joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140050680
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
mov r11, qword [r8 + 0x10]
xor r10d, r10d
mov rdi, rcx
cmp word [r11], 2
mov ecx, 0x1c
mov eax, 8
cmove ecx, eax
mov rsi, rdx
mov r9d, 0x811c9dc5
test rcx, rcx
jle 0x1400506d7
nop
movzx eax, byte [r10 + r11]
imul r9, r9, 0x1000193
inc r10
xor r9, rax
cmp r10, rcx
jl 0x1400506c0
mov rcx, qword [rdi + 0x40]
mov rdx, rcx
and rdx, r9
cmp qword [rdi + 0x48], rdx
ja 0x1400506f4
shr rcx, 1
or rax, 0xffffffffffffffff
sub rax, rcx
add rdx, rax
mov rcx, qword [rdi + 0x20]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x14005072a
cmp qword [rcx + rdx*8], r8
jne 0x14005071f
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [rdi + 0x20]
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140050737
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x140050737
cmp qword [rcx + rdx*8], r8
jne 0x14005073c
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
mov r8, qword [rsp + 0x40]
mov rbx, qword [r8]
cmp r8, qword [rdi + 8]
je 0x140050763
mov rax, qword [r8 + 8]
mov rcx, r8
mov qword [rax], rbx
mov rdx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rdx + 8], rax
call fcn.1400555d0
dec qword [rdi + 0x10]
mov qword [rsi], rbx
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140050980
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r15, qword [r8]
mov rbp, rdx
mov rdi, r9
xor r9d, r9d
cmp word [r15], 2
mov r10d, 0x1c
mov r11d, 8
mov edx, r10d
mov r12, rcx
cmove edx, r11d
mov r8d, 0x811c9dc5
test rdx, rdx
jle 0x1400509e7
nop dword [rax + rax]
movzx eax, byte [r9 + r15]
imul r8, r8, 0x1000193
inc r9
xor r8, rax
cmp r9, rdx
jl 0x1400509d0
mov rcx, qword [rcx + 0x40]
mov rsi, rcx
and rsi, r8
cmp qword [r12 + 0x48], rsi
ja 0x140050a05
shr rcx, 1
or rax, 0xffffffffffffffff
sub rax, rcx
add rsi, rax
mov rax, qword [r12 + 0x20]
mov rbx, qword [r12 + 8]
add rsi, rsi
mov r14, qword [rax + rsi*8]
cmp rbx, r14
je 0x140050a61
mov rbx, qword [rax + rsi*8 + 8]
mov rbx, qword [rbx]
cmp rbx, r14
je 0x140050a61
cmp word [r15], 2
mov rax, r10
cmove rax, r11
mov qword [rsp + 0x70], rax
nop dword [rax]
mov rbx, qword [rbx + 8]
mov r8, rax
mov rcx, r15
mov rdx, qword [rbx + 0x10]
call fcn.1400574e0
test eax, eax
je 0x140050ab7
mov rax, qword [rsp + 0x70]
cmp rbx, r14
jne 0x140050a40
mov rax, qword [rdi]
cmp rbx, rax
je 0x140050a94
lea r8, [r12 + 8]
lea rcx, [r12 + 8]
mov r9, rdi
mov rdx, rbx
mov qword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
call fcn.1400530c0
mov rdi, qword [rsp + 0x88]
mov rdx, qword [r12 + 0x20]
mov rax, qword [rdx + rsi*8]
cmp rax, qword [r12 + 8]
jne 0x140050b12
mov qword [rdx + rsi*8], rdi
mov rax, qword [r12 + 0x20]
mov qword [rax + rsi*8 + 8], rdi
jmp 0x140050b42
mov rcx, qword [rbx + 0x10]
mov eax, 8
mov r8d, 0x1c
cmp word [rcx], 2
mov rdx, r15
cmove r8d, eax
call fcn.1400574e0
test eax, eax
je 0x140050adf
mov rbx, qword [rbx]
jmp 0x140050a61
cmp rdi, qword [r12 + 8]
je 0x140050b08
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
mov rcx, rdi
call fcn.1400555d0
dec qword [r12 + 0x10]
mov qword [rbp], rbx
mov byte [rbp + 8], 0
jmp 0x140050b5a
cmp rax, rbx
jne 0x140050b1d
mov qword [rdx + rsi*8], rdi
jmp 0x140050b42
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rdi
je 0x140050b42
mov rdx, qword [r12 + 0x20]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r12
call fcn.140050810
mov r11, qword [rsp + 0x88]
mov byte [rbp + 8], 1
mov qword [rbp], r11
mov rax, rbp
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400524d0
Capabilities:
Create thread

Disassembly:
push rbp
push rdi
push r12
sub rsp, 0x30
xor r12d, r12d
mov rbp, rcx
mov edi, r12d
cmp dword [rcx + 0x18], r12d
jbe 0x140052603
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
nop word [rax + rax]
lea r8, [0x1400522a0]
mov r9, rbp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
call fcn.140057678
mov rsi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1400525e6
mov rax, qword [rbp + 0x178]
lea rcx, [rsp + 0x50]
cmp rcx, rax
jae 0x140052592
mov rcx, qword [rbp + 0x170]
lea rdx, [rsp + 0x50]
cmp rcx, rdx
ja 0x140052592
lea rsi, [rsp + 0x50]
sub rsi, rcx
sar rsi, 3
cmp rax, qword [rbp + 0x180]
jne 0x140052576
lea rcx, [rbp + 0x170]
mov edx, 1
call fcn.140043850
mov rdx, qword [rbp + 0x178]
test rdx, rdx
je 0x1400525bb
mov rax, qword [rbp + 0x170]
mov rcx, qword [rax + rsi*8]
mov qword [rdx], rcx
jmp 0x1400525bb
cmp rax, qword [rbp + 0x180]
jne 0x1400525ac
lea rcx, [rbp + 0x170]
mov edx, 1
call fcn.140043850
mov rcx, qword [rbp + 0x178]
test rcx, rcx
je 0x1400525bb
mov qword [rcx], rsi
add qword [rbp + 0x178], 8
inc edi
cmp edi, dword [rbp + 0x18]
jb 0x140052500
mov eax, 1
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x16c], 8
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, r12d
jmp 0x1400525d3
mov eax, 1
add rsp, 0x30
pop r12
pop rdi
pop rbp
ret

Function at 0x140059274
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400590e4

Function at 0x140064e70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, edx
test rcx, rcx
jne 0x140064e9a
call fcn.14005dae4
and dword [rax], 0
call fcn.14005dac4
mov ebx, reloc.WS2_32.dll_shutdown
mov dword [rax], ebx
call fcn.14005da14
mov eax, ebx
jmp 0x140064eea
test edx, 0xfffffff9
jne 0x140064e7d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140064ec3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14005db04
call fcn.14005dac4
mov eax, dword [rax]
jmp 0x140064eea
test al, 0x10
jne 0x140064ee8
test al, 1
je 0x140064ee8
test bl, 2
je 0x140064ee8
call fcn.14005dae4
mov dword [rax], 5
call fcn.14005dac4
mov dword [rax], reloc.WS2_32.dll_listen
jmp 0x140064eba
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140067df7
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x1400b27e8]
jne 0x14005b24a
rol rcx, 0x10
test cx, 0xffff
jne 0x14005b246
repz ret
ror rcx, 0x10
jmp 0x140067d50
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x1400b6de0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x1400b6ed8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140067dd5
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x1400b6de0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140067df7
mov rax, qword [rsp + 0x88]
mov qword [0x1400b6ed8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x1400b6e78], rax
mov rax, qword [0x1400b6ed8]
mov qword [0x1400b6d50], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400b6e60], rax
mov dword [0x1400b6d40], 0xc0000409
mov dword [0x1400b6d44], 1
mov rax, qword [0x1400b27e8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x1400b27f0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x1400b6dd8], eax
mov ecx, 1
call fcn.140074314
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, str._m_v_
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x1400b6dd8], 0
jne 0x140067e7e
mov ecx, 1
call fcn.140074314
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140076b00
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1400b27e8]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.14005de10
xor ebx, ebx
cmp qword [0x1400b7370], rbx
mov rdi, rax
jne 0x140076c13
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140076cea
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140076cea
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1400b7370], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1400b7378], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1400b7380], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1400b7390], rax
test rax, rax
je 0x140076c0a
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1400b7388], rax
jmp 0x140076c1a
mov rax, qword [0x1400b7388]
jmp 0x140076c21
mov rax, qword [0x1400b7388]
mov r11, qword [0x1400b7390]
cmp rax, rdi
je 0x140076c88
cmp r11, rdi
je 0x140076c88
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1400b7390]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140076c88
test rax, rax
je 0x140076c88
call rsi
test rax, rax
je 0x140076c82
lea rcx, [rsp + 0x30]
mov r9d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140076c82
test byte [rsp + 0x40], 1
jne 0x140076c88
bts ebp, 0x15
jmp 0x140076cc8
mov rcx, qword [0x1400b7378]
cmp rcx, rdi
je 0x140076cc8
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140076cc8
call rax
mov rbx, rax
test rax, rax
je 0x140076cc8
mov rcx, qword [0x1400b7380]
cmp rcx, rdi
je 0x140076cc8
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140076cc8
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400b7370]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140076cea
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140076cec
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14005b230
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x957950
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x95795d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x95796d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x957955
lea eax, [rcx + 1]
jmp 0x95797b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x95798e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x957974
sub eax, 3
jb 0x9579ae
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x9579fd
sar eax, 1
movsxd rbp, eax
jb 0x9579e4
jmp 0x9579bc
add ebx, ebx
jne 0x9579ba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x9579e4
inc ecx
add ebx, ebx
jne 0x9579ca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x9579e4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x9579dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x9579cc
add ecx, 2
jmp 0x9579e9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00957912
jmp 0x95795d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x229800
mov dl, 0x2f
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x957a49
cmp rsi, rcx
jae 0x957a51
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x957a30
cmp al, 0x8f
ja 0x957a30
cmp byte [rsi - 2], 0xf
je 0x957a36
sub al, 0xe8
cmp al, 1
ja 0x957a1a
cmp rsi, rcx
jae 0x957a51
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x957a20
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x957a51
lodsb al, byte [rsi]
jmp 0x957a30
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x550000]
mov eax, dword [rdi]
or eax, eax
je 0x957aae
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x55d960]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x957a5e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x957aa8
mov qword [rbx], rax
add rbx, 8
jmp 0x957a7e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x957af2
cmp al, 0xef
ja 0x957ada
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x957aba
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x957ac9
mov eax, dword [rdi]
add rdi, 4
jmp 0x957ac9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x957b46
sub rsp, 0xffffffffffffff80
jmp 0x46d160

Function at 0x1400036ac
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x78
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1400017fc
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x2a8]
sub rsp, 0x3a0
cmp byte [0x140004771], 0
movsd xmm0, qword [str._KXIH]
movzx eax, word [0x140004770]
movsd qword [rsp + 0x20], xmm0
mov word [rsp + 0x28], ax
je 0x140001879
xor r8d, r8d
lea r9, [rsp + 0x20]
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
inc r8d
sub al, cl
add al, 0x37
xor byte [r9], al
inc r9
cmp r8d, 0xa
jl 0x140001849
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140002fd4
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x238
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x30]
test eax, eax
je 0x140001926
cmp rsi, 0xf
lea rdx, [rsp + 0x30]
lea rax, [rbp + 0x190]
cmova rdx, rbx
sub rdx, rax
movzx ecx, byte [rax]
movzx r8d, byte [rax + rdx]
sub ecx, r8d
jne 0x1400018e8
inc rax
test r8d, r8d
jne 0x1400018d3
test ecx, ecx
je 0x140001918
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
lea r8, [rsp + 0x7c]
lea rdx, [0x140004464]
lea rcx, [rbp + 0x190]
call fcn.1400015cc
mov edi, dword [rsp + 0x58]
jmp 0x1400018bc
mov edx, edi
lea rcx, str.___PID:__d_n
call fcn.140001578
cmp rsi, 0xf
jbe 0x140001960
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140001958
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001958
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140003154
lea r11, [rsp + 0x3a0]
mov eax, edi
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400019c8
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rbx, qword gs:[0x60]
lea rcx, [rbp - 0x30]
mov esi, dword [0x1400061b8]
xor r15d, r15d
xorps xmm0, xmm0
mov dword [rbp - 0x30], 9
mov dword [rbp - 0x2c], 0x1000000
mov eax, dword [rbx + 0x118]
mov dword [rbp - 0x28], eax
lea r14d, [r15 + 0x30]
mov eax, dword [rbx + 0x11c]
mov edx, r14d
mov dword [rbp - 0x24], eax
movzx eax, word [rbx + 0x120]
mov dword [rbp - 0x20], eax
mov eax, dword [rbx + 0x124]
mov dword [rbp - 0x1c], eax
mov qword [rbp - 0x18], r15
movdqu xmmword [rbp - 0x10], xmm0
call fcn.140001980
test eax, eax
je 0x140001a9c
mov rdi, qword [0x1400061f0]
lea edx, [r15 + 4]
lea rcx, [rbp + 0x20]
mov dword [rdi + 0x24], r14d
mov r14d, dword [0x1400061b8]
mov dword [rdi + 0x28], esi
movzx eax, word [rbx + 0x2e8]
mov dword [rbp + 0x20], eax
call fcn.140001980
test eax, eax
je 0x140001a9c
movzx edx, word [rbx + 0x2e8]
mov rcx, qword [rbx + 0x2f0]
call fcn.140001980
test eax, eax
je 0x140001a9c
lea ecx, [rsi + 0x18]
mov dword [rcx + rdi], r14d
lea eax, [r15 + 1]
jmp 0x140001a9e
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140002698
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rsi, rdx
mov rdi, qword [0x1400061f0]
xor ebx, ebx
test rdi, rdi
je 0x1400027a2
movups xmm0, xmmword [str.zAjOKYOu_f9_b]
movups xmmword [rsp + 0x20], xmm0
mov eax, dword [0x140004608]
mov dword [rsp + 0x30], eax
movzx eax, word [0x14000460c]
mov word [rsp + 0x34], ax
mov al, byte [0x14000460e]
mov byte [rsp + 0x36], al
mov r8d, ebx
lea r9, [rsp + 0x20]
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
sub al, cl
add al, 0x37
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 0x17
jl 0x1400026f0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.140002fd4
nop
mov r8, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x38]
test rsi, rsi
je 0x14000276b
xor edx, edx
mov rax, rbx
div qword [rsp + 0x48]
cmp qword [rsp + 0x48], rdx
jbe 0x1400027b2
lea rax, [rsp + 0x38]
cmp r8, 0xf
cmova rax, rcx
mov al, byte [rax + rdx]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, rsi
jb 0x14000273f
cmp r8, 0xf
jbe 0x1400027a2
lea rdx, [r8 + 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000279d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000279d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003154
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
call fcn.140003104
nop
Function at 0x140002ac8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
movsd xmm0, qword [0x1400045e8]
movsd qword [rbp - 0x50], xmm0
mov al, byte [0x1400045f0]
mov byte [rbp - 0x48], al
xor r14d, r14d
mov r8d, r14d
lea r9, [rbp - 0x50]
mov eax, 0x2f684bdb
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x36
mov al, r8b
sub al, cl
add al, 0x37
xor byte [r9], al
inc r8d
inc r9
cmp r8d, 9
jl 0x140002afd
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.140002fd4
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rdi, rax
cmp qword [rbx + 0x18], 0xf
jbe 0x140002b50
mov rbx, qword [rbx]
mov dword [rax], r14d
mov r8d, 0x10
lea rdx, [rbp + 0x20]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov esi, eax
cmp rbx, qword [rbp + 0x20]
jne 0x140002b7c
lea rcx, str.invalid_stoi_argument
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_]
int3
cmp dword [rdi], 0x22
jne 0x140002b8f
lea rcx, str.stoi_argument_out_of_range
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140002bcd
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002bc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002bc8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140003154
mov dword [rbp - 0x40], esi
mov dword [rbp - 0x3c], 0xa793
mov dword [rbp - 0x38], 3
mov edx, 0x20
mov qword [rbp - 0x34], rdx
mov qword [rbp - 0x2c], r14
mov dword [rbp - 0x24], r14d
lea rcx, [rbp - 0x40]
call fcn.140001980
test eax, eax
je 0x140002c89
mov qword [rbp - 0x50], 7
mov dword [rbp - 0x48], r14d
mov ebx, 0xc
mov edx, ebx
lea rcx, [rbp - 0x50]
call fcn.140001980
test eax, eax
je 0x140002c89
mov qword [rbp - 0x50], 4
mov dword [rbp - 0x48], r14d
mov edx, ebx
lea rcx, [rbp - 0x50]
call fcn.140001980
test eax, eax
je 0x140002c89
mov qword [rbp - 0x50], 9
mov dword [rbp - 0x48], r14d
mov edx, ebx
lea rcx, [rbp - 0x50]
call fcn.140001980
test eax, eax
je 0x140002c89
call fcn.1400019c8
test eax, eax
je 0x140002c89
call fcn.140001e40
mov rbx, rax
test rax, rax
je 0x140002c89
mov rcx, rax
call fcn.1400027b8
mov rdi, rax
mov edx, 0x220
mov rcx, rbx
test rax, rax
jne 0x140002ca0
call fcn.140001ab8
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140001ab8
mov edx, 0x28
mov rcx, rdi
call fcn.140001ab8
mov eax, 1
jmp 0x140002c8b
Function at 0x1400038fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003946
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003946
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003946
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003946
cmp dword [rcx + 0x84], 0xe
jbe 0x140003946
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003948
xor al, al
add rsp, 0x28
ret
Function at 0x140002fd0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140008040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov ecx, 8
call fcn.140003400
lea rcx, [0x140002520]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140003280]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14000304d
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400032c0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140003d60
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003daa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003daa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003daa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003daa
cmp dword [rcx + 0x84], 0xe
jbe 0x140003daa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003dac
xor al, al
add rsp, 0x28
ret