joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002c40
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x140005510]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140002c60
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140002c68
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140002c60
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x140002cb0
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140002ca7
test rcx, rcx
je 0x140002c60
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x140002c98
xor eax, eax
ret

Function at 0x140002cc0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140005510]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140002cdf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002ce8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140002d00
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140005510]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002d20
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002d28
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002d20
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x140002d20
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140002d74
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140002d80
add rdx, 0x28
cmp r9, rdx
jne 0x140002d60
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140002d90
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x140005510]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002db2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002dc0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002db2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002db2
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x140002db2
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x140002e15
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140002e28
add rdx, 0x28
cmp rdx, r10
jne 0x140002e00
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140002e37
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140002e47
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140002e1e
test ecx, ecx
jg 0x140002e30
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0xb7b058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00b7b1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0xb7b089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xb7b06f
add dl, dl
jne 0xb7b096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xb7b0f6
xor eax, eax
add dl, dl
jne 0xb7b0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0xb7b1ad
add dl, dl
jne 0xb7b0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb7b0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb7b0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb7b0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0xb7b0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0xb7b07e
mov eax, 1
add dl, dl
jne 0xb7b106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xb7b113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xb7b0fb
sub eax, ebx
mov ebx, 1
jne 0xb7b14c
mov ecx, 1
add dl, dl
jne 0xb7b12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb7b13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xb7b123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xb7b07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xb7b168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xb7b175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0xb7b15d
cmp eax, 0x7d00
jae 0xb7b19b
cmp eax, 0x500
jb 0xb7b196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xb7b07e
cmp eax, 0x7f
ja 0xb7b19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0xb7b07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0xb7b1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0xb7b07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140110d20
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10090
call fcn.1401155e0
sub rsp, rax
mov rax, qword [0x140158ec0]
xor rax, rsp
mov qword [rsp + 0x10080], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x80], bp
mov edi, 0x28
mov word [rsp + 0x30], bp
test al, al
je 0x140110de2
nop dword [rax]
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.1401245b4
cmp rax, 1
jne 0x140110e3e
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x140110dbf
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140110db3
cmp rcx, 1
jb 0x140110e3e
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140110d80
mov r8d, 0x10000
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0xffff
ja 0x140110e13
lea rcx, [rsp + 0x80]
call fcn.140127030
jmp 0x140110e15
xor eax, eax
mov rcx, qword [rsp + 0x10080]
xor rcx, rsp
call fcn.140115310
lea r11, [rsp + 0x10090]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140118ad0
int3
Function at 0x140111c90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp byte [0x14016334e], 0
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
jne 0x140111d15
mov edx, 3
xor ecx, ecx
mov r8d, 0xa
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [0x1401631a0], rax
xor ecx, ecx
mov ebx, dword [rax]
lea rdx, [rax + 4]
mov qword [0x1401631a0], rdx
mov r8d, dword [rdx]
add rdx, 4
mov qword [0x1401631a0], rdx
call fcn.14010fbe0
cmp eax, ebx
jne 0x140111e7d
mov byte [0x14016334e], 1
lea rdx, [0x140135d68]
mov rcx, rsi
call fcn.140124060
test eax, eax
je 0x140111da0
cmp byte [0x14016334d], 1
je 0x140111da0
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1401640a0], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1401640a8], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1401640b0], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1401640b8], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1401640c0], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1401640c8], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1401640d0], rax
call qword [sym.imp.python311.dll_PyDict_New]
mov qword [0x1401640d8], rax
mov byte [0x14016334d], 1
mov r8, qword [0x1401631a0]
mov rax, rsi
mov rdx, r8
sub rdx, rsi
movzx ecx, byte [rax]
xor r9d, r9d
cmp cl, byte [rax + rdx]
jne 0x140111dc7
inc rax
test cl, cl
jne 0x140111db0
mov ecx, r9d
jmp 0x140111dcc
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
cmp byte [r8 + rax + 1], r9b
lea rax, [rax + 1]
jne 0x140111dd3
lea rdx, [r8 + rax]
mov eax, dword [r8 + rax + 1]
add rdx, 5
test ecx, ecx
je 0x140111e38
nop
add rdx, rax
mov rax, rsi
mov r8, rdx
sub r8, rsi
nop dword [rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + r8]
jne 0x140111e15
inc rax
test cl, cl
jne 0x140111e00
mov ecx, r9d
jmp 0x140111e1a
sbb ecx, ecx
or ecx, 1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdx + rax], r9b
jne 0x140111e21
add rdx, rax
mov eax, dword [rdx + 1]
add rdx, 5
test ecx, ecx
jne 0x140111df0
movzx ecx, word [rdx]
lea rax, [rdx + 2]
cmp r9w, cx
jae 0x140111e68
mov ebx, ecx
nop word [rax + rax]
mov r8, rax
mov rdx, rdi
mov rcx, rbp
call fcn.14010e1b0
add rdi, 8
sub rbx, 1
jne 0x140111e50
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
lea rcx, str.Error__corrupted_constants_object
call fcn.140120d74
call fcn.140118ad0
int3
Function at 0x140114ec0
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x140158ec0]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor r14d, r14d
mov rbp, rdx
mov word [rsp + 0x30], r14w
mov rsi, rcx
mov edi, 0x28
test al, al
je 0x140114f71
nop word [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], r14b
lea rcx, [rsp + 0x24]
call fcn.1401245b4
cmp rax, 1
jne 0x140114fa7
mov rcx, rdi
mov rax, rbx
cmp word [rbx], r14w
je 0x140114f4d
add rax, 2
dec rcx
cmp word [rax], r14w
jne 0x140114f40
cmp rcx, 1
jb 0x140114fa7
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], r14w
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x140114f10
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140115310
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.140118ad0
int3

Function at 0x140115190
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140158ec0]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
lea rbx, [rsp + 0x30]
xor ebp, ebp
mov rsi, rcx
mov word [rsp + 0x30], bp
mov edi, 0x28
test al, al
je 0x14011523f
nop dword [rax]
nop dword [rax + rax]
mov r8d, 2
mov byte [rsp + 0x20], al
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x21], bpl
lea rcx, [rsp + 0x24]
call fcn.1401245b4
cmp rax, 1
jne 0x140115275
mov rcx, rdi
mov rax, rbx
cmp word [rbx], bp
je 0x14011521c
nop
add rax, 2
dec rcx
cmp word [rax], bp
jne 0x140115210
cmp rcx, 1
jb 0x140115275
movzx ecx, word [rsp + 0x24]
inc rsi
mov word [rax], cx
add rbx, 2
mov word [rax + 2], bp
dec rdi
movzx eax, byte [rsi]
test al, al
jne 0x1401151e0
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140115310
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.140118ad0
int3

Function at 0x140115d78
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140115dc2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140115dc2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140115dc2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140115dc2
cmp dword [rcx + 0x84], 0xe
jbe 0x140115dc2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140115dc4
xor al, al
add rsp, 0x28
ret
Function at 0x14011a144
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14011a1b3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14011a1b3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14011a1b3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14011a1b3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14011a1b3
cmp dword [rcx + 0x84], 0xe
jbe 0x14011a1b3
cmp dword [rcx + 0xf8], 0
je 0x14011a1b3
mov ecx, ebx
call fcn.14011a264
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14011a040
nop
cmp dword [rbp + 0x20], 0
je 0x14011a201
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14011a20c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14011a144

Function at 0x14011a348
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14011a1b3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14011a1b3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14011a1b3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14011a1b3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14011a1b3
cmp dword [rcx + 0x84], 0xe
jbe 0x14011a1b3
cmp dword [rcx + 0xf8], 0
je 0x14011a1b3
mov ecx, ebx
call fcn.14011a264
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14011a040
nop
cmp dword [rbp + 0x20], 0
je 0x14011a201
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14011a20c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14011a144
Function at 0x14012bea0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14012bf27
mov rsi, rbx
cmp word [rax], bp
je 0x14012bee6
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14012bed0
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14012becc
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140127508
mov rdi, rax
test rax, rax
je 0x14012bf14
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140131b60
mov rbp, rdi
xor ecx, ecx
call fcn.140128050
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14012e1d0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14012e1e6
mov al, 1
jmp 0x14012e246
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14012e1f7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14012e244
mov ecx, dword [rcx + 0x18]
nop
call fcn.14012c1e8
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14012e244
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14012e244
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14012e244
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14012e246
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1401319b0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1401319d8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1401319d8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140018d5e
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rsi
mov rdi, rdi
push rdi
neg rsp
sub rsp, 0xffffffffffffffa0
neg rsp
lea rax, [rcx + 8]
xchg r8, rbx
mov qword [rsp + 0x70], r8
xchg rbx, r8
mov qword [rcx], rax
mov dword [rsp - 0x30], 0x2f7e82bb
xorps xmm0, xmm0
xchg rbp, rax
movups xmmword [rbp], xmm0
xchg rbp, rax
mov rsi, rcx
mov qword [rsp + 0x78], rbp
xchg rbx, rax
movups xmmword [rbx + 0x10], xmm0
xchg rbx, rax
lea rcx, [rsp + 0x20]
mov r9, r9
movups xmmword [rax + 0x20], xmm0
xchg r13, rax
movups xmmword [r13 + 0x30], xmm0
xchg r13, rax
xchg rbx, rax
movups xmmword [rbx + 0x40], xmm0
xchg rbx, rax
xchg r8, rax
movups xmmword [r8 + 0x50], xmm0
xchg r8, rax
xchg rdi, rax
movups xmmword [rdi + 0x60], xmm0
xchg rdi, rax
xchg r12, rax
movups xmmword [r12 + 0x70], xmm0
xchg r12, rax
xchg r14, rbp
mov r14, qword [rdx + 0x38]
xchg r14, rbp
lea rax, [rsp + 0x28]
mov dword [rsp - 0x18], ebx
xchg r12, rbx
mov r12, qword [rdx]
xchg rbx, r12
xchg r14, rax
mov qword [rsp + 0x20], r14
xchg r14, rax
xchg rbp, rsp
movups xmmword [rbp + 0x28], xmm0
xchg rsp, rbp
lea rdx, [rbp + 1]
mov dword [rsp - 0x28], edx
xchg r14, rsp
movups xmmword [r14 + 0x38], xmm0
xchg r14, rsp
xchg r12, rsp
movups xmmword [r12 + 0x48], xmm0
xchg rsp, r12
call fcn.14000ef40
mov dword [rsp - 0x38], 0x322e47cc
mov edx, 0x46f86d5e
xor edx, 0xb38bd81
xor edx, 0x65fba03c
add edx, 0x446b2a09
sub edx, 0xfea4aaa
test rbp, rbp
mov dword [rsp - 0x30], 0x536ff59b
je 0x140018ec0
xchg r10, rax
mov rdi, r10
xchg r10, rax
sub rbx, rax
mov r9, rbp
mov dword [rsp - 0x10], esp
mov r8d, 0x3200462b
add r8d, 0x165ae0c0
sub r8d, 0x32ef54b1
sub r8d, 0x156bd13b
nop word [rax + rax]
mov dword [rsp - 0x28], 0x4c9e17c4
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r8w
ror edx, 2
ror edx, 5
ror edx, 1
xor cx, word [rdi + rbx - 2]
mov word [rdi - 2], cx
sub r9, 1
mov dword [rsp - 0x40], esi
jne 0x140018e96
xor ecx, ecx
mov r8, rbp
mov word [rax + rbp*2], cx
mov r12, r12
xchg rsi, rcx
mov rsi, rcx
xchg rcx, rsi
xchg rdx, r15
mov r15, qword [rsp + 0x20]
xchg rdx, r15
call fcn.140072df0
mov rcx, qword [rsp + 0x20]
xchg rbp, rbp
lea rax, [rsp + 0x28]
xchg rbp, rbx
mov rbx, qword [rsp + 0x78]
xchg rbp, rbx
xchg rbx, r8
mov r8, qword [rsp + 0x70]
xchg r8, rbx
cmp rcx, rax
jne 0x140018f68
xchg r10, r10
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x306e9abb
xor ecx, 0x79a7acae
add ecx, 0x182d153a
xor ecx, 0xfe01d28
sub ecx, 0x6e165637
rep stosb byte [rdi], al
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
xchg r14, rsi
mov r14, qword [rsp + 0x80]
xchg rsi, r14
nop
sub rsp, 0x16620da8
add rsp, 0x16620e08
pop rdi
mov dword [rsp - 0x1c], 0x6816b50d
ret
call fcn.140098180
xchg rsi, r14
mov rax, r14
xchg rsi, r14
mov rsi, qword [rsp + 0x80]
nop
sub rsp, 0x422c6f7b
add rsp, 0x422c6fdb
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140030f60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
neg rsp
sub rsp, 0xffffffffffffffd0
neg rsp
lea rsi, [rcx + 0x298]
xorps xmm0, xmm0
lea rax, [0x140001a98]
mov r14, rdx
mov qword [rcx], rax
mov rdi, rcx
mov dword [rcx + 8], 0x5a5fe2ce
add dword [rcx + 8], 0xd095800
sub dword [rcx + 8], 0x67693acd
lea rax, [rsi + 8]
mov qword [rsi], rax
xor ebp, ebp
mov qword [rcx + 0x290], rbp
mov rbx, r8
movups xmmword [rax], xmm0
mov rcx, rsi
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rdx, qword [r8 + 0x38]
mov qword [rsi + 0x38], rdx
call fcn.14000ef40
mov r8d, ebp
cmp qword [rsi + 0x38], rbp
jbe 0x140031002
nop word [rax + rax]
mov rcx, qword [rbx]
movzx edx, word [rcx + r8*2]
mov word [rax + r8*2], dx
inc r8
cmp r8, qword [rsi + 0x38]
jb 0x140030fe8
mov ecx, dword [rbx + 0x40]
mov esi, 0x719bccf3
sub esi, 0x1839a97c
sub esi, 0x59612378
mov qword [rdi + 0x2e0], rbp
bts ecx, 0xe
mov dword [rdi + 0x2d8], ecx
mov edx, 0x2077e78d
add edx, 0x36fc1727
add edx, 0x1573f7f8
sub edx, 0x6ce7f69c
mov eax, dword [rbx + 0x54]
xor eax, 0x32241201
mov dword [rdi + 0x2e8], eax
mov eax, dword [rbx + 0x58]
xor eax, 0x32241201
mov dword [rdi + 0x2ec], eax
mov eax, dword [rbx + 0x44]
xor eax, 0x32241201
mov dword [rdi + 0x2f0], eax
mov eax, dword [rbx + 0x48]
xor eax, 0x32241201
mov dword [rdi + 0x2f4], eax
mov rax, qword [rbx + 0x60]
mov qword [rdi + 0x2f8], rax
mov eax, dword [rbx + 0x4c]
xor eax, 0x63cf5cc6
mov dword [rdi + 0x308], eax
mov eax, dword [rbx + 0x50]
xor eax, 0x32241201
mov word [rdi + 0x310], bp
bt ecx, 0xd
mov dword [rdi + 0x30c], eax
pushf
mov eax, 0x7a9376e6
sub eax, 0x49992a03
add eax, 0x4d93ce6e
sub eax, 0x7e8e1a52
popf
mov qword [rdi + 0x318], r14
cmovb esi, eax
mov ecx, esi
shl rcx, 4
call fcn.140098080
mov rcx, rax
mov edx, esi
nop dword [rax]
movaps xmm0, xmmword [0x1404a6590]
movups xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
sub rdx, 1
jne 0x1400310dd
mov qword [rdi + 0x300], rax
mov rdx, rbp
nop
mov rax, qword [rbx + 0x68]
lea rdx, [rdx + 0x10]
inc rbp
mov ecx, dword [rdx + rax - 0x10]
xor ecx, 0x63cf5cc6
mov dword [rsp + 0x50], ecx
movss xmm3, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
shufps xmm3, xmm3, 0xe1
mov ecx, dword [rdx + rax - 0xc]
xor ecx, 0x63cf5cc6
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
movss xmm3, xmm0
shufps xmm3, xmm3, 0xc6
mov ecx, dword [rdx + rax - 8]
xor ecx, 0x63cf5cc6
mov dword [rsp + 0x50], ecx
movss xmm1, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
movss xmm3, xmm1
shufps xmm3, xmm3, 0x27
mov ecx, dword [rdx + rax - 4]
xor ecx, 0x63cf5cc6
mov dword [rsp + 0x50], ecx
movss xmm2, dword [rsp + 0x50]
mov rax, qword [rdi + 0x300]
movss xmm3, xmm2
shufps xmm3, xmm3, 0x39
xorps xmm3, xmmword [0x1404a6590]
movups xmmword [rdx + rax - 0x10], xmm3
cmp rbp, rsi
jl 0x140031101
lea rcx, [r14 + 0xa8]
mov qword [rsp + 0x50], rdi
lea rdx, [rsp + 0x50]
call fcn.140012330
mov rbx, qword [rsp + 0x58]
mov rax, rdi
mov rbp, qword [rsp + 0x60]
nop
sub rsp, 0x64942169
add rsp, 0x64942199
pop r14
pop rdi
pop rsi
ret