joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003f4f0
Capabilities:
Resume thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rdi
sub rsp, 0x970
mov rax, qword [0x1400bb060]
xor rax, rsp
mov qword [rsp + 0x960], rax
mov edi, edx
mov rbx, rcx
cmp edx, 4
ja 0x14003f6cf
mov qword [r11 + 0x10], rbp
lea rcx, [r11 - 0x688]
xor edx, edx
mov qword [r11 + 0x18], rsi
mov r8d, 0x670
call fcn.14004d310
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2cc
call fcn.14004d310
mov rbp, qword [rbx]
mov rax, qword [rbp + 0x10]
movzx esi, byte [rax + 0x16]
test sil, sil
jne 0x14003f580
mov rdx, qword [rbx + 0x10]
lea r8, [rsp + 0x2f0]
mov dword [rsp + 0x320], 0x100010
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x58]
jmp 0x14003f5ad
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x2c8
call fcn.14004d310
mov rdx, qword [rbx + 0x10]
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x100010
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rbp, qword [rsp + 0x988]
lea r8, [rsp + 0x360]
test sil, sil
lea rcx, [rsp + 0x38]
cmovne r8, rcx
test eax, eax
js 0x14003f6a6
mov edx, dword [r8]
test edi, edi
jne 0x14003f5e0
and edx, 0xfff0fffe
jmp 0x14003f623
cmp edi, 1
jne 0x14003f5ed
and edx, 0xff0ffffb
jmp 0x14003f623
cmp edi, 2
mov ecx, 0xffffffbf
mov eax, 0xffffffef
cmovne eax, ecx
mov ecx, 0xf3ffffff
and eax, edx
mov edx, 0x3fffffff
cmp edi, 2
cmovne ecx, edx
mov edx, 0xfcffffff
and ecx, eax
mov eax, 0xcfffffff
cmp edi, 2
cmovne edx, eax
and edx, ecx
mov eax, edx
mov dword [r8], edx
shr eax, 2
mov ecx, eax
or ecx, edx
shr ecx, 4
or ecx, eax
or ecx, edx
test cl, 1
jne 0x14003f642
btr edx, 8
mov dword [r8], edx
mov rcx, rbx
mov edi, 0xc000071c
call fcn.14003f320
test sil, sil
jne 0x14003f673
test al, al
je 0x14003f6a4
mov rax, qword [rbx]
lea r8, [rsp + 0x2f0]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x68]
jmp 0x14003f68d
test al, al
je 0x14003f6a4
mov rax, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 8], eax
je 0x14003f6a4
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, edi
mov rsi, qword [rsp + 0x990]
mov rcx, qword [rsp + 0x960]
xor rcx, rsp
call fcn.14004aa20
mov rbx, qword [rsp + 0x998]
add rsp, 0x970
pop rdi
ret
xor eax, eax
jmp 0x14003f6ae
Function at 0x14003f6e0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x970
mov rax, qword [0x1400bb060]
xor rax, rsp
mov qword [rsp + 0x960], rax
mov rdi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x2f0]
mov r8d, 0x670
call fcn.14004d310
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2cc
call fcn.14004d310
mov rbp, qword [rbx]
mov rax, qword [rbp + 0x10]
movzx esi, byte [rax + 0x16]
test sil, sil
jne 0x14003f769
mov rdx, qword [rbx + 0x10]
lea r8, [rsp + 0x2f0]
mov dword [rsp + 0x320], 0x100010
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x58]
jmp 0x14003f796
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x2c8
call fcn.14004d310
mov rdx, qword [rbx + 0x10]
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x100010
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x50]
test sil, sil
lea r8, [rsp + 0x360]
lea rcx, [rsp + 0x38]
cmovne r8, rcx
test eax, eax
jns 0x14003f7b5
xor eax, eax
jmp 0x14003f8ad
xor ecx, ecx
mov edx, ecx
mov eax, ecx
nop dword [rax + rax]
cmp qword [rsp + rax*8 + 0x338], rdi
je 0x14003f7e5
cmp dword [rsp + rax*4 + 0x24], edi
je 0x14003f7e5
inc edx
inc rax
cmp rax, 4
jl 0x14003f7c0
mov eax, 0xc0000225
jmp 0x14003f8ad
movsxd rax, edx
test sil, sil
jne 0x14003f7f7
mov qword [rsp + rax*8 + 0x338], rcx
jmp 0x14003f7fb
mov dword [rsp + rax*4 + 0x24], ecx
mov ecx, dword [r8]
test edx, edx
jne 0x14003f80a
and ecx, 0xfff0fffe
jmp 0x14003f82a
cmp edx, 1
jne 0x14003f817
and ecx, 0xff0ffffb
jmp 0x14003f82a
cmp edx, 2
jne 0x14003f824
and ecx, 0xf0ffffef
jmp 0x14003f82a
and ecx, 0xfffffbf
mov eax, ecx
mov dword [r8], ecx
shr eax, 2
or eax, ecx
shr eax, 2
or eax, ecx
shr eax, 2
or eax, ecx
test al, 1
jne 0x14003f849
btr ecx, 8
mov dword [r8], ecx
mov rcx, rbx
mov edi, 0xc000071c
call fcn.14003f320
test sil, sil
jne 0x14003f87a
test al, al
je 0x14003f8ab
mov rax, qword [rbx]
lea r8, [rsp + 0x2f0]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x68]
jmp 0x14003f894
test al, al
je 0x14003f8ab
mov rax, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 8], eax
je 0x14003f8ab
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, edi
mov rcx, qword [rsp + 0x960]
xor rcx, rsp
call fcn.14004aa20
lea r11, [rsp + 0x970]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14003f980
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x1400bb060]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov r14, rdx
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400bf268], eax
jle 0x14003fa11
lea rcx, [0x1400bf268]
call fcn.14004abd0
cmp dword [0x1400bf268], 0xffffffff
jne 0x14003fa11
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.GetThreadId
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400bf270], rax
lea rcx, [0x1400bf268]
call fcn.14004ab70
mov rax, qword [0x1400bf270]
test rax, rax
je 0x14003fa27
mov rcx, r14
call rax
jmp 0x14003fb78
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x80], eax
xor esi, esi
mov dword [rsp + 0x60], esi
call fcn.1400167c0
mov rbx, rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], sil
lea r8d, [rsi + 0x18]
lea rdx, str.NtQueryInformationThread
lea rcx, [rsp + 0x30]
call fcn.140007460
nop
call fcn.14002fc20
lea rbp, [rbx + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x30]
mov rdi, qword [rsp + 0x30]
mov r15, qword [rsp + 0x48]
cmp r15, 0x10
cmovae rdx, rdi
movabs r9, 0xcbf29ce484222325
mov ecx, esi
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x14003fad5
movabs r10, 0x100000001b3
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x14003fac2
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400170a0
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14003fb28
cmp rdx, qword [rbx + 8]
je 0x14003fb28
mov rbx, qword [rdx + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14003fb31
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x1c
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, r14
call rbx
mov ebx, eax
jmp 0x14003fb36
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
shr ebx, 0x1f
xor bl, 1
cmp r15, 0x10
jb 0x14003fb6f
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003fb67
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003fba5
mov rcx, rdi
call fcn.14004aa40
test bl, bl
cmovne esi, dword [rsp + 0x74]
mov eax, esi
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.14004aa20
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.140057ca0
int3
Function at 0x1400419c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x1400bb060]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x58], r8
mov rsi, rdx
mov r13, rcx
mov rax, qword [rsp + 0xf0]
xor ebx, ebx
mov qword [rsp + 0x70], rbx
lea r15, [rsp + 0x70]
test rax, rax
cmovne r15, rax
cmp byte [rcx + 0x15], bl
je 0x140041a4e
cmp rdx, 0x7fffffff
jae 0x140041a4e
mov rax, qword gs:[0x30]
mov dword [rax + 0x1250], ebx
mov qword [rsp + 0x20], r15
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
jmp 0x140041b7a
call fcn.1400167c0
mov r12, rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], bl
mov r8d, 0x1a
lea rdx, str.NtWow64ReadVirtualMemory64
lea rcx, [rsp + 0x30]
call fcn.140007460
nop
call fcn.14002fc20
lea rcx, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x30]
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
cmp rbp, 0x10
cmovae rcx, rdi
movabs r9, 0xcbf29ce484222325
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x140041ae3
movabs r8, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
xor r9, rax
imul r9, r8
inc rbx
cmp rbx, rdx
jb 0x140041ad0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, r12
call fcn.1400170a0
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140041b35
cmp rdx, qword [r12 + 8]
je 0x140041b35
mov rbx, qword [rdx + 0x30]
lea rcx, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x140041b40
mov qword [rsp + 0x20], r15
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, rsi
mov rcx, qword [r13 + 8]
call rbx
mov ebx, eax
jmp 0x140041b45
lea rcx, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
cmp rbp, 0x10
jb 0x140041b78
lea rdx, [rbp + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140041b70
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041b9b
mov rcx, rdi
call fcn.14004aa40
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14004aa20
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.140057ca0
int3
Function at 0x140041bb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x1400bb060]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x58], r8
mov rsi, rdx
mov r13, rcx
mov rax, qword [rsp + 0xf0]
xor ebx, ebx
mov qword [rsp + 0x70], rbx
lea r15, [rsp + 0x70]
test rax, rax
cmovne r15, rax
cmp byte [rcx + 0x15], bl
je 0x140041c3e
cmp rdx, 0x7fffffff
jae 0x140041c3e
mov rax, qword gs:[0x30]
mov dword [rax + 0x1250], ebx
mov qword [rsp + 0x20], r15
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
jmp 0x140041d6a
call fcn.1400167c0
mov r12, rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], bl
mov r8d, 0x1b
lea rdx, str.NtWow64WriteVirtualMemory64
lea rcx, [rsp + 0x30]
call fcn.140007460
nop
call fcn.14002fc20
lea rcx, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x30]
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
cmp rbp, 0x10
cmovae rcx, rdi
movabs r9, 0xcbf29ce484222325
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x140041cd3
movabs r8, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
xor r9, rax
imul r9, r8
inc rbx
cmp rbx, rdx
jb 0x140041cc0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, r12
call fcn.1400170a0
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140041d25
cmp rdx, qword [r12 + 8]
je 0x140041d25
mov rbx, qword [rdx + 0x30]
lea rcx, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x140041d30
mov qword [rsp + 0x20], r15
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, rsi
mov rcx, qword [r13 + 8]
call rbx
mov ebx, eax
jmp 0x140041d35
lea rcx, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
cmp rbp, 0x10
jb 0x140041d68
lea rdx, [rbp + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140041d60
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041d8b
mov rcx, rdi
call fcn.14004aa40
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14004aa20
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.140057ca0
int3
Function at 0x140041da0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x1400bb060]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x30], r9d
mov r13, r8
mov r12d, edx
mov r15, rcx
xor ebx, ebx
mov dword [rsp + 0x68], ebx
call fcn.1400167c0
mov r14, rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], bl
lea r8d, [rbx + 0x20]
lea rdx, str.NtWow64QueryInformationProcess64
lea rcx, [rsp + 0x38]
call fcn.140007460
nop
call fcn.14002fc20
lea rcx, [r14 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x38]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x50]
cmp rsi, 0x10
cmovae rcx, rdi
movabs r9, 0xcbf29ce484222325
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x140041e63
movabs r8, 0x100000001b3
movzx eax, byte [rbx + rcx]
xor r9, rax
imul r9, r8
inc rbx
cmp rbx, rdx
jb 0x140041e50
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, r14
call fcn.1400170a0
mov r10, qword [rax + 8]
test r10, r10
je 0x140041eb6
cmp r10, qword [r14 + 8]
je 0x140041eb6
mov rbx, qword [r10 + 0x30]
lea rcx, [r14 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x140041ec0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x30]
mov r8, r13
mov edx, r12d
mov rcx, qword [r15 + 8]
call rbx
mov ebx, eax
jmp 0x140041ec5
lea rcx, [r14 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
cmp rsi, 0x10
jb 0x140041ef8
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140041ef0
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041f1b
mov rcx, rdi
call fcn.14004aa40
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14004aa20
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.140057ca0
int3

Function at 0x1400422f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
cmp byte [rcx + 0x15], 0
mov rbx, r9
mov rdi, r8
mov rsi, rdx
je 0x140042322
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
jmp method.blackbone::Native.virtual_112
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400bf300], eax
jle 0x14004237a
lea rcx, [0x1400bf300]
call fcn.14004abd0
cmp dword [0x1400bf300], 0xffffffff
jne 0x14004237a
call fcn.140047d60
mov rcx, rax
lea rdx, str.NtQueueApcThread
call fcn.140047df0
lea rcx, [0x1400bf300]
mov qword [0x1400bf2f0], rax
call fcn.14004ab70
mov rcx, qword [0x1400bf2f0]
test rcx, rcx
jne 0x14004239b
mov eax, 0xc0000138
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
xor eax, eax
mov r9, rdi
mov qword [rsp + 0x30], rax
mov r8, rsi
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea edx, [rax + 5]
call fcn.140047d20
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1400423d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1400bb060]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbp, rdx
mov rsi, rcx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
cmp byte [rcx + 0x15], r12b
jne 0x140042416
xor eax, eax
jmp 0x14004259a
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x88], xmm0
mov dword [rsp + 0x98], r12d
call fcn.1400167c0
mov rdi, rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], r12b
mov r8d, 0x19
lea rdx, str.NtQueryInformationProcess
lea rcx, [rsp + 0x38]
call fcn.140007460
nop
mov dword [rsp + 0x30], 1
call fcn.14002fc20
lea r14, [rdi + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x38]
mov rbx, qword [rsp + 0x38]
mov r15, qword [rsp + 0x50]
cmp r15, 0x10
cmovae rdx, rbx
movabs r9, 0xcbf29ce484222325
mov rcx, r12
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x1400424d3
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1400424c0
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.1400170a0
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140042534
cmp rcx, qword [rdi + 8]
je 0x140042534
mov rdi, qword [rcx + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x14004253d
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, qword [rsi + 8]
call rdi
test eax, eax
js 0x14004253d
test rbp, rbp
je 0x14004253d
mov dil, 1
jmp 0x140042540
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor dil, dil
cmp r15, 0x10
jb 0x140042573
lea rdx, [r15 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14004256b
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400425c6
mov rcx, rbx
call fcn.14004aa40
test dil, dil
je 0x140042595
mov qword [rsp + 0x20], r12
mov r9d, 0x250
mov r8, rbp
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14004aa20
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.140057ca0
int3
Function at 0x1400428d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x1400bb060]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbp, r8
mov r12, rdx
mov r15, rcx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
xor eax, eax
cmp byte [rcx + 0x15], r13b
je 0x140042a97
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [r11 - 0x60], rax
mov dword [r11 - 0x58], eax
mov dword [r11 - 0x50], r13d
call fcn.1400167c0
mov rdi, rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], r13b
lea r8d, [r13 + 0x18]
lea rdx, str.NtQueryInformationThread
lea rcx, [rsp + 0x38]
call fcn.140007460
nop
mov dword [rsp + 0x30], 1
call fcn.14002fc20
lea rsi, [rdi + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x38]
mov rbx, qword [rsp + 0x38]
mov r14, qword [rsp + 0x50]
cmp r14, 0x10
cmovae rdx, rbx
movabs r9, 0xcbf29ce484222325
mov ecx, r13d
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x1400429d3
movabs r10, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1400429c0
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.1400170a0
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140042a33
cmp rcx, qword [rdi + 8]
je 0x140042a33
mov rdi, qword [rcx + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x140042a3c
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x1c
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, r12
call rdi
test eax, eax
js 0x140042a3c
test rbp, rbp
je 0x140042a3c
mov dil, 1
jmp 0x140042a3f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor dil, dil
cmp r14, 0x10
jb 0x140042a72
lea rdx, [r14 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140042a6a
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042ac2
mov rcx, rbx
call fcn.14004aa40
test dil, dil
je 0x140042a93
mov edx, dword [rsp + 0x6c]
mov qword [rsp + 0x20], r13
mov r9d, 0x1000
mov r8, rbp
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [rsp + 0x6c]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14004aa20
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140057ca0
int3
Function at 0x140042d40
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x1400bb060]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, r8
mov r12, rdx
mov r15, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
call fcn.1400167c0
mov rsi, rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov r8d, 0x14
lea rdx, str.NtQueryVirtualMemory
lea rcx, [rsp + 0x30]
call fcn.140007460
nop
call fcn.14002fc20
lea rbp, [rsi + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x30]
mov rdi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x48]
cmp r14, 0x10
cmovae rdx, rdi
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r8, qword [rsp + 0x40]
test r8, r8
je 0x140042e23
movabs r10, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rcx + rdx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x140042e10
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1400170a0
mov r8, qword [rax + 8]
test r8, r8
je 0x140042e7d
cmp r8, qword [rsi + 8]
je 0x140042e7d
mov rsi, qword [r8 + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rsi, rsi
je 0x140042e86
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0x30
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rdx, r12
mov rcx, qword [r15 + 8]
call rsi
mov esi, eax
jmp 0x140042e8b
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, 0xc0000138
cmp r14, 0x10
jb 0x140042ebe
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140042eb6
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140042f29
mov rcx, rdi
call fcn.14004aa40
test esi, esi
je 0x140042ec6
mov eax, esi
jmp 0x140042f07
mov rax, qword [rsp + 0x68]
mov qword [rbx + 8], rax
mov eax, dword [rsp + 0x70]
mov dword [rbx + 0x10], eax
mov rax, qword [rsp + 0x60]
mov qword [rbx], rax
mov eax, dword [rsp + 0x84]
mov dword [rbx + 0x24], eax
mov rax, qword [rsp + 0x78]
mov qword [rbx + 0x18], rax
mov eax, dword [rsp + 0x80]
mov dword [rbx + 0x20], eax
mov eax, dword [rsp + 0x88]
mov dword [rbx + 0x28], eax
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14004aa20
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.140057ca0
int3