joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140054e90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140091010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140054ebd
xor eax, eax
jmp 0x140055029
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140054ef7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140054ef7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140055029
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14005501c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140054f3a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140054f65
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140055021
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140054fd4
sub eax, 1
je 0x140054fd4
cmp eax, 2
jne 0x14005501c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140055021
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140055002
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14005501c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140055021
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400726c0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x140055200
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4a], 0
je 0x140055225
xor eax, eax
mov r8d, 0x4199
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x24
jb 0x140055210
mov byte [rcx + 0x4a], 0
ret

Function at 0x140055230
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x50], 0
je 0x140055255
xor eax, eax
mov r8d, 0x4199
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x27
jb 0x140055240
mov byte [rcx + 0x50], 0
ret
Function at 0x140055260
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3e], 0
je 0x140055285
xor eax, eax
mov r8d, 0x4199
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x1e
jb 0x140055270
mov byte [rcx + 0x3e], 0
ret

Function at 0x140055290
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x36], 0
je 0x1400552b5
xor eax, eax
mov r8d, 0x4199
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x1a
jb 0x1400552a0
mov byte [rcx + 0x36], 0
ret

Function at 0x1400552c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4c], 0
je 0x1400552e5
xor eax, eax
mov r8d, 0x4199
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x25
jb 0x1400552d0
mov byte [rcx + 0x4c], 0
ret

Function at 0x1400552f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x46], 0
je 0x140055315
xor eax, eax
mov r8d, 0x4199
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x22
jb 0x140055300
mov byte [rcx + 0x46], 0
ret

Function at 0x140055320
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x58], 0
je 0x140055345
xor eax, eax
mov r8d, 0x4199
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x2b
jb 0x140055330
mov byte [rcx + 0x58], 0
ret

Function at 0x1400557e0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140091010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400558b3
cmp byte [rcx + 0x71], 0
je 0x1400558b3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400558af
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140055874
sub eax, 1
je 0x140055878
cmp eax, 2
jne 0x1400558af
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400726c0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400558a6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400558af
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14005585c
xor al, al
jmp 0x14005585c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400726c0
add rsp, 0x60
pop rbx
ret
Function at 0x14005d230
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x140091010]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14005d347
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14005d347
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov qword [rsp + 0x58], r8
mov ecx, dword [rax + rdx + 0xb0]
test ecx, ecx
jne 0x14005d2a9
mov qword [rdi], r8
mov qword [rdi + 8], r8
mov qword [rdi + 0x10], r8
jmp 0x14005d352
lea rbx, [rdx + rcx]
mov ebp, dword [rax + rdx + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x50]
cmp rbx, rbp
jae 0x14005d335
mov edx, dword [rbx + 4]
test edx, edx
je 0x14005d335
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [rdx - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, r8
je 0x14005d30e
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
mov rcx, qword [rsp + 0x50]
add rcx, 0x18
mov qword [rsp + 0x50], rcx
jmp 0x14005d325
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.14005dbe0
mov rcx, qword [rsp + 0x50]
mov eax, dword [rbx + 4]
add rbx, rax
mov r8, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x14005d2c1
mov rax, qword [rsp + 0x48]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r8
jmp 0x14005d352
mov qword [rcx], r8
mov qword [rcx + 8], r8
mov qword [rcx + 0x10], r8
mov rax, rdi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400726c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x14005ed30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1d], 0
je 0x14005ed53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x61]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1c
jb 0x14005ed40
mov byte [rcx + 0x1d], 0
mov rax, rcx
ret
Function at 0x14005f350
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x50
mov rax, qword [0x140091010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor edx, edx
lea r9, [rsp + 0x20]
mov rsi, rcx
xor r14d, r14d
xor r8d, r8d
mov dword [rsp + 0x20], r14d
mov ebx, r14d
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14005f3de
test rbx, rbx
je 0x14005f3a6
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14005f390
test eax, eax
jns 0x14005f3ff
test rbx, rbx
je 0x14005f404
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x14005f502
test rbx, rbx
jne 0x14005f40b
xor eax, eax
jmp 0x14005f502
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rdi
mov edi, r14d
cmp dword [rbx], r14d
jbe 0x14005f4e2
mov eax, edi
xorps xmm0, xmm0
imul rcx, rax, 0x128
movups xmmword [rsp + 0x28], xmm0
movzx edx, word [rcx + rbx + 0x2e]
lea rbp, [rcx + rbx]
add rdx, 0x30
mov qword [rsp + 0x38], r14
add rdx, rcx
mov qword [rsp + 0x40], r14
add rdx, rbx
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], r14b
jne 0x14005f460
lea rcx, [rsp + 0x28]
call fcn.14005a6a0
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x14005f480
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14005f518
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14005f4d8
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f4d3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005f561
call fcn.1400727b0
inc edi
cmp edi, dword [rbx]
jb 0x14005f424
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400726c0
add rsp, 0x50
pop r14
pop rsi
pop rbx
ret
mov rdi, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14005f56d
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005f568
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005f568
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400727b0
mov rax, rdi
jmp 0x14005f4f5
Function at 0x140061630
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140091010]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov esi, r8d
mov r14, rdx
xor r9d, r9d
cmp ecx, 0x7b
ja 0x14006166f
movsxd rax, ecx
lea r9, [0x1401bba40]
mov r9, qword [r9 + rax*8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x18], send
mov byte [rbp - 0x30], 0
test r9, r9
jne 0x140061788
mov dword [rbp - 0x40], 0xfff5fdc4
mov dword [rbp - 0x3c], 0xd5bde8f8
mov dword [rbp - 0x38], 0x100d9fa
xor ecx, ecx
nop word [rax + rax]
lea eax, [rcx - 0x69]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 0xa
jb 0x1400616b0
mov byte [rbp - 0x35], 0
lea rax, [rbp - 0x40]
mov rdi, 0xffffffffffffffff
mov rbx, rdi
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400616d2
lea rcx, [rbp - 0x30]
cmp rbx, 0xf
ja 0x1400616fc
mov qword [rbp - 0x20], rbx
mov r8, rbx
lea rdx, [rbp - 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x30], 0
jmp 0x140061708
lea r9, [rbp - 0x40]
mov rdx, rbx
call fcn.14005d690
cmp esi, 1
jne 0x1400617d3
mov dword [rbp - 0x40], 0xeffee8c9
mov dword [rbp - 0x3c], 0xc5f4beee
mov word [rbp - 0x38], 0xd8
mov byte [rbp - 0x36], sil
xor ecx, ecx
nop dword [rax + rax]
lea eax, [rcx - 0x67]
xor byte [rbp + rcx - 0x40], al
inc rcx
cmp rcx, 9
jb 0x140061730
mov byte [rbp - 0x36], 0
lea rax, [rbp - 0x40]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140061750
mov rax, qword [rbp - 0x18]
cmp rdi, rax
ja 0x1400617c3
lea rbx, [rbp - 0x30]
cmp rax, 0x10
cmovae rbx, qword [rbp - 0x30]
mov qword [rbp - 0x20], rdi
mov r8, rdi
lea rdx, [rbp - 0x40]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], 0
jmp 0x1400617d3
mov rdi, 0xffffffffffffffff
mov rbx, rdi
inc rbx
cmp byte [r9 + rbx], 0
jne 0x140061792
lea rcx, [rbp - 0x30]
cmp rbx, 0xf
ja 0x140061700
mov qword [rbp - 0x20], rbx
mov r8, rbx
mov rdx, r9
call sub.VCRUNTIME140.dll_memmove
mov byte [rbp + rbx - 0x30], 0
jmp 0x140061708
lea r9, [rbp - 0x40]
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.14005d690
mov dword [rbp - 0x40], 0x42700000
mov dword [rbp - 0x3c], 0x41a00000
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rcx, qword [rbp - 0x30]
lea rdx, [rbp - 0x40]
call fcn.14003ed70
test al, al
je 0x14006181e
test esi, esi
jne 0x14006181e
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], esi
xor r9d, r9d
mov r8, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x14006185c
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061857
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140061857
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400727b0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400726c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140062200
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
movdqa xmm0, xmmword [0x140085db0]
xor eax, eax
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0xcfc5d8ca
mov dword [rsp + 0x34], 0xc2cccf8b
mov dword [rsp + 0x38], 0xd5d5c3
mov byte [rsp + 0x3c], 1
nop dword [rax]
nop word [rax + rax]
lea edx, [rax - 0x69]
xor byte [rsp + rax + 0x20], dl
inc rax
cmp rax, 0x1b
jb 0x140062240
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x3c], 0
call fcn.14005a0b0
lea rdx, [0x140055d50]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov al, 1
add rsp, 0x48
ret
Function at 0x140064850
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2d], 0
je 0x140064873
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x69]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2c
jb 0x140064860
mov byte [rcx + 0x2d], 0
mov rax, rcx
ret
Function at 0x140066fa0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x140066fc3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x69]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x140066fb0
mov byte [rcx + 8], 0
mov rax, rcx
ret
Function at 0x14006d950
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140091010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r8d, 0x30
lea rdx, [rsp + 0x20]
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rdx, qword [rsp + 0x38]
lea r9, [rsp + 0x44]
mov rcx, qword [rsp + 0x20]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor edx, edx
mov r8d, 0x1000
mov rcx, rbx
call fcn.1400736e4
mov r8d, dword [rsp + 0x44]
xor r9d, r9d
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rsp + 0x38]
mov rcx, rax
mov rdx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400726c0
add rsp, 0x60
pop rbx
ret

Function at 0x14006d9f0
Capabilities:
Allocate or change rwx memory

Disassembly:
test rcx, rcx
je 0x14006dae6
push rbx
sub rsp, 0x30
mov rax, qword [0x140091010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, dword [rcx + 0x3c]
lea r9, [rsp + 0x20]
mov edx, 0x40
mov qword [rsp + 0x48], rdi
mov rbx, rcx
add eax, ebx
movsxd rdi, eax
lea r8d, [rdx - 0x3c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14006da74
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x28], 0
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x38], 0
test rdi, rdi
je 0x14006dacf
lea r9, [rsp + 0x20]
mov edx, 0x108
mov r8d, 4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14006dacf
xor ecx, ecx
xorps xmm0, xmm0
lea eax, [rcx + 2]
nop
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x60], xmm0
lea rdi, [rdi + 0x80]
movups xmmword [rdi - 0x10], xmm0
sub rax, 1
jne 0x14006daa0
mov qword [rdi], rcx
mov rdi, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400726c0
add rsp, 0x30
pop rbx
ret
Function at 0x1400706b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2f], 0
je 0x1400706d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x69]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2e
jb 0x1400706c0
mov byte [rcx + 0x2f], 0
mov rax, rcx
ret

Function at 0x1400706e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5c], 0
je 0x140070703
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x69]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5b
jb 0x1400706f0
mov byte [rcx + 0x5c], 0
mov rax, rcx
ret

Function at 0x140073480
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400734ca
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400734ca
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400734ca
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400734ca
cmp dword [rcx + 0x84], 0xe
jbe 0x1400734ca
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400734cc
xor al, al
add rsp, 0x28
ret
Function at 0x180001110
Capabilities:
Load windows common language runtime

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x180018030]
xor rax, rsp
mov qword [rbp - 8], rax
mov rcx, qword [rcx]
lea rdx, str.CLRCreateInstance
and qword [rbp - 0x20], 0
mov rdi, r8
and qword [rbp - 0x18], 0
xor bl, bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800011cc
lea r8, [rbp - 0x20]
lea rdx, [0x180015458]
lea rcx, [0x180015498]
call rax
test eax, eax
js 0x1800011cc
mov rcx, qword [rbp - 0x20]
lea r9, [rbp - 0x18]
lea r8, [0x1800154a8]
lea rdx, str.v4.0.30319
mov rax, qword [rcx]
call qword [rax + SafeArrayCopy]
test eax, eax
js 0x1800011cc
mov rcx, qword [rbp - 0x18]
lea rdx, [rbp - 0x10]
mov rax, qword [rcx]
call qword [rax + 0x50]
test eax, eax
js 0x1800011cc
cmp dword [rbp - 0x10], 0
je 0x1800011cc
mov rcx, qword [rbp - 0x18]
lea r8, [0x180015468]
mov r9, rdi
lea rdx, [0x180015488]
mov rax, qword [rcx]
call qword [rax + 0x48]
movzx ebx, bl
mov ecx, 1
test eax, eax
cmovns ebx, ecx
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1800011e0
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
and qword [rbp - 0x20], 0
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1800011ef
mov rdx, qword [rcx]
call qword [rdx + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov al, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180001d10
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x180001210
Capabilities:
Load windows common language runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rcx, qword [rcx]
lea rdx, str.CorBindToRuntime
mov rdi, r8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ebx, ebx
test rax, rax
je 0x18000125f
lea r9, [0x180015468]
mov qword [rsp + 0x20], rdi
lea r8, [0x180015488]
lea rdx, [0x1800153f0]
lea rcx, [0x180015418]
call rax
test eax, eax
lea ecx, [rbx + 1]
cmovns ebx, ecx
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x180005664
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea r9, str.FlsAlloc
xor ecx, ecx
lea r8, [0x18000e5d8]
lea rdx, str.FlsAlloc
call fcn.18000548c
mov rbx, rax
test rax, rax
je 0x1800056a4
mov rcx, rax
call fcn.1800020fc
mov rcx, rdi
call rbx
jmp 0x1800056aa
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18000570c
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, ecx
lea r9, str.FlsGetValue
mov ecx, 2
lea r8, [0x18000e600]
lea rdx, str.FlsGetValue
call fcn.18000548c
mov rdi, rax
test rax, rax
je 0x18000574d
mov rcx, rax
call fcn.1800020fc
mov ecx, ebx
call rdi
jmp 0x180005755
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180005760
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, str.FlsSetValue
mov edi, ecx
lea rdx, str.FlsSetValue
mov ecx, 3
lea r8, [0x18000e618]
call fcn.18000548c
mov rsi, rax
test rax, rax
je 0x1800057ac
mov rcx, rax
call fcn.1800020fc
mov rdx, rbx
mov ecx, edi
call rsi
jmp 0x1800057b7
mov rdx, rbx
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret