joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180135bb4
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180135bd4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.18011c644
or eax, 0xffffffff
jmp 0x180135bd6
xor eax, eax
add rsp, 0x28
ret
Function at 0x180139ccc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180139cfc
xor eax, eax
jmp 0x180139dbf
mov rbp, rbx
cmp word [rax], si
je 0x180139d21
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180139d08
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180139d04
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.18012f81c
movsxd r14, eax
test eax, eax
jne 0x180139d5f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180139cf5
mov rcx, r14
call fcn.18012f72c
mov rdi, rax
test rax, rax
jne 0x180139d78
xor ecx, ecx
call fcn.18012f6f0
jmp 0x180139d54
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.18012f81c
test eax, eax
jne 0x180139da9
mov rcx, rdi
call fcn.18012f6f0
jmp 0x180139db3
xor ecx, ecx
call fcn.18012f6f0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x180139ddc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x180139e63
mov rsi, rbx
cmp word [rax], bp
je 0x180139e22
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x180139e0c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x180139e08
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.18012f72c
mov rdi, rax
test rax, rax
je 0x180139e50
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1801176a0
mov rbp, rdi
xor ecx, ecx
call fcn.18012f6f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18013cec0
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.18012da38
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x18013cf61
cmp ebx, dword [rsp + 0x30]
je 0x18013cf5a
test esi, esi
je 0x18013cf5a
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x18013cf35
sub r8w, 0x61
cmp r8w, 0x19
ja 0x18013cf42
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x18013cf1f
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x18013cf46
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x18013cf63
mov eax, 1
jmp 0x18013cf63
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18013f008
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1802ae098]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x18013f052
call fcn.18011c6b0
mov dword [rax], 0xf
call fcn.18011c6d0
mov dword [rax], 0xd
call fcn.18011d854
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180114f40
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x18013f05d
lea eax, [rbx + 1]
jmp 0x18013f03f
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x18013f03d
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x18013f03f
Function at 0x18014192c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.18011bde0
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1801419b6
cmp byte [rbp - 0x21], r15b
je 0x1801419b1
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1801419ec
call fcn.18012fd90
test eax, eax
jne 0x1801419d8
cmp byte [rbp - 0x21], r15b
je 0x1801419d0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1801419ec
cmp byte [rbp - 0x21], r15b
je 0x1801419e9
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.18011c1b4
test eax, eax
jne 0x180141a8c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.18011bde0
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x180141a2b
cmp byte [rbp - 0x21], r15b
je 0x180141a60
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x180141a60
call fcn.18012fd90
test eax, eax
jne 0x180141a4c
cmp byte [rbp - 0x21], r15b
je 0x180141a45
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x180141a60
cmp byte [rbp - 0x21], r15b
je 0x180141a5d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.18011c1b4
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x180141a8c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x180141a8f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x180141a9d
mov rcx, rdi
call fcn.18012f6f0
cmp byte [rbp + 0x3f], r15b
je 0x180141aac
mov rcx, qword [rbp + 0x27]
call fcn.18012f6f0
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180142978
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1801354f0
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1801354f0
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x180142ac8
cmp rax, 0xffffffffffffffff
je 0x180142ac8
xor edi, edi
test rbp, rbp
jle 0x180142a73
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.180130714
mov rbx, rax
test rax, rax
jne 0x180142a00
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x180142a69
mov edx, 0x8000
mov ecx, r14d
call fcn.1801427fc
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.180132ce4
cmp eax, 0xffffffff
je 0x180142a49
cdqe
sub rbp, rax
test rbp, rbp
jg 0x180142a10
mov edx, r15d
mov ecx, r14d
call fcn.1801427fc
jmp 0x180142a69
cmp byte [rsi + 0x38], dil
je 0x180142a60
cmp dword [rsi + 0x34], 5
jne 0x180142a60
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x180142a69
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.18012f6f0
jmp 0x180142adc
jns 0x180142adc
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1801354f0
cmp rax, 0xffffffffffffffff
jne 0x180142a94
cmp byte [rsi + 0x30], dil
je 0x180142adc
mov edi, dword [rsi + 0x2c]
jmp 0x180142adc
mov ecx, r14d
call fcn.180133fd0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x180142adc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x180142adc
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x180142ad5
mov eax, dword [rsi + 0x2c]
jmp 0x180142ada
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1801354f0
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1801430d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1801430f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1801430f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180001f3b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x230
movsxd rax, dword [rcx + 0x3c]
mov r15, r8
mov r12d, edx
mov rdi, rcx
mov r9d, dword [rax + rcx + 0x88]
mov esi, dword [r9 + rcx + 0x20]
mov r14d, dword [r9 + rcx + 0x1c]
add rsi, rcx
mov ebp, dword [r9 + rcx + 0x24]
or dword [rsp + rcx*2], esp
add esi, ecx

Function at 0x180002280
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rbp - 0x19]
mov qword [rdx + 0x98], rax
mov rax, qword [rbp - 0x11]
mov qword [rdx + 0x28], rax
mov rax, qword [rbp - 9]
mov qword [rdx + 0x18], rbx
mov rbx, qword [rbp + 0x7f]
mov qword [rdx + 0xa8], rdi
mov rdi, qword [rbp + 0x77]
mov qword [rdx + 0x88], rsi
mov r8, rdi
mov qword [rdx], rax
mov rsi, rdx
mov qword [rdx + 0x48], rcx
mov qword [rdx + 0xd8], r12
mov qword [rdx + 0xc8], rbx
mov qword [rdx + 0x30], r15
mov qword [rdx + 0x20], r14
mov qword [rdx + 0x50], r13
mov edx, 0x80e96588
call fcn.180001f3b
mov qword [rsi + 0xb8], rax
mov r8, rdi
mov rax, qword [rbp + 0x67]
mov r15, qword [rax]
mov edx, dword [rdi + 0x54]
mov rcx, qword [rbp - 0x39]
call fcn.180001f3b
movsxd r12, dword [rdi + 0x14]
invalid
adc al, 0x8b
invalid
adc al, 1
add byte [rax], al
and dword [rbp + 0x67], 0
and qword [rbp - 0x31], 0
mov r14d, dword [r12 + r15]
xor ecx, dword [rdi + 0x64]
mov r13d, dword [r12 + r15 + 4]
mov qword [rbp - 0x29], rax
xor eax, eax
mov qword [rbp - 0x39], rax
cmp r14d, ecx
je 0x180002358
mov edx, r14d
lea ecx, [rax + 0x40]
call rbx
lea rdx, [r15 + 8]
mov r8d, r14d
add rdx, r12
mov rcx, rax
mov rbx, rax
call fcn.180001ed3
test r14d, r14d
je 0x1800022ec
lea edx, [r14 - 1]
mov rax, rbx
shr edx, 2
inc edx
xor dword [rax], r13d
lea rax, [rax + 4]
sub rdx, 1
jne 0x1800022df
mov edx, 0x20a
mov ecx, 0x40
call qword [rbp + 0x7f]
mov cl, byte [rbx]
test cl, cl
je 0x180002315
mov rdx, rax
inc rbx
movsx ecx, cl
mov word [rdx], cx
lea rdx, [rdx + 2]
mov cl, byte [rbx]
test cl, cl
jne 0x180002302
lea r9, [rbp + 0x67]
mov rdx, rax
lea r8, [rbp - 0x31]
mov rcx, rsi
call fcn.180002a4b
test al, al
je 0x18000248c
mov r8d, dword [rax + 0xc]
lea rcx, [rax + 0x10]
mov edx, dword [rax + 8]
lea r9, [rbp + 0x67]
and qword [rbp + 0x67], 0
mov qword [rsp + 0x20], rsi
call fcn.1800024f3
test al, al
je 0x18000248c
mov r12, qword [rbp + 0x67]
xor r14d, r14d
lea rcx, [r12 + 0x90]
call fcn.1800029e3
test eax, eax
jne 0x18000239e
mov r14d, dword [r12 + 0x160]
mov eax, dword [r12 + 8]
lea r8, [rbp + 0x67]
mov r9d, dword [rdi + 0xbc]
invalid
invalid

Function at 0x1800026d0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [r13 + 4]
lea rcx, [rbx + 0x10]
mov eax, dword [r13 + 8]
jmp 0x1800026e0
dec eax
test al, 3
jne 0x1800026de
test eax, eax
je 0x1800026fd
lea edx, [rax - 1]
shr edx, 2
inc edx
xor dword [rcx], r8d
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x1800026f0
mov rax, qword [rsp + 0x90]
test ebp, ebp
mov qword [rax], rbx
setne al
jmp 0x180002711
Function at 0x180006051
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov edi, ecx
mov rbx, qword [rax + 0x18]
add rbx, 0x10
mov rbx, qword [rbx]
mov rcx, qword [rbx + 0x60]
test rcx, rcx
je 0x18000606e
test edi, edi
je 0x180006087
call fcn.180006099
cmp edi, eax
jne 0x18000606e
mov rax, qword [rbx + 0x30]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x7ff77f2e6100
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x7ff77f2e6123
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x24]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x17
jb 0x7ff77f2e6110
mov byte [rcx + 0x18], 0
ret

Function at 0x7ff77f2e6130
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x7ff77f2e6153
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x24]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x14
jb 0x7ff77f2e6140
mov byte [rcx + 0x15], 0
ret

Function at 0x7ff77f2e6160
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x7ff77f2e6183
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x24]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x7ff77f2e6170
mov byte [rcx + 0xc], 0
ret

Function at 0x7ff77f2e6190
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
je 0x7ff77f2e61b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x24]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x12
jb 0x7ff77f2e61a0
mov byte [rcx + 0x13], 0
ret
Function at 0x7ff77f2e67f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x7ff77f2e6813
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x24]
xor byte [rax + rcx], dl
inc rax
cmp rax, 5
jb 0x7ff77f2e6800
mov byte [rcx + 6], 0
ret

Function at 0x7ff77f2e6820
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x7ff77f2e6843
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x24]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x7ff77f2e6830
mov byte [rcx + 3], 0
ret

Function at 0x7ff77f2e77f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x7ff77f2e7813
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x24]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x7ff77f2e7800
mov byte [rcx + 7], 0
ret
Function at 0x7ff77f2e9a60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2e], 0
je 0x7ff77f2e9a83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x21]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2d
jb 0x7ff77f2e9a70
mov byte [rcx + 0x2e], 0
ret

Function at 0x7ff77f2e9a90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x7ff77f2e9ab3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x21]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xe
jb 0x7ff77f2e9aa0
mov byte [rcx + 0xf], 0
ret

Function at 0x7ff77f2e9ac0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x16], 0
je 0x7ff77f2e9ae3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x21]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x15
jb 0x7ff77f2e9ad0
mov byte [rcx + 0x16], 0
ret

Function at 0x7ff77f2e9af0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x7ff77f2e9b13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x21]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x7ff77f2e9b00
mov byte [rcx + 0x12], 0
ret

Function at 0x7ff77f2e9b20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
je 0x7ff77f2e9b43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x21]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x13
jb 0x7ff77f2e9b30
mov byte [rcx + 0x14], 0
ret
Function at 0x7ff77f2eb020
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x7ff77f37b080]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], 0xba49
mov rbp, rcx
mov dword [rsp + 0x30], 0xff410000
mov byte [rsp + 0x34], 0xe2
mov qword [rsp + 0x20], rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x7ff77f2eb0fa
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x7ff77f2eb0fa
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0xc75e22f9
lea rcx, [r14 + r11*4]
mov r8d, dword [rcx + rbx]
add r8, rbx
movzx r9d, byte [r8]
inc r8
test r9b, r9b
je 0x7ff77f2eb0f5
movsx ecx, r9b
lea r8, [r8 + 1]
sub r9b, 0x41
mov edx, ecx
or edx, 0x20
cmp r9b, 0x19
movzx r9d, byte [r8 - 1]
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
test r9b, r9b
jne 0x7ff77f2eb0c0
cmp r10d, 0x3ebe0100
je 0x7ff77f2eb102
test r11d, r11d
jne 0x7ff77f2eb0a0
mov rax, qword [rax]
jmp 0x7ff77f2eb070
mov ecx, dword [rsi + 0x24]
mov r8d, 8
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x20]
add rax, rbx
lea rcx, [rsp + 0x2a]
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x7ff77f2eb1cd
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x7ff77f2eb1cd
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0xf32ff0a9
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x7ff77f2eb1c8
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x7ff77f2eb190
cmp r10d, 0xec1c5370
je 0x7ff77f2eb1d5
test r11d, r11d
jne 0x7ff77f2eb170
mov rax, qword [rax]
jmp 0x7ff77f2eb140
mov edx, dword [rsi + 0x24]
mov rcx, rbp
add rdx, rbx
movzx r8d, word [rdx + r11*2]
mov edx, dword [rsi + 0x1c]
add rdx, rbx
mov eax, dword [rdx + r8*4]
mov r8d, 0xd
add rax, rbx
lea rdx, [rsp + 0x28]
call rax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.7ff77f355090
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x7ff77f2ec4f0
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov ebp, edx
mov r15, rcx
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
mov rcx, qword gs:[0x60]
mov r12, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop word [rax + rax]
mov rbx, qword [rcx + 0x30]
movsxd rdx, dword [rbx + 0x3c]
mov edi, dword [rdx + rbx + 0x88]
add rdi, rbx
cmp rdi, rbx
je 0x7ff77f2ec5b7
mov r11d, dword [rdi + 0x18]
test r11d, r11d
je 0x7ff77f2ec5b7
mov r14d, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0xe069b338
lea rax, [r14 + r11*4]
mov r9d, dword [rax + rbx]
add r9, rbx
movzx eax, byte [r9]
inc r9
test al, al
je 0x7ff77f2ec5b2
nop
movsx edx, al
lea r9, [r9 + 1]
sub al, 0x41
mov r8d, edx
or r8d, 0x20
cmp al, 0x19
movzx eax, byte [r9 - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test al, al
jne 0x7ff77f2ec580
cmp r10d, 0x6500a71a
je 0x7ff77f2ec5bf
test r11d, r11d
jne 0x7ff77f2ec560
mov rcx, qword [rcx]
jmp 0x7ff77f2ec530
mov ecx, dword [rdi + 0x24]
mov rdx, r15
add rcx, rbx
movzx r8d, word [rcx + r11*2]
mov ecx, dword [rdi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + r8*4]
lea r8, [0x7ff77f37bf88]
add rax, rbx
mov rcx, r12
xor ebx, ebx
mov qword [rsp + 0x20], rbx
lea r9d, [rbx + 5]
call rax
test ebp, ebp
je 0x7ff77f2ec6b9
sub ebp, 1
je 0x7ff77f2ec667
cmp ebp, 1
jne 0x7ff77f2ec64e
movzx eax, byte [0x7ff77f37bf90]
cmp byte [0x7ff77f37bf88], al
jne 0x7ff77f2ec64e
movzx eax, byte [0x7ff77f37bf91]
cmp byte [0x7ff77f37bf89], al
jne 0x7ff77f2ec64e
movzx eax, byte [0x7ff77f37bf92]
cmp byte [0x7ff77f37bf8a], al
jne 0x7ff77f2ec64e
movzx eax, byte [0x7ff77f37bf93]
cmp byte [0x7ff77f37bf8b], al
jne 0x7ff77f2ec64e
movzx eax, byte [0x7ff77f37bf94]
cmp byte [0x7ff77f37bf8c], al
je 0x7ff77f2ec6b2
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
movzx eax, byte [0x7ff77f37bf28]
cmp byte [0x7ff77f37bf88], al
jne 0x7ff77f2ec64e
movzx eax, byte [0x7ff77f37bf29]
cmp byte [0x7ff77f37bf89], al
jne 0x7ff77f2ec64e
movzx eax, byte [0x7ff77f37bf2a]
cmp byte [0x7ff77f37bf8a], al
jne 0x7ff77f2ec64e
movzx eax, byte [0x7ff77f37bf2b]
cmp byte [0x7ff77f37bf8b], al
jne 0x7ff77f2ec64e
movzx eax, byte [0x7ff77f37bf2c]
cmp byte [0x7ff77f37bf8c], al
jne 0x7ff77f2ec64e
mov eax, 1
jmp 0x7ff77f2ec650
movzx eax, byte [0x7ff77f37bf70]
cmp byte [0x7ff77f37bf88], al
jne 0x7ff77f2ec64e
movzx eax, byte [0x7ff77f37bf71]
cmp byte [0x7ff77f37bf89], al
jne 0x7ff77f2ec64e
movzx ecx, byte [0x7ff77f37bf72]
cmp byte [0x7ff77f37bf8a], cl
jne 0x7ff77f2ec64e
movzx ecx, byte [0x7ff77f37bf73]
cmp byte [0x7ff77f37bf8b], cl
jne 0x7ff77f2ec64e
movzx ecx, byte [0x7ff77f37bf74]
cmp byte [0x7ff77f37bf8c], cl
sete bl
mov eax, ebx
jmp 0x7ff77f2ec650
Function at 0x7ff77f2ee6b0
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x500
mov rax, qword [0x7ff77f37b080]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rbp, rdx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x50], 0x100010
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x7ff77f2ee79d
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x7ff77f2ee79d
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x2a4097
lea rcx, [r14 + r11*4]
mov ecx, dword [rcx + rbx]
add rcx, rbx
movzx r9d, byte [rcx]
inc rcx
test r9b, r9b
je 0x7ff77f2ee798
nop
movsx edx, r9b
lea rcx, [rcx + 1]
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
movzx r9d, byte [rcx - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test r9b, r9b
jne 0x7ff77f2ee760
cmp r10d, 0xb1eacb7c
je 0x7ff77f2ee7a5
test r11d, r11d
jne 0x7ff77f2ee740
mov rax, qword [rax]
jmp 0x7ff77f2ee710
mov edx, dword [rsi + 0x24]
mov rcx, rbp
add rdx, rbx
movzx r8d, word [rdx + r11*2]
mov edx, dword [rsi + 0x1c]
add rdx, rbx
mov eax, dword [rdx + r8*4]
lea rdx, [rsp + 0x20]
add rax, rbx
call rax
test eax, eax
je 0x7ff77f2ee804
cmp qword [rsp + 0x68], 0
jne 0x7ff77f2ee82c
cmp qword [rsp + 0x70], 0
jne 0x7ff77f2ee82c
cmp qword [rsp + 0x78], 0
jne 0x7ff77f2ee82c
cmp qword [rsp + 0x80], 0
jne 0x7ff77f2ee82c
cmp qword [rsp + 0x88], 0
jne 0x7ff77f2ee82c
cmp qword [rsp + 0x90], 0
jne 0x7ff77f2ee82c
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.7ff77f355090
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.7ff77f2ee300
int3