joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140076f74
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1400aa180]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, r8
mov rdi, rdx
mov ecx, dword [0x1400b1d40]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x1400b16f0], ecx
jg 0x140077056
mov eax, ebx
cmp rbx, rax
jne 0x140077018
xor ecx, ecx
test rbx, rbx
setne cl
xor eax, eax
test ebx, ebx
setne al
cmp ecx, eax
jne 0x140077018
xor r9d, r9d
mov r8d, ebx
mov rdx, rdi
mov rcx, qword [0x1400b16e8]
call sub.bcrypt.dll_BCryptGenRandom
test eax, eax
js 0x140077099
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14007ee90
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x20]
call fcn.14002acc0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140076ca4
lea rdx, [0x1400a67c0]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea rcx, [0x1400b16f0]
call fcn.14007ef58
cmp dword [0x1400b16f0], 0xffffffff
jne 0x140076fc0
lea rcx, [0x1400b16e8]
call fcn.140076bb8
lea rcx, [0x1400834ec]
call fcn.14007f2c8
nop
lea rcx, [0x1400b16f0]
call fcn.14007eeec
jmp 0x140076fc0
mov ecx, eax
call fcn.1400770dc
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, [0x14008c5f8]
lea rcx, [rsp + 0x20]
call fcn.14002acc0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140076ca4
lea rdx, [0x1400a67c0]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll__CxxThrowException
int3

Function at 0x140078798
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor r14d, r14d
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp r8, 8
jb 0x14007880b
mov rbp, r8
shr rbp, 3
imul rax, rbp, 0xfffffffffffffff8
add rdi, rax
mov r8d, 8
lea rcx, [rsp + 0x58]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 8
lea rcx, [rsp + 0x50]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x50]
add rsi, 8
xor rax, qword [rsp + 0x58]
add rbx, 8
or r14, rax
sub rbp, 1
jne 0x1400787ca
mov rcx, r14
shr rcx, 0x20
or ecx, r14d
mov edx, ecx
mov eax, ecx
shr edx, 8
or edx, ecx
shr eax, 0x10
and edx, 0xff00
or edx, eax
movzx eax, cl
shr edx, 8
or edx, eax
test rdi, rdi
je 0x14007884d
sub rsi, rbx
movzx ecx, byte [rsi + rbx]
movzx eax, byte [rbx]
inc rbx
xor ecx, eax
or edx, ecx
sub rdi, 1
jne 0x140078839
mov rbx, qword [rsp + 0x40]
test edx, edx
mov rbp, qword [rsp + 0x48]
sete al
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140078868
Capabilities:
Encode data using xor

Disassembly:
test r9, r9
je 0x14007892e
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rbx, r9
mov r15d, 4
mov rdi, r8
mov rsi, rdx
mov r14, rcx
cmp rbx, r15
jb 0x1400788f9
mov rbp, rbx
shr rbp, 2
imul rax, rbp, 0xfffffffffffffffc
add rbx, rax
mov r8, r15
lea rcx, [rsp + 0x20]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r15
lea rcx, [rsp + 0x68]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x68]
lea rdx, [rsp + 0x24]
xor eax, dword [rsp + 0x20]
mov r8, r15
mov rcx, r14
mov dword [rsp + 0x24], eax
call sub.VCRUNTIME140.dll_memcpy
add r14, r15
add rsi, r15
add rdi, r15
sub rbp, 1
jne 0x1400788ae
test rbx, rbx
je 0x140078916
sub rsi, rdi
sub r14, rdi
mov al, byte [rsi + rdi]
xor al, byte [rdi]
mov byte [r14 + rdi], al
inc rdi
sub rbx, 1
jne 0x140078904
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x140078930
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400789dd
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, r8
mov r14d, 4
mov rsi, rdx
mov rdi, rcx
cmp rbx, r14
jb 0x1400789b5
mov rbp, rbx
shr rbp, 2
imul rax, rbp, 0xfffffffffffffffc
add rbx, rax
mov r8, r14
lea rcx, [rsp + 0x68]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8, r14
lea rcx, [rsp + 0x60]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x60]
lea rdx, [rsp + 0x20]
xor eax, dword [rsp + 0x68]
mov r8, r14
mov rcx, rdi
mov dword [rsp + 0x20], eax
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
add rsi, r14
sub rbp, 1
jne 0x14007896d
test rbx, rbx
je 0x1400789cb
sub rsi, rdi
mov al, byte [rsi + rdi]
xor byte [rdi], al
inc rdi
sub rbx, 1
jne 0x1400789bd
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14007ea90
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm1, xmmword [rcx]
mov r9d, 4
shl edx, 2
mov r8, rcx
movdqu xmm0, xmmword [rcx + rdx*4]
movdqu xmmword [rcx], xmm0
movdqu xmmword [rcx + rdx*4], xmm1
add edx, 0xfffffffc
cmp edx, r9d
jbe 0x14007eadf
aesimc xmm0, xmmword [r8 + rdx*4]
mov ecx, r9d
add r9d, 4
aesimc xmm1, xmmword [r8 + rcx*4]
movdqu xmmword [r8 + rcx*4], xmm0
movdqu xmmword [r8 + rdx*4], xmm1
add edx, 0xfffffffc
cmp r9d, edx
jb 0x14007eab6
mov eax, r9d
aesimc xmm0, xmmword [r8 + rax*4]
movdqu xmmword [r8 + rax*4], xmm0
ret

Function at 0x14007fd6c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14007fdb6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14007fdb6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14007fdb6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14007fdb6
cmp dword [rcx + 0x84], 0xe
jbe 0x14007fdb6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14007fdb8
xor al, al
add rsp, 0x28
ret
Function at 0x14040c5cb
Capabilities:
Check for software breakpoints

Disassembly:
push rdi
movabs rdi, 0x8c1776054cf278d
pushfq
sub di, 0x1a67
jle 0x14040c5c6
mov qword [rsp + 0x10], 0xffffffffe7e0b103
and dil, 0
mov di, 0xd4b
neg dil
add dil, 0xf7
or edi, 0x1463362f
and di, 0x65fb
mov rdi, qword [rsp + 8]
jge 0x1407a5044
call fcn.1403eced1
mov rdx, qword [rsp + 0x20]
je 0x14040c5e6
jns 0x14040c5d6
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x30]
call fcn.14088b0c6
call fcn.1403b4bd0
call fcn.1408503e1

Function at 0x1408ce87c
Capabilities:
Execute anti-debugging instructions

Disassembly:
push r9
jmp 0x1408a47d5
add r11, rax
jmp 0x140982a83
pushfq
cmc
push r14
jmp 0x140958e5a
push r13
jmp 0x14088f970
movsxd rax, eax
cmp bpl, 0xc5
jmp 0x1408a26d4
push rax
movsx eax, r8w
push r11
push r8
push rdi
push rcx
push rbp
bt r8d, edx
ror r11d, 0x7f
push r12
xchg al, al
bt r8w, 0xea
movsxd r11, r13d
push r10
push r15
push rbx
push rsi
bt r10w, r10w
push rdx
movzx eax, ax
bt rdx, r9
movabs r10, 0
rcl r8b, 0x1d
push r10
rcl dh, cl
mov rdi, qword [rsp + 0x90]
cdqe
rol edi, 1
sub edi, 0x2ae4747b
movzx rdx, bx
rdtsc
cdqe
ror edi, 2
movsx rax, bx
dec edi
movzx r8w, r14b
and r11b, r9b
sal dx, 0x21
not edi
bts r11, r12
sub r11b, 0x48
rdtsc
add rdi, r10
cmp dl, r12b
movabs rdx, 0x100000000
shl r11b, 0x37
rcl al, 0x13
mov bh, 0xad
add rdi, rdx
mov r8, rsp
sub rsp, 0x180
and rsp, 0xfffffffffffffff0
cmp sil, r15b
movzx ebx, r15w
bts r11, r13
mov rbx, rdi
movabs rdx, 0
rcl r11w, cl
sub rbx, rdx
cmova eax, ecx
test r8b, r12b
shl r11w, cl
lea r11, [0x140958f32]
bsf rax, rbp
mov al, r15b
cmovb rax, rsp
sub rdi, 4
mov eax, dword [rdi]
cmc
test r10b, cl
clc
xor eax, ebx
cmp dl, cl
cmc
sub eax, 0x5aa57603
rol eax, 1
not eax
stc
cmc
add eax, 0x5fb1f74
clc
push rbx
xor dword [rsp], eax
pop rbx
test rbp, 0x53d82dd4
jmp 0x1408d4657
push r11
ret
Function at 0x14000a820
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400151e0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400151e0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x14000a890
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x1401160a4]
mov rbx, rcx
test esi, esi
jle 0x14000a9c0
mov rax, qword [0x1401160a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000a8db
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x14000a965
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x14000a8c0
mov rcx, rbx
call fcn.14000b300
mov rdi, rax
test rax, rax
je 0x14000a9e2
mov rax, qword [0x1401160a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.14000b440
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1401160a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000a9c7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x14000a95e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x14000a970
add dword [0x1401160a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1401160a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000a95e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.14000a820
nop dword [rax]
xor esi, esi
jmp 0x14000a8e8
mov rax, qword [0x1401160a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.14000a820
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.14000a820
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x14000af70
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140116100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1401160e0]
test rbx, rbx
je 0x14000afcc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x14000afc3
test eax, eax
jne 0x14000afc3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14000afa8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x14000b300
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400f02c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14000b320
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14000b328
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14000b320
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000b37d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000b374
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14000b320
add rax, 0x28
cmp rax, r9
jne 0x14000b360
xor eax, eax
ret

Function at 0x14000b380
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400f02c0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000b39f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14000b3a8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000b39f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x14000b440
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400f02c0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000b45f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14000b468
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140015b20
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov dword [rsp + 0x78], edx
mov rdi, rcx
mov rbx, r8
mov rsi, r9
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x38]
mov r9d, 0x18
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140015c18
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov edx, 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140015c18
xor r9d, r9d
mov rcx, qword [rsp + 0x40]
mov r8d, esi
mov rdx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x140015c18
lea rax, [rsp + 0x48]
xor r9d, r9d
mov r8, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov edx, 0x6610
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x140015c18
lea rax, [rsp + 0x78]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x140015c18
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
mov eax, 0xffffffff
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
Function at 0x1400788a0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sub.msvcrt.dll__fileno_1
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sub.msvcrt.dll__read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x1400788e8
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x1400788ba
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400b3170
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1400b8160]
jmp 0x14000c150

Function at 0x1400b3180
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
lea rcx, [0x1400b8160]
jmp 0x14000c150

Function at 0x1400b3630
Capabilities:
Create thread
Inject thread

Disassembly:
push rdi
push rsi
push rbx
add rsp, 0xffffffffffffff80
lea rsi, [0x1400b81a0]
call fcn.14000a610
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0x31050
call rbx
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea r9, [rsp + 0x70]
mov dword [rsp + 0x28], 4
mov rcx, rax
mov dword [rsp + 0x20], 0x3000
call sub.ntdll.dll_NtAllocateVirtualMemory
call fcn.140015cb0
mov edx, dword [0x1400b8180]
mov r9d, 0x10
mov rcx, rsi
lea r8, [0x1400e9200]
call fcn.140015b20
mov rdi, qword [rsp + 0x68]
call rbx
mov r9d, 0x31050
mov r8, rsi
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, rdi
call sub.ntdll.dll_NtWriteVirtualMemory
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x64]
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400b3778
call fcn.140015cb0
mov rsi, qword [rsp + 0x68]
call rbx
lea rcx, [rsp + 0x78]
xor r8d, r8d
mov edx, 0x1fffff
mov qword [rsp + 0x50], 0
mov r9, rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rsi
call sub.ntdll.dll_NtCreateThreadEx
call fcn.140015cb0
mov rcx, qword [rsp + 0x78]
xor r8d, r8d
xor edx, edx
call sub.ntdll.dll_NtWaitForSingleObject
call fcn.140015cb0
mov rcx, qword [rsp + 0x78]
call sub.ntdll.dll_NtClose
xor eax, eax
sub rsp, 0xffffffffffffff80
pop rbx
pop rsi
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.VirtualProtect_failed_with_error_code:__lx_n
mov edx, eax
call fcn.140015ad0
or eax, 0xffffffff
jmp 0x1400b3770
Function at 0x140004620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x1400046a0
cmp r11, r10
ja 0x140004717
cmp r10, rdx
ja 0x140004729
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x1400046a2
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140004680
jmp 0x140004704
ja 0x1400046aa
mov r11, r10
cmp rax, r8
jne 0x14000464e
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x1400046e0
mov rdi, r8
sub ecx, edx
jns 0x1400046fb
jmp 0x140004706
cmp r8, rsi
je 0x140004738
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140004706
xor al, 1
cmp rdi, rsi
jne 0x1400046c0
jmp 0x140004706
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14002df40
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14002dc60
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.14002dfb0
int3
Function at 0x1400097e8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx]
mov r8d, 1
jmp 0x1400134e4
Function at 0x140009889
Capabilities:
Encrypt data using aes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
mov byte [rdx + 0xf0], 0xe
call fcn.140009b84
mov dword [rsi], eax
lea rcx, [rdi + 4]
call fcn.140009b84
mov dword [rsi + 4], eax
lea rcx, [rdi + 8]
call fcn.140009b84
mov dword [rsi + 8], eax
lea rcx, [rdi + 0xc]
call fcn.140009b84
mov dword [rsi + 0xc], eax
lea rcx, [rdi + 0x10]
call fcn.140009b84
mov dword [rsi + 0x10], eax
lea rcx, [rdi + 0x14]
call fcn.140009b84
mov dword [rsi + 0x14], eax
lea rcx, [rdi + 0x18]
call fcn.140009b84
mov dword [rsi + 0x18], eax
add rdi, 0x1c
mov rcx, rdi
call fcn.140009b84
mov dword [rsi + 0x1c], eax
mov eax, 0x3c
xor ebx, ebx
lea r14, [0x1409acc20]
mov ebp, 0xff
lea r15, [0x1409ad020]
lea r12, [0x1409ad420]
lea r13, [0x1409ad820]
lea rdi, [0x1409adc20]
cmp rax, 7
jbe 0x140009ac7
cmp rax, 8
je 0x140009adb
mov ecx, dword [rsi + 0x1c]
mov edx, ecx
shr edx, 0xe
and edx, 0x3fc
movzx r8d, byte [rdx + r14 + 3]
shl r8d, 0x18
xor r8d, dword [rsi]
mov edx, ecx
shr edx, 8
and edx, ebp
movzx edx, byte [r15 + rdx*4 + 2]
shl edx, 0x10
mov r9d, ecx
and r9d, ebp
movzx r9d, byte [r12 + r9*4 + 1]
shl r9d, 8
xor r9d, edx
mov edx, ecx
shr edx, 0x18
movzx edx, byte [r13 + rdx*4]
xor edx, r9d
xor edx, r8d
xor edx, dword [rbx + rdi]
mov dword [rsi + 0x20], edx
cmp rax, 9
jbe 0x140009ab1
xor edx, dword [rsi + 4]
mov dword [rsi + 0x24], edx
cmp rax, 0xa
je 0x140009af1
xor edx, dword [rsi + 8]
mov dword [rsi + 0x28], edx
cmp rax, 0xb
jbe 0x140009a9b
xor edx, dword [rsi + 0xc]
mov dword [rsi + 0x2c], edx
cmp rbx, 0x18
je 0x140009a8a
cmp rax, 0xc
je 0x140009b07
mov r8d, edx
shr r8d, 0x18
movzx r8d, byte [r14 + r8*4 + 3]
shl r8d, 0x18
xor r8d, dword [rsi + 0x10]
mov r9d, edx
shr r9d, 0xe
and r9d, 0x3fc
movzx r9d, byte [r9 + r15 + 2]
shl r9d, 0x10
mov r10d, edx
shr r10d, 8
and r10d, ebp
movzx r10d, byte [r12 + r10*4 + 1]
shl r10d, 8
xor r10d, r9d
and edx, ebp
movzx edx, byte [r13 + rdx*4]
xor edx, r10d
xor edx, r8d
mov dword [rsi + 0x30], edx
cmp rax, 0xd
jbe 0x140009b49
xor edx, dword [rsi + 0x14]
mov dword [rsi + 0x34], edx
cmp rax, 0xe
je 0x140009b1d
xor edx, dword [rsi + 0x18]
mov dword [rsi + 0x38], edx
cmp rax, 0xf
jbe 0x140009b33
xor edx, ecx
mov dword [rsi + 0x3c], edx
mov ecx, 8
mov rdx, rsi
mov r8, rax
lea r9, [0x1409add20]
call fcn.140009b60
mov rsi, rax
mov rax, rdx
add rbx, 4
jmp 0x140009933
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r8, [0x1409adca8]
mov ecx, 0xb
mov edx, 0xb
call fcn.14002dbf0
lea r8, [0x1409adc78]
mov ecx, 9
mov edx, 9
call fcn.14002dbf0
lea r8, [0x1409adc48]
mov ecx, 7
mov rdx, rax
call fcn.14002dbf0
lea r8, [0x1409adc60]
mov ecx, 8
mov edx, 8
call fcn.14002dbf0
lea r8, [0x1409adc90]
mov ecx, 0xa
mov edx, 0xa
call fcn.14002dbf0
lea r8, [0x1409adcc0]
mov ecx, 0xc
mov edx, 0xc
call fcn.14002dbf0
lea r8, [0x1409adcf0]
mov ecx, 0xe
mov edx, 0xe
call fcn.14002dbf0
lea r8, [0x1409add08]
mov ecx, 0xf
mov edx, 0xf
call fcn.14002dbf0
lea r8, [0x1409adcd8]
mov ecx, 0xd
mov edx, 0xd
call fcn.14002dbf0
int3
Function at 0x1400103a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x1400103c5
cmp rax, rcx
je 0x1400103cb
cmp rdx, 4
jae 0x1400103d2
xor eax, eax
xor r8d, r8d
jmp 0x140010470
pop rbp
jmp fcn.140001d10
xor eax, eax
jmp 0x140010487
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x1400303e0]
movdqa xmm3, xmmword [0x1400303f0]
pxor xmm1, xmm1
nop word cs:[rax + rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x140010400
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x140010487
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x140010470
pop rbp
ret
Function at 0x140015a15
Capabilities:
Hash data using sha256 via x86 extensions

Disassembly:
movaps xmm0, xmmword [rdx]
sha256msg1 xmm0, xmmword [r8]
movaps xmmword [rcx], xmm0
ret

Function at 0x140015a31
Capabilities:
Hash data using sha256 via x86 extensions

Disassembly:
movaps xmm0, xmmword [rdx]
sha256msg2 xmm0, xmmword [r8]
movaps xmmword [rcx], xmm0
ret

Function at 0x140015b35
Capabilities:
Hash data using murmur3

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
mov r10d, r8d
rol r10d, 0x19
mov eax, dword [rdx]
mov esi, eax
rol esi, 0x19
mov r11d, dword [rdx + 4]
mov ebp, r11d
rol ebp, 0x19
mov edi, dword [rdx + 8]
mov r14d, edi
rol r14d, 0x19
mov ebx, r8d
rol ebx, 0xe
xor ebx, r10d
mov r15d, eax
rol r15d, 0xe
xor r15d, esi
mov r12d, r11d
rol r12d, 0xe
xor r12d, ebp
mov ebp, edi
rol ebp, 0xe
mov r10, qword [rsp + 0x60]
xor ebp, r14d
shr r8d, 3
mov esi, eax
shr esi, 3
xor esi, r15d
add esi, r11d
shr r11d, 3
xor r11d, r12d
add r11d, edi
shr edi, 3
xor edi, ebp
add edi, dword [rdx + 0xc]
add esi, dword [r9]
add r11d, dword [r9 + 4]
add edi, dword [r9 + 8]
mov edx, dword [r10 + 4]
mov ebp, edx
rol ebp, 0xf
xor r8d, ebx
mov ebx, edx
rol ebx, 0xd
mov r9d, dword [r10]
xor ebx, ebp
shr edx, 0xa
xor edx, ebx
add edx, edi
mov edi, r9d
rol edi, 0xf
mov ebx, r9d
rol ebx, 0xd
xor ebx, edi
shr r9d, 0xa
mov edi, edx
rol edi, 0xf
xor r9d, ebx
mov ebx, edx
rol ebx, 0xd
add r9d, r11d
xor ebx, edi
mov r11d, edx
shr r11d, 0xa
xor r11d, ebx
mov edi, r9d
rol edi, 0xf
add r11d, esi
mov esi, r9d
rol esi, 0xd
xor esi, edi
mov edi, r9d
shr edi, 0xa
xor edi, esi
add eax, dword [r10 + 0xc]
add eax, r8d
add eax, edi
mov dword [rcx], eax
mov dword [rcx + 4], r11d
mov dword [rcx + 8], r9d
mov dword [rcx + 0xc], edx
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret