joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140024f10
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
sub rsp, 0x40
mov rbp, qword [0x140146178]
mov rax, 0xffffffffffffffff
lock xadd qword [rbp + 0x28], rax
cmp rax, 1
jne 0x140025155
movzx eax, byte [rbp + 0x20]
test al, al
je 0x140025155
mov r10, qword [0x140146e78]
test r10, r10
jne 0x140025135
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rbx
mov ebx, 0xb35b2a26
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x68], r12
xor r12d, r12d
mov qword [rsp + 0x38], r14
mov edi, r12d
mov qword [rsp + 0x30], r15
mov rax, qword [rax + 0x10]
nop word [rax + rax]
movups xmm0, xmmword [rax + 0x58]
movd ecx, xmm0
movups xmmword [rsp + 0x20], xmm0
sub cx, 8
test edi, edi
je 0x140024ff2
mov rdx, qword [rsp + 0x28]
mov r9d, 0x90b215e5
movzx r10d, cx
mov r8, r12
shr r10, 1
lea rcx, [rdx + r10*2]
cmp rdx, rcx
cmova r10, r12
test r10, r10
je 0x140024fe9
nop word [rax + rax]
movsx ecx, byte [rdx]
lea rdx, [rdx + 2]
xor ecx, r9d
inc r8
imul r9d, ecx, 0x1000193
cmp r8, r10
jne 0x140024fd0
cmp r9d, edi
jne 0x140025108
mov r11, qword [rax + 0x30]
movsxd rcx, dword [r11 + 0x3c]
mov rdx, qword [rcx + r11 + 0x88]
mov r15, rdx
mov esi, edx
shr r15, 0x20
add rsi, r11
cmp rsi, r11
je 0x140025108
mov r9d, dword [rsi + 0x18]
test r9d, r9d
je 0x140025108
mov r14d, dword [rsi + 0x20]
nop dword [rax + rax]
dec r9d
mov r8d, 0x90b215e5
lea rcx, [r14 + r9*4]
mov edx, dword [rcx + r11]
add rdx, r11
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140025069
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140025050
cmp r8d, ebx
je 0x14002507b
test r9d, r9d
jne 0x140025030
mov rax, qword [rax]
jmp 0x140024f90
mov ecx, dword [rsi + 0x24]
add rcx, r11
movzx edx, word [rcx + r9*2]
mov ecx, dword [rsi + 0x1c]
add rcx, r11
mov r10d, dword [rcx + rdx*4]
add r10, r11
cmp r10, rsi
jbe 0x140025110
lea rax, [r15 + rsi]
cmp r10, rax
jae 0x140025110
movzx eax, byte [r10]
mov edi, 0x90b215e5
mov ebx, edi
cmp al, 0x2e
je 0x1400250c6
movsx eax, al
inc r10
xor eax, edi
imul edi, eax, 0x1000193
movzx eax, byte [r10]
cmp al, 0x2e
jne 0x1400250b0
movzx eax, byte [r10 + 1]
inc r10
test al, al
je 0x1400250f7
nop dword [rax]
nop word [rax + rax]
movsx eax, al
lea r10, [r10 + 1]
xor eax, ebx
imul ebx, eax, 0x1000193
movzx eax, byte [r10]
test al, al
jne 0x1400250e0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x140024f90
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r12, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov qword [0x140146e78], r10
mov rcx, rbp
call fcn.140024760
xor r9d, r9d
mov rcx, rax
xor edx, edx
lea r8, [r9 - 1]
call r10
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_ExitThread]
add rsp, 0x40
pop rbp
ret
Function at 0x1400322e0
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword gs:[0x58]
mov rbx, rcx
mov ecx, 0x130
mov r8d, 0x20
mov rdx, rbx
add rcx, qword [rax]
call fcn.1400586c0
and byte [rbx], 0xf8
and byte [rbx + 0x1f], 0x3f
or byte [rbx + 0x1f], 0x40
add rsp, 0x20
pop rbx
ret

Function at 0x140032320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov rax, qword [0x140134190]
xor rax, rsp
mov qword [rbp + 0x60], rax
xor edx, edx
mov byte [0x1401461fc], 0
mov r8d, 0x118
lea rcx, [rsp + 0x44]
call fcn.1400a19b0
mov r8b, 3
mov dword [rsp + 0x40], 0x11c
mov edx, 2
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_VerSetConditionMask]
mov r8b, 3
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_VerSetConditionMask]
mov r8b, 3
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_VerSetConditionMask]
xor ebx, ebx
mov qword [rsp + 0x44], 6
mov r8, rax
mov word [rbp + 0x54], bx
lea rcx, [rsp + 0x40]
lea edx, [rbx + 0x23]
call qword [sym.imp.KERNEL32.DLL_VerifyVersionInfoW]
test eax, eax
setne byte [0x1401461fc]
test eax, eax
je 0x1400324c9
mov byte [rsp + 0x20], bl
mov byte [rsp + 0x21], 0x73
mov byte [rsp + 0x22], 0x71
mov byte [rsp + 0x23], 0x7a
mov byte [rsp + 0x24], 0x71
mov byte [rsp + 0x25], 0x1a
mov byte [rsp + 0x26], 0x71
mov byte [rsp + 0x27], 0x5b
mov byte [rsp + 0x28], 0x71
mov byte [rsp + 0x29], 0x1a
mov byte [rsp + 0x2a], 0x71
mov byte [rsp + 0x2b], 0x3f
mov byte [rsp + 0x2c], 0x71
mov byte [rsp + 0x2d], 4
mov byte [rsp + 0x2e], 0x71
mov byte [rsp + 0x2f], 0x5b
mov byte [rsp + 0x30], 0x71
mov byte [rsp + 0x31], 0xf
mov byte [rsp + 0x32], 0x71
mov byte [rsp + 0x33], 0x26
mov byte [rsp + 0x34], 0x71
mov byte [rsp + 0x35], 0x20
mov byte [rsp + 0x36], 0x71
mov byte [rsp + 0x37], 0x20
mov byte [rsp + 0x38], 0x71
mov byte [rsp + 0x39], 0x71
mov byte [rsp + 0x3a], 0x71
movzx eax, byte [rsp + 0x21]
movzx eax, byte [rsp + 0x20]
test al, al
jne 0x1400324b4
nop dword [rax + rax]
movzx ecx, byte [rsp + rbx + 0x21]
mov eax, 0x81020409
sub ecx, 0x71
imul r8d, ecx, 0x29
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov eax, 0x81020409
add r8d, 0x7f
imul r8d
add edx, r8d
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x7f
sub r8d, eax
mov byte [rsp + rbx + 0x21], r8b
inc rbx
cmp rbx, 0x1a
jb 0x140032460
lea rcx, [rsp + 0x21]
call qword [sym.imp.KERNEL32.DLL_LoadLibraryW]
test rax, rax
setne byte [0x1401461fc]
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.14007c490
mov rbx, qword [rsp + 0x180]
add rsp, 0x170
pop rbp
ret
Function at 0x140032ca0
Capabilities:
Get disk size

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x90
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x140134190]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rsi, rdx
mov rdi, rcx
mov qword [r11 - 0x38], rcx
mov qword [r11 - 0x30], rdx
xor eax, eax
mov dword [rsp + 0x30], eax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
mov qword [rdx + 0x10], rax
mov qword [rdx + 0x18], 7
mov word [rdx], ax
mov dword [rsp + 0x7c], eax
mov dword [rsp + 0x70], eax
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x74], eax
movdqa xmm0, xmmword [0x140113d20]
movdqu xmmword [rsp + 0x48], xmm0
mov word [rsp + 0x38], ax
mov dword [rsp + 0x30], 1
mov rdx, qword [rcx + 0x10]
inc rdx
lea rcx, [r11 - 0x60]
call fcn.140036000
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140032d4e
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rcx, [rsp + 0x38]
call fcn.14002cec0
mov r8d, 1
lea rdx, [0x140112e18]
lea rcx, [rsp + 0x38]
call fcn.14002cec0
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceW]
mov ebx, eax
lea rcx, [rsp + 0x38]
call fcn.14002cde0
mov edx, dword [rsp + 0x70]
mov eax, 0x200
test ebx, ebx
cmove edx, eax
mov dword [rdi + 0x20], edx
mov rcx, rsi
call fcn.14002cde0
mov rax, rdi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14007c490
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140033290
Capabilities:
Get disk information

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x280
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x140134190]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rcx
mov qword [rsp + 0x50], rcx
xor esi, esi
mov dword [rsp + 0x20], esi
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov dword [rsp + 0x20], 1
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.1400a19b0
lea rdx, [rsp + 0x60]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsW]
dec eax
cmp eax, 0x103
ja 0x1400333c0
lea rbx, [rsp + 0x60]
cmp word [rsp + 0x60], si
je 0x1400333c0
nop
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
mov qword [rsp + 0x38], 2
mov r8d, 4
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1400a1550
mov word [rsp + 0x2c], si
mov rdx, qword [rdi + 8]
cmp qword [rdi + 0x10], rdx
je 0x140033384
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rsp + 0x38]
movups xmmword [rdx + 0x10], xmm1
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], si
add qword [rdi + 8], 0x20
jmp 0x140033392
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.1400354c0
nop
lea rcx, [rsp + 0x28]
call fcn.14002cde0
mov rcx, 0xffffffffffffffff
lea rcx, [rcx + 1]
cmp word [rbx + rcx*2], 0
jne 0x1400333a3
lea rbx, [rbx + rcx*2]
add rbx, 2
cmp word [rbx], 0
jne 0x140033320
mov rax, rdi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14007c490
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140047630
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov r8, qword [r8 + 0x20]
mov r10, rcx
cmp qword [rdi + 0x28], 8
lea r9, [rdi + 0x10]
jb 0x140047659
mov r9, qword [rdi + 0x10]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
add r8, r8
je 0x140047694
movabs r11, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + r9]
inc rcx
xor rdx, rax
imul rdx, r11
cmp rcx, r8
jb 0x140047680
mov r8, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and r8, rdx
shl r8, 4
add rcx, r8
mov rax, qword [rcx]
cmp qword [rcx + 8], rdi
jne 0x1400476d4
cmp rax, rdi
jne 0x1400476ca
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [r8 + rcx + 8], rax
jmp 0x1400476df
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x1400476df
cmp rax, rdi
jne 0x1400476df
mov rax, qword [rdi]
mov qword [rcx], rax
mov rax, qword [rdi + 8]
lea rcx, [rdi + 0x30]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
mov qword [r8 + 8], rdx
dec qword [r10 + 0x10]
call fcn.14002cde0
lea rcx, [rdi + 0x10]
call fcn.14002cde0
mov edx, 0x50
mov rcx, rdi
call fcn.14007c4f0
mov qword [r14], rbx
mov rax, r14
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140047970
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xa8
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x140134190]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rbp, r9
mov r15, r8
mov rsi, rdx
mov rdi, rcx
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov r8, rdx
mov rdx, rcx
lea rcx, [rsp + 0x60]
call fcn.140047b50
nop
mov rax, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
sub rax, rbx
cmp rax, rbp
jne 0x1400479f1
mov r8, rbp
mov rdx, rbx
mov rcx, r15
call fcn.1400a2250
test eax, eax
je 0x140047ade
mov rcx, rdi
call fcn.140047740
mov r14, rax
test rax, rax
je 0x140047ade
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140047a12
mov rdx, qword [rdi]
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x140047a35
mov r8, rdx
nop
cmp word [r8], 0x5c
je 0x140047b34
add r8, 2
sub rcx, 1
jne 0x140047a20
mov r8, 0xffffffffffffffff
inc r8
mov r9, 0xffffffffffffffff
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.14002ad70
lea rdx, [rsp + 0x78]
cmp qword [rsp + 0x90], 8
cmovae rdx, qword [rsp + 0x78]
xor ecx, ecx
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x2011f
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140047ad3
cmp qword [rsi + 0x18], 8
jb 0x140047aa6
mov rsi, qword [rsi]
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], r15
mov r9d, dword [rsp + 0x100]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x78]
call fcn.14002cde0
nop
test rbx, rbx
je 0x140047b14
mov rdx, qword [rsp + 0x70]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x140047b0c
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140047b48
mov rcx, rbx
call fcn.14007c4f0
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14007c490
add rsp, 0xa8
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
test r8, r8
je 0x140047a35
sub r8, rdx
sar r8, 1
jmp 0x140047a3c
call fcn.1400aa8a4
int3
Function at 0x14005ba70
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x140134190]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, rcx
mov qword [rcx], 0
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14005bb13
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov edi, eax
mov dword [rsp + 0x20], 8
mov r9d, 1
xor r8d, r8d
lea rdx, str.Crypto_RNG
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x14005bb13
mov dword [rsp + 0x20], 0x28
lea r9d, [rax + 1]
xor r8d, r8d
lea rdx, str.Crypto_RNG
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14005bb37
mov rax, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14007c490
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb0
pop rdi
ret
mov ecx, edi
call qword [sym.imp.KERNEL32.DLL_SetLastError]
lea rdx, str.CryptAcquireContext
lea rcx, [rsp + 0x38]
call fcn.140023050
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x60]
call fcn.14005bbb0
lea rdx, [0x140130a50]
lea rcx, [rsp + 0x60]
call fcn.1400a1458
int3

Function at 0x14005c1c0
Capabilities:
Generate random numbers via winapi

Disassembly:
push rdi
sub rsp, 0xa0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov rax, qword [0x140134190]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, r8
mov rdi, rdx
mov ecx, dword [0x1401446c0]
mov rax, qword gs:[0x58]
mov edx, 0x10
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x140142e58], ecx
jg 0x14005c2ac
mov eax, ebx
cmp rbx, rax
jne 0x14005c26e
xor ecx, ecx
mov eax, ecx
test rbx, rbx
setne al
test ebx, ebx
setne cl
cmp eax, ecx
jne 0x14005c26e
mov r8, rdi
mov edx, ebx
mov rcx, qword [0x140142e50]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x14005c2ef
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14007c490
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.DLL_SetLastError]
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x28]
call fcn.140023050
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.14005bbb0
lea rdx, [0x140130a50]
lea rcx, [rsp + 0x50]
call fcn.1400a1458
nop
lea rcx, [0x140142e58]
call fcn.14007c760
cmp dword [0x140142e58], 0xffffffff
jne 0x14005c219
lea rcx, [0x140142e50]
call fcn.14005ba70
lea rcx, [0x1400edaa0]
call fcn.14007cbfc
nop
lea rcx, [0x140142e58]
call fcn.14007c700
jmp 0x14005c219
lea rdx, [0x1400f0110]
lea rcx, [rsp + 0x28]
call fcn.140023050
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.14005bbb0
lea rdx, [0x140130a50]
lea rcx, [rsp + 0x50]
call fcn.1400a1458
int3
Function at 0x14006d4f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor ebx, ebx
mov r11, rdx
mov r9, rcx
mov r10d, ebx
cmp r8, 8
jb 0x14006d537
mov rcx, r8
shr rcx, 3
imul rax, rcx, 0xfffffffffffffff8
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [r9]
add r9, 8
xor rax, qword [r11]
add r11, 8
or r10, rax
sub rcx, 1
jne 0x14006d520
mov rdx, r10
shr rdx, 0x20
or edx, r10d
mov eax, edx
mov ecx, edx
shr eax, 8
or eax, edx
shr ecx, 0x10
and eax, 0xff00
or eax, ecx
movzx ecx, dl
shr eax, 8
or eax, ecx
test r8, r8
je 0x14006d647
cmp r8, 8
jb 0x14006d614
mov rdx, r8
mov rcx, r9
and rdx, 0xfffffffffffffff8
xorps xmm4, xmm4
sub rcx, r11
xorps xmm3, xmm3
mov r10, r11
nop word [rax + rax]
movd xmm2, dword [rcx + r10]
xorps xmm0, xmm0
movd xmm1, dword [r10]
lea r10, [r10 + 8]
punpcklbw xmm2, xmm0
add rbx, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [r10 - 4]
punpcklbw xmm1, xmm0
por xmm2, xmm4
punpcklwd xmm1, xmm0
movdqa xmm4, xmm2
movd xmm2, dword [rcx + r10 - 4]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
pxor xmm2, xmm1
por xmm2, xmm3
movdqa xmm3, xmm2
cmp rbx, rdx
jb 0x14006d590
por xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd ecx, xmm3
or eax, ecx
cmp rbx, r8
jae 0x14006d647
sub r9, r11
lea r10, [rbx + r11]
sub r8, rbx
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r10 + r9]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
xor edx, ecx
or eax, edx
sub r8, 1
jne 0x14006d630
mov rbx, qword [rsp + 8]
test eax, eax
sete al
ret
Function at 0x14006d660
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x14006d7a4
cmp r9, 4
jb 0x14006d6aa
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x14006d690
xor r11d, r11d
test r9, r9
je 0x14006d7a4
cmp r9, 0x40
jb 0x14006d778
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x14006d6dc
cmp rdx, r8
jae 0x14006d778
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x14006d6f1
cmp rdx, r10
jae 0x14006d778
mov qword [rsp + 0x10], rbx
mov qword [rsp], rdi
mov rdi, r9
and rdi, 0xffffffffffffffc0
mov rdx, r10
mov rbx, rcx
sub rdx, r8
mov rax, r8
sub rbx, r8
movdqu xmm0, xmmword [rax]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax]
movdqu xmm2, xmmword [rdx + rax + 0x10]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm2, xmmword [rdx + rax - 0x10]
movdqu xmmword [rbx + rax - 0x20], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x10], xmm2
cmp r11, rdi
jb 0x14006d710
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
jae 0x14006d7a4
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
nop word [rax + rax]
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x14006d790
add rsp, 8
ret
Function at 0x1400b03ec
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400b0150
Function at 0x1400c5bbc
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1400c5a22
call fcn.1400ad2b8
mov dword [rax], 0x16
call fcn.1400aa884
mov eax, 0xffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400c5a04
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1400c5a04
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x20]
shr ecx, 1
test cl, 1
je 0x1400c5a54
lock or dword [rax + 0x14], 0x10
jmp 0x1400c5a04
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1400c5a71
mov rcx, qword [rbp + 0x20]
call fcn.1400c5bc4
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x10], 1
jne 0x1400c5a86
mov rcx, qword [rax]
mov sil, 1
mov r14b, byte [rcx]
jmp 0x1400c5a8c
xor sil, sil
xor r14b, r14b
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.1400bef50
mov rdx, qword [rbp + 0x20]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1400cb238
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x20]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 2
ja 0x1400c5adf
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x20]
and dword [rax + 0x10], 0
jmp 0x1400c5a04
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1400c5b4b
mov rcx, qword [rbp + 0x20]
call fcn.1400bef50
cmp eax, 0xffffffff
je 0x1400c5b32
mov rcx, qword [rbp + 0x20]
call fcn.1400bef50
cmp eax, 0xfffffffe
je 0x1400c5b32
mov rbx, qword [rbp + 0x20]
mov rcx, rbx
call fcn.1400bef50
movsxd rdi, eax
lea r15, [0x140145a00]
mov rcx, rbx
sar rdi, 6
call fcn.1400bef50
and eax, 0x3f
shl rax, 6
add rax, qword [r15 + rdi*8]
jmp 0x1400c5b39
lea rax, [0x140134440]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400c5b4b
mov rax, qword [rbp + 0x20]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x20]
cmp dword [rax + 0x20], 0x200
jne 0x1400c5b81
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1400c5b7d
mov rax, qword [rbp + 0x20]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1400c5b7d
mov rax, qword [rbp + 0x20]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x20]
mov rcx, qword [rax]
test sil, sil
je 0x1400c5b9f
movzx edx, byte [rcx]
dec dword [rax + 0x10]
shl dx, 8
movzx ecx, r14b
or dx, cx
inc qword [rax]
jmp 0x1400c5baa
movzx edx, word [rcx]
add dword [rax + 0x10], 0xfffffffe
add qword [rax], 2
movzx eax, dx
jmp 0x1400c5a09
jmp 0x1400c59d0
Function at 0x14008134c
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400813bb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400813bb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400813bb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400813bb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400813bb
cmp dword [rcx + 0x84], 0xe
jbe 0x1400813bb
cmp dword [rcx + 0xf8], 0
je 0x1400813bb
mov ecx, ebx
call fcn.1400814d8
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140081130
nop
cmp dword [rbp + 0x20], 0
je 0x140081409
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140081414
int3
xor r8d, r8d
xor edx, edx
jmp 0x14008134c

Function at 0x1400815d0
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x1400813bb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400813bb
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400813bb
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400813bb
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400813bb
cmp dword [rcx + 0x84], 0xe
jbe 0x1400813bb
cmp dword [rcx + 0xf8], 0
je 0x1400813bb
mov ecx, ebx
call fcn.1400814d8
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140081130
nop
cmp dword [rbp + 0x20], 0
je 0x140081409
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140081414
int3
xor r8d, r8d
xor edx, edx
jmp 0x14008134c