joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140034c68
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140034cef
mov rsi, rbx
cmp word [rax], bp
je 0x140034cae
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140034c98
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140034c94
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140031710
mov rdi, rax
test rax, rax
je 0x140034cdc
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140039eb0
mov rbp, rdi
xor ecx, ecx
call fcn.14002f000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400379fc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rdx
mov dword [rsp + 0x30], esi
mov rbx, rcx
test rcx, rcx
je 0x140037a6f
cmp word [rcx], si
je 0x140037a6f
lea rdx, [0x14005fe98]
call fcn.140039658
test eax, eax
je 0x140037a6f
lea rdx, [0x14005feb0]
mov rcx, rbx
call fcn.140039658
test eax, eax
jne 0x140037a65
mov ecx, dword [rdi + 8]
lea r9d, [rsi + 2]
lea r8, [rsp + 0x30]
mov edx, 0x2000000b
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140037a8c
mov eax, dword [rsp + 0x30]
jmp 0x140037a9e
mov rcx, rbx
call fcn.14002d610
jmp 0x140037a9e
mov ecx, dword [rdi + 8]
lea r8, [rsp + 0x30]
mov r9d, 2
mov edx, 0x20001004
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x140037a90
xor eax, eax
jmp 0x140037a9e
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x140037a9e
call qword [sym.imp.KERNEL32.dll_GetACP]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140037ab0
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov ebp, edx
mov dword [rax + 8], ebx
mov edi, ecx
call fcn.14002dd90
mov ecx, edi
lea r9d, [rbx + 2]
and ecx, 0x3ff
lea r8, [rsp + 0x30]
bts ecx, 0xa
mov edx, 0x20000001
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x140037b53
cmp edi, dword [rsp + 0x30]
je 0x140037b4c
test ebp, ebp
je 0x140037b4c
mov r9, qword [rsi + 0x98]
mov r8d, ebx
movzx edx, word [r9]
lea rcx, [r9 + 2]
lea eax, [rdx - 0x41]
cmp ax, 0x19
jbe 0x140037b28
sub dx, 0x61
cmp dx, 0x19
ja 0x140037b34
movzx edx, word [rcx]
inc r8d
add rcx, 2
jmp 0x140037b15
or rax, 0xffffffffffffffff
inc rax
cmp word [r9 + rax*2], bx
jne 0x140037b38
cmp r8d, eax
setne bl
mov eax, ebx
jmp 0x140037b55
mov eax, 1
jmp 0x140037b55
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140039858
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140031508
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140031508
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400399a5
cmp rax, 0xffffffffffffffff
je 0x1400399a5
xor edi, edi
test rbp, rbp
jle 0x140039953
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14002f610
mov rbx, rax
test rax, rax
jne 0x1400398e0
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140039949
mov edx, 0x8000
mov ecx, r14d
call fcn.14002b3dc
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14002eccc
cmp eax, 0xffffffff
je 0x140039929
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400398f0
mov edx, r15d
mov ecx, r14d
call fcn.14002b3dc
jmp 0x140039949
cmp byte [rsi + 0x38], dil
je 0x140039940
cmp dword [rsi + 0x34], 5
jne 0x140039940
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140039949
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14002f000
jmp 0x1400399b7
jns 0x1400399b7
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140031508
cmp rax, 0xffffffffffffffff
jne 0x140039971
cmp byte [rsi + 0x30], dil
je 0x1400399b7
jmp 0x1400399ad
mov ecx, r14d
call fcn.140035504
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400399b7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400399b7
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400399b2
mov edi, dword [rsi + 0x2c]
jmp 0x1400399b7
mov edi, 0x16
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140031508
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140039bf0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140039c18
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140039c18
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001128
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x30
mov r14d, dword [rsp + 0x78]
lea esi, [r8 + 0x3e7]
mov ebp, r9d
lea eax, [rsi - 0x67d]
mov r15d, edx
lea r13d, [r9 - 0x8a3]
xor ebp, 0x42d3
lea ebx, [r8 - 0x4bc]
xor r14d, 0x420c
xor r15d, 0x36d8
mov rdi, rcx
cmp r14d, eax
jge 0x140001226
mov rdx, qword [section..data]
xor esi, 0x78e3
mov eax, dword [rcx + 0x24]
cmp dword [rdx + 0xc4], eax
ja 0x1400011b9
mov eax, dword [rdx + 0x100]
sub eax, dword [rcx + 0x3c]
xor eax, 0xfa735
mov dword [0x140015080], eax
jmp 0x1400011cb
mov ecx, dword [rdx + 0xc8]
xor ecx, dword [rdx + 0x74]
mov eax, dword [rdi + 8]
imul eax, ecx
mov dword [rdi + 8], eax
mov ecx, ebx
lea eax, [r13 - 0x4de]
xor ecx, 0xd51
mov dword [rsp + 0x20], eax
lea r8d, [rbp + 0x3eec]
mov r9, rdi
lea edx, [rsi - 0xe3a]
call fcn.1400030ac
lea r8d, [rbp + 0x46ae]
mov dword [0x14001507c], 0xc4ec4ec5
lea edx, [r14 + 0x36d8]
mov dword [rsp + 0x20], eax
lea ecx, [r13 + 0xc7e]
mov r9, rdi
xor ebx, 0x799a
call fcn.1400031f0
jmp 0x14000128f
imul ecx, dword [rcx + 0xc8], 0x42d3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [section..data]
mov r9d, esi
mov edx, dword [rdi + 0xdc]
and r15d, 0x2bf6
mov ecx, dword [0x140015110]
sub r9d, dword [0x140015034]
mov r8d, dword [rax + 0x7c]
or edx, dword [0x140015028]
or r8d, esi
sub r8d, dword [0x140015114]
mov eax, esi
mov qword [rsp + 0x20], r8
xor rcx, rax
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, dword [rdi + 0x74]
mov edx, ebx
xor rcx, rdx
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rbp, qword [rsp + 0x58]
xor ebx, 0x7d46
mov rsi, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
ret
Function at 0x14000144c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, dword [rsp + 0x50]
lea r10d, [r9 - 0xe8a]
xor r9d, 0x43dc
lea edi, [rdx - 0x3761]
add r9d, 0x341b
add esi, 0x10f6
mov rbx, rcx
cmp edi, r9d
je 0x140001690
lea eax, [r8 - 0x137]
xor eax, 0x77b1
cmp edi, eax
jg 0x140001647
add esi, 0x6be
lea rax, [0x1400173f0]
mov qword [rcx + 0xa0], rax
xor r9d, r9d
mov rax, qword [section..data]
mov ecx, dword [rax + 0x18]
sub ecx, dword [0x1400150f8]
xor ecx, 0xffe30a3f
add dword [rbx + 0x110], ecx
mov rdx, qword [section..data]
mov ecx, dword [rdx + 0x60]
sub ecx, dword [rbx + 0x3c]
mov eax, dword [rdx + 0x100]
add ecx, 0x50ec7
imul eax, ecx
mov dword [rdx + 0x100], eax
mov eax, dword [0x140015034]
xor eax, 0xcaaf9
add dword [rbx + 0x94], eax
movsxd rcx, dword [rbx + 0x70]
mov rax, qword [rbx + 0xa0]
mov r8d, dword [r9 + rax]
add r9, 4
imul r8d, dword [rbx + 0x6c]
mov rax, qword [rbx + 0xa8]
mov edx, r8d
shr edx, 0x18
mov byte [rcx + rax], dl
mov edx, r8d
inc dword [rbx + 0x70]
mov rax, qword [section..data]
shr edx, 0x10
mov ecx, dword [rax + 0x48]
add ecx, dword [rbx + 0x100]
xor ecx, 0x29c9ee
sub dword [0x1400150d0], ecx
movsxd rcx, dword [rbx + 0x70]
mov rax, qword [rbx + 0xa8]
mov byte [rcx + rax], dl
mov ecx, 0xfffdd58e
inc dword [rbx + 0x70]
mov edx, r8d
mov rax, qword [section..data]
shr edx, 8
sub ecx, dword [rax + 0xd4]
sub ecx, dword [rbx + 0x60]
add dword [rbx + 0x18], ecx
mov rax, qword [section..data]
mov ecx, dword [rax + 0x60]
mov rax, qword [0x1400150b8]
add ecx, 0x2b47b
xor dword [0x140015120], ecx
movsxd rcx, dword [rbx + 0x70]
mov byte [rcx + rax], dl
inc dword [rbx + 0x70]
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x58]
sub eax, 0x1c26e4
or dword [rcx + 0x2c], eax
mov eax, dword [rbx + 0x9c]
mov rcx, qword [section..data]
sub eax, 0x2cdd8
or dword [rcx + 0x2c], eax
movsxd rcx, dword [0x140015080]
mov rax, qword [rbx + 0xa8]
mov byte [rcx + rax], r8b
inc dword [0x140015080]
cmp r9, 0x8c94
jl 0x1400014b7
mov rax, qword [section..data]
mov dword [rax + 0x6c], 0xaa4af
mov eax, dword [0x1400150e4]
add eax, 0x72c4b979
xor dword [rbx + 0x6c], eax
mov rcx, qword [section..data]
mov eax, dword [rcx + 0xe8]
cmp dword [rbx + 0xc0], eax
jb 0x140001637
mov eax, dword [0x140015098]
sub eax, dword [rcx + 0x74]
mov dword [rbx + 0xd0], eax
jmp 0x140001690
lea rax, [0x1400040a0]
mov qword [rcx + 0xa0], rax
jmp 0x140001690
mov ecx, dword [rcx + 0xc4]
mov eax, r10d
xor rcx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentActCtx]
mov ecx, edi
xor rcx, 0xfffffffffffff7da
and ecx, 0x383d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, 0x420c
sub ecx, dword [rbx + 0xc4]
add dword [0x14001509c], ecx
mov ecx, dword [rbx + 0x110]
or ecx, edi
add ecx, dword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, qword [rsp + 0x30]
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001a4c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov ebp, dword [rsp + 0x70]
lea eax, [r9 + 0x200]
add ecx, 0xfffffd44
lea r14d, [r9 - 0x614]
mov edi, r9d
xor ebp, 0x420c
xor edi, 0x3cec
xor ecx, 0xd51
mov rbx, r8
cmp eax, ecx
jle 0x140001ad1
mov eax, dword [r8 + 0x2c]
cmp dword [r8 + 0xd0], eax
jb 0x140001ac2
mov rax, qword [section..data]
mov ecx, dword [rax + 0x2c]
sub ecx, dword [r8 + 0x60]
add ecx, 0x2c42
mov dword [r8 + 0x6c], ecx
jmp 0x140001b79
mov eax, dword [r8 + 0x7c]
xor dword [0x1400150e4], eax
jmp 0x140001b79
mov eax, dword [r8 + 0xc0]
mov esi, edi
xor eax, 0x3a30
sub eax, r14d
cmp edi, eax
jbe 0x140001b79
mov rdx, qword [section..data]
mov ecx, dword [rdx + 0x34]
mov eax, dword [rbx + 0x58]
mov r15d, edi
add eax, 0x3a00
imul eax, ecx
cmp edi, eax
jne 0x140001b60
mov ecx, dword [rdx + 0xd4]
mov r8d, dword [rbx + 0x24]
add ecx, r14d
mov r9d, dword [0x140015084]
mov edx, dword [0x140015058]
imul r8d, dword [rbx + 0xe8]
xor edx, 0x350e
xor r9d, dword [rbx + 0x7c]
mov qword [rsp + 0x20], rcx
mov ecx, 0x43dc
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdx, qword [section..data]
add r15d, 2
mov eax, dword [rbx + 0x58]
add eax, 0x3a00
mov ecx, dword [rdx + 0x34]
imul eax, ecx
cmp r15d, eax
je 0x140001b06
mov eax, dword [rbx + 0xc0]
add esi, 4
xor eax, 0x3a30
sub eax, r14d
cmp esi, eax
ja 0x140001af4
mov rbx, qword [rsp + 0x50]
lea eax, [rbp + 0x350e]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x140001b98
Capabilities:
Encode data using xor
Get file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov eax, dword [rsp + 0x70]
mov rbx, r9
mov edi, dword [rsp + 0x80]
mov ebp, eax
mov r15d, dword [rsp + 0x78]
xor ebp, 0x7a42
add r15d, 0x8a3
lea r14d, [rax - 0x46ae]
lea r12d, [rdi - 0xb9f]
mov eax, r14d
xor eax, 0x3c56
xor edi, 0x76d2
cmp r12d, eax
jg 0x140001d26
mov eax, 0xfffff4ea
sub eax, dword [r9 + 0x14]
add dword [r9 + 0x6c], eax
lea rax, [0x1400156f0]
mov qword [0x1400150b0], rax
xor r10d, r10d
mov rax, qword [rbx + 0xa0]
mov r9d, dword [r10 + rax]
add r10, 4
mov eax, dword [rbx + 0x88]
sub eax, 0x7d4c5
add dword [rbx + 0xd0], eax
mov eax, dword [rbx + 0xc0]
add eax, dword [rbx + 0x7c]
xor eax, 0x1693e1
sub dword [rbx + 0x104], eax
mov rcx, qword [section..data]
mov eax, dword [rbx + 0x74]
sub dword [rcx + 0x14], eax
mov eax, 0x52823
mov ecx, dword [rbx + 0x9c]
sub eax, ecx
sub eax, dword [rbx + 0x3c]
add dword [rbx + 0x94], eax
mov eax, dword [rbx + 0x110]
add eax, ecx
xor eax, 0x2cde1
add dword [0x140015058], eax
mov rax, qword [section..data]
movsxd rdx, dword [rbx + 0x70]
imul r9d, dword [rbx + 0x6c]
mov rcx, qword [rax + 0xa8]
mov r8d, r9d
shr r8d, 8
mov byte [rdx + rcx], r8b
inc dword [rbx + 0x70]
mov eax, dword [0x14001508c]
mov rdx, qword [section..data]
mov ecx, dword [rbx + 0x48]
sub ecx, dword [rdx + 0x9c]
sub ecx, 0x14fa95
imul eax, ecx
mov dword [0x14001508c], eax
movsxd rcx, dword [rbx + 0x70]
mov rax, qword [rdx + 0xa8]
mov byte [rcx + rax], r9b
inc dword [rbx + 0x70]
mov eax, dword [rbx + 0x48]
sub eax, 0x17c86e
xor dword [0x1400150e0], eax
mov ecx, dword [rbx + 0xc4]
mov eax, dword [rbx + 0x2c]
add eax, 0xfff40049
add ecx, eax
add dword [rbx + 0x9c], ecx
mov rcx, qword [section..data]
mov eax, dword [0x140015084]
sub dword [rcx + 0x60], eax
cmp r10, 0x5a0
jl 0x140001c1a
jmp 0x140001db2
mov eax, dword [r9 + 0x88]
or eax, dword [0x140015014]
cmp dword [r9 + 0xd8], eax
ja 0x140001db2
imul eax, dword [r9 + 0x38], 0x42d3
mov esi, dword [0x140015118]
cmp esi, eax
jae 0x140001db2
mov ecx, dword [rbx + 0xc4]
or rcx, r14
and ecx, 0x3c56
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov eax, dword [rbx + 0x58]
lea r9, [0x140015010]
add eax, dword [rbx + 0xc8]
mov r8d, r14d
imul ecx, eax, 0x46ae
and r8d, r15d
mov eax, dword [rbx + 0x18]
mov edx, edi
sub edx, dword [0x140015110]
sub eax, 0x43aa
xor eax, edi
imul r8d, r15d
sub edx, r12d
mov dword [rsp + 0x20], eax
call fcn.140001dd8
imul ecx, dword [rbx + 0x38], 0x42d3
add esi, 3
mov r15d, eax
cmp esi, ecx
jb 0x140001d4e
mov rbx, qword [rsp + 0x50]
lea eax, [rbp - 0x2bc]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x140001dd8
Capabilities:
Clear file content
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov ebp, dword [rsp + 0xc0]
lea ecx, [r8 - 0x3127]
mov ebx, r8d
mov dword [rsp + 0xa8], ecx
mov r15d, edx
lea esi, [rdx - 0x3a30]
xor r15d, 0x3a30
lea r14d, [r8 + 0x12b5]
lea edi, [rbp + 0xc7]
mov dword [rsp + 0x48], r15d
xor ebp, 0x420c
lea eax, [rsi + 0x3cec]
add r8d, 0x3e7
mov dword [rsp + 0xc0], ebp
xor ebx, 0x3127
mov dword [rsp + 0x40], r8d
mov r13, r9
cmp edi, eax
jle 0x14000208b
mov eax, esi
mov edx, 0x3a00
xor eax, edx
cmp r8d, eax
jg 0x140002040
lea eax, [rsi + 0x3761]
cmp ecx, eax
jg 0x140001ece
mov esi, eax
mov edx, r14d
mov rax, qword [section..data]
xor edx, 0x7be1
mov r9d, r14d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
xor esi, 0xf5c
sub edi, 0xb72
xor r9d, 0x7f8a
xor r8d, 0xbe2
mov edx, edi
lea ecx, [rsi - 0xdc]
call fcn.1400033f0
add ebp, 0x43dc
add ebx, 0x2bf6
xor ebx, 0x69fa
jmp 0x14000203b
mov rax, qword [section..data]
mov r12d, edi
mov dword [rsp + 0xb0], edi
mov eax, dword [rax + 0xe8]
add eax, r15d
cmp edi, eax
jb 0x140002040
lea ecx, [rbp + 0x420c]
xor ecx, edx
lea r10, [0x140015010]
mov dword [rsp + 0x4c], ecx
mov r9d, dword [0x1400150e0]
mov edx, ebp
imul edx, dword [r13 + 0xd0]
add r9d, r14d
mov r8d, dword [r13 + 0xcc]
and r9d, dword [r13 + 0x9c]
or r8d, 0x77d3
mov qword [rsp + 0x20], r10
or edx, 0x46ae
call fcn.1400020ac
mov ecx, dword [rsp + 0xa8]
mov edi, eax
or ecx, eax
imul ecx, ebx
cmp eax, ecx
jle 0x14000200b
mov ecx, r14d
xor ecx, ebx
or ecx, dword [r13 + 0x24]
cmp eax, ecx
je 0x14000200b
mov r15d, dword [rsp + 0xa8]
lea eax, [rbp + 0x43aa]
cdqe
mov ebp, edi
mov r12, rax
mov rax, qword [section..data]
mov ecx, dword [rax + 4]
and ecx, 0x3cec
sub ecx, dword [r13 + 0x9c]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [0x140015084]
lea r8, [0x140015010]
mov r9d, dword [r13 + 0x110]
imul r9d, dword [0x140015120]
mov ecx, dword [r13 + 0xc4]
mov edx, dword [r13 + 0x38]
sub ecx, 0x2bf6
imul eax, r14d
or ecx, 0x3eec
add edx, esi
xor r9d, r15d
sub eax, r15d
mov dword [rsp + 0x20], eax
call fcn.1400025e0
mov ecx, eax
inc ebp
xor ecx, ebx
mov r14d, eax
or ecx, dword [r13 + 0x24]
cmp ebp, ecx
jne 0x140001f78
mov ebp, dword [rsp + 0xc0]
mov r15d, dword [rsp + 0x48]
mov r12d, dword [rsp + 0xb0]
mov rcx, qword [section..data]
lea r10, [0x140015010]
add r12d, 4
mov dword [rsp + 0xb0], r12d
mov ecx, dword [rcx + 0xe8]
add ecx, r15d
cmp r12d, ecx
mov ecx, dword [rsp + 0x4c]
jae 0x140001f03
mov r8d, dword [rsp + 0x40]
lea eax, [r8 + 0xece]
lea r9d, [rbx - 0x7dc]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], r9d
lea r10d, [rsi + 0xe71]
mov r9, qword [section..data]
lea r8d, [rdi - 0x89]
xor ebx, 0x7a31
mov dword [rsp + 0x20], r10d
lea edx, [rbp - 0x6f0]
mov ecx, ebx
call fcn.140001b98
xor r14d, 0x10f
lea eax, [r14 - 0xd81]
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400020ac
Capabilities:
Encode data using xor

Disassembly:
lea eax, [r8 + 0xeb8]
xor r9d, 0xd61
mov r8, qword [rsp + 0x28]
lea r10d, [rcx + 0x10f6]
add ecx, 0x16dd
cmp edx, eax
mov rdx, qword [section..data]
je 0x140002100
mov eax, dword [rdx + 0x74]
add ecx, 0xffffff39
xor ecx, 0x7617
cmp dword [rdx + 0x60], eax
jb 0x140002100
lea rax, [0x140015010]
mov qword [r8 + 0xf8], rax
mov rdx, qword [section..data]
lea eax, [r10 - 0x79a]
cmp r9d, eax
jl 0x1400021bb
xor r10d, r10d
mov rax, qword [0x1400150c0]
mov ecx, dword [r10 + rax]
xor ecx, dword [r8 + 0x78]
mov rax, qword [r8 + 0xb0]
mov dword [r10 + rax], ecx
add r10, 4
mov eax, dword [0x14001504c]
mov edx, dword [r8 + 0x74]
add eax, 0xfffda5b5
or dword [r8 + 0x24], eax
mov eax, dword [r8 + 0x14]
mov ecx, dword [r8 + 0x3c]
add ecx, 0xfffda5b6
add edx, ecx
imul eax, edx
mov dword [r8 + 0x14], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0xb8]
add dword [r8 + 0x78], ecx
mov eax, dword [r8 + 0x74]
sub eax, dword [r8 + 0xc0]
mov rcx, qword [section..data]
add eax, 0x12
xor dword [rcx + 0x14], eax
mov eax, dword [r8 + 0x18]
sub eax, 0xd
add dword [r8 + 0xc8], eax
mov eax, dword [r8 + 0xd0]
sub eax, dword [r8 + 0xc8]
xor eax, 0x1471cd
or dword [r8 + 0x9c], eax
cmp r10, 0x10658
jl 0x140002113
jmp 0x1400021f4
mov eax, dword [rdx + 0x58]
and eax, r9d
add eax, ecx
cmp dword [r8 + 0x7c], eax
jbe 0x1400021f4
imul ecx, ecx
cmp r10d, ecx
je 0x1400021f4
mov eax, dword [rdx + 0x10]
add eax, dword [r8 + 0x5c]
mov ecx, dword [0x140015110]
imul ecx, eax
mov dword [0x140015110], ecx
mov eax, dword [rdx + 4]
xor eax, dword [r8 + 0xc4]
xor r9d, eax
lea eax, [r9 + 0xdc]
ret
Function at 0x1400031f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov eax, dword [rsp + 0x50]
lea edi, [rcx - 0x46ae]
mov r8d, eax
mov rbx, r9
xor r8d, 0x11f6
lea r9d, [rdx - 0x36d8]
lea esi, [rax + 0xc47]
add eax, 0xffffd40a
xor eax, 0x3cec
cmp r8d, eax
jge 0x140003359
mov edx, r9d
lea eax, [rcx - 0x1293]
xor edx, 0x3a00
cmp eax, edx
je 0x14000337c
mov rax, qword [section..data]
lea rcx, [0x1400045a0]
add edi, 0x43aa
xor r9d, r9d
mov qword [rax + 0xa0], rcx
mov edx, dword [rbx + 8]
lea r10d, [r9 + 1]
mov rax, qword [0x1400150b0]
movsxd rcx, dword [rbx + 0x70]
mov r8d, dword [r9 + rax]
add r9, 4
mov rax, qword [section..data]
imul r8d, dword [rax + 0x6c]
mov eax, dword [rbx + 0x60]
xor eax, dword [0x140015098]
sub edx, eax
mov rax, qword [rbx + 0xa8]
sub edx, 0x560c0
mov dword [rbx + 8], edx
mov edx, r8d
shr edx, 8
mov byte [rcx + rax], dl
add dword [rbx + 0x70], r10d
mov rax, qword [section..data]
movsxd rcx, dword [rax + 0x70]
mov rax, qword [rbx + 0xa8]
mov byte [rcx + rax], r8b
mov rax, qword [section..data]
add dword [rax + 0x70], r10d
mov eax, dword [rbx + 0x58]
mov edx, dword [rbx + 8]
xor eax, 0x1c26e4
add eax, 0xffffffef
add eax, edx
add dword [rbx + 0x2c], eax
mov eax, dword [rbx + 0x94]
sub eax, 0x1af435
xor dword [rbx + 0x24], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0xc4]
add ecx, dword [rbx + 0x7c]
mov eax, dword [rbx + 0xe8]
xor ecx, 0x229387
imul eax, ecx
mov dword [rbx + 0xe8], eax
mov eax, dword [0x1400150e0]
xor eax, r10d
sub dword [rbx + 0x88], eax
mov eax, dword [rbx + 0xd0]
xor eax, r10d
or dword [rbx + 0x104], eax
cmp r9, 0xf1c8
jl 0x14000327c
mov dword [rbx + 0x6c], r10d
mov rbx, qword [rsp + 0x30]
xor edi, 0x7d46
mov rbp, qword [rsp + 0x38]
mov eax, edi
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov eax, dword [0x140015068]
mov ecx, 0x3eec
xor eax, ecx
add eax, ecx
mov rcx, qword [section..data]
cmp dword [rcx + 0x58], eax
ja 0x140003359
mov eax, dword [rbx + 0x10]
xor eax, dword [rbx + 0xc0]
cmp esi, eax
jb 0x140003359
mov eax, edi
sub eax, esi
movsxd rbp, eax
lea eax, [r9 + r8]
movsxd r14, eax
mov eax, dword [rcx + 0xc0]
mov rdx, rbp
or eax, dword [0x140015084]
mov rcx, r14
imul r8d, eax, 0x3c56
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [rbx + 0x10]
add esi, 2
xor eax, dword [rbx + 0xc0]
cmp esi, eax
jb 0x140003359
mov rcx, qword [section..data]
jmp 0x1400033b2