joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400630e0
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov rax, qword [0x140093f70]
xor rax, rsp
mov qword [rsp + 0x68], rax
call fcn.140062c40
movzx eax, byte [0x1400a3591]
test eax, eax
jne 0x140063115
xor al, al
jmp 0x140063265
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call fcn.140063280
test rax, rax
je 0x140063136
mov al, 1
jmp 0x140063265
mov dword [rsp + 0x20], 0x100
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
movzx eax, al
test eax, eax
je 0x140063187
mov rax, qword [rsp + 0x88]
movzx eax, byte [rax]
mov dword [rsp + 0x20], eax
jmp 0x1400631ae
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
cmp dword [rsp + 0x20], 0x100
jne 0x1400631ca
xor al, al
jmp 0x140063265
mov r8d, 0x6e556353
mov edx, 0x28
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x1400631ee
xor al, al
jmp 0x140063265
mov edx, 0x28
mov rcx, qword [rsp + 0x28]
call fcn.140024220
mov rax, qword [rsp + 0x28]
movzx ecx, byte [rsp + 0x20]
mov byte [rax + 0x20], cl
mov rax, qword [rsp + 0x28]
mov byte [rax + 0x21], 0xcc
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
mov qword [rax + 0x18], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x80]
mov qword [rax + 0x10], rcx
lea rcx, [0x1400a35a8]
call qword [sym.imp.ntoskrnl.exe_KeAcquireGuardedMutex]
mov rax, qword [rsp + 0x28]
mov rdx, rax
lea rcx, [0x1400a3598]
call fcn.14000b3c0
lea rcx, [0x1400a35a8]
call qword [sym.imp.ntoskrnl.exe_KeReleaseGuardedMutex]
mov al, 1
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14006ea30
add rsp, 0x70
pop rdi
ret
Function at 0x14006b510
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows
Print debug messages

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x28], 0xc0000001
mov dword [rsp + 0x24], 0
call fcn.140060e10
cmp dword [rax], 0x47ba
jae 0x14006b567
mov r8d, 0xd
lea rdx, [0x14007d250]
lea rcx, [0x14007d270]
call sub.ntoskrnl.exe_DbgPrint
movzx eax, byte [rsp + 0x20]
jmp 0x14006b753
lea r9, [rsp + 0x24]
xor r8d, r8d
xor edx, edx
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov eax, dword [rsp + 0x24]
mov r8d, 0x6e556353
mov edx, eax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14006b5a7
movzx eax, byte [rsp + 0x20]
jmp 0x14006b753
mov eax, dword [rsp + 0x24]
mov edx, eax
mov rcx, qword [rsp + 0x38]
call fcn.140024220
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x38]
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jl 0x14006b712
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x30], rax
jmp 0x14006b603
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
test rax, rax
je 0x14006b712
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x50]
call fcn.1400286c0
cmp rax, qword [rsp + 0x80]
jne 0x14006b70d
mov qword [rsp + 0x48], 0
jmp 0x14006b647
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 4]
cmp qword [rsp + 0x48], rax
jae 0x14006b70b
mov qword [rsp + 0x58], 0
imul rax, qword [rsp + 0x48], 0x50
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + rax + 0x130]
call qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jl 0x14006b696
mov dword [rsp + 0x40], 1
jmp 0x14006b69e
mov dword [rsp + 0x40], 0
cmp dword [rsp + 0x40], 1
jne 0x14006b706
call fcn.140060e20
mov eax, dword [rax + 4]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov eax, dword [rax]
btr eax, 0x15
mov rcx, qword [rsp + 0x60]
mov dword [rcx], eax
mov byte [rsp + 0x20], 1
jmp 0x14006b6fb
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x14006b63a
jmp 0x14006b712
jmp 0x14006b5ec
jmp 0x14006b739
cmp qword [rsp + 0x38], 0
je 0x14006b74e
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movzx eax, byte [rsp + 0x20]
add rsp, 0x78
ret
Function at 0x14006b760
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
mov rax, qword [0x140093f70]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov byte [rsp + 0x21], 0
cmp qword [rsp + 0xa0], 0
jne 0x14006b799
movzx eax, byte [rsp + 0x21]
jmp 0x14006b90b
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov byte [rsp + 0x20], 0
cmp qword [rsp + 0x40], 0
je 0x14006b86e
mov qword [rsp + 0x28], 0
jmp 0x14006b808
mov rax, qword [rsp + 0x28]
inc rax
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x88]
cmp qword [rsp + 0x28], rax
jae 0x14006b86e
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x90]
mov rcx, qword [rsp + 0x28]
mov eax, dword [rax + rcx*4]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
add eax, 0x40
mov eax, eax
mov eax, dword [rax]
and eax, 0xafffff9f
mov ecx, dword [rsp + 0x24]
add ecx, 0x40
mov ecx, ecx
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
add eax, 0x44
mov eax, eax
mov eax, dword [rax]
and eax, 0xbfffff9f
mov ecx, dword [rsp + 0x24]
add ecx, 0x44
mov ecx, ecx
mov dword [rcx], eax
mov byte [rsp + 0x20], 1
jmp 0x14006b7fb
cmp qword [rsp + 0x48], 0
je 0x14006b8eb
mov qword [rsp + 0x30], 0
jmp 0x14006b88e
mov rax, qword [rsp + 0x30]
inc rax
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x48]
mov eax, dword [rax + 0xe8]
cmp qword [rsp + 0x30], rax
jae 0x14006b8eb
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0xf0]
mov rcx, qword [rsp + 0x30]
mov rax, qword [rax + rcx*8]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x70]
and eax, 0xafffff9f
mov rcx, qword [rsp + 0x38]
mov dword [rcx + 0x70], eax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x74]
and eax, 0xbfffff9f
mov rcx, qword [rsp + 0x38]
mov dword [rcx + 0x74], eax
mov byte [rsp + 0x20], 1
jmp 0x14006b881
jmp 0x14006b8f2
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x21], al
lea rcx, [rsp + 0x50]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
movzx eax, byte [rsp + 0x21]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14006ea30
add rsp, 0x90
pop rdi
ret
Function at 0x14006b930
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov rax, qword [0x140093f70]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x20], 0
cmp qword [rsp + 0x80], 0
jne 0x14006b963
movzx eax, byte [rsp + 0x20]
jmp 0x14006ba3b
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
cmp qword [rsp + 0x30], 0
je 0x14006b9e9
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 0x68]
and eax, 0xffffff8f
mov rcx, qword [rsp + 0x30]
mov dword [rcx + 0x68], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xbc]
and eax, 0xffffff8f
mov rcx, qword [rsp + 0x28]
mov dword [rcx + 0xbc], eax
mov byte [rsp + 0x20], 1
jmp 0x14006ba0f
cmp qword [rsp + 0x28], 0
je 0x14006ba0f
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xbc]
and eax, 0xffffff8f
mov rcx, qword [rsp + 0x28]
mov dword [rcx + 0xbc], eax
mov byte [rsp + 0x20], 1
jmp 0x14006ba2b
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14006ea30
add rsp, 0x70
pop rdi
ret
Function at 0x14006bb80
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov byte [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x48], 0xc0000001
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov eax, dword [rsp + 0x20]
mov r8d, 0x6e556353
mov edx, eax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14006bbe4
xor al, al
jmp 0x14006bdb0
mov eax, dword [rsp + 0x20]
mov edx, eax
mov rcx, qword [rsp + 0x28]
call fcn.140024220
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
jl 0x14006bd72
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
jmp 0x14006bc40
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x38]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
test rax, rax
je 0x14006bd72
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x50]
call fcn.1400286c0
cmp rax, qword [rsp + 0x80]
jne 0x14006bd6d
mov qword [rsp + 0x50], 0
jmp 0x14006bc84
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
cmp qword [rsp + 0x50], rax
jae 0x14006bd6d
mov qword [rsp + 0x40], 0
imul rax, qword [rsp + 0x50], 0x50
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx + rax + 0x130]
call qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
test eax, eax
jl 0x14006bd68
call fcn.140060e20
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax]
and eax, 0x20
test eax, eax
je 0x14006bd55
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call fcn.140061af0
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x14006bd55
mov rax, qword [rsp + 0x60]
mov byte [rax + 0x89], 1
call fcn.140060e20
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov eax, dword [rax]
and eax, 0xffffffdf
mov rcx, qword [rsp + 0x68]
mov dword [rcx], eax
cmp qword [rsp + 0x28], 0
je 0x14006bd46
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, 1
jmp 0x14006bdb0
cmp qword [rsp + 0x40], 0
je 0x14006bd68
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x14006bc77
jmp 0x14006bc29
jmp 0x14006bd99
cmp qword [rsp + 0x28], 0
je 0x14006bdae
xor edx, edx
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor al, al
add rsp, 0x78
ret
Function at 0x14006bdc0
Capabilities:
Enumerate processes via ntquerysysteminformation
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov byte [rsp + 0x20], 0
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x28], 0xc0000001
mov dword [rsp + 0x24], 0
lea r9, [rsp + 0x24]
xor r8d, r8d
xor edx, edx
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov eax, dword [rsp + 0x24]
mov r8d, 0x6e556353
mov edx, eax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x14006be2a
movzx eax, byte [rsp + 0x20]
jmp 0x14006c01b
mov eax, dword [rsp + 0x24]
mov edx, eax
mov rcx, qword [rsp + 0x48]
call fcn.140024220
lea r9, [rsp + 0x24]
mov r8d, dword [rsp + 0x24]
mov rdx, qword [rsp + 0x48]
mov ecx, 5
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jl 0x14006bfda
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], rax
jmp 0x14006be86
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax]
test rax, rax
je 0x14006bfda
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 0x50]
call fcn.1400286c0
cmp rax, qword [rsp + 0x90]
jne 0x14006bfd5
mov qword [rsp + 0x50], 0
jmp 0x14006beca
mov rax, qword [rsp + 0x50]
inc rax
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov eax, dword [rax + 4]
cmp qword [rsp + 0x50], rax
jae 0x14006bfd3
mov qword [rsp + 0x40], 0
imul rax, qword [rsp + 0x50], 0x50
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx + rax + 0x130]
call qword [sym.imp.ntoskrnl.exe_PsLookupThreadByThreadId]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jl 0x14006bf19
mov dword [rsp + 0x38], 1
jmp 0x14006bf21
mov dword [rsp + 0x38], 0
cmp dword [rsp + 0x38], 1
jne 0x14006bfce
call fcn.140060e20
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax]
and eax, 4
test eax, eax
je 0x14006bf9c
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x90]
call fcn.140061af0
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x60], 0
je 0x14006bf73
mov byte [rsp + 0x20], 1
mov rax, qword [rsp + 0x60]
mov byte [rax + 0x88], 1
call fcn.140060e20
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x68]
mov eax, dword [rax]
and eax, 0xfffffffb
mov rcx, qword [rsp + 0x68]
mov dword [rcx], eax
jmp 0x14006bfc3
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x14006bebd
jmp 0x14006bfda
jmp 0x14006be6f
jmp 0x14006c001
cmp qword [rsp + 0x70], 0
je 0x14006c016
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
movzx eax, byte [rsp + 0x20]
add rsp, 0x88
ret
Function at 0x14006c420
Capabilities:
Attach user process memory

Disassembly:
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x70
mov rax, qword [0x140093f70]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x20], 0
cmp qword [rsp + 0x80], 0
jne 0x14006c457
movzx eax, byte [rsp + 0x20]
jmp 0x14006c525
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessWow64Process]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x38]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
cmp qword [rsp + 0x30], 0
je 0x14006c4d1
mov rax, qword [rsp + 0x30]
movzx ecx, byte [rsp + 0x88]
mov byte [rax + 2], cl
mov rax, qword [rsp + 0x28]
movzx ecx, byte [rsp + 0x88]
mov byte [rax + 2], cl
mov byte [rsp + 0x20], 1
jmp 0x14006c4ee
cmp qword [rsp + 0x28], 0
je 0x14006c4ee
mov rax, qword [rsp + 0x28]
movzx ecx, byte [rsp + 0x88]
mov byte [rax + 2], cl
mov byte [rsp + 0x20], 1
jmp 0x14006c515
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14006ea30
add rsp, 0x70
pop rdi
ret

Function at 0x1401456ac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], 0x5df5259a
mov qword [rsp + 8], 0x5df5259a
setne byte [rsp + 8]
push qword [rsp + 0x18]
popfq
lea rsp, [rsp + 0x28]
call fcn.140237e00
call fcn.140004a47
mov al, 0x53
test dword [rdx], edi
test byte [rax - 0x3b], al
insb byte [rdi], dx
xlatb
scasd eax, dword [rdi]
nop
jge 0x14014571b
sub byte [rcx + rsi*4 + 0x46], bl
popfq
mov ah, byte [rax]
imul ch
inc dword [rbx - 0x481c22b0]
cmp ecx, edx
out dx, al
and al, 0xb1
lea edx, [rbx + 0x75faf331]
push rcx
mov cl, 0x8d
xchg ebx, eax
xor ebx, esi
cli
jne 0x14014572a
jle 0x1401456d1
cli
ret 0xbd09
or dword [rbp - 0x518c8884], edi
sub r9d, dword [rsi + 0x60f64a14]
add al, 0xd9
xor byte [rsp + rbx - 0x66], ah
sub byte [rdx - 0x6c], cl
movsb byte [rdi], byte [rsi]
stosd dword [rdi], eax
xlatb
leave
lahf
imul esi, dword [rbp + 0x3d], 0x3a
xor al, 9
jl 0x14014568e
imul edi, dword [rdx], 0x728ec441
std
jb 0x1401456b9
popfq
sub cl, byte [rdx + rcx*4]
int 0xf9
invalid
cld
add dh, byte [rsi + 0x3b]
and eax, 0x7e41750c
xchg ebp, eax
sbb al, 0xd7
jb 0x1401456b8
jle 0x1401456dd
mov dl, 0xb0
xchg esp, ecx
invalid
mov al, 0x87
int3
Function at 0x140165257
Capabilities:
Encode data using xor

Disassembly:
push r13
call fcn.1400dfefa
mov r13, qword [rsp + 0x30]
movabs r12, 0xe8a5ff819dd55d2
setb r12b
movabs rcx, 0x20f8228056b97c0e
je 0x140133c10
mov rcx, qword [rsp + 8]
xor r12, 0x182516d9
mov r12d, 0x3b2a70a6
add qword [rsp + 0x20], 0xffffffffbff200f4
lea r12, [r12 + r12*8 + 0x39b57b31]
add qword [rsp + 0x18], 0xffffffffbff0442c
or r12b, 0xbc
mov r12, qword [rsp + 0x10]
add qword [rsp + 0x28], 0xffffffffbfecc3e9
call fcn.14017a937
loop 0x1401652e3
adc eax, 0xe71988d9
add dword [0x131097314], ecx
pop rbp
sub al, 0x3d
push rax
xchg ebx, eax
xor dword [rdx - 0x34], eax
pop rbx
scasb al, byte [rdi]
invalid
and bl, dh
invalid
jno 0x1401652c7
push rsp
jge 0x140165307
jmp 0xce27e036
fdiv qword [rdx - 0x3d]
scasb al, byte [rdi]
sbb eax, 0x6819653e
invalid

Function at 0x1401a2145
Capabilities:
Encode data using xor

Disassembly:
xor al, ch
add eax, 0x48000cd8
lea rsp, [rsp + 0x20]
lea rsp, [rsp + 0x20]
call fcn.14022b294
jb 0x1401a217c
in al, 0x51
jle 0x1401a213f
in al, dx
mov esi, edi
xchg esi, eax
sbb eax, 0x9911449
and rdx, r9
invalid
mov edi, 0xe400e6d1
or dword [rax + 0x4182fce9], eax
jmp 0x136f7b0b5

Function at 0x1402075e2
Capabilities:
Execute anti-debugging instructions

Disassembly:
not eax
stc
xor eax, 0xed066f5
cmp bpl, bpl
push rbx
bsr rbx, r14
sal bx, 3
neg ebx
xor dword [rsp], eax
dec rbx
pop rbx
movsxd rax, eax
add rdi, rax
jmp 0x1402644ec
push r12
movzx rax, r12w
push rdx
push rbp
push r11
not esi
push r13
jmp 0x1402420af
push rsi
jmp 0x140243896
push r15
movsxd rbx, r14d
push r9
mov r10w, dx
push r14
inc ax
push rdi
inc bx
mov bl, spl
rdtsc
movabs r10, 0
movzx dx, r15b
mov rdx, 0x42aa0d05
cdq
push r10
rdtsc
mov rbp, qword [rsp + 0x90]
cmove bx, bp
inc ebp
and dl, 0x7d
dec dx
bswap ebp
shld di, ax, 0x81
neg ebp
jmp 0x14029c976
push rax
push rcx
mov esi, r13d
xchg al, sil
cmovo esi, esi
pushfq
push r10
movsx si, r15b
push rbx
mov sil, 0x26
mov r10b, r13b
movzx rbx, r14w
push r8
xchg bl, r8b
jmp 0x140203790
xor eax, ebx
clc
cmp r8, 0x4c072c05
not eax
bswap eax
jmp 0x1401e35d8
push rdi
ret
inc ebp
movzx di, bl
ror di, 1
cmc
ror ebp, 1
btr rbx, r12
cbw
bswap rdx
lea rbp, [rbp + r10]
cwde
movabs rdx, 0x100000000
add rbp, rdx
xor bx, r15w
rcr bl, 0x3d
bsf edi, ebp
mov r8, rsp
cmp r8b, 0xa6
sub rsp, 0x180
xor sil, r12b
and rsp, 0xfffffffffffffff0
sar al, 0x27
mov rbx, rbp
movabs rsi, 0
shld di, ax, 0xad
sar dil, cl
sub rbx, rsi
lea rdi, [0x14029c9db]
sub rbp, 4
mov eax, dword [rbp + riz]
test r9, rsi
jmp 0x140256597
Function at 0x14000bd70
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14000bd7d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14000bd8d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14000bd75
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14000bda5
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14000bd92
sub eax, 3
jb 0x14000bdbf
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14000bdf6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14000bde6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14000bde4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14000bdd3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14000bd32
jmp 0x14000bd7d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x2e00
mov dl, 1
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14000be42
cmp rsi, rcx
jae 0x14000be4a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14000be29
cmp al, 0x8f
ja 0x14000be29
cmp byte [rsi - 2], 0xf
je 0x14000be2f
sub al, 0xe8
cmp al, 1
ja 0x14000be13
cmp rsi, rcx
jae 0x14000be4a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14000be19
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14000be4a
lodsb al, byte [rsi]
jmp 0x14000be29
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x9000]
mov eax, dword [rdi]
or eax, eax
je 0x14000beb3
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xc1a0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14000be57
jns 0x14000be8c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14000be96
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14000bead
mov qword [rbx], rax
add rbx, 8
jmp 0x14000be77
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14000beed
cmp al, 0xef
ja 0x14000bedf
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14000bebf
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14000bece
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1a7]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14000bf41
sub rsp, 0xffffffffffffff80
jmp 0x14000334c