joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4868c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48698a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x0060a590]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x48696f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004b1580]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x48695e
mov edi, 1
lea rsi, [0x004b1580]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004f37e8]
lea rsi, [0x004f3058]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString

Function at 0x49cf00
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d63f
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x49cf2d
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x49d1b1
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x49d1dd
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x004f5020]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004b1480]
lea rbx, [0x004f3700]
call sym.runtime.gopanic
inc rax
cmp rax, r8
jge 0x49d202
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x49d237
lea rdi, [0x004b1500]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x49cf23
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x49d21b
jmp 0x49d1f0
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.internal_bisect.Hash

Function at 0x49d7e0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x49d7f7
inc rax
cmp rax, 4
jge 0x49d80f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x49d7f4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x49d820
inc rax
cmp rax, 4
jge 0x49d82e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x49d857
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x49d83b
jmp 0x49d81d
Function at 0x14001e080
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.140022020
sub rsp, rax
mov rax, qword [0x14005f200]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov edi, 0x28
mov word [rsp + 0x30], bp
test al, al
je 0x14001e142
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.140030f7c
cmp rax, 1
jne 0x14001e19e
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14001e11f
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x14001e113
cmp rcx, 1
jb 0x14001e19e
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x14001e0e0
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x14001e173
lea rcx, [rsp + 0x80]
call fcn.140033b24
jmp 0x14001e175
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.140021d50
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140030d28
int3
Function at 0x14001ed80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [0x140060c4e], 0
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
jne 0x14001ee05
mov edx, 3
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x140060aa0], rax
xor ecx, ecx
mov ebx, dword [rax]
lea rdx, [rax + 4]
mov qword [0x140060aa0], rdx
mov r8d, dword [rdx]
add rdx, 4
mov qword [0x140060aa0], rdx
call fcn.14001cf40
cmp eax, ebx
jne 0x14001ef6d
mov byte [0x140060c4e], 1
lea rdx, [0x1400423f8]
mov rcx, rsi
call fcn.1400309d0
test eax, eax
je 0x14001ee90
cmp byte [0x140060c4d], 1
je 0x14001ee90
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1400619a0], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1400619a8], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1400619b0], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1400619b8], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1400619c0], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1400619c8], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1400619d0], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1400619d8], rax
mov byte [0x140060c4d], 1
mov r8, qword [0x140060aa0]
mov rax, rsi
mov rdx, r8
sub rdx, rsi
movzx ecx, byte [rax]
xor r9d, r9d
cmp cl, byte [rax + rdx]
jne 0x14001eeb7
inc rax
test cl, cl
jne 0x14001eea0
mov ecx, r9d
jmp 0x14001eebc
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
cmp byte [r8 + rax + 1], r9b
lea rax, [rax + 1]
jne 0x14001eec3
lea rdx, [r8 + rax]
mov eax, dword [r8 + rax + 1]
add rdx, 5
test ecx, ecx
je 0x14001ef28
nop
add rdx, rax
mov rax, rsi
mov r8, rdx
sub r8, rsi
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + r8]
jne 0x14001ef05
inc rax
test cl, cl
jne 0x14001eef0
mov ecx, r9d
jmp 0x14001ef0a
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r9b
jne 0x14001ef11
add rdx, rax
mov eax, dword [rdx + 1]
add rdx, 5
test ecx, ecx
jne 0x14001eee0
movzx ecx, word [rdx]
lea rax, [rdx + 2]
cmp r9w, cx
jae 0x14001ef58
mov ebx, ecx
nop word [rax + rax]
mov r8, rax
mov rdx, rdi
mov rcx, rbp
call fcn.14001b510
add rdi, 8
sub rbx, 1
jne 0x14001ef40
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, str.Error__corrupted_constants_object
call fcn.14002d6e4
call fcn.140030d28
int3
Function at 0x140021900
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x14005f200]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x1400219b1
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.140030f7c
cmp rax, 1
jne 0x1400219e7
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x14002198d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x140021980
cmp rcx, 1
jb 0x1400219e7
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140021950
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140021d50
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140030d28
int3

Function at 0x140021bd0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14005f200]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x30], bp
mov edi, 0x28
test al, al
je 0x140021c7f
nop dword [rax]
nop dword [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.140030f7c
cmp rax, 1
jne 0x140021cb5
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x140021c5c
nop
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140021c50
cmp rcx, 1
jb 0x140021cb5
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140021c20
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140021d50
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140030d28
int3

Function at 0x140022784
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400227ce
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400227ce
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400227ce
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400227ce
cmp dword [rcx + 0x84], 0xe
jbe 0x1400227ce
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400227d0
xor al, al
add rsp, 0x28
ret
Function at 0x140026af4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140026b63
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140026b63
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140026b63
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140026b63
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140026b63
cmp dword [rcx + 0x84], 0xe
jbe 0x140026b63
cmp dword [rcx + 0xf8], 0
je 0x140026b63
mov ecx, ebx
call fcn.140026c14
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400269f0
nop
cmp dword [rbp + 0x20], 0
je 0x140026bb1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140026bbc
int3
xor r8d, r8d
xor edx, edx
jmp 0x140026af4

Function at 0x140026cf8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140026b63
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140026b63
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140026b63
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140026b63
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140026b63
cmp dword [rcx + 0x84], 0xe
jbe 0x140026b63
cmp dword [rcx + 0xf8], 0
je 0x140026b63
mov ecx, ebx
call fcn.140026c14
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.1400269f0
nop
cmp dword [rbp + 0x20], 0
je 0x140026bb1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140026bbc
int3
xor r8d, r8d
xor edx, edx
jmp 0x140026af4
Function at 0x140038a80
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140038b07
mov rsi, rbx
cmp word [rax], bp
je 0x140038ac6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140038ab0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140038aac
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140033c10
mov rdi, rax
test rax, rax
je 0x140038af4
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14003ee00
mov rbp, rdi
xor ecx, ecx
call fcn.140034b44
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14003b20c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14003b222
mov al, 1
jmp 0x14003b282
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14003b233
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14003b280
mov ecx, dword [rcx + 0x18]
nop
call fcn.140039224
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003b280
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14003b280
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14003b280
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14003b282
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14003ebe0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14003ec08
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14003ec08
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x141d282b0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1250
call fcn.141ec2b10
sub rsp, rax
mov rax, qword [0x141f1bb40]
xor rax, rsp
mov qword [rsp + 0x1240], rax
mov rsi, rcx
lea r8, [rsp + 0x28]
lea rcx, [rsp + 0x30]
mov edx, 0x1000
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x141d28404
mov ebp, dword [rsp + 0x28]
xor ebx, ebx
shr ebp, 2
test ebp, ebp
je 0x141d28404
mov r8d, dword [rsp + rbx*4 + 0x30]
test r8d, r8d
je 0x141d283fa
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x141d283fa
lea r9, [rsp + 0x2c]
mov r8d, 8
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x141d283f1
mov rdx, qword [rsp + 0x20]
lea r8, [rsp + 0x1030]
mov r9d, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x141d283f1
lea rcx, [rsp + 0x1030]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x141d28390
cmp qword [rsi + 0x18], 7
mov r8, rsi
mov rdx, qword [rsi + 0x10]
jbe 0x141d283ab
mov r8, qword [rsi]
cmp rdx, rax
jne 0x141d283f1
lea rax, [rsp + 0x1030]
test rdx, rdx
je 0x141d283e4
lea rcx, [rsp + 0x1030]
sub r8, rcx
nop dword [rax + rax]
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x141d283f1
add rax, 2
sub rdx, 1
jne 0x141d283d0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x141d28406
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, ebp
jb 0x141d28310
xor al, al
mov rcx, qword [rsp + 0x1240]
xor rcx, rsp
call fcn.141ec2250
lea r11, [rsp + 0x1250]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x141d4a290
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbp, rcx
lea r15, [0x141f1e008]
mov qword [rsp + 0x20], r15
mov rax, qword [0x141f1e008]
mov r12d, 1
test rax, rax
jne 0x141d4a2d2
lock cmpxchg qword [0x141f1e008], r12
je 0x141d4a2da
mov rcx, r15
call fcn.141d8d680
mov byte [rsp + 0x28], r12b
xor r14d, r14d
cmp qword [rbp + 0x10], 0x7ffe
jg 0x141d4a302
mov rcx, rbp
call fcn.141d45210
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x141d4a3cf
mov ecx, 0xfffe
call fcn.141ec2af0
mov rsi, rax
mov rdi, r14
mov rax, qword [rbp + 0x10]
test rax, rax
jle 0x141d4a3c6
nop
mov rdx, rax
sub rdx, rdi
mov ebx, 0x7ffe
cmp rdx, rbx
cmovl rbx, rdx
mov r8, qword [rbp + 8]
test r8, r8
cmove r8, r14
mov rcx, rdi
cmp rdi, rax
jg 0x141d4a37e
test rdi, rdi
jns 0x141d4a371
test rbx, rbx
js 0x141d4a365
add rbx, rdi
cmp rbx, rax
jge 0x141d4a365
test rbx, rbx
jle 0x141d4a37e
mov rcx, r14
lea rdx, [r8 + rcx*2]
jmp 0x141d4a393
mov rcx, r14
mov rbx, rax
lea rdx, [r8 + rcx*2]
jmp 0x141d4a393
cmp rbx, rdx
cmova rbx, rdx
lea rdx, [r8 + rcx*2]
jmp 0x141d4a393
xorps xmm1, xmm1
xorps xmm0, xmm0
psrldq xmm0, 8
movq rdx, xmm0
movq rbx, xmm1
test rdx, rdx
je 0x141d4a3a4
lea r8, [rbx + rbx]
mov rcx, rsi
call fcn.141ee8ce0
mov word [rsi + rbx*2], r14w
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rdi, 0x7ffe
mov rax, qword [rbp + 0x10]
cmp rdi, rax
jl 0x141d4a320
mov rcx, rsi
call fcn.141ec2270
nop
mov rax, r12
lock cmpxchg qword [0x141f1e008], r14
je 0x141d4a3e5
mov rcx, r15
call fcn.141d8dc50
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x141d4f1c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, qword [rsp + 0x80]
mov r15, r8
mov qword [rsp + 0x60], rbp
mov r13, r9
mov rsi, rdx
mov qword [rsp + 0x68], rdx
mov r14, rcx
mov r8, rdx
lea rbp, [r15 - 1]
mov r10, rdx
sar rbp, 1
cmp rdx, rbp
jge 0x141d4f2c9
mov qword [rsp + 0x70], rdi
nop dword [rax + rax]
lea rdi, [r10 + r10]
mov rcx, rbx
lea rax, [rdi + 2]
imul rdx, rax, 0x38
add rdx, r14
lea r8, [rdx - 0x38]
call fcn.141d50a30
movzx r10d, al
xor r10, 1
imul rdx, rsi, 0x38
inc r10
add rdx, r14
add r10, rdi
imul r8, r10, 0x38
mov rcx, qword [rdx]
mov rsi, r10
add r8, r14
mov rax, qword [r8]
mov qword [rdx], rax
mov qword [r8], rcx
mov rax, qword [r8 + 8]
mov rcx, qword [rdx + 8]
mov qword [rdx + 8], rax
mov qword [r8 + 8], rcx
mov rax, qword [r8 + 0x10]
mov rcx, qword [rdx + 0x10]
mov qword [rdx + 0x10], rax
mov qword [r8 + 0x10], rcx
mov rax, qword [r8 + 0x18]
mov rcx, qword [rdx + 0x18]
mov qword [rdx + 0x18], rax
mov qword [r8 + 0x18], rcx
mov rax, qword [r8 + 0x20]
mov rcx, qword [rdx + 0x20]
mov qword [rdx + 0x20], rax
mov qword [r8 + 0x20], rcx
mov rax, qword [r8 + 0x28]
mov rcx, qword [rdx + 0x28]
mov qword [rdx + 0x28], rax
mov qword [r8 + 0x28], rcx
mov rax, qword [r8 + 0x30]
mov rcx, qword [rdx + 0x30]
mov qword [rdx + 0x30], rax
mov qword [r8 + 0x30], rcx
cmp r10, rbp
jl 0x141d4f210
mov rdi, qword [rsp + 0x70]
mov r8, qword [rsp + 0x68]
cmp r10, rbp
mov rbp, qword [rsp + 0x60]
jne 0x141d4f361
test r15b, 1
jne 0x141d4f361
imul r9, r15, 0x38
imul rdx, rsi, 0x38
add r9, r14
lea rsi, [r15 - 1]
mov rax, qword [r9 - 0x38]
add rdx, r14
mov rcx, qword [rdx]
mov qword [rdx], rax
mov qword [r9 - 0x38], rcx
mov rax, qword [r9 - 0x30]
mov rcx, qword [rdx + 8]
mov qword [rdx + 8], rax
mov qword [r9 - 0x30], rcx
mov rax, qword [r9 - 0x28]
mov rcx, qword [rdx + 0x10]
mov qword [rdx + 0x10], rax
mov qword [r9 - 0x28], rcx
mov rax, qword [r9 - 0x20]
mov rcx, qword [rdx + 0x18]
mov qword [rdx + 0x18], rax
mov qword [r9 - 0x20], rcx
mov rax, qword [r9 - 0x18]
mov rcx, qword [rdx + 0x20]
mov qword [rdx + 0x20], rax
mov qword [r9 - 0x18], rcx
mov rax, qword [r9 - 0x10]
mov rcx, qword [rdx + 0x28]
mov qword [rdx + 0x28], rax
mov qword [r9 - 0x10], rcx
mov rax, qword [r9 - 8]
mov rcx, qword [rdx + 0x30]
mov qword [rdx + 0x30], rax
mov qword [r9 - 8], rcx
mov r9, r13
mov qword [rsp + 0x80], rbx
mov rdx, rsi
mov rcx, r14
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rsi
jmp fcn.141d4f390
Function at 0x141d7e840
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r9d, r9d
mov r10, rcx
sub r10, r8
mov r11d, r9d
cmp rdx, 0x20
jb 0x141d7e8c3
mov qword [rsp + 0x10], rbx
lea rbx, [r8 + 0x10]
mov qword [rsp], rdi
mov edi, 0x10
sub rdi, r8
nop dword [rax + rax]
movdqu xmm0, xmmword [rbx + r10 - 0x10]
add r11, 0x20
movdqu xmm2, xmmword [rbx + r10]
lea rbx, [rbx + 0x20]
movdqa xmm1, xmm0
lea rax, [rdi + rbx]
psrlw xmm0, 8
psllw xmm1, 8
xorps xmm1, xmm0
movdqa xmm0, xmm2
psllw xmm0, 8
psrlw xmm2, 8
xorps xmm0, xmm2
movdqu xmmword [rbx - 0x20], xmm0
movdqu xmmword [rbx - 0x30], xmm1
cmp rax, rdx
jbe 0x141d7e870
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
lea rax, [r11 + 0x10]
cmp rax, rdx
ja 0x141d7e8ec
movdqu xmm0, xmmword [r11 + rcx]
movdqa xmm1, xmm0
psrlw xmm0, 8
psllw xmm1, 8
xorps xmm1, xmm0
movdqu xmmword [r11 + r8], xmm1
mov r11, rax
cmp r11, rdx
jae 0x141d7e91a
lea rax, [r11 + r8]
cmp r9, 0x10
jae 0x141d7e91a
movzx ecx, word [r10 + rax]
add r9, 2
ror cx, 8
mov word [rax], cx
add rax, 2
mov rcx, rax
sub rcx, r8
cmp rcx, rdx
jb 0x141d7e8f5
mov rax, rdx
add rsp, 8
ret

Function at 0x141dacda0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rsi, r8
mov r15, rdx
mov rbp, rcx
mov r12, qword [rcx + 0x28]
test r8, r8
js 0x141dacef4
xor ebx, ebx
cmp qword [rcx + 0xa8], rbx
je 0x141dace66
nop dword [rax + rax]
mov r8, rsi
sub r8, rbx
lea rcx, [rbx + r15]
mov r9, qword [rbp + 0xa8]
mov edx, 1
call fcn.141ed1374
mov rdi, rax
mov rcx, qword [rbp + 0xa8]
call fcn.141ed0fe4
test eax, eax
setne r14b
test eax, eax
je 0x141dace19
test rdi, rdi
je 0x141dace46
add rbx, rdi
test eax, eax
jne 0x141dacea8
test rdi, rdi
jne 0x141dace38
call fcn.141ed0e2c
xor ecx, ecx
cmp dword [rax], 4
sete cl
jmp 0x141dace40
xor ecx, ecx
cmp rbx, rsi
setl cl
test ecx, ecx
jne 0x141dacde0
jmp 0x141dacea8
mov rcx, qword [rbp + 0xa8]
call fcn.141ecd404
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rbp + 0xa8]
call fcn.141ed1644
jmp 0x141dacea8
cmp dword [rcx + 0xd0], 0xffffffff
je 0x141daceba
nop
mov rax, rsi
sub rax, rbx
mov r8d, 0x7fffffff
cmp rax, r8
cmovb r8d, eax
lea rdx, [rbx + r15]
mov ecx, dword [rbp + 0xd0]
call fcn.141ed20d0
movsxd rcx, eax
test eax, eax
jle 0x141dacea1
add rbx, rcx
cmp rbx, rsi
jl 0x141dace70
cmp ecx, 0xffffffff
setne r14b
test r14b, r14b
jne 0x141dacf3b
test rbx, rbx
jne 0x141dacf3b
mov rbx, 0xffffffffffffffff
mov edx, ebx
lea rcx, [rsp + 0x20]
call fcn.141d8c460
nop
mov r8, rax
mov edx, 1
mov rcx, r12
call fcn.141daa810
nop
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x141dacf3b
mov ecx, ebx
lock xadd dword [rax], ecx
cmp ecx, 1
jmp 0x141dacf2f
mov edx, 0x16
lea rcx, [rsp + 0x20]
call fcn.141d8c460
nop
mov r8, rax
mov edx, 1
mov rcx, r12
call fcn.141daa810
nop
mov rbx, 0xffffffffffffffff
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x141dacf3b
mov eax, ebx
lock xadd dword [rcx], eax
cmp eax, 1
jne 0x141dacf3b
mov rcx, qword [rsp + 0x20]
call fcn.141ec82c8
mov rax, rbx
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret