joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001f310
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push r14
push r15
sub r12, r12
add r12, 0x60
mov r14, qword gs:[r12]
push r11

Function at 0x140ac1058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140ac11df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140ac1089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ac106f
add dl, dl
jne 0x140ac1096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ac10f6
xor eax, eax
add dl, dl
jne 0x140ac10a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140ac11ad
add dl, dl
jne 0x140ac10b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ac10c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ac10d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ac10dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140ac10ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140ac107e
mov eax, 1
add dl, dl
jne 0x140ac1106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140ac1113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ac10fb
sub eax, ebx
mov ebx, 1
jne 0x140ac114c
mov ecx, 1
add dl, dl
jne 0x140ac112e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140ac113b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ac1123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ac107e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140ac1168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140ac1175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140ac115d
cmp eax, 0x7d00
jae 0x140ac119b
cmp eax, 0x500
jb 0x140ac1196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ac107e
cmp eax, 0x7f
ja 0x140ac119e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140ac107e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140ac11d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140ac107e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140025d20
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x140025e06
xchg r10, rbx
mov qword [rsp + 0x10], r10
xchg rbx, r10
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
mov rbx, rdx
xchg r15, rdi
mov r15, rcx
xchg r15, rdi
mov esi, r8d
sub rdi, rdx
xchg r10, rcx
mov rbp, r10
xchg r10, rcx
add rdi, 0x3c0b922d
sub rdi, 0x3c0b913d
dec rsi
shr rsi, 3
shr rsi, 1
inc rsi
nop dword [rax]
xchg r10, rbx
movups xmm0, xmmword [r10]
xchg rbx, r10
xchg r10, rbp
mov rdx, r10
xchg r10, rbp
mov rcx, rbx
call fcn.140026310
mov ecx, 0x10
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140025da9
nop
sub rdi, 0x213fb95f
add rdi, 0x213fb94f
xchg r14, rbp
movups xmmword [r14 + 0xf0], xmm0
xchg r14, rbp
sub rsi, 1
jne 0x140025d7c
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
xchg r14, rbp
mov r14, qword [rsp + 0x40]
xchg r14, rbp
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rsi
ret

Function at 0x140025e10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov edi, r8d
xchg rbx, r10
mov r10, rdx
xchg r10, rbx
lea r9, [rcx + 0xf0]
xchg rcx, rbp
mov rsi, rbp
xchg rcx, rbp
test r8d, r8d
je 0x140025ece
dec rdi
shr rdi, 1
shr rdi, 2
shr rdi, 1
inc rdi
nop dword [rax]
nop word [rax + rax]
xchg r11, rbx
mov rax, r11
xchg rbx, r11
sub r9, rbx
mov edx, 0x10
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140025e85
xchg r9, rdx
mov r9, rsi
xchg rdx, r9
xchg r11, rcx
mov r11, rbx
xchg r11, rcx
call fcn.140025f70
xchg rbp, rbx
mov r9, rbp
xchg rbx, rbp
neg rbx
add rbx, 0xfffffffffffffff0
neg rbx
sub rdi, 1
jne 0x140025e6f
movups xmm0, xmmword [r9]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
xchg rbp, rsi
movups xmmword [rbp + 0xf0], xmm0
xchg rbp, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
push rcx
push rcx
push rdx
push rdx
push rdx
push rcx
push rbx
push rax
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
ret
Function at 0x140027210
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rbx, rdx
push rdi
sub rsp, 0x10
mov rbx, rdx
xchg r14, r10
mov r14, rcx
xchg r14, r10
test r8b, 0xf
je 0x140027252
xor al, al
xchg rbx, r8
mov r8, qword [rsp + 0x20]
xchg r8, rbx
add rsp, 0x10
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret
xor edx, edx
test r8d, r8d
je 0x1400272e3
movdqa xmm2, xmmword [rsp]
nop
xchg r13, rdx
movdqu xmm1, xmmword [r13 + rbx]
xchg r13, rdx
test edx, edx
jne 0x140027286
xchg rbp, r10
movdqu xmm2, xmmword [rbp + 0x200]
xchg rbp, r10
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
xorps xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0xd
nop word [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x1400272a4
aesdeclast xmm0, xmmword [r10 + 0x1e0]
xorps xmm0, xmm2
movdqa xmm2, xmm1
xchg r11, rdx
movups xmmword [r11 + r9], xmm0
xchg r11, rdx
neg edx
add edx, 0xfffffff0
neg edx
cmp edx, r8d
jb 0x140027263
mov rbx, qword [rsp + 0x20]
mov al, 1
add rsp, 0x10
push rax
push rdx
push rcx
push rax
push rcx
push rbx
push rdx
xchg qword [rsp + 0x38], rdi
pop rdx
pop rbx
pop rcx
pop rax
pop rcx
pop rdx
pop rax
add rsp, 8
ret

Function at 0x140027310
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x10
xchg rbx, rdx
mov rdx, rbx
xchg rbx, rdx
xchg r10, rbp
mov rbp, rcx
xchg r10, rbp
test r8b, 0xf
je 0x140027343
xor al, al
add rsp, 0x10
nop
add rsp, 8
xchg qword [rsp - 8], rbx
ret
xor edx, edx
test r8d, r8d
je 0x1400273e5
movdqa xmm0, xmmword [rsp]
xchg r13, rdi
mov qword [rsp + 0x20], r13
xchg r13, rdi
nop dword [rax + rax]
movdqu xmm1, xmmword [rdx + rbx]
test edx, edx
jne 0x14002737e
xchg rdx, r10
movdqu xmm0, xmmword [rdx + 0x200]
xchg r10, rdx
xorps xmm0, xmm1
lea rax, [r10 + 0x10]
xorps xmm0, xmmword [r10 + 0x1e0]
mov ecx, 0xd
nop word [rax + rax]
aesenc xmm0, xmmword [rax]
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x14002739c
aesenclast xmm0, xmmword [r10 + 0xe0]
xchg r12, rdx
movups xmmword [r12 + r9], xmm0
xchg rdx, r12
nop
sub edx, 0x520b530d
add edx, 0x520b531d
cmp edx, r8d
jb 0x140027363
xchg r10, rdi
mov r10, qword [rsp + 0x20]
xchg rdi, r10
mov al, 1
add rsp, 0x10
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
Function at 0x14002a730
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rsi, r12
mov qword [rsp + 0x18], r12
xchg r12, rsi
mov qword [rsp + 0x20], rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
sub rsp, 0x30
xchg r12, rsi
mov r12, rcx
xchg r12, rsi
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x60]
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
xchg rbx, r14
mov qword [rsp + 0x40], r14
xchg r14, rbx
sub rcx, 0x2bc5fabe
add rcx, 0x2bc5fb86
xchg rbx, r11
mov qword [rsp + 0x28], r11
xchg rbx, r11
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.140029db0
test eax, eax
js 0x14002a7cc
cmp qword [rsp + 0x40], rbx
je 0x14002a7cc
lea eax, [rbx + 1]
jmp 0x14002a859
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0x70], 2
jbe 0x14002a7ed
mov eax, 2
jmp 0x14002a859
cmp dword [rcx + 0x74], ebx
jbe 0x14002a800
mov eax, 3
jmp 0x14002a859
cmp byte [rdi + 2], bl
je 0x14002a813
mov eax, 4
jmp 0x14002a859
cmp r14d, 0xa
jb 0x14002a83c
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002a83c
mov eax, 8
jmp 0x14002a859
lea rcx, [rsi + 0xb8]
mov edx, 0x99999999
call fcn.14002a200
jmp 0x14002a857
mov eax, ebx
mov rbx, qword [rsp + 0x48]
xchg r11, rsi
mov r11, qword [rsp + 0x50]
xchg rsi, r11
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
nop
add rsp, 8
xchg qword [rsp - 8], r14
ret
Function at 0x14002c380
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
xchg rsi, rcx
mov rcx, rsi
xchg rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x14002c5ec
lea rax, [rdx - 1]
xchg rdi, r8
mov qword [rsp + 0x38], r8
xchg rdi, r8
xchg rdi, r11
mov r11, qword [rsi + 8]
xchg rdi, r11
or rax, rbx
bsr rcx, rax
mov r8, rdi
xchg r14, rbp
mov qword [rsp + 0x40], rbp
xchg r14, rbp
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.14002bb40
xchg rbx, r10
mov qword [rsi + 0x38], r10
xchg r10, rbx
lea rax, [rbx - 1]
xchg r13, rax
mov qword [rsi + 0x30], r13
xchg r13, rax
xchg rcx, r10
mov r10, qword [rsi + 8]
xchg rcx, r10
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x14002c58e
mov qword [rsp + 0x30], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx r9d, byte [rax + 0x10]
movzx edx, byte [rax + 0x11]
xor r9, rbp
xchg r11, rbp
mov rbp, qword [rsi + 0x30]
xchg rbp, r11
mov rcx, qword [rcx]
imul r9, rbx
xor r9, rdx
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r8, qword [r11]
cmp r8, rdi
jne 0x14002c4a0
xchg rdi, rax
mov qword [r11], rdi
xchg rdi, rax
xchg r15, rax
mov qword [r11 + 8], r15
xchg r15, rax
jmp 0x14002c579
mov rdx, qword [r11 + 8]
movzx r9d, word [rax + 0x10]
cmp r9w, word [rdx + 0x10]
jne 0x14002c510
mov r10, qword [rdx]
cmp r10, rax
je 0x14002c503
mov r9, qword [rax + 8]
mov qword [r9], rcx
xchg rdx, r8
mov rdx, qword [rcx + 8]
xchg r8, rdx
xchg rbp, r10
mov qword [r8], rbp
xchg r10, rbp
mov rdx, qword [r10 + 8]
xchg r9, rax
mov qword [rdx], r9
xchg r9, rax
xchg rdi, r8
mov qword [r10 + 8], rdi
xchg rdi, r8
xchg rdx, r9
mov qword [rcx + 8], rdx
xchg r9, rdx
xchg r13, rdx
mov qword [rax + 8], r13
xchg rdx, r13
xchg r12, rax
mov qword [r11 + 8], r12
xchg r12, rax
jmp 0x14002c579
cmp r8, rdx
je 0x14002c533
nop
mov rdx, qword [rdx + 8]
cmp r9w, word [rdx + 0x10]
je 0x14002c5b1
cmp r8, rdx
jne 0x14002c51b
xchg r10, rbp
mov rbp, qword [rax + 8]
xchg r10, rbp
xchg rbp, rcx
mov qword [r10], rbp
xchg rbp, rcx
mov r9, qword [rcx + 8]
xchg rdx, r12
mov qword [r9], r12
xchg r12, rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
xchg r10, r14
mov qword [rcx + 8], r14
xchg r10, r14
xchg r11, r8
mov qword [rax + 8], r11
xchg r11, r8
xchg r15, rax
mov qword [r11], r15
xchg r15, rax
xchg r14, rax
mov r14, rcx
xchg r14, rax
cmp rcx, rdi
jne 0x14002c451
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
xchg r14, rdx
mov rdx, qword [rsp + 0x40]
xchg r14, rdx
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
nop
mov rsi, qword [rsp]
add rsp, 8
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
xchg r13, r8
mov r13, qword [rcx + 8]
xchg r13, r8
xchg r10, rdx
mov qword [r8], rdx
xchg rdx, r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
xchg r8, r12
mov qword [r10 + 8], r12
xchg r8, r12
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14002c579
lea rcx, [0x140001530]
call fcn.14014f330
int3
Function at 0x14005c880
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
mov r8d, 0xffffffff
test rcx, rcx
je 0x14005c8fc
cmp byte [rcx], 0
je 0x14005c8fc
test rdx, rdx
jne 0x14005c8ae
mov rdx, 0xffffffffffffffff
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x14005c8a0
test rdx, rdx
je 0x14005c8f9
xor r10d, r10d
lea r11, [0x140002db0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
xor rcx, rax
shr r8d, 1
shr r8d, 4
shr r8d, 1
shr r8d, 2
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x14005c8c0
not r8d
mov eax, r8d
ret

Function at 0x14005fc70
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg r8, rcx
mov rdx, r8
xchg rcx, r8
test rax, rax
jne 0x14005fc89
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14005fcb6
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14005fcb3
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14005fc97
mov rax, qword [rdx + 0x10]
mov byte [rdx], 1
ret

Function at 0x14005fcc0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg rdx, rcx
mov rcx, rdx
xchg rcx, rdx
test rax, rax
jne 0x14005fcd9
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14005fd07
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14005fd04
mov rcx, qword [rdx + 0x10]
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x14005fce7
xchg r15, rax
mov r15, qword [rdx + 0x10]
xchg r15, rax
mov byte [rdx], 1
ret

Function at 0x14005fd20
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
xchg rbx, rbp
mov rbp, rcx
xchg rbp, rbx
je 0x14005fd81
cmp byte [rcx], 0
je 0x14005fd81
push rax
call 0x14082381e
and eax, 0x8000ffff
jge 0x14005fd51
dec eax
or eax, 0xffff0000
inc eax
xor word [rbx + 2], ax
xor edx, edx
cmp qword [rbx + 8], rdx
jbe 0x14005fd7e
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x14005fd66
mov byte [rbx], 0
add rsp, 0x20
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret

Function at 0x14005fd90
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rax
mov rsi, qword [rcx + 0x10]
xchg rsi, rax
mov rdx, rcx
test rax, rax
jne 0x14005fda1
ret
cmp byte [rcx], 0
jne 0x14005fdd3
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14005fdd0
nop dword [rax + rax]
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14005fdb4
mov rax, qword [rdx + 0x10]
mov byte [rdx], 1
ret
Function at 0x1400d4730
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
xchg r12, rdx
mov qword [rsp + 0x10], r12
xchg r12, rdx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push rbx
mov qword [rsp], r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x30
xchg rdi, r14
mov rdi, r8
xchg r14, rdi
mov r12, rdx
test rdx, rdx
je 0x1400d4965
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x1400d4965
movsxd rdi, dword [rdx + 0x3c]
add rdi, rdx
cmp dword [rdi], 0x4550
jne 0x1400d4965
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x1400d4965
xor r15d, r15d
mov r13d, r15d
mov ebp, r15d
cmp r15w, word [rdi + 6]
jae 0x1400d495a
nop dword [rax]
mov eax, ebp
lea rbx, [rax + rax*4]
shl rbx, 1
shl rbx, 1
shl rbx, 1
mov eax, dword [rdi + rbx + 0x12c]
and eax, 0xc0000000
cmp eax, 0x40000000
jne 0x1400d494c
mov ecx, 0x60
call fcn.14014e6e0
xchg r8, rax
mov rsi, r8
xchg r8, rax
xchg rbp, rax
mov qword [rsp + 0x20], rbp
xchg rbp, rax
test rax, rax
lea rax, [rdi + 0x114]
je 0x1400d4863
lea r15, [rdi + 0x118]
add r15, rbx
mov r8d, dword [r15]
add rax, rbx
mov qword [rsp + 0x88], rax
mov edx, dword [rax]
add rdx, r12
xchg rcx, r10
mov r10, rsi
xchg rcx, r10
call fcn.1400d9360
lea rax, [0x140003e48]
mov qword [rsi], rax
jmp 0x1400d4885
xchg rsi, r15
mov r15, rsi
xchg r15, rsi
lea r15, [rdi + 0x118]
add r15, rbx
add rax, rbx
xchg r15, rax
mov qword [rsp + 0x88], r15
xchg r15, rax
mov r12d, dword [r15]
mov ecx, r12d
call fcn.14014e724
xchg rbx, r8
mov r8, rax
xchg rbx, r8
test rax, rax
je 0x1400d48ba
mov r8d, r12d
xor edx, edx
xchg rcx, r11
mov r11, rax
xchg r11, rcx
call fcn.14014f766
jmp 0x1400d48bc
xor ebx, ebx
mov r8d, dword [r15]
mov rax, qword [rsp + 0x88]
mov edx, dword [rax]
xchg r13, r12
mov r13, qword [rsp + 0x78]
xchg r12, r13
add rdx, r12
xchg r13, rcx
mov r13, rbx
xchg r13, rcx
call fcn.14014f790
xchg r9, rax
mov r9, qword [rsi]
xchg r9, rax
mov rdx, rbx
xchg r8, rsi
mov rcx, r8
xchg rsi, r8
call qword [rax + 0x10]
xchg r11, rsi
mov qword [rsp + 0x88], r11
xchg r11, rsi
xchg r8, rdx
mov r8, qword [r14 + 8]
xchg rdx, r8
cmp rdx, qword [r14 + 0x10]
je 0x1400d4930
xchg rsi, r8
mov qword [rdx], r8
xchg r8, rsi
sub qword [r14 + 8], 0xfffffffffffffff8
jmp 0x1400d4946
lea r8, [rsp + 0x88]
xchg r14, r9
mov rcx, r9
xchg r14, r9
call fcn.1400d3af0
inc r13d
xor r15d, r15d
inc ebp
movzx eax, word [rdi + 6]
cmp ebp, eax
jb 0x1400d47d9
test r13d, r13d
setne al
jmp 0x1400d4967
xor al, al
xchg rbx, r14
mov r14, qword [rsp + 0x70]
xchg r14, rbx
add rsp, 0x30
push rdx
push rax
push rbx
push rcx
push rax
push rax
xchg qword [rsp + 0x30], r15
add rsp, 0x38
nop
add rsp, 8
xchg qword [rsp - 8], r14
nop
mov r13, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rsi
push rbx
push rax
push rax
push rbx
push rbx
push rdx
push rbx
xchg qword [rsp + 0x38], rbp
add rsp, 0x40
ret
Function at 0x1400d4cd0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
xchg r14, r8
mov qword [rsp + 0x18], r14
xchg r8, r14
xchg r15, rcx
mov qword [rsp + 8], r15
xchg r15, rcx
push rbx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push rsi
push rdi
push r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
push 0x2a332807
mov qword [rsp], r14
nop
push 0x7d734fea
mov qword [rsp], r15
sub rsp, 0x58
xchg rbx, r13
mov r13, r9
xchg rbx, r13
xchg r8, rdx
mov rsi, r8
xchg r8, rdx
xchg r9, rcx
mov rcx, r9
xchg rcx, r9
xor ebp, ebp
test rdx, rdx
jne 0x1400d4d49
mov eax, ebp
jmp 0x1400d4d74
mov eax, 0x5a4d
cmp word [rdx], ax
je 0x1400d4d63
xchg rbp, rax
mov rbp, rax
xchg rbp, rax
jmp 0x1400d4d74
movsxd rax, dword [rdx + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
cmovne rax, rbp
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x1400d4eaa
mov r14d, dword [rax + 0x88]
add r14, rsi
je 0x1400d4eaa
mov r15d, dword [r14 + 0x1c]
add r15, rsi
mov r12d, dword [r14 + 0x24]
add r12, rsi
mov r13d, dword [r14 + 0x20]
add r13, rsi
mov edi, ebp
cmp dword [r14 + 0x18], 0
jbe 0x1400d4e76
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
mov ecx, dword [r13 + rax*4]
add rcx, rsi
movzx eax, word [r12 + rax*2]
mov edx, dword [r15 + rax*4]
add rdx, rsi
cmp rcx, 0xffff
jbe 0x1400d4e6a
xchg rbx, rdx
mov qword [rsp + 0xa8], rbx
xchg rdx, rbx
mov qword [rsp + 0x30], rcx
xchg rbx, r8
mov qword [rsp + 0x38], rbx
xchg r8, rbx
mov qword [rsp + 0x40], r9
xchg rcx, rbp
mov rbp, qword [rbx + 0x38]
xchg rcx, rbp
test rcx, rcx
je 0x1400d4f29
xchg r8, rax
mov r8, qword [rcx]
xchg r8, rax
lea rdx, [rsp + 0xa8]
xchg rdx, r12
mov qword [rsp + 0x20], r12
xchg r12, rdx
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
test al, al
je 0x1400d4e76
xchg r13, r8
mov r13, qword [rsp + 0xb0]
xchg r8, r13
xchg r15, r9
mov r15, qword [rsp + 0xa0]
xchg r9, r15
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x1400d4dc1
xchg r13, rcx
mov r13, qword [rbx + 0x38]
xchg r13, rcx
test rcx, rcx
je 0x1400d4ea3
cmp rcx, rbx
xchg r9, rax
mov r9, qword [rcx]
xchg r9, rax
setne dl
call qword [rax + 0x20]
xchg rsi, rbp
mov qword [rbx + 0x38], rsi
xchg rbp, rsi
mov al, 1
jmp 0x1400d4ed3
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400d4ed1
xchg r14, rax
mov r14, qword [rcx]
xchg r14, rax
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
xchg r12, rbp
mov qword [rbx + 0x38], r12
xchg rbp, r12
xor al, al
add rsp, 0x58
nop
add rsp, 8
xchg qword [rsp - 8], r15
push rdx
push rcx
push rax
push rbx
push rcx
xchg qword [rsp + 0x28], r14
add rsp, 0x30
nop
xchg qword [rsp], r13
add rsp, 8
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rsi
nop
mov rbp, qword [rsp]
add rsp, 8
push rcx
push rax
xchg qword [rsp + 0x10], rbx
add rsp, 0x18
ret
call fcn.14014f51c
nop
int3
Function at 0x1400d9460
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xchg r11, r10
mov r10, rdx
xchg r11, r10
xchg rdx, rcx
mov r10, rdx
xchg rcx, rdx
test rdx, rdx
je 0x1400d94de
mov qword [rsp], rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1400d94cb
movzx eax, byte [r10]
test bl, bl
je 0x1400d94ad
lea rcx, [r9 - 1]
mov rdx, r9
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1400d949c
jmp 0x1400d94cb
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1400d94bc
inc r10
sub r11, 1
jne 0x1400d9484
xchg rdi, rbx
mov rdi, qword [rsp]
xchg rbx, rdi
add rsp, 8
ret

Function at 0x1400db5a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
xchg rdi, rcx
mov qword [rsp + 0x18], rcx
xchg rcx, rdi
nop
sub rsp, 8
mov qword [rsp], rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
xchg r8, rdi
mov r8, rdi
xchg rdi, r8
xchg rdx, rbx
mov rdx, rbx
xchg rbx, rdx
mov rsi, rcx
test r8, r8
je 0x1400db74d
nop
mov dword [rbp - 0x29], 0xf6f6f6f6
mov dword [rbp + 0x16], 0x3d3c3b3a
mov dword [rbp - 0x25], 0xf6f6f6f6
mov dword [rbp + 0x1a], 0x41403f3e
mov dword [rbp - 0x21], 0xf6f6f6f6
mov dword [rbp + 0x1e], 0x4c4b4342
mov dword [rbp - 0x1d], 0xf6f6f6f6
mov dword [rbp + 0x22], 0x504f4e4d
mov dword [rbp - 0x19], 0xf6f6f6f6
mov dword [rbp + 0x26], 0x54535251
mov dword [rbp - 0x15], 0xf6f6f6f6
mov dword [rbp + 0x2a], 0x58575655
mov dword [rbp - 0x11], 0xf6f6f6f6
mov dword [rbp + 0x2e], 0x5c5b5a59
mov dword [rbp - 0xd], 0xf6f6f6f6
mov dword [rbp + 0x32], 0x605f5e5d
mov dword [rbp - 9], 0xf6f6f6f6
mov dword [rbp + 0x36], 0x64636261
mov dword [rbp - 5], 0xf6f6f6f6
mov dword [rbp + 0x3a], 0x6e6d6c6b
mov dword [rbp - 1], 0xf6f6f6f6
mov dword [rbp + 0x3e], 0x7271706f
mov dword [rbp + 3], 0xf6f6f6f6
mov dword [rbp + 0x42], 0x76757473
mov dword [rbp + 7], 0xf6f6f6f6
mov dword [rbp + 0x46], 0x7a797877
mov dword [rbp + 0xb], 0xf6f6f6f6
mov dword [rbp + 0x4a], 0x7e7d7c7b
mov dword [rbp + 0xf], 0xf6f6f6f6
mov dword [rbp + 0x4e], 0x8281807f
mov word [rbp + 0x13], 0xf6f6
mov word [rbp + 0x52], 0x8483
xor eax, eax
mov byte [rbp + 0x54], al
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rbp + rax + 0x16]
movzx edx, byte [rbp + rax - 0x29]
add dl, cl
mov byte [rbp + rax + 0x16], dl
mov byte [rbp + rax - 0x29], 0
inc rax
cmp rax, 0x3e
jb 0x1400db6da
mov edx, 0x3e
xor ecx, ecx
call fcn.1400dbe30
movsxd rcx, eax
movzx edx, byte [rbp + rcx + 0x16]
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbp + rax + 0x16], 0
inc rax
cmp rax, 0x3e
jb 0x1400db71e
mov byte [rbx], dl
inc rbx
sub rdi, 1
jne 0x1400db5ea
xchg r15, rbx
mov qword [rsi], r15
xchg r15, rbx
jmp 0x1400db756
xchg rdi, rdx
mov qword [rcx], rdi
xchg rdi, rdx
mov rax, rsi
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
xchg rsi, rcx
mov rcx, qword [r11 + 0x18]
xchg rsi, rcx
xchg r13, rdi
mov r13, qword [r11 + 0x20]
xchg rdi, r13
mov rsp, r11
push rcx
push rbx
push rdx
push rbx
push rbx
push rdx
push rdx
xchg qword [rsp + 0x38], rbp
pop rdx
pop rdx
pop rbx
pop rbx
pop rdx
pop rbx
pop rcx
add rsp, 8
ret