joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004ec90
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [0x1800ac2d4]
lea r8, [rcx + 0x40]
mov r9, rdx
mov rcx, r9
lea edx, [rax*8 + 0x80]
jmp 0x180056400
sub rsp, 0x68
movdqa xmm4, xmmword [0x1800ac360]
lea r9, [rdx + r8]
movdqa xmm5, xmmword [0x1800ac370]
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1800ac380]
movaps xmmword [rsp + 0x40], xmm7
movdqa xmm7, xmmword [0x1800ac390]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x1800ac3a0]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x1800ac3b0]
movaps xmmword [rsp + 0x10], xmm10
movdqa xmm10, xmmword [0x1800ac3c0]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x1800ac3d0]
cmp r8, r9
jae 0x180056509
lea rcx, [r8 + 0x20]
nop dword [rax]
aesdec xmm0, xmm4
aesenc xmm1, xmm4
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm0, xmm5
aesenc xmm1, xmm5
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm0, xmm6
aesenc xmm1, xmm6
aesdec xmm0, xmm7
movdqu xmmword [rcx - 0x20], xmm0
lea rcx, [rcx + 0x40]
aesdec xmm2, xmm10
aesenc xmm1, xmm7
movdqu xmmword [rcx - 0x50], xmm1
lea rax, [rcx - 0x20]
aesenc xmm3, xmm10
aesdec xmm2, xmm11
movdqu xmmword [rcx - 0x40], xmm2
aesenc xmm3, xmm11
movdqu xmmword [rcx - 0x30], xmm3
cmp rax, r9
jb 0x180056490
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
add rsp, 0x68
ret

Function at 0x18004ee90
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, qword [rcx + 0x11f0]
mov rax, rdx
mov edx, dword [0x1800ac2d0]
mov rcx, rax
jmp 0x180054f40
sub rsp, 0x28
movdqa xmm4, xmmword [0x180091820]
lea r10, [rdx + r8]
movdqa xmm5, xmmword [0x1800917d0]
mov r9, rcx
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm6, xmmword [0x1800917e0]
movaps xmmword [rsp], xmm7
movdqa xmm7, xmmword [0x1800917f0]
cmp r8, r10
jae 0x180054fc5
lea rcx, [r8 + 0x20]
aesdec xmm0, xmm4
movdqu xmmword [rcx - 0x20], xmm0
lea rcx, [rcx + 0x40]
aesenc xmm1, xmm5
movdqu xmmword [rcx - 0x50], xmm1
lea rax, [rcx - 0x20]
aesdec xmm2, xmm6
movdqu xmmword [rcx - 0x40], xmm2
aesenc xmm3, xmm7
movdqu xmmword [rcx - 0x30], xmm3
cmp rax, r10
jb 0x180054f90
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp]
movdqu xmmword [r9], xmm0
movdqu xmmword [r9 + 0x10], xmm1
movdqu xmmword [r9 + 0x20], xmm2
movdqu xmmword [r9 + 0x30], xmm3
add rsp, 0x28
ret
Function at 0x1800511d0
Capabilities:
Hash data using sha512

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xb0]
sub rsp, 0x1b0
mov rax, qword [0x1800aad48]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov rsi, qword [rbp + 0x110]
or r14d, 0xffffffff
mov r12, r9
mov r13, r8
mov rdi, rdx
mov r15, rcx
test r8, r8
jne 0x180051221
test r9, r9
jne 0x1800513c5
test r15, r15
je 0x1800513c5
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x1800513c5
mov qword [rsp + 0x1a8], rbx
mov rbx, qword [rbp + 0x118]
test rsi, rsi
jne 0x180051255
test rbx, rbx
jne 0x1800513bd
cmp rbx, 0x40
ja 0x1800513bd
test rbx, rbx
je 0x180051388
test rsi, rsi
je 0x1800513bd
xor eax, eax
mov byte [rbp + 0x10], dil
xor edx, edx
mov qword [rbp + 0x22], rax
mov r8d, 0xf0
mov qword [rbp + 0x2a], rax
lea rcx, [rsp + 0x20]
mov qword [rbp + 0x32], rax
mov qword [rbp + 0x3a], rax
mov qword [rbp + 0x42], rax
mov dword [rbp + 0x4a], eax
mov word [rbp + 0x4e], ax
mov byte [rbp + 0x11], bl
mov word [rbp + 0x12], 0x101
mov dword [rbp + 0x14], 0
mov word [rbp + 0x20], 0
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x180090f30]
movabs rcx, 0x6a09e667f3bcc908
movaps xmm1, xmmword [0x180090f40]
xor edx, edx
movaps xmm2, xmmword [0x180090f60]
mov r8d, 0x80
mov rax, qword [rbp + 0x10]
xor rax, rcx
movaps xmmword [rsp + 0x20], xmm0
movaps xmm0, xmmword [0x180090f50]
lea rcx, [rbp + 0x10]
xor qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
movq rax, xmm1
xor rax, qword [rbp + 0x20]
movaps xmmword [rsp + 0x30], xmm1
mov qword [rsp + 0x30], rax
mov rax, qword [rbp + 0x28]
xor qword [rsp + 0x38], rax
movq rax, xmm0
xor rax, qword [rbp + 0x30]
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x38]
xor qword [rsp + 0x48], rax
movq rax, xmm2
xor rax, qword [rbp + 0x40]
movaps xmmword [rsp + 0x50], xmm2
mov qword [rsp + 0x50], rax
mov rax, qword [rbp + 0x48]
xor qword [rsp + 0x58], rax
movzx eax, dil
mov dword [rbp + 4], eax
call sub.VCRUNTIME140.dll_memset
mov r8, rbx
lea rcx, [rbp + 0x10]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x80
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x20]
call fcn.180051b70
jmp 0x180051396
lea rcx, [rsp + 0x20]
call fcn.180051a30
test eax, eax
js 0x1800513bd
mov r8, r12
lea rcx, [rsp + 0x20]
mov rdx, r13
call fcn.180051b70
test eax, eax
js 0x1800513bd
mov r8, rdi
lea rcx, [rsp + 0x20]
mov rdx, r15
call fcn.1800518e0
mov r14d, eax
mov rbx, qword [rsp + 0x1a8]
mov eax, r14d
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.18005aca0
add rsp, 0x1b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180051a30
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1800aad48]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov rbx, rcx
test rcx, rcx
je 0x180051b4c
lea rax, [rdx - 1]
cmp rax, 0x3f
ja 0x180051b33
xor eax, eax
mov byte [rsp + 0x20], dil
xor edx, edx
mov qword [rsp + 0x32], rax
mov r8d, 0xf0
mov qword [rsp + 0x3a], rax
mov qword [rsp + 0x42], rax
mov qword [rsp + 0x4a], rax
mov qword [rsp + 0x52], rax
mov dword [rsp + 0x5a], eax
mov word [rsp + 0x5e], ax
mov word [rsp + 0x21], 0x100
mov byte [rsp + 0x23], 1
mov dword [rsp + 0x24], 0
mov word [rsp + 0x30], 0
call sub.VCRUNTIME140.dll_memset
movaps xmm0, xmmword [0x180090f30]
mov rax, qword [rsp + 0x20]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [0x180090f40]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [0x180090f50]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [0x180090f60]
movups xmmword [rbx + 0x30], xmm1
xor qword [rbx], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x38]
xor qword [rbx + 0x18], rax
mov rax, qword [rsp + 0x40]
xor qword [rbx + 0x20], rax
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x28], rax
mov rax, qword [rsp + 0x50]
xor qword [rbx + 0x30], rax
mov rax, qword [rsp + 0x58]
xor qword [rbx + 0x38], rax
xor qword [rbx + 8], 0
movzx eax, dil
mov dword [rbx + 0xe4], eax
xor eax, eax
jmp 0x180051b4f
cmp byte [rcx + 0xe8], 0
je 0x180051b44
mov qword [rcx + 0x58], 0xffffffffffffffff
mov qword [rcx + 0x50], 0xffffffffffffffff
or eax, 0xffffffff
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.18005aca0
mov rbx, qword [rsp + 0x90]
add rsp, 0x70
pop rdi
ret

Function at 0x180052650
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.18004ec90
mov rcx, rbx
call fcn.18004eeb0
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x180052120

Function at 0x1800549d0
Capabilities:
Encode data using xor

Disassembly:
xor r10d, r10d
lea rax, [rdx + 0x3f8]
lea r9, [rcx + 0x3f8]
mov r8d, 0x80
cmp rcx, rax
ja 0x1800549f1
cmp r9, rdx
jae 0x180054a61
mov r9, rdx
lea rax, [rcx + 0x10]
sub r9, rcx
mov r11d, 0x10
mov r10d, r8d
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [r9 + rax - 0x10]
movdqu xmm2, xmmword [r9 + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [r9 + rax - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [r9 + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
sub r11, 1
jne 0x180054a04
mov r9d, r10d
cmp r9, r8
jae 0x180054a91
sub rdx, rcx
lea rax, [rcx + r9*8]
sub r8, r9
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rax + rdx]
xor qword [rax], rcx
lea rax, [rax + 8]
sub r8, 1
jne 0x180054a80
ret
Function at 0x180054f40
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov r8, qword [rcx + 0x11f0]
mov rax, rdx
mov edx, dword [0x1800ac2d0]
mov rcx, rax
jmp 0x180054f40
sub rsp, 0x28
movdqa xmm4, xmmword [0x180091820]
lea r10, [rdx + r8]
movdqa xmm5, xmmword [0x1800917d0]
mov r9, rcx
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x10], xmm6
movdqa xmm6, xmmword [0x1800917e0]
movaps xmmword [rsp], xmm7
movdqa xmm7, xmmword [0x1800917f0]
cmp r8, r10
jae 0x180054fc5
lea rcx, [r8 + 0x20]
aesdec xmm0, xmm4
movdqu xmmword [rcx - 0x20], xmm0
lea rcx, [rcx + 0x40]
aesenc xmm1, xmm5
movdqu xmmword [rcx - 0x50], xmm1
lea rax, [rcx - 0x20]
aesdec xmm2, xmm6
movdqu xmmword [rcx - 0x40], xmm2
aesenc xmm3, xmm7
movdqu xmmword [rcx - 0x30], xmm3
cmp rax, r10
jb 0x180054f90
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp]
movdqu xmmword [r9], xmm0
movdqu xmmword [r9 + 0x10], xmm1
movdqu xmmword [r9 + 0x20], xmm2
movdqu xmmword [r9 + 0x30], xmm3
add rsp, 0x28
ret
Function at 0x180056400
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [0x1800ac2d4]
lea r8, [rcx + 0x40]
mov r9, rdx
mov rcx, r9
lea edx, [rax*8 + 0x80]
jmp 0x180056400
sub rsp, 0x68
movdqa xmm4, xmmword [0x1800ac360]
lea r9, [rdx + r8]
movdqa xmm5, xmmword [0x1800ac370]
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqu xmm3, xmmword [rcx + 0x30]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1800ac380]
movaps xmmword [rsp + 0x40], xmm7
movdqa xmm7, xmmword [0x1800ac390]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x1800ac3a0]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x1800ac3b0]
movaps xmmword [rsp + 0x10], xmm10
movdqa xmm10, xmmword [0x1800ac3c0]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x1800ac3d0]
cmp r8, r9
jae 0x180056509
lea rcx, [r8 + 0x20]
nop dword [rax]
aesdec xmm0, xmm4
aesenc xmm1, xmm4
aesdec xmm2, xmm8
aesenc xmm3, xmm8
aesdec xmm0, xmm5
aesenc xmm1, xmm5
aesdec xmm2, xmm9
aesenc xmm3, xmm9
aesdec xmm0, xmm6
aesenc xmm1, xmm6
aesdec xmm0, xmm7
movdqu xmmword [rcx - 0x20], xmm0
lea rcx, [rcx + 0x40]
aesdec xmm2, xmm10
aesenc xmm1, xmm7
movdqu xmmword [rcx - 0x50], xmm1
lea rax, [rcx - 0x20]
aesenc xmm3, xmm10
aesdec xmm2, xmm11
movdqu xmmword [rcx - 0x40], xmm2
aesenc xmm3, xmm11
movdqu xmmword [rcx - 0x30], xmm3
cmp rax, r9
jb 0x180056490
movaps xmm6, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
add rsp, 0x68
ret
Function at 0x1800572f0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
movdqa xmm2, xmmword [0x180091830]
lea r9, [rcx + rdx]
movdqa xmm3, xmmword [0x180091810]
movdqa xmm4, xmmword [0x180091840]
movdqa xmm5, xmmword [0x180091800]
cmp rcx, r9
jae 0x180057344
add rcx, 0x20
nop dword [rax]
aesenc xmm2, xmmword [rcx - 0x20]
aesdec xmm3, xmmword [rcx - 0x10]
aesenc xmm4, xmmword [rcx]
aesdec xmm5, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x40]
lea rax, [rcx - 0x20]
cmp rax, r9
jb 0x180057320
movdqa xmm0, xmmword [0x1800917c0]
movdqa xmm1, xmmword [0x180091850]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm2, xmm1
movdqu xmmword [r8], xmm2
aesenc xmm4, xmm0
aesdec xmm3, xmm1
movdqu xmmword [r8 + 0x10], xmm3
aesdec xmm5, xmm0
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [r8 + 0x20], xmm4
movdqu xmmword [r8 + 0x30], xmm5
ret
Function at 0x180058620
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x60
movdqu xmm0, xmmword [r9]
mov rbx, r8
movdqu xmm1, xmmword [r9 + 0x10]
lea r8, [rdx - 0x1000]
movdqa xmm2, xmmword [0x180091830]
mov r11, r9
movdqa xmm3, xmmword [0x180091810]
mov r10, rcx
movdqa xmm4, xmmword [0x180091840]
mov rax, rcx
movdqa xmm5, xmmword [0x180091800]
add r8, rcx
movaps xmmword [rsp + 0x50], xmm6
mov edx, 2
movdqu xmm6, xmmword [r9 + 0x20]
movaps xmmword [rsp + 0x40], xmm7
movdqu xmm7, xmmword [r9 + 0x30]
lea r9, [rcx + 0x1000]
movaps xmmword [rsp + 0x30], xmm8
movdqa xmm8, xmmword [0x180091820]
movaps xmmword [rsp + 0x20], xmm9
movdqa xmm9, xmmword [0x1800917d0]
movaps xmmword [rsp + 0x10], xmm10
movdqa xmm10, xmmword [0x1800917e0]
movaps xmmword [rsp], xmm11
movdqa xmm11, xmmword [0x1800917f0]
cmp rax, r8
jae 0x180058722
lea rcx, [rax + 0x20]
sub r9, rax
aesenc xmm2, xmmword [rax]
aesdec xmm3, xmmword [rcx - 0x10]
aesenc xmm4, xmmword [rcx]
aesdec xmm5, xmmword [rcx + 0x10]
aesdec xmm0, xmm8
movdqu xmmword [rax], xmm0
aesenc xmm1, xmm9
movdqu xmmword [rcx - 0x10], xmm1
aesdec xmm6, xmm10
aesenc xmm7, xmm11
movdqu xmmword [rcx], xmm6
movdqu xmmword [rcx + 0x10], xmm7
prefetcht0 byte [r9 + rax]
add rax, 0x40
lea rcx, [rcx + 0x40]
cmp rax, r8
jb 0x1800586d0
add r8, 0x1000
mov r9, r10
sub rdx, 1
jne 0x1800586c4
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x20]
movaps xmm10, xmmword [rsp + 0x10]
movaps xmm11, xmmword [rsp]
movdqu xmmword [r11], xmm0
movdqa xmm0, xmmword [0x1800917c0]
movdqu xmmword [r11 + 0x10], xmm1
movdqa xmm1, xmmword [0x180091850]
movdqu xmmword [r11 + 0x20], xmm6
movaps xmm6, xmmword [rsp + 0x50]
movdqu xmmword [r11 + 0x30], xmm7
movaps xmm7, xmmword [rsp + 0x40]
aesenc xmm2, xmm0
aesdec xmm3, xmm0
aesenc xmm2, xmm1
movdqu xmmword [rbx], xmm2
aesenc xmm4, xmm0
aesdec xmm3, xmm1
movdqu xmmword [rbx + 0x10], xmm3
aesdec xmm5, xmm0
aesenc xmm4, xmm1
aesdec xmm5, xmm1
movdqu xmmword [rbx + 0x20], xmm4
movdqu xmmword [rbx + 0x30], xmm5
add rsp, 0x60
pop rbx
ret

Function at 0x180059320
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov rdx, rcx
mov r9d, 0x40
xor ecx, ecx
mov r8d, 0x3000
jmp qword [sym.imp.KERNEL32.dll_VirtualAlloc]
Function at 0x18005ccc0
Capabilities:
Delete service
Stop service

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1800aad48]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rcx, qword [0x1800b02d8]
lea r8, [rsp + 0x20]
mov edx, 1
mov bl, 1
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x18005cd15
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.1800393a0
mov rcx, rax
lea r8, str.Failed_to_stop_WinRing0_driver__error__u
mov r9d, ebx
xor edx, edx
call fcn.180047d30
xor bl, bl
mov rcx, qword [0x1800b02d8]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x18005cd5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call fcn.1800393a0
mov rcx, rax
lea r8, str.Failed_to_remove_WinRing0_driver__error__u
mov r9d, ebx
xor edx, edx
call fcn.180047d30
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18005aca0
add rsp, 0x50
pop rbx
ret
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18005aca0
add rsp, 0x50
pop rbx
ret
Function at 0x14012a000
Capabilities:
Access peb ldr_data

Disassembly:
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
xchg rbp, r9
or byte [rsp + rax + 0x75], dh
add cl, byte [rcx - 0x44]
Function at 0x14012a7a5
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
add rcx, r9
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x3a0], rsi
jne 0x14012a57c
je 0x14012a57c
movabs r11, 0x2821bff27d4d0feb
popf
call rax
jl 0x14012a5ab
jmp 0x14012a58d
ret 0x10
mov dword [rsp + 0x20], 0x3000
movzx edx, word [rcx + r10*2]
mov ecx, dword [rbx + r9 + 0x1c]
add rcx, r9
jne 0x14012a5b8
je 0x14012a5b8
rol r14d, 0x61
test esi, 0x7260c4d1
jg 0x140129da8
invalid
movabs rcx, 0x4eeddc000000cee9
rcl esi, 0x3d
xor r8d, 0xa06a6827
syscall
call 0x14012a24d
jmp 0x14012a68b
xchg r12, rcx
mov r12, qword [rax + 0x18]
xchg rcx, r12
mov rax, qword [rcx + 0x10]
xchg rbp, rcx
mov rbp, qword [rax]
xchg rcx, rbp
jmp 0x14012a631
mov qword [rsp + 0x30], r15
lea r9, [rbp + 0xc0]
mov qword [rbp + 0xc0], 0x1f400000
mov rcx, 0xffffffffffffffff
call rdi
cmp qword [rsp + 0x30], r15
jmp 0x14012a786
jne 0x14012a767
cmp edx, 0xa3611248
je 0x14012a7cd
inc r8d
jmp 0x14012a6e9
xchg r11, r9
mov r11, qword [rcx + 0x30]
xchg r11, r9
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
mov r11d, dword [rbx + r9 + 0x20]
nop word [rax + rax]
jne 0x14012a661
je 0x14012a661
pause
pushf
cpuid
movabs rbp, 0x785f1800000083e9
pushf
jmp rax
jmp 0x14012a6e9
mov r14d, dword [rcx + rdx*4]
lea rdx, [rsp + 0x30]
add r14, r9
jne 0x14012a6d4
je 0x14012a6d4
mov r15d, 0xd19b41c2
cmp r12d, 0xe76887ee
add r11d, 0x7100a001
rcr ebx, 0xad
lea esi, [rbp - 0xa8fa]
lea esi, [rdi - 0xc97]
neg rbx
popf
call rax
neg r8
cmp r15d, 0xaef82e2a
test r14, rbx
movabs r11, 0x6392a0ffffff14e9
neg rbp
xor r10d, 0xb591db7a
ret 8
jmp 0x14012a5ed
mov r10d, r8d
mov edx, 0x8643cc8d
lea rax, [r11 + r10*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
jne 0x14012a73e
je 0x14012a73e
lea r9d, [rbp - 0x99ab]
ror ecx, 0x1b
call rax
lea edx, [rbx + 0xb507]
lea ebp, [rcx + 0xc58a]
or esi, 0xb95a6f21
call rax
popf
pushf
inc r8
jmp rax
jmp 0x14012a759
inc rcx
test al, al
je 0x14012a629
nop dword [rax]
movsx eax, al
jmp 0x14012a76f
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jmp 0x14012a617
je 0x14012d37b
mov rax, qword gs:[0x60]
mov r8d, r15d
jne 0x14012a7b6
je 0x14012a7b6
popfq
push r9
cmp r8d, 0xfdee0a6e
std
jl 0x14012ae69
call rax
js 0x14012a335
movabs rbx, 0x5962c9fffffe16e9
div r15
rol edx, 0x55
jmp rcx
jmp 0x14012a5d1
mov rax, qword gs:[0x60]
mov r8d, r15d
mov ecx, dword [rbx + r9 + 0x24]
add rcx, r9
jmp 0x14012a7fd
movzx edx, word [rcx + r10*2]
mov ecx, dword [rbx + r9 + 0x1c]
add rcx, r9
jmp 0x14012a827
mov esi, dword [rcx + rdx*4]
mov rcx, qword [rax + 0x18]
add rsi, r9
mov rax, qword [rcx + 0x10]
xchg rbp, rcx
jmp 0x14012a88c
mov ebx, dword [rax + r9 + 0x88]
mov r11d, dword [rbx + r9 + 0x20]
nop dword [rax + rax]
jmp 0x14012a80f
mov rbp, qword [rax]
xchg rcx, rbp
mov r9, qword [rcx + 0x30]
movsxd rax, dword [r9 + 0x3c]
jmp 0x14012a858
and al, 0xe1
add byte [rax], al
Function at 0x140007204
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.140007194
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007240
cmp qword [rbx + 0x18], rdi
je 0x140007247
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140007237
jmp 0x140007261
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x140020640]
call fcn.1400123b8
lea rcx, [0x140021210]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xchg ecx, eax
xchg ecx, eax
int 0x30
loopne 0x14003f6b7
invalid
jmp 0x14003f700
invalid
add al, 0x17
pop rsi
pop rax
or byte [rbp + rbx*8 + 0x28], 0x77
add eax, esp
lodsb al, byte [rsi]
out dx, eax
xor eax, 0xebc55036
movabs qword [0x15be84404d5f73bb], rax
jae 0x14003f728
pop rdi
test byte [rsi + 0xfe5ec15], dil
invalid
pop rdi
test byte [rsi + 0xfe5ec15], dil
test eax, 0x1fd26e81
add edx, ebp
mov ah, 0x88
xlatb
xor edx, dword [rax]
adc ecx, dword [rcx]
ret 0x5efd
add byte [rbx], cl
xchg ebp, eax
and byte [rbx - 0x246c2e4b], ah
fild dword [rdi]
fild dword [rdi]
imul esi, dword [rax], 0xffffffcb
loop 0x14003f763
add ebx, dword [rdx - 0x55b2c6c5]
invalid
mov esp, 0x2f8d2827
invalid
insb byte [rdi], dx
or eax, 0xb642c32a
ret
mov sil, 0xb8
mov eax, 0x66159a3c
div qword [r9 - 0x19ff15df]
div dword [rcx - 0x19ff15df]
ret
and edx, ebp
add dh, ah
sub edx, 0x9ca05bf2
push rsi
fstp xword [rax + 0x4c307e25]
movabs byte [0x4a38acea7c0635be], al
cmp byte [rdx + 0xa], cl
int3
nop
adc eax, 0x9fce3d4
and qword [r9], 0x50064e33
push rsp
ffreep st(1)
mov ss, word [rdx + rdx*8]
and eax, 0x47e03126
invalid
invalid

Function at 0x14000727c
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x30
lea rax, [r11 + 0x18]
mov r9, rdx
mov r8, rcx
mov qword [r11 - 0x10], rax
xor edi, edi
mov edx, 0x1000
xor ecx, ecx
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbp, rax
test rax, rax
je 0x140007342
lea rcx, [0x140021210]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140020640]
jmp 0x140007306
lea rsi, [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140007303
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbx]
lea rcx, [0x140020640]
mov rdx, rsi
call fcn.1400123b8
jmp 0x140007306
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1400072d3
mov rdx, qword [0x14001f118]
lea rcx, [0x140020640]
mov rdi, rdx
inc rdx
mov qword [0x14001f118], rdx
lea edx, [rbx + 0x20]
call fcn.140012400
lea rcx, [0x140021210]
mov qword [rax], rbp
mov qword [rax + 8], rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov rax, rdi
add rsp, 0x30
pop rdi
ret