joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140059218
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.1400368c8
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x1400592a2
cmp byte [rbp - 0x21], r15b
je 0x14005929d
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x1400592d8
call fcn.14004839c
test eax, eax
jne 0x1400592c4
cmp byte [rbp - 0x21], r15b
je 0x1400592bc
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x1400592d8
cmp byte [rbp - 0x21], r15b
je 0x1400592d5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.14003dc18
test eax, eax
jne 0x140059378
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.1400368c8
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x140059317
cmp byte [rbp - 0x21], r15b
je 0x14005934c
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14005934c
call fcn.14004839c
test eax, eax
jne 0x140059338
cmp byte [rbp - 0x21], r15b
je 0x140059331
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14005934c
cmp byte [rbp - 0x21], r15b
je 0x140059349
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.14003dc18
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x140059378
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14005937b
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x140059389
mov rcx, rdi
call fcn.140047850
cmp byte [rbp + 0x3f], r15b
je 0x140059398
mov rcx, qword [rbp + 0x27]
call fcn.140047850
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14005a420
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.14004a288
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.14004a288
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14005a56d
cmp rax, 0xffffffffffffffff
je 0x14005a56d
xor edi, edi
test rbp, rbp
jle 0x14005a51b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.140048010
mov rbx, rax
test rax, rax
jne 0x14005a4a8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14005a511
mov edx, 0x8000
mov ecx, r14d
call fcn.140043a5c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.140047514
cmp eax, 0xffffffff
je 0x14005a4f1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14005a4b8
mov edx, r15d
mov ecx, r14d
call fcn.140043a5c
jmp 0x14005a511
cmp byte [rsi + 0x38], dil
je 0x14005a508
cmp dword [rsi + 0x34], 5
jne 0x14005a508
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14005a511
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.140047850
jmp 0x14005a57f
jns 0x14005a57f
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.14004a288
cmp rax, 0xffffffffffffffff
jne 0x14005a539
cmp byte [rsi + 0x30], dil
je 0x14005a57f
jmp 0x14005a575
mov ecx, r14d
call fcn.140052994
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14005a57f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14005a57f
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14005a57a
mov edi, dword [rsi + 0x2c]
jmp 0x14005a57f
mov edi, 0x16
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.14004a288
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14005ae10
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14005ae38
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14005ae38
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14083ff70
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1408400f7
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14083ffa1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14083ff87
add dl, dl
jne 0x14083ffae
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14084000e
xor eax, eax
add dl, dl
jne 0x14083ffbd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1408400c5
add dl, dl
jne 0x14083ffce
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14083ffdb
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14083ffe8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14083fff5
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140840002
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14083ff96
mov eax, 1
add dl, dl
jne 0x14084001e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14084002b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140840013
sub eax, ebx
mov ebx, 1
jne 0x140840064
mov ecx, 1
add dl, dl
jne 0x140840046
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140840053
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14084003b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14083ff96
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140840080
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14084008d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140840075
cmp eax, 0x7d00
jae 0x1408400b3
cmp eax, 0x500
jb 0x1408400ae
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14083ff96
cmp eax, 0x7f
ja 0x1408400b6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14083ff96
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1408400ea
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14083ff96
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1403336f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x98
cmp byte [0x14036bb1b], 0
xorps xmm0, xmm0
movups xmm3, xmmword [0x14036bb08]
mov edx, dword [0x14036bb18]
movups xmmword [rax - 0x60], xmm0
mov dword [rax - 0x68], edx
movups xmmword [rax - 0x78], xmm3
movups xmmword [rax - 0x50], xmm0
movups xmmword [rax - 0x40], xmm0
je 0x14033397e
xor ecx, ecx
cmp dword [0x14037e090], 2
jl 0x14033394b
movdqa xmm5, xmmword [0x140377f20]
movdqa xmm2, xmmword [0x140377e60]
movdqa xmm4, xmmword [0x140377f00]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
movaps xmmword [rax - 0x18], xmm6
movdqa xmm6, xmmword [0x140377ed0]
movaps xmmword [rax - 0x28], xmm7
movdqa xmm7, xmmword [0x140377f40]
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
movd eax, xmm3
movdqa xmm3, xmmword [0x140377e80]
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
andps xmm2, xmm4
movd xmm0, eax
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
xorps xmm2, xmm0
movd dword [rsp + 0x20], xmm2
movdqa xmm2, xmmword [0x140377e70]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
pmulld xmm0, xmm6
psubd xmm2, xmm0
punpckldq xmm1, xmm3
movd xmm0, dword [rsp + 0x24]
andps xmm2, xmm4
pmuldq xmm1, xmm5
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
movd dword [rsp + 0x24], xmm2
movdqa xmm2, xmmword [0x140377e90]
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm2
pmulld xmm0, xmm6
psubd xmm3, xmm0
punpckldq xmm1, xmm2
movd xmm0, dword [rsp + 0x28]
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
pmuldq xmm1, xmm5
paddb xmm3, xmm7
xorps xmm3, xmm0
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
movd dword [rsp + 0x28], xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
movdqa xmm3, xmmword [0x140377ea0]
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movdqa xmm1, xmm3
movd xmm0, dword [rsp + 0x2c]
andps xmm2, xmm4
punpckldq xmm1, xmm3
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
pmuldq xmm1, xmm5
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
movd dword [rsp + 0x2c], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x80]
psubd xmm3, xmm0
andps xmm3, xmm4
movd xmm0, edx
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmm7
movaps xmm7, xmmword [rsp + 0x70]
xorps xmm3, xmm0
movd dword [rsp + 0x30], xmm3
jmp 0x14033397e
lea r8, [rsp + 0x20]
mov eax, 0x29e4129f
lea r8, [r8 + 1]
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul edx, eax, 0x37
movzx eax, cl
inc ecx
sub al, dl
add al, 0x39
xor byte [r8 - 1], al
cmp ecx, 0x14
jl 0x140333950
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x20]
call fcn.140337990
add rsp, 0x98
ret
Function at 0x1403392c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x138
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140339327
lea r8, [r10 + 0x10]
movabs r11, 0xb5026f5aa96619e9
mov rdx, qword [r8]
xor rdx, qword [r8 - 8]
lea r8, [r8 + 8]
and rdx, 0xffffffff80000000
xor rdx, qword [r8 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x1403392e2
mov ecx, dword [r10]
jmp 0x140339436
cmp ecx, 0x270
jb 0x140339436
mov qword [rsp + 0x10], rbx
movabs r11, 0xb5026f5aa96619e9
lea rbx, [r10 + 0x9c8]
mov qword [rsp], rdi
mov rax, qword [rbx]
mov edi, 0x9c
nop word [rax + rax]
mov r9, qword [rbx + 8]
lea rbx, [rbx + 8]
mov rdx, r9
xor rdx, rax
and rdx, 0xffffffff80000000
xor rdx, r9
movzx eax, dl
and al, 1
neg al
mov rax, r9
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [rbx + 0x4d8]
xor rcx, rdx
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x140339360
lea rbx, [r10 + 0xea8]
mov edi, 0x9b
mov r9, qword [rbx]
mov r8, qword [rbx + 8]
lea rbx, [rbx + 8]
xor r9, r8
and r9, 0xffffffff80000000
xor r9, r8
movzx eax, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, r11
xor rcx, qword [rbx - 0xea8]
xor rcx, r9
mov r9, r8
mov qword [rbx - 0x9c8], rcx
sub rdi, 1
jne 0x1403393b1
mov rdx, qword [r10 + 8]
xor rdx, qword [r10 + 0x1380]
mov rdi, qword [rsp]
and rdx, 0xffffffff80000000
xor rdx, qword [r10 + 8]
mov rbx, qword [rsp + 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, r11
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov rdx, qword [r10 + rax*8 + 8]
lea eax, [rcx + 1]
mov dword [r10], eax
mov rcx, rdx
mov rax, qword [r10 + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 8
ret
Function at 0x140339830
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rdi, qword [0x1403b56e8]
mov rbx, r8
lea rsi, [rdi + 0x164]
lea rcx, [rdi + 0x16c]
mov dword [rsi], 1
call sub.VCRUNTIME140.dll_memcpy
mov dword [rdi + 0x168], ebx
add rbx, 8
je 0x140339907
mov rax, qword [rdi]
test rax, rax
je 0x1403398c5
mov rcx, qword [rax + 8]
cmp rcx, 0xffffffffffffffff
je 0x1403398c5
test rsi, rsi
je 0x1403398c5
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], 0
mov r8d, ebx
mov qword [rsp + 0x20], 0
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
jne 0x1403398c5
cmp dword [rsp + 0x30], ebx
je 0x140339907
mov r8, qword [rdi + 0x18]
test r8, r8
je 0x1403398e4
mov eax, dword [rdi + 8]
dec eax
test eax, 0xfffffffd
jne 0x1403398e4
mov ecx, dword [rdi + 0x60]
lea rdx, [rdi + 0x64]
call r8
mov rbx, qword [rdi]
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
xor al, al
mov byte [rbx], 0
mov dword [rdi + 8], 0
jmp 0x140339909
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1403687d0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x14033e210
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
sub rsp, 0xa8
movaps xmm0, xmmword [0x14036cec0]
movaps xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [0x14036ced0]
movaps xmmword [rsp + 0x40], xmm1
movaps xmm0, xmmword [0x14036cee0]
movaps xmmword [rsp + 0x50], xmm0
movaps xmm1, xmmword [0x14036cef0]
movaps xmmword [rsp + 0x60], xmm1
movaps xmm0, xmmword [0x14036cf00]
movaps xmmword [rsp + 0x70], xmm0
movaps xmm1, xmmword [0x14036cf10]
movaps xmmword [r11 - 0x28], xmm1
movsd xmm0, qword [0x14036cf20]
movsd qword [r11 - 0x18], xmm0
mov eax, dword [0x14036cf28]
mov dword [r11 - 0x10], eax
movzx eax, word [0x14036cf2c]
mov word [r11 - 0xc], ax
movzx eax, byte [str.nZH_I__5_2m_G]
mov byte [r11 - 0xa], al
xor eax, eax
xor r9b, r9b
mov r11d, eax
mov r8d, eax
mov r10d, eax
mov ecx, eax
mov dword [rsp + 0x20], eax
cmp eax, 0x6f
jge 0x14033e2e5
mov eax, 0x8fb823ef
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul ecx, eax, 0x39
add cl, r9b
movsxd rax, r10d
xor cl, byte [rsp + rax + 0x30]
movsxd rax, r10d
mov byte [rsp + rax + 0x30], cl
lea eax, [r10 + 1]
movzx r9d, al
jmp 0x14033e296
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x14033e2f2
add rsp, 0xa8
ret
Function at 0x14033f530
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rsi, [0x1403b58f0]
lea rbp, [0x1403b5a58]
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.USER32.dll_FindWindowW]
test rax, rax
je 0x14033f617
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14033f5f7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14033f5f7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xb434b577
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14033f5f2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14033f5d0
cmp r8d, 0xa41c4fb7
je 0x14033f5fc
test r9d, r9d
jne 0x14033f5b0
mov rax, qword [rax]
jmp 0x14033f580
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
add rsi, 8
cmp rsi, rbp
jne 0x14033f552
mov r8, qword [0x1403b5a58]
xor edx, edx
mov ecx, 4
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
test rax, rax
je 0x14033f6f7
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14033f6d7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14033f6d7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xfe334f01
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14033f6d2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14033f6b0
cmp r8d, 0xe8d5a9a1
je 0x14033f6dc
test r9d, r9d
jne 0x14033f690
mov rax, qword [rax]
jmp 0x14033f660
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14033f710
Capabilities:
Allocate or change rwx memory
Encode data using xor

Disassembly:
sub rsp, 0x48
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rcx, [0x14036cc08]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9, rax
test rax, rax
je 0x14033f95c
cmp byte [0x14036d395], 0
movsd xmm0, qword [str.XO_]
movzx ecx, word [0x14036d394]
mov eax, dword [0x14036d390]
movsd qword [rsp + 0x20], xmm0
mov word [rsp + 0x2c], cx
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x28], eax
je 0x14033f921
xor ecx, ecx
cmp dword [0x14037e090], 2
jl 0x14033f8d7
movdqa xmm2, xmmword [0x140377e60]
mov ecx, 0xc
movdqa xmm5, xmmword [0x140377f80]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x140377e80]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
movdqa xmm4, xmmword [0x140377f00]
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140377ef0]
psubd xmm2, xmm0
movd xmm0, dword [str.XO_]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140377f40]
xorps xmm2, xmm0
movd dword [rsp + 0x20], xmm2
movdqa xmm2, xmmword [0x140377e70]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
pmulld xmm0, xmmword [0x140377ef0]
psubd xmm2, xmm0
punpckldq xmm1, xmm3
movd xmm0, dword [rsp + 0x24]
andps xmm2, xmm4
packuswb xmm2, xmm2
pmuldq xmm1, xmm5
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140377f40]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
movd dword [rsp + 0x24], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140377ef0]
psubd xmm3, xmm0
movd xmm0, eax
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [0x140377f40]
xorps xmm3, xmm0
movd dword [rsp + 0x28], xmm3
mov eax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8fb823ef
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul edx, eax, 0x39
add dl, cl
inc ecx
xor byte [r8 - 1], dl
cmp ecx, 0xe
jl 0x14033f8f0
lea rdx, [rsp + 0x20]
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14033f957
lea r9, [rsp + 0x30]
mov edx, 1
mov r8d, 0x40
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14033f957
mov byte [rbx], 0xc3
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1403687d0
add rsp, 0x48
ret
Function at 0x140344b30
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x28], rcx
mov rsi, rcx
mov dword [rsp + 0x28], 0x64
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140344bf7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140344bf7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xac9c2b5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140344bf2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140344bd0
cmp r8d, 0xe158e30a
je 0x140344bfc
test r9d, r9d
jne 0x140344bb0
mov rax, qword [rax]
jmp 0x140344b80
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [rsp + 0x28]
add rax, r10
lea rcx, [rsp + 0x30]
call rax
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov r8, 0xffffffffffffffff
mov qword [rsi + 0x18], 0
inc r8
cmp byte [rax + r8], 0
jne 0x140344c41
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140347100
mov rax, rsi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1403687d0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret