joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002db80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x1402a2cf8]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov r13, rdx
mov qword [rsp + 0x38], rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [r11 - 0x58], xmm0
mov dword [r11 - 0x48], ebx
call fcn.14000b930
mov rbp, rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], bl
lea r8d, [rbx + 0x19]
lea rdx, str.NtQueryInformationProcess
lea rcx, [rsp + 0x40]
call fcn.14000c110
nop
mov dword [rsp + 0x30], 1
call fcn.1400287c0
lea r12, [rbp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x40]
mov rsi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x58]
cmp r14, 0x10
cmovae r8, rsi
movabs rdx, 0xcbf29ce484222325
mov ecx, ebx
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x14002dc64
movabs r9, 0x100000001b3
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rdi
jb 0x14002dc50
mov rcx, qword [rbp + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r15, qword [rbp + 8]
cmp rbx, r15
je 0x14002dd19
mov rbp, qword [rax + rcx*8]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14002dca2
mov rdx, qword [rdx]
lea rcx, [rsp + 0x40]
cmp r14, 0x10
cmovae rcx, rsi
cmp rdi, rax
jne 0x14002dcc0
mov r8, rdi
call fcn.1400b75e0
test eax, eax
je 0x14002dccb
cmp rbx, rbp
je 0x14002dd19
mov rbx, qword [rbx + 8]
jmp 0x14002dc90
test rbx, rbx
je 0x14002dd19
cmp rbx, r15
je 0x14002dd19
mov rbx, qword [rbx + 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rdi, qword [rsp + 0x38]
test rbx, rbx
je 0x14002dd27
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rsp + 0x60]
xor edx, edx
mov rcx, qword [rdi + 8]
call rbx
test eax, eax
js 0x14002dd27
test r13, r13
je 0x14002dd27
mov bl, 1
jmp 0x14002dd29
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rdi, qword [rsp + 0x38]
xor bl, bl
cmp r14, 0x10
jb 0x14002dd5c
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14002dd54
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002ddb1
mov rcx, rsi
call fcn.14009aa1c
test bl, bl
je 0x14002dd81
mov qword [rsp + 0x20], 0
mov r9d, 0x388
mov r8, r13
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.14009a9c0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400c88c8
int3
Function at 0x14002ddc0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1402a2cf8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r13, r8
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
cmp byte [rcx + 0x15], bl
jne 0x14002de08
xor eax, eax
jmp 0x14002dfef
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x88], xmm0
mov dword [rsp + 0x98], ebx
call fcn.14000b930
mov rbp, rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], bl
mov r8d, 0x18
lea rdx, str.NtQueryInformationThread
lea rcx, [rsp + 0x38]
call fcn.14000c110
nop
mov dword [rsp + 0x30], 1
call fcn.1400287c0
lea r12, [rbp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x38]
mov rsi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x50]
cmp r14, 0x10
cmovae r8, rsi
movabs rdx, 0xcbf29ce484222325
mov rcx, rbx
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x14002dec4
movabs r9, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rdi
jb 0x14002deb0
mov rcx, qword [rbp + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r15, qword [rbp + 8]
cmp rbx, r15
je 0x14002df75
mov rbp, qword [rax + rcx*8]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14002df02
mov rdx, qword [rdx]
lea rcx, [rsp + 0x38]
cmp r14, 0x10
cmovae rcx, rsi
cmp rdi, rax
jne 0x14002df20
mov r8, rdi
call fcn.1400b75e0
test eax, eax
je 0x14002df2b
cmp rbx, rbp
je 0x14002df75
mov rbx, qword [rbx + 8]
jmp 0x14002def0
test rbx, rbx
je 0x14002df75
cmp rbx, r15
je 0x14002df75
mov rbx, qword [rbx + 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14002df7e
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call rbx
test eax, eax
js 0x14002df7e
test r13, r13
je 0x14002df7e
mov bl, 1
jmp 0x14002df80
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor bl, bl
cmp r14, 0x10
jb 0x14002dfb3
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14002dfab
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e01a
mov rcx, rsi
call fcn.14009aa1c
test bl, bl
je 0x14002dfe4
mov rdx, qword [rsp + 0x70]
add rdx, 0x2000
mov qword [rsp + 0x20], 0
mov r9d, 0x1000
mov r8, r13
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x70]
add rax, 0x2000
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14009a9c0
mov rbx, qword [rsp + 0x108]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400c88c8
int3
Function at 0x14002e020
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1402a2cf8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r13, r8
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rcx
xor ebx, ebx
mov dword [rsp + 0x30], ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [r11 - 0x60], xmm0
mov dword [r11 - 0x50], ebx
call fcn.14000b930
mov rbp, rax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], bl
lea r8d, [rbx + 0x18]
lea rdx, str.NtQueryInformationThread
lea rcx, [rsp + 0x38]
call fcn.14000c110
nop
mov dword [rsp + 0x30], 1
call fcn.1400287c0
lea r12, [rbp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x38]
mov rsi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x50]
cmp r14, 0x10
cmovae r8, rsi
movabs rdx, 0xcbf29ce484222325
mov ecx, ebx
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x14002e114
movabs r9, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, r9
inc rcx
cmp rcx, rdi
jb 0x14002e100
mov rcx, qword [rbp + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r15, qword [rbp + 8]
cmp rbx, r15
je 0x14002e1c5
mov rbp, qword [rax + rcx*8]
nop dword [rax + rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14002e152
mov rdx, qword [rdx]
lea rcx, [rsp + 0x38]
cmp r14, 0x10
cmovae rcx, rsi
cmp rdi, rax
jne 0x14002e170
mov r8, rdi
call fcn.1400b75e0
test eax, eax
je 0x14002e17b
cmp rbx, rbp
je 0x14002e1c5
mov rbx, qword [rbx + 8]
jmp 0x14002e140
test rbx, rbx
je 0x14002e1c5
cmp rbx, r15
je 0x14002e1c5
mov rbx, qword [rbx + 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14002e1ce
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call rbx
test eax, eax
js 0x14002e1ce
test r13, r13
je 0x14002e1ce
mov bl, 1
jmp 0x14002e1d0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor bl, bl
cmp r14, 0x10
jb 0x14002e203
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14002e1fb
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002e25d
mov rcx, rsi
call fcn.14009aa1c
test bl, bl
je 0x14002e22d
mov qword [rsp + 0x20], 0
mov r9d, 0x1838
mov r8, r13
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.14009a9c0
mov rbx, qword [rsp + 0x108]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400c88c8
int3
Function at 0x140037340
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rdi + 8], eax
jne 0x140037365
mov al, 1
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rax, qword [rdi]
mov rcx, qword [rax + 0x10]
cmp dword [rcx + 0x10], 3
jne 0x140037415
cmp byte [rcx + 0x16], 0
jne 0x140037415
call fcn.14000b930
mov rbx, rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov r8d, 0x12
lea rdx, str.Wow64SuspendThread
lea rcx, [rsp + 0x20]
call fcn.14000c110
nop
lea r8, [rdi + 0x10]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140037440
cmp eax, 0xffffffff
setne bl
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x140037407
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037402
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037430
call fcn.14009aa1c
movzx eax, bl
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
setne al
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
call fcn.1400c88c8
int3

Function at 0x140037440
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r14
sub rsp, 0x30
mov r14, r8
mov rbx, rdx
mov rsi, rcx
call fcn.1400287c0
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
mov r10, qword [rbx + 0x10]
jb 0x140037476
mov rdx, qword [rbx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x1400374a4
movabs r8, 0x100000001b3
movzx eax, byte [rcx + rdx]
inc rcx
xor r9, rax
imul r9, r8
cmp rcx, r10
jb 0x140037491
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14000c360
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x1400374ec
cmp rbx, qword [rsi + 8]
je 0x1400374ec
mov rbx, qword [rbx + 0x30]
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x1400374f6
mov rcx, qword [r14]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop rdi
pop rsi
jmp rax
lea rcx, [rsi + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x68]
xor eax, eax
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140037510
Capabilities:
Resume thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rdi
sub rsp, 0x970
mov rax, qword [0x1402a2cf8]
xor rax, rsp
mov qword [rsp + 0x960], rax
mov edi, edx
mov rbx, rcx
cmp edx, 4
ja 0x1400376ef
mov qword [r11 + 0x10], rbp
lea rcx, [r11 - 0x688]
xor edx, edx
mov qword [r11 + 0x18], rsi
mov r8d, 0x670
call fcn.1400b6650
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2cc
call fcn.1400b6650
mov rbp, qword [rbx]
mov rax, qword [rbp + 0x10]
movzx esi, byte [rax + 0x16]
test sil, sil
jne 0x1400375a0
mov rdx, qword [rbx + 0x10]
lea r8, [rsp + 0x2f0]
mov dword [rsp + 0x320], 0x100010
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x58]
jmp 0x1400375cd
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x2c8
call fcn.1400b6650
mov rdx, qword [rbx + 0x10]
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x100010
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rbp, qword [rsp + 0x988]
lea r8, [rsp + 0x360]
test sil, sil
lea rcx, [rsp + 0x38]
cmovne r8, rcx
test eax, eax
js 0x1400376c6
mov edx, dword [r8]
test edi, edi
jne 0x140037600
and edx, 0xfff0fffe
jmp 0x140037643
cmp edi, 1
jne 0x14003760d
and edx, 0xff0ffffb
jmp 0x140037643
cmp edi, 2
mov ecx, 0xffffffbf
mov eax, 0xffffffef
cmovne eax, ecx
mov ecx, 0xf3ffffff
and eax, edx
mov edx, 0x3fffffff
cmp edi, 2
cmovne ecx, edx
mov edx, 0xfcffffff
and ecx, eax
mov eax, 0xcfffffff
cmp edi, 2
cmovne edx, eax
and edx, ecx
mov eax, edx
mov dword [r8], edx
shr eax, 2
mov ecx, eax
or ecx, edx
shr ecx, 4
or ecx, eax
or ecx, edx
test cl, 1
jne 0x140037662
btr edx, 8
mov dword [r8], edx
mov rcx, rbx
mov edi, 0xc000071c
call fcn.140037340
test sil, sil
jne 0x140037693
test al, al
je 0x1400376c4
mov rax, qword [rbx]
lea r8, [rsp + 0x2f0]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x68]
jmp 0x1400376ad
test al, al
je 0x1400376c4
mov rax, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 8], eax
je 0x1400376c4
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, edi
mov rsi, qword [rsp + 0x990]
mov rcx, qword [rsp + 0x960]
xor rcx, rsp
call fcn.14009a9c0
mov rbx, qword [rsp + 0x998]
add rsp, 0x970
pop rdi
ret
xor eax, eax
jmp 0x1400376ce
Function at 0x140037700
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x970
mov rax, qword [0x1402a2cf8]
xor rax, rsp
mov qword [rsp + 0x960], rax
mov rdi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x2f0]
mov r8d, 0x670
call fcn.1400b6650
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x2cc
call fcn.1400b6650
mov rbp, qword [rbx]
mov rax, qword [rbp + 0x10]
movzx esi, byte [rax + 0x16]
test sil, sil
jne 0x140037789
mov rdx, qword [rbx + 0x10]
lea r8, [rsp + 0x2f0]
mov dword [rsp + 0x320], 0x100010
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x58]
jmp 0x1400377b6
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x2c8
call fcn.1400b6650
mov rdx, qword [rbx + 0x10]
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x100010
mov rcx, qword [rbp + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x50]
test sil, sil
lea r8, [rsp + 0x360]
lea rcx, [rsp + 0x38]
cmovne r8, rcx
test eax, eax
jns 0x1400377d5
xor eax, eax
jmp 0x1400378cd
xor ecx, ecx
mov edx, ecx
mov eax, ecx
nop dword [rax + rax]
cmp qword [rsp + rax*8 + 0x338], rdi
je 0x140037805
cmp dword [rsp + rax*4 + 0x24], edi
je 0x140037805
inc edx
inc rax
cmp rax, 4
jl 0x1400377e0
mov eax, 0xc0000225
jmp 0x1400378cd
movsxd rax, edx
test sil, sil
jne 0x140037817
mov qword [rsp + rax*8 + 0x338], rcx
jmp 0x14003781b
mov dword [rsp + rax*4 + 0x24], ecx
mov ecx, dword [r8]
test edx, edx
jne 0x14003782a
and ecx, 0xfff0fffe
jmp 0x14003784a
cmp edx, 1
jne 0x140037837
and ecx, 0xff0ffffb
jmp 0x14003784a
cmp edx, 2
jne 0x140037844
and ecx, 0xf0ffffef
jmp 0x14003784a
and ecx, 0xfffffbf
mov eax, ecx
mov dword [r8], ecx
shr eax, 2
or eax, ecx
shr eax, 2
or eax, ecx
shr eax, 2
or eax, ecx
test al, 1
jne 0x140037869
btr ecx, 8
mov dword [r8], ecx
mov rcx, rbx
mov edi, 0xc000071c
call fcn.140037340
test sil, sil
jne 0x14003789a
test al, al
je 0x1400378cb
mov rax, qword [rbx]
lea r8, [rsp + 0x2f0]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x68]
jmp 0x1400378b4
test al, al
je 0x1400378cb
mov rax, qword [rbx]
lea r8, [rsp + 0x20]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rax + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x60]
mov edi, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbx + 8], eax
je 0x1400378cb
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, edi
mov rcx, qword [rsp + 0x960]
xor rcx, rsp
call fcn.14009a9c0
lea r11, [rsp + 0x970]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140039e10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x1402a2cf8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x60], r8
mov r15, rdx
mov r10, rcx
mov qword [rsp + 0x68], rcx
mov rax, qword [rsp + 0xf0]
xor ebx, ebx
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x70]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0x50], rcx
cmp byte [r10 + 0x15], bl
je 0x140039ea9
cmp rdx, 0x7fffffff
jae 0x140039ea9
mov rax, qword gs:[0x30]
mov dword [rax + 0x1250], ebx
mov qword [rsp + 0x20], rcx
mov rcx, qword [r10 + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
jmp 0x14003a020
call fcn.14000b930
mov rbp, rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], bl
mov r8d, 0x1a
lea rdx, str.NtWow64ReadVirtualMemory64
lea rcx, [rsp + 0x30]
call fcn.14000c110
nop
call fcn.1400287c0
lea r12, [rbp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x30]
mov rdi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x48]
cmp r14, 0x10
cmovae rcx, rdi
movabs rdx, 0xcbf29ce484222325
mov rsi, qword [rsp + 0x40]
test rsi, rsi
je 0x140039f35
movabs r8, 0x100000001b3
movzx eax, byte [rbx + rcx]
xor rdx, rax
imul rdx, r8
inc rbx
cmp rbx, rsi
jb 0x140039f22
mov rcx, qword [rbp + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r13, qword [rbp + 8]
cmp rbx, r13
je 0x140039fdd
mov rbp, qword [rax + rcx*8]
nop dword [rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140039f72
mov rdx, qword [rdx]
lea rcx, [rsp + 0x30]
cmp r14, 0x10
cmovae rcx, rdi
cmp rsi, rax
jne 0x140039f90
mov r8, rsi
call fcn.1400b75e0
test eax, eax
je 0x140039f9b
cmp rbx, rbp
je 0x140039fdd
mov rbx, qword [rbx + 8]
jmp 0x140039f60
test rbx, rbx
je 0x140039fdd
cmp rbx, r13
je 0x140039fdd
mov rbx, qword [rbx + 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x140039fe6
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rdx, r15
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx + 8]
call rbx
mov ebx, eax
jmp 0x140039feb
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
cmp r14, 0x10
jb 0x14003a01e
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003a016
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003a041
mov rcx, rdi
call fcn.14009aa1c
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14009a9c0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1400c88c8
int3
Function at 0x14003a050
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x1402a2cf8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x60], r8
mov r15, rdx
mov r10, rcx
mov qword [rsp + 0x68], rcx
mov rax, qword [rsp + 0xf0]
xor ebx, ebx
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x70]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0x50], rcx
cmp byte [r10 + 0x15], bl
je 0x14003a0e9
cmp rdx, 0x7fffffff
jae 0x14003a0e9
mov rax, qword gs:[0x30]
mov dword [rax + 0x1250], ebx
mov qword [rsp + 0x20], rcx
mov rcx, qword [r10 + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
jmp 0x14003a260
call fcn.14000b930
mov rbp, rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], bl
mov r8d, 0x1b
lea rdx, str.NtWow64WriteVirtualMemory64
lea rcx, [rsp + 0x30]
call fcn.14000c110
nop
call fcn.1400287c0
lea r12, [rbp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x30]
mov rdi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x48]
cmp r14, 0x10
cmovae rcx, rdi
movabs rdx, 0xcbf29ce484222325
mov rsi, qword [rsp + 0x40]
test rsi, rsi
je 0x14003a175
movabs r8, 0x100000001b3
movzx eax, byte [rbx + rcx]
xor rdx, rax
imul rdx, r8
inc rbx
cmp rbx, rsi
jb 0x14003a162
mov rcx, qword [rbp + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [rbp + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
mov r13, qword [rbp + 8]
cmp rbx, r13
je 0x14003a21d
mov rbp, qword [rax + rcx*8]
nop dword [rax]
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14003a1b2
mov rdx, qword [rdx]
lea rcx, [rsp + 0x30]
cmp r14, 0x10
cmovae rcx, rdi
cmp rsi, rax
jne 0x14003a1d0
mov r8, rsi
call fcn.1400b75e0
test eax, eax
je 0x14003a1db
cmp rbx, rbp
je 0x14003a21d
mov rbx, qword [rbx + 8]
jmp 0x14003a1a0
test rbx, rbx
je 0x14003a21d
cmp rbx, r13
je 0x14003a21d
mov rbx, qword [rbx + 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14003a226
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rdx, r15
mov rcx, qword [rsp + 0x68]
mov rcx, qword [rcx + 8]
call rbx
mov ebx, eax
jmp 0x14003a22b
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
cmp r14, 0x10
jb 0x14003a25e
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003a256
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003a281
mov rcx, rdi
call fcn.14009aa1c
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14009a9c0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1400c88c8
int3