joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000fdc0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov r8, qword [0x1403b3790]
movsxd r9, ecx
mov rbx, qword [r8 + 0x3e28]
add rbx, 0xc8
movsxd rdx, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
lea rdx, [0x140083dc0]
not edi
movzx eax, r9b
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp dword [r8 + 0x3e5c], edi
jne 0x14000fe5b
mov r8, r9
mov edx, 4
mov ecx, edi
call fcn.140017f40
mov ecx, dword [rbx + 4]
mov r8d, dword [rbx]
cmp r8d, ecx
jne 0x14000fe8f
inc r8d
test ecx, ecx
je 0x14000fe78
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x14000fe7d
mov eax, 8
cmp eax, r8d
mov rcx, rbx
cmovg r8d, eax
mov edx, r8d
call fcn.140019030
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140011930
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1403b1040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x1403b3790]
mov edi, ecx
cmp byte [rbx + 0x41cd], 0
jne 0x140011991
cmp byte [rbx + 0x41ce], 0
jne 0x140011991
movsx r9d, word [rbx + 0x52ae]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140003070
test dil, 1
je 0x140011ab8
jmp 0x140011a1a
movss xmm1, dword [rbx + 0x3830]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x52ae]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1403a7aa8]
mulss xmm1, dword [0x1403a7a8c]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xd0c]
addss xmm1, dword [rbx + 0xd10]
mov qword [rbx + 0x3f48], rax
mov dword [rbx + 0x3f34], 1
movss dword [rbx + 0x3f40], xmm0
movss dword [rbx + 0x3f44], xmm1
movss xmm0, dword [rbx + 0x388c]
mulss xmm0, dword [0x1403a78ec]
or dword [rbx + 0x3f30], 0x41
movss dword [rbx + 0x3f90], xmm0
call fcn.140003070
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140011a70
lea r11, [0x140083dc0]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140011a53
cmp byte [r8], r9b
jne 0x140011a53
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140011a40
not ecx
call fcn.14000aad0
test rax, rax
je 0x140011ab8
cmp byte [rax + 0x8e], 0
je 0x140011ab8
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x52ae]
mov edx, 0x10
movsx r9d, word [rbx + 0x52ae]
call fcn.140003070
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000d160
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140080a20
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140016ca0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5360], 0
lea rbx, [rcx + 0x5368]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140016d47
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x140016cfa
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140018e00
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140003a60
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5360]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5370]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1403b3788]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x140016d4f
mov rcx, rbx
call fcn.140003a60
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140046410
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1403b1040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r8, rcx
test al, al
je 0x140046450
cmp al, 0x25
jne 0x140046444
cmp byte [r8 + 1], al
jne 0x140046450
inc r8
movzx eax, byte [r8 + 1]
inc r8
test al, al
jne 0x140046437
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x1400465ba
cmp byte [r8 + 1], dl
je 0x1400465ba
lea r11, [rsp + 0x20]
mov r9, r8
nop
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x14004648d
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x1400464b5
sub dl, 0x61
cmp dl, 0x19
ja 0x1400464a7
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x1400464b5
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x140046470
jmp 0x1400464b8
inc r9
cmp r8, r9
jae 0x1400464ef
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x1400464e4
bt rdx, rax
jb 0x1400464ea
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x1400464d0
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.140003070
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x140046528
nop
inc rcx
cmp byte [rcx], 0x20
je 0x140046520
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x1400465a8
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x14004654a
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, r8b
cmp r8b, 0x2b
jne 0x140046558
movzx eax, byte [rcx + 1]
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
cmp al, 0x30
jl 0x140046596
movss xmm2, dword [0x1403a7a94]
nop
cmp al, 0x39
ja 0x140046596
movzx eax, al
inc rdx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x140046570
cmp r9b, 0x2d
jne 0x1400465b5
xorps xmm1, xmmword [0x1403a7e30]
movaps xmm0, xmm1
jmp 0x1400465bd
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x1400465bd
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140080a20
add rsp, 0x90
pop rbx
ret
Function at 0x140046c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1403b1040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r8, rcx
test al, al
je 0x140046c40
cmp al, 0x25
jne 0x140046c34
cmp byte [r8 + 1], al
jne 0x140046c40
inc r8
movzx eax, byte [r8 + 1]
inc r8
test al, al
jne 0x140046c27
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x140046da4
cmp byte [r8 + 1], dl
je 0x140046da4
lea r11, [rsp + 0x20]
mov r9, r8
nop
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x140046c7d
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x140046ca5
sub dl, 0x61
cmp dl, 0x19
ja 0x140046c97
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x140046ca5
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x140046c60
jmp 0x140046ca8
inc r9
cmp r8, r9
jae 0x140046cdf
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x140046cd4
bt rdx, rax
jb 0x140046cda
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x140046cc0
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.140003070
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x140046d18
nop dword [rax + rax]
inc rcx
cmp byte [rcx], 0x20
je 0x140046d10
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x140046d96
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x140046d3a
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, r8b
cmp r8b, 0x2b
jne 0x140046d48
movzx eax, byte [rcx + 1]
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
cmp al, 0x30
jl 0x140046d84
movsd xmm2, qword [0x1403a7a10]
nop
cmp al, 0x39
ja 0x140046d84
movzx eax, al
inc rdx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x140046d60
cmp r9b, 0x2d
jne 0x140046d9f
xorps xmm1, xmmword [0x1403a7e20]
movaps xmm0, xmm1
jmp 0x140046da7
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x140046da7
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140080a20
add rsp, 0x90
pop rbx
ret
Function at 0x1400588c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov ebp, ecx
lea rcx, [rdx + 0x20]
call fcn.140058860
mov rcx, qword [0x1403b3ab0]
mov r15, rax
lea rdx, [rax + 0x18]
call fcn.14007d5d0
mov rcx, qword [0x1403b3ab0]
mov rdi, rax
movzx r8d, al
add r8, 0x31
lea rdx, [rax + 0x131]
and r8d, 0x7f
mov r9, qword [rcx + 0x21]
shr rdx, 7
and edx, 7
add rdx, r9
lea rbx, [r9 + 0x794432]
lea r14, [rbx + 8]
lea rdx, [rdx + r8*8]
add rdx, 0x3808640
call fcn.14007d5d0
movabs rcx, 0xdf9dc69b9e06d531
mov rsi, rax
add rcx, rdi
xor rsi, rcx
xor rsi, rbx
cmp rbx, r14
jae 0x14005897b
nop word [rax + rax]
mov rcx, qword [0x1403b3ab0]
mov rdx, rbx
call fcn.14007d5d0
xor rsi, rax
add rbx, 8
cmp rbx, r14
jb 0x140058960
mov rcx, qword [0x1403b3ab0]
lea rdx, [r15 + 0x10]
xor ebp, esi
xor ebp, r14d
xor ebp, 0x61f92ace
mov r8d, ebp
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp fcn.14007d790
Function at 0x1400815c4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14008160e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14008160e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14008160e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14008160e
cmp dword [rcx + 0x84], 0xe
jbe 0x14008160e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140081610
xor al, al
add rsp, 0x28
ret
Function at 0x140003ca0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140011240]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
lea rcx, [rsp + 0x30]
call fcn.140004140
lea rcx, [rsp + 0x30]
call fcn.140004210
nop
lea rdi, [rbx + 8]
lea rcx, [rsp + 0x30]
call fcn.1400017d0
mov r9, rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
lea r8, [0x140004260]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140003d35
lea rcx, [rsp + 0x30]
call fcn.140004180
nop
lea rcx, [rsp + 0x30]
call fcn.1400041a0
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14000bfc0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x140003ea0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140011240]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
lea rcx, [rsp + 0x30]
call fcn.140004140
lea rcx, [rsp + 0x30]
call fcn.140004460
nop
lea rdi, [rbx + 8]
lea rcx, [rsp + 0x30]
call fcn.1400017d0
mov r9, rax
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
lea r8, [0x140004490]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x140003f35
lea rcx, [rsp + 0x30]
call fcn.140004150
nop
lea rcx, [rsp + 0x30]
call fcn.140004170
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14000bfc0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x14000b040
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rdi, rcx
je 0x14000b0af
mov qword [rsp + 0x30], rbx
xor ebx, ebx
cmp dword [rcx + 0xc], ebx
jbe 0x14000b098
mov qword [rsp + 0x38], rsi
mov r8, qword [rdi]
xor edx, edx
mov r8d, dword [r8 + rbx*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x14000b08c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, dword [rdi + 0xc]
jb 0x14000b060
mov rsi, qword [rsp + 0x38]
mov r8, qword [rdi]
xor edx, edx
mov rcx, qword [0x140011388]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000b170
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
cmp rdi, 0x40000000
jbe 0x14000b1b0
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rsi, qword [0x140011b40]
lea r15, [rdi + 0x40000000]
cmp rcx, r15
cmovbe r15, rcx
sub r15, 0xfff
test rsi, rsi
je 0x14000b1ee
cmp rsi, r14
jb 0x14000b1e6
cmp rsi, r15
jae 0x14000b1e6
cmp qword [rsi + 8], 0
jne 0x14000b3b7
mov rsi, qword [rsi]
test rsi, rsi
jne 0x14000b1d1
mov qword [rsp + 0xa0], rbx
mov rbx, rdi
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0xb0], r12
mov r12d, 0x40
cmp rdi, r14
jb 0x14000b282
nop dword [rax]
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
mov rax, rbx
xor edx, edx
div rbp
sub rbx, rdx
sub rbx, rbp
cmp rbx, r14
jb 0x14000b279
nop word [rax + rax]
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000b279
cmp dword [rsp + 0x70], 0x10000
je 0x14000b2fb
mov rbx, qword [rsp + 0x58]
cmp rbx, rbp
jb 0x14000b279
sub rbx, rbp
cmp rbx, r14
jae 0x14000b240
test rsi, rsi
jne 0x14000b360
cmp rdi, r15
ja 0x14000b39f
nop dword [rax + rax]
mov ebp, dword [rsp + 0x48]
xor edx, edx
mov rax, rdi
mov ebx, ebp
div rbp
mov eax, ebp
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r15
ja 0x14000b39f
mov r8d, 0x30
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000b39f
cmp dword [rsp + 0x70], 0x10000
je 0x14000b331
xor edx, edx
lea edi, [rbp - 1]
add rdi, qword [rsp + 0x68]
add rdi, qword [rsp + 0x50]
mov rax, rdi
div rbx
sub rdi, rdx
cmp rdi, r15
jbe 0x14000b2b2
jmp 0x14000b39f
test rbx, rbx
je 0x14000b279
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x14000b360
cmp rbx, r14
jae 0x14000b220
jmp 0x14000b282
test rdi, rdi
je 0x14000b39f
mov r9d, r12d
mov edx, 0x1000
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
test rax, rax
jne 0x14000b360
cmp rdi, r15
jbe 0x14000b290
jmp 0x14000b39f
xor edx, edx
lea rcx, [rsi + 0x40]
mov dword [rsi + 0x10], edx
nop dword [rax]
mov qword [rcx], rdx
mov rax, rcx
mov qword [rsi + 8], rcx
add r12, 0x40
add rcx, 0x40
mov rdx, rax
cmp r12, 0xfc0
jbe 0x14000b370
mov rax, qword [0x140011b40]
mov qword [rsi], rax
mov qword [0x140011b40], rsi
mov r12, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov rax, rsi
mov rsi, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
ret
Function at 0x14000cc84
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000ccce
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000ccce
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000ccce
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000ccce
cmp dword [rcx + 0x84], 0xe
jbe 0x14000ccce
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000ccd0
xor al, al
add rsp, 0x28
ret

Function at 0x14003a80c
Capabilities:
Encode data using xor

Disassembly:
push r9
pushfq
sub word [rsp + 0x18], 0x6103
add qword [rsp + 0x20], 0xffffffffbff97966
sub dword [rsp + 0x18], 0x87af6482
mov r9, qword [rsp + 0x18]
mov qword [rsp + 0x20], 0x227f5f55
mov r9, qword [rsp + 8]
jl 0x14003a81f
add qword [rsp + 0x18], 0x438cfd9e
test dword [rsp + 0x18], 0xfc0c8634
push qword [rsp]
popfq
lea rsp, [rsp + 0x20]
call fcn.140057651
mov qword [rsp + 8], 0x6a7929ef
lea rsp, [rsp + 8]
call fcn.140063fd8
sub eax, 0xa2416957
enter 0x653b, 0xffffffffffffffa7
xchg ebx, eax
invalid
Function at 0x140069327
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp bl, 0xb9
call fcn.14002c57e
jmp 0x140069327
mov qword [rsp + 8], rbx
xor bl, 0x91
cmovbe rbx, rdi
mov qword [rsp + 0x10], rbp
btr ebx, r15d
bts bx, r15w
mov qword [rsp + 0x18], rsi
dec rbx
jmp 0x14006934e
mov qword [rsp + 0x20], rdi
clc
or ebx, 0xb1bad78f
xor esi, r14d
push r14
sub rsp, 0x30
neg r14b
shr rbx, 0x83
ror sil, 0x10
sub ebp, ebp
sar r14, 0xa2
clc
rcl rsi, cl
mov esi, edx
btc r14, 0x13
or bh, 0x3a
mov ebx, ebp
xor eax, eax
mov rdi, rcx
jmp 0x140069396
mov r14d, 1
cmp edx, r15d
test r8w, r8w
jmp 0x1400693a8
lock cmpxchg dword [0x140011380], r14d
jmp 0x1400693b6
je 0x14006940e
cmp rbx, 0x20
jmp 0x1400693c5
jae 0x1400693d7
sub ecx, ecx
jmp 0x1400693d2
jmp 0x1400693df
mov ecx, r14d
jmp 0x1400693df
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
test r11w, 0x1aaf
cmp r14, 0x13030cac
sub eax, eax
test esi, r11d
lock cmpxchg dword [0x140011380], r14d
jmp 0x140069408
jne 0x1400693bc
cmp qword [0x140011388], rbp
je 0x140069531
test rdi, rdi
jmp 0x140069423
jne 0x14006943c
mov ecx, esi
call fcn.14000a620
mov ebx, eax
jmp 0x140069437
jmp 0x140069546
mov ecx, dword [0x140011b5c]
mov ebx, ebp
stc
cmc
test ecx, ecx
jmp 0x14006944d
je 0x14006947d
mov r8, qword [0x140011b50]
and ah, 0x15
mov rax, r8
nop dword [rax]
cmc
clc
cmp rdi, qword [rax]
je 0x14006948c
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x140069466
mov ebx, 4
jmp 0x140069487
jmp 0x140069546
cmp ebx, 0xffffffff
jmp 0x140069494
je 0x14006947d
mov eax, ebx
imul rdx, rax, 0x38
movzx ax, r8b
movzx eax, byte [rdx + r8 + 0x20]
shr eax, 1
test r9, 0xffffffff859a23af
test rdx, rsi
and eax, r14d
cmp rcx, r8
stc
cmp eax, esi
jmp 0x1400694c5
je 0x140069524
mov r8d, r14d
movzx rcx, di
jmp 0x1400694d7
lea rcx, [rsp + 0x20]
movsx edx, bx
movzx edx, ax
mov edx, ebx
jmp 0x1400694e9
call fcn.14000a9a0
mov edx, esi
bswap cx
movsx ecx, bp
movsx rcx, r12w
mov ecx, ebx
jmp 0x140069501
call fcn.14006958f
lea rcx, [rsp + 0x20]
movsx ebx, sp
jmp 0x140069513
mov ebx, eax
jmp 0x14006951a
call fcn.14000b040
jmp 0x140069546
neg esi
sbb ebx, ebx
clc
add ebx, 6
jmp 0x140069546
mov ebx, 2
mov esi, 0xb3b29e2f
shrd ax, r12w, 0x22
movzx di, r13b
xchg dword [0x140011380], ebp
xadd r14w, ax
bt r14, rbp
mov rbp, qword [rsp + 0x48]
rcr sil, cl
mov eax, ebx
mov rbx, qword [rsp + 0x40]
rcl dil, 0x9a
inc esi
mov rsi, qword [rsp + 0x50]
sal dil, 0x99
stc
mov rdi, qword [rsp + 0x58]
xadd r14b, r14b
add rsp, 0x30
cmovns r14d, esi
not r14b
movzx r14d, bp
pop r14
ret
Function at 0x14006958f
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
movsx rax, bx
shld r9w, r12w, 0x1a
clc
mov qword [rsp + 0x18], rbp
or ebp, eax
ror ah, 0x99
rcl al, 0xb1
mov qword [rsp + 0x20], rsi
test r12b, r14b
add r9d, 0x4c2ea200
push rdi
adc si, 0xff0c
sbb sil, r11b
sub rsp, 0x20
lahf
mov eax, ecx
setge bl
lea r9, [rsp + 0x30]
ror di, cl
shr si, cl
imul rbx, rax, 0x38
adc ch, 0x83
mov esi, edx
clc
add rbx, qword [0x140011b50]
mov r8, qword [rbx]
bt ax, r14w
movzx eax, byte [rbx + 0x20]
sal edi, cl
and al, 1
mov dil, 0x98
movsx rdx, r11w
movzx ecx, al
movzx edx, r12w
cwd
cdq
lea rdi, [r8 - 5]
not bpl
movzx edx, bx
cmove rdi, r8
movsx r8, r11w
xchg bpl, dl
movsx r8d, r8w
mov r8d, 0x40
movsx rbp, r8w
xchg bpl, dl
mov bpl, r9b
lea rbp, [rcx*2 + 5]
movzx rdx, r14w
setle cl
cwd
mov rcx, rdi
movzx dx, spl
movsx edx, si
not dh
mov rdx, rbp
jmp 0x14006965a
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jmp 0x140069667
jne 0x140069677
mov eax, 0xa
jmp 0x1400697a4
test esi, esi
jmp 0x14006967e
je 0x1400696c3
mov byte [rdi], 0xe9
add al, 0xac
bswap eax
mov eax, dword [rbx + 8]
cmp r13w, r15w
sub eax, edi
jmp 0x14006969c
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x140069714
mov rax, qword [rbx]
jmp 0x1400696b4
mov word [rax], 0xf9eb
jmp 0x1400696be
jmp 0x140069714
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
jmp 0x1400696cf
mov dword [rdi], eax
jmp 0x1400696d6
je 0x1400696ff
movzx eax, word [rbx + 0x1c]
jmp 0x1400696e5
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
jmp 0x1400696f2
mov byte [rdi + 6], al
jmp 0x1400696fa
jmp 0x140069714
movzx eax, byte [rbx + 0x1c]
mov cl, 0x1b
not r9
cwd
mov byte [rdi + 4], al
xchg dl, r9b
setle r8b
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
movsx dx, spl
mov dx, di
bswap dx
mov rdx, rbp
movsx rcx, si
mov rcx, rdi
jmp 0x140069738
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
movsx rcx, ax
movzx rdx, cx
movzx ecx, r9w
mov rdx, rdi
mov rcx, rax
jmp 0x14006975e
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx ecx, sil
sub bp, di
not bpl
shl sil, 2
movsx edi, r13w
add cl, cl
bt bp, si
xor cl, byte [rbx + 0x20]
and cl, 2
xor cl, byte [rbx + 0x20]
xor sil, cl
btc di, r10w
and sil, 4
sar di, cl
xor sil, cl
mov byte [rbx + 0x20], sil
sub eax, eax
shr dil, 0x90
sar sil, cl
mov rbx, qword [rsp + 0x38]
cmp r15b, 0x96
cmovge rdi, r12
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
clc
add rsp, 0x20
seto dil
pop rdi
jmp 0x1400697ca
ret
Function at 0x140003820
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, qword [rcx]
mov qword [rsp + 0x50], rbx
movsxd rdx, dword [rdx]
mov rcx, qword [rbx + 0x18]
mov rcx, qword [rcx + 0x40]
call fcn.14003dd80
mov rdx, rax
mov rcx, qword [rbx + 0x10]
test byte [rax + 8], 0xf
jne 0x140003867
mov byte [rcx + 8], 0
jmp 0x140003874
mov rax, qword [rax]
mov qword [rcx], rax
movzx eax, byte [rdx + 8]
mov byte [rcx + 8], al
add qword [rbx + 0x10], 0x10
mov edx, 0xffffffff
mov rcx, rbx
call fcn.1400123e0
mov r10, rax
mov r13, rax
shr r13, 0x38
mov rcx, rax
shr rcx, 0x30
movzx r12d, cl
mov rcx, rax
shr rcx, 0x28
movzx r14d, cl
mov rdx, rax
shr rdx, 0x20
movzx ebp, dl
mov rdx, rax
shr rdx, 0x18
movzx esi, dl
shr rax, 0x10
movzx edi, al
mov rax, r10
shr rax, 8
movzx ebx, al
movzx r15d, r10b
mov edx, 0xfffffffe
mov rcx, qword [rsp + 0x50]
call fcn.140011e10
nop
movabs rax, 0xcbf29ce484222325
xor r15, rax
movabs rax, 0x100000001b3
imul r15, rax
xor r15, rbx
imul r15, rax
xor r15, rdi
imul r15, rax
xor r15, rsi
imul r15, rax
xor r15, rbp
imul r15, rax
xor r15, r14
imul r15, rax
xor r15, r12
imul r15, rax
xor r15, r13
imul rax, r15
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret