joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov edi, r8d
mov ebx, edx
mov rsi, rcx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001029
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001029
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov r14d, dword [r9 + r11*4]
mov bpl, byte [rax + r14]
test bpl, bpl
je 0x140001094
add r14, r10
mov r15d, 0xd9914a8d
movsx ebp, bpl
xor ebp, r15d
imul r15d, ebp, 0x1000193
mov bpl, byte [r14]
inc r14
test bpl, bpl
jne 0x140001072
cmp r15d, 0xde06d43b
je 0x14000109b
test r11, r11
jne 0x140001056
jmp 0x140001029
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov edx, dword [rcx + rdx*4]
add rdx, rax
mov rcx, rsi
call rdx
cmp eax, 0xffffffff
je 0x14000117f
mov ecx, eax
or ecx, edi
not edi
mov rdx, qword gs:[0x60]
mov r8, qword [rdx + 0x18]
add r8, 0x10
mov r8, qword [r8]
mov rdx, qword [r8 + 0x30]
movsxd r9, dword [rdx + 0x3c]
mov r9d, dword [rdx + r9 + 0x88]
test r9, r9
je 0x1400010d9
mov r10d, dword [rdx + r9 + 0x18]
test r10, r10
je 0x1400010d9
mov r14d, dword [rdx + r9 + 0x20]
add r14, rdx
lea r15, [rdx + 1]
dec r10
mov r11d, r10d
mov r12d, dword [r14 + r11*4]
mov bpl, byte [rdx + r12]
test bpl, bpl
je 0x140001146
add r12, r15
mov r13d, 0x54aa1114
movsx ebp, bpl
xor ebp, r13d
imul r13d, ebp, 0x1000193
mov bpl, byte [r12]
inc r12
test bpl, bpl
jne 0x140001123
cmp r13d, 0x76137b9a
je 0x14000114d
test r11, r11
jne 0x140001107
jmp 0x1400010d9
and eax, edi
test bl, bl
cmovne eax, ecx
mov ecx, dword [rdx + r9 + 0x1c]
mov r8d, dword [rdx + r9 + 0x24]
add rcx, rdx
add r8, rdx
movzx r8d, word [r8 + r11*2]
mov r8d, dword [rcx + r8*4]
add r8, rdx
mov rcx, rsi
mov edx, eax
call r8
test eax, eax
setne al
jmp 0x140001181
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140001cc4
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
lea rcx, [0x140006090]
call fcn.140001192
mov dword [0x140006098], 1
lea rsi, [0x1400060b0]
xor edi, edi
lea r8, [rsi - 4]
mov rcx, qword [rsi - 0x10]
mov rdx, rsi
call fcn.1400041a5
mov dword [rsi - 8], eax
test eax, eax
je 0x140001d1f
cmp qword [rsi], 0
je 0x140001d1f
mov rcx, qword [rsi - 0x10]
xor edx, edx
mov r8d, 1
call section..text
inc rdi
movsxd rax, dword [0x140006098]
add rsi, 0x18
cmp rdi, rax
jl 0x140001cf1
test eax, eax
jle 0x140001e1b
xor esi, esi
lea rdi, [0x1400060a0]
lea rbx, [rsi + rsi*2]
mov rcx, qword [rdi + rbx*8 + 0x10]
test rcx, rcx
je 0x140001dfd
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
add rdx, 0x10
mov rdx, qword [rdx]
mov rax, qword [rdx + 0x30]
movsxd r8, dword [rax + 0x3c]
mov r8d, dword [rax + r8 + 0x88]
test r8, r8
je 0x140001d66
mov r9d, dword [rax + r8 + 0x18]
test r9, r9
je 0x140001d66
mov r10d, dword [rax + r8 + 0x20]
add r10, rax
lea r11, [rax + 1]
dec r9
mov r14d, r9d
mov r15d, dword [r10 + r14*4]
mov bpl, byte [rax + r15]
test bpl, bpl
je 0x140001dd2
add r15, r11
mov r12d, 0xa027e6f5
movsx ebp, bpl
xor ebp, r12d
imul r12d, ebp, 0x1000193
mov bpl, byte [r15]
inc r15
test bpl, bpl
jne 0x140001db0
cmp r12d, 0x6e88b0e6
je 0x140001dd9
test r14, r14
jne 0x140001d94
jmp 0x140001d66
mov edx, dword [rax + r8 + 0x1c]
mov r8d, dword [rax + r8 + 0x24]
add rdx, rax
add r8, rax
movzx r8d, word [r8 + r14*2]
mov edx, dword [rdx + r8*4]
add rdx, rax
call rdx
mov eax, dword [0x140006098]
lea rcx, [rdi + rbx*8]
add rcx, 0x10
mov qword [rcx], 0
inc rsi
movsxd rcx, eax
cmp rsi, rcx
jl 0x140001d43
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140001ea8
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov r8d, ecx
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001ec6
mov r9d, dword [rax + rdx + 0x18]
test r9, r9
je 0x140001ec6
mov r10d, dword [rax + rdx + 0x20]
add r10, rax
lea r11, [rax + 1]
dec r9
mov esi, r9d
mov edi, dword [r10 + rsi*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x140001f28
add rdi, r11
mov ebp, 0x47fc05d7
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x140001f0c
cmp ebp, 0xa7eb9010
je 0x140001f2f
test rsi, rsi
jne 0x140001ef3
jmp 0x140001ec6
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + rsi*2]
mov r9d, dword [rcx + rdx*4]
add r9, rax
xor edi, edi
mov ecx, 1
xor edx, edx
call r9
test rax, rax
je 0x1400020a6
mov rsi, rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
add rcx, 0x10
mov rcx, qword [rcx]
mov rax, qword [rcx + 0x30]
movsxd rdx, dword [rax + 0x3c]
mov edx, dword [rax + rdx + 0x88]
test rdx, rdx
je 0x140001f71
mov r8d, dword [rax + rdx + 0x18]
test r8, r8
je 0x140001f71
mov r9d, dword [rax + rdx + 0x20]
add r9, rax
lea r10, [rax + 1]
dec r8
mov r11d, r8d
mov edi, dword [r9 + r11*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x140001fd3
add rdi, r10
mov ebp, 0x3eeaae8b
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x140001fb7
cmp ebp, 0x1d9e6f63
je 0x140001fda
test r11, r11
jne 0x140001f9e
jmp 0x140001f71
mov ecx, dword [rax + rdx + 0x1c]
mov edx, dword [rax + rdx + 0x24]
add rcx, rax
add rdx, rax
movzx edx, word [rdx + r11*2]
mov r8d, dword [rcx + rdx*4]
add r8, rax
mov rcx, rsi
xor edx, edx
call r8
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
add rdx, 0x10
mov rdx, qword [rdx]
mov rcx, qword [rdx + 0x30]
movsxd r8, dword [rcx + 0x3c]
mov r8d, dword [rcx + r8 + 0x88]
test r8, r8
je 0x14000200d
mov r9d, dword [rcx + r8 + 0x18]
test r9, r9
je 0x14000200d
mov r10d, dword [rcx + r8 + 0x20]
add r10, rcx
lea rdi, [rcx + 1]
dec r9
mov r11d, r9d
mov ebx, dword [r10 + r11*4]
mov bpl, byte [rcx + rbx]
test bpl, bpl
je 0x140002079
add rbx, rdi
mov r14d, 0x47ef39e4
movsx ebp, bpl
xor ebp, r14d
imul r14d, ebp, 0x1000193
mov bpl, byte [rbx]
inc rbx
test bpl, bpl
jne 0x140002057
cmp r14d, 0xac6713ae
je 0x140002080
test r11, r11
jne 0x14000203b
jmp 0x14000200d
test eax, eax
setne dil
mov eax, dword [rcx + r8 + 0x1c]
mov edx, dword [rcx + r8 + 0x24]
add rax, rcx
add rdx, rcx
movzx edx, word [rdx + r11*2]
mov edx, dword [rax + rdx*4]
add rdx, rcx
mov rcx, rsi
call rdx
mov eax, edi
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x1400032b0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
push rbp
push rbx
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
add rdx, 0x10
mov rdx, qword [rdx]
mov rax, qword [rdx + 0x30]
movsxd r8, dword [rax + 0x3c]
mov r8d, dword [rax + r8 + 0x88]
test r8, r8
je 0x1400032c5
mov r9d, dword [rax + r8 + 0x18]
test r9, r9
je 0x1400032c5
mov r10d, dword [rax + r8 + 0x20]
add r10, rax
lea r11, [rax + 1]
dec r9
mov esi, r9d
mov edi, dword [r10 + rsi*4]
mov bl, byte [rax + rdi]
test bl, bl
je 0x140003328
add rdi, r11
mov ebp, 0xa41754a7
movsx ebx, bl
xor ebx, ebp
imul ebp, ebx, 0x1000193
mov bl, byte [rdi]
inc rdi
test bl, bl
jne 0x14000330c
cmp ebp, 0x73b94c79
je 0x14000332f
test rsi, rsi
jne 0x1400032f3
jmp 0x1400032c5
mov edx, dword [rax + r8 + 0x1c]
mov r8d, dword [rax + r8 + 0x24]
add rdx, rax
add r8, rax
movzx r8d, word [r8 + rsi*2]
mov edx, dword [rdx + r8*4]
add rdx, rax
pop rbx
pop rbp
pop rdi
pop rsi
jmp rdx
Function at 0x14000bb30
Capabilities:
Encode data using xor

Disassembly:
and ebx, edi
xor eax, 0xc99f04f8
scasd eax, dword [rdi]
sbb eax, 0xa837d57f
int1
xor dword [rsi - 0x79], esi
popfq
push rsi
sub ecx, edx
sub dh, byte [rax - 0x7a]
nop
invalid
jb 0x14000bb0d
loop 0x14000bae5
cwde
pop rbx
ret

Function at 0x140d63058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140d631df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140d63089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d6306f
add dl, dl
jne 0x140d63096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d630f6
xor eax, eax
add dl, dl
jne 0x140d630a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140d631ad
add dl, dl
jne 0x140d630b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d630c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d630d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d630dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140d630ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140d6307e
mov eax, 1
add dl, dl
jne 0x140d63106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140d63113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d630fb
sub eax, ebx
mov ebx, 1
jne 0x140d6314c
mov ecx, 1
add dl, dl
jne 0x140d6312e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d6313b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d63123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d6307e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140d63168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140d63175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140d6315d
cmp eax, 0x7d00
jae 0x140d6319b
cmp eax, 0x500
jb 0x140d63196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d6307e
cmp eax, 0x7f
ja 0x140d6319e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140d6307e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140d631d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140d6307e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140eba9f0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140eba9fd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140ebaa0d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140eba9f5
lea eax, [rcx + 1]
jmp 0x140ebaa1b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140ebaa2e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140ebaa14
sub eax, 3
jb 0x140ebaa4e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140ebaa9d
sar eax, 1
movsxd rbp, eax
jb 0x140ebaa84
jmp 0x140ebaa5c
add ebx, ebx
jne 0x140ebaa5a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140ebaa84
inc ecx
add ebx, ebx
jne 0x140ebaa6a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140ebaa84
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140ebaa7d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140ebaa6c
add ecx, 2
jmp 0x140ebaa89
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140eba9b2
jmp 0x140eba9fd
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xeb6000]
mov eax, dword [rdi]
or eax, eax
je 0x140ebaaf9
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xecafc4]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140ebaaa9
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140ebaaf3
mov qword [rbx], rax
add rbx, 8
jmp 0x140ebaac9
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140ebab3d
cmp al, 0xef
ja 0x140ebab25
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140ebab05
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140ebab14
mov eax, dword [rdi]
add rdi, 4
jmp 0x140ebab14
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140ebabbc], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140ebabbc
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140ebabac
sub rsp, 0xffffffffffffff80
jmp 0x1400010f6
Function at 0x140c01e86
Capabilities:
Execute anti-debugging instructions

Disassembly:
bts r10d, 0xbc
btr ebx, 0xad
xor dword [rsp + rdx*8 - 0x648be358], ecx
inc edi
neg dil
mov r11, qword [rsp + rdx - 0xc917c64]
sbb r10b, dl
jbe 0x140c1737a
movsxd rcx, ecx
mov qword [rsp + rdx*2 - 0x1922f8d8], rdx
jp 0x140c063db
adc rbp, rcx
mov qword [rsp + rdx - 0xc917c64], 0xffffffffb0218a36
lea rcx, [rbx + r10*4 + 0x49ad5529]
jmp 0x140bf6ba8
sub cx, bx
adc rbp, rsi
and di, dx
setl cl
or rdx, rbp
jmp rdx

Function at 0x140c02e78
Capabilities:
Authenticate hmac

Disassembly:
xadd qword [rsp + rbx*2 + 8], rdx
or ebx, eax
mov r11, qword [rsp + rdx*2 - 0x566118]
movsxd rcx, ecx
inc word [rsp + rdx*2 - 0x566120]
adc rbp, rcx
mov rsi, qword [r8 + rdx - 0x2b3094]
push rdi
call fcn.140c269d6
mov esi, 0x8e9e2723
movsx eax, sil
movzx edi, al
mov dx, word [rax + r8 - 0x23]
shr eax, 0x15
xchg rsi, rax
lea r8, [rsi + r8 + 2]
push rdi
shl rdi, 0xb6
or word [rsp + rsi + 1], ax
lea r9, [r9 + rsi*4 - 1]
mov r10d, 0x38ad5fa1
movzx ecx, byte [r9 + rsi]
sar byte [rsp + r10*2 - 0x715abf40], 0xa4
xor cl, r11b
inc qword [rsp + rsi]
inc cl
shl r10d, 0xa4
xor cl, 5
jmp 0x140c2081e
neg ecx
btr edi, edi
mov qword [rsp + rdx - 0xa8], rdx
push rdi
bswap ecx
xor dword [rsp + rdx*4 - 0x299], 0x2b303c02
neg esi
setg dil
dec ecx
neg ecx
ror ecx, 1
mul byte [rsp + rdx - 0x99]
dec ecx
movsx ebx, byte [rsp + rdx*2 - 0x13e]
shl rbx, 0xff
ror dl, 0xc3
xor ecx, 0xf030bf38
xor word [rsp + rdx - 0x13], ax
xadd dil, al
mov qword [rsp + rdx*2 - 0x1a], r11
neg edx
xor dword [rsp + rbx + 0x10], ecx
jmp 0x140bf5a98
shr byte [rsp + rsi*2 + 2], 0xe1
neg cl
and word [rsp + rsi + 4], r10w
add r10w, word [rsp + rsi*8 + 5]
rol cl, 1
call fcn.140bf78ff

Function at 0x140c02f95
Capabilities:
Manually build aes constants

Disassembly:
push 0xfffffffff0100515
dec rbx
lea rsp, [rsp + 0x18]
jne 0x140c10432
Function at 0x140c06018
Capabilities:
Authenticate hmac
Execute anti-debugging instructions

Disassembly:
movsxd rcx, ecx
cbw
and r10b, 0x9f
adc rbp, rcx
rol rax, 0x31
adc dx, 0xc2a5
lea r9, [r9 + rdi - 0x718dba04]
movzx esi, byte [rdi + r9 - 0x718dba03]
movzx ecx, bx
mov qword [rsp + rcx*8 - 0x30e68], rax
xor sil, r11b
xor sil, 0x1a
rol sil, 1
not sil
rol edi, 0x87
pop rdi
adc sil, 0x18
push rdx
neg sil
add sil, 5
xchg rcx, rax
neg rax
rol al, 0x21
xor r11b, sil
shl bx, 0x69
lea rsi, [rsp + rsi + 8]
movzx r10w, byte [rsi + rax*4 + 0x18668]
lea r8, [rax + r8 + 0x6198]
mov word [rax + r8 + 0x619a], r10w
push rax
movzx r10d, di
pop rcx
pop rbx
jp fcn.140c26a67
mov ecx, 0x3282920f
movzx si, byte [r8 + rcx*2 - 0x6505241e]
mov ebx, ecx
movsx edx, bl
movsx r10d, dl
mov cl, byte [rcx + r8 - 0x3282920d]
jmp 0x140c25bcc
jae 0x140c236ee
mov r10d, 0x753d4c15
movsx edi, r10b
movzx ecx, word [r9 + r10 - 0x753d4c15]
lea rbx, [r10*2 - 0x3de7897d]
ror edi, 0xa7
xor cx, r11w
shr ebx, 0xc9
push r10
add qword [rsp + rdi - 0x2a000000], rbx
not cx
cmovl rbx, r10
xor cx, 0x1137
lea r10, [r10*2 - 0x477d1fce]
movzx edx, bl
xchg word [rsp + rdi - 0x29fffffa], dx
neg cx
add cx, 0xb78f
xor dl, r10b
push rdi
xor r11w, cx
lea rcx, [rsp + rcx + 0x10]
lea rsi, [rdi*4 - 0x60483461]
neg dl
inc byte [rsp + rdi - 0x29fffffe]
mov dl, byte [rcx + rdi - 0x2a000000]
inc r10d
cmovle rdi, qword [rsp + rbx - 0x564981]
push r10
lea r8, [r8 + rbx - 0x564989]
mov eax, esi
movzx ecx, al
mov word [r8 + rbx*4 - 0x159261c], dx
ja 0x140c3055b
jle 0x140c17349
mov ecx, 0x56193881
lea rdi, [rcx - 0x3d6d56d9]
lea r9, [r9 + rdi - 0x18abe1ac]
movzx edx, dil
jmp 0x140c1601f
push rcx
mov ecx, dword [rdi + r9 - 0x18abe1a8]
ror edi, 0xdc
lea rsi, [rdx + rdi*4 + 0x3809a2ab]
movsx eax, sil
xor ecx, r11d
not word [rsp + rdx*2 - 0x14e]
xchg qword [rsp + rdx*2 - 0x150], rax
call fcn.140c02e78
lea r8, [r8 + rsi*4 - 0x7fffff0]
mov qword [r10 + rsi*2 - 0x4000000], rcx
jmp rbp
btr r10, 0x16
lea r8, [r8 + rdx - 0xd]
setb dl
shr sil, cl
bt rbx, r10
call fcn.140c2ccf9
mov esi, ebx
movsxd rax, eax
add rbp, rax
rol edi, 0x47
mov r10, qword [r8 + r10*4 - 0x214]
movzx ecx, di
mov rcx, qword [r8 + rsi*2 - 0x3fffff8]
movsx eax, di
jae 0x140c06561
Function at 0x140c06e5f
Capabilities:
Authenticate hmac

Disassembly:
mov edx, 0x8d286d2d
mov r10d, dword [r9 + riz]
jmp 0x140c00f0e
add dil, dl
xor r10d, r11d
mov esi, edx
xor r10d, 0x80b0c32e
mov eax, esi
and cx, di
dec r10d
neg r10d
jmp 0x140c17188
shr r10d, 0x39
mov qword [rsp + r10*2 + 8], r11
add edx, 0x233f71bf
cmovp eax, r10d
xor dword [rsp + r10*2 + 8], ebx
mov r11, qword [rsp + r10 + 8]
movsxd rbx, ebx
imul rax
pop rdx
adc rbp, rbx
lea r9, [r9 + r10*2 - 8]
movzx esi, cl
mov edx, eax
push rdi
mov rsi, qword [r9 + r10]
call fcn.140c0a3da
mov ecx, 0xf226a281
sub r9, 4
movsx edi, cl
jmp 0x140bf50df
push r10
xor r11b, bl
lea rbx, [rsp + rbx + 8]
btc esi, 0xae
call fcn.140c2d57d
jg 0x140c207a3
movzx ebx, ax
cwd
ror r10d, 2
push r11
ror dil, 0xc1
xor dword [rsp + rbx*4 - 0x1b4b4], r10d
rol eax, 0xff
pop r11
movsxd r10, r10d
shr rsi, 0x83
add rbp, r10
btc rax, 0x20
lea r10, [rdx*8 + 0x76149f2f]
mul sil
mov esi, dword [r8 + rsi*4 - 0x46943694]
cmovno rcx, r10
call fcn.140c2f8ac
movzx ebx, byte [r9 + rdx*8]
div al
xor bl, r11b
pop r10
not rax
rol ax, cl
xor bl, 0x1a
rol bl, 1
not bl
mov edi, 0x44064eb7
add bl, 0x18
neg bl
add bl, 5
sal dl, 0xa4
jbe 0x140c08fdf
add rbp, rcx
mov r10, qword [r8 + riz]
mov rdx, qword [r8 + riz + 8]
call fcn.140c05517
movzx r10d, al
mov edx, dword [r9 + rbx - 0x4f8ca69e]
xor edx, r11d
movsx esi, bl
bswap edx
sar cl, 0xe4
dec edx
not edx
imul ax, si
adc r10, rsi
bts eax, esi
lea edx, [rbx + rdx - 0x2103d2e3]
bswap edx
btc bx, si
sar r10d, 0xf8
bts di, cx
push r11
movzx r11d, cx
xor dword [rsp + rbx - 0x4f8ce69e], edx
or r11b, 0x31
pop r11
movsxd rdx, edx
xor sil, 0x14
xadd r10w, bx
adc rbp, rdx
mul rdi
inc esi
sbb di, bx
jno fcn.140c26a67

Function at 0x140c080bd
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea rsp, [rsp + 0x10]
jne 0x140c2b0a5
mov r8, rax
jmp 0x140c11624
Function at 0x140c10419
Capabilities:
Manually build aes constants

Disassembly:
mov dword [r8 + r10 - 0x509f8fad], esi
call fcn.140bfdec5
mov edi, 0x1d32ebab
lea rcx, [rdi + rdi + 0x56233e19]
movzx eax, di
lea r9, [r9 + rdi*2 - 0x3a65d75a]
rol cx, cl
mov r10d, dword [rdi + r9 - 0x1d32ebab]
mul dil
lea rsi, [rcx + rdi*4 - 0x207c4ce6]
shr rcx, 0xb9
xor r10d, r11d
lea rdi, [rax + rsi - 0x5d5a3fd9]
movsx edx, cx
btr rdx, rax
lea r10d, [r10 + rcx*2 - 0x9350813]
neg r10d
not r10d
cqo
imul sil
lea r10d, [r10 + rcx*2 - 0x678594a3]
btc edi, esi
sal edi, 0x5a
not eax
neg r10d
dec rax
cdq
xor dl, sil
ror r10d, 2
bswap r10d
push r11
lea rbx, [rdi*2 - 0x7c72054f]
xor dword [rsp + rdi - 0x74000000], r10d
movsx r11d, cl
xor eax, 0xa6b3131e
sar rdi, 0x4e
pop r11
cwde
btc ax, di
movsxd r10, r10d
jae 0x140c16068
bts rax, 0xa3
idiv edi
add rbp, r10
shr esi, 0x6d
mov ebx, dword [r8 + rdi*4 - 0x74000]
btc dx, di
jae 0x140c22e73
movsx r10d, dl
lea rdi, [r10 - 0x36e89ed7]
mov ebx, dword [rdx + r9 - 0x8b]
xor ebx, r11d
not dx
xor ebx, 0x50995909
and ecx, r10d
lea ebx, [rbx + rdx*2 - 0x36c019e9]
shr rdi, 0x90
neg ebx
not ebx
movsx esi, r10b
push r11
lea rdx, [rsi*2 + 0x1a05bd11]
lea rdi, [rdx - 0x4a6feb53]
lea rax, [rcx*2 - 0x546f8543]
xor dword [rsp], ebx
dec r10w
pop r11
movsxd rbx, ebx
rol al, 0x61
btr rsi, rsi
add rbp, rbx
sub r9, 1
and rdi, rcx
or edi, edi
inc r10b
movzx esi, byte [r9 + riz]
call fcn.140c040d0
mov r10d, 0x509f8fad
movsx eax, r10w
not esi
mov edx, eax
jmp 0x140bfaf06
test rbx, rbx
not byte [rsp + 0x10]
lea rsp, [rsp + 0x18]
je 0x140c02fa8
lea rdx, [0x140c17d58]
mov eax, 0xd7347204
jmp 0x140c2ffdc
push 0x6e36b52a
and eax, 0xff
rol byte [rsp + 2], 0xc4
mov eax, dword [rdx + rax*4]
shr esi, 8
xor esi, eax
or byte [rsp + 2], 0x88
adc dword [rsp + 1], 0x252fbc98
setb byte [rsp]
inc rcx
jmp 0x140c18583
lea r11, [rdi + rcx + 0xf3e6caf]
xor dword [rsp + rcx*2 - 0x191fbe4e], r10d
dec dil
pop r11
cbw
movsxd r10, r10d
add rbp, r10
mov ebx, dword [r8 + rcx*8 - 0x647ef938]
cwde
movsx r10d, sil
lea r8, [r8 + rcx*4 - 0x323f7c98]
lea r9, [r9 + rcx*2 - 0x191fbe4f]
cwde
sar rsi, cl
movzx edi, byte [r9 + rsi]
mov edx, r10d
cwd
xor dil, r11b
xor dil, dl
cdqe
idiv cl
sub dil, 0xba
inc rax
ror dil, 1
lea rdx, [rax + rax*4 + 0xc3c8317]
xchg edx, esi
sar ax, cl
adc dil, dl
and edx, r10d
not r10w
xor dil, 0xa5
lea rax, [rdx + rsi - 0x6cd53947]
shr rdx, 0xa7
adc sil, al
ror dil, 1
add si, 0xd085
neg cl
xor r11b, dil
or esi, ecx
rol r10w, 0xad
add rdi, rsp
not al
mov dword [rsi + rdi - 0xcbffffb], ebx
dec rsi
sal si, 0x64
xor rdx, rbp
jmp rdx
xor esi, 0x82a25d0c
call fcn.140c02f95
mov edx, dword [r8 + rdi - 0x1cffc]
sar rcx, 0xec
jns 0x140c2efee
jmp 0x140c15a03
shr al, 0x44
or cl, byte [rdi + r8 - 0x1cff8]
lea r8, [r8 + rdi*4 - 0x73ffa]
btc rsi, 0xa3
mov r10d, eax
shrd ebx, edx, cl
lea rdx, [rsi + rax*2 + 0x29224081]
movzx ecx, dil
ror rcx, 0x37
mov dword [r8 + rdi*2 - 0x3a000], ebx
cwde
add rcx, rbp
jmp rcx
lea rax, [rax + rax*2 + 0x75012cb4]
movzx eax, byte [rcx + riz]
xor eax, esi
jmp 0x140c261b1

Function at 0x140c1b133
Capabilities:
Manually build aes constants

Disassembly:
shr bx, 0x28
mov rdi, qword [r8 + rax*2 - 0xa5ec]
call fcn.140c00122
Function at 0x140c267c8
Capabilities:
Execute anti-debugging instructions

Disassembly:
shr r10, 0x3c
mov qword [rsp + r10*2], rax
mov rsi, qword [r10 + r8]
cwde
movzx ecx, ax
or r10b, byte ss:[rsi + rax - 0x17e3]
inc rax
or rcx, rcx
lea r8, [r8 + rax - 0x17de]
pop rbx
xor rdi, rcx
jno 0x140c04441

Function at 0x140c2aaa5
Capabilities:
Authenticate hmac

Disassembly:
cmp ebx, 4
call fcn.140c10566
Function at 0x140001070
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13d, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, rax
xor edi, edi
movsxd rcx, dword [rax + 0x3c]
mov r15d, dword [rcx + rax + 0x88]
add r15, rax
mov eax, dword [r15 + 0x1c]
mov r12d, dword [r15 + 0x20]
add rax, r14
mov qword [rsp + 0x78], rax
add r12, r14
mov eax, dword [r15 + 0x24]
add rax, r14
mov qword [rsp + 0x70], rax
cmp dword [r15 + 0x14], edi
jbe 0x140001188
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rsi
mov ebx, dword [r12 + rdi*4]
add rbx, r14
jne 0x1400010e1
lea eax, [rbx + 0x35]
jmp 0x14000111d
mov edx, 0x32
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strnlen]
mov rdx, rax
mov r8, rbx
mov eax, 0x35
test rdx, rdx
je 0x14000111d
nop
movsx ecx, byte [r8]
lea r8, [r8 + 1]
add eax, ecx
imul eax, eax, 0x401
mov ecx, eax
shr ecx, 6
xor eax, ecx
sub rdx, 1
jne 0x140001100
lea ecx, [rax + rax*8]
mov eax, ecx
lea rdx, str.WriteProcessMemory
shr eax, 0xb
xor eax, ecx
mov rcx, rbx
imul esi, eax, 0x8001
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x140001152
mov r8d, esi
lea rcx, str.HASH_FROM_STRING__s:__x_n
mov rdx, rbx
call fcn.140001010
cmp esi, r13d
je 0x140001165
inc edi
cmp edi, dword [r15 + 0x14]
jb 0x1400010d3
jmp 0x140001179
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x78]
movzx eax, word [rax + rdi*2]
mov eax, dword [rcx + rax*4]
add rax, r14
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret