joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009d256
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
test r8d, r8d
jne 0x14009d280
movabs rax, 0x100000001
mov qword [rsi], rax
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov edi, r8d
mov dword [rsi], 0
test dl, 1
jne 0x14009d2a1
xor ebx, ebx
movzx edx, dx
shr edx, 1
inc ebx
mov r14d, edx
test dl, 1
je 0x14009d290
jmp 0x14009d2a7
movzx r14d, dx
xor ebx, ebx
bsr eax, r14d
xor eax, 0x1f
mov ecx, 0x20
sub ecx, eax
imul ecx, edi
cmp ecx, 0xde3
jg 0x14009d379
mov ecx, 1
mov ebp, ecx
lea ecx, [rbp + rbp]
cmp ebp, edi
jle 0x14009d2c9
xor r8d, r8d
sar ebp, 2
movzx r9d, dx
jne 0x14009d331
xor ebp, ebp
mov rdx, r9
mov dword [rsi], 0
test rdx, rdx
je 0x14009d30c
xor eax, eax
mov ecx, edx
and ecx, 0xfffffff
mov dword [rsi + rax*4 + 4], ecx
shr rdx, 0x1c
inc rax
test rdx, rdx
jne 0x14009d2f1
mov word [rsi], ax
test r8b, 1
jne 0x14009d39b
test ebp, ebp
jne 0x14009d37e
imul ebx, edi
mov rcx, rsi
mov edx, ebx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp fcn.14009cc7c
xor r8d, r8d
mov r10d, 1
mov rdx, r9
imul rdx, rdx
test ebp, edi
jne 0x14009d354
sar ebp, 1
je 0x14009d2e4
mov rcx, rdx
shr rcx, 0x20
jne 0x14009d2e4
jmp 0x14009d33d
mov ecx, eax
or cl, 0x20
mov r11, rdx
shr r11, cl
test r11, r11
mov ecx, 1
cmove rcx, r9
movzx r8d, r8b
cmovne r8d, r10d
imul rdx, rcx
jmp 0x14009d345
call fcn.1400c7c7c
mov rcx, rsi
call fcn.1400ce1cc
test ebp, edi
je 0x14009d395
mov rcx, rsi
mov edx, r14d
call fcn.14009cf3e
sar ebp, 1
je 0x14009d31a
jmp 0x14009d37e
mov rcx, rsi
mov edx, r14d
call fcn.14009cf3e
jmp 0x14009d316
Function at 0x14009d900
Capabilities:
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
lea rax, [0x1400e2000]
mov qword [rcx], rax
add rcx, 8
call fcn.140046b10
lea rcx, [rsi + 0x10]
call fcn.140046b10
xor edi, edi
mov byte [rsi + 0x18], dil
lea rcx, [rsi + 0x40]
xorps xmm6, xmm6
movups xmmword [rsi + 0x1c], xmm6
movups xmmword [rsi + 0x2c], xmm6
mov dword [rsi + 0x3c], edi
call fcn.140046b10
mov byte [rsi + 0x48], dil
lea rax, [rsi + 0x70]
movups xmmword [rsi + 0x50], xmm6
mov qword [rsi + 0x60], rdi
movups xmmword [rsi + 0x70], xmm6
mov qword [rsi + 0x68], rax
movups xmmword [rsi + 0x80], xmm6
movups xmmword [rsi + 0x90], xmm6
movups xmmword [rsi + 0xa0], xmm6
movups xmmword [rsi + 0xb0], xmm6
movups xmmword [rsi + 0xc0], xmm6
mov ebx, 0x3f800000
mov dword [rsi + 0xd0], ebx
mov dword [rsi + 0xd8], edi
movups xmmword [rsi + 0xe0], xmm6
movups xmmword [rsi + 0xf0], xmm6
mov dword [rsi + 0x100], ebx
movups xmmword [rsi + 0x108], xmm6
movups xmmword [rsi + 0x118], xmm6
mov dword [rsi + 0x128], ebx
movups xmmword [rsi + 0x140], xmm6
movups xmmword [rsi + 0x130], xmm6
mov dword [rsi + 0x150], ebx
movups xmmword [rsi + 0x158], xmm6
movups xmmword [rsi + 0x168], xmm6
mov dword [rsi + 0x178], ebx
mov qword [rsi + 0x198], rdi
movups xmmword [rsi + 0x180], xmm6
mov dword [rsi + 0x190], edi
mov dword [rsi + 0x1a0], 1
lea rcx, [rsi + 0x1a8]
call fcn.14009dbc0
lea rcx, [rsi + 0x2f0]
movups xmmword [rsi + 0x2d8], xmm6
mov qword [rsi + 0x2e8], rdi
xor edx, edx
call fcn.140035760
lea rcx, [rsi + 0x2f8]
xor edx, edx
call fcn.140035760
lea rcx, [rsi + 0x300]
xor edx, edx
call fcn.140035760
movups xmmword [rsi + 0x308], xmm6
movups xmmword [rsi + 0x318], xmm6
mov dword [rsi + 0x328], ebx
movups xmmword [rsi + 0x330], xmm6
movups xmmword [rsi + 0x340], xmm6
movups xmmword [rsi + 0x350], xmm6
movups xmmword [rsi + 0x359], xmm6
movups xmmword [rsi + 0x370], xmm6
movups xmmword [rsi + 0x380], xmm6
call fcn.140006f00
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [rsi + 0x190], eax
cdqe
movabs rcx, 0xcbf29ce484222325
xor rcx, rax
movabs rax, 0x100000001b3
imul rax, rcx
mov qword [rsi + 0x188], rax
mov rcx, rsi
call fcn.14009db10
mov rcx, qword [rsi + 0x20]
mov qword [rsi + 0x20], rax
test rcx, rcx
jne 0x14009dafe
call fcn.140036590
lea r8, str.TraceLog
mov rcx, rax
mov rdx, rsi
xor r9d, r9d
call fcn.140036870
mov qword [0x140100b38], rsi
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
jmp 0x14009dacd
Function at 0x1400a0ffd
Capabilities:
Create thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x10
call fcn.140062b88
mov qword [rax], rdi
mov qword [rax + 8], rsi
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x1400b85a0]
xor ecx, ecx
xor edx, edx
mov r9, rax
call fcn.1400637c0
mov qword [rbx], rax
test rax, rax
je 0x1400a1054
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_GetLastError]

Function at 0x1400a1b80
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
lea rdi, [rcx + 8]
mov rcx, rdi
call sub.KERNEL32.dll_AcquireSRWLockExclusive
mov rsi, qword [rsi]
test rsi, rsi
jne 0x1400a1bab
mov rcx, rdi
add rsp, 0x28
pop rdi
pop rsi
jmp sub.KERNEL32.dll_ReleaseSRWLockExclusive
lock inc dword [rsi]
mov rcx, rdi
call sub.KERNEL32.dll_ReleaseSRWLockExclusive
mov rcx, rsi
call fcn.1400c3e60
lock dec dword [rsi]
je 0x1400a1bca
add rsp, 0x28
pop rdi
pop rsi
ret
mov rcx, rsi
call fcn.1400c3e00
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400013b0
Function at 0x1400bea80
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1400fc468]
cmp ecx, 0xffffffff
je 0x1400beaa5
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
dec eax
cmp eax, 2
setb al
add rsp, 0x28
ret
xor eax, eax
jmp 0x1400beaa0
Function at 0x1400c2db0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x1400f9028]
xor rax, rsp
mov qword [rsp + 0x28], rax
movabs rbx, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x20]
mov qword [rsp + 0x20], rbx
mov rcx, rdi
mov edx, 8
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x1400c2e2e
mov rax, 0xffffffffffffffff
xor edx, edx
div rsi
mov rcx, 0xfffffffffffffffe
sub rcx, rdx
mov rax, qword [rsp + 0x20]
cmp rax, rcx
ja 0x1400c2dd8
xor edx, edx
div rsi
mov rsi, rdx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140065120
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
int3
Function at 0x1400c3e00
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
add rcx, 0x90
call fcn.1400c76e0
mov rcx, qword [rsi + 0x68]
test rcx, rcx
je 0x1400c3e26
mov qword [rsi + 0x70], rcx
call fcn.1400013b0
mov rcx, qword [rsi + 0x48]
test rcx, rcx
je 0x1400c3e38
mov qword [rsi + 0x50], rcx
call fcn.1400013b0
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x1400c3e4a
mov qword [rsi + 0x30], rcx
call fcn.1400013b0
mov rdx, qword [rsi + 0x18]
add rsi, 0x10
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp 0x1400c7710
push rsi
push rdi
sub rsp, 0x28
test rdx, rdx
jne 0x1400c7722
add rsp, 0x28
pop rdi
pop rsi
ret
mov rsi, rdx
mov rdi, rcx
mov rdx, qword [rdx]
call 0x1400c7710
mov rdx, qword [rsi + 8]
mov rcx, rdi
call 0x1400c7710
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.1400013b0

Function at 0x1400c6910
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov r15, rcx
mov rcx, qword [rcx]
mov rbx, qword [r15 + 8]
sub rbx, rcx
sar rbx, 4
lea rax, [rbx + 1]
mov rdx, rax
shr rdx, 0x3c
jne 0x1400c6a24
movabs rdx, 0xfffffffffffffff
mov rdi, qword [r15 + 0x10]
sub rdi, rcx
mov rcx, rdi
sar rcx, 4
sar rdi, 3
cmp rdi, rax
cmovb rdi, rax
movabs rax, 0x7ffffffffffffff
cmp rcx, rax
cmovae rdi, rdx
test rdi, rdi
jne 0x1400c6a17
xor eax, eax
shl rbx, 4
lea rdx, [rax + rbx]
shl rdi, 4
add rdi, rax
mov rcx, qword [r14]
lea r8, [rax + rbx]
add r8, 0x10
mov qword [r8 - 0x10], rcx
mov cl, byte [r14 + 8]
and cl, 1
mov byte [r8 - 8], cl
mov cl, byte [r14 + 9]
and cl, 1
mov byte [r8 - 7], cl
mov rbx, qword [r15]
mov rcx, qword [r15 + 8]
cmp rcx, rbx
je 0x1400c69ea
mov rax, qword [rcx - 0x10]
mov qword [rdx - 0x10], rax
mov al, byte [rcx - 8]
and al, 1
mov byte [rdx - 8], al
mov al, byte [rcx - 7]
lea rsi, [rcx - 0x10]
and al, 1
mov byte [rdx - 7], al
add rdx, 0xfffffffffffffff0
mov rcx, rsi
cmp rbx, rsi
jne 0x1400c69bf
mov rcx, qword [r15]
mov qword [r15], rdx
mov qword [r15 + 8], r8
mov qword [r15 + 0x10], rdi
test rcx, rcx
je 0x1400c6a0a
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.1400013b0
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, rdi
call fcn.1400c6bf0
jmp 0x1400c697f
mov rcx, r15
call fcn.1400a2af4
int3

Function at 0x1400c76e0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
add rcx, 0x38
call 0x1400cce10
add rsi, 8
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp 0x1400cce10
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400cce32
mov rdi, qword [rcx]
call fcn.14000bda0
mov rcx, rdi
test rdi, rdi
jne 0x1400cce22
mov rdx, qword [rsi]
mov qword [rsi], 0
test rdx, rdx
je 0x1400cce57
mov r8, qword [rsi + 8]
add rsi, 0x10
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14000b8a0
nop
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400cce10
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
add rcx, 0x38
call 0x1400cce10
add rsi, 8
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp 0x1400cce10
push rsi
push rdi
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400cce32
mov rdi, qword [rcx]
call fcn.14000bda0
mov rcx, rdi
test rdi, rdi
jne 0x1400cce22
mov rdx, qword [rsi]
mov qword [rsi], 0
test rdx, rdx
je 0x1400cce57
mov r8, qword [rsi + 8]
add rsi, 0x10
mov rcx, rsi
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.14000b8a0
nop
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140002ee6
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp qword [rdx + 0x18], 8
cmovnp r9w, r10w
mov r9, rcx
mov r11b, spl
mov r11, qword [rdx + 0x10]
jb 0x140002f03
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
mov r10, qword [rcx + 0x10]
jmp fcn.1402e1107

Function at 0x140014ce0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400fa040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov ecx, 8
call fcn.14005cdc8
lea rcx, [0x140009c70]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x14001c310]
xor edx, edx
xor ecx, ecx
call fcn.14009e1e8
mov qword [rbx], rax
test rax, rax
je 0x140014d5c
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14005cda0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call fcn.140058bd0
int3

Function at 0x1400315a5
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x30]
call fcn.1403f9b82
add dword [rdx], ecx
add al, 0
or dh, byte [rsi + rax]
add byte [rdx], cl
xor al, byte [rsi]
jo 0x1400315a9
mov ecx, edx
int3

Function at 0x14003ac38
Capabilities:
Encode data using xor

Disassembly:
mov r12b, byte [rsp + 0x9f]
mov rbx, qword [rsp + 0xa8]
jge 0x1401441d6
test dword [rsp + 0x98], r12d
lea r12, [r12*2 + 0x96b0432]
call fcn.140295932
push rsi
sub bp, 0x38f5
mov bpl, 0x28
mov rbp, qword [rsp + 0x18]
mov rbp, qword [rbp + riz]
cmovs r9w, r12w
movabs rsi, 0x31e33ad452a44738
not r9d
lea rbp, [rbp + 0x5b2008dc]
not sil
or r9d, r12d
mov qword [rsp + 0x18], r12
neg dword [rsp + 0x18]
cmovbe r9w, word [rsp + 0x18]
xchg qword [rsp + 0x58], rbp
js 0x140018dec
push 0x4dd123cd
xor r9, 0x2b182f22
mov dword [rsp + 0x20], esi
cmp r9d, dword [rsp + 0x23]
call fcn.140140113
not r13
add r15b, r11b
add qword [rsp + 0x18], 0xffffffffbfd748c3

Function at 0x140044aa0
Capabilities:
Encode data using xor

Disassembly:
movabs r15, 0x726266271df54225
lea r15, [r13*2 + 0x1f6a3abb]
mov r15, qword [rsp + 8]
mov rbx, r13
lea rbx, [rbx + r13*4 + 0x5694456f]
xor ebx, r13d
movabs r13, 0x3e8f2b67101428a0
add bx, 0xe5e
mov rbx, qword [rsp + 0x18]
and r13w, r13w
jb 0x140044ac2
jne 0x14026c641
invalid

Function at 0x14005001c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], r12
jo 0x1402caecd
xor word [rsp + 0x10], r12w
call fcn.1402dc1ea
cmp eax, dword [rbx]
add dword [rax + 0x4640c00], ecx
add byte [rsp + rsi], cl
add al, 0
or al, 0x34
add eax, dword [rax]
or al, 0xe0
add byte [rax], al
add dword [rdx], ecx
add al, 0
or dh, byte [rdi + rax]
add byte [rdx], cl
xor al, byte [rsi]
invalid

Function at 0x14005880c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.14013d0cc
fcomp dword [rsp + rcx*8 + 0x2a60b5e9]
add byte [rdi], ah
scasb al, byte [rdi]
xchg esp, eax
jmp fcn.14050173a

Function at 0x140058d70
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.14003f5db
sbb al, 0x7e
nop
jmp fcn.140502196
Function at 0x140058d78
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.14003f5db
sbb al, 0x7e
nop
jmp fcn.140502196

Function at 0x1400805c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor ebx, ebx
mov r11, rdx
mov r9, rcx
mov r10d, ebx
cmp r8, 8
jb 0x140080607
mov rcx, r8
shr rcx, 3
imul rax, rcx, 0xfffffffffffffff8
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [r9]
add r9, 8
xor rax, qword [r11]
add r11, 8
or r10, rax
sub rcx, 1
jne 0x1400805f0
mov rdx, r10
shr rdx, 0x20
or edx, r10d
mov eax, edx
mov ecx, edx
shr eax, 8
or eax, edx
shr ecx, 0x10
and eax, 0xff00
or eax, ecx
movzx ecx, dl
shr eax, 8
or eax, ecx
test r8, r8
je 0x140080707
cmp r8, 8
jb 0x1400806e3
mov rdx, r8
lea r10, [r11 + 4]
and rdx, 0xfffffffffffffff8
mov rcx, r9
sub rcx, r11
xorps xmm4, xmm4
xorps xmm3, xmm3
nop word [rax + rax]
movd xmm2, dword [rcx + r10 - 4]
xorps xmm0, xmm0
movd xmm1, dword [r10 - 4]
lea r10, [r10 + 8]
punpcklbw xmm2, xmm0
add rbx, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [r10 - 8]
punpcklbw xmm1, xmm0
por xmm4, xmm2
movd xmm2, dword [rcx + r10 - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp rbx, rdx
jb 0x140080660
por xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd ecx, xmm3
or eax, ecx
cmp rbx, r8
jae 0x140080707
sub r9, r11
lea r10, [rbx + r11]
sub r8, rbx
nop dword [rax]
movzx edx, byte [r10 + r9]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
xor edx, ecx
or eax, edx
sub r8, 1
jne 0x1400806f0
mov rbx, qword [rsp + 8]
test eax, eax
sete al
ret

Function at 0x140080720
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r9, rdx
test r8, r8
je 0x140080831
cmp r8, 4
jb 0x140080763
mov rdx, r8
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r9]
add r9, 4
xor dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x140080750
xor r10d, r10d
test r8, r8
je 0x140080831
cmp r8, 0x40
jb 0x140080815
lea rdx, [rcx - 1]
lea rax, [r9 - 1]
add rdx, r8
add rax, r8
cmp rcx, rax
ja 0x140080795
cmp rdx, r9
jae 0x140080815
mov r11, r8
mov qword [rsp], rbx
and r11, 0xffffffffffffffc0
mov rdx, r9
lea rax, [rcx + 0x10]
sub rdx, rcx
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r10, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [rdx + rax - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rdx + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
cmp r10, r11
jb 0x1400807b0
mov rbx, qword [rsp]
cmp r10, r8
jae 0x140080831
sub r9, rcx
lea rdx, [r10 + rcx]
sub r8, r10
nop
movzx eax, byte [rdx + r9]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r8, 1
jne 0x140080820
add rsp, 8
ret
Function at 0x14009a63c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14009a468

Function at 0x1400afb84
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1400af8aa
call fcn.1400a00f0
mov dword [rax], 0x16
call fcn.14009a2c8
jmp 0x1400af9f5
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400af9f5
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1400af9f5
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1400af8d9
lock or dword [rcx + 0x14], 0x10
jmp 0x1400af9f5
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1400af8ed
call fcn.1400b10a0
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x1400af8fd
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x1400af900
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.1400ab724
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.1400b0990
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x1400af9e3
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x1400af991
mov rcx, rbx
call fcn.1400ab724
cmp eax, 0xffffffff
je 0x1400af97c
mov rcx, rbx
call fcn.1400ab724
cmp eax, 0xfffffffe
je 0x1400af97c
mov rcx, rbx
call fcn.1400ab724
movsxd rdi, eax
lea r14, [0x14012e380]
mov rcx, rbx
sar rdi, 6
call fcn.1400ab724
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x1400af983
lea rdx, [0x1400fa410]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400af991
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x1400af9b5
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x1400af9b5
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x1400af9b5
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x1400af9d3
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x1400af9de
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x1400af9fa
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x1400af874

Function at 0x140150f63
Capabilities:
Packed with generic packer

Disassembly:
sub ecx, 0x2fc7eb3
xor ecx, ecx
not cl
or rcx, 0x494043de
call fcn.140047ee6
lea rsi, [r9*8 + 0x1d610696]
cmovg r9w, word [rsp + 0xb]
mov r9, qword [rsp]
cmovo rsi, qword [rsp + 8]
cmp qword [rsp + 8], rsi
lea rsi, [rsi + r8*2 + 0x47c7f2e]
lea r8, [r8 + r8*8 + 0x1e702d4f]
jne 0x1402cabe4
js 0x140053562
call fcn.14000b7c3
movabs rcx, 0x45159280f7c7f21
bswap r10d
mov rcx, qword [rsp + 8]
mov rcx, qword [rcx]
movzx r10d, r10w
add r14, r9
test byte [rsp + 0x18], r10b
call fcn.14025b5dd
mov rsi, qword [rsp + 0x48]
push qword [rsp + 0x40]
popfq
mov r8, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x20]
mov r15, qword [rsp + 0x18]
mov r11, qword [rsp + 8]
lea rsp, [rsp + 0x50]
Function at 0x140150f69
Capabilities:
Packed with generic packer

Disassembly:
and rsi, rdx
setl dl
xchg qword [rsp + 0x38], rbx
sub dl, 0x34
call fcn.1402b055b
movabs rsi, 0x5c9c05e446424a76
jns 0x1403112be
test esi, 0x3acc163c
lea rbx, [rbx + 0x2832f17]
ja 0x1402bc989
cmp dl, 0xa6
setb dl
jge 0x140053e9e
movabs rcx, 0x69ef4b5d318449a9
mov ecx, 0x5ab870a5
call fcn.1402552f2

Function at 0x14024e5df
Capabilities:
Encode data using xor

Disassembly:
or dil, 0xd7
bswap rdi
xchg qword [rsp + 0x48], rbp
jns 0x1402bbb8f
not byte [rsp + 0x20]
movsx edx, byte [rsp + 0x22]
test dil, dil
bswap r13d
mov r13, qword [rsp + 8]
lea rdx, [rdi*4 + 0x7f281756]
mov rdx, qword [rsp + 0x28]
push qword [rsp + 0x18]
popfq
mov rdi, qword [rsp]
lea rsp, [rsp + 0x30]
ret 8
pushfq
add qword [rsp + 8], 0xffffffffffdb6b36
push r11
movabs r11, 0x177c7908407e63fd
push 0x48440a29
nop
movabs rcx, 0x6b9021130de11428
test r11w, 0x6e4f
push r13
push rdx
mov r13, rcx
push rcx
jbe fcn.140026d55
bswap r11d
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
mov rdx, r11
mov qword [rsp + 0x30], rdx
or qword [rsp + 0x18], 0x26a238f6
push rcx
push rsi
jbe 0x14005966d
lea rcx, [rcx + 0x13ea0b0b]
test dword [rsp + 0x40], r11d
xchg qword [rsp + 0x48], rcx
jae 0x1400422c8

Function at 0x140257c4c
Capabilities:
Encode data using xor
Hash data using sha1
Hash data using sha1 via x86 extensions

Disassembly:
not qword [rsp + 0x38]
jne 0x1402f4bde
call fcn.14025d097

Function at 0x140287318
Capabilities:
Encode data using xor

Disassembly:
add qword [rsp], 0xffffffffffe99fc8
bswap rsi
add rsi, 0x1ca31797
push r12
mov rbx, qword [rsp + 8]
mov rbx, qword [rbx]
mov r12, rsi
movabs r12, 0x333c5d2405527c45
movsx r12w, si
not rsi
and rsi, rsi
lea rbx, [rbx + 0x57560e9b]
movsx si, sil
lea r12, [rsi + 0x57c0a05]

Function at 0x1402a17ea
Capabilities:
Encrypt data using rc4 prga

Disassembly:
not dword [rsp + 0x18]
mov rbx, qword [rsp + 0x38]
mov byte [rsp + 0x18], 0
call fcn.140144a6f
and bx, bx
cmp word [rsp + 0x40], bx
mov bx, 0x6674
mov word [rsp + 0x40], 0x13b2
setb r11b
add qword [rsp + 0x18], 0xffffffffbffc1137
mov rbx, qword [rsp + 0x28]
and word [rsp + 0x40], r11w
neg dword [rsp + 0x40]
or dword [rsp + 0x50], 0x52aa0e4e
xor qword [rsp + 0x50], r11
or word [rsp + 0x10], r11w
mov r11, qword [rsp + 0x48]
add qword [rsp], 0xffffffffbfffd8b9
cmp qword [rsp + 0x40], 0x4f957d06
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x70]
ret
push r14
movabs r14, 0x7b13337121b24f12
mov r14, qword [rsp]
jbe 0x1401450d4
mov rsi, qword [rsp + 0x28]
not rbx
add word [rsp + 0x18], 0x378b
or esi, 0x772a7f08
movzx rsi, word [rsp + 0x18]
jns 0x140300757
cmp rsi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x10]
jbe 0x14000921f
call fcn.1402bc9a0

Function at 0x1402e891d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movabs rdx, 0x663d00db44136220
cmp rdx, 0x32956b3e
mov rdx, qword [rsp + 8]
mov rdx, qword [rdx]
call fcn.140005db5

Function at 0x1402e893b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jno 0x1402745a6
test al, 0x4d
adc esi, eax
fcomp st(3)
invalid