joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140015e70
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.14001148d
movzx eax, al
test eax, eax
jne 0x140015e90
mov ecx, 7
call fcn.1400113f2
nop
mov byte [rsp + 0x20], 0
call fcn.140011406
mov byte [rsp + 0x21], al
cmp dword [0x140025ba8], 1
jne 0x140015eb4
mov ecx, 7
call fcn.1400113f2
nop
jmp 0x140015f0c
cmp dword [0x140025ba8], 0
jne 0x140015f07
mov dword [0x140025ba8], 1
lea rdx, [0x14001e660]
lea rcx, [0x14001e330]
call fcn.14001120d
test eax, eax
je 0x140015ee8
mov eax, 0xff
jmp 0x140016011
lea rdx, [0x14001e220]
lea rcx, [section..rdata]
call fcn.1400113fc
mov dword [0x140025ba8], 2
jmp 0x140015f0c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400113d9
call fcn.140011348
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140015f69
mov rcx, qword [rsp + 0x30]
call fcn.1400111ae
movzx eax, al
test eax, eax
je 0x140015f69
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14002c020]
nop
call fcn.140011389
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140015f9d
mov rcx, qword [rsp + 0x38]
call fcn.1400111ae
movzx eax, al
test eax, eax
je 0x140015f9d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.14001144c
nop
call fcn.1400160c0
mov dword [rsp + 0x28], eax
call fcn.140011325
movzx eax, al
test eax, eax
jne 0x140015fbc
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140015fcb
call fcn.140011456
nop
xor edx, edx
mov cl, 1
call fcn.140011195
mov eax, dword [rsp + 0x28]
jmp 0x140016011
add rsp, 0x68
ret
Function at 0x140f44058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140f441df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140f44089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f4406f
add dl, dl
jne 0x140f44096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f440f6
xor eax, eax
add dl, dl
jne 0x140f440a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140f441ad
add dl, dl
jne 0x140f440b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f440c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f440d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f440dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140f440ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140f4407e
mov eax, 1
add dl, dl
jne 0x140f44106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140f44113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f440fb
sub eax, ebx
mov ebx, 1
jne 0x140f4414c
mov ecx, 1
add dl, dl
jne 0x140f4412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f4413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f44123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f4407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140f44168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140f44175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140f4415d
cmp eax, 0x7d00
jae 0x140f4419b
cmp eax, 0x500
jb 0x140f44196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f4407e
cmp eax, 0x7f
ja 0x140f4419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140f4407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140f441d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140f4407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140007140
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1030
call fcn.14000bdb0
sub rsp, rax
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rsi, rdx
xor edi, edi
lea rdx, [0x14002d824]
call fcn.1400039e0
mov rbx, rax
test rax, rax
je 0x1400071a2
lea rdx, [0x14002d91c]
mov rcx, rsi
call fcn.1400039e0
mov rsi, rax
mov rcx, rbx
test rax, rax
jne 0x1400071ac
call fcn.14000f544
mov eax, 0xffffffff
jmp 0x140007241
call fcn.14000f5dc
test eax, eax
jne 0x14000722f
nop word [rax + rax]
mov r9, rbx
lea rcx, [rsp + 0x20]
mov edx, 1
mov r8d, 0x1000
call fcn.14000f894
test rax, rax
je 0x140007216
mov r9, rsi
lea rcx, [rsp + 0x20]
mov r8, rax
mov edx, 1
call fcn.14000ffd4
test rax, rax
je 0x140007211
mov rcx, rsi
call fcn.14000f608
test eax, eax
jne 0x140007211
mov rcx, rbx
call fcn.14000f5dc
test eax, eax
je 0x1400071c0
jmp 0x14000722f
mov rcx, rsi
jmp 0x140007225
mov rcx, rbx
call fcn.14000f608
test eax, eax
je 0x14000722f
mov rcx, rbx
call fcn.1400181f4
mov edi, 0xffffffff
mov rcx, rbx
call fcn.14000f544
mov rcx, rsi
call fcn.14000f544
mov eax, edi
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.14000bab0
lea r11, [rsp + 0x1030]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400073e0
Capabilities:
Read file on windows

Disassembly:
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r12, rcx
mov rsi, r8
mov ecx, 0x2000
mov r14, rdx
xor r13d, r13d
call fcn.140015e24
mov r15, rax
test rax, rax
je 0x1400074f3
xor edx, edx
mov r8d, 2
mov rcx, r12
call fcn.14000fbcc
test eax, eax
js 0x1400074f3
mov rcx, r12
mov qword [rsp + 0x50], rbx
call fcn.1400187a4
mov rbx, rax
cmp rax, rsi
jb 0x1400074ee
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rdi
nop dword [rax + rax]
cmp rbx, 0x2000
lea rbp, [rbx - 0x2000]
cmovb rbp, r13
sub rbx, rbp
cmp rbx, rsi
jb 0x1400074e4
xor r8d, r8d
mov rdx, rbp
mov rcx, r12
call fcn.14000fbcc
test eax, eax
js 0x1400074e4
mov r9, r12
mov r8, rbx
mov edx, 1
mov rcx, r15
call fcn.14000f894
cmp rax, rbx
jne 0x1400074e4
sub rbx, rsi
add rbx, 1
je 0x1400074cb
lea rdi, [r15 - 1]
add rdi, rbx
nop dword [rax]
nop dword [rax + rax]
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.14002ba80
test eax, eax
je 0x1400074dd
dec rdi
sub rbx, 1
jne 0x1400074b0
lea rbx, [rsi - 1]
add rbx, rbp
test rbp, rbp
jne 0x140007450
jmp 0x1400074e4
lea r13, [rbp - 1]
add r13, rbx
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rcx, r15
call fcn.140015e10
mov rax, r13
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x14000c7ec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x14002d228]
test rax, rax
je 0x14000c836
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000c836
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000c836
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000c836
cmp dword [rcx + 0x84], 0xe
jbe 0x14000c836
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000c838
xor al, al
add rsp, 0x28
ret

Function at 0x14001a840
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14001a8af
xor ecx, ecx
call qword [0x14002d228]
test rax, rax
je 0x14001a8af
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001a8af
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001a8af
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001a8af
cmp dword [rcx + 0x84], 0xe
jbe 0x14001a8af
cmp dword [rcx + 0xf8], 0
je 0x14001a8af
mov ecx, ebx
call fcn.14001a960
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14001a73c
nop
cmp dword [rbp + 0x20], 0
je 0x14001a8fd
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14001a908
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x14001a840

Function at 0x14001aa44
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14001a840

Function at 0x14002ade0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14002ae08
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14002ae08
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001ae0
Capabilities:
Check os version
Parse pe header
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x88
mov rax, qword gs:[0x60]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140001b0b
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x118], 0xa
je 0x140001b12
xor eax, eax
jmp 0x140001d19
mov dword [rsp + 0x48], 7
mov dword [rsp + 0x20], 0x15
mov dword [rsp + 0x34], 0
mov ecx, 5
call fcn.140001e60
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 1
je 0x140001b50
cmp dword [rsp + 0x30], 2
je 0x140001b58
jmp 0x140001b60
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x50]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
sub rax, 0x10
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x140001b9e
xor eax, eax
jmp 0x140001d19
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140001bbe
xor eax, eax
jmp 0x140001d19
mov rax, qword [rsp + 0x58]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
cmp dword [rax], 0x4550
je 0x140001beb
xor eax, eax
jmp 0x140001d19
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x60]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x140001c1f
xor eax, eax
jmp 0x140001d19
mov dword [rsp + 0x4c], 7
mov dword [rsp + 0x68], 0x15
mov dword [rsp + 0x6c], 0
mov ecx, 5
call fcn.140001e60
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 1
je 0x140001c5d
cmp dword [rsp + 0x38], 2
je 0x140001c65
jmp 0x140001c6d
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x20], 0
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x28]
mov qword [0x1400030f0], rax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x18]
mov dword [0x1400030e8], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [0x1400030d8], rax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [0x1400030d0], rax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [0x1400030e0], rax
cmp qword [0x1400030f0], 0
je 0x140001d0e
cmp dword [0x1400030e8], 0
je 0x140001d0e
cmp qword [0x1400030d8], 0
je 0x140001d0e
cmp qword [0x1400030d0], 0
je 0x140001d0e
cmp qword [0x1400030e0], 0
jne 0x140001d14
xor eax, eax
jmp 0x140001d19
mov eax, 1
add rsp, 0x88
ret
Function at 0x140001d30
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov dword [rsp + 0x20], 0xffffffff
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x40], 7
mov dword [rsp + 0x2c], 0x15
mov dword [rsp + 0x3c], 0
mov ecx, 5
call fcn.140001e60
mov dword [rsp + 0x3c], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 1
je 0x140001d8f
cmp dword [rsp + 0x34], 2
je 0x140001d97
jmp 0x140001d9f
mov dword [rsp + 0x2c], 0
mov dword [rsp + 0x2c], 0
mov dword [rsp + 0x2c], 0
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
movsx eax, byte [rcx + rax]
test eax, eax
je 0x140001e52
movsxd rax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x60]
movsx eax, byte [rcx + rax]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x30], 1
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x24], 7
jmp 0x140001e03
mov eax, dword [rsp + 0x24]
dec eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jl 0x140001e38
mov eax, dword [rsp + 0x20]
and eax, 1
imul eax, eax, 0xffffffff
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x20]
shr eax, 1
mov ecx, dword [rsp + 0x48]
and ecx, 0xedb88320
xor eax, ecx
mov dword [rsp + 0x20], eax
jmp 0x140001df9
mov eax, dword [rsp + 0x30]
add eax, 4
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
jmp 0x140001da7
mov eax, dword [rsp + 0x20]
not eax
add rsp, 0x58
ret
Function at 0x140001780
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x30
mov al, 0x24
mov byte [rsp + 0x27], 0x4b
mov dl, byte [rsp + 0x27]
sub al, dl
mov byte [rsp + 0x17], al
mov al, byte [rsp + 0x27]
add al, 0xd7
mov r8d, dword [rsp + 0x28]
imul r9d, r8d, 0x7301249c
mov dl, byte [rsp + 0x17]
mov dword [rsp + 0x28], r9d
cmp al, dl
mov qword [rsp + 8], rcx
mov dword [rsp + 4], r8d
ja 0x1400017be
mov ax, word [rsp + 0x2e]
mov word [rsp + 0x2e], ax
mov rcx, qword [rsp + 8]
mov word [rcx], 0x5a4d
mov dword [rcx + 0x3c], 0xd8
mov edx, dword [rsp + 4]
mov dword [rsp + 0x28], edx
mov dword [rcx + 0xd8], 0x4550
add rsp, 0x30
ret
Function at 0x140002650
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov word [rsp + 0xa0], 0x2da9
mov qword [rsp + 0x98], 0x614d5d0b
mov dword [rsp + 0x94], 0x65e8c72a
mov word [rsp + 0x7e], 0x336e
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xa8], rax
mov r10d, dword [rsp + 0x94]
mov r11d, r10d
xor r11d, 0x65e8c72a
cmp r9d, r11d
mov qword [rsp + 0x68], rdx
mov dword [rsp + 0x64], r9d
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x44], r10d
je 0x140002847
mov rax, qword [rsp + 0x48]
or rax, rax
mov cx, word [rsp + 0x7e]
mov dx, word [rsp + 0xa0]
add dx, 0x6838
mov qword [rsp + 0xa8], rax
cmp dx, cx
jb 0x14000285b
jmp 0x1400028a3
mov eax, 0x100
mov ecx, dword [rsp + 0x78]
add ecx, 1
mov edx, dword [rsp + 0x74]
mov r8w, word [rsp + 0xb6]
mov r9, qword [rsp + 0x88]
mov word [rsp + 0xb6], r8w
mov dword [rsp + 0x40], eax
mov eax, ecx
mov dword [rsp + 0x3c], edx
cdq
mov ecx, dword [rsp + 0x40]
idiv ecx
mov qword [rsp + 0xa8], 0xffffffffbb9a5917
movsxd r10, edx
mov r11b, byte [rsp + 0xa3]
or r11b, 0xcf
retf
iretd
mov byte [rsp + 0xa3], r11b
mov rsi, qword [rsp + 0x50]
mov r11b, byte [rsi + r10]
movzx edi, r11b
mov r8w, word [rsp + 0xb6]
imul r8w, word [rsp + 0xb6]
mov ebx, dword [rsp + 0x3c]
add ebx, edi
mov word [rsp + 0xb6], r8w
mov eax, ebx
mov dword [rsp + 0x38], edx
cdq
idiv ecx
movsxd r14, edx
mov bpl, byte [rsi + r14]
mov ebx, dword [rsp + 0x44]
mov dword [rsp + 0xa4], ebx
mov byte [rsi + r10], bpl
mov byte [rsi + r14], r11b
mov r11b, byte [rsp + 0xa3]
mov byte [rsp + 0xa3], r11b
movzx r15d, byte [rsi + r10]
add r15d, edi
and r15d, 0xff
mov edi, r15d
mov r10d, edi
mov r11b, byte [rsi + r10]
mov r10, qword [rsp + 0x58]
xor r11b, byte [r10 + r9]
mov r14, qword [rsp + 0x68]
mov byte [r14 + r9], r11b
add r9, 1
mov r12, qword [rsp + 0x80]
mov qword [rsp + 0x88], r9
mov r8w, word [rsp + 0xb6]
xor r8w, word [rsp + 0xb6]
mov word [rsp + 0xb6], r8w
mov edi, dword [rsp + 0x38]
mov dword [rsp + 0x78], edi
mov r13, qword [rsp + 0x48]
or r13, 0x5930fe5b
mov qword [rsp + 0xa8], r13
mov dword [rsp + 0x74], edx
cmp r9, r12
jne 0x140002704
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
mov ecx, eax
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffdf275967
mov qword [rsp + 0x30], rcx
mov r8, qword [rsp + 0x30]
mov qword [rsp + 0x28], rdx
mov rdx, r8
mov r8, qword [rsp + 0x28]
call fcn.140002bc0
mov qword [rsp + 0x20], rax
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x98]
mov ecx, dword [rsp + 0x64]
mov edx, ecx
mov r8d, edx
xor rax, 0x614d5d0b
mov qword [rsp + 0x80], r8
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x74], 0
jmp 0x140002704
Function at 0x1400038d0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xc8
movabs rax, 0x196b15878fef6e48
mov byte [rsp + 0xbf], 0x65
mov dword [rsp + 0xb0], 0x27ed9690
mov word [rsp + 0xae], 0xf77d
mov r8d, dword [rsp + 0xb0]
mov r9w, word [rsp + 0xb4]
mov qword [rsp + 0xc0], rax
mov r10d, r8d
add r10d, 0xf2457082
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xc0], 0x2ead8e6
mov dword [rsp + 0x9c], r10d
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x48], rcx
mov word [rsp + 0x46], r9w
mov dword [rsp + 0x40], r8d
mov qword [rsp + 0x38], rax
call fcn.140001ca0
mov r8d, 0x2db8a347
mov ecx, r8d
mov rax, qword [rax + 0x18]
mov rdx, rax
add rdx, 0x20
mov rax, qword [rax + 0x20]
mov r11, qword [rsp + 0x38]
sub rcx, r11
mov qword [rsp + 0xc0], rcx
mov qword [rsp + 0xa0], 0
cmp rax, rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rdx
je 0x140003c65
jmp 0x140003c17
mov dword [rsp + 0x5c], 0x61a3dab6
cmp dword [rsp + 0x5c], 0x3a93c8a5
jb 0x140003a61
jmp 0x140003d11
mov rax, qword [rsp + 0x50]
cmp rax, 0
setne cl
and cl, 1
mov byte [rsp + 0x5b], cl
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x78], rdx
jmp 0x140003ba0

Function at 0x140004060
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x38
lea rax, [fcn.140004060]
mov byte [rsp + 0x2f], 0x6d
mov qword [rsp + 0x10], rax
jmp 0x1400040b8
mov al, 0x1d
mov cl, byte [rsp + 0x2f]
mov rdx, qword [rsp + 8]
mov qword [rsp + 0x18], rdx
cmp al, cl
jne 0x1400040f4
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 8]
movsxd rax, dword [rax + 0x3c]
mov byte [rsp + 0x2e], 0x15
mov word [rsp + 0x36], 0x2f9f
cmp dword [rcx + rax], 0x4550
jne 0x140004077
mov rax, qword [rsp + 8]
add rsp, 0x38
ret
mov ax, 0x9c13
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 8], rcx
mov word [rsp + 6], 0xafa3
mov dl, byte [rsp + 0x2e]
mov r8b, 0x24
mov word [rsp + 4], ax
mov al, dl
mul r8b
mov r9w, word [rsp + 6]
mov byte [rsp + 0x2e], al
mov r10w, word [rsp + 4]
cmp r10w, r9w
jne 0x14000410c
mov rax, qword [rsp + 0x18]
add rax, 0xfffffffffffff000
and rax, 0xfffffffffffff000
mov qword [rsp + 0x10], rax
jmp 0x1400040b8
mov ax, word [rsp + 0x36]
or ax, word [rsp + 0x36]
mov word [rsp + 0x36], ax
mov rcx, qword [rsp + 8]
mov ax, word [rcx]
mov edx, dword [rsp + 0x30]
xor edx, 0x2781b673
mov dword [rsp + 0x30], edx
cmp ax, 0x5a4d
je 0x14000408b
jmp 0x140004077
Function at 0x140091d10
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
call fcn.140092a00
mov qword [0x14022d988], rax
test rax, rax
je 0x140091ecc
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140091dc7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140091dc7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x1ed217bd
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140091dc2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140091da0
cmp r8d, 0xdf58b42e
je 0x140091dcc
test r9d, r9d
jne 0x140091d80
mov rax, qword [rax]
jmp 0x140091d50
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, [0x14022d998]
mov rcx, qword [0x14022d988]
add rax, r10
call rax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140091e87
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140091e87
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x1200b16
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140091e82
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x140091e60
cmp r8d, 0xa2962b83
je 0x140091e8c
test r9d, r9d
jne 0x140091e40
mov rax, qword [rax]
jmp 0x140091e10
mov ecx, dword [rbx + 0x24]
lea r8, [0x14022d998]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov r9d, 2
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor edx, edx
mov rcx, qword [0x14022d988]
add rax, r10
call rax
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
mov byte [0x14022d7b3], 1
add rsp, 0x28
ret
Function at 0x140092a00
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1400ba040]
xor rax, rsp
mov qword [rsp + 0x80], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xor edi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], di
mov dword [rsp + 0x40], ecx
movabs rdx, 0x63f4924df362c055
mov qword [rsp + 0x20], rdx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rcx, 0x7618d0203758d6aa
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rdx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x78], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x30]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140092ab0
lea rcx, [rsp + 0x48]
cmp rdx, 7
ja 0x140092ae2
mov qword [rsp + 0x58], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
lea rdx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rbx + 0x48], di
jmp 0x140092aec
lea r9, [rsp + 0x30]
call fcn.1400912e0
mov qword [rsp + 0x68], rdi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140092b86
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140092b86
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x3182304b
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140092b81
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140092b60
cmp r8d, 0x698c4e47
je 0x140092b8b
test r9d, r9d
jne 0x140092b40
mov rax, qword [rax]
jmp 0x140092b10
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r8d, dword [rcx + rax*4]
add r8, r10
lea rdx, [rsp + 0x40]
lea rcx, [0x140092690]
call r8
mov rbx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
cmp rdx, 7
jbe 0x140092bfc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140092bf7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140092bf7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140099170
mov rax, rbx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140099150
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret