joyce8/EMBER2024-capa huggingface dataset:
Function at 0x420420
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x00d5fd57], 0
jne 0x420507
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x50]
test byte [rdx], al
mov esi, dword [rax + 0x64]
imul rbx, rsi
mov rsi, rbx
shr rbx, 0x20
shr rsi, 0x23
and ebx, 7
mov rdi, rcx
mov rcx, rbx
mov r8d, 1
shl r8d, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], r8b
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
lea rax, [rdx + rcx]
mov rdx, rax
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x4204fa
lea rbx, [0x00d32138]
mov rdx, qword [rbx + rdx*8]
test byte [rdx], al
mov rbx, rcx
shr rbx, 0x10
and ebx, 0x3f
shr rcx, 0xd
and ecx, 7
mov esi, 1
shl esi, cl
shr rax, 0x16
and eax, 0xfffff
mov rax, qword [rdx + rax*8]
test byte [rax], al
movzx edx, byte [rax + rbx + 0x11440]
lea rax, [rax + rbx]
lea rax, [rax + 0x11440]
test sil, dl
jne 0x4204e0
lock or byte [rax], sil
mov rax, qword [r14 + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
add qword [rax + 0x1250], rdi
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.00467300
lea rax, [0x009790ec]
mov ebx, 0x2c
call fcn.00437500
nop
int3

Function at 0x4227e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4228e6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x422823
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x4228db
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.004235c0
test rax, rax
je 0x4228db
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x00422920]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00464f00
xorps xmm15, xmm15
mov r14, qword [0x00d5fff0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x4228c9
xor eax, eax
jmp 0x4228d3
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x422811
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00465040
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.004227e0
Function at 0x430b60
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x430de6
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
mov rcx, qword [rax + 0x1268]
lea rsi, [rax + 0x1278]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x430dda
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x00d5fd57], 0
jne 0x430bba
xor edx, edx
xor ebx, ebx
jmp 0x430c00
xor edx, edx
jmp 0x430be5
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call fcn.0041fc80
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x430bbe
add rax, 0x1268
call fcn.00430ae0
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x430d74
mov rsi, qword [rax + rdx*8 + 0x1278]
cmp rsi, 0x1000
jb 0x430bfb
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.00413ee0
test rax, rax
jne 0x430c4c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x430bfb
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x430c8c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x430bfb
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x430dcd
lea r10, [0x00d32138]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x11440]
lea r8, [r8 + r10]
lea r8, [r8 + 0x11440]
test r11b, r9b
jne 0x430d0f
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x6a]
test r8b, 1
je 0x430d45
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x70]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x430bfb
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x430dc5
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x430bfb
cmp rbx, 0x200
ja 0x430db4
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.004264c0
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call fcn.00430ae0
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.00467360
mov rax, r8
call fcn.004672e0
mov rax, r8
mov ecx, 0x40
call fcn.00467300
mov edx, 0x200
nop
call fcn.00467340
nop
mov qword [rsp + 8], rax
call fcn.0046bbe0
mov rax, qword [rsp + 8]
jmp fcn.00430b60
Function at 0x4460a0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x446207
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x4460b2
cmp edx, ecx
jne 0x4461f5
nop word [rax + rax]
test rsi, rsi
jne 0x4461f5
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x446114
nop
call fcn.00468b80
xorps xmm15, xmm15
mov r14, qword [0x00d5fff0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00445fc0
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x4461f0
mov rdx, qword [0x00d0a348]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x4461e5
mov rcx, qword [0x00d0a340]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x00d0bf30]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x00d0bf30], rax
nop
mov edx, 1
lea rsi, [0x00d0bf38]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x4461d3
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x009789ff]
mov ebx, 0x28
nop
call fcn.00437500
mov rax, rsi
mov rcx, rdx
call fcn.004672e0
call fcn.00435a00
lea rax, [0x00977f8a]
mov ebx, 0x23
call fcn.00437500
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00465040
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004460a0
Function at 0x453320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x453497
movzx edx, byte [rax]
test edx, edx
jne 0x453354
nop dword [rax]
test r8b, r8b
jne 0x453354
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x453367
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x453457
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x453445
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x453437
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x4533bd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x453400
mov eax, 1
cmp rax, rbx
ja 0x4533eb
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.004673a0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x45342f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x4533f3
mov rcx, r11
mov eax, r12d
jmp 0x4533c2
mov rcx, rbx
call fcn.004672e0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004672e0
mov eax, r8d
mov rcx, rbx
call fcn.004673a0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x45348d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x453450
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x45336d
mov eax, edx
mov rcx, rbx
call fcn.004672e0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004672e0
nop
int3
Function at 0x45ad00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45adaf
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x0045ae00]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00464f00
xorps xmm15, xmm15
mov r14, qword [0x00d5fff0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00465040
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0045ad00
Function at 0x466e80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00d60300]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x00d5fd50], 0
je 0x466eb6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00d60800]
aesenc xmm0, xmmword [0x00d60810]
aesenc xmm0, xmmword [0x00d60820]
movq rax, xmm0
ret
jmp 0x409e40
Function at 0x140039d80
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10088
call fcn.14005f060
sub rsp, rax
mov rax, qword [0x14009d280]
xor rax, rsp
mov qword [rsp + 0x10070], rax
xor eax, eax
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x70], ax
mov word [rsp + 0x20], ax
lea r8d, [rax + 0x28]
call fcn.140059a20
mov r8d, 0x10000
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x140039dfd
lea rcx, [rsp + 0x70]
call fcn.140071640
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.14005f030
add rsp, 0x10088
ret
xor eax, eax
mov rcx, qword [rsp + 0x10070]
xor rcx, rsp
call fcn.14005f030
add rsp, 0x10088
ret

Function at 0x140039ee0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14009d280]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rcx, [0x1400808c8]
call fcn.140039d80
xor edi, edi
mov qword [0x1400a12f8], rax
lea rdx, [0x1400808c8]
mov word [rsp + 0x20], di
lea rcx, [rsp + 0x20]
lea r8d, [rdi + 0x28]
call fcn.140059a20
lea rdx, [0x1400808d0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rcx, str.PYTHONHOME
call fcn.140039d80
mov cl, 1
mov qword [0x1400a1300], rax
call fcn.14005acc0
lea r8d, [rdi + 0x28]
mov word [rsp + 0x20], di
lea rdx, str.PYTHONHOME
mov rbx, rax
lea rcx, [rsp + 0x20]
call fcn.140059a20
mov rdx, rbx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov cl, 1
call fcn.14005acc0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov rax, qword [sym.imp.python39.dll__Py_path_config]
mov dword [rax + 0x30], 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14005f030
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x14003a480
Capabilities:
Set environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x14009d280]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r8
mov rsi, rdx
mov rbp, rcx
call fcn.140049bd0
lea rdx, str.environ
mov rcx, rax
call qword [sym.imp.python39.dll_PyObject_GetAttrString]
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.python39.dll_PyUnicode_FromString]
mov rdx, rsi
lea rcx, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov word [rsp + 0x20], ax
lea r8d, [rax + 0x28]
call fcn.140059a20
lea rcx, [rsp + 0x20]
test r14, r14
je 0x14003a543
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, 0xffffffffffffffff
mov rcx, r14
call sub.python39.dll_PyUnicode_FromWideChar
mov r8, rax
mov rdx, rdi
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.python39.dll_PyObject_SetItem]
test eax, eax
je 0x14003a531
mov ecx, 1
call qword [sym.imp.python39.dll_PyErr_PrintEx]
mov ecx, 1
call qword [sym.imp.python39.dll_Py_Exit]
int3
sub qword [rsi], 1
jne 0x14003a563
mov rax, qword [rsi + 8]
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x14003a563
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.python39.dll_PyObject_DelItem]
test eax, eax
je 0x14003a563
mov rcx, rbp
call fcn.1400398d0
sub qword [rdi], 1
jne 0x14003a573
mov rax, qword [rdi + 8]
mov rcx, rdi
call qword [rax + 0x30]
sub qword [rbx], 1
jne 0x14003a583
mov rax, qword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14005f030
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140059ad0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r8, rcx
mov eax, 0xffffffff
test edx, edx
je 0x140059b94
mov r9d, edx
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r8]
lea r8, [r8 + 1]
xor eax, edx
mov edx, eax
and dl, 1
neg dl
sbb ecx, ecx
shr eax, 1
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb edx, edx
shr ecx, 1
and edx, 0xedb88320
xor edx, ecx
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0xedb88320
xor ecx, edx
mov eax, ecx
and al, 1
neg al
sbb eax, eax
shr ecx, 1
and eax, 0xedb88320
xor eax, ecx
sub r9, 1
jne 0x140059af0
not eax
ret
Function at 0x14005fa94
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005fade
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005fade
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005fade
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005fade
cmp dword [rcx + 0x84], 0xe
jbe 0x14005fade
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005fae0
xor al, al
add rsp, 0x28
ret

Function at 0x140064f38
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140064da3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140064da3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140064da3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140064da3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140064da3
cmp dword [rcx + 0x84], 0xe
jbe 0x140064da3
cmp dword [rcx + 0xf8], 0
je 0x140064da3
mov ecx, ebx
call fcn.140064e54
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140064c30
nop
cmp dword [rbp + 0x20], 0
je 0x140064df1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140064dfc
int3
xor r8d, r8d
xor edx, edx
jmp 0x140064d34
Function at 0x1400767c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140076847
mov rsi, rbx
cmp word [rax], bp
je 0x140076806
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400767f0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400767ec
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140071e2c
mov rdi, rax
test rax, rax
je 0x140076834
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14007c480
mov rbp, rdi
xor ecx, ecx
call fcn.140072974
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140079f60
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140079f76
mov al, 1
jmp 0x140079fd6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140079f87
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140079fd4
mov ecx, dword [rcx + 0x18]
nop
call fcn.140076b08
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140079fd4
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140079fd4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140079fd4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140079fd6
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x14007c2d0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14007c2f8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14007c2f8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x180002030
Capabilities:
Acquire debug privileges

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor ebx, ebx
mov rsi, r8
cmp qword [0x18003b100], rbx
je 0x1800020dd
mov edx, 0x1cd
lea rcx, [rsp + 0x20]
call fcn.18000884c
cmp qword [rax + 0x18], 0x10
jb 0x18000206a
mov rax, qword [rax]
mov rcx, qword [0x18003b100]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, qword [rsp + 0x38]
mov rdi, rax
cmp rdx, 0x10
jb 0x1800020b6
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800020b1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800020ef
call fcn.1800102b0
movdqa xmm0, xmmword [0x180030ff0]
mov byte [rsp + 0x20], bl
movdqu xmmword [rsp + 0x30], xmm0
test rdi, rdi
je 0x1800020dd
mov r8, rsi
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call rdi
mov ebx, eax
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
call fcn.180016bf4
int3

Function at 0x1800031e8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov eax, dword [rcx]
mov rdi, rcx
mov r10d, 4
xor ebx, ebx
xor r9d, r9d
test eax, eax
jle 0x180003222
mov r11, r8
mov al, byte [r11]
inc ebx
mov rcx, qword [rdx]
lea r11, [r11 + 4]
xor byte [rcx + r9], al
inc r9
mov eax, dword [rdi]
cmp ebx, eax
jl 0x180003209
add rdx, 8
inc r8
sub r10, 1
jne 0x1800031fd
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x18000323c
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
mov rdi, rcx
mov r12d, 4
mov ecx, r12d
mov rbp, r8
mov rsi, rdx
call fcn.1800105bc
mov ecx, r12d
mov rbx, rax
call fcn.1800105bc
mov edx, dword [rdi + 4]
xor r13d, r13d
mov r9, rax
mov r10d, r13d
lea ecx, [rdx*4]
test ecx, ecx
jle 0x1800032b2
mov rcx, rbp
sub rsi, rbp
mov al, byte [rsi + rcx]
inc r10d
mov byte [rcx], al
inc rcx
mov edx, dword [rdi + 4]
lea eax, [rdx*4]
cmp r10d, eax
jl 0x180003298
mov eax, dword [rdi + 8]
lea r10d, [rdx*4]
inc eax
imul eax, dword [rdi]
shl eax, 2
cmp r10d, eax
jge 0x18000345a
movsxd r14, r10d
add r14, 0xfffffffffffffffd
add r14, rbp
mov sil, byte [r14 - 1]
mov eax, r10d
cdq
mov byte [rbx], sil
mov cl, byte [r14]
and edx, 3
add eax, edx
mov byte [rbx + 1], cl
mov r8b, byte [r14 + 1]
sar eax, 2
mov byte [rbx + 2], r8b
cdq
mov r11b, byte [r14 + 2]
mov byte [rbx + 3], r11b
idiv dword [rdi + 4]
test edx, edx
jne 0x1800033a4
mov byte [rbx + 1], r8b
mov rdx, rbx
mov r8, r12
mov byte [rbx], cl
lea r12, [0x180030b00]
mov byte [rbx + 2], r11b
mov byte [rbx + 3], sil
movzx eax, byte [rdx]
mov ecx, eax
and eax, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rax
mov al, byte [rcx + r12]
mov byte [rdx], al
inc rdx
sub r8, 1
jne 0x180003328
mov ecx, dword [rdi + 4]
mov eax, r10d
shl ecx, 2
cdq
idiv ecx
mov r8b, 1
mov r12d, 4
dec eax
test eax, eax
jle 0x18000337b
mov edx, eax
mov al, r8b
add r8b, r8b
shr al, 7
movzx eax, al
imul ecx, eax, 0x1b
xor r8b, cl
sub rdx, 1
jne 0x180003363
and word [r9 + 2], 0
mov rdx, r9
mov byte [r9], r8b
sub rdx, rbx
mov byte [r9 + 1], r13b
mov rcx, rbx
mov r8, r12
mov al, byte [rdx + rcx]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x180003394
jmp 0x1800033dd
cmp dword [rdi + 4], 6
jle 0x1800033dd
cmp edx, r12d
jne 0x1800033dd
mov rdx, rbx
lea r13, [0x180030b00]
mov r8, r12
movzx eax, byte [rdx]
mov ecx, eax
and eax, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rax
mov al, byte [rcx + r13]
mov byte [rdx], al
inc rdx
sub r8, 1
jne 0x1800033bc
xor r13d, r13d
mov ecx, dword [rdi + 4]
mov eax, r10d
shl ecx, 2
sub eax, ecx
movsxd rcx, eax
mov al, byte [rcx + rbp]
xor al, byte [rbx]
mov byte [r14 + 3], al
mov eax, r10d
mov ecx, dword [rdi + 4]
shl ecx, 2
sub eax, ecx
movsxd rcx, eax
mov al, byte [rcx + rbp + 1]
xor al, byte [rbx + 1]
mov byte [r14 + 4], al
mov eax, r10d
mov ecx, dword [rdi + 4]
shl ecx, 2
sub eax, ecx
movsxd rcx, eax
mov al, byte [rcx + rbp + 2]
xor al, byte [rbx + 2]
mov byte [r14 + 5], al
mov eax, r10d
mov ecx, dword [rdi + 4]
add r10d, r12d
shl ecx, 2
sub eax, ecx
movsxd rcx, eax
mov al, byte [rcx + rbp + 3]
xor al, byte [rbx + 3]
mov byte [r14 + 6], al
add r14, 4
mov eax, dword [rdi + 8]
inc eax
imul eax, dword [rdi]
shl eax, 2
cmp r10d, eax
jl 0x1800032d8
mov rcx, r9
call fcn.1800102b0
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
jmp fcn.1800102b0