joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004720
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140021010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [0x140022e00]
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov r13, r9
mov r12, r8
mov r15, rdx
mov r14, rcx
test rax, rax
jne 0x140004832
mov rax, qword gs:[0x60]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rdi
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop word [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x140004804
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x140004804
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400047ff
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1400047e0
cmp edx, 0x6e2a0391
je 0x14000486d
test r8d, r8d
jne 0x1400047c0
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x140004819
cmp qword [rax + 0x30], rbp
jne 0x140004790
mov rax, rbp
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov qword [0x140022e00], rax
lea rcx, [rsp + 0x30]
mov r9, r13
mov qword [rsp + 0x20], rcx
mov r8, r12
mov rcx, r14
mov rdx, r15
call rax
test eax, eax
setns bpl
mov eax, ebp
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400071f0
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x14000481c
Function at 0x140007c14
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140007c5e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140007c5e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140007c5e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140007c5e
cmp dword [rcx + 0x84], 0xe
jbe 0x140007c5e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140007c60
xor al, al
add rsp, 0x28
ret

Function at 0x14000d004
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000ce30
Function at 0x1400142e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140014308
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140014308
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14005ca94
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.140042c50
sub rsp, rax
mov rax, qword [0x140103090]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.140058da8
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x14005cae3
mov rax, rbp
jmp 0x14005cbeb
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x109f90]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.14005da04
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x109f90]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x14005cbe7
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14005cbe7
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.14005da04
test rax, rax
js 0x14005cbe7
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x14005cbe7
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x14005cbd9
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x14005cbd9
cmp byte [rcx], 0xd
jne 0x14005cbbf
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14005cbce
cmp byte [rcx + 1], 0xa
jne 0x14005cbce
inc rcx
jmp 0x14005cbce
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x1034b0]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x14005cba1
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x14005cbeb
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140041e30
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140121806
Capabilities:
Set thread local storage value

Disassembly:
push rax
pushf
mov eax, 0xdf739de0
pushf
not eax
add eax, 0x882555ca
xor eax, 0xdb2503dd
rol eax, 0x11
popf
pushf
not eax
add eax, 0xd45136fe
xor eax, 0xddef69a5
rol eax, 0x69
popf
pushf
not eax
add eax, 0xefcdf33d
xor eax, 0xe1810fd0
rol eax, 0x61
popf
cmp eax, 2
jne 0x140121856
popf
pop rax
jmp 0x1401219ec
cmp eax, 0
jne 0x140121865
popf
pop rax
jmp 0x140121883
cmp eax, 3
jne 0x140121874
popf
pop rax
jmp 0x140121a4b
cmp eax, 1
jne 0x140121883
popf
pop rax
jmp 0x1401219e3
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
lea r9, [0x197a0d6b7]
pushf
sub r9, 0x5799c737
popf
mov edi, ecx
lea rdx, [0x1b36cabda]
pushf
sub rdx, 0x73659c5a
popf
mov ecx, 0x372f1df4
pushf
not ecx
add ecx, 0xd4265058
xor ecx, 0xaaa24afe
rol ecx, 0xe1
popf
pushf
not ecx
add ecx, 0x90ce0be3
xor ecx, 0xfc4fd53d
rol ecx, 0x5c
popf
pushf
not ecx
add ecx, 0xd305abd7
xor ecx, 0xf3dc50b2
rol ecx, 0x23
popf
pushf
not ecx
add ecx, 0xc83ad46f
xor ecx, 0x93266cf2
rol ecx, 0xf6
popf
lea r8, [0x1be8772dd]
pushf
sub r8, 0x7e806365
popf
call fcn.14004857c
mov rdx, rbx
mov ecx, edi
test rax, rax
je 0x140121989
push rax
pushf
mov eax, 0xa6c5ba41
pushf
not eax
add eax, 0xac4565ee
xor eax, 0xd542d2d8
rol eax, 0x1c
popf
pushf
not eax
add eax, 0xe6086ea3
xor eax, 0xbd1cf758
rol eax, 0x9d
popf
pushf
not eax
add eax, 0xce6056c6
xor eax, 0xef402ed3
rol eax, 0x71
popf
pushf
not eax
add eax, 0x8c3accb8
xor eax, 0xc369bf7f
rol eax, 0x1f
popf
jmp 0x140121847
push rax
pushf
mov eax, 0xb37ae2a7
pushf
not eax
add eax, 0x84f3763f
xor eax, 0x98effaf5
rol eax, 0x6e
popf
pushf
not eax
add eax, 0xe1aa6467
xor eax, 0xd8a22d6d
rol eax, 0xa1
popf
pushf
not eax
add eax, 0xb7ef2da0
xor eax, 0x87a30e18
rol eax, 0xa1
popf
pushf
not eax
add eax, 0xcaee07c8
xor eax, 0xc9a5c60b
rol eax, 0x88
popf
jmp 0x140121847
call qword [case.0x14014e652.0]
jmp 0x140121a4b
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
push rax
pushf
mov eax, 0xada7b785
pushf
not eax
add eax, 0xf4f366a7
xor eax, 0x86d44125
rol eax, 0x70
popf
pushf
not eax
add eax, 0x82d794ef
xor eax, 0x9c2e56eb
rol eax, 0x7a
popf
pushf
not eax
add eax, 0xe4f414d2
xor eax, 0xf499bcde
rol eax, 0x44
popf
pushf
not eax
add eax, 0xcf666478
xor eax, 0xcacc7e1e
rol eax, 0x20
popf
jmp 0x140121847
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14013ec0e
Capabilities:
Authenticate hmac

Disassembly:
push rax
pushf
mov eax, 0x42695696
pushf
not eax
add eax, 0xb8496bc9
xor eax, 0xc8ae29bd
rol eax, 0x5c
popf
pushf
not eax
add eax, 0x95908c61
xor eax, 0xd085efee
rol eax, 3
popf
pushf
not eax
add eax, 0xea29c44e
xor eax, 0xa037889b
rol eax, 0x6d
popf
cmp eax, 0
jne 0x14013ec5e
popf
pop rax
jmp 0x14013ec5e
mov r8, qword [rdx]
jmp fcn.14038cd43
Function at 0x1401861ea
Capabilities:
Get thread local storage value

Disassembly:
push rax
pushf
mov eax, 0x4599df7c
pushf
not eax
add eax, 0x8b5e3d9a
xor eax, 0xe0bac0c3
rol eax, 0xcb
popf
pushf
not eax
add eax, 0xf36ea694
xor eax, 0xb849189a
rol eax, 0x9b
popf
pushf
not eax
add eax, 0xc28a912b
xor eax, 0xacc42b89
rol eax, 0x84
popf
pushf
not eax
add eax, 0xa3b7701b
xor eax, 0xd9ec6af1
rol eax, 0xe0
popf
cmp eax, 2
jne 0x14018624d
popf
pop rax
jmp 0x14018637c
cmp eax, 0
jne 0x14018625c
popf
pop rax
jmp 0x14018626b
cmp eax, 1
jne 0x14018626b
popf
pop rax
jmp 0x140186370
push rbx
sub rsp, 0x20
mov ebx, ecx
lea r9, [0x18e31a84f]
pushf
sub r9, 0x4e2a98e7
popf
mov ecx, 0x4681bbb1
pushf
not ecx
add ecx, 0xa7c1babd
xor ecx, 0xaf191a4e
rol ecx, 0x13
popf
pushf
not ecx
add ecx, 0xb7036247
xor ecx, 0x8cd6f10f
rol ecx, 0x50
popf
lea r8, [0x1aedaf892]
pushf
sub r8, 0x6ed3e932
popf
lea rdx, [0x19b2742d6]
pushf
sub rdx, 0x5b20336e
popf
call fcn.14004857c
mov ecx, ebx
test rax, rax
je 0x14018633d
push rax
pushf
mov eax, 0x8a4ddc11
pushf
not eax
add eax, 0xb4c4afab
xor eax, 0xe6a2de83
rol eax, 0xbb
popf
pushf
not eax
add eax, 0x81413ecc
xor eax, 0xd2849955
rol eax, 0x2c
popf
pushf
not eax
add eax, 0xce5437a2
xor eax, 0x909a37d4
rol eax, 3
popf
pushf
not eax
add eax, 0xd7cee4f6
xor eax, 0xebf3a6b2
rol eax, 0xee
popf
jmp 0x14018623e
push rax
pushf
mov eax, 0xb70e38c1
pushf
not eax
add eax, 0x95898595
xor eax, 0xdf8bc506
rol eax, 0xc8
popf
pushf
not eax
add eax, 0x825f05e5
xor eax, 0x91d570e3
rol eax, 0xb3
popf
jmp 0x14018623e
add rsp, 0x20
pop rbx
jmp qword [case.0x14014e652.0]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x14019446e
Capabilities:
Allocate thread local storage

Disassembly:
push rax
pushf
mov eax, 0xc81e930c
pushf
not eax
add eax, 0xceb7890c
xor eax, 0xc0602a19
rol eax, 0x36
popf
pushf
not eax
add eax, 0xc873991f
xor eax, 0xcec1dae7
rol eax, 0xeb
popf
cmp eax, 2
jne 0x1401944ab
popf
pop rax
jmp 0x1401945c2
cmp eax, 0
jne 0x1401944ba
popf
pop rax
jmp 0x1401944c9
cmp eax, 1
jne 0x1401944c9
popf
pop rax
jmp 0x1401945b3
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [0x18026c23e]
pushf
sub r9, 0x401fb2fe
popf
xor ecx, ecx
lea r8, [0x19a72f18a]
pushf
sub r8, 0x5a6be252
popf
lea rdx, [0x1b2c6e5a3]
pushf
sub rdx, 0x72bfd663
popf
call fcn.14004857c
test rax, rax
je 0x14019456d
push rax
pushf
mov eax, 0x12a653ce
pushf
not eax
add eax, 0x8d42f9d2
xor eax, 0xa627c231
rol eax, 0xb7
popf
pushf
not eax
add eax, 0xa3c53af7
xor eax, 0xaebf7813
rol eax, 9
popf
pushf
not eax
add eax, 0x86999512
xor eax, 0x914da0d6
rol eax, 0x3d
popf
pushf
not eax
add eax, 0x9215fbb0
xor eax, 0xcdd593ec
rol eax, 0x78
popf
jmp 0x14019449c
push rax
pushf
mov eax, 0x48e5bd3f
pushf
not eax
add eax, 0x82b041fa
xor eax, 0xc4180293
rol eax, 0x4a
popf
pushf
not eax
add eax, 0xa05f759d
xor eax, 0xa5100a37
rol eax, 0x95
popf
pushf
not eax
add eax, 0xe8bdda2f
xor eax, 0xf61f6f56
rol eax, 0xcb
popf
jmp 0x14019449c
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [case.0x14014e652.0]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsAlloc]
Function at 0x1401ae026
Capabilities:
Hash data using murmur3

Disassembly:
push rax
pushf
mov eax, 0x6a21cd67
pushf
not eax
add eax, 0xaa581b68
xor eax, 0xc299995f
rol eax, 0xcf
popf
pushf
not eax
add eax, 0xb4cc31a1
xor eax, 0xc91c7049
rol eax, 0xd6
popf
cmp eax, 0
jne 0x1401ae063
popf
pop rax
jmp 0x1401ae063
jmp fcn.1401dc8d4
Function at 0x1401ce252
Capabilities:
Hash data using murmur3

Disassembly:
push rax
pushf
mov eax, 0x7b31fce3
pushf
not eax
add eax, 0xc0c9ce3a
xor eax, 0x9a66eab9
rol eax, 0x80
popf
pushf
not eax
add eax, 0xbb3cc193
xor eax, 0xfc3e4dd0
rol eax, 0x18
popf
pushf
not eax
add eax, 0xa45aefed
xor eax, 0xfc397d45
rol eax, 0xc6
popf
pushf
not eax
add eax, 0xf9000ef3
xor eax, 0xb67e367f
rol eax, 0xeb
popf
cmp eax, 2
jne 0x1401ce2b5
popf
pop rax
jmp 0x1401ce380
cmp eax, 0
jne 0x1401ce2c4
popf
pop rax
jmp 0x1401ce2d3
cmp eax, 1
jne 0x1401ce2d3
popf
pop rax
jmp 0x1401ce37d
cmp qword [rdx + 0x18], 0x10
mov r8, qword [rdx + 0x10]
jb 0x1401ce324
push rax
pushf
mov eax, 0xe93cdfd6
pushf
not eax
add eax, 0xb784c1c8
xor eax, 0xf5f01f22
rol eax, 0xef
popf
pushf
not eax
add eax, 0xc278010b
xor eax, 0xb0408ebb
rol eax, 0xe3
popf
pushf
not eax
add eax, 0x8b8c9657
xor eax, 0xf1152993
rol eax, 0xbb
popf
jmp 0x1401ce2a6
push rax
pushf
mov eax, 0x2404d483
pushf
not eax
add eax, 0xc139f7d3
xor eax, 0xa6e0ee53
rol eax, 0xe2
popf
pushf
not eax
add eax, 0xa81d6b42
xor eax, 0xbcee8352
rol eax, 0x35
popf
pushf
not eax
add eax, 0xb3d79ee0
xor eax, 0xf5a4f4f4
rol eax, 0xaf
popf
pushf
not eax
add eax, 0xc68cc1d1
xor eax, 0xcdedc667
rol eax, 0xe8
popf
jmp 0x1401ce2a6
mov rdx, qword [rdx]
jmp fcn.1401f13af
Function at 0x1401d7194
Capabilities:
Terminate process

Disassembly:
push rax
pushf
mov eax, 0xd808f033
pushf
not eax
add eax, 0x987b3050
xor eax, 0xc86543d1
rol eax, 0x32
popf
pushf
not eax
add eax, 0xaecb83a2
xor eax, 0x9f976345
rol eax, 0xc8
popf
cmp eax, 2
jne 0x1401d71d1
popf
pop rax
jmp 0x1401d72b2
cmp eax, 0
jne 0x1401d71e0
popf
pop rax
jmp 0x1401d71ef
cmp eax, 1
jne 0x1401d71ef
popf
pop rax
jmp 0x1401d72a0
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.140272b81
test al, al
je 0x1401d7259
push rax
pushf
mov eax, 0xd7b64f0c
pushf
not eax
add eax, 0xf71841fc
xor eax, 0xe9075860
rol eax, 0xe9
popf
pushf
not eax
add eax, 0x830ecb1c
xor eax, 0x9b31c998
rol eax, 0x5d
popf
pushf
not eax
add eax, 0xc1c7d328
xor eax, 0x92745129
rol eax, 0x20
popf
pushf
not eax
add eax, 0xd37f0acf
xor eax, 0x89bc72d6
rol eax, 0x2a
popf
jmp 0x1401d71c2
push rax
pushf
mov eax, 0xbb48d890
pushf
not eax
add eax, 0xdc21a56e
xor eax, 0xb35b5dbf
rol eax, 0xf8
popf
pushf
not eax
add eax, 0x80f7288d
xor eax, 0xfe093b4d
rol eax, 0x4d
popf
pushf
not eax
add eax, 0x8e33d4c2
xor eax, 0xba3cf8b4
rol eax, 2
popf
jmp 0x1401d71c2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, ebx
jmp 0x1401d72ac
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, ebx
call fcn.1401c9947
mov ecx, ebx
jmp 0x1401d72bc
call qword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x140202913
Capabilities:
Get geographical location

Disassembly:
push rax
pushf
mov eax, 0xf9fdcb9d
pushf
not eax
add eax, 0xefa0fa10
xor eax, 0xf763b5a6
rol eax, 0xf
popf
pushf
not eax
add eax, 0xf8739352
xor eax, 0xaa8991f1
rol eax, 0x64
popf
cmp eax, 2
jne 0x140202950
popf
pop rax
jmp 0x140202b11
cmp eax, 0
jne 0x14020295f
popf
pop rax
jmp 0x14020297d
cmp eax, 3
jne 0x14020296e
popf
pop rax
jmp 0x140202b72
cmp eax, 1
jne 0x14020297d
popf
pop rax
jmp 0x140202ac1
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebx, r9d
mov rdi, r8
mov esi, edx
lea r9, [0x18a0d3887]
pushf
sub r9, 0x4a05e35f
popf
mov rbp, rcx
lea r8, [0x1987bfb01]
pushf
sub r8, 0x5874a5e1
popf
lea rdx, [0x19966dafe]
pushf
sub rdx, 0x595f85d6
popf
mov ecx, 0xa04794c7
pushf
not ecx
add ecx, 0x848c81e2
xor ecx, 0xcf9721f2
rol ecx, 0x58
popf
pushf
not ecx
add ecx, 0xaf9c3dcb
xor ecx, 0x82ab9966
rol ecx, 0xa5
popf
pushf
not ecx
add ecx, 0xfae2bdb3
xor ecx, 0xec15c4f7
rol ecx, 0x6d
popf
pushf
not ecx
add ecx, 0xf2d638e7
xor ecx, 0xcb0a7e78
rol ecx, 0xa7
popf
call fcn.14005bc50
test rax, rax
je 0x140202a7b
push rax
pushf
mov eax, 0x514f1f62
pushf
not eax
add eax, 0xa955b759
xor eax, 0x90322db8
rol eax, 0xd6
popf
pushf
not eax
add eax, 0x9f9ba7cf
xor eax, 0x81695ac3
rol eax, 0x3c
popf
pushf
not eax
add eax, 0xf7ee3983
xor eax, 0xbf442d7c
rol eax, 0xf
popf
jmp 0x140202941
push rax
pushf
mov eax, 0x7f3a9b1c
pushf
not eax
add eax, 0xd510688e
xor eax, 0x882ac892
rol eax, 0xba
popf
pushf
not eax
add eax, 0x8efe858b
xor eax, 0xf9e25ed7
rol eax, 5
popf
pushf
not eax
add eax, 0x9fce9f37
xor eax, 0xd3332ab6
rol eax, 0x32
popf
jmp 0x140202941
movabs r10, 0xc37ef968306c9231
pushf
not r10
add r10, 0x5df8bc00
xor r10, 0x68408738
rol r10, 0x6a
popf
pushf
not r10
add r10, 0x75a902e1
xor r10, 0x46dcc31e
rol r10, 0xdc
popf
mov r9d, ebx
mov r8, rdi
mov edx, esi
mov rcx, rbp
jmp 0x140202b09
call qword [0x14006e5c8]
jmp 0x140202b72
xor edx, edx
mov rcx, rbp
call fcn.14022689c
mov ecx, eax
mov r9d, ebx
mov r8, rdi
mov edx, esi
jmp 0x140202b26
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push rax
pushf
mov eax, 0x90cde471
pushf
not eax
add eax, 0x83b27c93
xor eax, 0xb34a771e
rol eax, 0xd5
popf
pushf
not eax
add eax, 0xf9aa3929
xor eax, 0x8ae87d39
rol eax, 0xbe
popf
pushf
not eax
add eax, 0xa4281837
xor eax, 0xcd5d789a
rol eax, 0xc4
popf
jmp 0x140202941
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14026c14e
Capabilities:
Manually build aes constants

Disassembly:
push rax
pushf
mov eax, 0xcec1bd10
pushf
not eax
add eax, 0xa7c2ed24
xor eax, 0xc1b8aef6
rol eax, 0x1b
popf
pushf
not eax
add eax, 0xc3b22579
xor eax, 0x83f0d42b
rol eax, 0x63
popf
pushf
not eax
add eax, 0xafebcd13
xor eax, 0xe70767c2
rol eax, 0xcc
popf
cmp eax, 2
jne 0x14026c19e
popf
pop rax
jmp 0x14026c31c
cmp eax, 0
jne 0x14026c1ad
popf
pop rax
jmp 0x14026c1bc
cmp eax, 1
jne 0x14026c1bc
popf
pop rax
jmp 0x14026c2d6
sub rsp, 0x28
mov ecx, 0x86b0810b
pushf
not ecx
add ecx, 0xd2a9feed
xor ecx, 0x9caa4be8
rol ecx, 0x53
popf
pushf
not ecx
add ecx, 0x84765d33
xor ecx, 0xae00f42b
rol ecx, 0x93
popf
pushf
not ecx
add ecx, 0x8fb4f390
xor ecx, 0xa9868969
rol ecx, 0x79
popf
pushf
not ecx
add ecx, 0xffc3f10d
xor ecx, 0x86d961b6
rol ecx, 0xb2
popf
jmp 0x14026c21a
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x14026c27d
push rax
pushf
mov eax, 0xa34856a6
pushf
not eax
add eax, 0x9528add5
xor eax, 0xfb4bcf48
rol eax, 0xf0
popf
pushf
not eax
add eax, 0xd0dea6fe
xor eax, 0x919052d6
rol eax, 0x92
popf
pushf
not eax
add eax, 0xad183c24
xor eax, 0xf3dd4a7e
rol eax, 0xd0
popf
pushf
not eax
add eax, 0x9c6ffb0c
xor eax, 0xbc717a33
rol eax, 0xc8
popf
jmp 0x14026c18f
push rax
pushf
mov eax, 0xd76041c2
pushf
not eax
add eax, 0xfcdbff6d
xor eax, 0xac8041a4
rol eax, 0x8e
popf
pushf
not eax
add eax, 0xe804c84a
xor eax, 0xbe01eb47
rol eax, 0x32
popf
pushf
not eax
add eax, 0x859baa6b
xor eax, 0xf3436137
rol eax, 0x7f
popf
pushf
not eax
add eax, 0xed3123b0
xor eax, 0x911c8e07
rol eax, 0xb8
popf
jmp 0x14026c18f
mov ecx, 0x6d2e5db3
pushf
not ecx
add ecx, 0xffcdea5a
xor ecx, 0x9e41bdc2
rol ecx, 0xe9
popf
pushf
not ecx
add ecx, 0xa04ecdee
xor ecx, 0xde697315
rol ecx, 0x47
popf
pushf
not ecx
add ecx, 0xbb6aca07
xor ecx, 0xf8af6828
rol ecx, 0x9a
popf
int 0x29
mov r8d, 0xd1e682eb
pushf
not r8d
add r8d, 0xebde117c
xor r8d, 0xfc1044cb
rol r8d, 0x66
popf
pushf
not r8d
add r8d, 0x8b26c1f1
xor r8d, 0xb9de85fd
rol r8d, 0x63
popf
pushf
not r8d
add r8d, 0x93795daf
xor r8d, 0xcd57455b
rol r8d, 0x57
popf
pushf
not r8d
add r8d, 0xb65d7f53
xor r8d, 0xb50cc502
rol r8d, 0x8c
popf
mov edx, 0x8669283
pushf
not edx
add edx, 0xd79b7e95
xor edx, 0xf221ee58
rol edx, 0x88
popf
pushf
not edx
add edx, 0xba56190b
xor edx, 0xa54390cd
rol edx, 0x16
popf
lea ecx, [r8 + 1]
call fcn.140230c19
jmp 0x14026c3bf
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xd0292e8e
pushf
not edx
add edx, 0xc119473d
xor edx, 0xcab2ef8e
rol edx, 0xbd
popf
pushf
not edx
add edx, 0xd17c0fcf
xor edx, 0x9e215e0d
rol edx, 0x76
popf
pushf
not edx
add edx, 0x913c76c7
xor edx, 0xd7260e0b
rol edx, 0xd4
popf
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1403011f1
Capabilities:
Delete file

Disassembly:
push rax
pushf
mov eax, 0xf9a1f777
pushf
not eax
add eax, 0xd8ea4c2d
xor eax, 0xc4b7ce98
rol eax, 0x7e
popf
pushf
not eax
add eax, 0xfae9419b
xor eax, 0xb31fc0ec
rol eax, 0x9a
popf
pushf
not eax
add eax, 0x85bf5f5a
xor eax, 0x836059ac
rol eax, 0x27
popf
pushf
not eax
add eax, 0xfcce01ee
xor eax, 0x8edf5eb0
rol eax, 0x96
popf
cmp eax, 2
jne 0x140301254
popf
pop rax
jmp 0x140301342
cmp eax, 0
jne 0x140301263
popf
pop rax
jmp 0x140301281
cmp eax, 3
jne 0x140301272
popf
pop rax
jmp 0x14030138a
cmp eax, 1
jne 0x140301281
popf
pop rax
jmp 0x140301330
sub rsp, 0x28
jmp 0x140301286
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1403012e9
push rax
pushf
mov eax, 0x17a86103
pushf
not eax
add eax, 0xd466f0d8
xor eax, 0xfadcd271
rol eax, 0xfe
popf
pushf
not eax
add eax, 0xb8676b47
xor eax, 0xed0937ce
rol eax, 0x18
popf
pushf
not eax
add eax, 0xc583afd3
xor eax, 0x9a70e9c0
rol eax, 0xee
popf
pushf
not eax
add eax, 0xa074aa6b
xor eax, 0xdcf91f89
rol eax, 0xcc
popf
jmp 0x140301245
push rax
pushf
mov eax, 0xbf5267d2
pushf
not eax
add eax, 0x8c3b04c7
xor eax, 0x89bd402f
rol eax, 0x59
popf
pushf
not eax
add eax, 0xb2ed4985
xor eax, 0xd76d25d6
rol eax, 0xe4
popf
pushf
not eax
add eax, 0x9ba8c8dc
xor eax, 0xeaaf4709
rol eax, 0x10
popf
jmp 0x140301245
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140202b87
or eax, 0xffffffff
jmp 0x14030138a
xor eax, eax
push rax
pushf
mov eax, 0x73476369
pushf
not eax
add eax, 0xc29ca84b
xor eax, 0xb51db570
rol eax, 0xc6
popf
pushf
not eax
add eax, 0xcfb47c81
xor eax, 0x955c6b95
rol eax, 6
popf
pushf
not eax
add eax, 0xe65d6281
xor eax, 0xdd207c96
rol eax, 0x2b
popf
jmp 0x140301245
add rsp, 0x28
ret
Function at 0x14038d239
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword gs:[0x60]
xor r11d, r11d
mov rsi, r8
mov ebp, edx
mov rdi, qword [rax + 0x10]
movsxd rbx, dword [rdi + 0x3c]
add rbx, rdi
movzx eax, word [rbx + 0x14]
lea r9, [rbx + 0x18]
movzx r10d, word [rbx + 6]
add r9, rax
test r10, r10
je 0x14038d2f8
mov dword [rsp + 0x20], 0x6544302e
mov byte [rsp + 0x24], 0x76
movups xmm2, xmmword [r9]
lea rcx, [rsp + 0x20]
movups xmm0, xmmword [r9 + 0x10]
movsd xmm1, qword [r9 + 0x20]
movd edx, xmm2
movups xmmword [rsp + 0x28], xmm2
movsd qword [rsp + 0x48], xmm1
movups xmmword [rsp + 0x38], xmm0
test dl, dl
je 0x14038d2e0
lea rax, [rsp + 0x20]
lea r8, [rsp + 0x28]
sub r8, rax
movzx eax, dl
nop
movzx edx, al
cmp al, byte [rcx]
jne 0x14038d2e0
movzx eax, byte [r8 + rcx + 1]
inc rcx
movzx edx, al
test al, al
jne 0x14038d2c9
cmp dl, byte [rcx]
lea rdx, [rsp + 0x28]
cmovne rdx, r11
add r9, 0x28
mov r11, rdx
sub r10, 1
jne 0x14038d28b
mov eax, dword [r11 + 0xc]
mov rdx, rsi
mov ecx, dword [rbx + 8]
mov eax, dword [rax + rdi]
xor eax, dword [rbx + 0x68]
ror eax, cl
mov ecx, ebp
add rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
jmp rax