140129f39
mov rbx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x140129f3f
mov r9d, dword [rsp + 0x20]
mov r8, qword [rsp + 0x48]
mov edx, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
mov rcx, qword [rcx + 8]
call rbx
mov ebx, eax
jmp 0x140129f44
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
cmp r15, 0xf
jbe 0x140129f77
lea rdx, [r15 + 1]
mov rax, rbp
cmp rdx, 0x1000
jb 0x140129f6f
add rdx, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140129f8a
mov rcx, rbp
call fcn.1403e5198
mov eax, ebx
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1403eb834
int3
Function at 0x140129f90
Capabilities:
Create thread
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x68], r8
mov r12, rdx
mov qword [rsp + 0x90], rcx
call fcn.1400fd420
mov rbp, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xor ebx, ebx
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rbx
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.NtCreateThreadEx
lea rcx, [rsp + 0x70]
call fcn.1400fe440
nop
call fcn.14010e720
lea r13, [rbp + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x70]
mov rsi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x88]
cmp r14, 0xf
cmova r8, rsi
movabs rdx, 0xcbf29ce484222325
mov ecx, ebx
mov rdi, qword [rsp + 0x80]
test rdi, rdi
je 0x14012a064
movabs r9, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rdi
jb 0x14012a050
mov rcx, qword [rbp + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r15, qword [rbp + 8]
cmp rbx, r15
je 0x14012a0cf
mov rbp, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14012a0a2
mov rdx, qword [rdx]
lea rcx, [rsp + 0x70]
cmp r14, 0xf
cmova rcx, rsi
cmp rdi, rax
jne 0x14012a0c0
mov r8, rdi
call fcn.14041c7a0
test eax, eax
je 0x14012a0cb
cmp rbx, rbp
je 0x14012a0cf
mov rbx, qword [rbx + 8]
jmp 0x14012a090
xor edi, edi
jmp 0x14012a0d3
xor edi, edi
mov ebx, edi
test rbx, rbx
cmove rbx, r15
mov rcx, r13
cmp rbx, r15
je 0x14012a0ee
mov rbx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x14012a0f7
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, rdi
cmp r14, 0xf
jbe 0x14012a12e
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14012a126
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012a1e7
mov rcx, rsi
call fcn.1403e5198
mov rcx, qword [rsp + 0x90]
mov rcx, qword [rcx + 8]
mov eax, dword [rsp + 0x110]
mov r9, qword [rsp + 0x68]
xor r8d, r8d
test rbx, rbx
je 0x14012a196
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], 0x100000
mov qword [rsp + 0x40], 0x1000
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r9
mov r9, rcx
mov edx, dword [rsp + 0x118]
mov rcx, r12
call rbx
test eax, eax
jns 0x14012a1d3
mov qword [r12], rdi
jmp 0x14012a1d3
and eax, 1
shl eax, 2
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [r12], rax
test rax, rax
je 0x14012a1c4
mov eax, edi
jmp 0x14012a1d3
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1403eb834
int3
Function at 0x14012a220
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rdx
cmp byte [rcx + 0x15], 0
jne 0x14012a24b
xor eax, eax
jmp 0x14012a3cc
call fcn.1400fd420
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.Wow64GetThreadContext
lea rcx, [rsp + 0x20]
call fcn.1400fe440
nop
call fcn.14010e720
lea r13, [r14 + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x20]
mov rsi, qword [rsp + 0x20]
mov r15, qword [rsp + 0x38]
cmp r15, 0xf
cmova r8, rsi
movabs rdx, 0xcbf29ce484222325
mov ecx, ebp
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x14012a2e4
movabs r9, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rdi
jb 0x14012a2d0
mov rcx, qword [r14 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r14 + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r12, qword [r14 + 8]
cmp rbx, r12
je 0x14012a34b
mov r14, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14012a322
mov rdx, qword [rdx]
lea rcx, [rsp + 0x20]
cmp r15, 0xf
cmova rcx, rsi
cmp rdi, rax
jne 0x14012a340
mov r8, rdi
call fcn.14041c7a0
test eax, eax
je 0x14012a34e
cmp rbx, r14
je 0x14012a34b
mov rbx, qword [rbx + 8]
jmp 0x14012a310
mov rbx, rbp
test rbx, rbx
cmove rbx, r12
mov rcx, r13
cmp rbx, r12
je 0x14012a37c
mov rbx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14012a382
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call rbx
mov ebx, eax
jmp 0x14012a384
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, ebp
cmp r15, 0xf
jbe 0x14012a3b7
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14012a3af
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012a3e4
mov rcx, rsi
call fcn.1403e5198
test ebx, ebx
jne 0x14012a3ca
mov rax, qword gs:[0x30]
mov ebp, dword [rax + 0x1250]
mov eax, ebp
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1403eb834
int3
Function at 0x14012a420
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], rdx
cmp byte [rcx + 0x15], 0
jne 0x14012a44b
xor eax, eax
jmp 0x14012a5cc
call fcn.1400fd420
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.Wow64SetThreadContext
lea rcx, [rsp + 0x20]
call fcn.1400fe440
nop
call fcn.14010e720
lea r13, [r14 + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x20]
mov rsi, qword [rsp + 0x20]
mov r15, qword [rsp + 0x38]
cmp r15, 0xf
cmova r8, rsi
movabs rdx, 0xcbf29ce484222325
mov ecx, ebp
mov rdi, qword [rsp + 0x30]
test rdi, rdi
je 0x14012a4e4
movabs r9, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rdi
jb 0x14012a4d0
mov rcx, qword [r14 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r14 + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r12, qword [r14 + 8]
cmp rbx, r12
je 0x14012a54b
mov r14, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14012a522
mov rdx, qword [rdx]
lea rcx, [rsp + 0x20]
cmp r15, 0xf
cmova rcx, rsi
cmp rdi, rax
jne 0x14012a540
mov r8, rdi
call fcn.14041c7a0
test eax, eax
je 0x14012a54e
cmp rbx, r14
je 0x14012a54b
mov rbx, qword [rbx + 8]
jmp 0x14012a510
mov rbx, rbp
test rbx, rbx
cmove rbx, r12
mov rcx, r13
cmp rbx, r12
je 0x14012a57c
mov rbx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14012a582
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call rbx
mov ebx, eax
jmp 0x14012a584
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, ebp
cmp r15, 0xf
jbe 0x14012a5b7
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14012a5af
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012a5e4
mov rcx, rsi
call fcn.1403e5198
test ebx, ebx
jne 0x14012a5ca
mov rax, qword gs:[0x30]
mov ebp, dword [rax + 0x1250]
mov eax, ebp
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1403eb834
int3
Function at 0x14012a950
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x140713740]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r13, rdx
mov r15, rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
cmp byte [rcx + 0x15], bl
jne 0x14012a98b
xor eax, eax
jmp 0x14012ab5d
mov qword [rsp + 0x60], rbx
call fcn.1400fd420
mov rbp, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov r8d, 0x19
lea rdx, str.NtQueryInformationProcess
lea rcx, [rsp + 0x40]
call fcn.1400fe440
nop
mov dword [rsp + 0x30], 1
call fcn.14010e720
lea rax, [rbp + 0x40]
mov qword [rsp + 0x38], rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x40]
mov rsi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x58]
cmp r14, 0xf
cmova r8, rsi
movabs rdx, 0xcbf29ce484222325
mov rcx, rbx
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x14012aa34
movabs r9, 0x100000001b3
nop dword [rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rdi
jb 0x14012aa20
mov rcx, qword [rbp + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r12, qword [rbp + 8]
cmp rbx, r12
je 0x14012aa9b
mov rbp, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14012aa72
mov rdx, qword [rdx]
lea rcx, [rsp + 0x40]
cmp r14, 0xf
cmova rcx, rsi
cmp rdi, rax
jne 0x14012aa90
mov r8, rdi
call fcn.14041c7a0
test eax, eax
je 0x14012aa9d
cmp rbx, rbp
je 0x14012aa9b
mov rbx, qword [rbx + 8]
jmp 0x14012aa60
xor ebx, ebx
test rbx, rbx
cmove rbx, r12
mov rcx, qword [rsp + 0x38]
cmp rbx, r12
je 0x14012aaf0
mov rdi, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x14012aaf6
lea rbx, [r15 + 8]
mov qword [rsp + 0x20], 0
mov r9d, 8
lea r8, [rsp + 0x60]
mov edx, 0x1a
mov rcx, qword [rbx]
call rdi
mov rcx, rbx
test eax, eax
js 0x14012aafa
test r13, r13
je 0x14012aafa
mov dil, 1
jmp 0x14012ab00
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [r15 + 8]
xor dil, dil
mov rbx, rcx
cmp r14, 0xf
jbe 0x14012ab33
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14012ab2b
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012ab82
mov rcx, rsi
call fcn.1403e5198
test dil, dil
je 0x14012ab58
mov qword [rsp + 0x20], 0
mov r9d, 0x250
mov r8, r13
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1403e5550
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1403eb834
int3
Function at 0x14012ab90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x140713740]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x38], rdx
mov r13, rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [r11 - 0x58], xmm0
mov dword [r11 - 0x48], ebx
call fcn.1400fd420
mov rbp, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov r8d, 0x19
lea rdx, str.NtQueryInformationProcess
lea rcx, [rsp + 0x40]
call fcn.1400fe440
nop
mov dword [rsp + 0x30], 1
call fcn.14010e720
lea r12, [rbp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x40]
mov rsi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x58]
cmp r14, 0xf
cmova r8, rsi
movabs rdx, 0xcbf29ce484222325
mov ecx, ebx
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x14012ac84
movabs r9, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rdi
jb 0x14012ac70
mov rcx, qword [rbp + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r15, qword [rbp + 8]
cmp rbx, r15
je 0x14012aceb
mov rbp, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14012acc2
mov rdx, qword [rdx]
lea rcx, [rsp + 0x40]
cmp r14, 0xf
cmova rcx, rsi
cmp rdi, rax
jne 0x14012ace0
mov r8, rdi
call fcn.14041c7a0
test eax, eax
je 0x14012aced
cmp rbx, rbp
je 0x14012aceb
mov rbx, qword [rbx + 8]
jmp 0x14012acb0
xor ebx, ebx
test rbx, rbx
cmove rbx, r15
mov rcx, r12
cmp rbx, r15
je 0x14012ad44
mov rdi, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x14012ad4a
lea rbx, [r13 + 8]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, gethostbyname
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rbx]
call rdi
mov rcx, rbx
mov rbp, qword [rsp + 0x38]
test eax, eax
js 0x14012ad53
test rbp, rbp
je 0x14012ad53
mov dil, 1
jmp 0x14012ad59
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [r13 + 8]
mov rbp, qword [rsp + 0x38]
xor dil, dil
mov rbx, rcx
cmp r14, 0xf
jbe 0x14012ad8c
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14012ad84
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012ade1
mov rcx, rsi
call fcn.1403e5198
test dil, dil
je 0x14012adb1
mov qword [rsp + 0x20], 0
mov r9d, 0x388
mov r8, rbp
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.1403e5550
mov rbx, qword [rsp + 0xf0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1403eb834
int3
Function at 0x14012adf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x140713740]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r13, r8
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
cmp byte [rcx + 0x15], bl
jne 0x14012ae38
xor eax, eax
jmp 0x14012b020
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x88], xmm0
mov dword [rsp + 0x98], ebx
call fcn.1400fd420
mov rbp, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov r8d, 0x18
lea rdx, str.NtQueryInformationThread
lea rcx, [rsp + 0x38]
call fcn.1400fe440
nop
mov dword [rsp + 0x30], 1
call fcn.14010e720
lea r12, [rbp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x38]
mov rsi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x50]
cmp r14, 0xf
cmova r8, rsi
movabs rdx, 0xcbf29ce484222325
mov rcx, rbx
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x14012aef4
movabs r9, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rdi
jb 0x14012aee0
mov rcx, qword [rbp + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r15, qword [rbp + 8]
cmp rbx, r15
je 0x14012af5b
mov rbp, qword [rax + rcx*8]
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14012af32
mov rdx, qword [rdx]
lea rcx, [rsp + 0x38]
cmp r14, 0xf
cmova rcx, rsi
cmp rdi, rax
jne 0x14012af50
mov r8, rdi
call fcn.14041c7a0
test eax, eax
je 0x14012af5d
cmp rbx, rbp
je 0x14012af5b
mov rbx, qword [rbx + 8]
jmp 0x14012af20
xor ebx, ebx
test rbx, rbx
cmove rbx, r15
mov rcx, r12
cmp rbx, r15
je 0x14012afa9
mov rbx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14012afaf
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, gethostbyname
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call rbx
test eax, eax
js 0x14012afaf
test r13, r13
je 0x14012afaf
mov bl, 1
jmp 0x14012afb1
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor bl, bl
cmp r14, 0xf
jbe 0x14012afe4
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14012afdc
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14012b04b
mov rcx, rsi
call fcn.1403e5198
test bl, bl
je 0x14012b015
mov rdx, qword [rsp + 0x70]
add rdx, 0x2000
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, r13
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x70]
add rax, 0x2000
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1403e5550
mov rbx, qword [rsp + 0x108]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1403eb834
int3