joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400838e0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, qword [0x14014d948]
cmp rsi, 1
jbe 0x140083903
mov rcx, rsi
xor edx, edx
add rsp, 0x28
pop rdi
pop rsi
jmp fcn.140076370
lea rcx, [0x14014d948]
call fcn.140048c30
test al, al
je 0x140083948
xorps xmm0, xmm0
movups xmmword [0x14014d950], xmm0
lea rdi, [0x14014d948]
lea rsi, [0x14014d950]
mov rcx, rsi
xor edx, edx
call fcn.140052690
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
mov r9, rdi
call fcn.140048cd0
jmp 0x1400838f3
mov rsi, qword [0x14014d948]
jmp 0x1400838f3

Function at 0x140083d80
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14014e950]
mov ecx, dword [0x1401434ec]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140083db5
lea rcx, [0x14014e940]
add rsp, 0x28
jmp fcn.140076330
lea rcx, [0x14014e950]
call fcn.1400872c0
cmp dword [0x14014e950], 0xffffffff
jne 0x140083da5
xorps xmm0, xmm0
movups xmmword [0x14014e940], xmm0
lea rcx, [0x14014e940]
xor edx, edx
call fcn.140052690
lea rcx, [0x14014e950]
call fcn.140087358
jmp 0x140083da5

Function at 0x140087050
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x14014f340]
mov ecx, dword [0x1401434ec]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400870b6
lea rcx, [0x14014f330]
xor edx, edx
call fcn.140076370
mov eax, dword [0x14014f358]
mov ecx, dword [0x1401434ec]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400870f1
lea rcx, [0x14014f348]
xor edx, edx
add rsp, 0x28
jmp fcn.140076370
lea rcx, [0x14014f340]
call fcn.1400872c0
cmp dword [0x14014f340], 0xffffffff
jne 0x140087075
xorps xmm0, xmm0
movups xmmword [0x14014f330], xmm0
lea rcx, [0x14014f330]
xor edx, edx
call fcn.140052690
lea rcx, [0x14014f340]
call fcn.140087358
jmp 0x140087075
lea rcx, [0x14014f358]
call fcn.1400872c0
cmp dword [0x14014f358], 0xffffffff
jne 0x1400870a4
xorps xmm0, xmm0
movups xmmword [0x14014f348], xmm0
lea rcx, [0x14014f348]
xor edx, edx
call fcn.140052690
lea rcx, [0x14014f358]
call fcn.140087358
jmp 0x1400870a4

Function at 0x140096684
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400967d8
Function at 0x13208
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbp, rcx
lea rcx, [rax - 0x20]
mov edi, r9d
mov rsi, r8
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and dword [rsp + 0x30], 0
xor r9d, r9d
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8d, [r9 + 2]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ecx, dword [rsp + 0x30]
cmp eax, 0xc0000034
jne 0x13276
cmp ecx, edi
jae 0x13276
cmp ecx, 0x1000
ja 0x13276
mov eax, 0xc000000d
jmp 0x132df
mov rdx, rcx
mov r8d, 0x656e6f4e
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
jne 0x13296
mov eax, 0xc000009a
jmp 0x132df
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov r8d, 2
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
js 0x1326f
lea rdx, [rbx + 0xc]
mov r8, rdi
mov rcx, rsi
call fcn.00016020
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x17af4
Capabilities:
Create device object

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov rax, qword [0x00016a80]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r12, r8
mov edi, edx
mov rbx, rcx
mov r15d, 0x1a70
mov r8d, 0x656e6f4e
xor ecx, ecx
mov rdx, r15
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
xor r14d, r14d
mov rsi, rax
cmp rax, r14
jne 0x17b51
mov eax, 0xc000009a
jmp 0x17ced
mov r8, r15
xor edx, edx
mov rcx, rax
call fcn.00016370
cmp dword [0x00016d14], 0x10
jae 0x17ce8
lea rcx, [rsp + 0x48]
mov rdx, rbx
mov r8d, 0x34
call fcn.00016020
lea rcx, [rsp + 0x48]
mov rdx, rsi
call fcn.00020348
cmp eax, r14d
jl 0x17ced
mov edx, dword [0x00016d14]
mov eax, dword [rbx + 4]
lea r8, [0x00010000]
mov dword [r8 + rdx*4 + 0x6c20], eax
mov eax, dword [rbx + 8]
lea r13, [rdi - 0x34]
mov dword [r8 + rdx*4 + 0x6c60], eax
shr r13, 1
mov ebp, 1
add edx, ebp
lea eax, [r13 - 1]
mov dword [0x00016d14], edx
cmp r14w, word [rbx + rax*2 + 0x34]
jne 0x17ce8
lea eax, [r13 - 2]
cmp r14w, word [rbx + rax*2 + 0x34]
jne 0x17ce8
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [r12 + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
lea r11, [r12 + 0x30]
mov rax, qword [r11]
cmp rax, r11
je 0x17c1e
mov ecx, dword [rbx + 4]
cmp ecx, dword [rax - 8]
je 0x17c1b
mov rax, qword [rax]
cmp rax, r11
jne 0x17c0c
jmp 0x17c1e
mov bpl, r14b
lea rcx, [r12 + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
cmp bpl, r14b
je 0x17ce8
mov rcx, qword [r12]
lea rax, [rsp + 0x40]
mov r9d, 0x2a
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x1ac0
mov byte [rsp + 0x28], r14b
add r13d, r13d
mov dword [rsp + 0x20], 0x180
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
cmp eax, r14d
mov edi, eax
jl 0x17ced
mov rax, qword [rsp + 0x40]
mov r8d, 0x62735556
mov rdx, r13
mov rbp, qword [rax + 0x40]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rbp + 0x28], rax
cmp rax, r14
jne 0x17ca8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
jmp 0x17b47
lea rdx, [rbx + 0x34]
mov r8, r13
mov rcx, rax
call fcn.00016020
mov r11d, dword [rbx + 4]
mov rdx, r12
mov dword [rbp + 0x30], r11d
mov rcx, qword [rsp + 0x40]
call fcn.00017a40
lea rcx, [rbp + 0x50]
mov r8, r15
mov rdx, rsi
call fcn.00016020
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePool]
mov eax, edi
jmp 0x17ced
mov eax, 0xc000000d
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.00015fb0
mov rbx, qword [rsp + 0xe8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18754
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x1a0
mov rax, qword [0x00016a80]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov r12d, r8d
mov rbp, rdx
mov rsi, rcx
mov rax, cr8
xor ebx, ebx
cmp al, bl
je 0x1878f
lea eax, [rbx + 1]
jmp 0x1884c
lea r8, str.RegistryMACHINESystemCurrentControlSetSentinel
lea rdx, [0x00023fc0]
lea rcx, [rsp + 0x90]
add r9, 0x1528
call qword [sym.imp.ntoskrnl.exe_swprintf]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x78]
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov edx, 0x20006
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], 0x30
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x50], 0x40
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebx
mov edi, eax
jl 0x18845
lea rcx, [rsp + 0x68]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x68]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp edi, ebx
setl bl
mov eax, ebx
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.00015fb0
add rsp, 0x1a0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x23418
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r9b, byte [rcx + 1]
mov dil, byte [rcx + 2]
mov r11b, byte [rcx]
shr dil, 7
mov al, r9b
mov rbx, rcx
shr al, 5
not dil
and al, 1
and dil, 1
mov byte [rcx + 0xa], al
jne 0x2345d
not r11b
and dword [rsp + 0x50], 0
mov esi, 0x1f
mov r10b, byte [rsp + 0x50]
lea edx, [rsi - 0x1b]
and r9b, sil
mov al, r10b
mov cl, r9b
shl al, 2
add cl, cl
not cl
and cl, 2
mov r10b, cl
or r10b, al
mov al, r9b
shr r9b, 1
and al, 1
or r10b, al
sub rdx, 1
jne 0x23472
mov bpl, r10b
xor r12d, r12d
mov byte [rsp + 0x50], r10b
not bpl
or r13d, 0xffffffff
lea r14d, [rdx + 0x18]
mov byte [rsp + 0x52], bpl
mov r15d, 0xfe
lea rax, [r14 - 0x10]
mov r8d, r13d
dec r13d
sar rax, 2
and r8d, 7
and rax, r15
mov cl, r8b
mov dl, byte [rax + rbx + 2]
mov rax, r14
inc r14
shr dl, cl
mov ecx, r12d
sar rax, 2
and dl, 1
and rax, r15
xor dl, r9b
shl dl, cl
mov cl, r8b
xor r10b, dl
mov dl, byte [rax + rbx + 2]
shr dl, cl
mov ecx, r12d
inc r12d
and dl, 1
xor dl, r9b
shl dl, cl
xor bpl, dl
cmp r13d, 0xfffffff7
jg 0x234ba
and dword [rbx + 0xb], 0
movzx r12d, r11b
xor r13d, r13d
mov r14d, r12d
mov byte [rsp + 0x51], r10b
mov byte [rsp + 0x53], bpl
shl r14d, 3
mov r15, rsi
mov dword [rbx + 0xf], r14d
mov ebp, 0xc
mov rdx, rbx
mov ecx, esi
call fcn.0002335c
sub rbp, 1
mov r11d, eax
jne 0x2353b
mov eax, dword [rsp + 0x50]
mov rcx, r15
dec r15
sar rcx, 2
and ecx, 0xfe
movzx edx, byte [rcx + rbx + 2]
mov ecx, 0xff
sub cl, sil
and ecx, 7
shr edx, cl
mov ecx, esi
shr eax, cl
xor edx, eax
movzx eax, r11b
xor edx, esi
and edx, 1
xor edx, eax
lea eax, [r13 + r13]
mov r13d, edx
or r13d, eax
sub esi, 1
jns 0x23532
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
movzx eax, dil
lea ecx, [r12 + r12]
mov dword [rbx + 0xb], r13d
or ecx, eax
add ecx, ecx
or ecx, eax
add ecx, ecx
or ecx, eax
mov dword [rbx + 0xf], ecx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140011249
Capabilities:
Terminate process

Disassembly:
jmp 0x140013290
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400112d5
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
jmp 0x140011a10
push rbp
push rdi
sub rsp, 0x218
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x46
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x1c0], rax
lea rcx, [0x1400240a2]
call fcn.140011415
nop
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str.C:_vs2015RealBlindingEDR_mainRealBlindingEDRx64DebugRealBlindingEDR.exe
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x140011aa1
lea rcx, str.Unable_to_open_file._n
call fcn.1400111db
nop
mov eax, 1
jmp 0x140011baf
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rbp + 0x24], eax
mov eax, dword [rbp + 0x24]
mov ecx, eax
call fcn.1400111ae
mov qword [rbp + 0x188], rax
mov rax, qword [rbp + 0x188]
mov qword [rbp + 0x48], rax
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x64]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
mov dword [rax + 0x28], 0x401000
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
nop
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x64]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x1a8], rax
mov rcx, qword [rbp + 0x1a8]
call fcn.1400111ef
cmp qword [rbp + 0x1a8], 0
jne 0x140011b82
mov qword [rbp + 0x1b8], 0
jmp 0x140011b95
mov qword [rbp + 0x48], 0x8123
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x1b8], rax
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, str.The_entry_point_has_been_successfully_modified._n
call fcn.1400111db
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001ac80]
call fcn.140011393
mov rax, rdi
mov rcx, qword [rbp + 0x1c0]
xor rcx, rbp
call fcn.1400111f9
lea rsp, [rbp + 0x1d8]
pop rdi
pop rbp
ret
Function at 0x1400112e4
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400145e0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014600
xor al, al
jmp 0x140014681
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014613
xor al, al
jmp 0x140014681
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001463d
xor al, al
jmp 0x140014681
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014651
xor al, al
jmp 0x140014681
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014663
xor al, al
jmp 0x140014681
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001467f
xor al, al
jmp 0x140014681
mov al, 1
add rsp, 0x38
ret
Function at 0x140012430
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001143d
movzx eax, al
test eax, eax
jne 0x140012450
mov ecx, 7
call fcn.14001139d
nop
mov byte [rsp + 0x20], 0
call fcn.1400113c0
mov byte [rsp + 0x21], al
cmp dword [0x14001eb28], 1
jne 0x140012474
mov ecx, 7
call fcn.14001139d
nop
jmp 0x1400124cc
cmp dword [0x14001eb28], 0
jne 0x1400124c7
mov dword [0x14001eb28], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.1400111e0
test eax, eax
je 0x1400124a8
mov eax, 0xff
jmp 0x1400125d1
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.1400113b1
mov dword [0x14001eb28], 2
jmp 0x1400124cc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011389
call fcn.140011307
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012529
mov rcx, qword [rsp + 0x30]
call fcn.14001118b
movzx eax, al
test eax, eax
je 0x140012529
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140025020]
nop
call fcn.140011343
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001255d
mov rcx, qword [rsp + 0x38]
call fcn.14001118b
movzx eax, al
test eax, eax
je 0x14001255d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113f7
nop
call fcn.140012680
mov dword [rsp + 0x28], eax
call fcn.1400112e4
movzx eax, al
test eax, eax
jne 0x14001257c
mov ecx, dword [rsp + 0x28]
call fcn.14001105a
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001258b
call fcn.140011401
nop
xor edx, edx
mov cl, 1
call fcn.140011172
mov eax, dword [rsp + 0x28]
jmp 0x1400125d1
add rsp, 0x68
ret
Function at 0x140001179
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x1400130d8]
xor ecx, ecx
lea rdx, [rsp + 0x21]
mov byte [rdx - 1], cl
mov byte [rdx], cl
mov cl, 0x44
mov byte [rdx + 1], cl
mov byte [rdx + 2], 0x66
mov byte [rdx + 3], 0x2e
mov byte [rdx + 4], 0x6a
mov byte [rdx + 5], 0x50
mov byte [rdx + 6], 0x48
mov byte [rdx + 7], cl
mov r8b, 0x68
mov byte [rdx + 8], r8b
mov byte [rdx + 9], r8b
mov byte [rdx + 0xa], 0x1e
mov byte [rdx + 0xb], cl
mov byte [rdx + 0xc], 0x4c
mov byte [rdx + 0xd], 0x6e
mov byte [rdx + 0xe], 0x8e
mov cl, byte [rdx - 1]
test cl, 1
jne 0x1400011f7
mov ecx, 1
mov r8b, byte [rsp + rcx + 0x20]
ror r8b, 1
xor r8b, 0x47
mov byte [rsp + rcx + 0x20], r8b
inc rcx
cmp rcx, 0x10
jne 0x1400011dd
mov rcx, qword [0x1400130c8]
call rax
mov rdi, rax
mov rax, qword [0x1400130d8]
lea rdx, [rsp + 0x21]
mov byte [rdx - 1], 0
mov byte [rdx], 0x2c
mov byte [rdx + 1], 0x76
mov byte [rdx + 2], 0x7e
mov byte [rdx + 3], 0x5c
mov byte [rdx + 4], 0x3e
mov cl, 0x64
mov byte [rdx + 5], cl
mov byte [rdx + 6], cl
mov byte [rdx + 7], 0x62
mov byte [rdx + 8], 0x7a
mov byte [rdx + 9], 0xbc
mov cl, byte [rdx - 1]
test cl, 1
jne 0x140001261
mov ecx, 1
mov r8b, byte [rsp + rcx + 0x20]
ror r8b, 1
xor r8b, 0x5e
mov byte [rsp + rcx + 0x20], r8b
inc rcx
cmp rcx, 0xb
jne 0x140001247
mov rcx, qword [0x1400130c8]
call rax
mov rbx, rax
test rdi, rdi
sete al
test rbx, rbx
sete cl
or cl, al
jne 0x14000128e
call rdi
mov rcx, rax
mov edx, 8
mov r8, rsi
call rbx
jmp 0x140001290
xor eax, eax
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x140001298
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x1400130d8]
lea rdx, [rsp + 0x21]
mov byte [rdx - 1], 0
mov byte [rdx], 0x40
mov cl, 4
mov byte [rdx + 1], cl
mov byte [rdx + 2], 0x26
mov byte [rdx + 3], 0x6e
mov byte [rdx + 4], 0x2a
mov byte [rdx + 5], 0x10
mov byte [rdx + 6], 8
mov byte [rdx + 7], cl
mov r8b, 0x28
mov byte [rdx + 8], r8b
mov byte [rdx + 9], r8b
mov byte [rdx + 0xa], 0x5e
mov byte [rdx + 0xb], cl
mov byte [rdx + 0xc], 0xc
mov byte [rdx + 0xd], 0x2e
mov byte [rdx + 0xe], 0xce
mov cl, byte [rdx - 1]
test cl, 1
jne 0x140001316
mov ecx, 1
mov r8b, byte [rsp + rcx + 0x20]
ror r8b, 1
xor r8b, 0x67
mov byte [rsp + rcx + 0x20], r8b
inc rcx
cmp rcx, 0x10
jne 0x1400012fc
mov rcx, qword [0x1400130c8]
call rax
mov rdi, rax
mov rax, qword [0x1400130d8]
lea rdx, [rsp + 0x21]
mov byte [rdx - 1], 0
mov byte [rdx], 0x8c
mov cl, 0xd6
mov byte [rdx + 1], cl
mov byte [rdx + 2], 0xde
mov byte [rdx + 3], 0xfc
mov byte [rdx + 4], 0x90
mov byte [rdx + 5], 0xf8
mov byte [rdx + 6], cl
mov byte [rdx + 7], cl
mov byte [rdx + 8], 0x1c
mov cl, byte [rdx - 1]
test cl, 1
jne 0x14000137b
mov ecx, 1
mov r8b, byte [rsp + rcx + 0x20]
ror r8b, 1
xor r8b, 0xe
mov byte [rsp + rcx + 0x20], r8b
inc rcx
cmp rcx, 0xa
jne 0x140001361
mov rcx, qword [0x1400130c8]
call rax
mov rbx, rax
test rdi, rdi
sete al
test rbx, rbx
sete cl
or cl, al
jne 0x1400013a6
call rdi
mov rcx, rax
mov edx, 1
mov r8, rsi
call rbx
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140006cc6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rbx, r8
cmp edx, 0x10000
jb 0x140006d53
mov rdi, rcx
movsxd rax, dword [rcx + 0x3c]
mov esi, dword [rcx + rax + 0x88]
add rsi, rcx
cmp dword [rsi + 0x18], 0
je 0x140006d53
mov ebp, edx
mov r14d, dword [rdi + rax + 0x8c]
mov r12d, dword [rsi + 0x20]
mov r15d, dword [rsi + 0x24]
add r15, rdi
add r12, rdi
xor r13d, r13d
mov eax, dword [r12]
lea rcx, [rax + rdi]
cmp byte [rax + rdi], 0
mov edx, 0
je 0x140006d33
xor edx, edx
cmp byte [rcx + rdx + 1], 0
lea rdx, [rdx + 1]
jne 0x140006d28
mov r8d, 0xb801fcda
call fcn.140009548
cmp eax, ebp
je 0x140006d70
add r12, 4
add r15, 2
inc r13d
cmp r13d, dword [rsi + 0x18]
jb 0x140006d13
mov qword [rbx], 0
xor edi, edi
mov rax, rdi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movzx r8d, word [r15]
mov rcx, rdi
mov rdx, rsi
call fcn.1400048f3
mov rdi, rax
mov rcx, rax
mov rdx, rsi
mov r8d, r14d
call fcn.140004338
test eax, eax
je 0x140006d5c
mov rcx, rdi
call fcn.140001700
mov rdi, rax
jmp 0x140006d5c

Function at 0x140009548
Capabilities:
Encode data using xor

Disassembly:
imul eax, edx, 0xc6a4a793
xor eax, r8d
cmp edx, 4
jl 0x14000957a
add eax, dword [rcx]
imul r8d, eax, 0xc6a4a793
mov eax, r8d
shr eax, 0x10
xor eax, r8d
add rcx, 4
lea r8d, [rdx - 4]
cmp edx, 7
mov edx, r8d
ja 0x140009556
jmp 0x14000957d
mov r8d, edx
cmp r8d, 1
je 0x1400095a1
cmp r8d, 2
je 0x140009598
cmp r8d, 3
jne 0x1400095b3
movzx edx, byte [rcx + 2]
shl edx, 0x10
add eax, edx
movzx edx, byte [rcx + 1]
shl edx, 8
add eax, edx
movzx ecx, byte [rcx]
add ecx, eax
imul ecx, ecx, 0xc6a4a793
mov eax, ecx
shr eax, 0x10
xor eax, ecx
imul eax, eax, 0xc6a4a793
mov ecx, eax
shr ecx, 0xa
xor ecx, eax
imul ecx, ecx, 0xc6a4a793
mov eax, ecx
shr eax, 0x11
xor eax, ecx
ret

Function at 0x1400095d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
mov eax, dword [rcx]
mov ebx, dword [rcx + 4]
mov r8d, dword [rdx]
mov r9d, dword [rdx + 4]
mov r10d, dword [rdx + 8]
mov edx, dword [rdx + 0xc]
mov r11d, 0x38446867
mov esi, 0x20
mov edi, ebx
shl ebx, 4
add ebx, r8d
lea ebp, [rdi + r11]
xor ebp, ebx
mov ebx, edi
shr ebx, 5
add ebx, r9d
xor ebx, ebp
add eax, ebx
mov ebx, eax
shl ebx, 4
add ebx, r10d
lea ebp, [r11 + rax]
xor ebp, ebx
mov ebx, eax
shr ebx, 5
add ebx, edx
xor ebx, ebp
add ebx, edi
add r11d, 0x38446867
dec esi
jne 0x1400095f2
mov dword [rcx], eax
mov dword [rcx + 4], ebx
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14000963a
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
mov eax, dword [rcx]
mov r8d, dword [rcx + 4]
mov r9d, dword [rdx]
mov r10d, dword [rdx + 4]
mov r11d, dword [rdx + 8]
mov edx, dword [rdx + 0xc]
mov esi, 0x88d0ce0
mov edi, 0x20
mov ebx, eax
shl ebx, 4
add ebx, r11d
lea ebp, [rax + rsi]
xor ebp, ebx
mov ebx, eax
shr ebx, 5
add ebx, edx
xor ebx, ebp
sub r8d, ebx
mov ebx, r8d
shl ebx, 4
add ebx, r9d
lea ebp, [rsi + r8]
xor ebp, ebx
mov ebx, r8d
shr ebx, 5
add ebx, r10d
xor ebx, ebp
sub eax, ebx
add esi, 0xc7bb9799
dec edi
jne 0x14000965c
mov dword [rcx], eax
mov dword [rcx + 4], r8d
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x1400097c4
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r14, rcx
movsxd rsi, edx
add rsi, 0xfffffffffffffff0
mov ecx, 0x10
call fcn.140001179
mov rdi, rax
mov rcx, rax
mov rdx, r14
mov r8d, 0x10
call fcn.14000102a
mov rcx, rsi
call fcn.140001179
mov rbx, rax
add r14, 0x10
mov rcx, rax
mov rdx, r14
mov r8d, esi
call fcn.14000102a
cmp rsi, 8
jb 0x140009841
shr rsi, 3
cmp rsi, 1
adc rsi, 0
mov r14, rbx
mov ebp, dword [r14]
mov rcx, r14
mov rdx, rdi
call fcn.14000963a
xor dword [rdi], ebp
add r14, 8
dec rsi
jne 0x140009828
mov rax, rbx
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x14000b152
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov cl, byte [rcx]
test cl, 1
jne 0x14000b175
mov ecx, 1
mov dl, byte [rax + rcx]
ror dl, 1
xor dl, 0x37
mov byte [rax + rcx], dl
inc rcx
cmp rcx, 7
jne 0x14000b161
inc rax
ret