joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002f96c
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14005be78]
xor rax, rsp
mov qword [rbp - 8], rax
mov rbx, rcx
mov rdx, rcx
cmp qword [rcx + 0x18], 8
jb 0x14002f99c
mov rdx, qword [rcx]
lea rcx, str.sfxcmd
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor edi, edi
mov qword [rbp - 0x28], rdi
movdqa xmm0, xmmword [0x1400489c0]
movdqu xmmword [rbp - 0x18], xmm0
mov word [rbp - 0x28], di
mov qword [rbp - 0x30], rdi
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.14001cdbc
test al, al
je 0x14002fa23
mov rax, qword [rbp - 0x30]
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14002f9e9
mov rcx, qword [rbx]
movzx ecx, word [rcx + rax*2]
call fcn.14001d19c
test al, al
je 0x14002fa03
mov rax, qword [rbp - 0x30]
inc rax
mov qword [rbp - 0x30], rax
jmp 0x14002f9dc
cmp qword [rbx + 0x18], 8
jb 0x14002fa0d
mov rbx, qword [rbx]
mov rax, qword [rbp - 0x30]
lea rdx, [rbx + rax*2]
lea rcx, str.sfxpar
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x14002fa5f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002fa5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002fa7b
call fcn.140031e6c
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140031f80
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
call fcn.140037564
int3
Function at 0x14003139c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x140031414
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x140031414
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x140031414
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x140031408
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x140031426
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x1400313f6
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x140031416

Function at 0x140032f60
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140032faa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140032faa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140032faa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140032faa
cmp dword [rcx + 0x84], 0xe
jbe 0x140032faa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140032fac
xor al, al
add rsp, 0x28
ret

Function at 0x14003bcf4
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14003ba58

Function at 0x140045c10
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140045c38
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140045c38
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0xc77360
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0xc7736d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0xc7737d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0xc77365
lea eax, [rcx + 1]
jmp 0xc7738b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0xc7739e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0xc77384
sub eax, 3
jb 0xc773be
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0xc7740d
sar eax, 1
movsxd rbp, eax
jb 0xc773f4
jmp 0xc773cc
add ebx, ebx
jne 0xc773ca
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xc773f4
inc ecx
add ebx, ebx
jne 0xc773da
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0xc773f4
call r11
adc ecx, ecx
add ebx, ebx
jne 0xc773ed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0xc773dc
add ecx, 2
jmp 0xc773f9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.00c77322
jmp 0xc7736d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x258000
mov dl, 0x43
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0xc77459
cmp rsi, rcx
jae 0xc77461
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0xc77440
cmp al, 0x8f
ja 0xc77440
cmp byte [rsi - 2], 0xf
je 0xc77446
sub al, 0xe8
cmp al, 1
ja 0xc7742a
cmp rsi, rcx
jae 0xc77461
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0xc77430
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0xc77461
lodsb al, byte [rsi]
jmp 0xc77440
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x870000]
mov eax, dword [rdi]
or eax, eax
je 0xc774be
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x877000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0xc7746e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0xc774b8
mov qword [rbx], rax
add rbx, 8
jmp 0xc7748e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0xc77502
cmp al, 0xef
ja 0xc774ea
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0xc774ca
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0xc774d9
mov eax, dword [rdi]
add rdi, 4
jmp 0xc774d9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0xc77556
sub rsp, 0xffffffffffffff80
jmp 0x46d520
Function at 0x140a6a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140a6a1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140a6a089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a6a06f
add dl, dl
jne 0x140a6a096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a6a0f6
xor eax, eax
add dl, dl
jne 0x140a6a0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140a6a1ad
add dl, dl
jne 0x140a6a0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a6a0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a6a0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a6a0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140a6a0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140a6a07e
mov eax, 1
add dl, dl
jne 0x140a6a106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140a6a113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a6a0fb
sub eax, ebx
mov ebx, 1
jne 0x140a6a14c
mov ecx, 1
add dl, dl
jne 0x140a6a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a6a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a6a123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a6a07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140a6a168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140a6a175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140a6a15d
cmp eax, 0x7d00
jae 0x140a6a19b
cmp eax, 0x500
jb 0x140a6a196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a6a07e
cmp eax, 0x7f
ja 0x140a6a19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140a6a07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140a6a1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140a6a07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140aef0e9
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x86bcbd86
push rdx
lea rax, [0x140afd658]
lea rsp, [rsp + 8]
mov edx, 0x1d1a20bf
movzx edx, byte [r9 + rdx*2 - 0x3a34417e]
push 0x4f298709
xor edx, esi
and edx, 0xff
mov edx, dword [rax + rdx*4]
shr esi, 8
xor esi, edx
inc r9
xor esi, 0x230509bd
dec r8
lea rsp, [rsp + 8]
jne 0x140aec1de
not esi
call fcn.140afea52
test r8, r8
mov qword [rsp + 8], 0xffffffffb1ad4295
lea rsp, [rsp + 0x10]
je 0x140aec218
jmp 0x140aec1cc

Function at 0x140afe0e4
Capabilities:
Encode data using xor

Disassembly:
inc rdi
lea rsi, [rsi + rdi*2 - 0x6d445e34]
or edi, 0x2d0eec81
neg dil
xor r8w, r9w
ror r8w, 1
ror di, 0x22
sbb dil, 0x9c
adc r8w, 0xd5a7
inc edi
call fcn.140b013a9
lea rsp, [rsp + 8]
je 0x140afe167
mov edi, 0x599e8a6
lea rdi, [0x140af2c18]
mov eax, 0x489cb593
and rax, rax
movzx eax, byte [rdx + rax - 0x489cb593]
xor eax, ecx
and eax, 0xff
push 0x3cae5a95
mov eax, dword [rdi + rax*4]
shr ecx, 8
xor ecx, eax
inc rdx
xor ecx, 0xb23e0e95
dec rbx
lea rsp, [rsp + 8]
jne 0x140afe12c
push 0x143ef324
not ecx
mov dword [r11], ecx
lea rsp, [rsp + 8]
jmp fcn.140af3146
Function at 0x140002ec0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x14038a340]
xor rax, rsp
mov qword [rsp + 0xa8], rax
xor esi, esi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x60], 0x720062
mov dword [rsp + 0x64], 0x140083
mov dword [rsp + 0x68], 0x20023
mov dword [rsp + 0x6c], 0x7d00f3
mov dword [rsp + 0x70], 0x14000c
mov dword [rsp + 0x74], 0x1400ec
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r11 - 0x38], xmm0
movups xmmword [r11 - 0x28], xmm0
mov qword [r11 - 0x18], rax
movups xmmword [rsp + 0x38], xmm0
mov qword [r11 - 0x70], rsi
mov qword [r11 - 0x68], 7
mov word [rsp + 0x38], si
mov dword [rsp + 0x58], 1
mov ebx, esi
mov word [rsp + 0x20], si
mov edi, 8
mov r9d, edi
movzx r8d, byte [rsp + 0x30]
mov edx, edi
lea rcx, [r11 - 0x80]
call fcn.140005040
nop dword [rax]
mov rax, rbx
and eax, 3
movzx ecx, word [rsp + rbx*2 + 0x68]
xor cx, word [rsp + rax*2 + 0x60]
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 7
cmova rax, qword [rsp + 0x38]
mov word [rax + rbx*2], cx
inc rbx
sub rdi, 1
jne 0x140002f70
lea rax, [rsp + 0x38]
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x50]
cmp r8, 7
cmova rax, rdx
mov rcx, qword [rsp + 0x48]
lea r9, [rcx - 1]
cmp word [rax + r9*2], di
jne 0x140002feb
mov qword [rsp + 0x48], r9
lea rax, [rsp + 0x38]
cmp r8, 7
cmova rax, rdx
mov word [rax + r9*2], si
mov r8, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x80], rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
movdqa xmm1, xmmword [0x140384070]
movdqu xmmword [rsp + 0x98], xmm1
mov word [rsp + 0x88], si
test rcx, rcx
je 0x14000302b
lea rax, [rsp + 0x38]
cmp r8, 7
cmova rax, rdx
jmp 0x14000302e
mov rax, rsi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rcx
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
mov r8d, 0x10
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x80]
call fcn.140007c40
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x14000309e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003099
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003159
call fcn.140015390
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], si
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.140007e50
nop
mov rdx, qword [rsp + 0xa0]
cmp rdx, 7
jbe 0x140003108
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003103
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000315f
call fcn.140015390
movdqa xmm0, xmmword [0x140384070]
movdqu xmmword [rsp + 0x98], xmm0
mov word [rsp + 0x88], si
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140003134
call sub.ADVAPI32.dll_CloseServiceHandle
nop
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.140014f40
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call fcn.14001dfa8
nop
call fcn.14001dfa8
int3
Function at 0x140004450
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x14038a340]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov r15, r8
mov r14, rdx
mov rdi, rcx
mov rbx, qword [r8 + 8]
mov rax, qword [rbx + 0x30]
mov rcx, qword [r8]
call rax
mov rbp, rax
mov r9, qword [rbx + 0x38]
mov r8, qword [r14 + 8]
mov rdx, qword [r14]
mov rcx, qword [r15]
call r9
movaps xmm1, xmmword [r15]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r14, xmm0
mov rax, qword [r14 + 0x30]
movq r15, xmm1
mov rcx, r15
call rax
mov rsi, rax
xor ebx, ebx
test rax, rax
je 0x1400044cf
mov rdx, qword [r14 + 0x20]
mov rcx, r15
call rdx
nop
jmp 0x1400044d2
mov rax, rbx
lea r14, [rax + rbp]
mov qword [rsp + 0x20], r14
sub rsi, rbp
mov qword [rsp + 0x28], rsi
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov rcx, qword [rdi + 0xe0]
test rcx, rcx
je 0x1400045c9
mov eax, 0x10
sub rax, rcx
mov rbp, rsi
cmp rax, rsi
cmovb rbp, rax
cmp rbp, rsi
cmovbe rsi, rbp
movaps xmm0, xmmword [rdi]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rdi + 0x20]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.1400089c0
movaps xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
add rcx, qword [rdi + 0xe0]
test rsi, rsi
je 0x140004570
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + rbx]
xor byte [r14 + rbx], al
inc rbx
cmp rbx, rsi
jb 0x140004560
sub qword [rdi + 0xe0], rbp
lea rax, [r14 + rbp]
mov qword [rsp + 0x20], rax
sub qword [rsp + 0x28], rbp
cmp qword [rdi + 0xe0], 0
jne 0x1400045c9
mov eax, dword [rdi + 0xc]
bswap eax
inc eax
bswap eax
mov dword [rdi + 0xc], eax
test eax, eax
jne 0x1400045c9
mov eax, dword [rdi + 8]
bswap eax
inc eax
bswap eax
mov dword [rdi + 8], eax
test eax, eax
jne 0x1400045c9
mov eax, dword [rdi + 4]
bswap eax
inc eax
bswap eax
mov dword [rdi + 4], eax
test eax, eax
jne 0x1400045c9
mov eax, dword [rdi]
bswap eax
inc eax
bswap eax
mov dword [rdi], eax
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call fcn.1400048b0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140014f40
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400048b0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbx
push rbp
sub rsp, 0x68
mov rax, qword [0x14038a340]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbp, qword [rdx + 8]
mov rbx, rcx
test rbp, rbp
je 0x140004a77
mov qword [r11 + 0x10], rsi
mov rsi, rbp
mov qword [r11 + 0x18], rdi
and rsi, 0xfffffffffffffff0
mov qword [r11 + 0x20], r14
mov r14, qword [rdx]
add rsi, r14
mov qword [r11 - 0x18], r15
mov rdi, r14
test r14b, 0xf
je 0x140004988
cmp r14, rsi
je 0x1400049fa
movaps xmmword [rsp + 0x50], xmm6
movdqu xmm0, xmmword [rbx]
lea r8, [rsp + 0x30]
movdqu xmm6, xmmword [rdi]
lea rdx, [rbx + 0x20]
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x30], xmm0
call fcn.1400089c0
movups xmm0, xmmword [rax]
xorps xmm0, xmm6
movdqu xmmword [rdi], xmm0
mov eax, dword [rbx + 0xc]
bswap eax
inc eax
bswap eax
mov dword [rbx + 0xc], eax
test eax, eax
jne 0x140004975
mov eax, dword [rbx + 8]
bswap eax
inc eax
bswap eax
mov dword [rbx + 8], eax
test eax, eax
jne 0x140004975
mov eax, dword [rbx + 4]
bswap eax
inc eax
bswap eax
mov dword [rbx + 4], eax
test eax, eax
jne 0x140004975
mov eax, dword [rbx]
bswap eax
inc eax
bswap eax
mov dword [rbx], eax
add rdi, 0x10
cmp rdi, rsi
jne 0x140004910
movaps xmm6, xmmword [rsp + 0x50]
jmp 0x1400049fa
cmp r14, rsi
je 0x1400049fa
nop dword [rax]
movdqu xmm0, xmmword [rbx]
lea r8, [rsp + 0x30]
lea rdx, [rbx + 0x20]
lea rcx, [rsp + 0x20]
movdqu xmmword [rsp + 0x30], xmm0
call fcn.1400089c0
movups xmm0, xmmword [rax]
xorps xmm0, xmmword [rdi]
movdqu xmmword [rdi], xmm0
mov eax, dword [rbx + 0xc]
bswap eax
inc eax
bswap eax
mov dword [rbx + 0xc], eax
test eax, eax
jne 0x1400049f1
mov eax, dword [rbx + 8]
bswap eax
inc eax
bswap eax
mov dword [rbx + 8], eax
test eax, eax
jne 0x1400049f1
mov eax, dword [rbx + 4]
bswap eax
inc eax
bswap eax
mov dword [rbx + 4], eax
test eax, eax
jne 0x1400049f1
mov eax, dword [rbx]
bswap eax
inc eax
bswap eax
mov dword [rbx], eax
add rdi, 0x10
cmp rdi, rsi
jne 0x140004990
mov r15, qword [rsp + 0x60]
mov rsi, rbp
and esi, 0xf
sub r14, rsi
lea rdi, [r14 + rbp]
mov r14, qword [rsp + 0x98]
test rsi, rsi
je 0x140004a67
movups xmm0, xmmword [rbx]
lea rdx, [rbx + 0x20]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
call fcn.1400089c0
movups xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x30], xmm0
test rsi, rsi
je 0x140004a60
lea rdx, [rsp + 0x30]
mov ecx, esi
sub rdx, rdi
nop dword [rax]
movzx eax, byte [rdx + rdi]
xor byte [rdi], al
lea rdi, [rdi + 1]
sub rcx, 1
jne 0x140004a50
mov qword [rbx + 0xe0], rsi
mov rsi, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140014f40
add rsp, 0x68
pop rbp
pop rbx
ret
Function at 0x140005860
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.140005ff0
mov r9, qword [rbx]
mov rdi, rax
shl rdi, 0x20
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x1400058d1
lea r8, [r9 + 8]
nop
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140005890
mov ecx, dword [r9]
jmp 0x1400059b7
cmp ecx, 0x4e0
jb 0x1400059b7
lea r10, [r9 + 0x9c4]
mov ebx, 0xe3
mov r11d, dword [r10]
nop dword [rax]
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1400058f0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140005940
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov rbx, qword [rsp + 0x30]
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
or rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x140005df0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov ebp, r9d
mov r15, r8
mov r14, rdx
mov rsi, rcx
call fcn.140005ff0
mov rdi, rax
add ebp, 0xffffffff
je 0x140005fcd
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r12
xor r12d, r12d
nop word [rax + rax]
mov r9, qword [rsi]
shl rdi, 0x20
mov ecx, dword [r9]
cmp ecx, 0x270
jne 0x140005e94
lea rax, [r9 + 8]
mov r10d, ecx
nop dword [rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r10, 1
jne 0x140005e50
mov ecx, dword [r9]
jmp 0x140005f76
cmp ecx, 0x4e0
jb 0x140005f76
lea r10, [r9 + 0x9c4]
mov r11d, 0xe3
mov ebx, dword [r10]
mov eax, ebx
mov r8, r10
mov ebx, dword [r10 + 4]
mov edx, eax
xor edx, ebx
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub r11, 1
jne 0x140005eb0
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov ebx, dword [r10]
nop dword [rax]
mov eax, ebx
mov r8, r10
mov ebx, dword [r10 + 4]
mov edx, eax
xor edx, ebx
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub r11, 1
jne 0x140005f00
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
mov ecx, r12d
mov dword [r9], r12d
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov ecx, edx
mov dword [r9], eax
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
xor rdx, rax
mov rcx, rdx
shr rcx, 0x12
xor rcx, rdx
or rdi, rcx
add ebp, 0xffffffff
jne 0x140005e30
mov r12, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rax, r15
mul rdi
mov qword [r14], rax
mov rax, r14
mov qword [r14 + 8], rdx
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140005ff0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x140006051
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x140006010
mov ecx, dword [r9]
jmp 0x14000613b
cmp ecx, 0x4e0
jb 0x14000613b
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x140006070
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1400060c0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
add rsp, 8
ret
Function at 0x140007e50
Capabilities:
Start service

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x140007e66
add rsp, 0x28
ret
call fcn.140007e70
int3