joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140041270
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x1400413c4
cmp r9, 4
jb 0x1400412ba
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x1400412a0
xor r11d, r11d
test r9, r9
je 0x1400413c4
cmp r9, 0x40
jb 0x1400413a3
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x1400412ec
cmp rdx, r8
jae 0x1400413a3
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x140041301
cmp rdx, r10
jae 0x1400413a3
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp], rdi
mov rdi, r9
and rdi, 0xffffffffffffffc0
mov rdx, r10
lea rax, [r8 + 0x10]
sub rdx, r8
mov rbx, rcx
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rdi
jb 0x140041330
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
cmp r11, r9
jae 0x1400413c4
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x1400413b0
add rsp, 8
ret
Function at 0x1400464c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r12
push r13
mov rbp, r8
mov rbx, rdx
mov r11, rcx
mov rsi, rdx
movabs r12, 0x82434fe90edcef39
movabs r13, 0xec99bf0d8372caab
cmp rdx, 0x20
jbe 0x1400465bd
mov qword [rsp + 0x28], rdi
mov rdi, r8
mov qword [rsp + 0x30], r14
mov r14, rdx
ror r14, 0x11
ror rdi, 0x11
add r14, r8
mov qword [rsp + 0x38], r15
xor rdi, rdx
lea r15, [rdx - 0x1f]
add r15, rcx
nop
mov r10, qword [r11 + 0x10]
mov rax, qword [r11]
mov r8, qword [r11 + 0x18]
mov r9, qword [r11 + 8]
add r11, 0x20
lea rdx, [r10 + rdi]
ror rdx, 0x11
xor rdx, rax
lea rcx, [r8 + r14]
ror rax, 0x29
xor rax, rbp
ror rcx, 0x11
add r14, rax
xor rcx, r9
ror r9, 0x1f
lea rax, [rdx + r8]
imul rax, r12
xor r9, rsi
xor rbp, rax
sub rdi, r9
lea rax, [rcx + r10]
imul rax, r13
xor rsi, rax
cmp r11, r15
jb 0x140046520
mov r15, qword [rsp + 0x38]
mov rax, r14
ror rax, 0x11
movabs rcx, 0xcb5af53ae3aaac31
add rax, rdi
ror rdi, 0x11
add rdi, r14
mov r14, qword [rsp + 0x30]
imul rax, rcx
xor rbp, rax
movabs rax, 0xc060724a8424f345
imul rdi, rax
xor rsi, rdi
mov rdi, qword [rsp + 0x28]
and ebx, 0x1f
movabs r8, 0x9c06faf4d023e3ab
cmp rbx, 0x18
ja case.default.0x1400465e6
lea rdx, [0x140000000]
movzx eax, byte [rdx + rbx + 0x466a8]
mov ecx, dword [rdx + rax*4 + 0x46698]
add rcx, rdx
jmp rcx
mov rax, r8
mul qword [r11]
xor rdx, rax
add rsi, rdx
add r11, 8
movabs rax, 0xbd9cacc22c6e9571
mul qword [r11]
xor rdx, rax
add rbp, rdx
add r11, 8
movabs rax, 0xd4f06db99d67be4b
mul qword [r11]
xor rdx, rax
add rsi, rdx
add r11, 8
neg ebx
and ebx, 7
lea ecx, [rbx*8]
test r11, 0xff8
je 0x140046648
mov eax, ebx
sub r11, rax
mov rdx, qword [r11]
shr rdx, cl
jmp 0x140046655
mov rdx, 0xffffffffffffffff
shr rdx, cl
and rdx, qword [r11]
mov rax, r12
mul rdx
xor rdx, rax
add rbp, rdx
mov rbx, qword [rsp + 0x40]
lea rcx, [rsi + rbp]
ror rcx, 0x11
xor rsi, rbp
imul rsi, r13
mov rax, r8
mul rcx
mov rcx, rax
mov rax, rsi
ror rax, 0x29
xor rdx, rcx
xor rax, rsi
add rax, rdx
pop r13
pop r12
pop rsi
pop rbp
ret
Function at 0x1400bc283
Capabilities:
Set thread local storage value

Disassembly:
push rax
pushf
mov eax, 0xadfb559b
pushf
not eax
add eax, 0xc3f38c83
xor eax, 0xa9b001b9
rol eax, 0xe4
popf
pushf
not eax
add eax, 0xca2d9856
xor eax, 0xc8c60091
rol eax, 0xc4
popf
pushf
not eax
add eax, 0x955e6fa8
xor eax, 0xbe9c3feb
rol eax, 0xb3
popf
cmp eax, 2
jne 0x1400bc2d3
popf
pop rax
jmp 0x1400bc406
cmp eax, 0
jne 0x1400bc2e2
popf
pop rax
jmp 0x1400bc300
cmp eax, 3
jne 0x1400bc2f1
popf
pop rax
jmp 0x1400bc43f
cmp eax, 1
jne 0x1400bc300
popf
pop rax
jmp 0x1400bc3fd
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x1c007f742]
pushf
sub r9, 0x7fffc7fa
popf
mov edi, ecx
lea rdx, [0x1b90aee7a]
pushf
sub rdx, 0x7902bf32
popf
mov ecx, 0x6d6323a0
pushf
not ecx
add ecx, 0xe3711420
xor ecx, 0xa0f3c783
rol ecx, 0x40
popf
pushf
not ecx
add ecx, 0xa552962c
xor ecx, 0xce4c5e2f
rol ecx, 0xd
popf
lea r8, [0x1bcfd9a8e]
pushf
sub r8, 0x7cf56b4e
popf
call fcn.14005463c
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x1400bc3c9
push rax
pushf
mov eax, 0xd8846d7e
pushf
not eax
add eax, 0xe566b265
xor eax, 0xe5deedd9
rol eax, 0x20
popf
pushf
not eax
add eax, 0xfb9880e7
xor eax, 0x9cf98978
rol eax, 0xa
popf
pushf
not eax
add eax, 0x85023290
xor eax, 0xfb86b475
rol eax, 0x3b
popf
jmp 0x1400bc2c4
push rax
pushf
mov eax, 0x6a903539
pushf
not eax
add eax, 0xe5d1f191
xor eax, 0xec9eda95
rol eax, 7
popf
pushf
not eax
add eax, 0xb5ef31d3
xor eax, 0xc63b5087
rol eax, 0x92
popf
jmp 0x1400bc2c4
call qword [str.px_a_]
jmp 0x1400bc43f
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
push rax
pushf
mov eax, 0xcfeb4284
pushf
not eax
add eax, 0xe068239b
xor eax, 0xf045c3c6
rol eax, 0xde
popf
pushf
not eax
add eax, 0xf2990ff4
xor eax, 0xba8b473f
rol eax, 0xb1
popf
jmp 0x1400bc2c4
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c118f
Capabilities:
Hash data using murmur3

Disassembly:
push rax
pushf
mov eax, 0xa21ef687
pushf
not eax
add eax, 0xba813065
xor eax, 0xf305f945
rol eax, 0x72
popf
pushf
not eax
add eax, 0xac5e0e8d
xor eax, 0xa9fa60ed
rol eax, 6
popf
cmp eax, 4
jne 0x1400c11cc
popf
pop rax
jmp 0x1400c1460
cmp eax, 0
jne 0x1400c11db
popf
pop rax
jmp 0x1400c1217
cmp eax, 3
jne 0x1400c11ea
popf
pop rax
jmp 0x1400c13c4
cmp eax, 1
jne 0x1400c11f9
popf
pop rax
jmp 0x1400c1300
cmp eax, 5
jne 0x1400c1208
popf
pop rax
jmp 0x1400c14bb
cmp eax, 2
jne 0x1400c1217
popf
pop rax
jmp 0x1400c13ad
push rbx
sub rsp, 0x20
movabs rax, 0xd6d39ec4715d47b0
pushf
not rax
add rax, 0x607e745d
xor rax, 0x50d32cac
rol rax, 0x9c
popf
pushf
not rax
add rax, 0x619c67b4
xor rax, 0x5c6715aa
rol rax, 0xc6
popf
pushf
not rax
add rax, 0x686198ff
xor rax, 0x734b6992
rol rax, 0x4a
popf
mov r9, rdx
cmp rcx, rax
jae 0x1400c12a7
push rax
pushf
mov eax, 0x266a6408
pushf
not eax
add eax, 0xed722e7d
xor eax, 0x97b36a14
rol eax, 0xb3
popf
pushf
not eax
add eax, 0x9553e50f
xor eax, 0x92515d69
rol eax, 0xf7
popf
jmp 0x1400c11bd
push rax
pushf
mov eax, 0x296a9841
pushf
not eax
add eax, 0xf0a28a42
xor eax, 0x9d4b5946
rol eax, 0x58
popf
pushf
not eax
add eax, 0x8b35522f
xor eax, 0xa9f21fd4
rol eax, 0xe1
popf
pushf
not eax
add eax, 0x87fd0371
xor eax, 0xb7dd5f3a
rol eax, 0x23
popf
pushf
not eax
add eax, 0x9d51168c
xor eax, 0xc99786b3
rol eax, 0x2f
popf
jmp 0x1400c11bd
xor edx, edx
or rax, 0xffffffffffffffff
div r8
cmp r9, rax
jae 0x1400c1367
push rax
pushf
mov eax, 0x496d0546
pushf
not eax
add eax, 0xaa034afa
xor eax, 0xae82044a
rol eax, 0xf1
popf
pushf
not eax
add eax, 0xe8fe63ba
xor eax, 0xd106e6ac
rol eax, 0xab
popf
pushf
not eax
add eax, 0xca48dcab
xor eax, 0x9b6236e3
rol eax, 0x21
popf
pushf
not eax
add eax, 0xdb488007
xor eax, 0xf48ecc33
rol eax, 0x48
popf
jmp 0x1400c11bd
push rax
pushf
mov eax, 0x27334e70
pushf
not eax
add eax, 0x9b3e4fb0
xor eax, 0xd9a059df
rol eax, 0x7e
popf
pushf
not eax
add eax, 0xd419db92
xor eax, 0x89de0f27
rol eax, 0x5c
popf
pushf
not eax
add eax, 0xa1302d70
xor eax, 0xbf391cc8
rol eax, 0xad
popf
jmp 0x1400c11bd
shl rcx, 3
imul r9, r8
mov rax, rcx
not rax
cmp rax, r9
jbe 0x1400c1460
push r9
not r9
sub rcx, r9
pop r9
sub rcx, 1
mov edx, 0xdc95210e
pushf
not edx
add edx, 0x9f32a9ee
xor edx, 0xf33a44e9
rol edx, 0xf
popf
pushf
not edx
add edx, 0x8332e0df
xor edx, 0x93325db5
rol edx, 0x9b
popf
pushf
not edx
add edx, 0xa5caff9c
xor edx, 0xb551d2ee
rol edx, 0xd
popf
call fcn.140182714
xor ecx, ecx
mov rbx, rax
call fcn.1402e3b5e
mov rax, rbx
jmp 0x1400c14bb
xor eax, eax
push rax
pushf
mov eax, 0xd224d2fc
pushf
not eax
add eax, 0xc8a2f60c
xor eax, 0xc0e4c528
rol eax, 0x93
popf
pushf
not eax
add eax, 0x9c8ab2c1
xor eax, 0xd1b12cee
rol eax, 0xab
popf
pushf
not eax
add eax, 0xd9cef7a5
xor eax, 0xb3eaa107
rol eax, 0x7d
popf
pushf
not eax
add eax, 0xe401c95a
xor eax, 0x94ec4c40
rol eax, 0x17
popf
jmp 0x1400c11bd
add rsp, 0x20
pop rbx
ret
Function at 0x1401076fb
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x2362697d
pushf
not eax
add eax, 0xf7ba8404
xor eax, 0xc5cd1fe5
rol eax, 0x60
popf
pushf
not eax
add eax, 0xc50731cf
xor eax, 0x9a9139c3
rol eax, 0x1f
popf
pushf
not eax
add eax, 0xe335d2b8
xor eax, 0xc5f713ff
rol eax, 0xcc
popf
pushf
not eax
add eax, 0xc84cd5ec
xor eax, 0x930b1530
rol eax, 0x79
popf
cmp eax, 4
jne 0x14010775e
popf
pop rax
jmp 0x140107942
cmp eax, 0
jne 0x14010776d
popf
pop rax
jmp 0x14010779a
cmp eax, 3
jne 0x14010777c
popf
pop rax
jmp 0x1401078f7
cmp eax, 1
jne 0x14010778b
popf
pop rax
jmp 0x140107845
cmp eax, 2
jne 0x14010779a
popf
pop rax
jmp 0x14010789c
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
jne 0x1401077ec
push rax
pushf
mov eax, 0xb7a679de
pushf
not eax
add eax, 0xc5927fb5
xor eax, 0x9923c3c2
rol eax, 0xa8
popf
pushf
not eax
add eax, 0xb06c71d8
xor eax, 0xe0a64d43
rol eax, 0x34
popf
jmp 0x14010774f
push rax
pushf
mov eax, 0x193bea37
pushf
not eax
add eax, 0xf9a1416d
xor eax, 0x97933ea2
rol eax, 0x4b
popf
pushf
not eax
add eax, 0xe92cc9fb
xor eax, 0xc28f4935
rol eax, 5
popf
pushf
not eax
add eax, 0xeedc6cfe
xor eax, 0x86e2b692
rol eax, 0x25
popf
pushf
not eax
add eax, 0xb4731fa1
xor eax, 0xf2cb6df0
rol eax, 0xeb
popf
jmp 0x14010774f
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
push rax
pushf
mov eax, 0x4b82fb4d
pushf
not eax
add eax, 0x94f4e9a9
xor eax, 0xc18ea9d9
rol eax, 0x52
popf
pushf
not eax
add eax, 0xb7a7160b
xor eax, 0xb6cf9a8e
rol eax, 0xb9
popf
pushf
not eax
add eax, 0x9abde4c7
xor eax, 0x94df3df5
rol eax, 0x2a
popf
jmp 0x14010774f
mov r8, qword [rbx + 0x10]
mov rdx, rsi
mov rcx, rbp
call fcn.1401076fb
mov rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.1401a2052
mov edx, 0xf0e5cf9a
pushf
not edx
add edx, 0x8aae04c1
xor edx, 0xeb334de3
rol edx, 0x3b
popf
pushf
not edx
add edx, 0xd05d53b5
xor edx, 0xa4c5d7ee
rol edx, 0x77
popf
mov rcx, rdi
call fcn.14019a0bc
cmp byte [rbx + 0x19], 0
je 0x14010789c
mov rdi, qword [rsp + 0x30]
push rax
pushf
mov eax, 0x13b887b5
pushf
not eax
add eax, 0xa639acc0
xor eax, 0xa9305172
rol eax, 0xf1
popf
pushf
not eax
add eax, 0xd92d7870
xor eax, 0x8e2db8cb
rol eax, 0x53
popf
pushf
not eax
add eax, 0xc6bbc3f4
xor eax, 0xf887d37e
rol eax, 0xbe
popf
jmp 0x14010774f
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x140136f52
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xcc6bd2d9
pushf
not eax
add eax, 0xb204402a
xor eax, 0xa7999643
rol eax, 2
popf
pushf
not eax
add eax, 0xf1247d7a
xor eax, 0xe91c912c
rol eax, 0x30
popf
cmp eax, 4
jne 0x140136f8f
popf
pop rax
jmp 0x14013714d
cmp eax, 0
jne 0x140136f9e
popf
pop rax
jmp 0x140136fcb
cmp eax, 3
jne 0x140136fad
popf
pop rax
jmp 0x140137115
cmp eax, 1
jne 0x140136fbc
popf
pop rax
jmp 0x140137066
cmp eax, 2
jne 0x140136fcb
popf
pop rax
jmp 0x1401370ba
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rbx, qword [rcx]
mov rbp, rdx
mov rsi, rcx
mov rbx, qword [rbx + 8]
cmp byte [rbx + 0x19], 0
jne 0x140137020
push rax
pushf
mov eax, 0x93614d73
pushf
not eax
add eax, 0xc97fd626
xor eax, 0xbc821f15
rol eax, 0xaa
popf
pushf
not eax
add eax, 0xf95cab22
xor eax, 0x86fe4cf7
rol eax, 0xf2
popf
jmp 0x140136f80
push rax
pushf
mov eax, 0xe925da97
pushf
not eax
add eax, 0xb7559e2c
xor eax, 0xbfaf30de
rol eax, 0x92
popf
pushf
not eax
add eax, 0x8aee9eb8
xor eax, 0x80ed9d8c
rol eax, 0xc8
popf
pushf
not eax
add eax, 0xd04d58d9
xor eax, 0xa708209a
rol eax, 0x22
popf
jmp 0x140136f80
mov qword [rsp + 0x30], rdi
nop word [rax + rax]
push rax
pushf
mov eax, 0xc1992fbd
pushf
not eax
add eax, 0x9f06fd5d
xor eax, 0xd122e5f5
rol eax, 0x10
popf
pushf
not eax
add eax, 0x899c1d57
xor eax, 0xa94f6ea0
rol eax, 0xcc
popf
pushf
not eax
add eax, 0x8a85317c
xor eax, 0xb28ab0f4
rol eax, 0x77
popf
jmp 0x140136f80
mov r8, qword [rbx + 0x10]
mov rdx, rbp
mov rcx, rsi
call fcn.1401076fb
mov rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.1401a2052
mov edx, 0x9283bb0c
pushf
not edx
add edx, 0xcdd8ebf2
xor edx, 0xffde7466
rol edx, 0xe9
popf
pushf
not edx
add edx, 0xf05bf5ce
xor edx, 0xd9d2ee4e
rol edx, 0xa3
popf
mov rcx, rdi
call fcn.14019a0bc
cmp byte [rbx + 0x19], 0
je 0x1401370ba
mov rdi, qword [rsp + 0x30]
push rax
pushf
mov eax, 0xcd44e2d3
pushf
not eax
add eax, 0xdfb0439e
xor eax, 0xe44ccc3d
rol eax, 9
popf
pushf
not eax
add eax, 0xd339e0ca
xor eax, 0x83dff0dc
rol eax, 0x62
popf
jmp 0x140136f80
mov rcx, qword [rsi]
mov edx, 0x2128bca8
pushf
not edx
add edx, 0xcef8d480
xor edx, 0x91c4951e
rol edx, 0x12
popf
pushf
not edx
add edx, 0xf083f3c4
xor edx, 0xe5770371
rol edx, 0x31
popf
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp fcn.14019a0bc
Function at 0x1401371ec
Capabilities:
Get thread local storage value

Disassembly:
push rax
pushf
mov eax, 0x31f3f168
pushf
not eax
add eax, 0xb76384c1
xor eax, 0xbe144cf1
rol eax, 0x65
popf
pushf
not eax
add eax, 0xef6edc88
xor eax, 0x8976b667
rol eax, 0x99
popf
pushf
not eax
add eax, 0x913402dd
xor eax, 0x8146fa3a
rol eax, 0xdb
popf
cmp eax, 2
jne 0x14013723c
popf
pop rax
jmp 0x14013736b
cmp eax, 0
jne 0x14013724b
popf
pop rax
jmp 0x14013725a
cmp eax, 1
jne 0x14013725a
popf
pop rax
jmp 0x14013735f
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x1ba725217]
pushf
sub r9, 0x7a6a22e7
popf
mov ecx, 0x6c183340
pushf
not ecx
add ecx, 0xefd56b09
xor ecx, 0xe1a2cda3
rol ecx, 0xf
popf
pushf
not ecx
add ecx, 0x9e1172cf
xor ecx, 0xa2dbc1bf
rol ecx, 0x28
popf
lea r8, [0x1bfb8fff5]
pushf
sub r8, 0x7fb0d0cd
popf
lea rdx, [0x192bc3c96]
pushf
sub rdx, 0x52b40d66
popf
call fcn.14005463c
mov ecx, ebx
test rax, rax
je 0x140137306
push rax
pushf
mov eax, 0x3ed015df
pushf
not eax
add eax, 0xa7c54215
xor eax, 0xf5864e64
rol eax, 0x9c
popf
pushf
not eax
add eax, 0xa7289c5e
xor eax, 0x8d556638
rol eax, 0xae
popf
jmp 0x14013722d
push rax
pushf
mov eax, 0x34bfcda4
pushf
not eax
add eax, 0xd5601657
xor eax, 0x9c562c50
rol eax, 0x98
popf
pushf
not eax
add eax, 0xef93db5e
xor eax, 0x8e113a84
rol eax, 0x43
popf
pushf
not eax
add eax, 0x8760cf94
xor eax, 0xc5d87bb5
rol eax, 0x29
popf
pushf
not eax
add eax, 0xdc474e85
xor eax, 0xe9072932
rol eax, 0x21
popf
jmp 0x14013722d
add rsp, 0x20
pop rbx
jmp qword [str.px_a_]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x14014222e
Capabilities:
Allocate thread local storage

Disassembly:
push rax
pushf
mov eax, 0x73b3eabe
pushf
not eax
add eax, 0xf5b2d556
xor eax, 0xbc43c70f
rol eax, 0xe3
popf
pushf
not eax
add eax, 0xa36bff68
xor eax, 0xb58292a6
rol eax, 0x47
popf
cmp eax, 2
jne 0x14014226b
popf
pop rax
jmp 0x14014236f
cmp eax, 0
jne 0x14014227a
popf
pop rax
jmp 0x140142289
cmp eax, 1
jne 0x140142289
popf
pop rax
jmp 0x140142360
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x1ab049178]
pushf
sub r9, 0x6afc6270
popf
xor ecx, ecx
lea r8, [0x1be2d3ed6]
pushf
sub r8, 0x7e250fd6
popf
lea rdx, [0x1b72582a5]
pushf
sub rdx, 0x771d539d
popf
call fcn.14005463c
test rax, rax
je 0x14014231a
push rax
pushf
mov eax, 0x7d2f76d2
pushf
not eax
add eax, 0xc1147c64
xor eax, 0xeb059a7e
rol eax, 0x7d
popf
pushf
not eax
add eax, 0xb821f53f
xor eax, 0xe62a7d7c
rol eax, 5
popf
pushf
not eax
add eax, 0xa0269a82
xor eax, 0xfa3312d5
rol eax, 0x1d
popf
jmp 0x14014225c
push rax
pushf
mov eax, 0xebabb2c
pushf
not eax
add eax, 0xc0267f12
xor eax, 0xfec4f364
rol eax, 0x9e
popf
pushf
not eax
add eax, 0x8071ca0e
xor eax, 0xe3fb9145
rol eax, 0xc7
popf
pushf
not eax
add eax, 0xb8b57abf
xor eax, 0xf97f2655
rol eax, 0xa0
popf
jmp 0x14014225c
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [str.px_a_]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x14017bbdd
Capabilities:
Terminate process

Disassembly:
push rax
pushf
mov eax, 0x11ffd5e5
pushf
not eax
add eax, 0xdf8d5b4b
xor eax, 0xd7f42673
rol eax, 0xce
popf
pushf
not eax
add eax, 0xed1a2d2a
xor eax, 0x8454a68b
rol eax, 0xba
popf
cmp eax, 2
jne 0x14017bc1a
popf
pop rax
jmp 0x14017bcc2
cmp eax, 0
jne 0x14017bc29
popf
pop rax
jmp 0x14017bc38
cmp eax, 1
jne 0x14017bc38
popf
pop rax
jmp 0x14017bcb0
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.14021418e
test al, al
je 0x14017bc7c
push rax
pushf
mov eax, 0xaa37a117
pushf
not eax
add eax, 0x9b81ec84
xor eax, 0xc9c03177
rol eax, 0x38
popf
pushf
not eax
add eax, 0xe4dd0370
xor eax, 0xc9a479f5
rol eax, 0x38
popf
jmp 0x14017bc0b
push rax
pushf
mov eax, 0xfb646f2d
pushf
not eax
add eax, 0x867303db
xor eax, 0xf4d64e31
rol eax, 0x30
popf
pushf
not eax
add eax, 0xbaf6eb5e
xor eax, 0xe04a6b85
rol eax, 0xd
popf
jmp 0x14017bc0b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
jmp 0x14017bcbc
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.14016d3b9
mov ecx, ebx
jmp 0x14017bccc
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1401abb98
Capabilities:
Get geographical location

Disassembly:
push rax
pushf
mov eax, 0x77f4e741
pushf
not eax
add eax, 0xd8d120bf
xor eax, 0x9ed36a64
rol eax, 0xc0
popf
pushf
not eax
add eax, 0xbe2033f3
xor eax, 0xe4c7bef9
rol eax, 0x73
popf
pushf
not eax
add eax, 0x8333c358
xor eax, 0x9b9e1419
rol eax, 0xbe
popf
pushf
not eax
add eax, 0x98f7b645
xor eax, 0x968c9423
rol eax, 0xfb
popf
cmp eax, 2
jne 0x1401abbfb
popf
pop rax
jmp 0x1401abde6
cmp eax, 0
jne 0x1401abc0a
popf
pop rax
jmp 0x1401abc28
cmp eax, 3
jne 0x1401abc19
popf
pop rax
jmp 0x1401abe5a
cmp eax, 1
jne 0x1401abc28
popf
pop rax
jmp 0x1401abd7d
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
mov esi, edx
lea r9, [0x189cbea77]
pushf
sub r9, 0x49c37bbf
popf
mov rbp, rcx
lea r8, [0x1b1c1d79c]
pushf
sub r8, 0x71b968ec
popf
lea rdx, [0x1a076c25b]
pushf
sub rdx, 0x606e53a3
popf
mov ecx, 0xee8c413d
pushf
not ecx
add ecx, 0x8ec7c1d5
xor ecx, 0xb3655855
rol ecx, 0x72
popf
pushf
not ecx
add ecx, 0xe23c3171
xor ecx, 0xad6a8abe
rol ecx, 0x95
popf
pushf
not ecx
add ecx, 0xd0b02ad8
xor ecx, 0xa335dfaa
rol ecx, 0x29
popf
call fcn.14006aafc
test rax, rax
je 0x1401abd24
push rax
pushf
mov eax, 0x94234267
pushf
not eax
add eax, 0x9ea3347e
xor eax, 0x99eeb782
rol eax, 0x48
popf
pushf
not eax
add eax, 0xe57973c8
xor eax, 0xd60e8dfe
rol eax, 0x67
popf
pushf
not eax
add eax, 0x9dbcd693
xor eax, 0xac9361e7
rol eax, 0x12
popf
pushf
not eax
add eax, 0xd860c192
xor eax, 0x95a57391
rol eax, 0x8b
popf
jmp 0x1401abbec
push rax
pushf
mov eax, 0x93e642e1
pushf
not eax
add eax, 0xc4b618ff
xor eax, 0x89db95b6
rol eax, 0x44
popf
pushf
not eax
add eax, 0xaf7cff22
xor eax, 0x862251a3
rol eax, 0x1e
popf
pushf
not eax
add eax, 0xde47910a
xor eax, 0xa685c6dc
rol eax, 0x83
popf
pushf
not eax
add eax, 0x8c5fd004
xor eax, 0x963645dd
rol eax, 0x54
popf
jmp 0x1401abbec
movabs r10, 0x621a5504ef765207
pushf
not r10
add r10, 0x5f6fa1c4
xor r10, 0x6cbcc8b0
rol r10, 0xc
popf
pushf
not r10
add r10, 0x6d25dfcd
xor r10, 0x4b8c005d
rol r10, 0xe9
popf
pushf
not r10
add r10, 0x582da558
xor r10, 0x44df055a
rol r10, 0x3e
popf
mov r9d, ebx
mov r8, rdi
mov edx, esi
mov rcx, rbp
jmp 0x1401abdde
call qword [0x14007c520]
jmp 0x1401abe5a
xor edx, edx
mov rcx, rbp
call fcn.1401cd16a
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
jmp 0x1401abdfb
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push rax
pushf
mov eax, 0xed494d05
pushf
not eax
add eax, 0xf9f9e968
xor eax, 0xb5de0ca4
rol eax, 0x8c
popf
pushf
not eax
add eax, 0xa649c990
xor eax, 0xb395c023
rol eax, 0x47
popf
pushf
not eax
add eax, 0xb393864e
xor eax, 0xfad094a8
rol eax, 0x4e
popf
pushf
not eax
add eax, 0x9ce613fd
xor eax, 0x996a6a9b
rol eax, 0xfe
popf
jmp 0x1401abbec
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1403161c7
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x7ea76c58
pushf
not eax
add eax, 0x87f8673e
xor eax, 0xd4c5ca8e
rol eax, 0x5e
popf
pushf
not eax
add eax, 0xace1da08
xor eax, 0xc66692e6
rol eax, 0xbf
popf
pushf
not eax
add eax, 0xa9d0c30d
xor eax, 0xf043b387
rol eax, 0x65
popf
cmp eax, 2
jne 0x140316217
popf
pop rax
jmp 0x14031631f
cmp eax, 0
jne 0x140316226
popf
pop rax
jmp 0x140316235
cmp eax, 1
jne 0x140316235
popf
pop rax
jmp 0x1403162aa
push rbx
sub rsp, 0x40
mov rax, qword [0x1400a21c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
xor r10d, r10d
lea r9, [rsp + 0x34]
mov qword [rcx], r10
mov r8, rdx
mov dword [rcx + 8], r10d
mov rbx, rcx
mov byte [rsp + 0x34], r10b
push rax
pushf
mov eax, 0xac6e2a5e
pushf
not eax
add eax, 0xb1ebd24e
xor eax, 0xe47512ba
rol eax, 3
popf
pushf
not eax
add eax, 0x841440a2
xor eax, 0xc4825999
rol eax, 0x9e
popf
pushf
not eax
add eax, 0xb1d5ec7a
xor eax, 0xc242b95f
rol eax, 0x4a
popf
jmp 0x140316208
dec r9
movabs rax, 0x41b4507e6e5a48cf
pushf
not rax
add rax, 0x64ad0dde
xor rax, 0x5d61eb59
rol rax, 0xe7
popf
pushf
not rax
add rax, 0x5c16e74b
xor rax, 0x4d494013
rol rax, 0x6e
popf
pushf
not rax
add rax, 0x69ffce73
xor rax, 0x52910973
rol rax, 0x39
popf
mul r8
shr rdx, 3
mov al, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8, rdx
test rdx, rdx
jne 0x1403162aa
lea r8, [rsp + 0x34]
mov rdx, r9
sub r8d, r9d
mov rcx, rbx
call fcn.140102478
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14021cfd0
add rsp, 0x40
pop rbx
ret
Function at 0x14032edb0
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword gs:[0x60]
xor r11d, r11d
mov rsi, r8
mov ebp, edx
mov rdi, qword [rax + 0x10]
movsxd rbx, dword [rdi + 0x3c]
add rbx, rdi
movzx eax, word [rbx + 0x14]
lea r9, [rbx + 0x18]
movzx r10d, word [rbx + 6]
add r9, rax
test r10, r10
je 0x14032ee6f
mov dword [rsp + 0x20], 0x6544302e
mov byte [rsp + 0x24], 0x76
movups xmm2, xmmword [r9]
lea rcx, [rsp + 0x20]
movups xmm0, xmmword [r9 + 0x10]
movsd xmm1, qword [r9 + 0x20]
movd edx, xmm2
movups xmmword [rsp + 0x28], xmm2
movsd qword [rsp + 0x48], xmm1
movups xmmword [rsp + 0x38], xmm0
test dl, dl
je 0x14032ee57
lea rax, [rsp + 0x20]
lea r8, [rsp + 0x28]
sub r8, rax
movzx eax, dl
nop
movzx edx, al
cmp al, byte [rcx]
jne 0x14032ee57
movzx eax, byte [r8 + rcx + 1]
inc rcx
movzx edx, al
test al, al
jne 0x14032ee40
cmp dl, byte [rcx]
lea rdx, [rsp + 0x28]
cmovne rdx, r11
add r9, 0x28
mov r11, rdx
sub r10, 1
jne 0x14032ee02
mov eax, dword [r11 + 0xc]
mov rdx, rsi
mov ecx, dword [rbx + 8]
mov eax, dword [rax + rdi]
xor eax, dword [rbx + 0x68]
ror eax, cl
mov ecx, ebp
add rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
jmp rax