joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5fc0e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x5fc1b5
movdqa xmm0, xmmword [0x0083c860]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x5fc121
movdqa xmm0, xmmword [0x0083c870]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x5fc237
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x5fc20b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x0083bbe8]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x0083cdc0]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x60a780
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x60a92b
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x60a7a7
inc rcx
cmp rbx, rcx
jle 0x60a91d
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x60a7a4
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.005177e0
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rsi
test rsi, rsi
mov rdx, qword [rsp + 0x88]
cmovne rbx, rdx
mov rdx, qword [rsp + 0x80]
cmovne rax, rdx
mov rdx, qword [0x00a48858]
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.00606780
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop dword [rax]
test rcx, rcx
jne 0x60a90d
test rdx, rdx
je 0x60a8fe
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403300
xorps xmm15, xmm15
mov r14, qword [0x00aac5a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x60a8c9
xor eax, eax
lea rbx, [0x0083a340]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x00793896]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.0044ee40
jmp 0x60a8f0
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0083a1a0]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.0044ed60
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ecx, ecx
mov rdi, r9
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov rax, r9
mov rbx, rsi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
xor ecx, ecx
xor edi, edi
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463d20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0060a780
Function at 0x180002a50
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x18004f010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r15, rcx
cmp edx, 1
jne 0x180002c43
lea rcx, str.ArkAscended.exe
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180002c43
xor edx, edx
lea r8d, [rdx + 8]
lea rcx, str.C:windowsARK_ENGINE.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
xor r14d, r14d
mov dword [rsp + 0x30], r14d
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSCEnumProtocols]
cmp eax, 0xffffffff
jne 0x180002adf
cmp dword [rsp + 0x34], 0x2747
je 0x180002adf
xor ebp, ebp
mov edx, dword [rsp + 0x40]
jmp 0x180002b08
mov edx, dword [rsp + 0x30]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbp, rax
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSCEnumProtocols]
mov edx, eax
xor ecx, ecx
test edx, edx
jle 0x180002ba8
mov r9, qword [0x18004f048]
mov r10, qword [0x18004f040]
movsxd r8, ecx
imul rax, r8, 0x274
cmp r10, qword [rax + rbp + 0x14]
jne 0x180002b38
cmp r9, qword [rax + rbp + 0x1c]
je 0x180002b40
inc ecx
cmp ecx, edx
jge 0x180002b4c
jmp 0x180002b20
imul rax, r8, 0x274
mov r14d, dword [rax + rbp + 0x24]
xor edi, edi
movsxd rsi, edx
test edx, edx
jle 0x180002b96
lea rbx, [rbp + 0x2c]
nop dword [rax]
cmp dword [rbx - 4], 1
jle 0x180002b87
cmp dword [rbx], r14d
jne 0x180002b87
movsxd rax, edi
imul rcx, rax, 0x274
add rcx, 0x14
add rcx, rbp
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSCDeinstallProvider]
inc edi
add rbx, 0x274
sub rsi, 1
jne 0x180002b60
lea rdx, [rsp + 0x40]
lea rcx, [0x18004f040]
call qword [sym.imp.WS2_32.dll_WSCDeinstallProvider]
mov ecx, 0x10
call fcn.18003d610
mov qword [rax], r15
lea rcx, [0x1800026a0]
mov qword [rax + 8], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x180002d70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x50], rax
test rax, rax
je 0x180002c2f
cmp dword [rsp + 0x58], 0
jne 0x180002c08
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x180002c2b
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov al, 1
jmp 0x180002c45
mov dword [rsp + 0x58], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
xor al, al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18003d5f0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x180002d20
Capabilities:
Encode data using add xor sub operations

Disassembly:
test rdx, rdx
je 0x180002d48
imul r8d, r8d, 0x91651
lea rcx, [rcx + 1]
add r8d, 0x654a6
mov eax, r8d
shr eax, 0x10
and al, 0xbe
xor byte [rcx - 1], al
sub rdx, 1
jne 0x180002d25
ret

Function at 0x180006750
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x18004f010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], 7
lea r8d, [rax + 0x26]
lea rdx, [0x180044b60]
lea rcx, [rsp + 0x38]
call fcn.180006290
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rdx, qword [rsp + 0x38]
lea r8, [rsp + 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1800067ec
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8, rbx
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueA]
test eax, eax
je 0x1800067ec
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x180006831
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000682c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000682c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18003d64c
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18003d5f0
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x180027e80
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x18004f010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, r8
mov rsi, rdx
mov rbx, qword [0x18005a110]
cmp rbx, qword [0x18005a118]
je 0x180027f18
mov ecx, 0x10
call fcn.18003d610
mov ecx, dword [rdi]
mov dword [rax], ecx
mov qword [rax + 8], rsi
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
xor esi, esi
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x180036de0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x180027f0a
mov rax, qword [0x18005a110]
lea rcx, [rax + 0x10]
mov qword [0x18005a110], rcx
jmp 0x180027f26
mov dword [rdi], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r9, rdi
mov r8, rsi
mov rdx, rbx
call fcn.1800356d0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18003d5f0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180036580
Capabilities:
Encode data using xor

Disassembly:
mov rax, rdx
mov dword [rdx], 0xf43c5a33
mov dword [rdx + 4], 0xccf8c93a
mov dword [rdx + 8], 0x8d8da27d
mov dword [rdx + 0xc], 0x254d2ce4
mov dword [rdx + 0x10], 0x177d2030
mov dword [rdx + 0x14], 0x522e6d2b
mov dword [rdx + 0x18], 0x919fc470
mov dword [rdx + 0x1c], 0x89a78ff7
mov dword [rdx + 0x20], 0x88758064
mov dword [rdx + 0x24], 0xe9a4070a
mov dword [rdx + 0x28], 0x474e411a
mov dword [rdx + 0x2c], 0xe47946e
mov dword [rdx + 0x30], 0x8a6daa1d
mov dword [rdx + 0x34], 0xefd0b65
mov dword [rdx + 0x38], 0xec832822
mov dword [rdx + 0x3c], 0xf3c4f737
mov dword [rdx + 0x40], 0xa6eb5376
mov dword [rdx + 0x44], 0x3b52fe3
mov dword [rdx + 0x48], 0x64d8864
mov ecx, 0x8cb0
mov r8d, 0x9bbd4a7a
mov word [rdx + 0x4c], cx
mov edx, 0x27
mov rcx, rax
jmp fcn.180002ce0

Function at 0x18003a660
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov rcx, rdx
mov dword [rdx], 0xed62e7d8
mov dword [rdx + 4], 0xde534356
mov dword [rdx + 8], 0xfb5a4fa4
mov dword [rdx + 0xc], 0xdacd5861
mov dword [rdx + 0x10], 0xe7d75bef
mov dword [rdx + 0x14], 0xe1765932
mov dword [rdx + 0x18], 0xd0cb4e79
mov dword [rdx + 0x1c], 0x57c7604e
mov dword [rdx + 0x20], 0x6d5dd6f9
mov dword [rdx + 0x24], 0x7ffcf674
mov dword [rdx + 0x28], 0xdef76a6e
mov dword [rdx + 0x2c], 0x7445670e
mov dword [rdx + 0x30], 0xfae44b6e
mov dword [rdx + 0x34], 0x65c2d3ca
mov dword [rdx + 0x38], 0x534841ce
mov dword [rdx + 0x3c], 0xe27c6ade
mov dword [rdx + 0x40], 0xc3d4dbef
mov dword [rdx + 0x44], 0x656cd577
mov dword [rdx + 0x48], 0x517e5c63
mov dword [rdx + 0x4c], 0xc27fead6
mov word [rdx + 0x50], 0xa04b
mov r8d, 0x6999ad0a
mov edx, 0x52
jmp fcn.180002d20

Function at 0x18003a710
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov rcx, rdx
mov dword [rdx], 0xff56c958
mov dword [rdx + 4], 0x5cfdc74e
mov dword [rdx + 8], 0x57fe4520
mov dword [rdx + 0xc], 0x6657d041
mov dword [rdx + 0x10], 0x67c14ddd
mov dword [rdx + 0x14], 0xc142cc10
mov dword [rdx + 0x18], 0xc5eae9d9
mov dword [rdx + 0x1c], 0x5fe8415e
mov dword [rdx + 0x20], 0x62574cff
mov dword [rdx + 0x24], 0x54db4af3
mov dword [rdx + 0x28], 0xc3797569
mov dword [rdx + 0x2c], 0x76f3f0e7
mov dword [rdx + 0x30], 0x885e50e1
mov dword [rdx + 0x34], 0x5f48e442
mov dword [rdx + 0x38], 0xfe6d4bee
mov dword [rdx + 0x3c], 0x49ec41dd
mov dword [rdx + 0x40], 0x50e1dad3
mov dword [rdx + 0x44], 0xffff68e1
mov dword [rdx + 0x48], 0xf5c845c6
mov word [rdx + 0x4c], 0xaac5
mov r8d, 0xe2792946
mov edx, 0x4e
jmp fcn.180002d20
Function at 0x18003a7b0
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov rcx, rdx
mov dword [rdx], 0x6966fb5c
mov dword [rdx + 4], 0x42d74fea
mov dword [rdx + 8], 0x7fc64ba0
mov dword [rdx + 0xc], 0x56415ce5
mov dword [rdx + 0x10], 0xdbdb57e3
mov dword [rdx + 0x14], 0x657255b6
mov dword [rdx + 0x18], 0x6ccf427d
mov dword [rdx + 0x1c], 0xd34364ca
mov dword [rdx + 0x20], 0x5159d2fd
mov dword [rdx + 0x24], 0xe3f84a78
mov dword [rdx + 0x28], 0x5a6b6e52
mov dword [rdx + 0x2c], 0xf0f963b2
mov dword [rdx + 0x30], 0x7ee04f62
mov dword [rdx + 0x34], 0xe1c6cf46
mov dword [rdx + 0x38], 0xda4445c2
mov dword [rdx + 0x3c], 0x615350c1
mov dword [rdx + 0x40], 0x6be7c6d3
mov dword [rdx + 0x44], 0x52f1c0f8
mov dword [rdx + 0x48], 0xc9f641d2
mov byte [rdx + 0x4c], 0xb4
mov r8d, 0x7615ad0a
mov edx, 0x4d
jmp fcn.180002d20

Function at 0x18003a850
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov rcx, rdx
mov dword [rdx], 0xed6267d8
mov dword [rdx + 4], 0x5ed3c356
mov dword [rdx + 8], 0xfbda4f24
mov dword [rdx + 0xc], 0x5a4dd861
mov dword [rdx + 0x10], 0x67d75b6f
mov dword [rdx + 0x14], 0x6176d932
mov dword [rdx + 0x18], 0xd0cb4ef9
mov dword [rdx + 0x1c], 0x5747604e
mov dword [rdx + 0x20], 0xed5dd679
mov dword [rdx + 0x24], 0x7ffc76f4
mov dword [rdx + 0x28], 0xde776aee
mov dword [rdx + 0x2c], 0x74c5e70e
mov dword [rdx + 0x30], 0x7ae4cbee
mov dword [rdx + 0x34], 0x65c2d3ca
mov dword [rdx + 0x38], 0x5448c14e
mov dword [rdx + 0x3c], 0x42576940
mov dword [rdx + 0x40], 0xd2e95b65
mov dword [rdx + 0x44], 0xf6f6737f
mov dword [rdx + 0x48], 0x5bfc5c4f
mov word [rdx + 0x4c], 0xe74a
mov r8d, 0xe559ad0a
mov byte [rdx + 0x4e], 0x90
mov edx, 0x4f
jmp fcn.180002d20

Function at 0x18003a900
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rcx, rdx
mov dword [rdx], 0xd97cf7f2
mov dword [rdx + 4], 0xe6657df8
mov dword [rdx + 8], 0xe3e8eda2
mov dword [rdx + 0xc], 0xd47b467d
mov dword [rdx + 0x10], 0x73dd6353
mov dword [rdx + 0x14], 0xed484dac
mov dword [rdx + 0x18], 0xdad7ecdd
mov dword [rdx + 0x1c], 0xd3f7ce74
mov dword [rdx + 0x20], 0xe5517cc9
mov dword [rdx + 0x24], 0xc5e2f8ea
mov dword [rdx + 0x28], 0xfefdc264
mov dword [rdx + 0x2c], 0x7c73759c
mov dword [rdx + 0x30], 0xe4e6e36e
mov dword [rdx + 0x34], 0x47cdcdd3
mov dword [rdx + 0x38], 0xf859d4d7
mov dword [rdx + 0x3c], 0x406c7b68
mov dword [rdx + 0x40], 0x6fe17a55
mov dword [rdx + 0x44], 0x78f577c5
mov word [rdx + 0x48], 0xe143
mov r8d, 0x82e117f6
mov byte [rdx + 0x4a], 0xb8
mov edx, 0x4b
jmp fcn.180002d20
Function at 0x18003c4a8
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov r8, qword [rcx]
mov rbx, rcx
test r8, r8
je 0x18003c50e
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x18003c4ff
mov rax, qword [rbx]
xor edx, edx
mov r8d, dword [rax + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x18003c4f5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x18003c4c9
mov r8, qword [rbx]
mov rcx, qword [0x180057c00]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18003c520
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x10], edx
push rdi
sub rsp, 0x20
mov eax, ecx
lea r9, [rsp + 0x38]
imul rbx, rax, 0x38
mov r8d, 0x40
add rbx, qword [0x18005a290]
mov rdx, qword [rbx]
mov al, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rbp, [rdx - 5]
cmove rbp, rdx
lea rdi, [rdx - 5]
test al, al
lea rsi, [rcx*2 + 5]
cmove rdi, rdx
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18003c58b
mov eax, 0xa
jmp 0x18003c5d8
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, ebp
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x18003c5a7
mov rax, qword [rbx]
mov word [rax], 0xf9eb
mov r8d, dword [rsp + 0x38]
lea r9, [rsp + 0x38]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [rbx + 0x20], 6
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x18003c8d8
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x18003c8ef
cmp r8b, 0x90
je 0x18003c8ef
cmp r8b, 0xcc
jne 0x18003c911
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x18003c90d
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x18003c911
add edx, r10d
cmp edx, r9d
jb 0x18003c8fd
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x18003cc90
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rsi, qword [rbp - 0x58]
cmp rdi, 0x40000000
jbe 0x18003ccda
lea rax, [rdi - 0x40000000]
cmp rsi, rax
cmovb rsi, rax
mov rbx, qword [0x18005a288]
lea r15, [rdi + 0x40000000]
cmp qword [rbp - 0x50], r15
cmovbe r15, qword [rbp - 0x50]
sub r15, 0xfff
test rbx, rbx
je 0x18003cd17
cmp rbx, rsi
jb 0x18003cd12
cmp rbx, r15
jae 0x18003cd12
cmp qword [rbx + 8], 0
jne 0x18003ce73
mov rbx, qword [rbx]
jmp 0x18003ccf8
mov r14, rdi
cmp rdi, rsi
jb 0x18003cd9b
mov r12d, dword [rbp - 0x38]
xor edx, edx
mov rax, r14
div r12
sub r14, rdx
sub r14, r12
cmp r14, rsi
jb 0x18003cd92
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18003cd92
cmp dword [rbp - 0x10], 0x10000
je 0x18003cd62
mov r14, qword [rbp - 0x28]
cmp r14, r12
jb 0x18003cd92
jmp 0x18003cd2e
test r14, r14
je 0x18003cd92
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x18003ce33
cmp r14, rsi
jae 0x18003cd1f
test rbx, rbx
jne 0x18003ce33
cmp rdi, r15
ja 0x18003ce73
mov r14d, dword [rbp - 0x38]
xor edx, edx
mov rax, rdi
mov esi, r14d
div r14
mov eax, r14d
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x18003ce73
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x18003ce73
cmp dword [rbp - 0x10], 0x10000
je 0x18003ce09
xor edx, edx
lea edi, [r14 - 1]
add rdi, qword [rbp - 0x18]
add rdi, qword [rbp - 0x30]
mov rax, rdi
div rsi
sub rdi, rdx
cmp rdi, r15
jmp 0x18003cdc2
test rdi, rdi
je 0x18003ce73
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jmp 0x18003cd95
and qword [rbx + 8], 0
lea rcx, [rbx + 0x40]
and dword [rbx + 0x10], 0
mov rdx, rcx
sub rdx, rbx
mov rax, qword [rbx + 8]
add rdx, 0x40
mov qword [rcx], rax
mov qword [rbx + 8], rcx
add rcx, 0x40
cmp rdx, 0xfc0
jbe 0x18003ce46
mov rax, qword [0x18005a288]
mov qword [rbx], rax
mov qword [0x18005a288], rbx
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14002de7c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov r8d, ecx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14002deb4
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
test eax, eax
jne 0x14002debc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x14002deb6

Function at 0x14002e0dc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1400fc828]
test rax, rax
je 0x14002e10c
call rax
mov al, 1
jmp 0x14002e289
xor eax, eax
mov dword [rbp - 0x30], 0xa009b544
mov dword [rbp - 0x2c], 0x44c2b150
xor r9d, r9d
mov word [rbp - 0x28], 0x74bd
movabs rsi, 0x1a6e778c1
mov byte [rbp - 0x26], al
movabs rdi, 0x8080808080808081
lea r11d, [rax + 0xa]
movabs r10, 0x10850ab794
movabs r14, 0x1a6e778c2
mov cl, r9b
mov rax, rdi
mul r10
and cl, 7
mov r8, rsi
shl cl, 3
shr r8, cl
mov rcx, r10
shr rdx, 7
add r10, r14
imul rax, rdx, 0xff
sub rcx, rax
mov rax, rdi
mul r11
xor r8b, cl
mov rcx, r11
shr rdx, 7
add r11, 0xa
imul rax, rdx, 0xff
sub rcx, rax
movabs rax, 0x210a156f28
xor r8b, cl
xor r8b, r9b
xor byte [rbp + r9 - 0x30], r8b
inc r9
cmp r10, rax
jb 0x14002e154
lea rcx, [rbp - 0x30]
mov byte [rbp - 0x26], 0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r9, rax
test rax, rax
je 0x14002e287
movdqa xmm0, xmmword [0x1400ea490]
xor r10d, r10d
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xd7e269bb
movabs r11, 0x22b0fce7ea
mov word [rbp - 0xc], 0xb0
lea ebx, [r10 + 0x15]
mov cl, r10b
mov rax, rdi
mul r11
and cl, 7
mov r8, rsi
shl cl, 3
shr r8, cl
mov rcx, r11
shr rdx, 7
add r11, r14
imul rax, rdx, 0xff
sub rcx, rax
mov rax, rdi
xor r8b, cl
mov rcx, rbx
mul rbx
add rbx, 0x15
shr rdx, 7
imul rax, rdx, 0xff
sub rcx, rax
movabs rax, 0x4561f9cfd4
xor r8b, cl
xor r8b, byte [rbp + r10 - 0x20]
xor r8b, r10b
mov byte [rbp + r10 - 0x20], r8b
inc r10
cmp r11, rax
jb 0x14002e1fd
lea rdx, [rbp - 0x20]
mov byte [rbp - 0xb], 0
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400fc828], rax
test rax, rax
jne 0x14002e103
xor al, al
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret