joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140144370
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov ecx, 0xd8
mov esi, r8d
mov rdi, rdx
call qword [fcn.140167bc0]
mov rbx, rax
test rax, rax
jne 0x1401443ad
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
lea rax, [0x1401c2ca8]
lea rcx, [rbx + 0x18]
mov qword [rsp + 0x38], rbp
mov qword [rbx], rax
lea rax, [rcx + 0x58]
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rax
cmp esi, 0x40
jbe 0x140144401
call qword [0x1401c2ca8]
mov rcx, qword [rbx + 8]
mov r8d, esi
mov rdx, rdi
call qword [fcn.140142190]
mov rdi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
add rdi, 0x58
mov rcx, rdi
call qword [fcn.140142260]
mov esi, reloc.WS2_32.dll_recv
mov rcx, qword [rbx + 8]
call qword [0x1401c2ca8]
mov rcx, qword [rbx + 0x10]
call qword [0x1401c2ca8]
xor ebp, ebp
test rsi, rsi
je 0x14014446b
mov rbp, rsi
nop
movzx eax, byte [rdi]
lea rdx, [rsp + 0x30]
mov r8d, 1
xor al, 0x36
mov byte [rsp + 0x30], al
mov rcx, qword [rbx + 8]
call qword [fcn.140142190]
movzx eax, byte [rdi]
lea rdx, [rsp + 0x30]
xor al, 0x5c
mov r8d, 1
lea rdi, [rdi + 1]
mov byte [rsp + 0x30], al
mov rcx, qword [rbx + 0x10]
call qword [fcn.140142190]
dec rsi
jne 0x140144420
cmp rbp, 0x40
jae 0x1401444a6
mov edi, 0x40
sub rdi, rbp
mov rcx, qword [rbx + 8]
lea rdx, [0x1401bb0a3]
mov r8d, 1
call qword [fcn.140142190]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1401bb0b1]
mov r8d, 1
call qword [fcn.140142190]
dec rdi
jne 0x140144473
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140175b64
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1401759cc
Function at 0x6d8c1f80
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d8e35e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d8c2108
mov rax, qword [0x6d8e35e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d8c1fcc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d8c2055
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d8c1fb0
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d8c213d
mov rax, qword [0x6d8e35e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d8e35e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d8c2120
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d8c204e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d8c20b0
add dword [0x6d8e35e4], 1
cmp edi, 8
jae 0x6d8c2083
test dil, 4
jne 0x6d8c20f4
test edi, edi
je 0x6d8c2078
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d8c210f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d8c2078
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d8c209c
jmp 0x6d8c2078
add rsi, qword [0x6d8e35e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d8c204e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d8c2078
xor esi, esi
jmp 0x6d8c1fd7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d8c2078
mov rax, qword [0x6d8e35e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d8c2890
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d8e38c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d8e38a0]
test rbx, rbx
je 0x6d8c28e4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d8c28db
test rsi, rsi
je 0x6d8c28db
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d8c28c0
lea rcx, [0x6d8e38c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d8c2b20
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d8c2b30
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d8c2b40
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d8c2b81
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d8c2b78
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d8c2b83
add rax, 0x28
cmp rax, r9
jne 0x6d8c2b64
xor eax, eax
ret

Function at 0x6d8c2c20
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8e01f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d8c2c8d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8c2c8d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8c2c8d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8c2c84
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8c2c8f
add rax, 0x28
cmp rax, r9
jne 0x6d8c2c70
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d8c2d90
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8e01f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d8c2db0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8c2da8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8c2e0d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8c2e04
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8c2e14
add rax, 0x28
cmp rax, r9
jne 0x6d8c2df0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d8c2e30
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d8e01f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d8c2e9e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8c2e9e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d8c2e9e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d8c2e9e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d8c2e95
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d8c2ea5
add rcx, 0x28
cmp rcx, rax
jne 0x6d8c2e80
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d8c2eb8
jmp 0x6d8c2e9e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d8c2ec6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d8c2e9e
test r9d, r9d
jg 0x6d8c2eb0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d8c3230
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x14000139c
Capabilities:
Encode data using xor

Disassembly:
jne 0x14000121c
invalid
invalid
invalid
add byte [rax], 0

Function at 0x140004e9c
Capabilities:
Encode data using xor

Disassembly:
movabs eax, dword [0xc028d008bf8f225f]
xchg esp, eax
jb 0x140004f1f
sub esp, dword [rax + 0x7095df31]
push rax
mov edi, 0xeb015358
insd dword [rdi], dx
sbb edi, dword [rdx - 0x20866d16]
retf
jne 0x140004f65
mov ecx, dword [rsi + 0x36]
xor ebp, dword [rcx - 0x5e]
invalid
out dx, eax
movsb byte [rdi], byte [rsi]
xor dword [rdi + rax + 0xeb1d5b5], edi
push 0xfffffffff89f9804
sub eax, 0x664eb50d
ror dword [rbp + 0x6b], 1
mov fs, word [rdx - 0x2d297273]
add esp, edi
or al, 0x55
cmp al, 0x7d
fsub dword [rbp + 3]
push rax
xor al, 0x35
push rdi
mov ch, 0xdf
invalid

Function at 0x14000941c
Capabilities:
Encode data using xor

Disassembly:
sub dh, byte [rax]
in eax, dx
mov ch, 0x69
pxor mm1, qword [rdx + rsi*4 + 0x2022a013]
movabs al, byte [0x92914acc49b6f530]
mov dl, 0x13
movabs al, byte [0xcc49b6f530a02022]
xchg rcx, rax
xchg edx, eax
cmp bl, byte [rcx]
sti
cmp al, 0xb1
jno 0x1400093aa
cmp bl, bl
sbb ebp, dword [rsi + 0x4d]
sbb al, 0x5e
mov edi, 0x5411b169
add byte [rbp + 0x48b6ce51], dh
mov cl, 0xb5
lahf
sub ah, al
outsd dx, dword cs:[rsi]
pop rsi
xchg esp, eax
lodsb al, byte [rsi]
popfq
in al, dx
push 0x64711923
sbb eax, 0xbfab7f7f
invalid
sbb dword [rdi - 0x43], esp
fbld tbyte [rdx + rax*8]
jnp 0x1400093b2
sbb eax, 0xb8a497e1
push 0x283490b8
pop rbp
pop r15
mov esi, 0x207e816f
xor cl, cl
imul esp, dword [rcx - 0x234159fa], 0xffffffc3
pop rdi

Function at 0x14000d410
Capabilities:
Encode data using xor

Disassembly:
out 0xa, eax
jp 0x14000d475
lodsb al, byte [rsi]
or eax, dword [rbx - 0x3f]
lodsb al, byte [rsi]
fild dword [rax]
or dword [rbx + rax - 0x39259252], eax
add dword [rbx + 0x1203d3e2], 0x645e2834
ja 0x14000d487
add ebp, dword [rsi - 0x7e392593]
and edx, 0xffffffd3
add edx, dword [rdx]
xor al, 0x28
pop rsi
ja 0x14000d487
jnp 0x14000d47e
mov ecx, 0xee6e23c6
enter 0xffffffffffffe0e0, 0xffffffffffffff9b
clc
add byte [rax - 0x656f6f70], dl
out 0x8b, eax

Function at 0x140011848
Capabilities:
Encode data using xor

Disassembly:
stc
push r14
cmp ebx, dword [rax]
jp 0x14001187d
clc
and dword [rax + 0x3f], esp
or dword [r13 + rax - 0x4e697487], r10d
push rcx
adc eax, 0x1f20baa3
xchg edi, eax
xchg dword [rax - 0x57], edi
mov dword [rax + 0x701457c2], 0x38f09a93
invalid
invalid

Function at 0x1400122c0
Capabilities:
Encode data using xor

Disassembly:
and eax, 0x6a464de0
cmp eax, 0x4441594
pop rsi
invalid
mov ebx, 0xff3b5035
add al, byte [rdi]
xor al, 0x77
xor dl, ah
adc byte [rsi - 0x60f405b6], ch
mov bl, 0x43
cmpsb byte [rsi], byte [rdi]
jnp 0x1400122a4
iretq

Function at 0x140016810
Capabilities:
Encode data using xor

Disassembly:
xor dword [rbx + 0x24], esi
xchg edx, eax
mov bh, 0xa8
push rsi
xor ah, byte [rbx]
adc edx, edx
cdq
fstp qword [rcx]
cli
sub al, r12b
sbb al, 0x84
loope 0x140016813
invalid

Function at 0x14002aef0
Capabilities:
Encode data using xor

Disassembly:
cmpsb byte [rsi], byte [rdi]
sbb esp, dword [rbp + 0x31]
movabs rsp, 0x3955fc10828b1ee1
scasb al, byte [rdi]
invalid
Function at 0x14002c45c
Capabilities:
Encode data using xor

Disassembly:
xor esi, dword [rdx + rdi*4 - 0x52]
sub eax, 0x3e8345bd
cmp dword [r14], 0xffffffa3
sbb bl, ch
jmp 0x1564200a9
push 0x5a
mov dh, 0xee
wait
popfq
mov eax, 0xcd3f1eae
xchg bh, ch
jno 0x14002c43e
invalid

Function at 0x14002f04c
Capabilities:
Encode data using xor

Disassembly:
adc dword [rbx + 0x5b5668], edi
fstp xword [rdx - 0xc1461b3]
lodsb al, byte [rsi]
mov cl, 0xa1
invalid
lock sbb dword [rdi], ecx
in eax, 0x68
pop rsp
in al, 7
jge 0x14002f099
push r12
movabs dword [0xd90f405f91c298e7], eax
out dx, al
xor cl, byte [rdi - 0x30ea94e3]
pop rbp
push rdi
push rax
and byte [rdx], 0x84
loopne 0x14002f011
sbb dword [rcx], ecx
or esi, dword [rdx + 0x3f]
xor bh, al
sahf
sbb eax, dword [rax]
test dword [rdx], ebx
std
mov ch, byte [rax - 0x3f]
scasd eax, dword [rdi]
js 0x14002f0f9
in al, 0xfc
mov bl, 0x48
invalid
in eax, 4
not ebp
fiadd word [rax - 0x222f0d7e]
mov esp, 0x64713b27
invalid
stosd dword [rdi], eax
invalid
xchg r12d, eax
jne 0x14002f0e6
jg 0x14002f154
int1
out 0xa8, al
xchg ebp, eax
stosd dword [rdi], eax
loope 0x14002f143
pop rcx
add eax, 0x2224758d
xchg esi, eax
xchg esp, eax
invalid
pushfq
or al, 0xcd
leave
in al, 0xcf
jne 0x14002f155
mov fs, word [rax + riz*4]
jl 0x14002f1ae
invalid
push rsp
stosb byte [rdi], al
adc eax, 0x5295ff6d
cdq
fbstp tbyte [rax]
push rax
popfq
pop rdi
test byte [0x11178488f], al
push rdi
jne 0x14002f128
adc eax, 0x2bab8628
mov eax, dword [rax + 0x54]
cld
mul dword [rdx + 0x3fc698b3]
xchg ebp, eax
invalid
out dx, eax
invalid

Function at 0x140041b28
Capabilities:
Encode data using xor

Disassembly:
jle 0x140041a9d
xlatb
xchg edi, eax
test al, 0x99
push 0x7230b276
add dh, byte [rsi]
cmpsd dword [rsi], dword [rdi]
jno 0x140041b60
push rbx
and byte [rdx - 0x50], cl
jbe 0x140041ac8
mov al, 0xc9
sub byte [rdx + 0x5059445f], 0x41
and esp, edx
wait
xor eax, 0xc5a91199
xchg ebx, eax
cmc
invalid
pop rsi
mov eax, 0xcf3c4080
add byte [rax + 0x3c], 0xcf
and al, 0x62
sub ecx, ebp
push bx
pop rbp
popfq
xor cl, byte [rbx + 0x5397aa1a]
mov ecx, dword [rax + 0x2b1a869e]
mov edi, 0x4c199475
ja 0x140041b5e
cli
retf 0xaa7e

Function at 0x140042928
Capabilities:
Encode data using xor

Disassembly:
xor byte [rdx + 0x7c296db7], ah
push 0xffffffffffffffac
jb 0x140042961
mov ecx, 0x5ea3ddc
mov bh, 0xa3
cli
shl byte [rdx + 6], 1
jl 0x1400429a1
mov eax, 0x3a24e708
mov esp, 0xc440b598
invalid
mov dl, 0xfe
jns 0x1400429c7
and byte [rdx], cl
xchg edi, eax
adc ebx, dword [rdx]
mov ecx, 0xaade561e
cwde
out dx, al
xchg ebx, eax
add al, al
xor eax, 0x86b734f0
jg 0x140042972
std
add dword [rdx - 0xba7e81e], 0xffffffda
out dx, eax
mov byte [rax], bh
sal dl, cl
push rbp
invalid
mov ch, 5
push 0xffffffffdb3f5e80
invalid
mov cl, 0
fidivr word [0x1a3828c74]
outsb dx, byte [rsi]
or ch, byte [rbx + rcx*8 - 0x453af03]
invalid
Function at 0x140045d10
Capabilities:
Encode data using xor

Disassembly:
cmp dh, bl
sub eax, 0x25f424e9
mov ebx, 0xc857b7e1
xor eax, 0x7a737d7
and dword [rbp - 0x6d60ded4], edi
add dl, bh
xlatb
cmp dword [rdx + 0x2ce57f0a], 0x4f88d891
imul esp, dword [rax + 0x4f438f9], 0x26
adc byte [rbp - 0x3305eb68], dl
movsd dword [rdi], dword [rsi]
wait
xchg ebp, eax
lahf
sti
mov bh, 0xf1
int3
sbb byte [rdx + 0x3b0121e1], cl
loopne 0x140045be0
retf 0x8ada
invalid
stosd dword [rdi], eax
xchg ebp, eax
sbb eax, 0xb0b7f75e
jg 0x140045c5a
movabs eax, dword [0xe362d38b98f506fc]
jnp 0x140045c4d
clc
push rax
invalid
js 0x140045cc1
push rdx
xchg ebx, eax
xchg ebx, eax
outsd dx, dword [rsi]
movabs dword [0xacc3526bf0b54d17], eax
jp 0x140045d02
invalid
jno 0x140045d06
ret 0x6dae
jb 0x140045d49
adc byte [rdx + 0x4b6d690a], ah
invalid
or ch, byte [rcx + 0x6d]
invalid
jae 0x140045ca5
pop rdi
jge 0x140045d50
cmpsb byte [rsi], byte [rdi]
jnp 0x140045cc0
cli
movsb byte [rdi], byte [rsi]
jae 0x140045cc9
invalid
add ebx, dword [rsi - 0x73]
mov ebx, 0x38ff6587
cmp byte [rdi - 0x59cb055b], dl
cmp byte [rax], bh
xchg edi, eax
movsd dword [rdi], dword [rsi]
cli
xor al, 0xa6
xchg esi, eax
movabs byte [0x97d83daedfce4aa1], al
invalid

Function at 0x14004e824
Capabilities:
Parse pe header

Disassembly:
lea rax, [fcn.14004e820]
mov qword [rsp + 0x28], 0x4f1db680
mov dword [rsp + 0x28], 0x4f1db680

Function at 0x14004edd8
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rsp + 0x40]
mov cx, 0xfd5d
mov dl, byte [rsp + 0x99]
mov r8d, eax
mov eax, eax
mov r9d, r8d
mov r10b, 0xb7
mov dword [rsp + 0x3c], eax
mov al, dl
mul r10b
mov r11w, word [rsp + 0x9a]
mov byte [rsp + 0x99], al
mov al, byte [rsp + 0x99]
sub cx, r11w
mov byte [rsp + 0x99], al
mov al, byte [rsp + 0x99]
mov rsi, qword [rsp + 0x30]
mov r11w, word [rsi + r9*2]
mov di, r11w
add di, cx
mov cx, r11w
add cx, 0x20
cmp di, 0x1a
cmovb r11w, cx
mov byte [rsp + 0x99], al
mov rbx, qword [rsp + 0x80]
cmp word [rbx + r9*2], r11w
sete al
cmp r11w, 0
setne dl
mov r10b, byte [rsp + 0x99]
mov byte [rsp + 0x2f], al
mov al, r10b
mul byte [rsp + 0x99]
mov r10b, byte [rsp + 0x2f]
and r10b, dl
mov r8d, dword [rsp + 0x3c]
add r8d, 1
mov byte [rsp + 0x99], al
mov al, byte [rsp + 0x99]
xor al, byte [rsp + 0x99]
add byte [rax], al
add byte [rbx + 0x4144246c], cl
cmp eax, ebp
add byte [rax], al
add byte [rbx + 0x4144246c], cl
cmp eax, ebp
setb dl
mov byte [rsp + 0x99], al
and r10b, dl
test r10b, 1
mov dword [rsp + 0x40], r8d
jne 0x14004ed14
mov al, byte [rsp + 0x2f]
test al, 1
mov rcx, qword [rsp + 0x20]
mov qword [rsp + 0x60], rcx
jne 0x14004ec82
jmp 0x14004ec3d
Function at 0x415da0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415f46
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432160
xorps xmm15, xmm15
mov r14, qword [0x00610610]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x415e0b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415e20
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x415e45
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415e59
cmp rbx, 0x1000
jae 0x415e15
nop dword [rax]
jmp 0x415ec9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x415e6d
xor edx, edx
jmp 0x415ec0
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432160
xorps xmm15, xmm15
mov r14, qword [0x00610610]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x415e4f
jmp 0x415e34
call fcn.00463c40
xorps xmm15, xmm15
mov r14, qword [0x00610610]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00436840
lea rax, [0x004e64ff]
mov ebx, 0x18
call fcn.00437140
mov rax, qword [rsp + 0x38]
call fcn.00436e40
lea rax, [0x004e65bf]
mov ebx, 0x19
call fcn.00437140
mov rax, qword [rsp + 0x30]
nop
call fcn.00436e40
call fcn.00436aa0
call fcn.004368c0
lea rax, [0x004e887c]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00434f00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460080
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00415da0
Function at 0x415f80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4161aa
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004321e0
xorps xmm15, xmm15
mov r14, qword [0x00610610]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x415ff9
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41600c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416030
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x416044
cmp rbx, 0x1000
jae 0x416003
jmp 0x4160c5
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x416056
xor esi, esi
jmp 0x4160b6
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.004321e0
xorps xmm15, xmm15
mov r14, qword [0x00610610]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x41603a
nop
jmp 0x416022
call fcn.00463c40
xorps xmm15, xmm15
mov r14, qword [0x00610610]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x416145
call fcn.00436840
lea rax, [0x004e69a7]
mov ebx, 0x19
call fcn.00437140
mov rax, qword [rsp + 0x68]
call fcn.00436e40
lea rax, [0x004e65bf]
mov ebx, 0x19
call fcn.00437140
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00436e40
call fcn.00436aa0
call fcn.004368c0
lea rax, [0x004e3352]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.00434f00
cmp eax, 0x5af
je 0x4160e8
call fcn.00436840
lea rax, [0x004e69a7]
mov ebx, 0x19
nop dword [rax]
call fcn.00437140
mov rax, qword [rsp + 0x38]
call fcn.00436e40
lea rax, [0x004e65bf]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00437140
mov eax, dword [rsp + 0x34]
call fcn.00436e40
call fcn.00436aa0
call fcn.004368c0
lea rax, [0x004e814f]
mov ebx, 0x1f
call fcn.00434f00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460080
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00415f80