joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff344760f8
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x490
mov rax, qword [0x7ff34484108]
xor rax, rsp
mov qword [rsp + 0x480], rax
lea rax, [0x7ff34447ac0]
xor r14d, r14d
mov rbx, rdx
mov qword [rsp + 0x50], rax
lea rax, [0x7ff34447ae0]
mov r13, rcx
mov ebp, 0x80004005
mov edi, r14d
lea r12, [rsp + 0x50]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x62]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x60], r14w
call sub.msvcrt.dll_memset
mov r9d, dword [r13 + 8]
mov rdx, qword [r12]
mov rcx, qword [r13]
lea rax, [rsp + 0x48]
or r9d, 1
xor r8d, r8d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x7ff3447623b
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea r8, [0x7ff34447af8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov r9d, 0x10000002
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x20], r14
call sub.SHLWAPI.dll_SHRegGetValueW
mov esi, eax
cmp eax, r14d
jne 0x7ff344761e3
cmp word [rsp + 0x60], r14w
jne 0x7ff3447621b
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov r9d, 2
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x20], r14
call sub.SHLWAPI.dll_SHRegGetValueW
mov esi, eax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, r14d
jne 0x7ff34476236
movzx eax, word [rsp + 0x60]
cmp ax, r14w
jne 0x7ff3447624f
mov ebp, 0x80004005
inc edi
add r12, 8
cmp edi, 2
jae 0x7ff344762ef
jmp 0x7ff34476151
mov ebp, r14d
lea rsi, [rsp + 0x60]
cmp ax, 0x22
jne 0x7ff34476273
lea rdx, [0x7ff34441794]
lea rcx, [rsp + 0x62]
lea rsi, [rsp + 0x62]
call sub.msvcrt.dll_wcstok
mov edi, 0x104
lea rdx, [rsp + 0x270]
mov rcx, rsi
mov r8d, edi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r8d, edi
mov rdx, rbx
dec eax
lea rcx, [rsp + 0x270]
cmp eax, 0x102
jbe 0x7ff344762a6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, edi
jbe 0x7ff344762b7
mov ebp, 8
jmp 0x7ff344762ef
cmp eax, r14d
jne 0x7ff344762ef
sub rsi, rbx
lea rax, [rdi + 0x7ffffefa]
cmp rax, r14
je 0x7ff344762e2
movzx eax, word [rsi + rbx]
cmp ax, r14w
je 0x7ff344762e2
mov word [rbx], ax
add rbx, 2
sub rdi, 1
jne 0x7ff344762bf
cmp rdi, r14
jne 0x7ff344762eb
sub rbx, 2
mov word [rbx], r14w
mov eax, ebp
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.7ff344779c0
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x7ff34476324
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x2c0
mov rax, qword [0x7ff34484108]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rcx, qword [rcx]
lea rax, [rsp + 0x40]
lea rdx, [0x7ff34447b58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor esi, esi
xor r9d, r9d
xor r8d, r8d
mov edi, 0x80004005
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x40], 0x4e
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, edi
cmp eax, 2
cmove ebx, esi
cmp eax, esi
jne 0x7ff3447651d
lea rdx, [0x7ff34447b20]
lea rax, [rsp + 0xa0]
mov r9d, 0x104
lea rcx, [rsp + 0xa0]
mov ebx, esi
sub rdx, rax
mov r8, r9
lea rax, [r8 + 0x7ffffefa]
cmp rax, rsi
je 0x7ff344763dd
movzx eax, word [rdx + rcx]
cmp ax, si
je 0x7ff344763dd
mov word [rcx], ax
add rcx, 2
sub r8, 1
jne 0x7ff344763bb
cmp r8, rsi
jne 0x7ff344763eb
sub rcx, 2
mov ebx, 0x8007007a
cmp ebx, esi
mov word [rcx], si
jl 0x7ff3447651d
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0xa0]
mov rdx, r9
call fcn.7ff3444bbcc
cmp eax, esi
mov ebx, eax
jl 0x7ff3447651d
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0xa0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov ebx, edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x7ff34476517
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, [0x7ff34447b68]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x30], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
cmp eax, esi
jne 0x7ff344764f7
lea rdx, [0x7ff34447b78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x7ff3447650a
mov ecx, dword [rsp + 0x30]
call fcn.7ff3444f574
mov rdi, rax
cmp rax, rsi
je 0x7ff3447650a
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
lea rdx, [0x7ff34447b68]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x7ff344764ed
lea rdx, [0x7ff34447b30]
mov rcx, rdi
call sub.msvcrt.dll__wcsicmp
cmp eax, esi
cmove ebx, esi
mov rcx, rdi
call fcn.7ff3444f5a0
jmp 0x7ff3447650a
lea rdx, [0x7ff34447ba0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
cmove ebx, esi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x7ff3447651d
cmp eax, 2
cmove ebx, esi
mov eax, ebx
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.7ff344779c0
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x7ff3447674c
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rsi, qword [rsp + 0x70]
xor r14d, r14d
mov r12, r8
mov rbp, rdx
mov r13, rcx
cmp rsi, r14
je 0x7ff344768d3
lea ecx, [r14 + 0x48]
call fcn.7ff3444f574
mov rbx, rax
cmp rax, r14
je 0x7ff344767c4
mov qword [rax], r14
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r14
mov qword [rax + 0x20], r14
mov dword [rax + 0x28], r14d
mov dword [rax + 0x2c], r14d
mov dword [rax + 0x30], r14d
mov dword [rax + 0x34], 5
mov dword [rax + 0x38], r14d
mov qword [rax + 0x40], r14
jmp 0x7ff344767c7
mov rbx, r14
cmp rbx, r14
je 0x7ff344768d3
mov edi, r14d
cmp rbp, r14
je 0x7ff344767f6
mov rcx, rbp
call sub.SHLWAPI.dll_StrDupW
mov qword [rbx], rax
neg rax
sbb edi, edi
not edi
and edi, 0x8007000e
jl 0x7ff344768c3
cmp r12, r14
je 0x7ff34476814
mov rcx, r12
call sub.SHLWAPI.dll_StrDupW
mov qword [rbx + 8], rax
neg rax
sbb edi, edi
not edi
and edi, 0x8007000e
cmp edi, r14d
jl 0x7ff344768c3
cmp dword [rsi + 0x48], r14d
je 0x7ff344768b9
mov rax, qword [rsi + 0x28]
cmp rax, r14
je 0x7ff344768b9
lea rcx, [rsi + 0x40]
call rax
cmp dword [rsi + 0x50], r14d
je 0x7ff3447686e
mov rbp, qword [rsi]
jmp 0x7ff34476859
mov rdx, rbx
mov rcx, rbp
call fcn.7ff344753f0
cmp eax, r14d
jne 0x7ff34476860
mov rbp, qword [rbp + 0x40]
cmp rbp, r14
jne 0x7ff34476845
jmp 0x7ff3447686e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, 0x80004005
mov dword [rbp + 0x38], eax
cmp edi, r14d
jl 0x7ff344768a2
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r8, [rbx + 0x30]
lea rdx, [rsp + 0x70]
mov rcx, r13
mov dword [rbx + 0x28], r14d
mov dword [rbx + 0x2c], r14d
mov dword [rbx + 0x38], eax
call fcn.7ff34475a4c
mov r11, qword [rsi]
mov qword [rbx + 0x40], r11
inc dword [rsi + 8]
mov qword [rsi], rbx
cmp dword [rsi + 0x48], r14d
je 0x7ff344768be
mov rax, qword [rsi + 0x18]
cmp rax, r14
je 0x7ff344768be
lea rcx, [rsi + 0x40]
call rax
jmp 0x7ff344768be
mov edi, 0x80004005
cmp edi, r14d
jge 0x7ff344768d3
mov rcx, rbx
call fcn.7ff344766f8
mov rcx, rbx
call fcn.7ff3444f5a0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x7ff344779c0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x7ff34484108]
jne 0x7ff344779db
rol rcx, 0x10
test cx, 0xffff
jne 0x7ff344779d7
ret 0
ror rcx, 0x10
jmp 0x7ff34477df4
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x7ff34484cc0]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x7ff34484db8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x7ff34477e79
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x7ff34484cc0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x7ff34477e9b
mov rax, qword [rsp + 0x88]
mov qword [0x7ff34484db8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x7ff34484d58], rax
mov rax, qword [0x7ff34484db8]
mov qword [0x7ff34484c30], rax
mov rax, qword [rsp + 0x90]
mov qword [0x7ff34484d40], rax
mov dword [0x7ff34484c20], 0xc0000409
mov dword [0x7ff34484c24], 1
mov rax, qword [0x7ff34484108]
mov qword [rsp + 0x68], rax
mov rax, qword [0x7ff34484110]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x7ff344415f0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140001200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rdi, rcx
mov byte [rcx], 0
mov byte [rcx + 4], 1
mov dword [rcx + 8], 0x2d
mov dword [rcx + 0xc], 1
add rcx, 0x10
mov dword [rsp + 0x20], 0xff
mov r9d, 0xc8
xor r8d, r8d
lea edx, [r9 + 0x37]
call fcn.14000b460
mov qword [rdi + 0x14], 1
xor r12d, r12d
mov ecx, 0x3f800000
call fcn.14002fc40
movss dword [rdi + 0x1c], xmm0
mov byte [rdi + 0x20], r12b
lea r14, [rdi + 0x28]
mov qword [rsp + 0x90], r14
movabs rax, 0x82937da1ab6d2025
mov qword [rsp + 0x40], rax
movabs rcx, 0x9f9d198839bf22fa
mov qword [rsp + 0x48], rcx
movabs rax, 0x82931ac8cd034f46
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rcx
movdqa xmm0, xmmword [rsp + 0x30]
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
mov dword [r14], r12d
mov qword [r14 + 8], r12
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], r12
lea rbx, [rsp + 0x30]
movq rax, xmm0
test al, al
je 0x1400012e8
nop dword [rax]
inc rbx
cmp byte [rbx], 0
jne 0x1400012e0
lea rax, [rsp + 0x30]
sub rbx, rax
mov dword [rsp + 0x40], r12d
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r12
lea rdx, [rbx + 1]
test rdx, rdx
je 0x140001320
lea rcx, [rsp + 0x48]
call fcn.140002010
nop word [rax + rax]
rdtsc
shl rdx, 0x20
or rax, rdx
mov rbp, rax
mov dword [rsp + 0x40], ebp
mov r8, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x48]
sub r8, rsi
xor edx, edx
mov rcx, rsi
call fcn.14007b900
mov r8d, r12d
test rbx, rbx
je 0x140001373
mov r9, r12
movzx eax, r8b
add al, al
lea edx, [rax + r8]
add dl, bpl
xor dl, byte [rsp + r9 + 0x30]
mov byte [r9 + rsi], dl
inc r8d
movsxd r9, r8d
cmp r9, rbx
jb 0x140001352
lea rdx, [rsp + 0x48]
lea rcx, [r14 + 8]
call fcn.140001f70
mov eax, dword [rsp + 0x40]
mov dword [r14], eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400013bc
mov rax, qword [rsp + 0x58]
sub rax, rcx
mov rdx, rcx
cmp rax, 0x1000
jb 0x1400013b6
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
ja 0x14000141a
call fcn.14000d9c0
nop
mov dword [rdi + 0x48], r12d
mov qword [rdi + 0x50], r12
mov qword [rdi + 0x58], r12
mov qword [rdi + 0x60], r12
mov qword [rdi + 0x70], r12
mov qword [rdi + 0x68], r12
mov qword [rdi + 0x80], r12
mov qword [rdi + 0x88], r12
mov qword [rdi + 0x90], r12
mov qword [rdi + 0x98], r12
mov qword [rdi + 0xa0], r12
mov qword [rdi + 0xa8], r12
mov rax, rdi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.14007f764
nop
Function at 0x14000b8c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rdx
mov rbp, rcx
mov rdi, qword [rcx + 0x10]
sub rdi, qword [rcx + 8]
je 0x14000b9bc
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x14000b9fd
cmp rdi, 0x1000
jb 0x14000b933
lea rcx, [rdi + 0x27]
cmp rcx, rdi
jbe 0x14000ba03
call fcn.14000d710
test rax, rax
je 0x14000b9f7
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000b93e
mov rcx, rdi
call fcn.14000d710
mov rsi, rax
lea r14, [rsi + rdi]
mov r8, rdi
xor edx, edx
mov rcx, rsi
call fcn.14007b900
mov r8, r14
sub r8, rsi
xor edx, edx
mov rcx, rsi
call fcn.14007b900
xor r8d, r8d
mov rax, qword [rbp + 0x10]
sub rax, qword [rbp + 8]
cmp rax, 1
je 0x14000b9af
mov r9d, r8d
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rbp + 8]
movzx eax, r8b
add al, al
lea ecx, [rax + r8]
add cl, byte [rbp]
xor cl, byte [rdx + r9]
mov byte [r9 + rsi], cl
inc r8d
mov rax, qword [rbp + 0x10]
sub rax, qword [rbp + 8]
movsxd r9, r8d
dec rax
cmp r9, rax
jb 0x14000b980
mov qword [rbx], rsi
mov qword [rbx + 8], r14
mov qword [rbx + 0x10], r14
jmp 0x14000b9d9
mov ecx, 1
call fcn.14000d710
lea rcx, [rax + 1]
xor edx, edx
mov byte [rax], dl
mov qword [rbx], rax
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rcx
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
call fcn.14007f764
int3
call fcn.140001ed0
int3
call fcn.140001160
int3
Function at 0x14001ba90
Capabilities:
Get windows directory from kuser_shared_data

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rbp
push rdi
push r14
lea rbp, [rax - 0x228]
sub rsp, 0x310
xor r14d, r14d
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
mov ecx, 0x7f7fffff
mov qword [rsp + 0x30], r14
xorps xmm7, xmm7
mov qword [rsp + 0x38], r14
movaps xmm6, xmm2
mov dword [rsp + 0x40], r14d
mov rsi, rdx
mov byte [rsp + 0x60], r14b
mov dword [rsp + 0x64], r14d
call fcn.14002fc40
mov ecx, 0x3f800000
movss dword [rsp + 0x68], xmm0
mov byte [rsp + 0x6c], r14b
mov dword [rsp + 0x70], r14d
call fcn.14002fc40
mov ecx, 0x3f733333
mov qword [rsp + 0x78], r14
mov byte [rsp + 0x4c], 1
mov dword [rsp + 0x44], 1
mov dword [rsp + 0x48], 1
call fcn.14002fc40
movss dword [rsp + 0x74], xmm0
lea rcx, [rbp - 0x20]
movabs rax, 0x74c6523138cbdee5
xor edx, edx
mov qword [rbp - 0x80], rax
mov r8d, 0x200
movabs rax, 0xb538b4c408c995de
mov qword [rbp - 0x78], rax
movabs rax, 0x74a8525e388ddeb9
movdqa xmm0, xmmword [rbp - 0x80]
mov qword [rsp + 0x20], rax
movabs rax, 0xb538b49808ba95aa
mov qword [rsp + 0x28], rax
pxor xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
call fcn.14007b900
lea rax, [rbp - 0x20]
mov rbx, 0xffffffffffffffff
mov qword [rbp + 0x1e0], rax
mov edx, 0x7ffe0030
mov rdi, rbx
inc rdi
cmp word [rdx + rdi*2], r14w
jne 0x14001bba2
add rdi, rdi
lea rcx, [rbp - 0x20]
mov r8, rdi
call fcn.14007b250
mov rcx, qword [rbp + 0x1e0]
lea rax, [rsp + 0x20]
add rcx, rdi
mov rdi, rbx
mov qword [rbp + 0x1e0], rcx
inc rdi
cmp word [rax + rdi*2], r14w
jne 0x14001bbd4
add rdi, rdi
lea rdx, [rsp + 0x20]
mov r8, rdi
call fcn.14007b250
mov rcx, qword [rbp + 0x1e0]
add rcx, rdi
mov qword [rbp + 0x1e0], rcx
nop
inc rbx
cmp word [rsi + rbx*2], r14w
jne 0x14001bc00
add rbx, rbx
mov rdx, rsi
mov r8, rbx
call fcn.14007b250
add qword [rbp + 0x1e0], rbx
lea r8, [rbp + 0x238]
mov r9b, 1
mov qword [rbp + 0x230], r14
lea rdx, [rbp + 0x230]
mov qword [rbp + 0x238], r14
lea rcx, [rbp - 0x20]
call fcn.14002d9c0
mov rdx, qword [rbp + 0x230]
test rdx, rdx
je 0x14001bcbe
mov rcx, qword [rbp + 0x238]
test rcx, rcx
je 0x14001bcbe
movups xmm0, xmmword [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x40]
mov rax, qword [0x1401bf190]
movups xmmword [rbp - 0x70], xmm0
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rbp - 0x60], xmm1
movups xmm1, xmmword [rsp + 0x70]
mov qword [rbp - 0x70], rdx
lea rdx, [rbp - 0x70]
mov dword [rbp - 0x68], ecx
mov rcx, qword [rax + 0x40]
movups xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x40], r14b
movss dword [rbp - 0x60], xmm6
movups xmmword [rbp - 0x50], xmm7
movups xmmword [rbp - 0x30], xmm1
call fcn.140022010
mov rcx, qword [0x1401bf190]
cmp qword [rcx + 0x78], r14
jne 0x14001bcc1
mov qword [rcx + 0x78], rax
jmp 0x14001bcc1
mov rax, r14
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400224f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rdi
mov rdi, rcx
mov qword [rsp + 0x48], r14
movsxd r14, dword [rcx + 0x28]
mov ecx, dword [rcx + 0x2c]
mov qword [rsp + 0x40], r15
movzx r15d, dx
movaps xmmword [rsp + 0x30], xmm6
movaps xmm6, xmm3
lea esi, [r14 + 1]
movaps xmmword [rsp + 0x20], xmm7
movaps xmm7, xmm2
cmp esi, ecx
jle 0x140022591
test ecx, ecx
je 0x14002253f
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x140022544
mov eax, 8
cmp eax, esi
mov ebx, esi
cmovg ebx, eax
cmp ebx, ecx
jle 0x140022591
movsxd rax, ebx
imul rcx, rax, 0x2c
mov qword [rsp + 0x60], rbp
call fcn.14000d710
mov rdx, qword [rdi + 0x30]
mov rbp, rax
test rdx, rdx
je 0x140022585
movsxd rcx, dword [rdi + 0x28]
imul r8, rcx, 0x2c
mov rcx, rax
call fcn.14007b250
mov rcx, qword [rdi + 0x30]
call fcn.14000d9c0
mov qword [rdi + 0x30], rbp
mov rbp, qword [rsp + 0x60]
mov dword [rdi + 0x2c], ebx
movss xmm0, dword [rsp + 0x80]
movss xmm1, dword [rsp + 0x88]
mov dword [rdi + 0x28], esi
mov rsi, qword [rsp + 0x68]
imul rbx, r14, 0x2c
mov r14, qword [rsp + 0x48]
add rbx, qword [rdi + 0x30]
movss dword [rbx + 0x14], xmm0
movss xmm0, dword [rsp + 0x90]
movss dword [rbx + 0x18], xmm1
movss xmm1, dword [rsp + 0x98]
movss dword [rbx + 0x1c], xmm0
movss xmm0, dword [rsp + 0xa0]
movss dword [rbx + 0x20], xmm1
movss xmm1, dword [rsp + 0xa8]
movss dword [rbx + 0x24], xmm0
movss xmm0, dword [rsp + 0xb0]
movss dword [rbx + 0xc], xmm7
movaps xmm7, xmmword [rsp + 0x20]
movss dword [rbx + 0x10], xmm6
movaps xmm6, xmmword [rsp + 0x30]
mov word [rbx + 4], r15w
mov r15, qword [rsp + 0x40]
movss dword [rbx + 0x28], xmm1
mov rax, qword [rdi + 0x50]
addss xmm0, dword [rax + 0x20]
movss dword [rbx + 8], xmm0
mov rax, qword [rdi + 0x50]
cmp byte [rax + 0x1c], 0
je 0x140022658
mov ecx, 0x3f000000
call fcn.14002fc40
addss xmm0, dword [rbx + 8]
cvttss2si eax, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 8], xmm0
mov byte [rdi + 0x64], 1
xor r8d, r8d
mov rdi, qword [rsp + 0x70]
nop dword [rax]
nop dword [rax + rax]
movzx eax, r8b
movsxd rdx, r8d
add al, al
lea ecx, [rax + r8]
inc r8d
add cl, byte [rbx]
xor byte [rdx + rbx + 4], cl
cmp r8d, 0x28
jb 0x140022670
add rsp, 0x50
pop rbx
ret
Function at 0x140028440
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
xor ebp, ebp
mov edi, 0xa6d99f45
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
movups xmm0, xmmword [rax + 0x58]
movups xmmword [rsp + 0x20], xmm0
movd ecx, xmm0
sub cx, 8
test ebp, ebp
je 0x1400284e3
mov r9, qword [rsp + 0x28]
movzx ecx, cx
shr rcx, 1
lea r11, [r9 + rcx*2]
mov r10d, 0x811c9dc5
cmp r9, r11
je 0x1400284da
nop
movsx ecx, byte [r9]
mov edx, ecx
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
add r9, 2
cmp r9, r11
jne 0x1400284b0
cmp r10d, ebp
jne 0x14002863a
mov rbx, qword [rax + 0x30]
test rbx, rbx
je 0x140028642
movsxd rcx, dword [rbx + 0x3c]
mov rdx, qword [rcx + rbx + 0x88]
mov r12, rdx
shr r12, 0x20
mov esi, edx
add rsi, rbx
cmp rsi, rbx
je 0x14002863a
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x14002863a
mov r15d, dword [rsi + 0x20]
dec r11d
lea rcx, [rbx + r11*4]
mov r8d, dword [rcx + r15]
add r8, rbx
mov r10d, 0x811c9dc5
movzx r9d, byte [r8]
inc r8
test r9b, r9b
je 0x14002856d
movsx ecx, r9b
sub r9b, 0x41
mov edx, ecx
or edx, 0x20
cmp r9b, 0x19
cmova edx, ecx
xor edx, r10d
imul r10d, edx, 0x1000193
movzx r9d, byte [r8]
lea r8, [r8 + 1]
test r9b, r9b
jne 0x140028542
cmp r10d, edi
je 0x14002857f
test r11d, r11d
jne 0x140028522
mov rax, qword [rax]
jmp 0x140028480
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
add rax, rbx
cmp rax, rsi
jbe 0x140028644
lea rcx, [rsi + r12]
cmp rax, rcx
jae 0x140028644
mov ebp, 0x811c9dc5
mov edi, ebp
movzx r8d, byte [rax]
cmp r8b, 0x2e
je 0x1400285e9
nop dword [rax]
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, ebp
imul ebp, edx, 0x1000193
inc rax
movzx r8d, byte [rax]
cmp r8b, 0x2e
jne 0x1400285c0
inc rax
movzx r8d, byte [rax]
test r8b, r8b
je 0x140028629
nop word [rax + rax]
movsx ecx, r8b
sub r8b, 0x41
mov edx, ecx
or edx, 0x20
cmp r8b, 0x19
cmova edx, ecx
xor edx, edi
imul edi, edx, 0x1000193
lea rax, [rax + 1]
movzx r8d, byte [rax]
test r8b, r8b
jne 0x140028600
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
jmp 0x140028480
xor eax, eax
lea rcx, [0x140027840]
call rax
mov qword [0x1401bf2b8], rax
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret