joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400080b8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
push r15
cmp qword [r8 + 0x18], 8
mov r11, rdx
mov rdi, qword [r8 + 0x10]
mov rbx, rcx
mov r10, r8
jb 0x1400080e6
mov r10, qword [r8]
lea rdx, [rdi + rdi]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test rdx, rdx
je 0x140008119
movzx eax, byte [rcx + r10]
movabs rsi, 0x100000001b3
xor r9, rax
inc rcx
imul r9, rsi
cmp rcx, rdx
jb 0x1400080fb
mov rcx, qword [rbx + 0x30]
mov r14, qword [rbx + 0x18]
and rcx, r9
mov rsi, qword [rbx + 8]
mov rax, rcx
add rax, rax
lea r15, [rcx + rcx]
mov rax, qword [r14 + rax*8]
cmp qword [r14 + r15*8], rsi
jne 0x140008141
mov rcx, rsi
jmp 0x140008149
mov rcx, qword [r14 + r15*8 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400081f3
cmp qword [r8 + 0x18], 8
mov rcx, r8
jb 0x14000815f
mov rcx, qword [r8]
mov rbp, qword [rax + 0x28]
lea r10, [rax + 0x10]
cmp rbp, 8
jb 0x140008171
mov r10, qword [rax + 0x10]
mov r9, qword [rax + 0x20]
cmp r9, rdi
jne 0x14000819c
test r9, r9
je 0x140008196
sub r10, rcx
movzx edx, word [rcx + r10]
cmp dx, word [rcx]
jne 0x1400081a1
add rcx, 2
sub r9, 1
jne 0x140008182
xor ecx, ecx
test ecx, ecx
je 0x1400081aa
mov rax, qword [rax]
jmp 0x140008136
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x140008198
lea rcx, [rax + 0x10]
cmp rbp, 8
jb 0x1400081b7
mov rcx, qword [rcx]
cmp qword [r8 + 0x18], 8
jb 0x1400081c1
mov r8, qword [r8]
test rdi, rdi
je 0x1400081dd
sub r8, rcx
movzx edx, word [rcx + r8]
cmp dx, word [rcx]
jne 0x1400081ea
add rcx, 2
sub rdi, 1
jne 0x1400081c9
xor ecx, ecx
test ecx, ecx
cmovne rax, rsi
mov qword [r11], rax
jmp 0x1400081f6
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
jmp 0x1400081df
mov qword [r11], rsi
mov rbx, qword [rsp + 0x18]
mov rax, r11
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
Function at 0x140009384
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rbx, r9
mov r10, r8
mov rsi, rdx
mov r9, rcx
mov r15, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x1400093c1
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
lea r11, [r15 + r15]
xor ecx, ecx
test r11, r11
je 0x1400093f4
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs rdi, 0x100000001b3
imul rdx, rdi
inc rcx
cmp rcx, r11
jb 0x1400093d6
mov r8, qword [r9 + 0x30]
and r8, rdx
mov rdi, qword [r9 + 8]
mov rax, r8
add rax, rax
mov rcx, qword [r9 + 0x18]
mov r12, qword [rcx + rax*8]
cmp rdi, r12
je 0x1400094c9
mov rdi, qword [rcx + rax*8 + 8]
mov rdi, qword [rdi]
cmp rdi, r12
je 0x1400094c9
mov rdi, qword [rdi + 8]
lea rax, [rdi + 0x10]
cmp qword [rdi + 0x28], 8
jb 0x14000943a
mov rax, qword [rdi + 0x10]
mov rdx, r10
cmp qword [r10 + 0x18], 8
jb 0x140009447
mov rdx, qword [r10]
cmp r15, qword [rdi + 0x20]
jne 0x14000941e
mov r14, r15
test r15, r15
je 0x14000946f
sub rdx, rax
movzx ecx, word [rdx + rax]
cmp cx, word [rax]
jne 0x140009524
add rax, 2
sub r14, 1
jne 0x140009458
xor eax, eax
test eax, eax
jne 0x14000941e
mov rcx, qword [rbx + 8]
mov rax, qword [rbx]
mov qword [rcx], rax
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1400094a4
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14001bf80]
lea rcx, [rbx + 0x10]
call fcn.140007cac
mov edx, 0x38
mov rcx, rbx
call fcn.1400177dc
mov qword [rsi], rdi
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x140009572
mov rax, qword [rbx]
cmp rdi, rax
je 0x1400094fe
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov r10, r8
add r10, r10
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r10*8]
add r8, r8
cmp rax, qword [r9 + 8]
jne 0x140009530
mov qword [rdx + r8*8], rbx
mov rax, qword [r9 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14000955f
sbb eax, eax
and eax, 0xfffffffe
inc eax
jmp 0x140009471
cmp rax, rdi
jne 0x14000953b
mov qword [rdx + r8*8], rbx
jmp 0x14000955f
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14000955f
mov rdx, qword [r9 + 0x18]
mov rax, qword [rdx + r10*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r10*8 + 8], rcx
mov rcx, r9
call fcn.14000958c
nop
mov qword [rsi], rbx
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140009b2c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rbx, r8
mov r14, rdx
mov r8, rcx
lea rsi, [rbx + 0x10]
cmp qword [rsi + 0x18], 8
mov r9, rsi
mov r10, qword [rsi + 0x10]
jb 0x140009b5f
mov r9, qword [rsi]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r10, r10
je 0x140009b8e
movzx eax, byte [rdx + r9]
movabs r11, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r11
cmp rdx, r10
jb 0x140009b70
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x140009bc6
cmp qword [rcx + rdx*8], rbx
jne 0x140009bbb
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x140009bbf
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140009bd3
cmp qword [rcx + rdx*8], rbx
jne 0x140009bd3
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r8 + 0x10]
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140009c02
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14001bf80]
mov rcx, rsi
call fcn.140007cac
mov edx, 0x38
mov rcx, rbx
call fcn.1400177dc
mov rbx, qword [rsp + 0x30]
mov rax, r14
mov rsi, qword [rsp + 0x38]
mov qword [r14], rdi
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x14000a8ec
Capabilities:
Get file size
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xf8
mov qword [rbp - 0x79], 0xfffffffffffffffe
mov rax, qword [0x140026c70]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15, r9
mov r14, r8
mov rax, rdx
mov rsi, rcx
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000a97f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
test edx, edx
js 0x14000aa93
mov qword [rbp - 0x71], rbx
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileSizeEx]
nop dword [rax + rax]
test eax, eax
jne 0x14000a9bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
test edx, edx
js 0x14000aaad
cmp dword [rsp + 0x44], 0
jne 0x14000aac7
mov rax, qword [rsi]
mov edx, dword [rsp + 0x40]
mov rcx, rsi
mov rax, qword [rax + 0x18]
call qword [0x14001bf80]
mov rdi, rax
test rax, rax
je 0x14000aafb
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x40]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
je 0x14000aa49
mov qword [r14], rdi
mov eax, dword [rsp + 0x40]
mov dword [r15], eax
test rbx, rbx
je 0x14000aa2c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140016ac0
add rsp, 0xf8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
nop
mov ebx, eax
mov rdx, qword [rsi]
mov rax, qword [rdx + 0x28]
mov rdx, rdi
mov rcx, rsi
call qword [0x14001bf80]
movzx edx, bx
or edx, 0x80070000
test ebx, ebx
cmovle edx, ebx
lea rcx, [rbp - 0x29]
call fcn.140001124
lea rdx, [0x140024040]
lea rcx, [rbp - 0x29]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
nop
lea rcx, [rbp - 0x69]
call fcn.140001124
lea rdx, [0x140024040]
lea rcx, [rbp - 0x69]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
nop
lea rcx, [rbp - 0x69]
call fcn.140001124
lea rdx, [0x140024040]
lea rcx, [rbp - 0x69]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
lea rdx, str.input_file_is_too_large
lea rcx, [rbp - 0x69]
call fcn.140007f64
nop
lea r8, [rbp - 0x69]
mov edx, 0x80aa0003
lea rcx, [rbp - 0x29]
call fcn.140001154
lea rdx, [0x140024040]
lea rcx, [rbp - 0x29]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
nop
lea rcx, [rbp - 0x69]
call fcn.1400010fc
lea rdx, [0x140024108]
lea rcx, [rbp - 0x69]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
Function at 0x14000ad88
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbp
mov rsi, r8
mov edi, edx
mov rbp, rcx
test rcx, rcx
je 0x14000ae9c
test r8, r8
je 0x14000ae9c
and qword [r8], 0
mov rax, qword [0x140027328]
mov ecx, dword [rax + 8]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsGetValue]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x14000adf0
mov rax, qword [rax]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [0x14001bf80]
mov r14, rdi
mov rax, qword [rbx]
mov rdx, rdi
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [0x14001bf80]
mov rdi, rax
test rax, rax
jne 0x14000ae15
mov ebp, 0x8007000e
jmp 0x14000ae6f
mov r8, r14
mov rdx, rbp
mov rcx, rdi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
and qword [rsp + 0x60], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov r8, r14
mov rdx, rbx
mov rcx, rdi
call fcn.14000aca0
mov ebp, eax
test eax, eax
jns 0x14000ae4e
mov rcx, qword [rsp + 0x60]
jmp 0x14000ae5c
xor edi, edi
mov rax, qword [rsp + 0x60]
xor ecx, ecx
mov qword [rsi], rax
xor ebp, ebp
test rcx, rcx
je 0x14000ae6f
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14001bf80]
nop
test rdi, rdi
je 0x14000ae87
mov rax, qword [rbx]
mov rdx, rdi
mov rcx, rbx
mov rax, qword [rax + 0x28]
call qword [0x14001bf80]
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
mov rcx, rbx
call qword [0x14001bf80]
nop
mov eax, ebp
jmp 0x14000aea1
mov eax, 0x80004003
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x14000f890
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x14000f9a2
mov rax, rsp
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rsi, rdx
mov r14, rcx
and qword [rax - 0x38], 0
mov dword [rax - 0x40], 0x80
mov dword [rax - 0x48], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 1]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
mov rbx, rax
mov qword [rsp + 0x80], rax
cmp rax, 0xffffffffffffffff
jne 0x14000f917
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov rdx, rsi
call fcn.14000f544
mov rax, qword [r14]
mov rcx, r14
mov rax, qword [rax + 0x20]
call qword [0x14001bf80]
mov rdi, rax
mov rcx, qword [r14]
mov rax, qword [rcx + 0x18]
mov rcx, r14
call qword [0x14001bf80]
mov rdx, rax
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
mov r8d, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
jne 0x14000f981
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov rdx, rsi
call fcn.14000f544
nop
test rbx, rbx
je 0x14000f995
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret

Function at 0x1400171a4
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140027290], eax
call fcn.140016ef0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140027290], 0
jne case.default.0x1400171fa
mov ecx, 1
call fcn.140016ef0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
pop rsp
push rsi
and byte [rdx + rax], 0x1e
test al, 0x67
scasd eax, dword [rdi]
mov ebp, 0x5e4d65e3
mov dl, 0x52
sub edi, dword [rbx + 0xc]
lodsd eax, dword [rsi]
nop
xchg ebx, eax
cmp byte [rbx + 0x2c], ah
loope 0x1400408b8
adc cl, byte [rbx + rbp*8 - 0xb]
invalid
movabs al, byte [0x2480d4396d35feae]
sub byte [rax + 0x4a], al
mov bh, 0x5b
xor al, 0xb8
lodsd eax, dword [rsi]
cmc
pop rsp
xchg edi, eax
add al, 0xbe
jl 0x14004085c
cmpsd dword [rsi], dword [rdi]
mov rdi, qword [rbx - 8]
jge 0x14004093a
invalid
fpatan
mov ecx, 0x1b278eb6
invalid
js 0x1400408e7
xor ebx, dword [rdi + rbx*8 + 0xd]
cmp byte [0x1a2f1aef2], dl
pop qword [rdi + 0x3de3e915]
invalid
Function at 0x140001a90
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x10]
mov qword [rcx], rax
mov rax, rcx
ret
Function at 0x1400035a0
Capabilities:
Delete file
Encode data using xor

Disassembly:
sub rsp, 0x68
cmp byte [reloc.WLDAP32.dll_Ordinal_79], 0
movups xmm0, xmmword [0x140181a18]
mov eax, dword [0x140181a30]
mov dword [rsp + 0x48], eax
movups xmmword [rsp + 0x30], xmm0
movsd xmm0, qword [0x140181a28]
movsd qword [rsp + 0x40], xmm0
je 0x14000376d
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140003729
movdqa xmm0, xmmword [0x1401826a0]
lea rdx, [rsp + 0x34]
movdqa xmm5, xmmword [0x140182610]
movdqa xmm4, xmmword [0x1401826f0]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x140182630]
nop dword [rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140182670]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140182670]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x18
jl 0x140003620
movaps xmm6, xmmword [rsp + 0x50]
cmp ecx, 0x1c
jge 0x14000376d
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0x1c
jl 0x140003740
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
add rsp, 0x68
ret
Function at 0x140012b20
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x140295ef8]
test rax, rax
jne 0x140012d0c
mov rax, qword gs:[0x60]
xor r11d, r11d
mov qword [rsp + 0x48], rbp
mov r9d, 0xafacb808
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x30], rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], r15
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test r11d, r11d
je 0x140012bcd
psrldq xmm0, 8
mov edx, 0xe77bdd26
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x140012bc4
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x140012bb0
cmp edx, r11d
jne 0x140012ccf
mov r10, qword [rdi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
mov ebx, ecx
shr r15, 0x20
add rbx, r10
cmp rbx, r10
je 0x140012ccf
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140012ccf
mov r14d, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0xe77bdd26
lea rax, [r14 + r8*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140012c47
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140012c30
cmp edx, r9d
je 0x140012c53
test r8d, r8d
jne 0x140012c10
jmp 0x140012ccf
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
cmp rax, rbx
jbe 0x140012ce7
lea rcx, [r15 + rbx]
cmp rax, rcx
jae 0x140012ce7
movzx ecx, byte [rax]
mov r11d, 0xe77bdd26
mov r9d, r11d
cmp cl, 0x2e
je 0x140012ca8
nop dword [rax]
movsx ecx, cl
inc rax
xor ecx, r11d
imul r11d, ecx, 0x1000193
movzx ecx, byte [rax]
cmp cl, 0x2e
jne 0x140012c90
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
je 0x140012ccb
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx ecx, byte [rax]
test cl, cl
jne 0x140012cb3
mov rdi, qword [rbp]
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x140012ce5
cmp qword [rax + 0x30], 0
jne 0x140012b80
xor eax, eax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x140295ef8], rax
add rsp, 0x38
jmp rax
Function at 0x140016440
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140294280]
xor rax, rsp
mov qword [rbp - 8], rax
cmp byte [0x140181859], 0
movsd xmm0, qword [str.ZAR_T]
movzx eax, word [0x140181858]
movsd qword [rbp - 0x30], xmm0
mov word [rbp - 0x28], ax
je 0x1400164a0
xor byte [rbp - 0x2f], 0x35
xor byte [rbp - 0x2e], 0x36
xor byte [rbp - 0x2d], 0x37
xor byte [rbp - 0x2c], 0x38
xor byte [rbp - 0x2b], 0x39
xor byte [rbp - 0x2a], 0x3a
xor byte [rbp - 0x29], 0x3b
xor byte [rbp - 0x28], 0x3c
xor byte [rbp - 0x27], 0x3d
mov byte [rbp - 0x30], WSASetLastError
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9, rax
test rax, rax
je 0x140016664
cmp byte [0x140181aad], 0
mov ecx, dword [0x140181aa8]
movsd xmm0, qword [str.pWQuJ_PlRWQ4A]
mov dword [rbp - 0x18], ecx
movzx ecx, word [0x140181aac]
mov word [rbp - 0x14], cx
mov qword [rsp + 0x60], rbx
movsd qword [rbp - 0x20], xmm0
je 0x14001662d
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x1400165f0
movdqa xmm2, xmmword [0x140182610]
mov ecx, 8
movdqa xmm4, xmmword [0x1401826f0]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x140182620]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140182630]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [str.pWQuJ_PlRWQ4A]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140182670]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401826a0]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rbp - 0x20], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140182630]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rbp - 0x1c]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140182670]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x1401826a0]
xorps xmm2, xmm0
movd dword [rbp - 0x1c], xmm2
movsxd rax, ecx
lea r8, [rbp - 0x20]
add r8, rax
nop word [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0xe
jl 0x140016600
lea rdx, [rbp - 0x20]
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14001665f
mov edx, 1
lea r9, [rbp - 0x10]
mov rcx, rax
lea r8d, [rdx + 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14001665f
mov byte [rbx], 0xc3
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140136580
add rsp, 0x50
pop rbp
ret