joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004770c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x1800cf540]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
mov esi, edx
imul rbx, rax, 0x38
add rbx, qword [0x1800d1430]
mov rdx, qword [rbx]
mov cl, byte [rbx + 0x20]
mov rbp, rdx
lea rdi, [rdx - 5]
and cl, 1
je 0x180047751
mov rbp, rdi
movzx eax, cl
lea r9, [rsp + 0x20]
test cl, cl
mov r8d, 0x40
cmove rdi, rdx
lea r14, [rax*2 + 5]
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180047787
mov eax, 0xa
jmp 0x180047816
test esi, esi
je 0x1800477a9
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, ebp
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x1800477ca
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x1800477ca
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x1800477c4
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
mov al, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x1800477ca
mov al, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, r14
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov al, sil
shl sil, 2
add al, al
xor al, byte [rbx + 0x20]
and al, 2
xor al, byte [rbx + 0x20]
xor sil, al
and sil, 4
xor sil, al
mov byte [rbx + 0x20], sil
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180055770
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x180047878
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1800cf540]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor ebx, ebx
mov r15d, edx
mov rdi, rcx
mov qword [rcx], rbx
mov qword [rcx + 8], rbx
xor edx, edx
mov r14d, r8d
mov esi, ebx
lea ecx, [rbx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x180047a14
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x1800479b6
lea esi, [rbx + 1]
cmp dword [rsp + 0x20], 0x10
jb 0x180047972
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x2c], eax
jne 0x180047972
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rsp + 0x28], eax
je 0x180047972
mov rdx, qword [rdi]
test rdx, rdx
jne 0x180047934
mov dword [rdi + 8], 0x80
mov r8d, 0x200
mov rcx, qword [0x1800d0100]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rdi], rax
mov rdx, rax
test rax, rax
je 0x18004799a
jmp 0x180047965
mov eax, dword [rdi + 8]
cmp dword [rdi + 0xc], eax
jb 0x180047965
add eax, eax
mov r8, rdx
mov r9d, eax
xor edx, edx
mov dword [rdi + 8], eax
mov rcx, qword [0x1800d0100]
shl r9, 2
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rdx, rax
test rax, rax
je 0x18004799a
mov qword [rdi], rax
mov ecx, dword [rdi + 0xc]
mov eax, dword [rsp + 0x28]
mov dword [rdx + rcx*4], eax
inc dword [rdi + 0xc]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x1c
mov rcx, rbp
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x1800478e2
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1800479b6
mov esi, ebx
cmp qword [rdi], rbx
je 0x1800479b6
mov r8, qword [rdi]
xor edx, edx
mov rcx, qword [0x1800d0100]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rdi], rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x180047a14
cmp qword [rdi], rbx
je 0x180047a19
mov esi, ebx
cmp dword [rdi + 0xc], ebx
jbe 0x180047a19
mov r8, qword [rdi]
xor edx, edx
mov eax, esi
lea ecx, [rdx + 0x5a]
mov r8d, dword [r8 + rax*4]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rbp, rax
test rax, rax
je 0x180047a0b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, r14d
mov edx, r15d
mov rcx, rbp
call fcn.180047c58
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [rdi + 0xc]
jb 0x1800479cf
jmp 0x180047a19
mov ebx, 9
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180055770
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x180047df4
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
je 0x180047e58
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x180047e46
mov r8, qword [rbx]
xor edx, edx
mov r8d, dword [r8 + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180047e3f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x180047e13
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [0x1800d0100]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1800481cc
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x1800481e3
cmp r8b, 0x90
je 0x1800481e3
cmp r8b, 0xcc
jne 0x180048205
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x180048201
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x180048205
add edx, r10d
cmp edx, r9d
jb 0x1800481f1
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x180051120
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
cmp byte [0x1800d0642], bpl
je 0x1800512fe
mov rax, qword [0x1800d0dc0]
test rax, rax
jne 0x1800511ef
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbx, qword [rax]
mov rdx, rbx
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x1800511d4
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x1800511d4
mov esi, dword [r9 + 0x20]
dec r10d
mov r11d, 0x811c9dc5
lea rax, [rsi + r10*4]
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
inc rcx
test al, al
je 0x1800511cf
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x1800511ac
cmp r11d, 0x95466b05
je 0x1800512e0
test r10d, r10d
jne 0x18005118f
mov rax, qword [rdx]
mov rdx, rax
cmp rax, rbx
je 0x1800511e5
cmp qword [rax + 0x30], rbp
jne 0x18005116a
mov rax, rbp
mov qword [0x1800d0dc0], rax
mov ecx, dword [0x1800d0664]
call rax
test ax, ax
je 0x1800512fe
mov rax, qword [0x1800d0140]
mov rcx, qword [rax]
test rcx, rcx
je 0x1800512fe
mov r11, qword [rcx + 8]
test r11, r11
je 0x1800512fe
mov rax, qword [0x1800d0148]
mov r8, qword [rax]
test r8, r8
je 0x1800512fe
mov r8, qword [r8 + 0x18]
test r8, r8
je 0x1800512fe
mov r9d, ebp
mov r10, rbp
movsxd rax, r9d
cmp rax, qword [r8 + 0x108]
jae 0x1800512fe
mov rdx, qword [r8 + 0x100]
test rdx, rdx
je 0x1800512d4
mov rdx, qword [r10 + rdx]
test rdx, rdx
je 0x1800512d4
cmp rdx, r11
je 0x1800512d4
mov eax, dword [0x1800d016c]
mov ecx, dword [rax + rdx]
test ecx, ecx
je 0x1800512d4
and ecx, 0x1fc000
cmp ecx, 0x8000
je 0x1800512d4
movsd xmm0, qword [r11 + 0x90]
movss xmm2, dword [r11 + 0x98]
movsd qword [rsp + 0x20], xmm0
movss xmm1, dword [rsp + 0x24]
addss xmm1, dword [0x180058b18]
movss xmm0, dword [rsp + 0x20]
mov dword [rdx + 0x280], 0x3dcccccd
unpcklps xmm0, xmm1
movsd qword [rdx + 0x90], xmm0
movss dword [rdx + 0x98], xmm2
inc r9d
add r10, 0x10
jmp 0x180051246
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x1800511e8
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180051940
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
movaps xmmword [rax - 0x28], xmm6
xor r14d, r14d
cmp byte [0x1800d05da], r14b
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
movaps xmmword [rax - 0x58], xmm9
je 0x180051b66
mov rax, qword [0x1800d0dc0]
test rax, rax
jne 0x180051a21
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbx, qword [rax]
mov r10, rbx
mov r8, qword [r10 + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x180051a06
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x180051a06
mov esi, dword [r9 + 0x20]
dec edx
mov r11d, 0x811c9dc5
lea rax, [rsi + rdx*4]
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
inc rcx
test al, al
je 0x180051a02
movsx eax, al
xor eax, r11d
imul r11d, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x1800519df
cmp r11d, 0x95466b05
je 0x180051a9b
test edx, edx
jne 0x1800519c3
mov rax, qword [r10]
mov r10, rax
cmp rax, rbx
je 0x180051a17
cmp qword [rax + 0x30], r14
jne 0x18005199f
mov rax, r14
mov qword [0x1800d0dc0], rax
mov ecx, dword [0x1800cf444]
call rax
test ax, ax
jns 0x180051b66
call fcn.18004cf64
mov rbx, rax
test rax, rax
je 0x180051b66
cmp dword [0x1800cf470], 1
jne 0x180051b66
movss xmm9, dword [0x1800d01a8]
lea rcx, [rbp - 0x50]
movss xmm6, dword [0x1800d01ac]
xor r8d, r8d
mulss xmm9, dword [0x180058b14]
mov rdx, rax
mulss xmm6, dword [0x180058b14]
call fcn.18004cc24
mov ecx, dword [0x1800d05e8]
sub ecx, 1
je 0x180051ac0
sub ecx, 1
je 0x180051ab8
cmp ecx, 1
jne 0x180051ad2
mov r8d, ecx
jmp 0x180051ac6
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x180051a1a
mov r8d, 8
jmp 0x180051ac6
mov r8d, 7
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.18004cc24
movsd xmm8, qword [rbp - 0x50]
lea rdx, [rbp - 0x50]
mov ebx, dword [rbp - 0x48]
lea rcx, [rbp + 0x20]
movsd qword [rbp - 0x50], xmm8
mov dword [rbp - 0x48], ebx
call fcn.180050f14
movss xmm0, dword [rbp + 0x24]
cvtps2pd xmm1, xmm6
cvtps2pd xmm0, xmm0
subsd xmm0, xmm1
movsd xmm1, qword [0x1800604e8]
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
movsd xmm1, qword [0x1800604e8]
movaps xmm7, xmm0
movss xmm0, dword [rbp + 0x20]
cvtps2pd xmm0, xmm0
cvtps2pd xmm2, xmm9
subsd xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_pow
addsd xmm7, xmm0
xorps xmm0, xmm0
cvtsd2ss xmm0, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
mov eax, dword [0x1800cf448]
lea ecx, [rax + rax*4]
add ecx, ecx
movd xmm1, ecx
cvtdq2ps xmm1, xmm1
comiss xmm1, xmm0
jbe 0x180051b66
lea rcx, [rbp - 0x50]
movsd qword [rbp - 0x50], xmm8
mov dword [rbp - 0x48], ebx
call fcn.18004c848
movaps xmm6, xmmword [rsp + 0x60]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm7, xmmword [rsp + 0x50]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180052410
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x1800d0140]
mov rcx, qword [rax]
test rcx, rcx
je 0x18005257f
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x18005257f
mov eax, dword [0x1800d0178]
mov rdx, qword [rax + rcx]
test rdx, rdx
je 0x18005257f
cmp qword [rcx + 0x30], 0
je 0x18005257f
mov rax, qword [0x1800d0148]
mov r8, qword [rax]
test r8, r8
je 0x18005257f
cmp qword [r8 + 0x10], 0
je 0x18005257f
cmp byte [0x1800d064c], 0
je 0x1800524a7
cmp byte [0x1800d01a1], 0
movss xmm0, dword [0x1800cf4b4]
je 0x18005249f
movss dword [rdx + 0xd40], xmm0
jmp 0x1800524a7
movss dword [rdx + 0xcf0], xmm0
mov eax, dword [0x1800d0198]
cmp byte [rax + rcx], 0x40
je 0x18005257f
movss xmm0, dword [0x18005a8a8]
comiss xmm0, dword [rcx + 0x280]
ja 0x18005257f
mov rax, qword [0x1800d0dc0]
test rax, rax
jne 0x180052571
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r11, qword [rax]
mov rdx, r11
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x180052556
mov ecx, dword [r9 + 0x18]
test ecx, ecx
je 0x180052556
mov esi, dword [r9 + 0x20]
dec ecx
mov ebx, 0x811c9dc5
mov edi, ecx
lea rax, [rsi + rcx*4]
mov r10d, dword [rax + r8]
add r10, r8
mov al, byte [r10]
inc r10
test al, al
je 0x180052552
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
mov al, byte [r10]
inc r10
test al, al
jne 0x180052535
cmp ebx, 0x95466b05
je 0x18005258f
test ecx, ecx
jne 0x180052517
mov rax, qword [rdx]
mov rdx, rax
cmp rax, r11
je 0x180052568
cmp qword [rax + 0x30], 0
jne 0x1800524f3
xor eax, eax
mov qword [0x1800d0dc0], rax
mov ecx, 0xa0
call rax
mov byte [0x1800d0670], 1
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdi*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x18005256a
Function at 0x180055134
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x1800cf540]
xor rax, rsp
mov qword [rsp + 0xc0], rax
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x18005509c]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x1800551ab
mov qword [rsp + 0x20], 0xc8
lea rdx, [rsp + 0x30]
lea rcx, [0x18005509c]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.18004833c
mov rcx, rax
call fcn.1800485a8
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180055178
mov r8d, 0x80
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180055770
add rsp, 0xd8
ret
Function at 0x140001070
Capabilities:
Enumerate system firmware tables

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, str.acpi_sandbox_detect_by_huoji_2023.6.19__n
call fcn.140001010
xor r8d, r8d
xor edx, edx
mov ecx, 0x41435049
call qword [sym.imp.KERNEL32.dll_EnumSystemFirmwareTables]
mov ebx, eax
test eax, eax
je 0x1400011a0
mov ecx, ebx
mov qword [rsp + 0x38], r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r14, rax
test rax, rax
je 0x14000119b
mov r8d, ebx
mov rdx, rax
mov ecx, 0x41435049
call qword [sym.imp.KERNEL32.dll_EnumSystemFirmwareTables]
test eax, eax
je 0x140001192
mov qword [rsp + 0x58], rsi
xor sil, sil
mov qword [rsp + 0x60], rdi
mov edi, eax
shr rdi, 2
test rdi, rdi
je 0x14000116b
mov qword [rsp + 0x50], rbp
lea rbx, [r14 + 0x10]
mov qword [rsp + 0x68], r12
mov r12d, 1
mov qword [rsp + 0x30], r15
mov r15d, edi
mov ebp, dword [rbx - 6]
cmp ebp, 0x54454157
jne 0x140001128
lea rcx, str._detected__Vmware_detected_by_Windows_ACPI_Emulated_n
call fcn.140001010
test sil, sil
jne 0x14000113b
cmp ebp, 0x54455048
movzx esi, sil
cmove esi, r12d
mov eax, dword [rbx]
test rax, rax
jne 0x14000114e
lea rcx, str._detected__Cuckoo_sandbox_detected_by_oem_table_id_n
call fcn.140001010
inc rbx
sub rdi, r12
jne 0x140001111
mov r12, qword [rsp + 0x68]
cmp r15d, 8
mov r15, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x50]
jae 0x140001177
lea rcx, str._detected__vm_guest_detected_by_table_size__n
call fcn.140001010
mov rdi, qword [rsp + 0x60]
test sil, sil
mov rsi, qword [rsp + 0x58]
jne 0x140001192
lea rcx, str._detected__HPET_not_found_Cuckoo_detected__n
call fcn.140001010
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r14, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_getchar]
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400011d0
add rsp, 0x40
pop rbx
ret

Function at 0x140001a90
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001ada
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001ada
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001ada
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001ada
cmp dword [rcx + 0x84], 0xe
jbe 0x140001ada
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001adc
xor al, al
add rsp, 0x28
ret
Function at 0x1400ad1f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400ad218
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400ad218
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x1636eb4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1636ebe
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x1636ee7
pop rbp
sub rbp, 0x33
sub rbp, 0x1236eb4
sub rsp, 0x20
and byte [rax], al
add byte [rax], al
jmp 0x1636f06
mov rax, 0x1236eb4
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xffffffff94f2fd32
xor byte [rax], dl
inc rax
dec rcx
jne 0x1636f25
jmp 0x1636f3c
jp 0x1636ef9
fstp xword [rcx + 0x32320ebb]
xor bh, byte [rdx - 0x4d]
cmp dh, byte [rbx]
xor dh, byte [rdx]
jp 0x1636f81
fstp xword [rdx - 0xb]
xor dh, byte ss:[rdx]
xor dh, byte [rdx]
xor bh, byte [rdx - 0xb]
invalid
xor bh, byte [rdx + 0x33]
fstp xword [rdx - 0x78]
jrcxz 0x1636fec
jns 0x1636fb8
xor dh, byte [rdx]
xor dh, byte [rdx]
fidiv dword [rdi]
xor dh, byte [rdx]
xor bl, bl
and al, 0x32
xor dh, byte [rdx]
fidiv dword [rax]
add esp, dword [rbx]
jp 0x1636f53
xor dh, byte ss:[rdx]
xor bh, byte [rdx - 0x33]
cli
cmp eax, 0xcdcddcb7
int 0xf1
push 0x68
invalid
xor dh, byte [rdx]
xor dh, byte [rdx]
xor bh, byte [rdx - 0x75]
sub byte [rbp - 0x37], bl
xor dh, byte [rdx]
xor dh, byte [rdx]
xor bh, byte [rdx + 0x33]
fcmovnu st(0), st(2)
invalid
mov dh, 0x56
xor dh, byte [rdx]
xor bh, byte [0x3395dcb0]
xor dl, byte [rcx + rdi*4 + 0x2e]
or esi, dword [rdx - 0x49c22537]
xor dh, byte cs:[rdx]
xor dh, byte [rdx - 0x49c22437]
and dword [rdx], esi
xor dh, byte [rdx]
push rsp
mov bl, 0xc9
int 0x17
cmp eax, 0x32322db6
xor bh, byte [rdx - 0x33]
invalid
Function at 0x140006ee0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
mov rax, rcx
je 0x140006f28
xor r10d, r10d
nop dword [rax]
mov r9d, r10d
lea r8d, [r10 + 0x10]
xor r8b, byte [rax + r10]
and r9d, 7
movzx edx, r8b
mov ecx, 8
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
or dl, r8b
mov byte [rax + r10], dl
inc r10
cmp r10, 0x11
jb 0x140006ef0
mov byte [rax + 0x12], 0
ret

Function at 0x140006fc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2a], 0
mov rax, rcx
je 0x140007008
xor r10d, r10d
nop dword [rax]
mov r9d, r10d
lea r8d, [r10 + 0x10]
xor r8b, byte [rax + r10]
and r9d, 7
movzx edx, r8b
mov ecx, 8
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
or dl, r8b
mov byte [rax + r10], dl
inc r10
cmp r10, 0x29
jb 0x140006fd0
mov byte [rax + 0x2a], 0
ret

Function at 0x140007100
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
mov rax, rcx
je 0x140007148
xor r10d, r10d
nop dword [rax]
mov r9d, r10d
lea r8d, [r10 + 0x10]
xor r8b, byte [rax + r10]
and r9d, 7
movzx edx, r8b
mov ecx, 8
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
or dl, r8b
mov byte [rax + r10], dl
inc r10
cmp r10, 0xd
jb 0x140007110
mov byte [rax + 0xe], 0
ret

Function at 0x140007150
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x28], 0
mov rax, rcx
je 0x140007221
mov qword [rsp], rbx
lea r11, [rcx + 2]
mov rbx, 0xfffffffffffffffe
sub rbx, rcx
nop dword [rax]
nop word [rax + rax]
lea r10, [rbx + r11]
mov ecx, 8
lea r8d, [r10 + 0x10]
mov r9d, r10d
xor r8b, byte [r11 - 2]
lea r11, [r11 + 3]
movzx edx, r8b
and r9d, 7
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 1]
or dl, r8b
and r9d, 7
mov byte [r11 - 5], dl
lea r8d, [r10 + 0x11]
xor r8b, byte [r11 - 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [r10 + 2]
mov byte [r11 - 4], dl
add r10b, 0x12
xor r10b, byte [r11 - 3]
and r8d, 7
sub ecx, r8d
movzx edx, r10b
shl dl, cl
movzx ecx, r8b
shr r10b, cl
lea rcx, [rbx + r11]
or dl, r10b
mov byte [r11 - 3], dl
cmp rcx, 0x27
jb 0x140007180
mov rbx, qword [rsp]
mov byte [rax + 0x28], 0
add rsp, 8
ret

Function at 0x140007320
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
mov rax, rcx
je 0x140007368
xor r10d, r10d
nop dword [rax]
mov r9d, r10d
lea r8d, [r10 + 0x10]
xor r8b, byte [rax + r10]
and r9d, 7
movzx edx, r8b
mov ecx, 8
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
or dl, r8b
mov byte [rax + r10], dl
inc r10
cmp r10, 0x13
jb 0x140007330
mov byte [rax + 0x14], 0
ret
Function at 0x140007370
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x10], 0
mov rax, rcx
je 0x140007499
mov qword [rsp], rbx
lea r11, [rcx + 2]
mov rbx, 0xfffffffffffffffe
sub rbx, rcx
nop dword [rax]
nop word [rax + rax]
lea r10, [rbx + r11]
mov ecx, 8
lea r8d, [r10 + 0x10]
mov r9d, r10d
xor r8b, byte [r11 - 2]
lea r11, [r11 + 5]
movzx edx, r8b
and r9d, 7
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 1]
or dl, r8b
and r9d, 7
mov byte [r11 - 7], dl
lea r8d, [r10 + 0x11]
xor r8b, byte [r11 - 6]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 2]
or dl, r8b
and r9d, 7
mov byte [r11 - 6], dl
lea r8d, [r10 + 0x12]
xor r8b, byte [r11 - 5]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
lea r9d, [r10 + 3]
or dl, r8b
and r9d, 7
mov byte [r11 - 5], dl
lea r8d, [r10 + 0x13]
xor r8b, byte [r11 - 4]
mov ecx, 8
sub ecx, r9d
movzx edx, r8b
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [r10 - 4]
mov byte [r11 - 4], dl
add r10b, 0x14
xor r10b, byte [r11 - 3]
and r8d, 7
sub ecx, r8d
movzx edx, r10b
shl dl, cl
movzx ecx, r8b
shr r10b, cl
lea rcx, [rbx + r11]
or dl, r10b
mov byte [r11 - 3], dl
cmp rcx, 0xf
jb 0x1400073a0
mov rbx, qword [rsp]
mov byte [rax + 0x10], 0
add rsp, 8
ret

Function at 0x140007500
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
cmp byte [rcx + 0x23], 0
mov rax, rcx
je 0x140007590
mov qword [rsp], rbx
mov r11, rcx
mov rbx, rcx
neg rbx
nop
lea r10, [rbx + r11]
mov ecx, 8
lea r8d, [r10 + 0x10]
mov r9d, r10d
xor r8b, byte [r11]
lea r11, [r11 + 2]
movzx edx, r8b
and r9d, 7
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
mov ecx, 8
or dl, r8b
lea r8d, [r10 + 1]
mov byte [r11 - 2], dl
add r10b, 0x11
xor r10b, byte [r11 - 1]
and r8d, 7
sub ecx, r8d
movzx edx, r10b
shl dl, cl
movzx ecx, r8b
shr r10b, cl
lea rcx, [rbx + r11]
or dl, r10b
mov byte [r11 - 1], dl
cmp rcx, 0x22
jb 0x140007520
mov rbx, qword [rsp]
mov byte [rax + 0x23], 0
add rsp, 8
ret

Function at 0x1400075a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x20], 0
mov rax, rcx
je 0x1400075e8
xor r10d, r10d
nop dword [rax]
mov r9d, r10d
lea r8d, [r10 + 0x10]
xor r8b, byte [rax + r10]
and r9d, 7
movzx edx, r8b
mov ecx, 8
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
or dl, r8b
mov byte [rax + r10], dl
inc r10
cmp r10, 0x1f
jb 0x1400075b0
mov byte [rax + 0x20], 0
ret

Function at 0x1400075f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1e], 0
mov rax, rcx
je 0x140007638
xor r10d, r10d
nop dword [rax]
mov r9d, r10d
lea r8d, [r10 + 0x10]
xor r8b, byte [rax + r10]
and r9d, 7
movzx edx, r8b
mov ecx, 8
sub ecx, r9d
shl dl, cl
movzx ecx, r9b
shr r8b, cl
or dl, r8b
mov byte [rax + r10], dl
inc r10
cmp r10, 0x1d
jb 0x140007600
mov byte [rax + 0x1e], 0
ret