joyce8/EMBER2024-capa huggingface dataset:
Function at 0x476300
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47653b
push rbp
mov rbp, rsp
sub rsp, 0x78
mov ebx, dword [rax + 0x2c]
test ebx, ebx
jne 0x47639a
mov qword [rsp + 0x88], rax
lea rbx, [0x004ca680]
mov rcx, rax
lea rax, [0x00589be0]
call fcn.00471720
test cl, cl
jne 0x476383
mov rax, qword [rsp + 0x88]
call fcn.00475c20
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x30]
lea rbx, [0x004f41b0]
call fcn.0044c1a0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rbx
call fcn.00476580
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x4763b7
lea rdx, [0x004c8b20]
cmp rax, rdx
jne 0x4763a5
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
call fcn.0045d7e0
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x004b6f60]
call fcn.0040a500
inc rdx
cmp rbx, rdx
jle 0x476401
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x4763b4
lea rax, [0x00589be0]
lea rbx, [0x004ca680]
lea rdi, [0x004c8b20]
nop dword [rax + rax]
call fcn.004718e0
lea rdx, [0x004c8b20]
cmp rax, rdx
jne 0x47652b
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
nop
ret
lea rcx, [0x004b0a80]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rcx
lea rax, [0x004bbd00]
call fcn.0040cfe0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x005dcc40], 0
nop
je 0x47645b
mov rbx, rax
lea rax, [0x004bbd00]
call fcn.00412280
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
mov rax, qword [rsp + 0x50]
call fcn.00401480
call fcn.0045d8a0
mov rsi, qword [rsp + 0x60]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x4764c2
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
test rax, rax
jle 0x4764b4
mov dword [rsi + 0x10], edx
cmp dword [0x005dcc40], 0
je 0x4764e3
call fcn.00461cc0
mov qword [r11], rcx
mov rdx, qword [rsi + 0x30]
mov qword [r11 + 8], rdx
mov qword [rsi + 0x30], rcx
lea rax, [0x00589be0]
lea rbx, [0x004ca680]
lea rdi, [0x004c8b20]
nop dword [rax]
call fcn.004718e0
lea rdx, [0x004c8b20]
cmp rax, rdx
jne 0x47651c
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x004b6f60]
call fcn.0040a500
mov rbx, rdx
lea rcx, [0x004b6f60]
call fcn.0040a500
nop
mov qword [rsp + 8], rax
call fcn.0045fda0
mov rax, qword [rsp + 8]
jmp fcn.00476300
Function at 0x47d960
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47da2a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004038c0
xorps xmm15, xmm15
mov r14, qword [0x005dcc08]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x47da0f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004b3d00]
xor ebx, ebx
mov rcx, rdx
call fcn.004483e0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0047e000
inc rbx
cmp rcx, rbx
jae 0x47d9fe
mov edi, 1
lea rsi, [0x004b3d00]
call fcn.004484c0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004f5998]
lea rsi, [0x004f5108]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045fda0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0047d960
Function at 0x49e2c0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x49e2d7
inc rax
cmp rax, 4
jge 0x49e2ef
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x49e2d4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x49e300
inc rax
cmp rax, 4
jge 0x49e30e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x49e337
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x49e31b
jmp 0x49e2fd
Function at 0x1400022b0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000a900]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400022d0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400022d8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400022d0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000232d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002324
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400022d0
add rax, 0x28
cmp rax, r9
jne 0x140002310
xor eax, eax
ret

Function at 0x140002330
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000a900]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000234f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002358
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000234f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400023f0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000a900]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000240f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002418
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140007c30
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r10d, 0xc
mov eax, dword [rdx]
mov r9, rcx
mov ecx, dword [rdx + 4]
mov r8, rdx
movq xmm1, qword [r9]
pshufd xmm2, xmm1, 0xe5
movd r11d, xmm1
movd ebx, xmm2
nop dword [rax]
mov edx, ecx
mov ecx, eax
sub edx, ebx
ror edx, cl
mov ecx, edx
xor ecx, eax
sub eax, r11d
ror eax, cl
xor eax, ecx
sub r10d, 1
jne 0x140007c58
movd xmm0, eax
movd xmm3, ecx
mov eax, dword [r8 + 8]
mov ecx, dword [r8 + 0xc]
punpckldq xmm0, xmm3
mov r10d, 0xc
psubd xmm0, xmm1
movq qword [r8], xmm0
mov ebx, dword [r9 + 0x14]
mov r11d, dword [r9 + 0x10]
nop dword [rax]
mov edx, ecx
mov ecx, eax
sub edx, ebx
ror edx, cl
mov ecx, edx
xor ecx, eax
sub eax, r11d
ror eax, cl
xor eax, ecx
sub r10d, 1
jne 0x140007ca0
movq xmm1, qword [r9]
movd xmm0, eax
movd xmm4, ecx
punpckldq xmm0, xmm4
psubd xmm0, xmm1
movq qword [r8 + 8], xmm0
pop rbx
ret

Function at 0x140007ce0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r9d, 0xc
mov ebx, dword [rcx]
mov eax, dword [rdx + 4]
mov r10, rcx
mov ecx, dword [rdx]
mov r8, rdx
mov r11d, dword [r10 + 4]
add ecx, ebx
add eax, r11d
nop dword [rax]
mov edx, ecx
mov ecx, eax
xor edx, eax
rol edx, cl
mov ecx, edx
add ecx, ebx
xor eax, ecx
rol eax, cl
add eax, r11d
sub r9d, 1
jne 0x140007d00
mov dword [r8], ecx
mov r9d, 0xc
mov dword [r8 + 4], eax
mov ecx, dword [r10]
mov eax, dword [r10 + 4]
mov r11d, dword [r10 + 0x10]
mov r10d, dword [r10 + 0x14]
add ecx, dword [r8 + 8]
add eax, dword [r8 + 0xc]
nop dword [rax]
mov edx, ecx
mov ecx, eax
xor edx, eax
rol edx, cl
mov ecx, edx
add ecx, r11d
xor eax, ecx
rol eax, cl
add eax, r10d
sub r9d, 1
jne 0x140007d40
mov dword [r8 + 8], ecx
mov dword [r8 + 0xc], eax
pop rbx
ret
Function at 0x140007d70
Capabilities:
Encrypt data using rc6

Disassembly:
push rsi
push rbx
mov dword [rdx], 0xb7e15163
mov r11, rcx
mov rbx, rdx
lea rax, [rdx + 4]
lea rcx, [rdx + 0x68]
mov edx, 0xb7e15163
nop dword [rax + rax]
sub edx, 0x61c88647
add rax, 4
mov dword [rax - 4], edx
cmp rcx, rax
jne 0x140007d90
mov r10d, 0x4e
xor edx, edx
xor eax, eax
xor ecx, ecx
xor r8d, r8d
nop dword [rax]
mov r9d, eax
add eax, 1
lea rsi, [rbx + r9*4]
mov r9d, dword [rsi]
add r9d, ecx
add r8d, r9d
mov r9d, edx
add edx, 1
lea r9, [r11 + r9*4]
rol r8d, 3
and edx, 3
mov dword [rsi], r8d
mov esi, dword [r9]
add ecx, r8d
add esi, ecx
rol esi, cl
mov dword [r9], esi
mov r9, rax
imul rax, rax, 0x4ec4ec4f
mov ecx, esi
shr rax, 0x23
imul esi, eax, 0x1a
mov eax, r9d
sub eax, esi
sub r10d, 1
jne 0x140007db8
pop rbx
pop rsi
ret
Function at 0x140001840
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov ecx, 2
call fcn.140002168
mov qword [0x1400055f8], rax
call fcn.140001820
mov ecx, 1
call qword [sym.imp.msvcrt.dll_exit]
nop dword [rax + rax]
int3

Function at 0x140001a50
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x1400055e0], rbx
je 0x140001a9c
cmp rax, rbx
jne 0x140001a8f
mov ebx, 1
mov esi, ebx
jmp 0x140001aa1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140001a74
mov ebx, 1
mov eax, dword [0x1400055e8]
cmp eax, ebx
jne 0x140001ab7
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x140001b1c
mov eax, dword [0x1400055e8]
test eax, eax
jne 0x140001b16
mov dword [0x1400055e8], ebx
lea r15, [0x1400032b8]
lea rdi, [0x1400032a0]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140001b08
test eax, eax
jne 0x140001b0c
cmp qword [rdi], 0
je 0x140001afd
mov rax, qword [rdi]
mov rcx, qword [0x140003280]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x140001ade
test eax, eax
je 0x140001b1c
mov eax, 0xff
jmp 0x140001bf8
mov dword [0x140005024], ebx
mov eax, dword [0x1400055e8]
cmp eax, ebx
jne 0x140001b43
lea rdx, [0x140003298]
lea rcx, [0x140003288]
call sub.msvcrt.dll__initterm
mov dword [0x1400055e8], 2
test esi, esi
jne 0x140001b50
xor eax, eax
xchg qword [0x1400055e0], rax
cmp qword [0x1400055f0], 0
je 0x140001b84
lea rcx, [0x1400055f0]
call fcn.140001e00
test eax, eax
je 0x140001b84
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1400055f0]
mov r9, qword [0x140003280]
call r9
mov r8, qword [0x140005038]
mov rdx, qword [0x140005030]
mov ecx, dword [0x140005028]
call fcn.140001008
mov dword [0x140005020], eax
cmp dword [0x140005040], 0
jne 0x140001bb4
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140005024], 0
jne 0x140001bc9
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140005020]
jmp 0x140001bf8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140175000
add rsp, 0x28
jmp 0x140001a50

Function at 0x140001cec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140001d38
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140001d30
cmp dword [rcx + 0x3c], edx
jl 0x140001d30
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140001d30
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140001d38
mov rax, rdx
add rsp, 0x18
ret
Function at 0x7ff7e14c3c80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov r15d, edx
lea r14d, [rdx - 1]
mov rdi, rcx
xor r12d, r12d
nop word [rax + rax]
mov esi, r12d
mov ebp, r12d
test r14d, r14d
je 0x7ff7e14c3e8a
mov r8, qword [rdi + 8]
nop dword [rax]
nop word [rax + rax]
lea ecx, [r8 + 0xff]
shl esi, cl
add esi, esi
nop dword [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x7ff7e14c3d44
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x7ff7e14c3d00
mov ecx, dword [r10]
jmp 0x7ff7e14c3e27
cmp ecx, 0x4e0
jb 0x7ff7e14c3e27
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x7ff7e14c3d60
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x7ff7e14c3db0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r12d
mov dword [r10], r12d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
mov edx, dword [rdi + 0x10]
cmp eax, edx
ja 0x7ff7e14c3ce0
mov r8, qword [rdi + 8]
or esi, eax
lea ecx, [r8 + 0xff]
shl ebp, cl
add ebp, ebp
or ebp, edx
cmp ebp, r14d
jb 0x7ff7e14c3cd0
xor edx, edx
mov eax, ebp
div r15d
mov ecx, eax
mov r8d, edx
xor edx, edx
mov eax, esi
div r15d
cmp eax, ecx
jb 0x7ff7e14c3eaa
cmp r8d, r14d
jne 0x7ff7e14c3cb0
mov rbx, qword [rsp + 0x20]
mov eax, esi
mov rbp, qword [rsp + 0x28]
xor edx, edx
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
div r15d
mov eax, edx
pop r15
pop r14
pop r12
ret
Function at 0x7ff7e14c4870
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbx
sub rsp, 0xa0
xorps xmm0, xmm0
mov rbx, rcx
movups xmmword [rax - 0x78], xmm0
mov dword [rax - 0x78], 0x70
xor r8d, r8d
mov dword [rax - 0x74], 0x40
movabs rcx, 0x2bf37eec7796da6
mov qword [rax - 0x70], r8
movups xmmword [rax - 0x68], xmm0
movups xmmword [rax - 0x58], xmm0
movups xmmword [rax - 0x48], xmm0
movups xmmword [rax - 0x38], xmm0
movups xmmword [rax - 0x28], xmm0
movups xmmword [rax - 0x18], xmm0
movabs rax, 0x9dbfd214efe06367
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xb0], rcx
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x28], rax
movabs rax, 0x9dbfd2678e8e1615
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xb0], rcx
mov rax, qword [rsp + 0xb0]
cmp qword [rbx + 0x18], 0x10
lea rax, [rsp + 0x20]
mov qword [rsp + 0x40], rax
mov rax, rbx
jb 0x7ff7e14c4935
mov rax, qword [rbx]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x30]
lea rax, [0x7ff7e15b2378]
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x50], rax
test dl, dl
mov eax, 5
mov qword [rsp + 0x68], r8
cmovne eax, r8d
mov dword [rsp + 0x60], eax
call qword [sym.imp.shell32.dll_ShellExecuteExA]
mov rcx, rbx
test eax, eax
je 0x7ff7e14c4984
call fcn.7ff7e14c3a70
mov eax, 1
add rsp, 0xa0
pop rbx
ret
call fcn.7ff7e14c3a70
xor eax, eax
add rsp, 0xa0
pop rbx
ret
Function at 0x7ff7e14c4bc0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
xor eax, eax
mov dword [rbp - 0x29], 0x70
mov dword [rbp + 0xb], eax
xorps xmm0, xmm0
mov qword [rbp + 0x37], rax
mov rdi, rcx
movups xmmword [rbp + 0x17], xmm0
mov dword [rbp - 0x25], 0x40
xor r15d, r15d
movups xmmword [rbp + 0x27], xmm0
mov qword [rbp - 0x21], r15
movabs rax, 0x9dbfd214efe06367
mov qword [rbp + 0x6f], rax
movabs rcx, 0x2bf37eec7796da6
mov rax, qword [rbp + 0x6f]
mov rbx, rdx
mov qword [rbp - 0x59], rax
movabs rdx, 0x9dbfd2678e8e1615
mov qword [rbp + 0x6f], rcx
movzx r14d, r8b
mov rax, qword [rbp + 0x6f]
mov qword [rbp - 0x51], rax
mov qword [rbp + 0x6f], rdx
mov rax, qword [rbp + 0x6f]
mov qword [rbp - 0x49], rax
mov qword [rbp + 0x6f], rcx
mov rax, qword [rbp + 0x6f]
cmp qword [rdi + 0x18], 0x10
movdqa xmm0, xmmword [rbp - 0x59]
mov qword [rbp - 0x41], rax
lea rax, [rbp - 0x59]
pxor xmm0, xmmword [rbp - 0x49]
mov qword [rbp - 0x19], rax
mov rax, rdi
movdqa xmmword [rbp - 0x59], xmm0
jb 0x7ff7e14c4c8a
mov rax, qword [rdi]
cmp qword [rbx + 0x18], 0x10
mov qword [rbp - 0x11], rax
mov rax, rbx
jb 0x7ff7e14c4c9b
mov rax, qword [rbx]
mov qword [rbp - 9], rax
mov qword [rbp + 0x6f], rdx
mov rax, qword [rbp + 0x6f]
mov qword [rbp - 0x39], rax
mov qword [rbp + 0x6f], rcx
mov rax, qword [rbp + 0x6f]
mov qword [rbp - 0x31], rax
mov qword [rbp + 0x6f], rdx
mov rax, qword [rbp + 0x6f]
mov qword [rbp + 0x6f], rcx
lea rcx, [rbp - 0x29]
mov rax, qword [rbp + 0x6f]
lea rax, [rbp - 0x39]
mov qword [rbp + 0xf], r15
mov qword [rbp - 1], rax
movzx eax, r9b
xor eax, 1
mov qword [rbp + 0x3f], r15
mov dword [rbp + 7], eax
call qword [sym.imp.shell32.dll_ShellExecuteExA]
mov esi, eax
test eax, eax
je 0x7ff7e14c4d0f
test r14b, r14b
je 0x7ff7e14c4d05
mov rcx, qword [rbp + 0x3f]
mov edx, 0xffffffff
call qword [sym.imp.kernel32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x3f]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x7ff7e14c4d45
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x7ff7e14c4d40
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x7ff7e14c4db8
mov rcx, r8
call fcn.7ff7e1566ce4
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], r15b
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x7ff7e14c4d8a
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x7ff7e14c4d85
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x7ff7e14c4db8
mov rcx, r8
call fcn.7ff7e1566ce4
lea r11, [rsp + 0xc0]
mov qword [rbx + 0x10], r15
mov rdi, qword [r11 + 0x38]
mov eax, esi
mov rsi, qword [r11 + 0x30]
mov qword [rbx + 0x18], 0xf
mov byte [rbx], r15b
mov rbx, qword [r11 + 0x20]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x7ff7e14c4dc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 0x10
jb 0x7ff7e14c4dce
mov rcx, qword [rcx]
call qword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x7ff7e14c4de4
test al, 0x10
je 0x7ff7e14c4de4
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x7ff7e14c5b50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov esi, r14d
mov ebp, r14d
mov rdi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl esi, cl
add esi, esi
nop word [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x7ff7e14c5bf4
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x7ff7e14c5bb0
mov ecx, dword [r10]
jmp 0x7ff7e14c5cd7
cmp ecx, 0x4e0
jb 0x7ff7e14c5cd7
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x7ff7e14c5c10
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x7ff7e14c5c60
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov ecx, edx
shr ecx, 0x12
xor ecx, edx
cmp ecx, dword [rdi + 0x10]
ja 0x7ff7e14c5b90
mov rax, qword [rdi + 8]
or esi, ecx
add rbp, rax
cmp rbp, 0x20
jb 0x7ff7e14c5b80
mov rbx, qword [rsp + 0x10]
mov eax, esi
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x7ff7e14c7c10
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
call qword [sym.imp.kernel32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.kernel32.dll_OpenProcess]
xor r12d, r12d
mov dword [rbp - 0x10], 0x1817061f
mov ecx, r12d
mov dword [rbp - 0xc], 0x14135819
mov r15, rax
mov word [rbp - 8], 0x15
mov byte [rbp - 6], 1
lea eax, [rcx + 0x71]
xor byte [rbp + rcx - 0x10], al
inc rcx
cmp rcx, 9
jb 0x7ff7e14c7c60
lea rcx, [rbp - 0x10]
mov byte [rbp - 6], r12b
call qword [sym.imp.kernel32.dll_LoadLibraryA]
lea rdi, [0x7ff7e1638018]
mov esi, r12d
mov r14, rax
mov rbx, rdi
nop
mov rdx, qword [rbx - 8]
mov rcx, r14
call qword [sym.imp.kernel32.dll_GetProcAddress]
inc esi
mov qword [rbx], rax
lea rbx, [rbx + 0x18]
cmp esi, 3
jb 0x7ff7e14c7c90
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [rbp - 0x10], 0x2d062d1f
mov rcx, r12
mov rbx, rax
mov dword [rbp - 0xc], 0x2d182d17
mov dword [rbp - 8], 0x2d19
mov esi, 0x2d71
mov byte [rbp - 4], 1
nop word [rax + rax]
lea eax, [rsi + rcx]
xor word [rbp + rcx*2 - 0x10], ax
inc rcx
cmp rcx, 5
jb 0x7ff7e14c7ce0
lea rdx, [rbp - 0x10]
mov byte [rbp - 4], r12b
mov rcx, rbx
call sub.VCRUNTIME140.dll_wcsstr
test rax, rax
jne 0x7ff7e14c7d56
mov dword [rbp - 0x10], 0x2d262d3f
mov rcx, r12
mov dword [rbp - 0xc], 0x2d382d37
mov dword [rbp - 8], 0x2d39
mov byte [rbp - 4], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rsi + rcx]
xor word [rbp + rcx*2 - 0x10], ax
inc rcx
cmp rcx, 5
jb 0x7ff7e14c7d30
lea rdx, [rbp - 0x10]
mov byte [rbp - 4], r12b
mov rcx, rbx
call sub.VCRUNTIME140.dll_wcsstr
test rax, rax
je 0x7ff7e14c7dc1
mov esi, r12d
nop dword [rax]
mov r8, qword [rdi + 8]
lea rax, [rbp + 0x30]
mov rdx, qword [rdi]
mov r9d, 0x40
mov rcx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.kernel32.dll_VirtualProtectEx]
mov rdx, qword [rdi]
mov rcx, r15
mov r9, qword [rdi + 8]
mov r8, rdx
mov qword [rsp + 0x20], r12
call qword [sym.imp.kernel32.dll_WriteProcessMemory]
mov r9d, dword [rbp + 0x30]
mov rcx, r15
mov r8, qword [rdi + 8]
mov ebx, eax
mov rdx, qword [rdi]
mov qword [rsp + 0x20], r12
call qword [sym.imp.kernel32.dll_VirtualProtectEx]
test ebx, ebx
je 0x7ff7e14c7dc1
inc esi
add rdi, 0x18
cmp esi, 3
jb 0x7ff7e14c7d60
mov rcx, r15
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rbx, qword [rsp + 0x78]
xor eax, eax
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret

Function at 0x7ff7e14c7df0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.7ff7e14c7e50
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x7ff7e14c7e05
mov rdx, rbx
lea rcx, [rax + 0x10]
call fcn.7ff7e14c5e30
call fcn.7ff7e14c7e50
mov byte [rax + 8], 1
call fcn.7ff7e14c7e50
mov ecx, 0x1388
mov byte [rax + 9], 1
call qword [sym.imp.kernel32.dll_Sleep]
add rsp, 0x20
pop rbx
jmp fcn.7ff7e14c5b20