joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140056240
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r12d, r9d
mov r15, r8
mov r14d, edx
mov rbp, rcx
call fcn.140023eb0
mov rdi, rax
mov ecx, 0x20
call fcn.140068fd8
mov rbx, rax
mov qword [rsp + 0x30], 0x17
mov qword [rsp + 0x38], 0x1f
movups xmm0, xmmword [str.NtSetInformationProcess]
movups xmmword [rax], xmm0
mov ecx, dword [0x1400b34f8]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x1400b34fc]
mov word [rax + 0x14], cx
movzx ecx, byte [0x1400b34fe]
mov byte [rax + 0x16], cl
mov byte [rax + 0x17], 0
mov qword [rsp + 0x20], rax
call fcn.140045b80
lea rsi, [rdi + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
movabs rdx, 0x100000001b3
movabs r9, 0xcbf29ce484222325
nop dword [rax + rax]
movzx eax, byte [rcx + rbx]
xor r9, rax
imul r9, rdx
inc rcx
cmp rcx, 0x17
jb 0x1400562e0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400252e0
mov r10, qword [rax + 8]
test r10, r10
je 0x14005633a
cmp r10, qword [rdi + 8]
je 0x14005633a
mov rdi, qword [r10 + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x140056343
mov r9d, r12d
mov r8, r15
mov edx, r14d
mov rcx, qword [rbp + 8]
call rdi
mov edi, eax
jmp 0x140056348
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, 0xc0000138
mov edx, 0x20
mov rcx, rbx
call fcn.140068fd0
mov eax, edi
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140056370
Capabilities:
Create thread
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
mov r13, r9
mov r12, r8
mov r14, rdx
mov qword [rsp + 0x60], rcx
call fcn.140023eb0
mov r15, rax
mov ecx, 0x20
call fcn.140068fd8
mov rdi, rax
mov qword [rsp + 0x78], 0x10
mov qword [rsp + 0x80], 0x1f
movups xmm0, xmmword [str.NtCreateThreadEx]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0
mov qword [rsp + 0x68], rax
call fcn.140045b80
lea rcx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
movabs r9, 0xcbf29ce484222325
mov ecx, ebx
movabs rdx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rdi]
xor r9, rax
imul r9, rdx
inc rcx
cmp rcx, 0x10
jb 0x140056400
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x88]
mov rcx, r15
call fcn.1400252e0
mov rsi, qword [rax + 8]
test rsi, rsi
je 0x140056448
cmp rsi, qword [r15 + 8]
je 0x140056448
mov rsi, qword [rsi + 0x30]
lea rcx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140056455
lea rcx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rsi, rbx
mov edx, 0x20
mov rcx, rdi
call fcn.140068fd0
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax + 8]
mov eax, dword [rsp + 0x110]
xor r8d, r8d
test rsi, rsi
je 0x1400564bc
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], 0x100000
mov qword [rsp + 0x40], 0x1000
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
mov r9, rcx
mov edx, dword [rsp + 0x118]
mov rcx, r14
call rsi
test eax, eax
jns 0x1400564f4
mov qword [r14], rbx
jmp 0x1400564f4
and eax, 1
shl eax, 2
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
mov r9, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [r14], rax
test rax, rax
jne 0x1400564f2
mov rax, qword gs:[0x30]
mov ebx, dword [rax + 0x1250]
mov eax, ebx
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140056540
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov r15, r8
mov r14, rdx
cmp byte [rcx + 0x15], 0
jne 0x140056563
xor eax, eax
jmp 0x140056660
call fcn.140023eb0
mov rsi, rax
mov ecx, 0x20
call fcn.140068fd8
mov rbx, rax
mov qword [rsp + 0x30], 0x15
mov qword [rsp + 0x38], 0x1f
movups xmm0, xmmword [str.Wow64GetThreadContext]
movups xmmword [rax], xmm0
mov ecx, dword [0x1400b3620]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x1400b3624]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], 0
mov qword [rsp + 0x20], rax
call fcn.140045b80
lea rbp, [rsi + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
movabs r9, 0xcbf29ce484222325
mov ecx, edi
movabs rdx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rbx]
xor r9, rax
imul r9, rdx
inc rcx
cmp rcx, 0x15
jb 0x1400565e0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400252e0
mov r8, qword [rax + 8]
test r8, r8
je 0x140056633
cmp r8, qword [rsi + 8]
je 0x140056633
mov rsi, qword [r8 + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rsi, rsi
je 0x14005663c
mov rdx, r15
mov rcx, r14
call rsi
mov esi, eax
jmp 0x14005663e
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, edi
mov edx, 0x20
mov rcx, rbx
call fcn.140068fd0
test esi, esi
jne 0x14005665e
mov rax, qword gs:[0x30]
mov edi, dword [rax + 0x1250]
mov eax, edi
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400566b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov r15, r8
mov r14, rdx
cmp byte [rcx + 0x15], 0
jne 0x1400566d3
xor eax, eax
jmp 0x1400567d0
call fcn.140023eb0
mov rsi, rax
mov ecx, 0x20
call fcn.140068fd8
mov rbx, rax
mov qword [rsp + 0x30], 0x15
mov qword [rsp + 0x38], 0x1f
movups xmm0, xmmword [str.Wow64SetThreadContext]
movups xmmword [rax], xmm0
mov ecx, dword [0x1400b3670]
mov dword [rax + 0x10], ecx
movzx ecx, byte [0x1400b3674]
mov byte [rax + 0x14], cl
mov byte [rax + 0x15], 0
mov qword [rsp + 0x20], rax
call fcn.140045b80
lea rbp, [rsi + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edi, edi
movabs r9, 0xcbf29ce484222325
mov ecx, edi
movabs rdx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rbx]
xor r9, rax
imul r9, rdx
inc rcx
cmp rcx, 0x15
jb 0x140056750
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.1400252e0
mov r8, qword [rax + 8]
test r8, r8
je 0x1400567a3
cmp r8, qword [rsi + 8]
je 0x1400567a3
mov rsi, qword [r8 + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rsi, rsi
je 0x1400567ac
mov rdx, r15
mov rcx, r14
call rsi
mov esi, eax
jmp 0x1400567ae
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, edi
mov edx, 0x20
mov rcx, rbx
call fcn.140068fd0
test esi, esi
jne 0x1400567ce
mov rax, qword gs:[0x30]
mov edi, dword [rax + 0x1250]
mov eax, edi
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400567f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov r15, r9
mov r14, r8
mov rbp, rdx
cmp dword [rcx + 0x10], 3
jne 0x140056905
call fcn.140023eb0
mov rbx, rax
mov ecx, 0x20
call fcn.140068fd8
mov rdi, rax
mov qword [rsp + 0x40], 0x16
mov qword [rsp + 0x48], 0x1f
movups xmm0, xmmword [str.RtlQueueApcWow64Thread]
movups xmmword [rax], xmm0
mov ecx, dword [0x1400b35a8]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x1400b35ac]
mov word [rax + 0x14], cx
mov byte [rax + 0x16], 0
mov qword [rsp + 0x30], rax
call fcn.140045b80
lea rsi, [rbx + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
movabs rdx, 0x100000001b3
movabs r9, 0xcbf29ce484222325
nop dword [rax]
movzx eax, byte [rcx + rdi]
xor r9, rax
imul r9, rdx
inc rcx
cmp rcx, 0x16
jb 0x140056890
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400252e0
mov r9, qword [rax + 8]
test r9, r9
je 0x1400568f2
cmp r9, qword [rbx + 8]
je 0x1400568f2
mov rbx, qword [r9 + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x1400568fb
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, r15
mov rdx, r14
mov rcx, rbp
call rbx
mov ebx, eax
jmp 0x140056900
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
jmp 0x1400569e0
call fcn.140023eb0
mov rbx, rax
mov ecx, 0x20
call fcn.140068fd8
mov rdi, rax
mov qword [rsp + 0x40], 0x10
mov qword [rsp + 0x48], 0x1f
movups xmm0, xmmword [str.NtQueueApcThread]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0
mov qword [rsp + 0x30], rax
call fcn.140045b80
lea rsi, [rbx + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
movabs rdx, 0x100000001b3
movabs r9, 0xcbf29ce484222325
nop word [rax + rax]
movzx eax, byte [rcx + rdi]
xor r9, rax
imul r9, rdx
inc rcx
cmp rcx, 0x10
jb 0x140056970
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400252e0
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400569d2
cmp rdx, qword [rbx + 8]
je 0x1400569d2
mov rbx, qword [rdx + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x1400569db
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, r15
mov rdx, r14
mov rcx, rbp
call rbx
mov ebx, eax
jmp 0x1400569e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
mov edx, 0x20
mov rcx, rdi
call fcn.140068fd0
mov eax, ebx
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140056a10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x1400c50b0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbp, rdx
mov rsi, rcx
xor r15d, r15d
mov dword [rsp + 0x30], r15d
cmp byte [rcx + 0x15], r15b
jne 0x140056a4d
xor eax, eax
jmp 0x140056b8f
mov qword [rsp + 0x68], r15
call fcn.140023eb0
mov rdi, rax
mov ecx, 0x20
call fcn.140068fd8
mov rbx, rax
mov qword [rsp + 0x48], 0x19
mov qword [rsp + 0x50], 0x1f
movups xmm0, xmmword [str.NtQueryInformationProcess]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x1400b34a0]
movsd qword [rax + 0x10], xmm1
movzx ecx, byte [0x1400b34a8]
mov byte [rax + 0x18], cl
mov byte [rax + 0x19], r15b
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
call fcn.140045b80
lea r14, [rdi + 0x40]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movabs r9, 0xcbf29ce484222325
mov rcx, r15
movabs rdx, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + rbx]
xor r9, rax
imul r9, rdx
inc rcx
cmp rcx, 0x19
jb 0x140056ae0
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.1400252e0
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140056b4f
cmp rcx, qword [rdi + 8]
je 0x140056b4f
mov rdi, qword [rcx + 0x30]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x140056b58
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [rsp + 0x68]
lea edx, [r9 + 0x12]
mov rcx, qword [rsi + 8]
call rdi
test eax, eax
js 0x140056b58
test rbp, rbp
je 0x140056b58
mov dil, 1
jmp 0x140056b5b
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor dil, dil
mov edx, 0x20
mov rcx, rbx
call fcn.140068fd0
test dil, dil
je 0x140056b8a
mov qword [rsp + 0x20], r15
mov r9d, 0x250
mov r8, rbp
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140068fb0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140056bc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x1400c50b0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbp, rdx
mov r14, rcx
mov dword [rsp + 0x30], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [r11 - 0x40], xmm0
mov dword [r11 - 0x30], 0
call fcn.140023eb0
mov rdi, rax
mov ecx, 0x20
call fcn.140068fd8
mov rbx, rax
mov qword [rsp + 0x48], 0x19
mov qword [rsp + 0x50], 0x1f
movups xmm0, xmmword [str.NtQueryInformationProcess]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x1400b34a0]
movsd qword [rax + 0x10], xmm1
movzx ecx, byte [0x1400b34a8]
mov byte [rax + 0x18], cl
mov byte [rax + 0x19], 0
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
call fcn.140045b80
lea rsi, [rdi + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
movabs rdx, 0x100000001b3
movabs r9, 0xcbf29ce484222325
movzx eax, byte [rcx + rbx]
xor r9, rax
imul r9, rdx
inc rcx
cmp rcx, 0x19
jb 0x140056c91
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.1400252e0
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140056d06
cmp rcx, qword [rdi + 8]
je 0x140056d06
mov rdi, qword [rcx + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x140056d0f
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, qword [r14 + 8]
call rdi
test eax, eax
js 0x140056d0f
test rbp, rbp
je 0x140056d0f
mov dil, 1
jmp 0x140056d12
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor dil, dil
mov edx, 0x20
mov rcx, rbx
call fcn.140068fd0
test dil, dil
je 0x140056d45
mov qword [rsp + 0x20], 0
mov r9d, 0x388
mov r8, rbp
mov rdx, qword [rsp + 0x70]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140068fb0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140056d80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1400c50b0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rsi, r8
mov r15, rdx
mov r14, rcx
mov dword [rsp + 0x30], 0
cmp byte [rcx + 0x15], 0
jne 0x140056dc3
xor eax, eax
jmp 0x140056f25
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x88], xmm0
mov dword [rsp + 0x98], 0
call fcn.140023eb0
mov rdi, rax
mov ecx, 0x20
call fcn.140068fd8
mov rbx, rax
mov qword [rsp + 0x48], 0x18
mov qword [rsp + 0x50], 0x1f
movups xmm0, xmmword [str.NtQueryInformationThread]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x1400b34d8]
movsd qword [rax + 0x10], xmm1
mov byte [rax + 0x18], 0
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
call fcn.140045b80
lea rbp, [rdi + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
movabs rdx, 0x100000001b3
movabs r9, 0xcbf29ce484222325
nop word [rax + rax]
movzx eax, byte [rcx + rbx]
xor r9, rax
imul r9, rdx
inc rcx
cmp rcx, 0x18
jb 0x140056e60
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.1400252e0
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140056ed4
cmp rcx, qword [rdi + 8]
je 0x140056ed4
mov rdi, qword [rcx + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x140056edd
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, r15
call rdi
test eax, eax
js 0x140056edd
test rsi, rsi
je 0x140056edd
mov dil, 1
jmp 0x140056ee0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor dil, dil
mov edx, 0x20
mov rcx, rbx
call fcn.140068fd0
test dil, dil
je 0x140056f1a
mov rdx, qword [rsp + 0x70]
add rdx, 0x2000
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, rsi
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x70]
add rax, 0x2000
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140068fb0
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140056f50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1400c50b0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbp, r8
mov r15, rdx
mov r14, rcx
mov dword [rsp + 0x30], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [r11 - 0x50], xmm0
mov dword [r11 - 0x40], 0
call fcn.140023eb0
mov rdi, rax
mov ecx, 0x20
call fcn.140068fd8
mov rbx, rax
mov qword [rsp + 0x48], 0x18
mov qword [rsp + 0x50], 0x1f
movups xmm0, xmmword [str.NtQueryInformationThread]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x1400b34d8]
movsd qword [rax + 0x10], xmm1
mov byte [rax + 0x18], 0
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 1
call fcn.140045b80
lea rsi, [rdi + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ecx, ecx
movabs rdx, 0x100000001b3
movabs r9, 0xcbf29ce484222325
nop dword [rax]
movzx eax, byte [rcx + rbx]
xor r9, rax
imul r9, rdx
inc rcx
cmp rcx, 0x18
jb 0x140057020
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.1400252e0
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140057094
cmp rcx, qword [rdi + 8]
je 0x140057094
mov rdi, qword [rcx + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x14005709d
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, r15
call rdi
test eax, eax
js 0x14005709d
test rbp, rbp
je 0x14005709d
mov dil, 1
jmp 0x1400570a0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor dil, dil
mov edx, 0x20
mov rcx, rbx
call fcn.140068fd0
test dil, dil
je 0x1400570d3
mov qword [rsp + 0x20], 0
mov r9d, 0x1838
mov r8, rbp
mov rdx, qword [rsp + 0x70]
mov rcx, qword [r14 + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140068fb0
mov rbx, qword [rsp + 0xf8]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400613d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x1400c50b0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], r9
mov r12, r8
mov rsi, rdx
mov r13, rcx
mov rax, qword [rsp + 0xf0]
xor ebx, ebx
mov qword [rsp + 0x68], rbx
lea r14, [rsp + 0x68]
test rax, rax
cmovne r14, rax
cmp byte [rcx + 0x15], bl
je 0x14006145c
cmp rdx, 0x7fffffff
jae 0x14006145c
mov rax, qword gs:[0x30]
mov dword [rax + 0x1250], ebx
mov qword [rsp + 0x20], r14
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
jmp 0x140061550
call fcn.140023eb0
mov r15, rax
mov ecx, 0x20
call fcn.140068fd8
mov rdi, rax
mov qword [rsp + 0x48], 0x1a
mov qword [rsp + 0x50], 0x1f
movups xmm0, xmmword [str.NtWow64ReadVirtualMemory64]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x1400b35d8]
movsd qword [rax + 0x10], xmm1
movzx ecx, word [0x1400b35e0]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], bl
mov qword [rsp + 0x38], rax
call fcn.140045b80
lea rcx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movabs rcx, 0x100000001b3
movabs r9, 0xcbf29ce484222325
movzx eax, byte [rbx + rdi]
xor r9, rax
imul r9, rcx
inc rbx
cmp rbx, 0x1a
jb 0x1400614d0
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, r15
call fcn.1400252e0
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140061532
cmp rdx, qword [r15 + 8]
je 0x140061532
mov rbx, qword [rdx + 0x30]
lea rcx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14006153c
mov qword [rsp + 0x20], r14
mov r9, qword [rsp + 0x30]
mov r8, r12
mov rdx, rsi
mov rcx, qword [r13 + 8]
call rbx
mov ebx, eax
jmp 0x140061541
lea rcx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
mov edx, 0x20
mov rcx, rdi
call fcn.140068fd0
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140068fb0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140061580
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x1400c50b0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x30], r9
mov r12, r8
mov rsi, rdx
mov r15, rcx
mov rax, qword [rsp + 0xf0]
xor ebx, ebx
mov qword [rsp + 0x68], rbx
lea r14, [rsp + 0x68]
test rax, rax
cmovne r14, rax
cmp byte [rcx + 0x15], bl
je 0x14006160c
cmp rdx, 0x7fffffff
jae 0x14006160c
mov rax, qword gs:[0x30]
mov dword [rax + 0x1250], ebx
mov qword [rsp + 0x20], r14
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
jmp 0x140061710
call fcn.140023eb0
mov r13, rax
mov ecx, 0x20
call fcn.140068fd8
mov rdi, rax
mov qword [rsp + 0x48], 0x1b
mov qword [rsp + 0x50], 0x1f
movups xmm0, xmmword [str.NtWow64WriteVirtualMemory64]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x1400b3638]
movsd qword [rax + 0x10], xmm1
movzx ecx, word [0x1400b3640]
mov word [rax + 0x18], cx
movzx ecx, byte [0x1400b3642]
mov byte [rax + 0x1a], cl
mov byte [rax + 0x1b], bl
mov qword [rsp + 0x38], rax
call fcn.140045b80
lea rcx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movabs rcx, 0x100000001b3
movabs r9, 0xcbf29ce484222325
nop word [rax + rax]
movzx eax, byte [rbx + rdi]
xor r9, rax
imul r9, rcx
inc rbx
cmp rbx, 0x1b
jb 0x140061690
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, r13
call fcn.1400252e0
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400616f2
cmp rdx, qword [r13 + 8]
je 0x1400616f2
mov rbx, qword [rdx + 0x30]
lea rcx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x1400616fc
mov qword [rsp + 0x20], r14
mov r9, qword [rsp + 0x30]
mov r8, r12
mov rdx, rsi
mov rcx, qword [r15 + 8]
call rbx
mov ebx, eax
jmp 0x140061701
lea rcx, [r13 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
mov edx, 0x20
mov rcx, rdi
call fcn.140068fd0
mov eax, ebx
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140068fb0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret