joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005be20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push r14
sub rsp, 0x68
mov rax, qword [0x1405e9138]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0x98], 0
mov rsi, rdx
mov r14, rcx
jne 0x14005be4d
xor al, al
jmp 0x14005c026
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x58], rdi
call fcn.14005d050
test al, al
je 0x14005c00f
mov rax, qword [r14 + 0x50]
mov r8, rsi
mov rdi, qword [rax - 0x70]
lea rbx, [rax - 0x78]
mov rdx, rbx
mov rcx, rdi
call fcn.14005e290
test al, al
je 0x14005c00f
mov rdx, rbx
mov rcx, rdi
call fcn.14005e510
test al, al
je 0x14005c00f
mov rbx, qword [r14 + 0x48]
cmp rbx, qword [r14 + 0x50]
je 0x14005bff9
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x50], r12
movabs r12, 0x100000001b3
mov qword [rsp + 0x48], r13
movabs r13, 0x789e9b398d409406
mov qword [rsp + 0x40], r15
xor r15d, r15d
nop word [rax + rax]
mov rbp, qword [rbx + 0x20]
test rbp, rbp
je 0x14005bf6f
xorps xmm0, xmm0
mov qword [rsp + 0x20], rsi
cvtsi2sd xmm0, rsi
mov rdi, r13
mov rcx, r15
movsd qword [rsp + 0x28], xmm0
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x20]
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x21]
imul rdi, r12
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x22]
imul rdi, r12
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x23]
imul rdi, r12
add rcx, 4
xor rdi, rax
imul rdi, r12
cmp rcx, 0x10
jb 0x14005bf10
mov rcx, qword [rbp + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rbp + 0x20]
jbe 0x14005bf64
mov rcx, rbp
call fcn.1400673b0
mov rcx, qword [rbp + 0x18]
lea rax, [rcx + 8]
mov qword [rbp + 0x18], rax
mov qword [rcx], rdi
cmp qword [rbx + 0x30], r15
je 0x14005bfa4
mov edi, r15d
cmp dword [rbx + 0x38], r15d
jbe 0x14005bfa4
nop
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov rdx, rsi
cmove rcx, r15
call fcn.14005be20
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x14005bf80
cmp qword [rbx + 0x40], r15
je 0x14005bfd7
mov edi, r15d
cmp dword [rbx + 0x48], r15d
jbe 0x14005bfd7
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov rdx, rsi
cmove rcx, r15
call fcn.14005be20
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x14005bfb3
add rbx, 0x78
cmp rbx, qword [r14 + 0x50]
jne 0x14005bee0
mov r15, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rcx, r14
call fcn.14005cc00
test al, al
setne al
mov byte [r14 + 0x98], al
jmp 0x14005c019
mov byte [r14 + 0x98], 0
xor al, al
mov rbx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1402ad1b0
add rsp, 0x68
pop r14
pop rsi
ret
Function at 0x14005c040
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r14
sub rsp, 0x68
mov rax, qword [0x1405e9138]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0x98], 0
mov r14, rcx
mov ebp, edx
jne 0x14005c06c
xor al, al
jmp 0x14005c24e
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x40], r15
call fcn.14005d050
test al, al
je 0x14005c232
mov rax, qword [r14 + 0x50]
mov r8, rbp
mov rdi, qword [rax - 0x70]
lea rbx, [rax - 0x78]
mov rdx, rbx
mov rcx, rdi
call fcn.14005e090
test al, al
je 0x14005c232
mov rdx, rbx
mov rcx, rdi
call fcn.14005e510
test al, al
je 0x14005c232
mov rbx, qword [r14 + 0x48]
cmp rbx, qword [r14 + 0x50]
je 0x14005c21c
mov qword [rsp + 0x60], rsi
movabs rcx, 0x789e9b398d409406
mov qword [rsp + 0x50], r12
xor r12d, r12d
mov qword [rsp + 0x48], r13
movabs r13, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
mov rsi, qword [rbx + 0x20]
test rsi, rsi
je 0x14005c18f
xorps xmm0, xmm0
mov qword [rsp + 0x20], rbp
cvtsi2sd xmm0, rbp
mov rdi, rcx
mov rcx, r12
movsd qword [rsp + 0x28], xmm0
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x20]
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x21]
imul rdi, r13
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x22]
imul rdi, r13
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x23]
imul rdi, r13
add rcx, 4
xor rdi, rax
imul rdi, r13
cmp rcx, 0x10
jb 0x14005c130
mov rcx, qword [rsi + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rsi + 0x20]
jbe 0x14005c184
mov rcx, rsi
call fcn.1400673b0
mov rcx, qword [rsi + 0x18]
lea rax, [rcx + 8]
mov qword [rsi + 0x18], rax
mov qword [rcx], rdi
cmp qword [rbx + 0x30], r12
je 0x14005c1c3
mov edi, r12d
cmp dword [rbx + 0x38], r12d
jbe 0x14005c1c3
nop
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r12
call fcn.14005c040
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x14005c1a0
cmp qword [rbx + 0x40], r12
je 0x14005c1f5
mov edi, r12d
cmp dword [rbx + 0x48], r12d
jbe 0x14005c1f5
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r12
call fcn.14005c040
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x14005c1d2
add rbx, 0x78
movabs rcx, 0x789e9b398d409406
cmp rbx, qword [r14 + 0x50]
jne 0x14005c100
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rcx, r14
call fcn.14005cc00
test al, al
setne al
mov byte [r14 + 0x98], al
jmp 0x14005c23c
mov byte [r14 + 0x98], 0
xor al, al
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1402ad1b0
add rsp, 0x68
pop r14
pop rbp
ret
Function at 0x14005c270
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbp
push r14
sub rsp, 0x68
mov rax, qword [0x1405e9138]
xor rax, rsp
mov qword [rsp + 0x30], rax
cmp byte [rcx + 0x98], 0
mov r14, rcx
movsxd rbp, edx
jne 0x14005c29d
xor al, al
jmp 0x14005c47e
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x40], r15
call fcn.14005d050
test al, al
je 0x14005c462
mov rax, qword [r14 + 0x50]
mov r8, rbp
mov rdi, qword [rax - 0x70]
lea rbx, [rax - 0x78]
mov rdx, rbx
mov rcx, rdi
call fcn.14005e290
test al, al
je 0x14005c462
mov rdx, rbx
mov rcx, rdi
call fcn.14005e510
test al, al
je 0x14005c462
mov rbx, qword [r14 + 0x48]
cmp rbx, qword [r14 + 0x50]
je 0x14005c44c
mov qword [rsp + 0x60], rsi
movabs rax, 0x789e9b398d409406
mov qword [rsp + 0x50], r12
xor r12d, r12d
mov qword [rsp + 0x48], r13
movabs r13, 0x100000001b3
nop word [rax + rax]
mov rsi, qword [rbx + 0x20]
test rsi, rsi
je 0x14005c3bf
movd xmm0, ebp
mov rdi, rax
cvtdq2pd xmm0, xmm0
mov qword [rsp + 0x20], rbp
mov rcx, r12
movsd qword [rsp + 0x28], xmm0
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x20]
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x21]
imul rdi, r13
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x22]
imul rdi, r13
xor rdi, rax
movzx eax, byte [rsp + rcx + 0x23]
imul rdi, r13
add rcx, 4
xor rdi, rax
imul rdi, r13
cmp rcx, 0x10
jb 0x14005c360
mov rcx, qword [rsi + 0x18]
lea rax, [rcx + 8]
cmp rax, qword [rsi + 0x20]
jbe 0x14005c3b4
mov rcx, rsi
call fcn.1400673b0
mov rcx, qword [rsi + 0x18]
lea rax, [rcx + 8]
mov qword [rsi + 0x18], rax
mov qword [rcx], rdi
cmp qword [rbx + 0x30], r12
je 0x14005c3f3
mov edi, r12d
cmp dword [rbx + 0x38], r12d
jbe 0x14005c3f3
nop
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r12
call fcn.14005c270
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x14005c3d0
cmp qword [rbx + 0x40], r12
je 0x14005c425
mov edi, r12d
cmp dword [rbx + 0x48], r12d
jbe 0x14005c425
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
mov edx, ebp
cmove rcx, r12
call fcn.14005c270
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x14005c402
add rbx, 0x78
movabs rax, 0x789e9b398d409406
cmp rbx, qword [r14 + 0x50]
jne 0x14005c330
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rcx, r14
call fcn.14005cc00
test al, al
setne al
mov byte [r14 + 0x98], al
jmp 0x14005c46c
mov byte [r14 + 0x98], 0
xor al, al
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1402ad1b0
add rsp, 0x68
pop r14
pop rbp
ret
Function at 0x14005c4a0
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push r14
sub rsp, 0x38
cmp byte [rcx + 0x98], 0
mov r14, rcx
movzx esi, dl
jne 0x14005c4c1
xor al, al
add rsp, 0x38
pop r14
pop rsi
ret
mov qword [rsp + 0x50], rbx
call fcn.14005d050
test al, al
je 0x14005c506
mov rax, qword [r14 + 0x50]
mov rcx, qword [rax - 0x70]
lea rbx, [rax - 0x78]
test byte [rcx + 0x50], 2
jne 0x14005c51d
call fcn.14005f020
mov ecx, 0x1000
test word [rax + 0xe], cx
jne 0x14005c502
mov rax, qword [rax + 8]
movabs rcx, 0xffffffffffff
and rax, rcx
mov qword [rbx + 0x18], rax
mov rbx, qword [rsp + 0x50]
xor al, al
mov byte [r14 + 0x98], 0
add rsp, 0x38
pop r14
pop rsi
ret
mov rdx, rbx
call fcn.14005e510
test al, al
je 0x14005c506
mov rbx, qword [r14 + 0x48]
cmp rbx, qword [r14 + 0x50]
je 0x14005c63c
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x30], r12
movabs r12, 0x84222325cbf29ce4
mov qword [rsp + 0x28], r13
movabs r13, 0x100000001b3
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov qword [rsp + 0x58], rbp
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x14005c5a0
mov rcx, qword [rdi + 0x18]
lea rbp, [rsi + 1]
xor rbp, r12
imul rbp, r13
lea rax, [rcx + 8]
cmp rax, qword [rdi + 0x20]
jbe 0x14005c595
mov rcx, rdi
call fcn.1400673b0
mov rcx, qword [rdi + 0x18]
lea rax, [rcx + 8]
mov qword [rdi + 0x18], rax
mov qword [rcx], rbp
cmp qword [rbx + 0x30], r15
je 0x14005c5d5
mov edi, r15d
cmp dword [rbx + 0x38], r15d
jbe 0x14005c5d5
nop
mov rax, qword [rbx + 0x30]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
movzx edx, sil
cmove rcx, r15
call fcn.14005c4a0
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x14005c5b0
cmp qword [rbx + 0x40], r15
je 0x14005c615
mov edi, r15d
cmp dword [rbx + 0x48], r15d
jbe 0x14005c615
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rbx + 0x40]
mov ecx, edi
mov rdx, qword [rax + rcx*8]
test rdx, rdx
lea rcx, [rdx - 8]
movzx edx, sil
cmove rcx, r15
call fcn.14005c4a0
inc edi
cmp edi, dword [rbx + 0x48]
jb 0x14005c5f0
add rbx, 0x78
cmp rbx, qword [r14 + 0x50]
jne 0x14005c567
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rcx, r14
call fcn.14005cc00
mov rbx, qword [rsp + 0x50]
test al, al
setne al
mov byte [r14 + 0x98], al
add rsp, 0x38
pop r14
pop rsi
ret
Function at 0x140064f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, rdx
mov qword [rsp + 0x20], rdx
mov rsi, rcx
lea rdx, [rsp + 0x28]
xor ebx, ebx
mov rcx, rax
movzx r15d, r9b
mov dword [rsp + 0x28], ebx
movzx r12d, r8b
call fcn.140062a20
mov r13d, dword [rsp + 0x28]
lea r14, [rsi + 0x18]
test al, al
lea rbp, [rsi + 0x48]
mov rax, qword [rsi + 0x28]
cmove r13d, ebx
mov qword [rsi + 0x30], rax
mov rax, qword [rsi]
xor edx, edx
mov dword [rsp + 0x28], r13d
mov ecx, dword [rax + 0x64]
add ecx, 0x1f
shr ecx, 5
shl ecx, 2
mov edi, ecx
mov r8d, ecx
mov rcx, qword [rsi + 0x78]
mov qword [rsp + 0x60], rdi
call fcn.1402cc070
mov rax, qword [rsi]
mov rdx, r14
mov rcx, rsi
mov r8d, dword [rax + 0x60]
call fcn.140066830
mov rcx, qword [rsi + 0x28]
movzx r11d, al
cmp qword [rsi + 0x30], rcx
je 0x1400650e6
nop word [rax + rax]
mov ebx, r13d
test r13d, r13d
je 0x1400650e6
mov rcx, qword [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.140062a20
mov r13d, dword [rsp + 0x28]
test al, al
mov rcx, qword [rsi + 0x78]
mov eax, 0
cmove r13d, eax
mov r8, rdi
xor edx, edx
mov dword [rsp + 0x28], r13d
call fcn.1402cc070
mov rax, qword [rbp + 0x10]
xor r11b, r11b
mov qword [rbp + 0x18], rax
mov rdi, qword [r14 + 0x10]
cmp rdi, qword [r14 + 0x18]
je 0x1400650c5
nop word [rax + rax]
mov r10, qword [rsi]
mov r9d, dword [rdi]
shl r9, 4
add r9, qword [r10 + 0x10]
mov eax, dword [r9 + 0xc]
cmp eax, ebx
je 0x14006507c
cmp eax, 0xffffffff
je 0x14006507c
cmp eax, 0xfffffffe
jne 0x1400650a0
mov edx, dword [r9 + 8]
mov r10, qword [r10 + 0x40]
lea rcx, [rdx + rdx*2]
mov r8d, dword [r10 + rcx*4]
shr r8d, 0x1f
not r8b
and r8b, 1
cmp edx, 0xffffffff
je 0x140065073
mov eax, edx
lea rcx, [rax + rax*2]
mov eax, dword [r10 + rcx*4]
btr eax, 0x1f
cmp ebx, eax
jb 0x140065069
cmp ebx, dword [r10 + rcx*4 + 4]
jbe 0x140065077
mov edx, dword [r10 + rcx*4 + 8]
cmp edx, 0xffffffff
jne 0x140065050
xor r8b, 1
test r8b, r8b
je 0x1400650a0
mov r8d, dword [r9]
mov rdx, rbp
mov rcx, rsi
call fcn.140066830
test al, al
jne 0x140065093
test r11b, r11b
je 0x140065096
mov r11b, 1
test r15b, r15b
jne 0x1400650a0
test r11b, r11b
jne 0x1400650e2
test r12b, r12b
jne 0x1400650b7
mov rax, qword [rsi]
mov rdx, rbp
mov rcx, rsi
mov r8d, dword [rax + 0x60]
call fcn.140066830
add rdi, 4
cmp rdi, qword [r14 + 0x18]
jne 0x140065010
mov rax, r14
mov r14, rbp
mov rbp, rax
mov rax, qword [r14 + 0x10]
cmp qword [r14 + 0x18], rax
je 0x1400650e6
mov rdi, qword [rsp + 0x60]
jmp 0x140064fb0
mov al, 1
jmp 0x1400650ea
movzx eax, r11b
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401b2250
Capabilities:
Encode data using base64

Disassembly:
xor r10d, r10d
test r8d, r8d
jle 0x1401b2343
lea r9, [rdx + 1]
lea r11, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
cmp r8d, 3
jl 0x1401b22cb
movzx eax, byte [r9]
movzx edx, byte [r9 - 1]
shl rdx, 8
or rdx, rax
movzx eax, byte [r9 + 1]
shl rdx, 8
or rdx, rax
mov rax, rdx
shr rax, 0x12
movzx eax, byte [rax + r11]
mov byte [rcx], al
mov rax, rdx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [rcx + 1], al
mov rax, rdx
shr rax, 6
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [rcx + 2], al
add rcx, 3
and edx, 0x3f
movzx eax, byte [rdx + r11]
mov byte [rcx], al
jmp 0x1401b2324
movzx edx, byte [r9 - 1]
shl edx, 0x10
cmp r8d, 2
jne 0x1401b22e2
movzx eax, byte [r9]
shl eax, 8
or edx, eax
mov rax, rdx
shr rax, 0x12
movzx eax, byte [rax + r11]
mov byte [rcx], al
mov rax, rdx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r11]
mov byte [rcx + 1], al
cmp r8d, 1
jne 0x1401b230e
lea eax, [r8 + 0x3c]
jmp 0x1401b231a
shr rdx, 6
and edx, 0x3f
movzx eax, byte [rdx + r11]
mov byte [rcx + 2], al
add rcx, 3
mov byte [rcx], 0x3d
add r10d, 4
add r9, 3
sub r8d, 3
inc rcx
test r8d, r8d
jg 0x1401b2267
mov byte [rcx], 0
mov eax, r10d
ret
mov byte [rcx], r10b
mov eax, r10d
ret
Function at 0x140289ab0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r9, qword [rcx]
lea r8, [0x140289b40]
mov rdi, rcx
xor edx, edx
xor ecx, ecx
lea rax, [r9 + 0x20]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
call fcn.1402ddad8
mov rsi, rax
test rax, rax
jne 0x140289af4
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rdi]
mov qword [rsp + 0x40], rbx
lock inc dword [rax + 8]
mov rbx, qword [rdi]
mov rcx, qword [rbx + 0x10]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140289b17
call qword [0x1403244a8]
mov qword [rbx + 0x10], rsi
mov rcx, qword [rdi]
mov rcx, qword [rcx + 0x10]
call qword [0x1403246a8]
mov rbx, qword [rsp + 0x40]
mov al, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1402de214
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1402de0a7
xor ecx, ecx
call qword [0x140324380]
test rax, rax
je 0x1402de0a7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1402de0a7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1402de0a7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1402de0a7
cmp dword [rcx + 0x84], 0xe
jbe 0x1402de0a7
cmp dword [rcx + 0xf8], 0
je 0x1402de0a7
mov ecx, ebx
call fcn.1402de148
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1402ddf38
cmp dword [rbp + 0x20], 0
je 0x1402de0f4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1402de0fc
int3
xor r8d, r8d
xor edx, edx
jmp 0x1402de040
Function at 0x140b54652
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r15
jmp 0x140a8c0c7
ror eax, 1
bswap eax
ror eax, 2
bswap eax
push rbp
add bpl, r15b
jmp 0x140af3d1a
pushfq
stc
push r13
push r11
cmc
jmp 0x140b283c3
movsxd rax, eax
add r8, rax
jmp r8
xor dword [rsp], eax
sal ebp, 0x2e
rcl bpl, cl
pop rbp
stc
jmp 0x140a9fbb6
push r8
push rbx
rol bh, 0xb3
push r9
stc
not r9w
movsxd r9, eax
push rdx
movzx r8, r13w
cqo
push rbp
bt ebx, r13d
bswap r8w
rcr rdx, 0xcb
push r10
rol r10, 0x7b
push rcx
movzx ebp, cx
rcl ecx, cl
push r12
bswap ecx
rol rbp, cl
stc
push rax
stc
cqo
movzx ebp, r15w
push rdi
push rsi
movabs rcx, 0
push rcx
cmc
mov r10, qword [rsp + 0x90]
xchg edx, edx
cqo
rol r10d, 1
rdtsc
lahf
movsxd r9, r14d
not r10d
movsx bx, r8b
movzx r9d, di
inc r10d
shld r8w, r15w, 0xe9
neg r10d
and ebx, 0x1bd745d2
btr r8w, r13w
add r10, rcx
mov rbx, 0x73033dcc
sbb r9d, r13d
movabs rbx, 0x100000000
btr r9w, di
ror ah, 0x24
add r10, rbx
bsr r9w, r9w
btr r9, rax
mov r9, rsp
sub rsp, 0x180
bt edx, 0xed
rdtsc
and rsp, 0xfffffffffffffff0
btr r8w, dx
sbb r8w, 0x7348
mov rbp, r10
cbw
shr r8b, 0x97
movzx eax, r8w
movabs rdx, 0
neg r8d
sub rbp, rdx
adc al, r8b
lea r8, [0x140b284b6]
sal ax, 0xca
mov eax, dword [r10]
clc
cmp r13, 0x16b3364a
test r15b, 0x9f
add r10, 4
jmp 0x140b38707
xor eax, ebp
dec eax
cmc
jmp 0x140a2b416
push r14
jmp 0x140a2b377
Function at 0x14000dd96
Capabilities:
Create thread

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov ecx, 0x10
call fcn.14000dd35
mov rsi, rax
mov qword [rax], rbx
mov qword [rax + 8], rdi
and qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
lea r8, [0x14000de2f]
xor edi, edi
xor ecx, ecx
mov rdx, r14
mov r9, rax
call qword [sym.imp.kernel32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14000de13
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
call qword [rax]
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.14000d46c
mov rcx, rsi
call fcn.140007128
mov edi, 1
call fcn.14000aa88
mov rdx, rax
mov rax, rdi
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14000e2c0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
mov rdi, rcx
movabs rbx, 0x8000000000000000
lea r14, [rsp + 0x78]
mov rcx, r14
call fcn.14000da33
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov rdx, r14
call fcn.14000e4a3
mov rax, qword [rsi]
cmp rax, rbx
jne 0x14000e30d
mov qword [rdi], rbx
jmp 0x14000e48c
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rdi
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x60]
and qword [rax], 0
mov qword [rax + 8], 2
and qword [rax + 0x10], 0
mov r8d, 0x200
mov r15d, 2
xor r12d, r12d
mov r14d, 0xffffffff
xor r13d, r13d
cmp r8, 0x201
jae 0x14000e367
lea rbp, [rsp + 0x78]
mov ebx, 0x200
mov rsi, r8
jmp 0x14000e39c
sub r8, r13
lea rcx, [rsp + 0x60]
mov rdx, r8
call fcn.14000a9e1
mov r12, qword [rsp + 0x60]
mov r15, qword [rsp + 0x68]
cmp r12, r14
mov r13d, 0xffffffff
cmovb r13, r12
mov qword [rsp + 0x70], r13
mov rbp, r15
mov rbx, r13
mov rsi, r13
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, qword [rsp + 0x38]
mov rdx, rbp
mov r8d, esi
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x14000e3c5
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14000e444
mov r8d, edi
cmp rsi, r8
jne 0x14000e3ee
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000e4a1
add rsi, rsi
cmp rsi, r14
cmovae rsi, r14
mov r8, rsi
jmp 0x14000e34f
jb 0x14000e34f
cmp rbx, r8
jb 0x14000e4a1
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov rdx, rbp
call fcn.14000a2b4
mov rcx, r12
mov rdx, r15
call fcn.140009e44
movabs rdi, 0x8000000000000000
cmp qword [rsi], rdi
mov rax, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
je 0x14000e472
movups xmm0, xmmword [rsp + 0x40]
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
jmp 0x14000e47f
call fcn.14000aa88
mov qword [rsp + 0x48], rax
movabs rdi, 0x8000000000000000
mov qword [rsp + 0x40], rdi
mov rcx, r12
mov rdx, r15
call fcn.140009e44
mov rax, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x28]
mov qword [rax], rdi
mov rcx, qword [rsp + 0x48]
call fcn.140006985
mov rcx, rsi
mov rdx, qword [rsp + 0x38]
call fcn.140009e44
nop
add rsp, 0x478
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x14000f1f4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
movabs r14, 0x8000000000000000
lea rdi, [rsp + 0x38]
mov rcx, rdi
call fcn.14000f27e
lea rbx, [rsp + 0x20]
mov rcx, rbx
mov rdx, rdi
call fcn.14000e4a3
mov rdi, qword [rbx]
cmp rdi, r14
jne 0x14000f236
mov qword [rsi], r14
jmp 0x14000f259
mov rbx, qword [rsp + 0x28]
mov r15, qword [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000f265
mov qword [rsi], rdi
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov qword [rsi], r14
mov rcx, rdi
mov rdx, rbx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.140009e44
Function at 0x1400108d3
Capabilities:
Generate random numbers via winapi

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
movaps xmmword [rdx], xmm0
xor ecx, ecx
mov r8d, 0x10
mov r9d, 2
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
test eax, eax
js 0x140010906
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
jmp 0x14001090b
call fcn.140010911
nop
add rsp, 0x38
ret

Function at 0x140010911
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
sub rsp, 0x38
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx], xmm0
mov edx, 0x10
call qword [sym.imp.advapi32.dll_SystemFunction036]
test al, al
je 0x14001093e
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
add rsp, 0x38
ret
call fcn.14000aa88
ud2

Function at 0x1400122bb
Capabilities:
Accept command line arguments

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, rdx
mov rsi, rcx
lea rdx, [rsp + 0x2c]
mov rcx, rax
call qword [sym.imp.shell32.dll_CommandLineToArgvW]
test rax, rax
je 0x140012367
mov rdi, rax
lea rbx, [rsp + 0x30]
and qword [rbx], 0
mov qword [rbx + 8], 8
and qword [rbx + 0x10], 0
movsxd r12, dword [rsp + 0x2c]
shl r12, 3
xor r13d, r13d
lea r14, [rsp + 0x48]
cmp r12, r13
je 0x140012341
mov r15, qword [rdi + r13]
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, r14
mov rdx, r15
mov r8, rax
call fcn.14001104f
mov rcx, rbx
mov rdx, r14
call fcn.1400125b6
add r13, 8
jmp 0x140012311
mov rcx, rdi
call qword [sym.imp.kernel32.dll_LocalFree]
test rax, rax
jne 0x140012354
call fcn.140016177
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
jmp 0x140012378
and qword [rsi], 0
mov qword [rsi + 8], 8
and qword [rsi + 0x10], 0
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14001694c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x140016996
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140016996
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140016996
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140016996
cmp dword [rcx + 0x84], 0xe
jbe 0x140016996
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140016998
xor al, al
add rsp, 0x28
ret