joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003250
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x40
mov rcx, qword [0x1402a9cb0]
xor ebx, ebx
mov eax, dword [0x1402a7fec]
mov dword [0x1402a7fe8], eax
test rcx, rcx
jne 0x1400033fa
mov rax, qword gs:[0x60]
mov r11d, 0xf4d8b55
mov qword [rsp + 0x60], rbp
mov ebp, ebx
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x38], rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov r12, qword [rcx + 0x10]
mov rsi, r12
nop
movups xmm0, xmmword [rsi + 0x58]
movd eax, xmm0
sub ax, 8
test ebp, ebp
je 0x1400032fc
psrldq xmm0, 8
mov edx, 0x811c9dc5
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x1400032f4
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x1400032e0
cmp edx, ebp
jne 0x1400033c3
mov r9, qword [rsi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rcx, qword [rax + r9 + 0x88]
mov r15, rcx
mov r10d, ecx
shr r15, 0x20
add r10, r9
cmp r10, r9
je 0x1400033c3
mov r8d, dword [r10 + 0x18]
test r8d, r8d
je 0x1400033c3
mov r14d, dword [r10 + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [r14 + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140003377
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140003360
cmp edx, r11d
je 0x140003383
test r8d, r8d
jne 0x140003340
jmp 0x1400033c3
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov ecx, dword [rcx + rdx*4]
add rcx, r9
cmp rcx, r10
jbe 0x1400033d5
lea rax, [r15 + r10]
cmp rcx, rax
jae 0x1400033d5
mov ebp, 0x811c9dc5
mov rsi, r12
mov dword [rsp + 0x58], ebp
mov dword [rsp + 0x5c], ebp
mov r11, qword [rsp + 0x58]
shr r11, 0x20
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r12
jne 0x1400032b0
mov rcx, rbx
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
mov qword [0x1402a9cb0], rcx
call rcx
mov ecx, dword [0x1402a7fe8]
mov dword [0x1402a7fec], eax
test ecx, ecx
je 0x14000345b
sub eax, ecx
cmp eax, 0x1770
jbe 0x14000345b
mov dword [rsp + 0x50], 0x2e27201c
mov word [rsp + 0x54], 0x100
nop dword [rax]
nop dword [rax + rax]
lea eax, [rbx + 0x48]
xor byte [rsp + rbx + 0x50], al
inc rbx
cmp rbx, 4
jb 0x140003430
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x55], 0
call fcn.140005d60
mov qword [0], 1
xor eax, eax
add rsp, 0x40
pop rbx
ret

Function at 0x140003470
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140003493
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x48]
xor byte [rcx + rax], dl
inc rax
cmp rax, 4
jb 0x140003480
mov byte [rcx + 5], 0
mov rax, rcx
ret
Function at 0x140005b50
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1402a9cf0]
test rax, rax
jne 0x140005d35
xor r10d, r10d
mov dword [rsp + 0x28], r10d
mov eax, 0xfaba0065
mov dword [rsp + 0x24], eax
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov r11, qword [rcx + 0x10]
mov qword [rsp + 0x48], r11
mov r15, r11
mov qword [rsp + 0x50], r11
mov rcx, r11
nop dword [rax + rax]
movups xmm0, xmmword [rcx + 0x58]
movups xmmword [rsp + 0x58], xmm0
movd ecx, xmm0
sub cx, 8
mov word [rsp + 0x58], cx
test r10d, r10d
je 0x140005c06
mov rdx, qword [rsp + 0x60]
movzx ecx, cx
shr rcx, 1
lea r9, [rdx + rcx*2]
mov r8d, 0x811c9dc5
mov qword [rsp + 0x38], rdx
cmp rdx, r9
je 0x140005bfd
movsx ecx, byte [rdx]
xor ecx, r8d
imul r8d, ecx, 0x1000193
add rdx, 2
jmp 0x140005be0
cmp r8d, r10d
jne 0x140005d15
mov rbx, qword [r11 + 0x30]
mov qword [rsp + 0x68], rbx
movsxd rcx, dword [rbx + 0x3c]
mov r14, qword [rcx + rbx + 0x88]
mov qword [rsp + 0xa8], r14
mov r9d, r14d
add r9, rbx
mov qword [rsp + 0x70], r9
shr r14, 0x20
mov dword [rsp + 0x78], r14d
cmp r9, rbx
je 0x140005d15
mov edi, dword [r9 + 0x18]
mov dword [rsp + 0x20], edi
nop dword [rax + rax]
mov ecx, edi
dec edi
mov dword [rsp + 0x20], edi
test ecx, ecx
je 0x140005d15
mov edx, dword [r9 + 0x20]
add rdx, rbx
mov r8d, dword [rdx + rdi*4]
add r8, rbx
mov qword [rsp + 0x40], r8
mov edx, 0x811c9dc5
nop dword [rax + rax]
movsx ecx, byte [r8]
inc r8
mov qword [rsp + 0x40], r8
test cl, cl
jne 0x140005d08
cmp edx, eax
jne 0x140005d03
mov ecx, dword [r9 + 0x1c]
add rcx, rbx
mov eax, dword [r9 + 0x24]
add rax, rbx
movzx eax, word [rax + rdi*2]
mov edx, dword [rcx + rax*4]
add rdx, rbx
cmp rdx, r9
jbe 0x140005d2b
lea rax, [r9 + r14]
cmp rdx, rax
jae 0x140005d2b
mov r10d, 0x811c9dc5
mov dword [rsp + 0xa0], r10d
mov eax, r10d
mov dword [rsp + 0xa4], eax
mov qword [rsp + 0x30], rdx
cmp byte [rdx], 0x2e
je 0x140005ce1
inc rdx
jmp 0x140005cd2
inc rdx
mov qword [rsp + 0x30], rdx
cmp byte [rdx], 0
je 0x140005cf0
jmp 0x140005ce1
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x28], r10d
mov r11, r15
mov qword [rsp + 0x48], r15
jmp 0x140005d15
jmp 0x140005c50
xor ecx, edx
imul edx, ecx, 0x1000193
jmp 0x140005c80
mov r11, qword [r11]
mov rcx, r11
mov qword [rsp + 0x48], r11
cmp r11, r15
jne 0x140005bb0
xor edx, edx
mov qword [0x1402a9cf0], rdx
mov rax, rdx
mov ecx, 0x13333337
call rax
jmp 0x140005d40
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140005d60
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rdi, rcx
mov dword [rsp + 0x20], 0x24383b2d
xor edx, edx
mov dword [rsp + 0x24], 0x6f746d3e
mov word [rsp + 0x28], 0x100
nop dword [rax]
lea eax, [rdx + 0x48]
xor byte [rsp + rdx + 0x20], al
inc rdx
cmp rdx, 8
jb 0x140005d90
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x29], 0
mov rcx, rbx
call fcn.140001540
mov rdx, rdi
mov rcx, rbx
call fcn.140001540
lea rdx, [0x140001b80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140005e57
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140005e57
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140005e52
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140005e30
cmp r8d, 0x2fa62ca8
je 0x140005e5c
test r9d, r9d
jne 0x140005e10
mov rax, qword [rax]
jmp 0x140005de0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 0xbb8
add rax, r10
call rax
mov rbx, qword [rsp + 0x40]
mov qword [0], 1
add rsp, 0x30
pop rdi
ret
Function at 0x14000ab80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x60
mov rax, qword [0x1402a7980]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbx, rdx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
lea r12, [rsp + 0x88]
movabs r15, 0xff00ff00ff00ff00
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x30], r12
mov rdi, qword [r12]
xor rdi, r15
mov qword [rsp + 0x20], rdi
mov qword [r12], rax
xor edx, edx
lea r8d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [rsp + 0x50], rax
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
sub rbx, qword [rsp + 0x50]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], rax
mov rcx, qword [rax]
xor rcx, r15
mov qword [rsp + 0x38], rcx
mov qword [rax], 0
xor ecx, ecx
lea rbp, [0x1400017e0]
lea rsi, [0x140000000]
mov rax, qword [0x1402a9600]
test rax, rax
je 0x14000ac70
xor edx, edx
cmp rax, rbp
je 0x14000ac5f
inc ecx
mov edx, ecx
mov rax, qword [rsi + rcx*8 + 0x2a9600]
test rax, rax
jne 0x14000ac47
jmp 0x14000ac70
mov r8, qword [rsi + rdx*8 + 0x2a9920]
test r8, r8
jne 0x14000ad4f
mov edx, 0x1f4
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, rax
test rax, rax
je 0x14000ad2e
mov rcx, rbp
mov edx, 3
nop dword [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rax - 0x10], xmm1
lea rcx, [rcx + 0x80]
sub rdx, 1
jne 0x14000aca0
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rax + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rax + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rax + 0x60], xmm0
mov ecx, dword [rcx + 0x70]
mov dword [rax + 0x70], ecx
mov rax, qword [0x1402a95f0]
mov qword [rsi + rax*8 + 0x2a9600], rbp
mov qword [rsi + rax*8 + 0x2a9920], r8
inc rax
mov qword [0x1402a95f0], rax
lea rdx, [rsp + 0x50]
mov rcx, qword [sym.imp.KERNEL32.dll_FreeLibrary]
call r8
nop
xor rdi, r15
mov qword [r12], rdi
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140073e20
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000ad90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov dword [rsp + 0x10], edx
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, r9
mov r12, r8
mov ebx, edx
mov r14, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
lea rax, [rsp + 0x78]
movabs r13, 0xff00ff00ff00ff00
mov qword [r11 - 0x50], r13
mov qword [r11 - 0x48], rax
mov rbp, qword [rax]
xor rbp, r13
mov qword [r11 + 0x20], rbp
mov qword [r11 - 0x58], rbp
xor edi, edi
mov qword [rax], rdi
mov ecx, dword [r9 + 0x90]
mov rdx, r9
call fcn.14000af90
cmp dword [rsi + 0x90], edi
je 0x14000ae66
cmp dword [rsi + 0x94], edi
je 0x14000ae66
lea r15, [rax + 0x10]
lea r11, [rsp + 0x78]
mov r8d, dword [r15 - 4]
mov r10, qword [r11]
mov qword [r11], rdi
movzx edx, word [rsi + 0x14]
add rdx, 0x18
add rdx, rsi
movzx eax, word [rsi + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x14000ae5b
nop dword [rax]
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14000ae52
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x14000ae90
add rdx, 0x28
cmp rdx, r9
jb 0x14000ae40
mov qword [r11], r10
mov rbp, qword [rsp + 0x98]
mov edi, 1
xor r13, rbp
lea rax, [rsp + 0x78]
mov qword [rax], r13
mov eax, edi
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ebp, dword [rdx + 0x14]
sub rbp, rcx
add rbp, r8
mov qword [r11], r10
add rbp, r12
je 0x14000ae5e
mov r8, rbp
mov edx, ebx
mov rcx, r14
call fcn.140003bb0
mov r14, rax
test rax, rax
je 0x14000af76
mov ecx, dword [r15]
mov r8, r12
mov rdx, rsi
call fcn.14000af90
mov rbx, rax
mov r8, qword [rax]
test r8, r8
je 0x14000af50
lea r13, [rsp + 0x78]
jns 0x14000aee0
movzx edx, r8w
jmp 0x14000af2c
mov r10, qword [r13]
mov qword [r13], rdi
movzx eax, word [rsi + 0x14]
add rax, 0x18
add rax, rsi
movzx ecx, word [rsi + 6]
lea rdx, [rcx + rcx*4]
lea r9, [rax + rdx*8]
cmp rax, r9
jae 0x14000af1f
mov edx, dword [rax + 0xc]
cmp r8, rdx
jb 0x14000af16
mov ecx, dword [rax + 8]
add ecx, edx
cmp r8, rcx
jb 0x14000af68
add rax, 0x28
cmp rax, r9
jb 0x14000af04
mov rcx, rdi
mov rax, r13
mov qword [rax], r10
lea rdx, [rcx + 2]
mov rcx, rbp
call fcn.14000ab80
add rax, r14
mov qword [rbx], rax
add rbx, 8
mov r8, qword [rbx]
test r8, r8
jne 0x14000aed8
movabs r13, 0xff00ff00ff00ff00
add r15, 0x14
mov ebx, dword [rsp + 0x88]
mov r14, qword [rsp + 0x80]
jmp 0x14000ae0e
mov ecx, dword [rax + 0x14]
sub rcx, rdx
add rcx, r8
add rcx, r12
jmp 0x14000af22
mov rbp, qword [rsp + 0x98]
jmp 0x14000ae6b
Function at 0x14000af90
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea rdi, [rsp]
mov r10, rcx
mov rbx, qword [rdi]
mov qword [rdi], 0
movzx eax, word [rdx + 0x14]
add rax, 0x18
add rax, rdx
movzx edx, word [rdx + 6]
lea r9, [rdx + rdx*4]
lea r11, [rax + r9*8]
cmp rax, r11
jae 0x14000afe2
mov edx, dword [rax + 0xc]
cmp r10, rdx
jb 0x14000afd9
mov ecx, dword [rax + 8]
add ecx, edx
cmp r10, rcx
jb 0x14000aff2
add rax, 0x28
cmp rax, r11
jb 0x14000afc7
xor eax, eax
mov qword [rdi], rbx
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
mov eax, dword [rax + 0x14]
sub rax, rdx
mov qword [rdi], rbx
mov rbx, qword [rsp + 8]
add rax, r10
mov rdi, qword [rsp + 0x10]
add rax, r8
ret
Function at 0x14000d930
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x88
mov rax, qword [0x1402a7980]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r10, qword [0x1402a9ce8]
xor r11d, r11d
mov qword [rsp + 0x58], r11
test r10, r10
jne 0x14000db0d
mov rax, qword gs:[0x60]
mov r10d, 0xdf6a51c
mov qword [rsp + 0x98], rbp
mov ebp, r11d
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x90], rbx
mov r12, qword [rcx + 0x10]
mov rsi, r12
mov qword [rsp + 0x70], r15
nop dword [rax]
movups xmm0, xmmword [rsi + 0x58]
movd eax, xmm0
sub ax, 8
test ebp, ebp
je 0x14000d9fc
psrldq xmm0, 8
mov edx, 0x811c9dc5
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x14000d9f4
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x14000d9e0
cmp edx, ebp
jne 0x14000dac2
mov r9, qword [rsi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rcx, qword [rax + r9 + 0x88]
mov r15, rcx
mov ebx, ecx
shr r15, 0x20
add rbx, r9
cmp rbx, r9
je 0x14000dac2
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x14000dac2
mov r14d, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [r14 + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x14000da77
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x14000da60
cmp edx, r10d
je 0x14000da83
test r8d, r8d
jne 0x14000da40
jmp 0x14000dac2
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov r10d, dword [rcx + rdx*4]
add r10, r9
cmp r10, rbx
jbe 0x14000dad4
lea rax, [rbx + r15]
cmp r10, rax
jae 0x14000dad4
mov ebp, 0x811c9dc5
mov rsi, r12
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x54], ebp
mov r10, qword [rsp + 0x50]
shr r10, 0x20
mov rax, qword [rsi]
mov rsi, rax
cmp rax, r12
jne 0x14000d9b0
mov r10, r11
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
mov r12, qword [rsp + 0x80]
mov rdi, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0x98]
mov rbx, qword [rsp + 0x90]
mov qword [0x1402a9ce8], r10
movdqa xmm0, xmmword [0x140077180]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0xd060d1c
mov dword [rsp + 0x44], 0x6121e
mov word [rsp + 0x48], 0x3f
mov byte [rsp + 0x4a], 1
nop word [rax + rax]
lea eax, [r11 + 0x48]
xor byte [rsp + r11 + 0x30], al
inc r11
cmp r11, 0x19
jb 0x14000db40
lea rax, [rsp + 0x58]
mov byte [rsp + 0x4a], 0
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, 0xffffffff80000002
call r10
test eax, eax
jne 0x14000db89
mov qword [0], 1
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140073e20
add rsp, 0x88
ret
Function at 0x14000e3b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd8
mov rax, qword [0x1402a7980]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r14, r9
mov r13, r8
mov r12, rdx
mov r15, rcx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x28], xmm0
lea rcx, [rsp + 0x118]
movabs rbx, 0xff00ff00ff00ff00
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rcx
mov rsi, qword [rcx]
xor rsi, rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rsi
mov qword [rcx], rax
movzx edi, word [r9 + 0x14]
add rdi, 0x2c
movzx ebp, ax
cmp ax, word [r9 + 6]
jae 0x14000e4e1
lea rsi, [rsp + 0x118]
add rdi, r9
nop dword [rax]
call fcn.140005ee0
mov r9, rax
mov r8d, dword [rdi - 4]
mov edx, dword [rdi]
add rdx, r13
mov ecx, dword [rdi - 8]
add rcx, r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rbx, qword [rsi]
mov rax, rbx
movabs r10, 0xff00ff00ff00ff00
xor rax, r10
mov qword [rsp + 0x40], rax
mov qword [rsi], 0
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x80], r15d
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x78], r8
lea rdx, [rsp + 0x60]
mov rcx, r9
call fcn.14000b630
nop
mov qword [rsi], rbx
inc bp
lea rdi, [rdi + 0x28]
cmp bp, word [r14 + 6]
movabs rbx, 0xff00ff00ff00ff00
jb 0x14000e440
mov rsi, qword [rsp + 0x20]
lea rcx, [rsp + 0x118]
xor rsi, rbx
mov qword [rcx], rsi
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140073e20
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000e520
Capabilities:
Encode data using xor
Terminate process

Disassembly:
sub rsp, 0x38
lea rcx, [0x1402a8090]
call fcn.14001e300
mov r9d, 0x40
lea r8, str.Inject
lea rdx, str.press_in_lobby
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140002cd0
mov r9, rax
cmp byte [rax + 0xc], 0
je 0x14000e69c
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14000e66a
movdqa xmm2, xmmword [0x140077120]
mov ecx, 8
movdqa xmm4, xmmword [0x1400771c0]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x140077130]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140077140]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rax]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140077160]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140077320]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rax], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140077140]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rax + 4]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140077160]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140077320]
xorps xmm2, xmm0
movd dword [rax + 4], xmm2
movsxd r8, ecx
add r8, r9
mov eax, 0x94f2095
lea r8, [r8 + 1]
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x37
movzx eax, cl
inc ecx
sub al, dl
add al, 0x34
xor byte [r8 - 1], al
cmp ecx, 0xd
jl 0x14000e670
lea rdx, str.injected
mov rcx, r9
call fcn.140007e50
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14000ee50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14000ee84
mov eax, esi
lea ecx, [rax + 3]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14000ee70
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140001410
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14000eea9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14001fa10
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000ef23
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ef1e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ef1e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140073954
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14000ef30
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x14000ef64
mov eax, esi
lea ecx, [rax + 3]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x14000ef50
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140001410
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14000ef89
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14001fa10
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000f003
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000effe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000effe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140073954
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret