joyce8/EMBER2024-capa huggingface dataset:
Function at 0x39064
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x60
xor ebx, ebx
mov rbp, r9
mov rdi, r8
mov r12, rdx
mov rsi, rcx
movzx r10d, bx
movsx rax, r10w
inc r10w
mov dword [rsp + rax*4 + 0x40], ebx
cmp r10w, 4
jb 0x3908f
movzx ecx, bx
movsx rax, cx
inc cx
mov dword [rsp + rax*4 + 0x20], ebx
cmp cx, 4
jb 0x390a5
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rsi + rcx*4]
xor eax, dword [r12 + rcx*4]
mov dword [rsp + rcx*4 + 0x40], eax
mov eax, dword [rsi + rcx*4 + 0x10]
xor eax, dword [r12 + rcx*4 + 0x10]
mov dword [rsp + rcx*4 + 0x20], eax
cmp dx, 4
jb 0x390b9
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.00038f4c
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.00038de0
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsp + rcx*4 + 0x20], eax
cmp dx, 4
jb 0x39104
lea rcx, [rsp + 0x20]
call fcn.00038d5c
movzx edx, bx
cmp word [rbp], bx
je 0x39151
movsx rcx, dx
inc dx
mov eax, dword [rsi + rcx*4]
xor eax, dword [r12 + rcx*4]
xor eax, dword [rbp + rcx*4 + 4]
xor eax, dword [rsp + rcx*4 + 0x20]
xor eax, dword [rsp + rcx*4 + 0x30]
mov dword [rdi + rcx*4], eax
cmp dx, 4
jb 0x3912c
jmp 0x39170
movsx rcx, dx
inc dx
mov eax, dword [rsi + rcx*4]
xor eax, dword [r12 + rcx*4]
xor eax, dword [rsp + rcx*4 + 0x20]
xor eax, dword [rsp + rcx*4 + 0x30]
mov dword [rdi + rcx*4], eax
cmp dx, 4
jb 0x39151
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rsi + rcx*4]
xor eax, dword [rdi + rcx*4]
mov dword [rsp + rcx*4 + 0x40], eax
cmp dx, 4
jb 0x39173
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.00038de0
movsx rcx, bx
inc bx
mov eax, dword [rsi + rcx*4 + 0x10]
xor eax, dword [rdi + rcx*4]
xor eax, dword [rsp + rcx*4 + 0x20]
mov dword [rdi + rcx*4 + 0x10], eax
cmp bx, 4
jb 0x3919e
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x391dc
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x60
mov rsi, rdx
lea rdx, [rax - 0x28]
mov rdi, r8
mov rbp, rcx
call fcn.00038f4c
lea rdx, [rbp + 0x10]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.00038de0
xor ebx, ebx
movzx r9d, bx
movsx rcx, r9w
inc r9w
mov eax, dword [rbp + rcx*4]
xor eax, dword [rsp + rcx*4 + 0x20]
mov dword [rsp + rcx*4 + 0x30], eax
cmp r9w, 4
jb 0x3921b
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsp + rcx*4 + 0x50], eax
cmp dx, 4
jb 0x39239
lea rcx, [rsp + 0x50]
call fcn.00038d5c
movzx edx, bx
cmp word [rdi], bx
je 0x3927e
movsx rcx, dx
inc dx
mov eax, dword [rdi + rcx*4 + 4]
xor eax, dword [rsp + rcx*4 + 0x50]
xor eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsi + rcx*4], eax
cmp dx, 4
jb 0x39260
jmp 0x39296
movsx rcx, dx
inc dx
mov eax, dword [rsp + rcx*4 + 0x50]
xor eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsi + rcx*4], eax
cmp dx, 4
jb 0x3927e
movzx ecx, bx
movsx rax, cx
inc cx
or dword [rsp + rax*4 + 0x20], 0xffffffff
cmp cx, 4
jb 0x39299
and dword [rsp + 0x20], 0x1ffff
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rsp + rcx*4 + 0x30]
xor dword [rsp + rcx*4 + 0x20], eax
cmp dx, 4
jb 0x392b6
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.00038de0
movzx edx, bx
movsx rcx, dx
inc dx
mov eax, dword [rbp + rcx*4]
mov dword [rsp + rcx*4 + 0x40], eax
cmp dx, 4
jb 0x392e0
lea rcx, [rsp + 0x40]
call fcn.00038d5c
movsx rcx, bx
inc bx
mov eax, dword [rsp + rcx*4 + 0x50]
xor eax, dword [rsp + rcx*4 + 0x40]
mov dword [rsi + rcx*4 + 0x10], eax
cmp bx, 4
jb 0x392ff
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x39334
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xf0
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0xe0], rax
xor r13d, r13d
mov r12, r9
mov rsi, r8
lea r14d, [r13 + 1]
mov rbp, rdx
movzx r10d, r13w
movsx r8, r10w
add r10w, r14w
mov eax, dword [rcx + r8*4]
mov dword [rsp + r8*4 + 0x20], eax
cmp r10w, 4
jb 0x39373
mov edx, r13d
movzx ecx, r13w
movsx rax, cx
add cx, r14w
or edx, dword [rsp + rax*4 + 0x20]
cmp cx, 4
jb 0x39392
cmp edx, r13d
jne 0x393db
movzx ecx, r13w
movsx rax, cx
add cx, r14w
mov dword [rsi + rax*4], r13d
cmp cx, 4
jb 0x393ad
movzx ecx, r13w
movsx rax, cx
add cx, r14w
mov dword [rsi + rax*4 + 0x10], r13d
cmp cx, 4
jb 0x393c3
jmp 0x39577
movzx ebx, r13w
mov r11d, 3
test byte [rsp + 0x2c], r14b
je 0x3941b
mov al, byte [rsp + 0x2c]
mov ecx, 2
and al, r11b
sub cl, al
movsx rax, bx
mov byte [rsp + rax + 0x60], cl
jns 0x39424
movzx ecx, r11w
movsx rax, cx
add dword [rsp + rax*4 + 0x20], r14d
jne 0x39424
add cx, 0xffff
jns 0x39408
jmp 0x39424
movsx rax, bx
mov byte [rsp + rax + 0x60], r13b
and dword [rsp + 0x2c], 0xfffffffe
lea rcx, [rsp + 0x20]
call fcn.00038d9c
add bx, r14w
mov edx, r13d
movzx ecx, r13w
movsx rax, cx
add cx, r14w
or edx, dword [rsp + rax*4 + 0x20]
cmp cx, 4
jb 0x3943e
cmp edx, r13d
jne 0x393e5
dec bx
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rbp + rcx*4]
mov dword [rsi + rcx*4], eax
cmp dx, 4
jb 0x3945c
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rbp + rcx*4 + 0x10]
mov dword [rsi + rcx*4 + 0x10], eax
cmp dx, 4
jb 0x39475
cmp bx, r13w
jle 0x39577
movsx rax, bx
lea rdi, [rsp + rax + 0x60]
lea rdx, [rsp + 0x20]
mov r8, r12
mov rcx, rsi
call fcn.000391dc
sub rdi, r14
dec bx
cmp byte [rdi], 0xff
je 0x39509
cmp byte [rdi], r13b
je 0x394d4
cmp byte [rdi], r14b
jne 0x3956d
lea rdx, [rsp + 0x20]
mov rcx, rbp
jmp 0x39562
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rsp + rcx*4 + 0x20]
mov dword [rsi + rcx*4], eax
cmp dx, 4
jb 0x394d8
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rsp + rcx*4 + 0x30]
mov dword [rsi + rcx*4 + 0x10], eax
cmp dx, 4
jb 0x394f1
jmp 0x3956d
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rbp + rcx*4]
mov dword [rsp + rcx*4 + 0x40], eax
cmp dx, 4
jb 0x3950d
movzx ecx, r13w
movsx rax, cx
add cx, r14w
mov dword [rsp + rax*4 + 0x50], r13d
cmp cx, 4
jb 0x39527
movzx edx, r13w
movsx rcx, dx
add dx, r14w
mov eax, dword [rbp + rcx*4 + 0x10]
xor eax, dword [rbp + rcx*4]
mov dword [rsp + rcx*4 + 0x50], eax
cmp dx, 4
jb 0x3953e
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
mov r9, r12
mov r8, rsi
call fcn.00039064
cmp bx, r13w
jg 0x3949e
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.00039b80
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x39688
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x1f0
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov esi, 1
xor ebp, ebp
lea r12d, [rsi + 0x70]
mov cx, si
movzx r8d, bp
movsx rax, cx
movsx ecx, cx
mov word [rsp + rax*2 + 0x10], r8w
add ecx, ecx
mov eax, 0x24168e19
add r8w, si
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe3
sub ecx, edx
cmp r8w, r12w
jl 0x396c8
mov r8d, 0xe2
cmp cx, si
jne 0x39742
movzx r9d, bp
movsx rax, r8w
movsx ecx, r8w
mov word [rsp + rax*2 + 0x10], r9w
add ecx, ecx
mov eax, 0x24168e19
add r9w, si
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe3
sub ecx, edx
cmp r9w, r12w
mov r8w, cx
jl 0x39709
jmp 0x39778
movzx r9d, r12w
movsx rax, cx
movsx ecx, cx
mov word [rsp + rax*2 + 0x10], r9w
add ecx, ecx
mov eax, 0x24168e19
add r9w, si
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe3
sub ecx, edx
cmp r9w, r8w
jl 0x39746
or eax, 0xffffffff
mov word [0x0004e880], si
mov bx, si
lea r11d, [rax + 0x71]
mov word [0x0004ea46], ax
mov r8, rsi
mov r10, r11
movsx ebx, bx
mov eax, 0x24168e19
add ebx, ebx
imul ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe3
sub ebx, edx
movsx rdx, bx
mov rcx, rdx
neg rcx
movzx eax, word [rsp + rcx*2 + 0x1d8]
mov word [rsp], ax
movzx eax, word [rsp + rcx*2 + 0x1d4]
movzx ecx, bp
mov word [rsp + 2], ax
movzx eax, word [rsp + rdx*2 + 0xe]
mov word [rsp + 4], ax
movzx eax, word [rsp + rdx*2 + 0x12]
movzx edx, bp
mov word [rsp + 6], ax
movsx rax, dx
movzx r9d, word [rsp + rax*2]
cmp r9w, r12w
jge 0x3981d
movsx rax, cx
lea rdi, [0x0004e880]
imul rax, rax, 0xe3
add rax, r8
add cx, si
mov word [rdi + rax*2], r9w
add dx, si
cmp cx, 2
jl 0x397f1
add r8, rsi
sub r10, rsi
jne 0x39796
lea edx, [r10 + 0x10]
movzx r8d, bp
mov word [0x0004e864], bp
mov r10d, edx
mov r9d, 0xffff0000
mov ecx, r9d
and ecx, r11d
je 0x39859
add r8w, dx
mov r11d, ecx
mov eax, r10d
cdq
sub eax, edx
sar eax, 1
movsx edx, ax
mov eax, r9d
mov ecx, edx
mov r10d, edx
shr eax, cl
xor r9d, eax
cmp dx, bp
jne 0x3984a
mov word [0x0004e864], r8w
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.00039b80
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x398b4
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x230
mov rax, qword [0x00045100]
xor rax, rsp
mov qword [rsp + 0x220], rax
mov r12, rcx
movsxd r13, edx
xor ebx, ebx
lea rcx, [rsp + 0x20]
jmp 0x39915
mov al, byte [r8]
cmp al, 0x20
je 0x39912
cmp al, 9
je 0x39912
cmp al, 0xd
je 0x39912
cmp al, 0xa
je 0x39912
cmp al, 0x61
jl 0x3990d
cmp al, 0x7a
jg 0x3990d
sub al, 0x20
mov byte [rcx], al
inc rcx
inc r8
cmp byte [r8], bl
jne 0x398f0
mov r10, qword [0x0004f808]
mov byte [rcx], bl
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
or esi, 0xffffffff
repne scasb al, byte [rdi]
not rcx
lea rbp, [rcx - 1]
cmp r10, rbx
jne 0x399c6
mov edx, 0x400
xor ecx, ecx
mov r8d, 0xcc4d5053
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov r9d, ebx
mov r8, rbx
mov r10, rax
mov qword [0x0004f808], rax
mov eax, 1
mov ecx, ebx
lea edx, [rax + 0x7f]
test r9d, eax
je 0x39977
or ecx, edx
add eax, eax
shr edx, 1
jne 0x39970
shl ecx, 0x18
mov eax, 8
bt ecx, 0x1f
jae 0x39995
add ecx, ecx
xor ecx, 0x4c11db7
jmp 0x39997
add ecx, ecx
sub rax, 1
jne 0x39985
lea edi, [rax + 1]
mov edx, ebx
mov eax, 0x80000000
test ecx, edi
je 0x399ad
or edx, eax
add edi, edi
shr eax, 1
jne 0x399a7
mov dword [r10 + r8*4], edx
inc r8
inc r9d
cmp r8, 0x100
jl 0x39966
mov eax, ebp
lea rdi, [rsp + 0x20]
lea rdx, [rsp + rax + 0x20]
lea rax, [rsp + 0x20]
cmp rax, rdx
jae 0x399fa
movsx ecx, byte [rdi]
mov eax, esi
inc rdi
xor rcx, rax
movzx eax, cl
mov ecx, esi
mov esi, dword [r10 + rax*4]
shr ecx, 8
xor esi, ecx
cmp rdi, rdx
jb 0x399dc
cmp r13, rbx
mov dword [0x0004e878], esi
jle 0x39a1b
mov ecx, 0x100
call fcn.00037aac
xor byte [rbx + r12], al
inc rbx
cmp rbx, r13
jl 0x39a05
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.00039b80
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x2b27c5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
bt r9, r10
rcl r9b, 0x8c
xor edi, edi
movzx bx, r12b
movzx ebx, r8b
mov r9d, r15d
dec r11d
mov r11, rcx
cmovno r9w, di
movzx r8w, r14b
mov r9d, 0x30881add
mov r8, rdi
inc r9b
nop
mov r10, rcx
movzx r9d, byte [r11]
mov r10b, r11b
mov r10w, 0x23db
bswap r10d
movzx r10d, byte [rdx]
jmp 0x2b281d
inc r11
jmp 0x2b2825
inc rdx
test spl, dil
test spl, 0x62
test bl, bl
jmp 0x2b2836
je 0x2b2860
mov ecx, r8d
bts ax, ax
mov eax, 0x25fe0502
stc
rol eax, cl
add al, r8b
test esi, 0x75b25c44
stc
xor r9b, al
jmp 0x2b285d
inc r8
test r9b, r9b
je 0x2b2877
cmp r9b, r10b
jmp 0x2b2871
je 0x2b2805
cmp r9b, r10b
jmp 0x2b287f
jae 0x2b28ac
or eax, 0xffffffff
movzx di, r12b
cmovnp di, sp
xchg rdi, rdi
mov rbx, qword [rsp + 8]
movzx di, r8b
mov dil, 0x7b
mov rdi, qword [rsp + 0x10]
jmp 0x2b28ab
ret
mov rbx, qword [rsp + 8]
seta dil
cdqe
lahf
not ah
mov eax, edi
movsx rdi, bp
movsx di, r11b
mov rdi, qword [rsp + 0x10]
ret
Function at 0x140003940
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003974
cmp word [rcx], 0x5a4d
jne 0x140003974
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003974
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003974
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003880
test eax, eax
jne 0x140003990
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.1400038f0
test rax, rax
je 0x140003985
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.140004145
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004040
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140003fe0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400044a4
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x14000eb38]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x14000eb34]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x1400044f2
mov rdx, qword [rax]
cmp r12, rdx
jb 0x1400044ea
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x1400045d9
inc ebx
add rax, 0x28
jmp 0x1400044ca
mov rcx, r12
call fcn.140004cd1
mov rbp, rax
test rax, rax
jne 0x140004511
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140004440
movsxd rbx, ebx
mov rax, qword [0x14000eb38]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.140004d7f
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14000eb38]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x140004573
mov rax, qword [0x14000eb38]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140004440
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x1400045d3
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400045d3
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14000eb38]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400045d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140004440
inc dword [0x14000eb34]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140004a00
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x14000eba0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14000eb80]
test rbx, rbx
je 0x140004a4c
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140004a46
test eax, eax
jne 0x140004a46
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140004a1e
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140004c00
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140004c23
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140004c23
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140004c24
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x140004c5e
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x140004c55
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140004c60
inc r8d
add rax, 0x28
jmp 0x140004c3c
xor eax, eax
ret

Function at 0x140004cd1
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14000acb0]
mov r8, rcx
mov rcx, r9
call fcn.140004c00
test eax, eax
je 0x140004cfd
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140004c24
xor eax, eax
add rsp, 0x28
ret
Function at 0x140001350
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
sub rsp, 0xb8
cmp byte [0x1400175bb], 0
xorps xmm0, xmm0
mov eax, dword [0x1400175b8]
movups xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x40], eax
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmm0, xmmword [0x1400175a8]
movups xmmword [rsp + 0x30], xmm0
je 0x14000154f
xor ecx, ecx
cmp dword [0x140024018], 2
jl 0x140001513
movdqa xmm0, xmmword [0x140021a50]
lea rdx, [rsp + 0x34]
movdqa xmm5, xmmword [0x1400219d0]
mov eax, 5
movdqa xmm4, xmmword [0x140021aa0]
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x140021a10]
movd xmm6, eax
mov eax, 0x1f
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [r11 - 0x38], xmm8
movd xmm8, eax
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140021a30]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140021a30]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x10
jl 0x1400013f0
movaps xmm8, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x90]
movaps xmm6, xmmword [rsp + 0xa0]
cmp ecx, 0x14
jge 0x14000154f
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop
mov eax, 0x8d3dcb09
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x3a
movzx eax, cl
inc ecx
sub al, dl
add al, 0x35
xor byte [r8 - 1], al
cmp ecx, 0x14
jl 0x140001520
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.140004900
add rsp, 0xb8
ret
Function at 0x140006180
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x138
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x1400061e7
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
lea r8, [r8 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x1400061a2
mov ecx, dword [r10]
jmp 0x1400062f6
cmp ecx, 0x270
jb 0x1400062f6
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
nop word [rax + rax]
mov r9, qword [rbx + 8]
lea rbx, [rbx + 8]
mov rdx, r9
xor rdx, rax
and rdx, 0xffffffff80000000
xor rdx, r9
movzx eax, dl
and al, 1
neg al
mov rax, r9
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx + 0x4d8]
xor rcx, rdx
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x140006220
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov r9, qword [rbx]
mov r8, qword [rbx + 8]
lea rbx, [rbx + 8]
xor r9, r8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rbx - 0xea8]
xor rcx, r9
mov r9, r8
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x140006271
mov rdx, qword [r10 + 8]
xor rdx, qword [r10 + 0x1380]
mov rdi, qword [rsp]
and rdx, 0xffffffff80000000
xor rdx, qword [r10 + 8]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret
Function at 0x1400066f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140024010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x14005b2c8]
mov rbx, r8
lea rsi, [rdi + 0x164]
lea rcx, [rdi + 0x16c]
mov dword [rsi], 1
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + 0x168], ebx
add rbx, 8
je 0x1400067c7
mov rax, qword [rdi]
test rax, rax
je 0x140006785
mov rcx, qword [rax + 8]
cmp rcx, 0xffffffffffffffff
je 0x140006785
test rsi, rsi
je 0x140006785
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov r8d, ebx
mov qword [rsp + 0x20], 0
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x140006785
cmp dword [rsp + 0x30], ebx
je 0x1400067c7
mov r8, qword [rdi + 0x18]
test r8, r8
je 0x1400067a4
mov eax, dword [rdi + 8]
dec eax
test eax, 0xfffffffd
jne 0x1400067a4
mov ecx, dword [rdi + 0x60]
lea rdx, [rdi + 0x64]
call r8
mov rbx, qword [rdi]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
xor al, al
mov byte [rbx], 0
mov dword [rdi + 8], 0
jmp 0x1400067c9
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140015b70
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x140015600
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140024010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov ecx, 8
call fcn.140015b90
lea rcx, [0x14000ba40]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140015b30]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x14001567d
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140015b70
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x1400165bc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140016606
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140016606
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140016606
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140016606
cmp dword [rcx + 0x84], 0xe
jbe 0x140016606
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140016608
xor al, al
add rsp, 0x28
ret