joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7feeffb321e
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
call fcn.7feeff31066
mov rsi, rax
movups xmm0, xmmword [rdi + 0x20]
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
call fcn.7feeff4985d
test al, al
je 0x7feeffb325a
cmp byte [rsi], 0
jne 0x7feeffb3397
jmp 0x7feeffb33de
mov qword [rsp + 0x28], 0
mov rcx, qword [rdi + 0x28]
call qword [rdi + 0x20]
mov r12b, 1
cmp byte [rsi], 0
jne 0x7feeffb337d
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x7feeffb3326
lea rbp, [rdi + 0x20]
lea r14, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov cl, byte [rbx + 0x20]
call fcn.7feeff43162
test al, al
je 0x7feeffb32e9
mov rcx, qword [rdi + 0x28]
call qword [rdi + 0x20]
cmp byte [rsi], 0
jne 0x7feeffb337d
mov rcx, r14
mov rdx, rax
call fcn.7feeff41ae5
cmp byte [rsi], 0
jne 0x7feeffb337d
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, r15
call fcn.7feeff4985d
mov rbx, qword [rsp + 0x28]
test al, al
jne 0x7feeffb32e4
test rbx, rbx
jne 0x7feeffb3295
test rbx, rbx
je 0x7feeffb3326
lea r14, [rsp + 0x30]
mov edx, 0x10
mov rcx, r14
call fcn.7feeff318bc
lea rax, [fcn.7feeffb321e]
mov qword [r14], rax
mov qword [r14 + 8], rdi
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, rbx
call fcn.7feeff43f67
jmp 0x7feeffb337a
mov rax, qword [rdi + 0x18]
mov cl, byte [rax + 0x20]
call fcn.7feeff43162
test al, al
je 0x7feeffb333b
xor r12d, r12d
jmp 0x7feeffb337d
mov ecx, 0x40
mov edx, 8
call fcn.7feeff3fbf8
lea rcx, [0x7feeffe4f48]
mov qword [rax], rcx
lea rdx, str.AssertionDefect
mov qword [rax + 0x10], rdx
movups xmm0, xmmword [0x7feeffd1428]
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 8], 0
mov rcx, rax
call fcn.7feeff3fc31
mov r12b, byte [rsi]
mov byte [rsi], 0
mov rcx, qword [rsp + 0x28]
call fcn.7feeff41b10
cmp byte [rsi], 0
jne 0x7feeffb3397
mov byte [rsi], r12b
test r12b, r12b
je 0x7feeffb33de
mov byte [rsi], 0
mov rax, qword [rdi + 0x18]
mov cl, byte [rax + 0x20]
call fcn.7feeff43162
test al, al
je 0x7feeffb33bd
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.7feeff4986a
call fcn.7feeff45705
mov rbx, rax
mov rcx, qword [rdi + 0x18]
mov rdx, rax
call fcn.7feeff431e9
mov rcx, rbx
call fcn.7feeff3fab9
cmp byte [rsi], 0
je 0x7feeffb33ed
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.7feeff45730
Function at 0x7feeffb3e78
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rbx, rdx
mov r15, rcx
call fcn.7feeff31066
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [r15], xmm0
movups xmm6, xmmword [0x7feeffd0b28]
movaps xmmword [rsp + 0x20], xmm6
mov rcx, qword [rbx]
mov rdx, qword [rbx + 8]
lea r9, [0x7feeffdc520]
mov r8d, 2
call fcn.7feeff5b350
mov cl, byte [rdi]
test cl, cl
jne 0x7feeffb4012
test al, al
je 0x7feeffb4012
movups xmm0, xmmword [rbx]
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
movups xmm0, xmmword [0x7feeffd0b18]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
mov r8d, 2
call fcn.7feeff5b22e
cmp byte [rdi], 0
jne 0x7feeffb4025
dec rax
lea rsi, [rsp + 0x50]
mov rcx, rsi
mov rdx, rax
call fcn.7feeffb40d3
movups xmm0, xmmword [rbx]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
mov r8, qword [rsi]
mov r9, qword [rsi + 8]
lea rcx, [rsp + 0x30]
call fcn.7feeff59485
cmp byte [rdi], 0
jne 0x7feeffb4025
lea rdx, [rsp + 0x30]
mov rax, qword [rdx]
mov rcx, qword [rdx + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x20]
mov rcx, rsi
call fcn.7feeff4172d
movaps xmm0, xmmword [rsi]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x30]
call fcn.7feeff5b4b4
cmp byte [rdi], 0
jne 0x7feeffb4025
lea rdx, [rsp + 0x30]
mov rax, qword [rdx]
mov rcx, qword [rdx + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rsi, [rsp + 0x20]
mov rcx, rsi
call fcn.7feeff4172d
mov rbx, qword [rsi]
mov r14, qword [rsi + 8]
lea r9, [0x7feeffdc560]
mov r8d, 9
mov rcx, rbx
mov rdx, r14
call fcn.7feeff5508c
test al, al
jne 0x7feeffb3ff3
lea r9, [0x7feeffdc580]
mov r8d, 9
mov rcx, rbx
mov rdx, r14
call fcn.7feeff5508c
test al, al
jne 0x7feeffb3ff3
lea r9, [0x7feeffdc5a0]
mov r8d, 1
mov rcx, rbx
mov rdx, r14
call fcn.7feeff5508c
test al, al
je 0x7feeffb400b
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm6
lea rsi, [rsp + 0x20]
mov rcx, rsi
call fcn.7feeff4172d
mov rbx, qword [rsi]
test rbx, rbx
jne 0x7feeffb406f
jmp 0x7feeffb4016
test cl, cl
jne 0x7feeffb4025
lea rcx, [rsp + 0x50]
call fcn.7feeff56150
cmp byte [rdi], 0
je 0x7feeffb4052
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x7feeffb40c2
test byte [rcx + 7], 0x40
jne 0x7feeffb40c2
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.7feeff311e0
lea rdx, [rsp + 0x50]
mov rax, qword [rdx]
mov rcx, qword [rdx + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rsp + 0x20]
call fcn.7feeff4172d
lea rsi, [rsp + 0x20]
movaps xmm0, xmmword [rsi]
movups xmmword [r15], xmm0
mov rcx, rsi
call fcn.7feeff3fc2a
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x7feeffb40c2
mov rax, qword [rcx]
mov edx, eax
not edx
lea edx, [rdx + rdx*2]
lea ebx, [rax + rax]
add edx, eax
inc edx
xor edx, ebx
movabs rbx, 0x1f08cc5f86dfac68
xor rbx, rdx
movabs rdx, 0x20f733a086dfac6a
add rdx, rbx
test rax, rdx
je 0x7feeffb403d
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x7feeffb8aa3
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
call fcn.7feeff31066
mov rsi, rax
movups xmm0, xmmword [rdi + 0x20]
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
call fcn.7feeff4985d
test al, al
je 0x7feeffb8adf
cmp byte [rsi], 0
jne 0x7feeffb8c1c
jmp 0x7feeffb8c63
mov qword [rsp + 0x28], 0
mov rcx, qword [rdi + 0x28]
call qword [rdi + 0x20]
mov r12b, 1
cmp byte [rsi], 0
jne 0x7feeffb8c02
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x7feeffb8bab
lea rbp, [rdi + 0x20]
lea r14, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov cl, byte [rbx + 0x20]
call fcn.7feeff43162
test al, al
je 0x7feeffb8b6e
mov rcx, qword [rdi + 0x28]
call qword [rdi + 0x20]
cmp byte [rsi], 0
jne 0x7feeffb8c02
mov rcx, r14
mov rdx, rax
call fcn.7feeff41ae5
cmp byte [rsi], 0
jne 0x7feeffb8c02
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, r15
call fcn.7feeff4985d
mov rbx, qword [rsp + 0x28]
test al, al
jne 0x7feeffb8b69
test rbx, rbx
jne 0x7feeffb8b1a
test rbx, rbx
je 0x7feeffb8bab
lea r14, [rsp + 0x30]
mov edx, 0x10
mov rcx, r14
call fcn.7feeff318bc
lea rax, [fcn.7feeffb8aa3]
mov qword [r14], rax
mov qword [r14 + 8], rdi
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, rbx
call fcn.7feeff43f67
jmp 0x7feeffb8bff
mov rax, qword [rdi + 0x18]
mov cl, byte [rax + 0x20]
call fcn.7feeff43162
test al, al
je 0x7feeffb8bc0
xor r12d, r12d
jmp 0x7feeffb8c02
mov ecx, 0x40
mov edx, 8
call fcn.7feeff3fbf8
lea rcx, [0x7feeffe4f48]
mov qword [rax], rcx
lea rdx, str.AssertionDefect
mov qword [rax + 0x10], rdx
movups xmm0, xmmword [0x7feeffd1348]
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 8], 0
mov rcx, rax
call fcn.7feeff3fc31
mov r12b, byte [rsi]
mov byte [rsi], 0
mov rcx, qword [rsp + 0x28]
call fcn.7feeff41b10
cmp byte [rsi], 0
jne 0x7feeffb8c1c
mov byte [rsi], r12b
test r12b, r12b
je 0x7feeffb8c63
mov byte [rsi], 0
mov rax, qword [rdi + 0x18]
mov cl, byte [rax + 0x20]
call fcn.7feeff43162
test al, al
je 0x7feeffb8c42
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.7feeff4986a
call fcn.7feeff45705
mov rbx, rax
mov rcx, qword [rdi + 0x18]
mov rdx, rax
call fcn.7feeff431e9
mov rcx, rbx
call fcn.7feeff3fab9
cmp byte [rsi], 0
je 0x7feeffb8c72
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.7feeff45730
Function at 0x7feeffbc64e
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, rcx
call fcn.7feeff31066
mov rsi, rax
movups xmm0, xmmword [rdi + 0x20]
lea rcx, [rsp + 0x30]
movaps xmmword [rcx], xmm0
call fcn.7feeff4985d
test al, al
je 0x7feeffbc68a
cmp byte [rsi], 0
jne 0x7feeffbc7c7
jmp 0x7feeffbc80e
mov qword [rsp + 0x28], 0
mov rcx, qword [rdi + 0x28]
call qword [rdi + 0x20]
mov r12b, 1
cmp byte [rsi], 0
jne 0x7feeffbc7ad
mov rbx, rax
mov qword [rsp + 0x28], rax
test rax, rax
je 0x7feeffbc756
lea rbp, [rdi + 0x20]
lea r14, [rsp + 0x28]
lea r15, [rsp + 0x30]
mov cl, byte [rbx + 0x20]
call fcn.7feeff43162
test al, al
je 0x7feeffbc719
mov rcx, qword [rdi + 0x28]
call qword [rdi + 0x20]
cmp byte [rsi], 0
jne 0x7feeffbc7ad
mov rcx, r14
mov rdx, rax
call fcn.7feeff41ae5
cmp byte [rsi], 0
jne 0x7feeffbc7ad
movups xmm0, xmmword [rbp]
movaps xmmword [rsp + 0x30], xmm0
mov rcx, r15
call fcn.7feeff4985d
mov rbx, qword [rsp + 0x28]
test al, al
jne 0x7feeffbc714
test rbx, rbx
jne 0x7feeffbc6c5
test rbx, rbx
je 0x7feeffbc756
lea r14, [rsp + 0x30]
mov edx, 0x10
mov rcx, r14
call fcn.7feeff318bc
lea rax, [fcn.7feeffbc64e]
mov qword [r14], rax
mov qword [r14 + 8], rdi
mov rax, qword [r14]
mov rcx, qword [r14 + 8]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
mov rcx, rbx
call fcn.7feeff43f67
jmp 0x7feeffbc7aa
mov rax, qword [rdi + 0x18]
mov cl, byte [rax + 0x20]
call fcn.7feeff43162
test al, al
je 0x7feeffbc76b
xor r12d, r12d
jmp 0x7feeffbc7ad
mov ecx, 0x40
mov edx, 8
call fcn.7feeff3fbf8
lea rcx, [0x7feeffe4f48]
mov qword [rax], rcx
lea rdx, str.AssertionDefect
mov qword [rax + 0x10], rdx
movups xmm0, xmmword [0x7feeffd10f8]
movups xmmword [rax + 0x18], xmm0
mov qword [rax + 8], 0
mov rcx, rax
call fcn.7feeff3fc31
mov r12b, byte [rsi]
mov byte [rsi], 0
mov rcx, qword [rsp + 0x28]
call fcn.7feeff41b10
cmp byte [rsi], 0
jne 0x7feeffbc7c7
mov byte [rsi], r12b
test r12b, r12b
je 0x7feeffbc80e
mov byte [rsi], 0
mov rax, qword [rdi + 0x18]
mov cl, byte [rax + 0x20]
call fcn.7feeff43162
test al, al
je 0x7feeffbc7ed
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.7feeff4986a
call fcn.7feeff45705
mov rbx, rax
mov rcx, qword [rdi + 0x18]
mov rdx, rax
call fcn.7feeff431e9
mov rcx, rbx
call fcn.7feeff3fab9
cmp byte [rsi], 0
je 0x7feeffbc81d
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.7feeff45730
Function at 0x7feeffbca3a
Capabilities:
Terminate process

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rbx, rdx
mov rsi, rcx
call fcn.7feeff31066
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
movups xmm0, xmmword [0x7feeffd27f0]
movaps xmmword [rsp + 0x20], xmm0
movups xmm1, xmmword [rbx]
lea rdx, [rsp + 0x50]
movaps xmmword [rdx], xmm1
lea r8, [rsp + 0x40]
movaps xmmword [r8], xmm0
lea rcx, [rsp + 0x30]
call fcn.7feeff58156
cmp byte [rdi], 0
jne 0x7feeffbcaa6
lea rdx, [rsp + 0x30]
mov rax, qword [rdx]
mov rcx, qword [rdx + 8]
mov qword [rdx], rax
mov qword [rdx + 8], rcx
lea rcx, [rsp + 0x20]
call fcn.7feeff4172d
cmp byte [rdi], 0
je 0x7feeffbcad3
mov byte [rdi], 0
movups xmm0, xmmword [0x7feeffd2790]
lea rdx, [rsp + 0x30]
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x20]
call fcn.7feeff4172d
call fcn.7feeff45730
cmp byte [rdi], 0
je 0x7feeffbcad3
mov rcx, qword [rsp + 0x28]
jmp 0x7feeffbcaea
lea rdi, [rsp + 0x20]
movaps xmm0, xmmword [rdi]
movups xmmword [rsi], xmm0
mov rcx, rdi
call fcn.7feeff3fc2a
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x7feeffbcb01
test byte [rcx + 7], 0x40
jne 0x7feeffbcb01
add rsp, 0x60
pop rbx
pop rdi
pop rsi
jmp fcn.7feeff311e0
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret

Function at 0x7feeffc2546
Capabilities:
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x7feeffc25c1
mov rax, qword [rcx]
mov edx, eax
or edx, 8
imul edx, edx
imul edx, edx, 0xeab9
or edx, 0x5c
mov ebx, 0xff
and edx, ebx
imul edx, edx
imul edx, edx, 0xac45
mov edi, eax
or edi, 0xc4
and edi, ebx
imul edi, edi
imul ebx, edi, 0x8837
xor edi, edi
cmp edx, ebx
sete dil
neg rdi
movabs rdx, 0xd85f6705dd4a2733
xor rdx, rdi
movabs rbx, 0x67a098fa22b5d8cd
add rbx, rdx
test rax, rbx
jne 0x7feeffc25c1
call fcn.7feeff311e0
movabs r14, 0x4000000000000000
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x7feeffc25de
test qword [rcx], r14
jne 0x7feeffc25de
call fcn.7feeff311e0
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x7feeffc25f1
test qword [rcx], r14
jne 0x7feeffc25f1
call fcn.7feeff311e0
mov rcx, qword [rsi + 0x48]
test rcx, rcx
je 0x7feeffc2604
test qword [rcx], r14
jne 0x7feeffc2604
call fcn.7feeff311e0
mov ebx, 0xfffffffe
mov rcx, qword [rsi + 0x68]
test rcx, rcx
je 0x7feeffc264d
mov rax, qword [rcx]
lea edx, [rbx + 1]
xor edx, eax
lea edx, [rdx + rdx*2]
lea edi, [rax + rax]
add edx, eax
inc edx
xor edx, edi
xor rdx, rbx
movabs rdi, 0x46bee7a1a3b7e858
add rdi, rdx
movabs rdx, 0x6bee7a1a3b7e858
xor rdx, rdi
test rax, rdx
jne 0x7feeffc264d
call fcn.7feeff311e0
mov rcx, qword [rsi + 0x78]
test rcx, rcx
je 0x7feeffc2660
test qword [rcx], r14
jne 0x7feeffc2660
call fcn.7feeff311e0
mov rcx, qword [rsi + 0x88]
test rcx, rcx
je 0x7feeffc2688
mov rax, qword [rcx]
lea edx, [rbx + 1]
xor edx, eax
lea edx, [rdx + rdx*2]
sub ebx, eax
lea edx, [rdx + rax*2]
inc edx
xor edx, ebx
or rdx, r14
test rax, rdx
je 0x7feeffc2692
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.7feeff311e0
Function at 0x7feeffc296d
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x7fef003ef50], eax
lea rdx, [0x7fef003adf0]
mov ecx, eax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x7feeffc29ef
Capabilities:
Terminate process

Disassembly:
push rsi
sub rsp, 0x20
call fcn.7feeff31208
cmp byte [rax], 0
je 0x7feeff64eb8
mov rsi, rax
mov rcx, qword [rax + 0x18]
test rcx, rcx
jne 0x7feeff64ebe
add rsp, 0x20
pop rsi
ret
add rsi, 0x18
call fcn.7feeff51fd9
mov rcx, rsi
xor edx, edx
call fcn.7feeff3fdb7
mov ecx, 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
int3
jmp 0x7feeffc29ea
jmp 0x7feeff64e9d
sub rsp, 0x28
call fcn.7feeffc28e7
nop
add rsp, 0x28
jmp 0x7feeffc29e5

Function at 0x7feeffc2a30
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
lea r8, [0x7feeffc2a10]
xor eax, eax
xor ecx, ecx
xor edx, edx
xor r9d, r9d
mov dword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x30]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
add rsp, 0x38
ret
Function at 0x1400023b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x14000a008]
movzx edx, word [rax]
cmp edx, 0x5a4d
jne 0x14000241c
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14000241c
add rax, rdx
movzx edx, word [rax + 0x18]
cmp edx, 0x20b
jne 0x14000241c
movzx edx, word [rax + 6]
test edx, edx
je 0x14000241c
sub rcx, qword [0x14000a008]
movzx r8d, word [rax + 0x14]
add rax, r8
add rax, 0x18
jmp 0x140002408
add rax, 0x28
dec edx
je 0x14000241c
mov r8d, dword [rax + 0xc]
cmp rcx, r8
jb 0x140002400
add r8d, dword [rax + 8]
cmp rcx, r8
jae 0x140002400
jmp 0x14000241e
xor eax, eax
ret

Function at 0x140002420
Capabilities:
Parse pe header

Disassembly:
mov rcx, qword [0x14000a008]
movzx edx, word [rcx]
xor eax, eax
cmp edx, 0x5a4d
jne 0x140002455
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rcx + rdx], 0x4550
jne 0x140002455
movzx r8d, word [rcx + rdx + 0x18]
cmp r8d, 0x20b
jne 0x140002455
movzx eax, word [rcx + rdx + 6]
ret

Function at 0x1400024d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000a008]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x1400024fc
movsxd rcx, dword [rax + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400024fc
movzx ecx, word [rax + rcx + 0x18]
cmp ecx, 0x20b
je 0x1400024fe
xor eax, eax
ret
Function at 0x180001180
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
add rcx, 2
mov ebp, 4
nop dword [rax]
movzx esi, byte [rcx - 2]
movzx r9d, byte [rcx - 1]
movzx edi, byte [rcx + 1]
movzx r11d, byte [rcx]
movzx r8d, sil
movzx r10d, dil
xor r8b, r9b
xor r10b, r11b
mov al, 0x1b
movzx edx, r8b
add r8b, r8b
movzx ebx, r10b
shr dl, 7
xor bl, sil
lea rcx, [rcx + 4]
xor bl, r9b
imul dl
xor al, r8b
movzx r8d, r9b
xor al, sil
xor r8b, r11b
xor sil, dil
xor al, bl
movzx edx, r8b
add r8b, r8b
mov byte [rcx - 6], al
shr dl, 7
mov al, 0x1b
imul dl
xor al, r8b
movzx edx, r10b
xor al, r9b
shr dl, 7
add r10b, r10b
xor al, bl
mov byte [rcx - 5], al
mov al, 0x1b
imul dl
xor al, r10b
movzx edx, sil
xor al, r11b
shr dl, 7
add sil, sil
xor al, bl
mov byte [rcx - 4], al
mov al, 0x1b
imul dl
xor al, sil
xor al, dil
xor al, bl
mov byte [rcx - 3], al
dec rbp
jne 0x1800011a0
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x1800016b0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, rdx
mov rbp, rdx
mov rbx, rcx
mov r8, rcx
mov r9d, 4
sub rdi, rcx
nop
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rdi + r8]
inc r8
xor byte [r8 - 1], al
dec rcx
jne 0x1800016f0
dec r9
jne 0x1800016e0
mov sil, 1
lea r14, str.cw
mov r8, rbx
mov r9d, 4
nop dword [rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
dec rdx
jne 0x180001730
inc r8
dec r9
jne 0x180001720
movzx eax, byte [rbx + 5]
movzx ecx, byte [rbx + 1]
mov byte [rbx + 1], al
movzx eax, byte [rbx + 9]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xd]
mov byte [rbx + 0xd], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 0xf], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 7], cl
mov byte [rbx + 0xb], al
cmp sil, 0xa
je 0x1800017fd
mov rcx, rbx
call fcn.180001180
movzx r8d, sil
mov rax, rbx
shl r8, 4
mov r9d, 4
sub r8, rbx
add r8, rbp
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
inc rax
xor byte [rax - 1], cl
dec rdx
jne 0x1800017e0
dec r9
jne 0x1800017d0
inc sil
jmp 0x180001710
mov edx, 4
nop dword [rax]
nop word [rax + rax]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rdi + rbx + 0xa0]
inc rbx
xor byte [rbx - 1], al
dec rcx
jne 0x180001820
dec rdx
jne 0x180001810
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180001860
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r10, rdx
mov rsi, rdx
mov rbx, rcx
mov r8, rcx
mov r11d, 4
sub r10, rcx
nop dword [rax]
mov r9d, 4
nop word [rax + rax]
movzx eax, byte [r10 + r8 + 0xa0]
inc r8
xor byte [r8 - 1], al
dec r9
jne 0x1800018a0
dec r11
jne 0x180001890
mov dil, 9
lea rbp, [0x180014510]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbx + 9]
movzx ecx, byte [rbx + 0xd]
mov r8, rbx
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov r9d, 4
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xf], cl
mov byte [rbx + 0xb], al
nop dword [rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + rbp]
mov byte [rcx - 4], al
dec rdx
jne 0x180001940
inc r8
dec r9
jne 0x180001930
movzx r8d, dil
mov rax, rbx
lea r9d, [rdx + 4]
shl r8, 4
sub r8, rbx
add r8, rsi
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
inc rax
xor byte [rax - 1], cl
dec rdx
jne 0x180001980
dec r9
jne 0x180001970
test dil, dil
je 0x1800019ab
mov rcx, rbx
call fcn.180001260
add dil, 0xff
jmp 0x1800018d0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1800019c0
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x180001a53
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
mov rdi, rcx
mov esi, r8d
sub rdi, rdx
mov rbx, rdx
mov rbp, rcx
add rdi, 0xb0
dec rsi
shr rsi, 4
inc rsi
nop dword [rax]
movups xmm0, xmmword [rbx]
mov rdx, rbp
mov rcx, rbx
call fcn.180001860
mov ecx, 0x10
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
inc rbx
xor byte [rbx - 1], al
dec rcx
jne 0x180001a20
sub rdi, 0x10
movups xmmword [rbp + 0xb0], xmm0
dec rsi
jne 0x180001a00
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret