joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14018d14c
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
cmp qword [r8], 0
mov esi, r9d
mov r14, r8
mov r15b, dl
mov rdi, rcx
je 0x14018d2bd
test r9d, r9d
je 0x14018d2bd
mov rbx, qword [rcx + 0x10]
test rbx, rbx
jne 0x14018d215
cmp dword [rcx + 8], 2
jne 0x14018d239
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0xd0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
je 0x14018d1f9
xor edx, edx
mov r8d, 0xd0
mov rcx, rax
call sub.msvcrt.dll_memset
and qword [rbx + 0x90], 0
xor eax, eax
and qword [rbx + 0x98], 0
mov qword [rbx + 0xb0], rax
and qword [rbx + 0xb8], rax
and dword [rbx + 0x58], eax
and dword [rbx + 0x38], eax
mov qword [rbx], rdi
mov dword [rbx + 8], 1
jmp 0x14018d1fb
xor ebx, ebx
mov qword [rdi + 0x10], rbx
test rbx, rbx
jne 0x14018d215
mov ebx, 0x8007000e
mov ecx, ebx
call fcn.140079c40
jmp 0x14018d2cd
mov rcx, rbx
call fcn.140199fe4
mov ebx, eax
test eax, eax
jns 0x14018d22a
mov ecx, eax
call fcn.140079c40
mov ecx, ebx
call fcn.140079c60
test ebx, ebx
js 0x14018d2c2
mov ecx, dword [rdi + 4]
sub ecx, 1
je 0x14018d269
cmp ecx, 1
je 0x14018d24d
mov ebx, 0xc004d203
jmp 0x14018d2c2
movaps xmm0, xmmword [r14]
lea rdx, [rbp - 0x20]
mov r8d, esi
movdqa xmmword [rbp - 0x20], xmm0
mov rcx, rdi
call fcn.140195f38
mov ebx, eax
jmp 0x14018d2b4
movaps xmm0, xmmword [r14]
lea rax, [0x14002c658]
mov qword [rbp - 0x50], rax
lea rdx, [rbp - 0x58]
xor r9d, r9d
movdqa xmmword [rbp - 0x10], xmm0
lea rax, [rbp - 0x60]
mov qword [rbp - 0x58], 3
mov qword [rbp - 0x48], rax
mov ecx, 0xb9
lea rax, [rbp - 0x10]
mov qword [rbp - 0x40], rdi
lea r8d, [r9 + 0x2c]
mov qword [rbp - 0x38], rax
mov dword [rbp - 0x30], esi
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp - 0x60]
test ebx, ebx
js 0x14018d2c2
mov byte [rdi], 1
jmp 0x14018d2c9
mov ebx, 0x80070057
mov ecx, ebx
call fcn.140079c40
test ebx, ebx
jns 0x14018d2d0
mov byte [rdi], 0
mov ecx, ebx
call fcn.140079c60
mov eax, ebx
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14018d2f8
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [rbp + 0x77]
mov r10d, r9d
movaps xmm1, xmmword [r8]
mov r9, rcx
mov rcx, qword [rcx + 0x10]
movaps xmm0, xmmword [rax]
test rcx, rcx
je 0x14018d390
mov rax, qword [rbp + 0x7f]
test dl, dl
je 0x14018d35c
lea r9, [rbp - 0x19]
movdqa xmmword [rbp - 0x19], xmm0
mov r8d, r10d
movdqa xmmword [rbp - 9], xmm1
lea rdx, [rbp - 9]
mov qword [rsp + 0x20], rax
call fcn.14019a0ec
mov ebx, eax
test eax, eax
jns 0x14018d402
mov ecx, eax
jmp 0x14018d3fd
movdqa xmmword [rbp - 9], xmm0
movdqa xmmword [rbp - 0x19], xmm1
test rax, rax
jne 0x14018d375
mov ebx, 0x80070057
jmp 0x14018d3fb
lea r9, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r8d, r10d
lea rdx, [rbp - 0x19]
call fcn.14019a7f8
mov ebx, eax
test eax, eax
jmp 0x14018d3f9
lea rax, [0x14002bc98]
mov qword [rbp + 0x1f], r9
mov qword [rbp + 0xf], rax
xor r9d, r9d
lea rax, [rbp + 0x57]
movdqa xmmword [rbp - 0x19], xmm0
mov qword [rbp + 0x17], rax
movzx eax, dl
lea rdx, [rbp + 7]
inc eax
movdqa xmmword [rbp - 9], xmm1
shl eax, 6
lea r8d, [r9 + 0x40]
mov dword [rbp + 0x27], eax
lea ecx, [r8 + 0x79]
lea rax, [rbp - 9]
mov qword [rbp + 7], 3
mov qword [rbp + 0x2b], rax
lea rax, [rbp - 0x19]
mov qword [rbp + 0x37], rax
mov rax, qword [rbp + 0x7f]
mov qword [rbp + 0x3f], rax
mov dword [rbp + 0x33], r10d
call sub.ntdll.dll_NtQuerySystemInformation
mov ebx, dword [rbp + 0x57]
test ebx, ebx
jns 0x14018d402
mov ecx, ebx
call fcn.140079c40
mov ecx, ebx
call fcn.140079c60
mov eax, ebx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rbp
ret
Function at 0x14018ebb8
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
mov rcx, rdx
call fcn.14018eb68
test eax, eax
js 0x14018ec46
movzx eax, word [rdi + 6]
mov word [rbx], ax
mov qword [rbx + 0x10], rsi
lea rcx, [rbx + 0x18]
mov r9d, esi
mov r8, rdi
xor edx, edx
call fcn.14018eefc
test eax, eax
js 0x14018ec46
mov qword [rsp + 0x20], 3
lea rax, [0x140029258]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rdi
xor r9d, r9d
lea r8d, [r9 + 0x28]
lea rdx, [rsp + 0x20]
mov ecx, 0xb9
call sub.ntdll.dll_NtQuerySystemInformation
mov eax, dword [rsp + 0x78]
jmp 0x14018ec46
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1401b39d0
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
and qword [rax + 8], 0
mov rbp, rcx
mov rax, qword gs:[0x58]
mov r15, r9
mov ecx, 4
mov r12, r8
mov r14, rdx
mov r10, qword [rax]
mov eax, dword [rcx + r10]
cmp dword [0x140440b28], eax
jg 0x1401b3b2a
mov rsi, qword [rbp + 0x18]
xor edi, edi
cmp dword [0x140440d60], 1
cmove rdi, qword [0x140440260]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rsp + 0x90]
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
test eax, eax
js 0x1401b3ac2
mov rax, qword [rsp + 0x90]
lea r9, [0x140440b30]
and qword [rsp + 0x30], 0
mov r8, r15
mov qword [rsp + 0x28], rax
mov rdx, r12
mov rcx, rbp
mov dword [rsp + 0x20], 1
call fcn.1401b519c
mov ebx, eax
test eax, eax
js 0x1401b3ac2
mov rax, qword [r14]
mov rbx, qword [rax + 0xa8]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rdx, qword [rsp + 0x90]
mov rax, rbx
xor r8d, r8d
mov rcx, r14
call rax
mov ebx, eax
test eax, eax
jns 0x1401b3ac9
mov ecx, eax
call fcn.140079c40
mov ecx, ebx
call fcn.140079c60
and qword [rsp + 0x50], 0
lea rax, [0x140006698]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], 3
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
lea rcx, [0x140440b28]
call fcn.14037adcc
cmp dword [0x140440b28], 0xffffffff
jne 0x1401b3a19
and qword [0x140440b38], 0
lea rax, str.metaInfoType
and dword [0x140440b40], 0
lea rcx, [0x140440b28]
or dword [0x140440b44], 0xffffffff
mov qword [0x140440b30], rax
call fcn.14037ad5c
jmp 0x1401b3a19
Function at 0x1401b3b80
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
and qword [rax + 8], 0
mov rbp, rcx
mov rax, qword gs:[0x58]
mov r15, r9
mov ecx, 4
mov r12, r8
mov r14, rdx
mov r10, qword [rax]
mov eax, dword [rcx + r10]
cmp dword [0x140440b48], eax
jg 0x1401b3cda
mov rsi, qword [rbp + 0x18]
xor edi, edi
cmp dword [0x140440d60], 1
cmove rdi, qword [0x140440248]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x178]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rsp + 0x90]
mov rdx, rdi
mov rcx, rsi
call rax
mov ebx, eax
test eax, eax
js 0x1401b3c72
mov rax, qword [rsp + 0x90]
lea r9, [0x140440b50]
and qword [rsp + 0x30], 0
mov r8, r15
mov qword [rsp + 0x28], rax
mov rdx, r12
mov rcx, rbp
mov dword [rsp + 0x20], 2
call fcn.1401b519c
mov ebx, eax
test eax, eax
js 0x1401b3c72
mov rax, qword [r14]
mov rbx, qword [rax + 0xa8]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rdx, qword [rsp + 0x90]
mov rax, rbx
xor r8d, r8d
mov rcx, r14
call rax
mov ebx, eax
test eax, eax
jns 0x1401b3c79
mov ecx, eax
call fcn.140079c40
mov ecx, ebx
call fcn.140079c60
and qword [rsp + 0x50], 0
lea rax, [0x140006698]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], 3
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x58], rax
mov ecx, 0xb9
lea r8d, [r9 + 0x20]
call sub.ntdll.dll_NtQuerySystemInformation
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
lea rcx, [0x140440b48]
call fcn.14037adcc
cmp dword [0x140440b48], 0xffffffff
jne 0x1401b3bc9
and qword [0x140440b58], 0
lea rax, str.metaInfoType
and dword [0x140440b60], 0
lea rcx, [0x140440b48]
or dword [0x140440b64], 0xffffffff
xorps xmm0, xmm0
mov qword [0x140440b50], rax
xor eax, eax
mov qword [0x140440b78], rax
lea rax, str.windowsComponentLicenseFileName
and dword [0x140440b78], 0
movups xmmword [0x140440b68], xmm0
mov qword [0x140440b68], rax
lea rax, str.path
mov qword [0x140440b70], rax
mov dword [0x140440b7c], 1
call fcn.14037ad5c
jmp 0x1401b3bc9
Function at 0x1402fb9a4
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov r14, qword [rbp + 0x77]
mov r12, r9
and qword [rbp - 0x21], 0
mov r15d, r8d
and dword [rbp + 0x67], 0
mov rdi, rdx
and dword [rbp - 0x39], 0
mov rsi, rcx
cmp dword [r14], r8d
jae 0x1402fb9ee
mov edi, 0x80049e19
jmp 0x1402fbb64
mov rax, qword [rdx]
and qword [rbp - 0x31], 0
and qword [rbp - 0x29], 0
and qword [rbp - 0x19], 0
mov rbx, qword [rax]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rax, rbx
lea r8, [rbp - 0x29]
lea rdx, [0x140412068]
mov rcx, rdi
call rax
test eax, eax
je 0x1402fba30
mov edi, 0x80049e2f
jmp 0x1402fbabe
mov rdi, qword [rbp - 0x29]
mov rax, qword [rdi]
mov rbx, qword [rax + 0x30]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rax, rbx
lea rdx, [rbp - 0x31]
mov rcx, rdi
call rax
mov edi, eax
test eax, eax
js 0x1402fbabe
mov rdx, qword [rbp - 0x31]
lea r8, [rbp - 0x19]
mov rcx, rsi
call fcn.1402fb0d8
mov edi, eax
test eax, eax
js 0x1402fbabe
lea rax, [0x14003b6d8]
mov qword [rbp - 0x11], 3
mov qword [rbp - 9], rax
lea rdx, [rbp - 0x11]
lea rax, [rbp + 0x77]
mov qword [rbp + 7], rsi
mov qword [rbp - 1], rax
xor r9d, r9d
mov rax, qword [rbp - 0x29]
mov ecx, 0xb9
mov qword [rbp + 0xf], rax
mov rax, qword [rbp - 0x19]
mov qword [rbp + 0x17], rax
lea r8d, [r9 + 0x38]
lea rax, [rbp - 0x21]
mov qword [rbp + 0x1f], rax
call sub.ntdll.dll_NtQuerySystemInformation
mov edi, dword [rbp + 0x77]
mov rsi, qword [rbp - 0x31]
test rsi, rsi
je 0x1402fbae7
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rax, rbx
mov rcx, rsi
call rax
and qword [rbp - 0x31], 0
mov rsi, qword [rbp - 0x29]
test rsi, rsi
je 0x1402fbb0b
mov rax, qword [rsi]
mov rbx, qword [rax + 0x10]
mov rax, qword [0x1403c1610]
mov rcx, rbx
call rax
mov rax, rbx
mov rcx, rsi
call rax
test edi, edi
js 0x1402fbb64
mov eax, dword [r14]
mov r8d, r15d
mov r9, qword [rbp + 0x7f]
mov rdx, r12
mov rcx, qword [rbp - 0x21]
mov dword [rbp + 0x67], eax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
call fcn.1401661ac
mov edi, eax
test eax, eax
js 0x1402fbb64
mov eax, dword [r14]
lea r9, [rbp - 0x39]
mov r8d, dword [rbp + 0x67]
sub eax, r8d
mov rdx, qword [rbp + 0x7f]
mov rcx, qword [rbp - 0x21]
mov dword [rbp - 0x39], eax
call fcn.140166514
mov edi, eax
test eax, eax
js 0x1402fbb64
mov ecx, dword [rbp + 0x67]
add ecx, dword [rbp - 0x39]
mov dword [r14], ecx
mov rcx, qword [rbp - 0x21]
call fcn.140165518
lea r11, [rsp + 0x90]
mov eax, edi
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x2fc4da4ec
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4da56a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4da561
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4da561
mov rax, qword [rbp - 8]
jmp 0x2fc4da57f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4da534
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001fc4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000200e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000200e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000200e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000200e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000200e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002010
xor al, al
add rsp, 0x28
ret
Function at 0x140007ba5
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx]
cmp rax, qword [rdx]
je 0x140007bd9
lea rcx, str.x0__nw__x1__nw
lea rdx, str..._mpint.c
mov r8d, 0x9a
call fcn.14003787c
mov rax, qword [rdi]
and ebx, 1
neg rbx
mov qword [rsp + 0x28], rbx
test rax, rax
je 0x140007c1b
xor eax, eax
mov rcx, qword [rdi + 8]
mov rdx, qword [rsi + 8]
mov rdx, qword [rdx + rax*8]
xor rdx, qword [rcx + rax*8]
mov rcx, qword [rsp + 0x28]
and rcx, rdx
mov rdx, qword [rdi + 8]
xor qword [rdx + rax*8], rcx
mov rdx, qword [rsi + 8]
xor qword [rdx + rax*8], rcx
inc rax
cmp rax, qword [rdi]
jb 0x140007beb
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x140007df9
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rcx
mov rax, qword [rcx + 8]
mov rcx, rax
shr rcx, 0x3e
je 0x140007e2f
lea rcx, str.hex.len_____size_t_0____4
lea rdx, str..._mpint.c
mov r8d, 0xfa
call fcn.14003787c
mov rax, qword [r14 + 8]
lea rax, [rax*4 + 0x3f]
shr rax, 6
mov ecx, 1
cmovne rcx, rax
call fcn.1400079d8
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x140007ed7
mov r8, 0xffffffffffffffff
xor r9d, r9d
xor r10d, r10d
add rcx, qword [r14]
movsx ecx, byte [r8 + rcx]
movsxd rcx, ecx
lea rbx, [rcx - 0x61]
mov edx, 0x66
sub rdx, rcx
or rdx, rbx
sar rdx, 0x3f
lea rsi, [rcx - 0x41]
mov ebx, 0x46
sub rbx, rcx
or rbx, rsi
sar rbx, 0x3f
lea esi, [rcx - 0x30]
lea edi, [rcx - 0x57]
xor esi, edi
and edx, esi
add ecx, 0xffffffc9
xor edi, ecx
xor edi, edx
and ebx, edi
xor ebx, ecx
and ebx, 0xf
mov rdx, r10
shr rdx, 4
mov ecx, r9d
and cl, 0x3c
shl rbx, cl
mov rcx, qword [rax + 8]
or qword [rcx + rdx*8], rbx
inc r10
mov rcx, qword [r14 + 8]
dec r8
add r9, 4
cmp r10, rcx
jb 0x140007e63
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140008434
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
mov r9, rcx
test r8, r8
je 0x140008465
lea rax, [r8 - 1]
movzx ecx, byte [r9 + rax]
xor rcx, 0x30
dec rcx
sar rcx, 0x3f
xor r8, rax
and r8, rcx
xor r8, rax
add rax, 0xffffffffffffffff
jb 0x140008444
jmp 0x140008468
xor r8d, r8d
test rdx, rdx
je 0x1400084c5
xor ecx, ecx
mov r10, r8
shr r10, cl
mov edi, 1
shl rdi, cl
cmp rdi, rdx
jae 0x1400084b7
and r10b, 1
neg r10b
mov r11, rdx
sub r11, rdi
add rdi, r9
xor esi, esi
mov bl, byte [r9 + rsi]
mov bpl, byte [rdi + rsi]
mov eax, ebp
xor al, bl
and al, r10b
xor bl, al
mov byte [r9 + rsi], bl
xor al, bpl
mov byte [rdi + rsi], al
inc rsi
cmp r11, rsi
jne 0x140008494
inc rcx
mov rax, rdx
shr rax, cl
test rax, rax
jne 0x14000846f
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14000d658
Capabilities:
Encode data using xor

Disassembly:
mov rcx, qword [rcx + 8]
jmp fcn.140007ff3

Function at 0x1400131f8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
mov qword [rsp + 0x58], r9
mov dword [rsp + 0x54], edx
mov dword [rsp + 0x50], ecx
mov rbx, qword [rsp + 0x140]
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xa0], rax
imul eax, r8d, 0x3e8
imul r14, rax, 0x10624dd3
shr r14, 0x26
mov ebp, 1
mov r13, qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r15d, 1
mov r12d, r15d
mov r15d, ebp
call r13
mov esi, eax
mov rax, qword [rsp + 0x120]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x90], xmm0
mov rax, qword [rsp + 0x128]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x80], xmm0
mov rax, qword [rsp + 0x130]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x70], xmm0
mov rax, qword [rsp + 0x138]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x60], xmm0
mov rdi, rbx
mov qword [rsp + 0x48], rbx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x118]
mov dword [rsp + 0x20], eax
mov ecx, dword [rsp + 0x50]
mov edx, dword [rsp + 0x54]
mov r8d, ebp
mov r9d, dword [rsp + 0x110]
call fcn.14001250b
call r13
mov ebp, r12d
add ebp, r15d
jb 0x140013324
sub eax, esi
cmp eax, r14d
jae 0x140013324
mov rbx, rdi
mov rcx, rdi
xor edx, edx
call fcn.140024aac
jmp 0x140013256
mov rax, qword [rsp + 0x58]
mov dword [rax], r15d
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14002b3d0
nop
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400133c9
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xc28
mov rsi, rcx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xc20], rax
xor eax, eax
mov rcx, qword [r8 + rax*8]
xor rcx, qword [rdx + rax*8]
mov qword [rsp + rax*8 + 0x820], rcx
inc rax
cmp rax, 0x80
jne 0x1400133e9
xor edi, edi
lea r8, [rsp + rdi]
add r8, 0x820
lea rcx, [rsp + rdi]
add rcx, 0x420
mov edx, 2
mov r9d, 2
call fcn.1400134d7
sub rdi, 0xffffffffffffff80
cmp rdi, 0x400
jne 0x140013406
xor edi, edi
lea r8, [rsp + rdi]
add r8, 0x420
lea rcx, [rsp + rdi]
add rcx, 0x20
mov edx, 0x10
mov r9d, 0x10
call fcn.1400134d7
add rdi, 0x10
cmp rdi, 0x80
jne 0x14001343b
xor eax, eax
mov rcx, qword [rsp + rax*8 + 0x20]
xor rcx, qword [rsp + rax*8 + 0x820]
xor qword [rsi + rax*8], rcx
inc rax
cmp rax, 0x80
jne 0x14001346d
lea rcx, [rsp + 0x820]
mov edx, 0x400
call fcn.14002654c
lea rcx, [rsp + 0x420]
mov edx, 0x400
call fcn.14002654c
lea rcx, [rsp + 0x20]
mov edx, 0x400
call fcn.14002654c
mov rcx, qword [rsp + 0xc20]
xor rcx, rsp
call fcn.14002b3d0
nop
add rsp, 0xc28
pop rdi
pop rsi
ret
Function at 0x140013f52
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
movaps xmmword [rsp + 0xe0], xmm6
mov esi, r9d
mov dword [rsp + 0x2c], r8d
mov qword [rsp + 0x30], rdx
mov rdi, rcx
mov ebx, dword [rsp + 0x168]
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0xd8], rax
call fcn.14003c240
lea rdx, [rsp + 0x40]
mov qword [rdx], rdi
mov qword [rdx + 8], rax
lea rcx, [0x140054080]
lea r8, [rsp + 0x90]
call fcn.140013caf
lea ecx, [rbx + 0x1f]
lea eax, [rbx + 0x3e]
test ecx, ecx
cmovns eax, ecx
test ebx, ebx
jle 0x1400140a1
sar eax, 5
movsxd rbx, eax
mov eax, dword [rsp + 0x168]
mov ebp, eax
test ebx, ebx
mov eax, 1
cmovg eax, ebx
mov qword [rsp + 0x38], rax
xor edi, edi
xorps xmm6, xmm6
lea r12, [rsp + 0x70]
lea r15, [rsp + 0x90]
movaps xmmword [rsp + 0x60], xmm6
movaps xmmword [rsp + 0x50], xmm6
test esi, esi
jle 0x140014062
lea r14d, [rdi + 1]
xor r13d, r13d
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x2c]
test r13d, r13d
mov ecx, 0
cmove ecx, r14d
mov qword [rsp + 0x20], r12
mov rdx, r15
call fcn.140013e8b
xor eax, eax
movaps xmm0, xmmword [rsp + rax + 0x50]
xorps xmm0, xmmword [rsp + rax + 0x70]
movaps xmmword [rsp + rax + 0x50], xmm0
add rax, 0x10
cmp rax, 0x20
jne 0x140014038
inc r13d
mov r9d, 0x20
mov r8, r12
cmp r13d, esi
jne 0x14001401d
mov eax, dword [rsp + 0x168]
mov r8, rdi
cmp edi, eax
mov rdi, qword [rsp + 0x160]
jge 0x140014090
lea rax, [rsp + 0x50]
mov rcx, r8
mov dl, byte [rax]
mov byte [rdi + rcx], dl
add rcx, rbx
inc rax
cmp rcx, rbp
jl 0x140014080
mov rdi, r8
inc rdi
cmp rdi, qword [rsp + 0x38]
jne 0x140013ffe
lea rcx, [rsp + 0x90]
mov edx, 0x40
call fcn.14002654c
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.14002b3d0
movaps xmm6, xmmword [rsp + 0xe0]
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140014dba
Capabilities:
Encrypt data using blowfish

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdi, [rcx + 0x1000]
lea rsi, [0x140051280]
mov ecx, 0x12
rep movsd dword [rdi], dword [rsi]
lea rdx, [0x1400512d0]
mov r8d, 0x400
mov rcx, rbx
call fcn.14002c530
lea rcx, [rbx + 0x400]
lea rdx, [0x1400516d0]
mov r8d, 0x400
call fcn.14002c530
lea rcx, [rbx + 0x800]
lea rdx, [0x140051ad0]
mov r8d, 0x400
call fcn.14002c530
add rbx, 0xc00
lea rdx, [0x140051ed0]
mov r8d, 0x400
mov rcx, rbx
call fcn.14002c530
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x14001703f
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x18
mov rax, rcx
mov qword [rsp + 8], rcx
shr rax, 0x20
mov r10d, dword [rdx + r8*4]
mov r11d, eax
rol r11d, 4
xor r11d, dword [rdx + r8*4 + 0x40]
mov qword [rsp + 0x10], rax
xor r10d, eax
mov eax, 0xfc00fc
mov ebp, r11d
and ebp, eax
mov edx, 0xff00ff00
or ebp, edx
shr r11d, 8
and r11d, eax
or r11d, edx
mov r8d, r10d
and r8d, eax
or r8d, edx
shr r10d, 8
and r10d, eax
or r10d, edx
xor r13d, r13d
lea rax, [0x140052770]
mov r12d, 0x80008
lea r15, fcn.140017357
mov dword [rsp], ebp
xor esi, esi
xor edi, edi
xor ebx, ebx
mov edx, r10d
mov dword [rsp + 4], r8d
mov r14d, r11d
mov r9d, dword [rax]
and r9d, ebp
xor ebx, r9d
add ebp, r12d
mov ecx, dword [rax + 4]
and ecx, r14d
xor edi, ecx
add r14d, r12d
mov ecx, dword [rax + 8]
and ecx, r8d
xor esi, ecx
add r8d, r12d
mov ecx, dword [rax + 0xc]
and ecx, edx
xor r13d, ecx
add edx, r12d
add rax, 0x10
cmp rax, r15
jb 0x1400170cc
mov eax, 0x100
mov edx, dword [rsp + 4]
add edx, eax
mov ebp, dword [rsp]
add ebp, eax
add r11d, eax
add r10d, eax
mov ecx, ebx
shl ecx, 4
mov r8d, 0x40004
and ebp, r8d
imul eax, ebp, 0x3c00
and eax, ecx
xor eax, ebx
mov ebp, edi
shl ebp, 4
and r11d, r8d
imul ecx, r11d, 0x3c00
and ecx, ebp
xor ecx, edi
mov ebx, esi
shl ebx, 4
and edx, r8d
imul ebp, edx, 0x3c00
and ebp, ebx
xor ebp, esi
mov ebx, r13d
shl ebx, 4
and r10d, r8d
imul edx, r10d, 0x3c00
and edx, ebx
xor edx, r13d
and edx, 0xf000f000
shr eax, 0xc
and eax, 0xf000f
shr ecx, 4
and ecx, 0xf000f00
shr ebp, 8
and ebp, 0xf000f0
or ebp, ecx
or ebp, edx
or eax, ebp
shr ebp, 4
xor ebp, eax
and ebp, 0x7030702
xor eax, ebp
shl ebp, 4
xor ebp, eax
mov ecx, ebp
shr ecx, 8
xor ecx, eax
and ecx, 0x4e009e
xor ebp, ecx
shl ecx, 8
xor ecx, ebp
mov eax, ecx
shr eax, 0x10
xor eax, ecx
and eax, 0xd9d3
xor ecx, eax
shl eax, 0x10
xor eax, ecx
mov ecx, eax
shr ecx, 4
xor ecx, eax
and ecx, 0x5040004
mov edx, ecx
xor edx, eax
shl ecx, 4
shr eax, 1
xor eax, edx
and eax, 0x4045015
xor ecx, dword [rsp + 8]
xor ecx, edx
xor ecx, eax
add eax, eax
xor eax, ecx
shl rax, 0x20
add rax, qword [rsp + 0x10]
add rsp, 0x18
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret