joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001e7b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5358], 0
lea rbx, [rcx + 0x5360]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001e857
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001e80a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.1400209b0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.14000d6f0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5358]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5368]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x1400469ad]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001e85f
mov rcx, rbx
call fcn.14000d6f0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140037fd4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003801e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003801e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003801e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003801e
cmp dword [rcx + 0x84], 0xe
jbe 0x14003801e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140038020
xor al, al
add rsp, 0x28
ret
Function at 0x180001190
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov ecx, 0xc0827
call fcn.180001db8
test rax, rax
je 0x180001264
mov qword [rsp + 0x50], rbx
lea rdx, sym.cryptHelper.dll_globalByteArray
mov qword [rsp + 0x40], rdi
mov r8d, 0xc0800
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov rcx, rdi
mov qword [rdi - 8], rax
call fcn.180005500
xor ebx, ebx
mov qword [rsp + 0x28], rbx
lea ecx, [rbx + 0x20]
call fcn.180001db8
movups xmm0, xmmword [sym.cryptHelper.dll_encryptionKey]
mov rcx, rax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x30], 0x10
movups xmmword [rax], xmm0
mov byte [rax + 0x10], bl
mov qword [rsp + 0x38], 0x1f
nop dword [rax + rax]
mov rax, rbx
and eax, 0xf
movzx eax, byte [rax + rcx]
xor byte [rbx + rdi], al
inc rbx
cmp rbx, 0xc0800
jb 0x180001210
mov rbx, qword [rsp + 0x50]
mov edx, 0x20
call fcn.180001dfc
mov rcx, rdi
call sym.cryptHelper.dll_RunPortableExecutable
mov rcx, qword [rdi - 8]
sub rdi, rcx
lea rax, [rdi - 8]
mov rdi, qword [rsp + 0x40]
cmp rax, 0x1f
ja 0x180001264
mov edx, 0xc0827
add rsp, 0x48
jmp fcn.180001dfc
call fcn.180005f7c
int3
Function at 0x180009674
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1800096a4
xor eax, eax
jmp 0x180009767
mov rbp, rbx
cmp word [rax], si
je 0x1800096c9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1800096b0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1800096ac
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180009594
movsxd r14, eax
test eax, eax
jne 0x180009707
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18000969d
mov rcx, r14
call fcn.18000799c
mov rdi, rax
test rax, rax
jne 0x180009720
xor ecx, ecx
call fcn.1800079fc
jmp 0x1800096fc
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180009594
test eax, eax
jne 0x180009751
mov rcx, rdi
call fcn.1800079fc
jmp 0x18000975b
xor ecx, ecx
call fcn.1800079fc
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18000edd0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18000edf8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18000edf8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400031e0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140004ed0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140004ed0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x140003250
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14000b0a4]
mov rbx, rcx
test esi, esi
jle 0x140003380
mov rax, qword [0x14000b0a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000329b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x140003325
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140003280
mov rcx, rbx
call fcn.140003ca0
mov rdi, rax
test rax, rax
je 0x1400033a2
mov rax, qword [0x14000b0a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140003de0
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000b0a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140003387
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000331e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140003330
add dword [0x14000b0a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000b0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000331e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400031e0
nop dword [rax]
xor esi, esi
jmp 0x1400032a8
mov rax, qword [0x14000b0a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400031e0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.1400031e0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140003910
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14000b100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000b0e0]
test rbx, rbx
je 0x14000396c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140003963
test rsi, rsi
je 0x140003963
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140003948
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140003ca0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140007b10]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140003cc0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140003cc8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140003cc0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x140003d1d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140003d14
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140003cc0
add rax, 0x28
cmp rax, r9
jne 0x140003d00
xor eax, eax
ret

Function at 0x140003d20
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140007b10]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140003d3f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140003d48
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140003d3f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140003de0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140007b10]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140003dff
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140003e08
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x1400027b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x14002a6e4], 0
lea rdi, [0x14002a6e0]
mov r11d, r8d
mov r9d, edx
mov r10, rcx
jne 0x140002888
mov qword [rsp + 0x10], rbx
xor edx, edx
mov rbx, rdi
nop dword [rax]
mov r8d, edx
lea rbx, [rbx + 4]
and r8d, 1
mov eax, edx
shr eax, 1
neg r8d
and r8d, 0xedb88320
inc edx
xor r8d, eax
mov eax, r8d
shr r8d, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, r8d
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rbx - 4], eax
cmp edx, 0x100
jb 0x1400027e0
mov rbx, qword [rsp + 0x10]
not r11d
mov eax, r11d
test r9d, r9d
jle 0x1400028be
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
movzx edx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [rdi + rdx*4]
sub r9d, 1
jne 0x1400028a0
not eax
pop rdi
ret
movzx r9d, byte [r10]
lea r8, [r10 + 1]
test r9b, r9b
je 0x1400028ff
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x1400028e3
cmp byte [r8], r9b
jne 0x1400028e3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rdi + rdx*4]
test r9b, r9b
jne 0x1400028d0
not eax
pop rdi
ret
Function at 0x140015af0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
push rbp
push r13
push r14
sub rsp, 0xb0
xor eax, eax
movsxd r13, r9d
mov dword [rsp + 0xe8], eax
mov r14, rdx
mov qword [rsp + 0x60], r13
mov rbp, rcx
test r9d, r9d
jle 0x140015d3e
mov qword [r11 + 8], rbx
lea rbx, [r8 + 0x20]
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 - 0x20], r12
xor r12d, r12d
mov qword [r11 - 0x28], r15
movaps xmmword [r11 - 0x38], xmm6
movaps xmmword [r11 - 0x48], xmm7
xorps xmm7, xmm7
movaps xmmword [r11 - 0x58], xmm8
mov r11d, 0x100
movss xmm8, dword [0x140025710]
nop dword [rax + rax]
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x140015bac
movsxd r10, dword [r14 + 0x24]
mov r9, qword [r14 + 8]
movsx ecx, r11w
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, r11w
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
movd xmm0, eax
jmp 0x140015bcb
movsxd rdx, dword [r14 + 0x1c]
xorps xmm6, xmm8
mov rax, qword [r14 + 8]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
movzx eax, byte [rbp + 0x20]
xor edi, edi
cvtdq2ps xmm0, xmm0
mov byte [rbx], al
movzx eax, byte [rbp + 0x24]
mov byte [rbx + 1], al
divss xmm6, xmm0
cmp dword [rbx - 0x10], edi
jle 0x140015ce6
mov r15, qword [rsp + 0xf0]
mov rax, r12
mov r13d, dword [rsp + 0xe8]
add r15, 6
shl rax, 4
xor esi, esi
add r15, rax
nop word [rax + rax]
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x140015c20
mov edx, dword [rbx - 0x1c]
add edx, edi
jmp 0x140015c23
mov edx, dword [rax + rsi]
mov rcx, r14
call fcn.140010b50
mov edx, eax
xorps xmm3, xmm3
mov eax, dword [rbp + 0x24]
xorps xmm2, xmm2
mov rcx, r14
cvtsi2ss xmm3, rax
mov eax, dword [rbp + 0x20]
cvtsi2ss xmm2, rax
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
mulss xmm3, xmm6
mulss xmm2, xmm6
movss dword [rsp + 0x20], xmm7
call fcn.140013780
movzx eax, word [rbp + 0x20]
inc r13d
sub ax, word [rsp + 0x50]
inc r12
dec ax
inc edi
add ax, word [rbp + 0x1c]
add rsi, 4
add ax, word [rsp + 0x54]
mov word [r15 - 2], ax
movzx eax, word [rbp + 0x24]
sub ax, word [rsp + 0x58]
dec ax
add ax, word [rbp + 0x1c]
add ax, word [rsp + 0x5c]
mov word [r15], ax
add r15, 0x10
cmp edi, dword [rbx - 0x10]
jl 0x140015c10
mov dword [rsp + 0xe8], r13d
mov r11d, 0x100
mov r13, qword [rsp + 0x60]
add rbx, 0x28
sub r13, 1
mov qword [rsp + 0x60], r13
jne 0x140015b60
movaps xmm8, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
mov r15, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xe0]
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
mov eax, dword [rsp + 0xe8]
add rsp, 0xb0
pop r14
pop r13
pop rbp
ret
Function at 0x14001fe28
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001fe72
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001fe72
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001fe72
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001fe72
cmp dword [rcx + 0x84], 0xe
jbe 0x14001fe72
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001fe74
xor al, al
add rsp, 0x28
ret
Function at 0x140026050
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x140026159
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
xchg rsi, rdi
mov qword [rsp + 0x30], rsi
xchg rsi, rdi
xchg rbx, rbp
mov rbp, rdx
xchg rbp, rbx
xchg rcx, rbx
mov rdi, rbx
xchg rcx, rbx
mov esi, r8d
sub rdi, rdx
xchg rbp, rcx
mov rcx, rbp
xchg rcx, rbp
add rdi, 0x61968c4c
sub rdi, 0x61968b5c
dec rsi
shr rsi, 2
shr rsi, 1
shr rsi, 1
inc rsi
nop dword [rax]
xchg rdx, rbx
movups xmm0, xmmword [rdx]
xchg rdx, rbx
xchg rbp, rdx
mov rbp, rdx
xchg rbp, rdx
mov rcx, rbx
call fcn.140026820
mov ecx, 0x56803c22
add ecx, 0x1ce37df3
sub ecx, 0x4350037
xor ecx, 0x7a41615
xor ecx, 0x1f3d4c7f
sub ecx, 0x77b7e3a4
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140026108
sub rdi, 0x10
movups xmmword [rbp + 0xf0], xmm0
sub rsi, 1
jne 0x1400260be
xchg rsi, rdi
mov rsi, qword [rsp + 0x30]
xchg rsi, rdi
xchg rbx, r11
mov r11, qword [rsp + 0x38]
xchg rbx, r11
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140026170
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 8], r13
xchg r13, rbx
xchg rbp, r13
mov qword [rsp + 0x10], r13
xchg rbp, r13
mov qword [rsp + 0x18], rsi
push rbx
mov qword [rsp], rdi
sub rsp, 0x20
mov edi, r8d
xchg rbx, rdx
mov rdx, rbx
xchg rbx, rdx
lea r9, [rcx + 0xf0]
xchg rsi, rcx
mov rcx, rsi
xchg rsi, rcx
test r8d, r8d
je 0x140026242
dec rdi
shr rdi, 1
shr rdi, 3
inc rdi
nop dword [rax]
nop word [rax + rax]
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
sub r9, rbx
mov edx, 0x7593fe17
xor edx, 0x6e5f05b2
add edx, 0xe9d6a97
add edx, 0x2fc70eb
add edx, 0x4fae4295
xor edx, 0x7d1519ac
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140026205
xchg r10, rsi
mov rdx, r10
xchg rsi, r10
xchg rcx, rsi
mov rsi, rbx
xchg rsi, rcx
call fcn.140026300
mov r9, rbx
add rbx, 0x10
sub rdi, 1
jne 0x1400261d3
xchg r9, r8
movups xmm0, xmmword [r8]
xchg r9, r8
xchg rcx, rbx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
xchg rbp, r12
mov r12, qword [rsp + 0x38]
xchg r12, rbp
xchg rsi, r10
movups xmmword [r10 + 0xf0], xmm0
xchg r10, rsi
xchg r11, rsi
mov r11, qword [rsp + 0x40]
xchg rsi, r11
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400279c0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov qword [rsp + 8], rbx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x10
mov rbx, rdx
xchg r10, r12
mov r12, rcx
xchg r10, r12
test r8b, 0xf
je 0x140027a11
xor al, al
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
push rbx
push rax
push rdx
push rdx
push rax
push rdx
xchg qword [rsp + 0x30], rdi
pop rdx
pop rax
pop rdx
pop rdx
pop rax
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
xor edx, edx
test r8d, r8d
je 0x140027acd
movdqa xmm2, xmmword [rsp]
nop
xchg rdx, r8
movdqu xmm1, xmmword [r8 + rbx]
xchg rdx, r8
test edx, edx
jne 0x140027a45
xchg r13, r10
movdqu xmm2, xmmword [r13 + 0x200]
xchg r13, r10
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
pxor xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0x6f83eaa7
xor ecx, 0x21b1be44
add ecx, 0x279dc07a
add ecx, 0x3d43c34
sub ecx, 0x4cce02c7
sub ecx, 0xb4a5303
xor ecx, 0x218bfbca
nop dword [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027a87
aesdeclast xmm0, xmmword [r10 + 0x1e0]
pxor xmm0, xmm2
movdqa xmm2, xmm1
xchg rdx, r10
movups xmmword [r10 + r9], xmm0
xchg rdx, r10
nop
sub edx, 0x5d282a74
add edx, 0x5d282a84
cmp edx, r8d
jb 0x140027a22
mov rbx, qword [rsp + 0x20]
mov al, 0x53
sub al, 0x4c
xor al, 0x69
xor al, 0x4d
add al, 0xa
add al, 8
add al, 0x46
sub al, 0x7a
add rsp, 0x10
push rbx
xchg qword [rsp + 8], rdi
add rsp, 0x10
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140027b00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x10
xchg r11, rdx
mov rbx, r11
xchg rdx, r11
mov r10, rcx
test r8b, 0xf
je 0x140027b35
xor al, al
add rsp, 0x10
nop
add rsp, 8
xchg qword [rsp - 8], rbx
nop
add rsp, 8
jmp qword [rsp - 8]
xor edx, edx
test r8d, r8d
je 0x140027be4
movdqa xmm0, xmmword [rsp]
mov qword [rsp + 0x20], rdi
nop dword [rax + rax]
movdqu xmm1, xmmword [rdx + rbx]
test edx, edx
jne 0x140027b65
movdqu xmm0, xmmword [r10 + 0x200]
pxor xmm0, xmm1
lea rax, [r10 + 0x10]
pxor xmm0, xmmword [r10 + 0x1e0]
mov ecx, 0x39e7249a
add ecx, 0x2f20f671
xor ecx, 0x3bcd6cd7
sub ecx, 0x3b54ed0
xor ecx, 0x1557b8b8
sub ecx, 0x4c823612
xor ecx, 0x7ab24528
sub ecx, 0x77771e7d
nop dword [rax + rax]
aesenc xmm0, xmmword [rax]
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x140027bad
aesenclast xmm0, xmmword [r10 + 0xe0]
movups xmmword [rdx + r9], xmm0
neg edx
add edx, 0xfffffff0
neg edx
cmp edx, r8d
jb 0x140027b4f
mov rdi, qword [rsp + 0x20]
mov al, 0x29
sub al, 0xa
sub al, 9
add al, 0x21
add al, 0x33
xor al, 0x1b
xor al, 0x69
xor al, 0x50
xor al, 0x49
add rsp, 0x10
nop
add rsp, 8
xchg qword [rsp - 8], rbx
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140028970
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 8], r15
xchg rbx, r15
xchg rsi, r15
mov qword [rsp + 0x10], r15
xchg r15, rsi
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg rsi, rbx
mov rsi, r8
xchg rsi, rbx
mov rdi, rdx
mov rsi, rcx
jne 0x140028a1f
nop
xchg r8, rdx
mov rdx, qword [rbx + 0x10]
xchg rdx, r8
xchg rdi, rdx
mov rdi, rdx
xchg rdi, rdx
xchg rcx, r11
mov r11, rsi
xchg r11, rcx
call fcn.140028970
xchg rcx, r8
mov r8, rbx
xchg r8, rcx
mov edx, 0x678c5c8b
xor edx, 0x1f122dbd
sub edx, 0x2c638332
add edx, 0x2abdac1f
xor edx, 0x54ea7a1d
add edx, 0x3227dcb6
xor edx, 0x27597e51
xor edx, 0x49eaec2d
sub edx, 0x3a892e58
mov rbx, qword [rbx]
call fcn.1401fc5cc
cmp byte [rbx + 0x19], 0
je 0x1400289ae
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rbx, rdx
xchg rsi, r10
mov r10, qword [rsp + 0x38]
xchg rsi, r10
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140029920
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 8], r11
xchg r11, rbx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
xor ebx, ebx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1400299b2
mov rdx, qword [rdi + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x140029995
mov r8, qword [rcx - 8]
nop
sub rdx, 0x3c35f43b
add rdx, 0x3c35f462
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140029a5f
xchg r10, r8
mov rcx, r10
xchg r8, r10
call fcn.1401fc5cc
xchg rsi, rbx
mov qword [rdi + 0x18], rsi
xchg rsi, rbx
xchg r13, rbx
mov qword [rdi + 0x20], r13
xchg rbx, r13
mov qword [rdi + 0x28], rbx
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], rbx
mov rcx, qword [rcx]
test rcx, rcx
je 0x140029a0e
nop dword [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x4a1d38ec
sub edx, 0x474f251b
add edx, 0x882b20
add edx, 0x7869f4b2
xor edx, 0x31a5a860
xor edx, 0x4dc50149
sub edx, 0x7a09a72
call fcn.1401fc5cc
mov rcx, rbx
test rbx, rbx
jne 0x1400299d1
mov rcx, qword [rdi + 8]
mov edx, 0x3af0610d
sub edx, 0x1b1ba269
xor edx, 0x5f24b288
sub edx, 0xec399d
add edx, 0x9165ed5
add edx, 0x1418adc5
sub edx, 0x49628fa1
add edx, 0x36df3135
sub edx, 0x4aaf80a5
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
jmp fcn.1401fc5cc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14002ca80
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
xchg rcx, rbx
mov qword [rsp + 0x10], rcx
xchg rcx, rbx
mov qword [rsp + 0x18], rsi
xchg rbx, rdi
mov qword [rsp + 0x20], rbx
xchg rbx, rdi
push r8
mov qword [rsp], r14
sub rsp, 0x30
xchg rcx, rsi
mov rcx, rsi
xchg rsi, rcx
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x60]
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
xchg rbx, r11
mov qword [rsp + 0x40], r11
xchg r11, rbx
sub rcx, 0x273f31e9
add rcx, 0x273f32b1
xchg r11, rbx
mov qword [rsp + 0x28], r11
xchg rbx, r11
mov dword [rsp + 0x20], 0x12eff572
add dword [rsp + 0x20], 0x79423bb
xor dword [rsp + 0x20], 0x247cfa99
sub dword [rsp + 0x20], 0xef97181
add dword [rsp + 0x20], 0x3138e8ad
xor dword [rsp + 0x20], 0x61385ae8
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b740
test eax, eax
js 0x14002cb46
cmp qword [rsp + 0x40], rbx
je 0x14002cb46
lea eax, [rbx + 1]
jmp 0x14002cc74
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0x70], 2
jbe 0x14002cb85
mov eax, 0x75f2022b
add eax, 0x69bc90b
sub eax, 0x75a2ffc1
add eax, 0x150b2927
add eax, 0x5eab485e
xor eax, 0x37b75d5
sub eax, 0x79da492d
jmp 0x14002cc74
cmp dword [rcx + 0x74], ebx
jbe 0x14002cbb6
mov eax, 0x67a5aa8
xor eax, 0x24ecabd2
xor eax, 0x624e810
add eax, 0x309e6ebd
xor eax, 0x56de754d
add eax, 0x5f681317
sub eax, 0x62f7107e
jmp 0x14002cc74
cmp byte [rdi + 2], bl
je 0x14002cbec
mov eax, 0x3b511ebe
xor eax, 0x66d4412f
xor eax, 0x7d2bb21b
sub eax, 0x15e3968c
add eax, 0xf860c01
add eax, 0x1ca9c313
add eax, 0x46609d2d
sub eax, 0x7d5bc33b
jmp 0x14002cc74
cmp r14d, 0xa
jb 0x14002cc33
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002cc33
mov eax, 0x54fd7912
xor eax, 0x1bcc4a91
xor eax, 0x5f118117
xor eax, 0x7d3b4439
xor eax, 0x40842bed
sub eax, 0x14a36cac
xor eax, 0x18fc709c
jmp 0x14002cc74
lea rcx, [rsi + 0xb8]
mov edx, 0x7a8ba484
sub edx, 0xdd4ec38
xor edx, 0x15033c6b
xor edx, 0x55fa8105
sub edx, 0x28373b3a
add edx, 0x3f6032b9
xor edx, 0xdaee6538
call fcn.14002c070
jmp 0x14002cc72
mov eax, ebx
xchg rbx, r14
mov r14, qword [rsp + 0x48]
xchg r14, rbx
mov rsi, qword [rsp + 0x50]
xchg rdi, r9
mov r9, qword [rsp + 0x58]
xchg rdi, r9
add rsp, 0x30
push rdx
xchg qword [rsp + 8], r14
add rsp, 0x10
nop
add rsp, 8
jmp qword [rsp - 8]