joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004c280
Capabilities:
Execute syscall

Disassembly:
mov eax, ecx
cmp edx, 1
jl 0x14004c2a8
mov r10, r8
cmp edx, 2
jl 0x14004c2a8
xchg r9, rdx
cmp r9d, 3
jl 0x14004c2a8
mov r8, qword [rsp + 0x28]
cmp r9d, 4
jl 0x14004c2a8
mov r9, qword [rsp + 0x30]
add rsp, 0x10
syscall
sub rsp, 0x10
ret

Function at 0x14004fb40
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004fb8a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004fb8a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004fb8a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004fb8a
cmp dword [rcx + 0x84], 0xe
jbe 0x14004fb8a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14004fb8c
xor al, al
add rsp, 0x28
ret

Function at 0x140061794
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140061584
Function at 0x1400684e0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x140068202
call fcn.14005b944
mov dword [rax], 0x16
call fcn.14005a538
jmp 0x140068352
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140068352
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140068352
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140068231
lock or dword [rcx + 0x14], 0x10
jmp 0x140068352
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140068245
call fcn.1400688e0
mov ebp, dword [rbx + 0x10]
cmp ebp, 1
jne 0x140068255
mov rax, qword [rbx]
mov r14b, byte [rax]
jmp 0x140068258
xor r14b, r14b
mov rsi, qword [rbx + 8]
mov rcx, rbx
mov edi, dword [rbx + 0x20]
mov qword [rbx], rsi
call fcn.1400654e0
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.140071a38
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x140068340
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x1400682eb
mov rcx, rbx
call fcn.1400654e0
cmp eax, 0xffffffff
je 0x1400682d6
mov rcx, rbx
call fcn.1400654e0
cmp eax, 0xfffffffe
je 0x1400682d6
mov rcx, rbx
call fcn.1400654e0
movsxd rdi, eax
lea rsi, [0x1400a0040]
mov rcx, rbx
sar rdi, 6
call fcn.1400654e0
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [rsi + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x1400682dd
lea rdx, [0x14009d3d0]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400682eb
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x14006830f
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x14006830f
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x14006830f
mov dword [rbx + 0x20], 0x1000
mov rdx, qword [rbx]
cmp ebp, 1
jne 0x14006832d
movzx ecx, byte [rdx]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, r14b
or cx, ax
inc rdx
jmp 0x140068338
movzx ecx, word [rdx]
add dword [rbx + 0x10], 0xfffffffe
add rdx, 2
mov qword [rbx], rdx
movzx eax, cx
jmp 0x140068357
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x1400681cc
Function at 0x140069bf8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.14004f980
sub rsp, rax
mov rax, qword [0x14009d020]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.1400654e0
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x140069c47
mov rax, rbp
jmp 0x140069d4f
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0xa0040]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14006a0e8
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0xa0040]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x140069d4b
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140069d4b
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14006a0e8
test rax, rax
js 0x140069d4b
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x140069d4b
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x140069d3d
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x140069d3d
cmp byte [rcx], 0xd
jne 0x140069d23
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x140069d32
cmp byte [rcx + 1], 0xa
jne 0x140069d32
inc rcx
jmp 0x140069d32
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x9db00]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x140069d05
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x140069d4f
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14004eaf0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14006c7d4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14006c804
xor eax, eax
jmp 0x14006c8c7
mov rbp, rbx
cmp word [rax], si
je 0x14006c829
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14006c810
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14006c80c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14006b0f4
movsxd r14, eax
test eax, eax
jne 0x14006c867
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14006c7fd
mov rcx, r14
call fcn.140064130
mov rdi, rax
test rax, rax
jne 0x14006c880
xor ecx, ecx
call fcn.1400640f4
jmp 0x14006c85c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14006b0f4
test eax, eax
jne 0x14006c8b1
mov rcx, rdi
call fcn.1400640f4
jmp 0x14006c8bb
xor ecx, ecx
call fcn.1400640f4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14007158c
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
movsxd rbp, ecx
mov r9, r8
mov rax, rbp
lea rcx, [0x1400a0040]
and eax, 0x3f
mov r10, rbp
sar r10, 6
xor edi, edi
mov rsi, rdx
mov r14, rbp
lea r8, [rax + rax*8]
mov rax, qword [rcx + r10*8]
mov ecx, 4
mov qword [rsp + 0x78], rcx
mov r11, qword [rax + r8*8 + 0x28]
lea r12d, [rcx + 6]
test r9, r9
je 0x1400715ea
cmp word [rdx], r12w
jne 0x1400715ea
or byte [rax + r8*8 + 0x38], cl
jmp 0x1400715f0
and byte [rax + r8*8 + 0x38], 0xfb
lea rdx, [rdx + r9*2]
mov rcx, rsi
mov rbx, rsi
cmp rsi, rdx
jae 0x14007174b
mov r9d, 0x1a
lea r13d, [r9 - 0xd]
movzx eax, word [rcx]
cmp ax, r9w
je 0x140071726
lea r9, [rcx + 2]
cmp ax, r13w
je 0x140071629
mov rcx, r9
jmp 0x14007164c
cmp r9, rdx
jae 0x140071663
cmp word [r9], r12w
mov eax, 2
cmove rax, qword [rsp + 0x78]
add rcx, rax
mov eax, r12d
cmp word [r9], r12w
cmovne ax, r13w
mov word [rbx], ax
mov r9d, 0x1a
add rbx, 2
cmp rcx, rdx
jb 0x14007160d
jmp 0x14007174b
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rdi
mov r8d, 2
lea rdx, [rsp + 0x70]
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140071720
cmp dword [rsp + 0x80], edi
je 0x140071720
mov rdx, r14
lea r11, [0x1400a0040]
sar rdx, 6
and r14d, 0x3f
mov rax, qword [r11 + rdx*8]
lea r8, [r14 + r14*8]
test byte [rax + r8*8 + 0x38], 0x48
je 0x1400716f9
movzx eax, word [rsp + 0x70]
cmp ax, r12w
jne 0x1400716cc
mov word [rbx], r12w
jmp 0x140071747
mov word [rbx], r13w
mov word [rsp + 0x78], ax
mov rax, qword [r11 + rdx*8]
lea rcx, [rax + r8*8]
mov al, byte [rsp + rdi + 0x78]
mov byte [rcx + rdi + 0x3a], al
inc rdi
cmp rdi, 2
jl 0x1400716d5
mov rax, qword [r11 + rdx*8]
mov byte [rax + r8*8 + 0x3c], r12b
jmp 0x140071747
cmp word [rsp + 0x70], r12w
jne 0x140071706
cmp rbx, rsi
je 0x1400716c6
mov rdx, 0xfffffffffffffffe
mov ecx, ebp
lea r8d, [rdx + 3]
call fcn.14006a0f0
cmp word [rsp + 0x70], r12w
je 0x14007174b
mov word [rbx], r13w
jmp 0x140071747
lea r11, [0x1400a0040]
mov rcx, qword [r11 + r10*8]
mov al, byte [rcx + r8*8 + 0x38]
test al, 0x40
jne 0x140071743
or al, 2
mov byte [rcx + r8*8 + 0x38], al
jmp 0x14007174b
mov word [rbx], r9w
add rbx, 2
sub rbx, rsi
sar rbx, 1
lea eax, [rbx + rbx]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400731b4
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.14005a5d8
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14007323e
cmp byte [rbp - 0x21], r15b
je 0x140073239
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x140073274
call fcn.140067018
test eax, eax
jne 0x140073260
cmp byte [rbp - 0x21], r15b
je 0x140073258
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x140073274
cmp byte [rbp - 0x21], r15b
je 0x140073271
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140060f54
test eax, eax
jne 0x140073314
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.14005a5d8
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x1400732b3
cmp byte [rbp - 0x21], r15b
je 0x1400732e8
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x1400732e8
call fcn.140067018
test eax, eax
jne 0x1400732d4
cmp byte [rbp - 0x21], r15b
je 0x1400732cd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x1400732e8
cmp byte [rbp - 0x21], r15b
je 0x1400732e5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140060f54
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140073314
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x140073317
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140073325
mov rcx, rdi
call fcn.1400640f4
cmp byte [rbp + 0x3f], r15b
je 0x140073334
mov rcx, qword [rbp + 0x27]
call fcn.1400640f4
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x100017460
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x10001a100]
jne 0x10001747b
rol rcx, 0x10
test cx, 0xffff
jne 0x100017477
ret 0
ror rcx, 0x10
jmp 0x1000178ac
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x10001d160]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x10001d258]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x100017931
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x10001d160]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x100017953
mov rax, qword [rsp + 0x88]
mov qword [0x10001d258], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x10001d1f8], rax
mov rax, qword [0x10001d258]
mov qword [0x10001d0d0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x10001d1e0], rax
mov dword [0x10001d0c0], 0xc0000409
mov dword [0x10001d0c4], 1
mov rax, qword [0x10001a100]
mov qword [rsp + 0x68], rax
mov rax, qword [0x10001a108]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1000015d0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x100017748
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100017795
cmp rcx, 0xffffffffffffffff
je 0x100017795
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10001778d
cmp dword [rcx + 0x3c], edx
jl 0x10001778d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10001778d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100017795
mov rax, rdx
add rsp, 0x18
ret

Function at 0x180024200
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180024228
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180024228
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x18002a810
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
test edx, edx
je 0x18002a82d
mov eax, 1
cmp edx, eax
jne 0x18002a882
mov qword [0x180075668], rcx
add rsp, 0x28
ret
cmp qword [0x180060a70], 0
je 0x18002a87d
cmp qword [0x180060a78], 8
mov qword [rsp + 0x20], rbx
lea rbx, [0x180060a60]
mov rcx, rbx
cmovae rcx, qword [0x180060a60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp qword [0x180060a78], 8
cmovae rbx, qword [0x180060a60]
xor eax, eax
mov qword [0x180060a70], rax
mov word [rbx], ax
mov rbx, qword [rsp + 0x20]
mov eax, 1
add rsp, 0x28
ret

Function at 0x1400028c0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xd0
invalid
invalid
Function at 0x140d59160
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140d592e7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140d59191
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d59177
add dl, dl
jne 0x140d5919e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d591fe
xor eax, eax
add dl, dl
jne 0x140d591ad
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d592b5
add dl, dl
jne 0x140d591be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d591cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d591d8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d591e5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140d591f2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140d59186
mov eax, 1
add dl, dl
jne 0x140d5920e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d5921b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d59203
sub eax, ebx
mov ebx, 1
jne 0x140d59254
mov ecx, 1
add dl, dl
jne 0x140d59236
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d59243
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d5922b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d59186
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140d59270
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d5927d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d59265
cmp eax, 0x7d00
jae 0x140d592a3
cmp eax, 0x500
jb 0x140d5929e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d59186
cmp eax, 0x7f
ja 0x140d592a6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d59186
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140d592da
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140d59186
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14016077a
Capabilities:
Encode data using xor

Disassembly:
pop rsi
not eax
call fcn.1401601c6
lea rsi, [0x140172110]
lea rsp, [rsp + 8]
mov edi, 0x979ee510
lea rdi, [rdi + rdi - 0x7c9356c]
shr rdi, 0xb2
xor dil, byte [rbx + rdi]
push 0xffffffffdf1a4bac
xor edi, eax
push 0xffffffff818bcc98
and edi, 0xff
mov edi, dword [rsi + rdi*4]
shr eax, 8
xor eax, edi
inc rbx
xor eax, 0x8c347e28
dec rdx
lea rsp, [rsp + 0x10]
jne 0x140160786
jmp 0x1401579ca

Function at 0x14016c6bb
Capabilities:
Encode data using xor

Disassembly:
movzx r9d, byte [rcx]
jmp 0x140156c62
xor r9d, edx
push 0x4f0ed880
and r9d, 0xff
mov r9d, dword [rsi + r9*4]
call fcn.14016c6bb
inc dword [rsp + 0xb]
shr edx, 8
xor edx, r9d
inc rcx
xor edx, 0xcc365b20
dec r11
lea rsp, [rsp + 0x10]
jne 0x14014203d
Function at 0x140005b40
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov dword [rcx + 0x4c], 0x67452301
mov byte [rcx], al
mov rbx, rcx
mov qword [rcx + 0x44], rax
mov dword [rcx + 0x50], 0xefcdab89
mov dword [rcx + 0x54], 0x98badcfe
mov dword [rcx + 0x58], 0x10325476
call fcn.140029998
mov rcx, rbx
call fcn.140015168
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140006128
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x140006142
mov rax, rcx
mov edx, 5
xor byte [rax], 0x48
inc rax
sub rdx, 1
jne 0x140006136
mov rax, rcx
ret

Function at 0x140006674
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072818]
mov edx, 4
mov dword [rbp - 0x20], 0x292d3a0b
mov dword [rbp - 0x1c], 0x3a182d3c
mov rcx, qword [rax + rcx*8]
mov dword [rbp - 0x18], 0x3b2d2b27
mov word [rbp - 0x14], 0x93b
mov eax, dword [rdx + rcx]
cmp dword [0x140071bc8], eax
jg 0x1400066e2
lea rax, [0x140071bb8]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140030560
add rsp, 0x40
pop rbp
ret
lea rcx, [0x140071bc8]
call fcn.140030350
cmp dword [0x140071bc8], 0xffffffff
jne 0x1400066c9
mov eax, dword [rbp - 0x18]
lea rcx, [0x140055940]
movsd xmm0, qword [rbp - 0x20]
mov dword [0x140071bc0], eax
movzx eax, word [rbp - 0x14]
mov word [0x140071bc4], ax
movsd qword [0x140071bb8], xmm0
mov byte [0x140071bc6], 0x48
call fcn.14002ff44
lea rcx, [0x140071bc8]
call fcn.1400302f0
jmp 0x1400066c9

Function at 0x14000673c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
movaps xmmword [rsp + 0x50], xmm6
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp - 0x20], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072818]
movdqa xmm6, xmmword [0x140059470]
mov edx, 4
mov dword [rbp - 0x30], 0x2665683c
mov rcx, qword [rax + rcx*8]
mov dword [rbp - 0x2c], 0x76687e68
mov dword [rbp - 0x28], 0x243d2668
mov word [rbp - 0x24], 0x6e68
mov eax, dword [rdx + rcx]
cmp dword [0x1400715cc], eax
jg 0x1400067bc
lea rax, [0x1400713c8]
mov rcx, qword [rbp - 0x20]
xor rcx, rsp
call fcn.140030560
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbp
ret
lea rcx, [0x1400715cc]
call fcn.140030350
cmp dword [0x1400715cc], 0xffffffff
jne 0x14000679e
mov eax, dword [rbp - 0x28]
lea rcx, [0x140055960]
movsd xmm0, qword [rbp - 0x30]
mov dword [0x1400713e0], eax
movzx eax, word [rbp - 0x24]
mov word [0x1400713e4], ax
movups xmmword [0x1400713c8], xmm6
mov byte [0x1400713e6], 0x48
movsd qword [0x1400713d8], xmm0
call fcn.14002ff44
lea rcx, [0x1400715cc]
call fcn.1400302f0
jmp 0x14000679e
Function at 0x1400068b4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072818]
mov edx, 4
mov dword [rbp - 0x20], 0x67682c3a
mov dword [rbp - 0x1c], 0x3967683b
mov rcx, qword [rax + rcx*8]
mov word [rbp - 0x18], 0x4868
mov eax, dword [rdx + rcx]
cmp dword [0x140071af4], eax
jg 0x14000691b
lea rax, [0x140071ae8]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140030560
add rsp, 0x40
pop rbp
ret
lea rcx, [0x140071af4]
call fcn.140030350
cmp dword [0x140071af4], 0xffffffff
jne 0x140006902
movsd xmm0, qword [rbp - 0x20]
lea rcx, [0x140055998]
movzx eax, word [rbp - 0x18]
movsd qword [0x140071ae8], xmm0
mov word [0x140071af0], ax
call fcn.14002ff44
lea rcx, [0x140071af4]
call fcn.1400302f0
jmp 0x140006902

Function at 0x140006f0c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x58]
movdqa xmm0, xmmword [0x140059270]
movdqa xmm1, xmmword [0x1400593d0]
mov ecx, dword [0x140072818]
mov r8d, 4
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x140059260]
mov rdx, qword [rax + rcx*8]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x1400592a0]
movdqa xmmword [rbp - 0x40], xmm0
mov eax, dword [r8 + rdx]
cmp dword [0x140071ab0], eax
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x20], 0x213b3a2d
mov dword [rbp - 0x1c], 0x1a142627
mov dword [rbp - 0x18], 0x6768263d
mov word [rbp - 0x14], 0x683e
mov byte [rbp - 0x12], 0x48
jg 0x140006fba
lea rax, [0x140071a60]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140030560
add rsp, 0x80
pop rbp
ret
lea rcx, [0x140071ab0]
call fcn.140030350
cmp dword [0x140071ab0], 0xffffffff
jne 0x140006f9e
lea rdx, [rbp - 0x60]
lea rcx, [0x140071a60]
call fcn.140005a60
lea rcx, [0x140055a6c]
call fcn.14002ff44
lea rcx, [0x140071ab0]
call fcn.1400302f0
jmp 0x140006f9e

Function at 0x140007d08
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x14006f998]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword gs:[0x58]
mov ecx, dword [0x140072818]
mov edx, 4
mov dword [rbp - 0x20], 0x3c262d3b
mov dword [rbp - 0x1c], 0x242d2621
mov rcx, qword [rax + rcx*8]
mov dword [rbp - 0x18], 0x482d2627
mov eax, dword [rdx + rcx]
cmp dword [0x14007171c], eax
jg 0x140007d70
lea rax, [0x140071710]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140030560
add rsp, 0x40
pop rbp
ret
lea rcx, [0x14007171c]
call fcn.140030350
cmp dword [0x14007171c], 0xffffffff
jne 0x140007d57
movsd xmm0, qword [rbp - 0x20]
lea rcx, [0x140055c40]
mov eax, dword [rbp - 0x18]
movsd qword [0x140071710], xmm0
mov dword [0x140071718], eax
call fcn.14002ff44
lea rcx, [0x14007171c]
call fcn.1400302f0
jmp 0x140007d57