joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ddf60
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x850
mov rax, qword [0x140419c00]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov esi, r9d
mov r10, rdx
mov r9d, dword [rcx]
neg esi
mov eax, r9d
mov r11, rcx
xor eax, dword [rdx]
and eax, esi
movsxd rdx, r8d
mov dword [rsp], eax
test r8d, r8d
jle 0x1400dab52
mov qword [rsp + 0x848], rbx
add rcx, 8
mov qword [rsp + 0x840], rdi
mov rbx, r10
sub rbx, r11
lea rdi, [rsp]
sub rdi, r11
mov r8, rdx
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbx + rcx]
xor eax, dword [rcx]
lea rcx, [rcx + 4]
and eax, esi
mov dword [rdi + rcx - 4], eax
sub r8, 1
jne 0x1400daad0
mov ebx, dword [rsp]
lea rcx, [r11 + 8]
mov rdi, qword [rsp + 0x840]
xor r9d, ebx
mov dword [r11], r9d
mov r8, rdx
lea r9, [rsp]
sub r9, r11
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [rcx + r9]
xor dword [rcx], eax
lea rcx, [rcx + 4]
sub r8, 1
jne 0x1400dab10
xor dword [r10], ebx
lea r8, [rsp]
mov rbx, qword [rsp + 0x848]
lea rax, [r10 + 8]
sub r8, r10
nop word [rax + rax]
mov ecx, dword [r8 + rax]
xor dword [rax], ecx
lea rax, [rax + 4]
sub rdx, 1
jne 0x1400dab40
jmp 0x1400dab5b
xor r9d, eax
mov dword [rcx], r9d
xor dword [r10], eax
xor eax, eax
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.1400f4390
add rsp, 0x850
pop rsi
ret
jmp 0x1400daa60
Function at 0x1400e6f10
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x1a0
mov rax, qword [0x140419c00]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov rbx, r8
test rcx, rcx
je 0x1400e709d
test rbx, rbx
je 0x1400e709d
lea r8, [rsp + 0x20]
call fcn.1400e70c0
cmp eax, 0xffffff53
je 0x1400e709d
movsxd rdx, dword [rsp + 0x110]
aesimc xmm1, xmmword [rsp + 0x30]
movdqa xmm0, xmmword [rsp + 0x20]
mov rax, rdx
add rax, rax
mov dword [rbx + 0xf0], edx
mov r8, rdx
add r8, r8
movdqu xmmword [rbx + rax*8 - 0x10], xmm1
lea rax, [rdx - 2]
aesimc xmm1, xmmword [rsp + 0x50]
add rax, rax
movdqu xmmword [rbx + r8*8], xmm0
aesimc xmm0, xmmword [rsp + 0x40]
movdqu xmmword [rbx + rax*8], xmm0
lea rax, [rdx - 3]
aesimc xmm0, xmmword [rsp + 0x60]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm1
lea rax, [rdx - 4]
aesimc xmm1, xmmword [rsp + 0x70]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm0
lea rax, [rdx - 5]
aesimc xmm0, xmmword [rsp + 0x80]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm1
lea rax, [rdx - 6]
aesimc xmm1, xmmword [rsp + 0x90]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm0
lea rax, [rdx - 7]
aesimc xmm0, xmmword [rsp + 0xa0]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm1
lea rax, [rdx - 8]
aesimc xmm1, xmmword [rsp + 0xb0]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm0
lea rax, [rdx - 9]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm1
cmp edx, 0xa
jle 0x1400e705d
aesimc xmm0, xmmword [rsp + 0xc0]
aesimc xmm1, xmmword [rsp + 0xd0]
lea rax, [rdx - 0xa]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm0
lea rax, [rdx - 0xb]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm1
cmp edx, 0xc
jle 0x1400e708e
aesimc xmm0, xmmword [rsp + 0xe0]
aesimc xmm1, xmmword [rsp + 0xf0]
lea rax, [rdx - 0xc]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm0
lea rax, [rdx - 0xd]
add rax, rax
movdqu xmmword [rbx + rax*8], xmm1
movdqu xmm0, xmmword [rsp + r8*8 + 0x20]
xor eax, eax
movdqu xmmword [rbx], xmm0
jmp 0x1400e70a2
mov eax, 0xffffff53
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400f4390
add rsp, 0x1a0
pop rbx
ret
Function at 0x1400e9fb0
Capabilities:
Encrypt data using aes
Reference aes constants
Resolve function by parsing pe exports

Disassembly:
mov rax, r8
mov r8, rdx
mov rdx, rax
jmp fcn.1400e8fd0
Function at 0x1400eb860
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov eax, r8d
xor r9d, r9d
or al, cl
mov r10, rcx
or al, dl
test al, 7
jne 0x1400eb957
shr r8d, 3
test r8d, r8d
je 0x1400eba20
cmp r8d, 8
jb 0x1400eb92c
lea eax, [r8 - 1]
lea r11, [rcx + rax*8]
lea rax, [rdx + rax*8]
cmp rcx, rax
ja 0x1400eb8ab
cmp r11, rdx
jae 0x1400eb92c
mov r11d, r8d
and r11d, 0xfffffff8
mov ebx, 4
nop word [rax + rax]
movdqu xmm0, xmmword [rcx + r9*8]
lea eax, [rbx - 2]
movdqu xmm1, xmmword [rdx + r9*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r9*8], xmm1
add r9d, 8
movdqu xmm0, xmmword [rcx + rax*8]
movdqu xmm1, xmmword [rdx + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
mov eax, ebx
movdqu xmm0, xmmword [rcx + rax*8]
movdqu xmm1, xmmword [rdx + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
lea eax, [rbx + 2]
add ebx, 8
movdqu xmm0, xmmword [rcx + rax*8]
movdqu xmm1, xmmword [rdx + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
cmp r9d, r11d
jb 0x1400eb8c0
cmp r9d, r8d
jae 0x1400eba20
sub rdx, r10
lea rcx, [rcx + r9*8]
sub r8d, r9d
mov r9d, r8d
nop dword [rax]
mov rax, qword [rdx + rcx]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub r9, 1
jne 0x1400eb940
mov rbx, qword [rsp + 8]
ret
test r8d, r8d
je 0x1400eba20
cmp r8d, 0x40
jb 0x1400eb9fc
lea eax, [r8 - 1]
lea r11, [rax + rcx]
add rax, rdx
cmp r10, rax
ja 0x1400eb983
cmp r11, rdx
jae 0x1400eb9fc
mov ebx, r8d
and ebx, 0xffffffc0
mov r11d, 0x20
nop
movdqu xmm0, xmmword [r9 + rcx]
lea eax, [r11 - 0x10]
movdqu xmm1, xmmword [r9 + rdx]
pxor xmm1, xmm0
movdqu xmmword [r9 + rcx], xmm1
add r9d, 0x40
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
mov eax, r11d
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
lea eax, [r11 + 0x10]
add r11d, 0x40
movdqu xmm0, xmmword [rax + rcx]
movdqu xmm1, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
cmp r9d, ebx
jb 0x1400eb990
cmp r9d, r8d
jae 0x1400eba20
mov eax, r9d
sub rdx, r10
add rax, r10
sub r8d, r9d
mov r9d, r8d
nop dword [rax + rax]
movzx ecx, byte [rdx + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x1400eba10
mov rbx, qword [rsp + 8]
ret
Function at 0x1400eba30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov eax, r9d
mov r11d, r9d
or al, cl
xor r9d, r9d
or al, dl
mov r10, rdx
or al, r8b
test al, 7
jne 0x1400ebb50
shr r11d, 3
test r11d, r11d
je 0x1400ebc34
cmp r11d, 8
jb 0x1400ebb13
lea eax, [r11 - 1]
mov edx, eax
lea rbx, [rcx + rax*8]
lea rax, [r8 + rax*8]
cmp rcx, rax
ja 0x1400eba88
cmp rbx, r8
jae 0x1400ebb13
lea rax, [r10 + rdx*8]
cmp rcx, rax
ja 0x1400eba96
cmp rbx, r10
jae 0x1400ebb13
mov ebx, r11d
and ebx, 0xfffffff8
mov edi, 4
movdqu xmm0, xmmword [r8 + r9*8]
lea eax, [rdi - 2]
movdqu xmm1, xmmword [r10 + r9*8]
pxor xmm1, xmm0
movdqu xmm0, xmmword [r10 + rax*8]
movdqu xmmword [rcx + r9*8], xmm1
add r9d, 8
movdqu xmm1, xmmword [r8 + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
mov eax, edi
movdqu xmm0, xmmword [r8 + rax*8]
movdqu xmm1, xmmword [r10 + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
lea eax, [rdi + 2]
add edi, 8
movdqu xmm1, xmmword [r8 + rax*8]
movdqu xmm0, xmmword [r10 + rax*8]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax*8], xmm1
cmp r9d, ebx
jb 0x1400ebaa1
cmp r9d, r11d
jae 0x1400ebc34
sub r10, r8
lea rdx, [r8 + r9*8]
sub rcx, r8
sub r11d, r9d
mov r8d, r11d
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + rdx]
xor rax, qword [rdx]
mov qword [rcx + rdx], rax
lea rdx, [rdx + 8]
sub r8, 1
jne 0x1400ebb30
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
test r11d, r11d
je 0x1400ebc34
cmp r11d, 0x40
jb 0x1400ebc0e
lea eax, [r11 - 1]
mov edx, eax
lea rbx, [rax + rcx]
add rax, r10
cmp rcx, rax
ja 0x1400ebb7e
cmp rbx, r10
jae 0x1400ebc0e
lea rax, [rdx + r8]
cmp rcx, rax
ja 0x1400ebb90
cmp rbx, r8
jae 0x1400ebc0e
mov edi, r11d
and edi, 0xffffffc0
mov ebx, 0x20
nop dword [rax + rax]
movdqu xmm0, xmmword [r9 + r8]
lea eax, [rbx - 0x10]
movdqu xmm1, xmmword [r9 + r10]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax + r8]
movdqu xmmword [r9 + rcx], xmm1
add r9d, 0x40
movdqu xmm1, xmmword [rax + r10]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
mov eax, ebx
movdqu xmm0, xmmword [rax + r8]
movdqu xmm1, xmmword [rax + r10]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
lea eax, [rbx + 0x10]
add ebx, 0x40
movdqu xmm1, xmmword [rax + r10]
movdqu xmm0, xmmword [rax + r8]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
cmp r9d, edi
jb 0x1400ebba0
cmp r9d, r11d
jae 0x1400ebc34
mov edx, r9d
sub r8, r10
add rdx, r10
sub rcx, r10
sub r11d, r9d
mov r9d, r11d
movzx eax, byte [r8 + rdx]
xor al, byte [rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x1400ebc20
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x1400f2600
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push r15
sub rsp, 0x20
mov r15d, edx
mov rsi, r8
neg r15d
mov rbp, rcx
test rcx, rcx
je 0x1400f26f3
test r8, r8
je 0x1400f26f3
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
xor r12d, r12d
mov ebx, r12d
mov qword [rsp + 0x58], r14
cmp dword [rcx], ebx
jle 0x1400f267a
lea r14, [r8 + 8]
nop dword [rax]
mov edx, ebx
mov rcx, rbp
call fcn.1400f25c0
mov edx, ebx
mov rcx, rsi
mov edi, eax
call fcn.1400f25c0
xor edi, eax
lea r14, [r14 + 4]
and edi, r15d
inc ebx
xor dword [r14 - 4], edi
cmp ebx, dword [rbp]
jl 0x1400f2650
mov eax, dword [rsi]
cmp ebx, eax
jge 0x1400f26bb
movsxd r14, ebx
add r14, 2
lea r14, [rsi + r14*4]
nop dword [rax + rax]
mov edx, ebx
mov rcx, rbp
call fcn.1400f25c0
mov edx, ebx
mov rcx, rsi
mov edi, eax
call fcn.1400f25c0
xor edi, eax
lea r14, [r14 + 4]
and edi, r15d
inc ebx
xor dword [r14 - 4], edi
mov eax, dword [rsi]
cmp ebx, eax
jl 0x1400f2690
mov edx, dword [rsi + 4]
mov ecx, eax
xor ecx, dword [rbp]
mov r14, qword [rsp + 0x58]
and ecx, r15d
mov rdi, qword [rsp + 0x48]
xor ecx, eax
mov rbx, qword [rsp + 0x40]
mov eax, r12d
mov r12, qword [rsp + 0x50]
mov dword [rsi], ecx
xor edx, dword [rbp + 4]
and edx, r15d
xor dword [rsi + 4], edx
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
mov eax, 0xffffff53
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret

Function at 0x1400f2870
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
mov r8, qword [rsp + 0x28]
mov r9d, dword [rsp + 0x30]
mov r10, rcx
shr rcx, 4
shl r10, 0x3c
je 0x1400f289d
add rcx, 1
sub rsi, 0x10
movdqa xmm1, xmmword [rdx]
pxor xmm1, xmmword [rdi]
pxor xmm1, xmmword [r8]
add rsi, 0x10
add rdi, 0x10
cmp r9d, 0xc
aesenc xmm1, xmmword [r8 + 0x10]
aesenc xmm1, xmmword [r8 + 0x20]
aesenc xmm1, xmmword [r8 + 0x30]
aesenc xmm1, xmmword [r8 + 0x40]
aesenc xmm1, xmmword [r8 + 0x50]
aesenc xmm1, xmmword [r8 + 0x60]
aesenc xmm1, xmmword [r8 + 0x70]
aesenc xmm1, xmmword [r8 + 0x80]
aesenc xmm1, xmmword [r8 + 0x90]
movdqa xmm2, xmmword [r8 + 0xa0]
jb 0x1400f294a
cmp r9d, 0xe
aesenc xmm1, xmmword [r8 + 0xa0]
aesenc xmm1, xmmword [r8 + 0xb0]
movdqa xmm2, xmmword [r8 + 0xc0]
jb 0x1400f294a
aesenc xmm1, xmmword [r8 + 0xc0]
aesenc xmm1, xmmword [r8 + 0xd0]
movdqa xmm2, xmmword [r8 + 0xe0]
dec rcx
aesenclast xmm1, xmm2
movdqu xmmword [rsi], xmm1
jne 0x1400f28a5
mov rdi, rax
mov rsi, r11
ret
Function at 0x1400f3edd
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
mov dword [rsi + 0xf0], 0xa
movdqu xmm1, xmmword [rdi]
movdqa xmmword [rsi], xmm1
aeskeygenassist xmm2, xmm1, 1
call fcn.1400f3fab
movdqa xmmword [rsi + 0x10], xmm1
aeskeygenassist xmm2, xmm1, 2
call fcn.1400f3fab
movdqa xmmword [rsi + 0x20], xmm1
aeskeygenassist xmm2, xmm1, 4
call fcn.1400f3fab
movdqa xmmword [rsi + 0x30], xmm1
aeskeygenassist xmm2, xmm1, 8
call fcn.1400f3fab
movdqa xmmword [rsi + 0x40], xmm1
aeskeygenassist xmm2, xmm1, 0x10
call fcn.1400f3fab
movdqa xmmword [rsi + 0x50], xmm1
aeskeygenassist xmm2, xmm1, 0x20
call fcn.1400f3fab
movdqa xmmword [rsi + 0x60], xmm1
aeskeygenassist xmm2, xmm1, 0x40
call fcn.1400f3fab
movdqa xmmword [rsi + 0x70], xmm1
aeskeygenassist xmm2, xmm1, 0x80
call fcn.1400f3fab
movdqa xmmword [rsi + 0x80], xmm1
aeskeygenassist xmm2, xmm1, 0x1b
call fcn.1400f3fab
movdqa xmmword [rsi + 0x90], xmm1
aeskeygenassist xmm2, xmm1, 0x36
call fcn.1400f3fab
movdqa xmmword [rsi + 0xa0], xmm1
mov rdi, rax
mov rsi, r11
ret

Function at 0x1400f3fd4
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
sub rsp, 0x18
movdqa xmmword [rsp], xmm6
movdqu xmm1, xmmword [rdi]
movq xmm3, qword [rdi + 0x10]
movdqa xmmword [rsi], xmm1
movdqa xmm5, xmm3
aeskeygenassist xmm2, xmm3, 1
call fcn.1400f40f9
shufpd xmm5, xmm1, 0
movdqa xmmword [rsi + 0x10], xmm5
movdqa xmm6, xmm1
shufpd xmm6, xmm3, 1
movdqa xmmword [rsi + 0x20], xmm6
aeskeygenassist xmm2, xmm3, 2
call fcn.1400f40f9
movdqa xmmword [rsi + 0x30], xmm1
movdqa xmm5, xmm3
aeskeygenassist xmm2, xmm3, 4
call fcn.1400f40f9
shufpd xmm5, xmm1, 0
movdqa xmmword [rsi + 0x40], xmm5
movdqa xmm6, xmm1
shufpd xmm6, xmm3, 1
movdqa xmmword [rsi + 0x50], xmm6
aeskeygenassist xmm2, xmm3, 8
call fcn.1400f40f9
movdqa xmmword [rsi + 0x60], xmm1
movdqa xmm5, xmm3
aeskeygenassist xmm2, xmm3, 0x10
call fcn.1400f40f9
shufpd xmm5, xmm1, 0
movdqa xmmword [rsi + 0x70], xmm5
movdqa xmm6, xmm1
shufpd xmm6, xmm3, 1
movdqa xmmword [rsi + 0x80], xmm6
aeskeygenassist xmm2, xmm3, 0x20
call fcn.1400f40f9
movdqa xmmword [rsi + 0x90], xmm1
movdqa xmm5, xmm3
aeskeygenassist xmm2, xmm3, 0x40
call fcn.1400f40f9
shufpd xmm5, xmm1, 0
movdqa xmmword [rsi + 0xa0], xmm5
movdqa xmm6, xmm1
shufpd xmm6, xmm3, 1
movdqa xmmword [rsi + 0xb0], xmm6
aeskeygenassist xmm2, xmm3, 0x80
call fcn.1400f40f9
movdqa xmmword [rsi + 0xc0], xmm1
movdqa xmmword [rsi + 0xd0], xmm3
mov rdi, rax
mov rsi, r11
movdqa xmm6, xmmword [rsp]
add rsp, 0x18
ret
Function at 0x1400f4138
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, rdi
mov r11, rsi
mov rdi, rcx
mov rsi, rdx
movdqu xmm1, xmmword [rdi]
movdqu xmm3, xmmword [rdi + 0x10]
movdqa xmmword [rsi], xmm1
movdqa xmmword [rsi + 0x10], xmm3
aeskeygenassist xmm2, xmm3, 1
call fcn.1400f4242
movdqa xmmword [rsi + 0x20], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400f426b
movdqa xmmword [rsi + 0x30], xmm3
aeskeygenassist xmm2, xmm3, 2
call fcn.1400f4242
movdqa xmmword [rsi + 0x40], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400f426b
movdqa xmmword [rsi + 0x50], xmm3
aeskeygenassist xmm2, xmm3, 4
call fcn.1400f4242
movdqa xmmword [rsi + 0x60], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400f426b
movdqa xmmword [rsi + 0x70], xmm3
aeskeygenassist xmm2, xmm3, 8
call fcn.1400f4242
movdqa xmmword [rsi + 0x80], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400f426b
movdqa xmmword [rsi + 0x90], xmm3
aeskeygenassist xmm2, xmm3, 0x10
call fcn.1400f4242
movdqa xmmword [rsi + 0xa0], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400f426b
movdqa xmmword [rsi + 0xb0], xmm3
aeskeygenassist xmm2, xmm3, 0x20
call fcn.1400f4242
movdqa xmmword [rsi + 0xc0], xmm1
aeskeygenassist xmm2, xmm1, 0
call fcn.1400f426b
movdqa xmmword [rsi + 0xd0], xmm3
aeskeygenassist xmm2, xmm3, 0x40
call fcn.1400f4242
movdqa xmmword [rsi + 0xe0], xmm1
mov rdi, rax
mov rsi, r11
ret

Function at 0x1400f4f1c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400f4f66
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400f4f66
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400f4f66
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400f4f66
cmp dword [rcx + 0x84], 0xe
jbe 0x1400f4f66
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400f4f68
xor al, al
add rsp, 0x28
ret
Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020640]
call fcn.1400123b8
lea rcx, [0x140021210]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
sbb dword [rcx], ebx
sbb edi, edi
sbb ebx, dword [rbx]
sbb edi, edi
sbb ebx, dword [rbx]
sbb edi, edi
sbb ebx, dword [rbx]
sbb edi, edi
sbb ebx, dword [rbx]
sbb edi, edi
sbb ebx, dword [rbx]
sbb edi, edi
sbb ebx, dword [rbx]
sbb edi, edi
sbb ebx, dword [rbx]
sbb edi, edi
sbb ebx, dword [rbx]
sbb edi, edi
adc edx, dword [rbx]
adc edi, edi
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
or al, 0xc
or al, 0xff
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
invalid
Function at 0x14001120d
Capabilities:
Terminate process

Disassembly:
jmp 0x1400132f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001129e
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014640
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014660
xor al, al
jmp 0x1400146e1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014673
xor al, al
jmp 0x1400146e1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001469d
xor al, al
jmp 0x1400146e1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400146b1
xor al, al
jmp 0x1400146e1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400146c3
xor al, al
jmp 0x1400146e1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400146df
xor al, al
jmp 0x1400146e1
mov al, 1
add rsp, 0x38
ret
Function at 0x140015e80
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x140015eb5
nop
movdqu xmm0, xmmword [rdx + r8]
pxor xmm0, xmmword [r8]
movdqu xmmword [rcx + r8], xmm0
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x140015e90
and r10, 0xf
je 0x140015ee5
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
mov al, byte [rdx + r8]
xor al, byte [r8]
mov byte [rcx + r8], al
mov byte [r8], al
lea r8, [r8 + 1]
dec r10
jne 0x140015ec0
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x140015ed9
mov rax, r8
repz ret

Function at 0x140015ef0
Capabilities:
Encode data using xor

Disassembly:
sub rdx, r8
sub rcx, r8
mov r10, r9
shr r9, 4
je 0x140015f2d
nop
movdqu xmm0, xmmword [rdx + r8]
movdqa xmm1, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [rcx + r8], xmm1
movdqa xmmword [r8], xmm0
lea r8, [r8 + 0x10]
dec r9
jne 0x140015f00
pxor xmm1, xmm1
and r10, 0xf
je 0x140015f63
mov r9d, reloc.WS2_32.dll_recv
sub r9, r10
xor eax, eax
xor r11, r11
mov r11b, byte [rdx + r8]
mov al, byte [r8]
xor al, r11b
mov byte [rcx + r8], al
mov byte [r8], r11b
lea r8, [r8 + 1]
dec r10
jne 0x140015f3b
xor eax, eax
mov byte [r8], al
lea r8, [r8 + 1]
dec r9
jne 0x140015f57
mov rax, r8
repz ret
Function at 0x1400d6330
Capabilities:
Access the windows event log

Disassembly:
push rbx
sub rsp, 0x60
movsxd rax, edx
xor r11d, r11d
mov edx, 1
lea ebx, [rdx + 1]
cmp eax, 5
ja case.0x1400d635b.4
lea r10, [0x140000000]
mov ecx, dword [r10 + rax*4 + 0xd63bc]
add rcx, r10
jmp rcx
movzx edx, r11w
jmp case.0x1400d635b.4
mov edx, 4
jmp case.0x1400d635b.4
movzx edx, bx
mov rcx, qword [0x1405fa6f8]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r11d
mov qword [rsp + 0x50], r9
mov r9d, 0x1337
mov qword [rsp + 0x58], r8
mov r8d, 0xdead
mov word [rsp + 0x28], bx
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
setne al
add rsp, 0x60
pop rbx
ret

Function at 0x1400d89f0
Capabilities:
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rdx], 0
mov rbx, rdx
je 0x1400d8a16
inc rdx
call fcn.1400d89f0
imul rcx, rax, 0x21
movsx eax, byte [rbx]
add rax, rcx
add rsp, 0x20
pop rbx
ret
mov eax, 0x1505
add rsp, 0x20
pop rbx
ret

Function at 0x1400e0e90
Capabilities:
Hash data using djb2

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 0xf
jbe 0x1400e0e9e
mov rcx, qword [rcx]
movsx r8d, byte [rcx]
test r8b, r8b
je 0x1400e0ec4
lea rdx, [rcx + 1]
lea rcx, [rsp + 0x30]
call fcn.1400d89f0
imul rax, rax, 0x21
mov edx, r8d
add rax, rdx
add rsp, 0x28
ret
mov eax, 0x1505
add rsp, 0x28
ret