joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c490
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x138
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x14000c502
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
nop dword [rax]
nop word [rax + rax]
mov edx, dword [r8 - 8]
xor edx, dword [r8]
lea r8, [r8 + 8]
btr edx, 0x1f
xor rdx, qword [r8 - 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x14000c4c0
mov ecx, dword [r10]
jmp 0x14000c603
cmp ecx, 0x270
jb 0x14000c603
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
mov rdx, qword [rbx + 8]
lea r8, [rbx + 8]
xor rdx, rax
btr edx, 0x1f
xor rdx, rax
movzx eax, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx + 0x4e0]
xor rcx, rdx
mov qword [rbx - 0x9c0], rcx
lea rbx, [r8]
sub rdi, 1
jne 0x14000c530
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov rax, qword [rbx]
nop
mov rdx, rax
lea r8, [rbx + 8]
xor rdx, qword [r8]
btr edx, 0x1f
xor rdx, rax
movzx eax, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx - 0xea0]
xor rcx, rdx
mov qword [rbx - 0x9c0], rcx
lea rbx, [r8]
sub rdi, 1
jne 0x14000c580
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 8]
mov rdi, qword [rsp]
btr edx, 0x1f
xor rdx, qword [r10 + 0x1380]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret
Function at 0x14000c660
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140156010]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea r14, [rsp + 0x78]
xor ebp, ebp
mov rsi, qword [r14]
mov rdi, rdx
mov rdx, qword [0x14016f428]
mov rbx, rcx
mov qword [r14], rbp
cmp qword [rdx + 0x18], 8
jb 0x14000c6a5
mov rdx, qword [rdx]
mov qword [rsp + 0x40], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rbp
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x14000c725
mov qword [r14], rsi
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14000c71e
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000c719
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c7ee
mov rcx, r8
call fcn.14005b338
xor al, al
jmp 0x14000c7bd
cmp qword [rdi + 0x18], 0x10
mov eax, dword [rdi + 0x10]
lea eax, [rax*2 + 2]
jb 0x14000c739
mov rdi, qword [rdi]
cmp qword [rbx + 0x18], 8
mov rdx, rbx
jb 0x14000c746
mov rdx, qword [rbx]
mov rcx, qword [rsp + 0x50]
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x14000c777
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000c6dc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [r14], rsi
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14000c7bb
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000c7b6
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c7ee
mov rcx, r8
call fcn.14005b338
mov al, 1
mov word [rbx], bp
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rbp
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14005b040
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14000c800
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x480
mov rax, qword [0x140156010]
xor rax, rsp
mov qword [rsp + 0x470], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
lea r15, [rsp + 0x4a8]
movabs r12, 0xff00ff00ff00ff00
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r15
mov rbp, qword [r15]
mov rsi, rbp
xor rsi, r12
mov qword [rsp + 0x50], rsi
mov qword [r15], r14
mov rdx, qword [0x14016f428]
cmp qword [rdx + 0x18], 8
jb 0x14000c884
mov rdx, qword [rdx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14000c8d1
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
xor r8d, r8d
lea rdx, [0x14005ee73]
mov rcx, rdi
call fcn.140009a20
nop
mov qword [r15], rbp
jmp 0x14000c98f
mov dword [rsp + 0x48], 0x400
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000c8e6
mov rdx, qword [rbx]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x14000c951
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov word [rsp + 0x30], 0x6c
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
lea rax, [rsp + 0x31]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000c940
lea rdx, [rsp + 0x31]
jmp 0x14000c980
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], r14
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x14000c971
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.140009a20
nop
xor rsi, r12
mov qword [r15], rsi
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14000c9ca
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000c9c5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000ca09
mov rcx, r8
call fcn.14005b338
mov word [rbx], r14w
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov rax, rdi
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.14005b040
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14000ca10
Capabilities:
Delete registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
lea r14, [rsp + 0x28]
xor esi, esi
mov rdi, qword [r14]
mov rbx, rcx
mov qword [r14], rsi
mov r8, rcx
cmp qword [rcx + 0x18], 8
jb 0x14000ca42
mov r8, qword [rcx]
mov rdx, qword [0x14016f428]
cmp qword [rdx + 0x18], 8
jb 0x14000ca53
mov rdx, qword [rdx]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyValueW]
mov qword [r14], rdi
mov rcx, qword [rbx + 0x18]
test eax, eax
je 0x14000caa6
cmp rcx, 8
jb 0x14000caa2
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000ca9d
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000cb04
mov rcx, r8
call fcn.14005b338
xor al, al
jmp 0x14000cadf
cmp rcx, 8
jb 0x14000cadd
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14000cad8
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000cb04
mov rcx, r8
call fcn.14005b338
mov al, 1
mov rdi, qword [rsp + 0x48]
mov word [rbx], si
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x14000cd50
Capabilities:
Check for debugger via api
Terminate process

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140156010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x48], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x48], 0
je 0x14000ce49
lea rdx, [rsp + 0x20]
call fcn.14000ce60
mov ecx, 0x1001
movzx r8d, byte [rax]
lea rdx, [rax + 1]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
xor byte [rax + 0x18], r8b
xor byte [rax + 0x19], r8b
xor byte [rax + 0x1a], r8b
xor byte [rax + 0x1b], r8b
xor byte [rax + 0x1c], r8b
xor byte [rax + 0x1d], r8b
xor byte [rax + 0x1e], r8b
xor byte [rax + 0x1f], r8b
xor byte [rax + 0x20], r8b
xor byte [rax + 0x21], r8b
xor byte [rax + 0x22], r8b
xor byte [rax + 0x23], r8b
xor byte [rax + 0x24], r8b
xor byte [rax + 0x25], r8b
mov byte [rax + 0x26], 0
call fcn.14000cce0
mov ecx, 0x1001
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14005b040
add rsp, 0x68
ret
Function at 0x14000ceb0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x50
lea rdx, str.OllyDbg____CPU_
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.USER32.dll_FindWindowW]
mov ecx, 1
lea rdx, str.Immunity_Debugger____CPU_
test rax, rax
cmovne ebx, ecx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14000ceee
test ebx, ebx
je 0x14000cfa1
lea rdx, [rsp + 0x20]
call fcn.14000cfb0
mov ecx, 0x1005
movzx r8d, byte [rax]
lea rdx, [rax + 1]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
xor byte [rax + 0x18], r8b
xor byte [rax + 0x19], r8b
xor byte [rax + 0x1a], r8b
xor byte [rax + 0x1b], r8b
xor byte [rax + 0x1c], r8b
xor byte [rax + 0x1d], r8b
xor byte [rax + 0x1e], r8b
xor byte [rax + 0x1f], r8b
xor byte [rax + 0x20], r8b
xor byte [rax + 0x21], r8b
xor byte [rax + 0x22], r8b
mov byte [rax + 0x23], 0
call fcn.14000cce0
mov ecx, 0x1005
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x50
pop rbx
ret
Function at 0x14000d300
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x50
xor edx, edx
lea rcx, str.OLLYDBG
xor ebx, ebx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
mov ecx, 1
cmovne ebx, ecx
xor edx, edx
lea rcx, [0x14005f2e8]
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
jne 0x14000d33e
test ebx, ebx
je 0x14000d3ed
lea rdx, [rsp + 0x20]
call fcn.14000d400
mov ecx, 0x1005
movzx r8d, byte [rax]
lea rdx, [rax + 1]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
xor byte [rax + 0x18], r8b
xor byte [rax + 0x19], r8b
xor byte [rax + 0x1a], r8b
xor byte [rax + 0x1b], r8b
xor byte [rax + 0x1c], r8b
xor byte [rax + 0x1d], r8b
xor byte [rax + 0x1e], r8b
xor byte [rax + 0x1f], r8b
xor byte [rax + 0x20], r8b
xor byte [rax + 0x21], r8b
mov byte [rax + 0x22], 0
call fcn.14000cce0
mov ecx, 0x1005
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x50
pop rbx
ret

Function at 0x14000d450
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14000d4fd
lea rdx, [rsp + 0x20]
call fcn.14000d510
mov ecx, 0x1002
movzx r8d, byte [rax]
lea rdx, [rax + 1]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
xor byte [rax + 0x18], r8b
xor byte [rax + 0x19], r8b
xor byte [rax + 0x1a], r8b
xor byte [rax + 0x1b], r8b
xor byte [rax + 0x1c], r8b
mov byte [rax + 0x1d], 0
call fcn.14000cce0
mov ecx, 0x1002
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x48
ret
Function at 0x14000d550
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
sub rsp, 0xb8
mov rax, qword [0x140156010]
xor rax, rsp
mov qword [rsp + 0xa8], rax
xorps xmm0, xmm0
mov dword [r11 - 0x18], 0
movups xmmword [rsp + 0x70], xmm0
lea rcx, str.ntdll.dll
movups xmmword [r11 - 0x38], xmm0
movups xmmword [r11 - 0x28], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000d719
lea rdx, str.NtQueryInformationProcess
mov qword [rsp + 0xb0], rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14000d711
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, [rsp + 0xa0]
mov r9d, 0x30
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x70]
mov rcx, rax
xor edx, edx
call rbx
test eax, eax
js 0x14000d711
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x14000d711
cmp byte [rax + 2], 0
je 0x14000d711
lea rdx, [rsp + 0x30]
call fcn.14000d740
mov ecx, 0x1004
movzx r8d, byte [rax]
lea rdx, [rax + 1]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
xor byte [rax + 0x18], r8b
xor byte [rax + 0x19], r8b
xor byte [rax + 0x1a], r8b
xor byte [rax + 0x1b], r8b
xor byte [rax + 0x1c], r8b
xor byte [rax + 0x1d], r8b
xor byte [rax + 0x1e], r8b
xor byte [rax + 0x1f], r8b
xor byte [rax + 0x20], r8b
xor byte [rax + 0x21], r8b
xor byte [rax + 0x22], r8b
xor byte [rax + 0x23], r8b
xor byte [rax + 0x24], r8b
xor byte [rax + 0x25], r8b
xor byte [rax + 0x26], r8b
xor byte [rax + 0x27], r8b
xor byte [rax + 0x28], r8b
xor byte [rax + 0x29], r8b
xor byte [rax + 0x2a], r8b
xor byte [rax + 0x2b], r8b
xor byte [rax + 0x2c], r8b
xor byte [rax + 0x2d], r8b
xor byte [rax + 0x2e], r8b
xor byte [rax + 0x2f], r8b
xor byte [rax + 0x30], r8b
xor byte [rax + 0x31], r8b
xor byte [rax + 0x32], r8b
xor byte [rax + 0x33], r8b
xor byte [rax + 0x34], r8b
xor byte [rax + 0x35], r8b
xor byte [rax + 0x36], r8b
xor byte [rax + 0x37], r8b
mov byte [rax + 0x38], 0
call fcn.14000cce0
mov ecx, 0x1004
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa8]
xor rcx, rsp
call fcn.14005b040
add rsp, 0xb8
ret
Function at 0x14000d890
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Create process on windows
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x410
mov rax, qword [0x140156010]
xor rax, rsp
mov qword [rsp + 0x400], rax
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x68
xor eax, eax
lea r8, str.antidbg
mov rbx, rcx
mov dword [rsp + 0xd4], eax
xor edi, edi
mov qword [rsp + 0x60], rax
xor ecx, ecx
mov dword [rsp + 0x68], edi
xor edx, edx
movups xmmword [rsp + 0x74], xmm0
movups xmmword [rsp + 0x84], xmm0
movups xmmword [rsp + 0x94], xmm0
movups xmmword [rsp + 0xa4], xmm0
movups xmmword [rsp + 0xb4], xmm0
movups xmmword [rsp + 0xc4], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14000d943
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_atoi]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_DebugActiveProcess]
test eax, eax
jne 0x14000d9f8
mov ecx, 0x22b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r8d, 0x104
lea rdx, [rsp + 0x1f0]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r9, [rsp + 0x1f0]
mov dword [rsp + 0x20], ebx
lea r8, str._ws__d
mov edx, 0x109
lea rcx, [rsp + 0xe0]
call fcn.14000cc80
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0xe0]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x50]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x400]
xor rcx, rsp
call fcn.14005b040
mov rbx, qword [rsp + 0x428]
add rsp, 0x410
pop rdi
ret
Function at 0x14000da20
Capabilities:
Check for time delay via queryperformancecounter
Terminate process

Disassembly:
sub rsp, 0x68
mov rax, qword [0x140156010]
xor rax, rsp
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x48]
sub rax, qword [rsp + 0x50]
cmp rax, 0x1e
jle 0x14000db10
lea rdx, [rsp + 0x20]
call fcn.14000db30
mov ecx, 0x3001
movzx r8d, byte [rax]
lea rdx, [rax + 1]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
xor byte [rax + 0x18], r8b
xor byte [rax + 0x19], r8b
xor byte [rax + 0x1a], r8b
xor byte [rax + 0x1b], r8b
xor byte [rax + 0x1c], r8b
xor byte [rax + 0x1d], r8b
xor byte [rax + 0x1e], r8b
xor byte [rax + 0x1f], r8b
xor byte [rax + 0x20], r8b
xor byte [rax + 0x21], r8b
xor byte [rax + 0x22], r8b
mov byte [rax + 0x23], 0
call fcn.14000cce0
mov ecx, 0x3001
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14005b040
add rsp, 0x68
ret

Function at 0x14000db80
Capabilities:
Check for time delay via gettickcount
Terminate process

Disassembly:
push rbx
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1e
jbe 0x14000dc26
lea rdx, [rsp + 0x20]
call fcn.14000dc30
mov ecx, 0x3002
movzx r8d, byte [rax]
lea rdx, [rax + 1]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
mov byte [rax + 0x18], 0
call fcn.14000cce0
mov ecx, 0x3002
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x40
pop rbx
ret
Function at 0x14000dc70
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x538
mov rax, qword [0x140156010]
xor rax, rsp
mov qword [rsp + 0x520], rax
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x80], 0x100010
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x14000dddb
cmp qword [rsp + 0x98], 0
jne 0x14000dd08
cmp qword [rsp + 0xa0], 0
jne 0x14000dd08
cmp qword [rsp + 0xa8], 0
jne 0x14000dd08
cmp qword [rsp + 0xb0], 0
jne 0x14000dd08
cmp qword [rsp + 0xb8], 0
jne 0x14000dd08
cmp qword [rsp + 0xc0], 0
je 0x14000dddb
lea rdx, [rsp + 0x20]
call fcn.14000de00
mov ecx, 0x2000
movzx r8d, byte [rax]
lea rdx, [rax + 1]
xor byte [rdx], r8b
xor byte [rax + 2], r8b
xor byte [rax + 3], r8b
xor byte [rax + 4], r8b
xor byte [rax + 5], r8b
xor byte [rax + 6], r8b
xor byte [rax + 7], r8b
xor byte [rax + 8], r8b
xor byte [rax + 9], r8b
xor byte [rax + 0xa], r8b
xor byte [rax + 0xb], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0xd], r8b
xor byte [rax + 0xe], r8b
xor byte [rax + 0xf], r8b
xor byte [rax + 0x10], r8b
xor byte [rax + 0x11], r8b
xor byte [rax + 0x12], r8b
xor byte [rax + 0x13], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x15], r8b
xor byte [rax + 0x16], r8b
xor byte [rax + 0x17], r8b
xor byte [rax + 0x18], r8b
xor byte [rax + 0x19], r8b
xor byte [rax + 0x1a], r8b
xor byte [rax + 0x1b], r8b
xor byte [rax + 0x1c], r8b
xor byte [rax + 0x1d], r8b
xor byte [rax + 0x1e], r8b
xor byte [rax + 0x1f], r8b
xor byte [rax + 0x20], r8b
xor byte [rax + 0x21], r8b
xor byte [rax + 0x22], r8b
xor byte [rax + 0x23], r8b
xor byte [rax + 0x24], r8b
xor byte [rax + 0x25], r8b
xor byte [rax + 0x26], r8b
xor byte [rax + 0x27], r8b
xor byte [rax + 0x28], r8b
xor byte [rax + 0x29], r8b
xor byte [rax + 0x2a], r8b
mov byte [rax + 0x2b], 0
call fcn.14000cce0
mov ecx, 0x2000
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rsp + 0x520]
xor rcx, rsp
call fcn.14005b040
add rsp, 0x538
ret