joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140088238
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1400ea6b0]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x14008828f
cmp word [rdx], r13w
jne 0x14008828f
or byte [rax + rdi*8 + 0x38], cl
jmp 0x140088294
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x1400883b9
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x1400883da
lea r9, [rdx + 2]
cmp cx, r11w
je 0x1400882cd
mov rdx, r9
mov word [rbx], cx
jmp 0x1400882f4
cmp r9, r8
jae 0x140088304
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x1400882ae
jmp 0x1400883b9
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400883ae
cmp dword [rsp + 0x80], esi
je 0x1400883ae
lea r8, [0x1400ea6b0]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x140088386
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x140088356
mov word [rbx], r13w
jmp 0x1400883b6
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x140088363
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x1400883b6
cmp word [rsp + 0x70], r13w
jne 0x140088393
cmp rbx, r14
je 0x140088350
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.140088194
cmp word [rsp + 0x70], r13w
je 0x1400883b9
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1400ea6b0]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x1400883b3
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x1400883b9
Function at 0x14008bf74
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14008bf8a
mov al, 1
jmp 0x14008bfea
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14008bf9b
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14008bfe8
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400902c4
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14008bfe8
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14008bfe8
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14008bfe8
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14008bfea
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14008f9f8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14008fa28
xor eax, eax
jmp 0x14008faeb
mov rbp, rbx
cmp word [rax], si
je 0x14008fa4d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14008fa34
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14008fa30
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14008e300
movsxd r14, eax
test eax, eax
jne 0x14008fa8b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14008fa21
mov rcx, r14
call fcn.14008aae8
mov rdi, rax
test rax, rax
jne 0x14008faa4
xor ecx, ecx
call fcn.140087e5c
jmp 0x14008fa80
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14008e300
test eax, eax
jne 0x14008fad5
mov rcx, rdi
call fcn.140087e5c
jmp 0x14008fadf
xor ecx, ecx
call fcn.140087e5c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140092818
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1400879ac
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1400928b9
cmp ebx, dword [rsp + 0x30]
je 0x1400928b2
test esi, esi
je 0x1400928b2
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x14009288d
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14009289a
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x140092877
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14009289e
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1400928bb
mov eax, 1
jmp 0x1400928bb
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400969a0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140088194
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140088194
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x140096af0
cmp rax, 0xffffffffffffffff
je 0x140096af0
xor edi, edi
test rbp, rbp
jle 0x140096a9b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140087d0c
mov rbx, rax
test rax, rax
jne 0x140096a28
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x140096a91
mov edx, 0x8000
mov ecx, r14d
call fcn.140085aec
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14008a3dc
cmp eax, 0xffffffff
je 0x140096a71
cdqe
sub rbp, rax
test rbp, rbp
jg 0x140096a38
mov edx, r15d
mov ecx, r14d
call fcn.140085aec
jmp 0x140096a91
cmp byte [rsi + 0x38], dil
je 0x140096a88
cmp dword [rsi + 0x34], 5
jne 0x140096a88
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x140096a91
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140087e5c
jmp 0x140096b04
jns 0x140096b04
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140088194
cmp rax, 0xffffffffffffffff
jne 0x140096abc
cmp byte [rsi + 0x30], dil
je 0x140096b04
mov edi, dword [rsi + 0x2c]
jmp 0x140096b04
mov ecx, r14d
call fcn.1400902c4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140096b04
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x140096b04
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x140096afd
mov eax, dword [rsi + 0x2c]
jmp 0x140096b02
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140088194
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140097550
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140097578
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140097578
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001be0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
lea r10, [0x14028c120]
xor edx, edx
mov r8, r10
nop dword [rax]
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x140001bf0
lea rax, [0x14028c124]
mov r9d, 0x1c0
nop dword [rax]
mov r8d, dword [rax - 4]
lea rax, [rax + 0x10]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r10 + rdx*4]
mov dword [rax + 0x3ec], r8d
mov r8d, dword [rax - 0x10]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r10 + rdx*4]
mov dword [rax + 0x3f0], r8d
mov r8d, dword [rax - 0xc]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r10 + rdx*4]
mov dword [rax + 0x3f4], r8d
mov r8d, dword [rax - 8]
movzx edx, r8b
shr r8d, 8
xor r8d, dword [r10 + rdx*4]
mov dword [rax + 0x3f8], r8d
sub r9, 1
jne 0x140001ca0
lea rax, [0x140001d20]
mov qword [0x14028c100], rax
ret
Function at 0x140004930
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov r12, rdx
mov qword [rbp - 0x39], 0
mov rdi, rcx
mov dword [rbp - 0x19], 0x6a09e667
xor eax, eax
mov dword [rbp - 0x15], 0xbb67ae85
mov dword [rbp - 0x11], 0x3c6ef372
mov r15d, 0x43fc4
mov dword [rbp - 0xd], 0xa54ff53a
mov dword [rbp - 9], 0x510e527f
mov dword [rbp - 5], 0x9b05688c
mov dword [rbp - 1], 0x1f83d9ab
mov dword [rbp + 3], 0x5be0cd19
nop dword [rax]
nop word [rax + rax]
mov ecx, eax
mov esi, 0x100
and ecx, 0x3f
mov ebx, 0x40
add rax, rsi
sub ebx, ecx
mov qword [rbp - 0x31], rax
mov r14, r12
cmp rbx, rsi
jbe 0x1400049de
mov eax, ecx
mov rdx, r12
lea rcx, [rbp + 7]
add rcx, rax
jmp 0x140004a38
test ecx, ecx
je 0x140004a11
mov eax, ecx
mov r8, rbx
lea rcx, [rbp + 7]
mov rdx, r12
add rcx, rax
sub rsi, rbx
call qword [0x14028bfa0]
mov r8d, 1
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x19]
lea r14, [rbx + r12]
call fcn.1400041e0
mov rbx, rsi
lea rcx, [rbp - 0x19]
shr rbx, 6
mov rdx, r14
mov r8, rbx
call fcn.1400041e0
and esi, 0x3f
je 0x140004a41
shl rbx, 6
lea rcx, [rbp + 7]
lea rdx, [r14 + rbx]
mov r8, rsi
call qword [0x14028bfa0]
sub r15, 1
je 0x140004a50
mov rax, qword [rbp - 0x31]
jmp 0x1400049b0
mov eax, dword [rbp - 0x31]
and eax, 0x3f
mov byte [rbp + rax + 7], 0x80
inc eax
cmp eax, 0x38
jbe 0x140004a91
cmp eax, 0x40
je 0x140004a7c
nop word [rax + rax]
mov byte [rbp + rax + 7], 0
inc eax
cmp eax, 0x40
jne 0x140004a70
mov r8d, 1
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x19]
call fcn.1400041e0
xor eax, eax
mov ecx, eax
mov r8d, 0x38
sub r8d, eax
xor edx, edx
lea rax, [rbp + 7]
add rcx, rax
call qword [0x14028bfa8]
mov rax, qword [rbp - 0x31]
lea rdx, [rbp + 7]
mov r8d, 1
lea rcx, [rax*8]
mov rax, rcx
bswap ecx
shr rax, 0x20
bswap eax
mov dword [rbp + 0x43], ecx
lea rcx, [rbp - 0x19]
mov dword [rbp + 0x3f], eax
call fcn.1400041e0
lea rcx, [rbp - 0x15]
mov edx, 4
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [rcx - 4]
lea rdi, [rdi + 8]
lea rcx, [rcx + 8]
bswap eax
mov dword [rdi - 8], eax
mov eax, dword [rcx - 8]
bswap eax
mov dword [rdi - 4], eax
sub rdx, 1
jne 0x140004af0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140005530
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
movaps xmmword [rax - 0x28], xmm6
mov rdi, r8
movq xmm6, r8
mov rbx, rdx
xor r14d, r14d
punpcklqdq xmm6, xmm6
mov qword [rax - 0x48], r14
xor r9d, r9d
mov dword [rax - 0x50], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rax - 0x58], 3
call qword [0x14028bde8]
mov qword [rsp + 0x30], r14
mov edx, 0x40000000
cmp rax, 0xffffffffffffffff
mov dword [rsp + 0x28], 0x80
mov rbp, rax
mov dword [rsp + 0x20], 2
cmove rbp, r14
mov rcx, rbx
xor r9d, r9d
xor r8d, r8d
call qword [0x14028bde8]
cmp rax, 0xffffffffffffffff
mov rsi, rax
cmove rsi, r14
call qword [0x14028be80]
mov r15d, 0x186a0
xor edx, edx
mov rcx, rax
mov r8d, r15d
call qword [0x14028bf50]
mov rbx, rax
test rbp, rbp
je 0x14000573f
test rsi, rsi
je 0x14000573f
test rax, rax
je 0x14000573f
lea r9, [rsp + 0x98]
mov qword [rsp + 0x20], r14
mov r8d, r15d
mov rdx, rax
mov rcx, rbp
call qword [0x14028bec8]
mov r10d, dword [rsp + 0x98]
cmp r10d, 1
jb 0x140005717
nop word [rax + rax]
cmp r10d, r15d
mov ecx, r10d
mov rax, rbx
mov r8, r14
cmova ecx, r15d
mov edx, ecx
add rcx, rbx
add rdx, 7
shr rdx, 3
cmp rbx, rcx
cmova rdx, r14
test rdx, rdx
je 0x1400056bf
cmp rdx, 8
jb 0x1400056bf
and rdx, 0xfffffffffffffff8
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
add r8, 8
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax], xmm1
movdqu xmm0, xmmword [rax + 0x10]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax + 0x10], xmm1
movdqu xmm0, xmmword [rax + 0x20]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax + 0x20], xmm1
movdqu xmm0, xmmword [rax + 0x30]
movdqa xmm1, xmm6
xorps xmm1, xmm0
movdqu xmmword [rax + 0x30], xmm1
add rax, 0x40
cmp r8, rdx
jb 0x140005670
cmp rax, rcx
jae 0x1400056d0
xor qword [rax], rdi
add rax, 8
cmp rax, rcx
jb 0x1400056c4
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], r14
mov r8d, r10d
mov rdx, rbx
mov rcx, rsi
call qword [0x14028bf30]
lea r9, [rsp + 0x98]
mov qword [rsp + 0x20], r14
mov r8d, r15d
mov rdx, rbx
mov rcx, rbp
call qword [0x14028bec8]
mov r10d, dword [rsp + 0x98]
cmp r10d, 1
jae 0x140005630
call qword [0x14028be80]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [0x14028bf78]
mov rcx, rbp
call qword [0x14028bdd0]
mov rcx, rsi
call qword [0x14028bdd0]
jmp 0x140005741
xor eax, eax
movaps xmm6, xmmword [rsp + 0x50]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140005e60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov eax, dword [rcx + 0x3c]
mov r11, rdx
mov r8d, dword [rax + rcx + 0x88]
add r8, rcx
mov r14d, dword [r8 + 0x1c]
mov ebp, dword [r8 + 0x20]
add r14, rcx
mov r15d, dword [r8 + 0x24]
add rbp, rcx
mov edi, dword [r8 + 0x18]
add r15, rcx
test edi, edi
je 0x140005eff
movzx esi, byte [rdx]
xor r9d, r9d
mov rax, rdx
mov r10d, r9d
test sil, sil
je 0x140005ee1
nop word [rax + rax]
mov r8d, dword [rbp + r10*4]
movzx edx, sil
sub r8, r11
add r8, rcx
nop
cmp byte [r8 + rax], dl
jne 0x140005eef
movzx edx, byte [rax + 1]
inc rax
test dl, dl
jne 0x140005ed0
movzx eax, word [r15 + r10*2]
mov eax, dword [r14 + rax*4]
add rax, rcx
jmp 0x140005f01
inc r9d
cmp r9d, edi
je 0x140005eff
mov rax, r11
mov r10d, r9d
jmp 0x140005ec0
xor eax, eax
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret
Function at 0x14000aaf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
sub rsp, 0x150
mov rdi, qword [0x14028b9e0]
xor ebx, ebx
mov rbp, rdx
mov r14, rcx
test rdi, rdi
je 0x14000ab40
call qword [0x14028be80]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [0x14028bf78]
xorps xmm0, xmm0
mov qword [0x14028b9f0], rbx
movdqu xmmword [0x14028b9e0], xmm0
mov dword [0x14028b9f8], ebx
test r14, r14
je 0x14000ace8
test rbp, rbp
je 0x14000ace8
lea r8, [rsp + 0x180]
mov qword [rsp + 0x178], rsi
mov rdx, rbp
mov rcx, r14
call fcn.140004cb0
lea r9, [0x14028c120]
mov qword [0x14028b9e0], rax
mov r8, rbp
mov qword [0x14028b9e8], rax
mov rdx, r14
mov ecx, 0xffffffff
call qword [0x14028c100]
cmp word [0x140012066], bx
not eax
mov dword [0x14028b9f0], eax
mov qword [0x14028b9f4], rbx
je 0x14000abe9
movzx ecx, word [0x140012064]
mov eax, ebx
inc ecx
test cl, 3
setne al
shr ecx, 2
add eax, ecx
mov rcx, rbx
mov edx, eax
je 0x14000abe2
lea r8, [0x140012068]
nop
mov eax, dword [0x140012060]
xor dword [r8 + rcx*4], eax
inc rcx
cmp rcx, rdx
jne 0x14000abd0
mov word [0x140012066], bx
lea rcx, [0x14028b8c0]
call qword [0x14028bfb8]
mov rsi, rax
test rax, rax
je 0x14000ac1b
mov r8, rax
lea rdx, [0x14028b8c0]
lea rcx, [rsp + 0x40]
call qword [0x14028bfa0]
mov byte [rsp + rsi + 0x40], 0x5c
inc rsi
lea rcx, [0x140012068]
call qword [0x14028bfb8]
lea rcx, [rsp + 0x40]
mov r8, rax
add rcx, rsi
lea rdx, [0x140012068]
mov rdi, rax
call qword [0x14028bfa0]
lea rax, [rsi + rdi]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x40]
xor r9d, r9d
mov byte [rsp + rax + 0x40], bl
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0x40000000
call qword [0x14028bde8]
mov rsi, qword [rsp + 0x178]
cmp rax, 0xffffffffffffffff
mov rdi, rax
cmove rdi, rbx
test rdi, rdi
je 0x14000acb3
lea r9, [rsp + 0x170]
mov qword [rsp + 0x20], rbx
mov r8d, ebp
mov rdx, r14
mov rcx, rdi
call qword [0x14028bf30]
mov rcx, rdi
call qword [0x14028bdd0]
mov rdx, qword [rsp + 0x180]
test rdx, rdx
je 0x14000ace8
mov r8, qword [0x14028b9e0]
mov rcx, rbx
mov eax, dword [0x14028b9f8]
cmp byte [rcx + r8], 0
jne 0x14000acdf
inc eax
mov dword [0x14028b9f8], eax
inc ebx
mov ecx, ebx
cmp rcx, rdx
jne 0x14000acd0
mov rbx, qword [rsp + 0x188]
add rsp, 0x150
pop r14
pop rdi
pop rbp
ret
Function at 0x14000ad00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor dword [rcx], 0xf6fc61e8
lea r8, [rcx + 4]
xor edi, edi
lea r9, [rcx - 4]
add r9, rdx
mov r10d, 1
mov rax, r9
mov rbx, rdx
sub rax, r8
add rax, 4
shr rax, 2
cmp r8, r9
cmova rax, rdi
cmp rax, r10
jb 0x14000ad99
cmp rax, 0x10
jb 0x14000ad99
movdqa xmm1, xmmword [str.]
and rax, 0xfffffffffffffff0
movdqu xmm0, xmmword [r8]
add r10, 0x10
xorps xmm0, xmm1
movdqu xmmword [r8], xmm0
movdqu xmm0, xmmword [r8 + 0x10]
xorps xmm0, xmm1
movdqu xmmword [r8 + 0x10], xmm0
movdqu xmm0, xmmword [r8 + 0x20]
xorps xmm0, xmm1
movdqu xmmword [r8 + 0x20], xmm0
movdqu xmm0, xmmword [r8 + 0x30]
xorps xmm0, xmm1
movdqu xmmword [r8 + 0x30], xmm0
add r8, 0x40
cmp r10, rax
jbe 0x14000ad52
cmp r8, r9
ja 0x14000adb0
nop
xor dword [r8], 0x3db6cc5c
add r8, 4
cmp r8, r9
jbe 0x14000ada0
mov rdx, rcx
xor r9d, r9d
mov rcx, qword [0x14028b9d0]
mov r8d, ebx
call qword [0x14028c0a0]
movsxd rcx, eax
cmp rcx, rbx
mov rbx, qword [rsp + 0x30]
sete dil
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x140009f90
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x1400158a0], rbx
je 0x140009fdc
cmp rax, rbx
jne 0x140009fcf
mov ebx, 1
mov esi, ebx
jmp 0x140009fe1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140009fb4
mov ebx, 1
mov eax, dword [0x1400158a8]
cmp eax, ebx
jne 0x140009ff7
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x14000a05c
mov eax, dword [0x1400158a8]
test eax, eax
jne 0x14000a056
mov dword [0x1400158a8], ebx
lea r15, [0x14000b6b8]
lea rdi, [0x14000b6a0]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x14000a048
test eax, eax
jne 0x14000a04c
cmp qword [rdi], 0
je 0x14000a03d
mov rax, qword [rdi]
mov rcx, qword [0x14000b650]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000a01e
test eax, eax
je 0x14000a05c
mov eax, 0xff
jmp 0x14000a138
mov dword [0x1400150b4], ebx
mov eax, dword [0x1400158a8]
cmp eax, ebx
jne 0x14000a083
lea rdx, [0x14000b698]
lea rcx, [0x14000b658]
call sub.msvcrt.dll__initterm
mov dword [0x1400158a8], 2
test esi, esi
jne 0x14000a090
xor eax, eax
xchg qword [0x1400158a0], rax
cmp qword [0x1400158c0], 0
je 0x14000a0c4
lea rcx, [0x1400158c0]
call fcn.14000a740
test eax, eax
je 0x14000a0c4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1400158c0]
mov r9, qword [0x14000b650]
call r9
mov r8, qword [0x1400150c8]
mov rdx, qword [0x1400150c0]
mov ecx, dword [0x1400150b8]
call fcn.140007088
mov dword [0x1400150b0], eax
cmp dword [0x1400150d0], 0
jne 0x14000a0f4
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400150b4], 0
jne 0x14000a109
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400150b0]
jmp 0x14000a138
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140185000
add rsp, 0x28
jmp 0x140009f90

Function at 0x14000a62c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000a678
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000a670
cmp dword [rcx + 0x3c], edx
jl 0x14000a670
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14000a670
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000a678
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140001150
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x14000e008]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor edx, edx
mov dword [rsp + 0x10], 0x90d0b0e
lea rax, [rsp + 0x20]
mov dword [rsp + 0x14], 0xd0b0e09
mov r9, rcx
mov dword [rsp + 0x18], 0xb0e090d
sub r9, rax
mov dword [rsp + 0x1c], 0xe090d0b
mov r8, rcx
nop dword [rax + rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
movzx eax, byte [r9 + rcx]
mov byte [rcx], al
movzx eax, byte [r8 + rdx + 1]
mov byte [rcx + 1], al
movzx eax, byte [r8 + rdx + 2]
mov byte [rcx + 2], al
movzx eax, byte [r8 + rdx + 3]
add rdx, 4
mov byte [rcx + 3], al
cmp rdx, 0x10
jl 0x1400011b0
lea rax, [rsp + 0x12]
mov qword [rsp], 4
sub r9, rax
lea r15, [rsp + 0x12]
mov qword [rsp + 8], r9
nop
movzx r12d, byte [r15 - 2]
xor ebp, ebp
movzx r13d, byte [r15 - 1]
nop dword [rax]
lea r14, [rsp + 0x20]
movzx r9d, r12b
add r14, rbp
mov r10d, 8
xor sil, sil
movzx eax, byte [r14]
nop dword [rax]
movzx ecx, sil
movzx r8d, r9b
xor cl, al
movzx edx, cl
and r8b, 1
movzx ecx, sil
cmove edx, ecx
movzx ecx, al
add cl, cl
shr r9b, 1
movzx esi, dl
movzx edx, cl
movzx ecx, al
movzx eax, dl
xor al, 0x1b
test cl, cl
movzx eax, al
cmovns eax, edx
sub r10, 1
jne 0x140001230
movzx r8d, byte [r14 + 4]
movzx r9d, r13b
xor dil, dil
mov r10d, 8
nop
movzx eax, dil
movzx edx, r9b
xor al, r8b
movzx ecx, al
and dl, 1
movzx eax, dil
cmove ecx, eax
movzx eax, r8b
add al, al
shr r9b, 1
movzx edx, al
movzx edi, cl
movzx ecx, r8b
movzx eax, dl
xor al, 0x1b
test cl, cl
movzx r8d, al
cmovns r8d, edx
sub r10, 1
jne 0x140001280
movzx r8d, byte [r14 + 8]
xor r11b, r11b
movzx r9d, byte [r15]
mov r10d, 8
movzx eax, r11b
movzx edx, r9b
xor al, r8b
movzx ecx, al
and dl, 1
movzx eax, r11b
cmove ecx, eax
movzx eax, r8b
add al, al
shr r9b, 1
movzx edx, al
movzx r11d, cl
movzx ecx, r8b
movzx eax, dl
xor al, 0x1b
test cl, cl
movzx r8d, al
cmovns r8d, edx
sub r10, 1
jne 0x1400012d2
movzx r9d, byte [r14 + 0xc]
xor r8b, r8b
movzx r10d, byte [r15 + 1]
mov ebx, 8
nop word [rax + rax]
movzx eax, r8b
movzx edx, r10b
xor al, r9b
movzx ecx, al
and dl, 1
movzx eax, r8b
cmove ecx, eax
movzx eax, r9b
add al, al
shr r10b, 1
movzx edx, al
movzx r8d, cl
movzx ecx, r9b
movzx eax, dl
xor al, 0x1b
test cl, cl
movzx r9d, al
cmovns r9d, edx
sub rbx, 1
jne 0x140001330
mov rax, qword [rsp + 8]
xor r8b, r11b
xor r8b, dil
add rax, r15
xor r8b, sil
inc rbp
mov byte [r14 + rax], r8b
cmp rbp, 4
jl 0x140001210
add r15, 4
sub qword [rsp], 1
jne 0x140001200
xor eax, eax
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140002890
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret