joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002610
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140004390]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002630
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002638
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002630
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x140002630
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140002684
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140002690
add rdx, 0x28
cmp r9, rdx
jne 0x140002670
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x1400026a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x140004390]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x1400026c4
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
cmp dword [rcx], 0x4550
je 0x1400026d0
mov rax, r9
ret
cmp word [rcx + 0x18], 0x20b
jne 0x1400026c4
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x1400026c4
movzx edx, word [rcx + 0x14]
movzx r10d, word [rcx + 6]
lea rdx, [rcx + rdx + 0x18]
test r10w, r10w
je 0x1400026c4
lea ecx, [r10 - 1]
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x14000271c
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x140002730
add rdx, 0x28
cmp rdx, r10
jne 0x140002708
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140002740
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x14000274e
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140002725
test r8d, r8d
jg 0x140002738
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140002d4d
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
add dh, al
shr byte [r9 + 0xf], 1
mov dh, 0x45
rol byte [rdi + rsi*8], 1
movzx eax, al
shl byte [rbp + 0x48], 0x8b
add byte [rax - 0x75], cl
sbb byte [rax - 0x7d], cl
shl byte [rax], 0xeb
invalid
cmp r8w, r9w
je 0x140002c40
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140002be0
add rdx, 2
cmp r8w, r9w
je 0x140002bf0
jmp 0x140002be0
mov rdx, qword [rax + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
sub rsp, 0x20
mov r8d, 0xdd833843
call fcn.1400063b0
mov rcx, rsi
call rax
add rsp, 0x20
xor ebx, ebx
nop word cs:[rax + rax]
cmp byte [rdi + rbx], 0
lea rbx, [rbx + 1]
jne 0x140002c70
mov byte [rbp - 0x30], 0x69
movzx eax, byte [rbp - 0x30]
add al, 0xf7
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
jmp 0x140002ca6
cmp r8w, r9w
je 0x140002d00
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140002ca0
add rdx, 2
cmp r8w, r9w
je 0x140002cb0
jmp 0x140002ca0
mov rdx, qword [rax + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
sub rsp, 0x20
mov r8d, 0xdd833843
call fcn.1400063b0
mov rcx, rsi
call rax
add rsp, 0x20
mov byte [rbp - 0x30], 0x69
movzx eax, byte [rbp - 0x30]
add al, 0xf7
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
jmp 0x140002d46
cmp r8w, r9w
je 0x140002da0
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140002d40
add rdx, 2
cmp r8w, r9w
je 0x140002d50
jmp 0x140002d40
mov rdx, qword [rax + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
sub rsp, 0x20
mov r8d, 0x7080d354
call fcn.1400063b0
mov ecx, 0xfffffff5
call rax
add rsp, 0x20
mov r14, rax
mov byte [rbp - 0x30], 0x69
movzx eax, byte [rbp - 0x30]
add al, 0xf7
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
jmp 0x140002dfa
cmp r8w, r9w
je 0x140002b70
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop word cs:[rax + rax]
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140002df0
add rdx, 2
cmp r8w, r9w
je 0x140002e10
jmp 0x140002df0
Function at 0x140002dc4
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
add dh, al
shr byte [r9 + 0xf], 1
mov dh, 0x45
rol byte [rdi + rsi*8], 1
movzx eax, al
shl byte [rbp + 0x48], 0x8b
add byte [rax - 0x75], cl
sbb byte [rax - 0x7d], cl
shl byte [rax], 0xeb
invalid
cmp r8w, r9w
je 0x140002c40
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140002be0
add rdx, 2
cmp r8w, r9w
je 0x140002bf0
jmp 0x140002be0
mov rdx, qword [rax + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
sub rsp, 0x20
mov r8d, 0xdd833843
call fcn.1400063b0
mov rcx, rsi
call rax
add rsp, 0x20
xor ebx, ebx
nop word cs:[rax + rax]
cmp byte [rdi + rbx], 0
lea rbx, [rbx + 1]
jne 0x140002c70
mov byte [rbp - 0x30], 0x69
movzx eax, byte [rbp - 0x30]
add al, 0xf7
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
jmp 0x140002ca6
cmp r8w, r9w
je 0x140002d00
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140002ca0
add rdx, 2
cmp r8w, r9w
je 0x140002cb0
jmp 0x140002ca0
mov rdx, qword [rax + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
sub rsp, 0x20
mov r8d, 0xdd833843
call fcn.1400063b0
mov rcx, rsi
call rax
add rsp, 0x20
mov byte [rbp - 0x30], 0x69
movzx eax, byte [rbp - 0x30]
add al, 0xf7
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
jmp 0x140002d46
cmp r8w, r9w
je 0x140002da0
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140002d40
add rdx, 2
cmp r8w, r9w
je 0x140002d50
jmp 0x140002d40
mov rdx, qword [rax + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
sub rsp, 0x20
mov r8d, 0x7080d354
call fcn.1400063b0
mov ecx, 0xfffffff5
call rax
add rsp, 0x20
mov r14, rax
mov byte [rbp - 0x30], 0x69
movzx eax, byte [rbp - 0x30]
add al, 0xf7
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
jmp 0x140002dfa
cmp r8w, r9w
je 0x140002b70
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop word cs:[rax + rax]
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140002df0
add rdx, 2
cmp r8w, r9w
je 0x140002e10
jmp 0x140002df0
Function at 0x140002e0a
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
add dh, al
shr byte [r9 + 0xf], 1
mov dh, 0x45
rol byte [rdi + rsi*8], 1
movzx eax, al
shl byte [rbp + 0x48], 0x8b
add byte [rax - 0x75], cl
sbb byte [rax - 0x7d], cl
shl byte [rax], 0xeb
invalid
cmp r8w, r9w
je 0x140002c40
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140002be0
add rdx, 2
cmp r8w, r9w
je 0x140002bf0
jmp 0x140002be0
mov rdx, qword [rax + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
sub rsp, 0x20
mov r8d, 0xdd833843
call fcn.1400063b0
mov rcx, rsi
call rax
add rsp, 0x20
xor ebx, ebx
nop word cs:[rax + rax]
cmp byte [rdi + rbx], 0
lea rbx, [rbx + 1]
jne 0x140002c70
mov byte [rbp - 0x30], 0x69
movzx eax, byte [rbp - 0x30]
add al, 0xf7
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
jmp 0x140002ca6
cmp r8w, r9w
je 0x140002d00
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140002ca0
add rdx, 2
cmp r8w, r9w
je 0x140002cb0
jmp 0x140002ca0
mov rdx, qword [rax + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
sub rsp, 0x20
mov r8d, 0xdd833843
call fcn.1400063b0
mov rcx, rsi
call rax
add rsp, 0x20
mov byte [rbp - 0x30], 0x69
movzx eax, byte [rbp - 0x30]
add al, 0xf7
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
jmp 0x140002d46
cmp r8w, r9w
je 0x140002da0
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140002d40
add rdx, 2
cmp r8w, r9w
je 0x140002d50
jmp 0x140002d40
mov rdx, qword [rax + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
sub rsp, 0x20
mov r8d, 0x7080d354
call fcn.1400063b0
mov ecx, 0xfffffff5
call rax
add rsp, 0x20
mov r14, rax
mov byte [rbp - 0x30], 0x69
movzx eax, byte [rbp - 0x30]
add al, 0xf7
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
jmp 0x140002dfa
cmp r8w, r9w
je 0x140002b70
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop word cs:[rax + rax]
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140002df0
add rdx, 2
cmp r8w, r9w
je 0x140002e10
jmp 0x140002df0
Function at 0x140002e20
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
add dh, al
shr byte [r9 + 0xf], 1
mov dh, 0x45
rol byte [rdi + rsi*8], 1
movzx eax, al
shl byte [rbp + 0x48], 0x8b
add byte [rax - 0x75], cl
sbb byte [rax - 0x7d], cl
shl byte [rax], 0xeb
invalid
cmp r8w, r9w
je 0x140002c40
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140002be0
add rdx, 2
cmp r8w, r9w
je 0x140002bf0
jmp 0x140002be0
mov rdx, qword [rax + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
sub rsp, 0x20
mov r8d, 0xdd833843
call fcn.1400063b0
mov rcx, rsi
call rax
add rsp, 0x20
xor ebx, ebx
nop word cs:[rax + rax]
cmp byte [rdi + rbx], 0
lea rbx, [rbx + 1]
jne 0x140002c70
mov byte [rbp - 0x30], 0x69
movzx eax, byte [rbp - 0x30]
add al, 0xf7
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
jmp 0x140002ca6
cmp r8w, r9w
je 0x140002d00
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140002ca0
add rdx, 2
cmp r8w, r9w
je 0x140002cb0
jmp 0x140002ca0
mov rdx, qword [rax + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
sub rsp, 0x20
mov r8d, 0xdd833843
call fcn.1400063b0
mov rcx, rsi
call rax
add rsp, 0x20
mov byte [rbp - 0x30], 0x69
movzx eax, byte [rbp - 0x30]
add al, 0xf7
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
jmp 0x140002d46
cmp r8w, r9w
je 0x140002da0
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140002d40
add rdx, 2
cmp r8w, r9w
je 0x140002d50
jmp 0x140002d40
mov rdx, qword [rax + 0x20]
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
sub rsp, 0x20
mov r8d, 0x7080d354
call fcn.1400063b0
mov ecx, 0xfffffff5
call rax
add rsp, 0x20
mov r14, rax
mov byte [rbp - 0x30], 0x69
movzx eax, byte [rbp - 0x30]
add al, 0xf7
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
jmp 0x140002dfa
cmp r8w, r9w
je 0x140002b70
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop word cs:[rax + rax]
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140002df0
add rdx, 2
cmp r8w, r9w
je 0x140002e10
jmp 0x140002df0
Function at 0x140003126
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
nop word cs:[rax + rax]

Function at 0x140003152
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
add al, 0xf7
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
jmp 0x140003136
cmp r8w, r9w
je 0x140003190
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmp edx, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140003130
add rdx, 2
cmp r8w, r9w
je 0x140003140
jmp 0x140003130
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax + 0x3c]
lea rdx, [rcx + rax]
movzx r8d, word [rcx + rax + 0x14]
add rdx, r8
add rdx, 0x18
add rcx, rax
add rcx, 0x88
mov r8b, 1
jmp 0x1400031c3
inc r8b
lea r9d, [r8 - 1]
movzx r9d, r9b
shl r9d, 3
lea r9, [r9 + r9*4]
mov byte [rbp - 0x30], 0x54
mov byte [rbp + 0x18], 0x54
movzx r10d, byte [rbp + 0x18]
movzx r11d, byte [rbp - 0x30]
sub rsp, rdi
mov rbx, rsp
mov byte [rbx], r11b
mov ebx, r10d
xor bl, r10b
not bl
and bl, r11b
xor bl, r10b
movzx r11d, bl
mov r10d, dword [rdx + r9 + 0xc]
cmp dword [rcx + r11*8], r10d
jb 0x1400031c0
mov byte [rbp + 0x14], 0x54
mov byte [rbp + 0x1f], 0x54
movzx r11d, byte [rbp + 0x1f]
movzx ebx, byte [rbp + 0x14]
sub rsp, rdi
mov r15, rsp
mov edi, esp
mov byte [r15], bl
sub rsp, rdi
mov r14, rsp
mov byte [r14], r11b
movzx r14d, byte [r15]
not r14b
or bl, r11b
not r11b
or r11b, r14b
and r11b, bl
movzx r11d, r11b
add r10d, dword [r9 + rdx + 8]
cmp dword [rcx + r11*8], r10d
jae 0x1400031c0
mov byte [rbp - 0x30], 0x6f
mov byte [rbp + 0x18], 0x6f
movzx edx, byte [rbp + 0x18]
movzx r8d, byte [rbp - 0x30]
sub rsp, rdi
mov r9, rsp
mov byte [r9], r8b
mov r9d, edx
xor r9b, dl
not r9b
and r9b, r8b
xor r9b, dl
movzx edx, r9b
mov ecx, dword [rcx + rdx*8]
or al, 0xd1
mov r8d, dword [rcx + rax + 0x20]
add rcx, rax
add r8, rax
xor edx, edx
jmp 0x1400032a2
inc edx
movzx edx, dx
mov r9d, dword [r8 + rdx*4]
movzx r11d, byte [r9 + rax]
test r11b, r11b
je 0x1400032a0
add r9, rax
inc r9
mov r10d, 0xab43
nop
movsx r11d, r11b
sub rsp, rdi
mov rbx, rsp
mov dword [rbx], r10d
sub rsp, rdi
mov r14, rsp
mov dword [r14], r11d
mov ebx, dword [rbx]
not ebx
or r10d, r11d
not r11d
or r11d, ebx
and r11d, r10d
imul r10d, r11d, 0x127aa3
movzx r11d, byte [r9]
inc r9
test r11b, r11b
jne 0x1400032c0
cmp r10d, 0xdd833843
jne 0x1400032a0
mov r8d, dword [rcx + 0x1c]
mov ecx, dword [rcx + 0x24]
add rcx, rax
movzx ecx, word [rcx + rdx*2]
add r8, rax
mov edx, dword [r8 + rcx*4]
mov edx, dword [rax + rcx*4]
add rdx, rax
sub rsp, 0x20
mov rcx, rsi
call rdx
add rsp, 0x20
mov byte [rbp - 0x30], 0x69
movzx eax, byte [rbp - 0x30]
add al, 0xf7
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
Function at 0x14000317e
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
add al, 0xf7
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
jmp 0x140003136
cmp r8w, r9w
je 0x140003190
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmp edx, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140003130
add rdx, 2
cmp r8w, r9w
je 0x140003140
jmp 0x140003130
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax + 0x3c]
lea rdx, [rcx + rax]
movzx r8d, word [rcx + rax + 0x14]
add rdx, r8
add rdx, 0x18
add rcx, rax
add rcx, 0x88
mov r8b, 1
jmp 0x1400031c3
inc r8b
lea r9d, [r8 - 1]
movzx r9d, r9b
shl r9d, 3
lea r9, [r9 + r9*4]
mov byte [rbp - 0x30], 0x54
mov byte [rbp + 0x18], 0x54
movzx r10d, byte [rbp + 0x18]
movzx r11d, byte [rbp - 0x30]
sub rsp, rdi
mov rbx, rsp
mov byte [rbx], r11b
mov ebx, r10d
xor bl, r10b
not bl
and bl, r11b
xor bl, r10b
movzx r11d, bl
mov r10d, dword [rdx + r9 + 0xc]
cmp dword [rcx + r11*8], r10d
jb 0x1400031c0
mov byte [rbp + 0x14], 0x54
mov byte [rbp + 0x1f], 0x54
movzx r11d, byte [rbp + 0x1f]
movzx ebx, byte [rbp + 0x14]
sub rsp, rdi
mov r15, rsp
mov edi, esp
mov byte [r15], bl
sub rsp, rdi
mov r14, rsp
mov byte [r14], r11b
movzx r14d, byte [r15]
not r14b
or bl, r11b
not r11b
or r11b, r14b
and r11b, bl
movzx r11d, r11b
add r10d, dword [r9 + rdx + 8]
cmp dword [rcx + r11*8], r10d
jae 0x1400031c0
mov byte [rbp - 0x30], 0x6f
mov byte [rbp + 0x18], 0x6f
movzx edx, byte [rbp + 0x18]
movzx r8d, byte [rbp - 0x30]
sub rsp, rdi
mov r9, rsp
mov byte [r9], r8b
mov r9d, edx
xor r9b, dl
not r9b
and r9b, r8b
xor r9b, dl
movzx edx, r9b
mov ecx, dword [rcx + rdx*8]
or al, 0xd1
mov r8d, dword [rcx + rax + 0x20]
add rcx, rax
add r8, rax
xor edx, edx
jmp 0x1400032a2
inc edx
movzx edx, dx
mov r9d, dword [r8 + rdx*4]
movzx r11d, byte [r9 + rax]
test r11b, r11b
je 0x1400032a0
add r9, rax
inc r9
mov r10d, 0xab43
nop
movsx r11d, r11b
sub rsp, rdi
mov rbx, rsp
mov dword [rbx], r10d
sub rsp, rdi
mov r14, rsp
mov dword [r14], r11d
mov ebx, dword [rbx]
not ebx
or r10d, r11d
not r11d
or r11d, ebx
and r11d, r10d
imul r10d, r11d, 0x127aa3
movzx r11d, byte [r9]
inc r9
test r11b, r11b
jne 0x1400032c0
cmp r10d, 0xdd833843
jne 0x1400032a0
mov r8d, dword [rcx + 0x1c]
mov ecx, dword [rcx + 0x24]
add rcx, rax
movzx ecx, word [rcx + rdx*2]
add r8, rax
mov edx, dword [r8 + rcx*4]
mov edx, dword [rax + rcx*4]
add rdx, rax
sub rsp, 0x20
mov rcx, rsi
call rdx
add rsp, 0x20
mov byte [rbp - 0x30], 0x69
movzx eax, byte [rbp - 0x30]
add al, 0xf7
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
Function at 0x1400032c4
Capabilities:
Encrypt data using speck
Resolve function by parsing pe exports

Disassembly:
add al, 0xf7
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]
add rax, 0x20
jmp 0x140003136
cmp r8w, r9w
je 0x140003190
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
xor edx, edx
nop
movzx r9d, word [rcx + rdx]
lea r10d, [r9 - 0x41]
mov r8d, r9d
or r8d, 0x20
cmp r10w, 0x1a
cmp edx, 0x1a
cmovae r8d, r9d
movzx r10d, word [rdx + rsi]
lea r11d, [r10 - 0x41]
mov r9d, r10d
or r9d, 0x20
cmp r11w, 0x1a
cmovae r9d, r10d
test r8w, r8w
je 0x140003130
add rdx, 2
cmp r8w, r9w
je 0x140003140
jmp 0x140003130
mov rax, qword [rax + 0x20]
movsxd rcx, dword [rax + 0x3c]
lea rdx, [rcx + rax]
movzx r8d, word [rcx + rax + 0x14]
add rdx, r8
add rdx, 0x18
add rcx, rax
add rcx, 0x88
mov r8b, 1
jmp 0x1400031c3
inc r8b
lea r9d, [r8 - 1]
movzx r9d, r9b
shl r9d, 3
lea r9, [r9 + r9*4]
mov byte [rbp - 0x30], 0x54
mov byte [rbp + 0x18], 0x54
movzx r10d, byte [rbp + 0x18]
movzx r11d, byte [rbp - 0x30]
sub rsp, rdi
mov rbx, rsp
mov byte [rbx], r11b
mov ebx, r10d
xor bl, r10b
not bl
and bl, r11b
xor bl, r10b
movzx r11d, bl
mov r10d, dword [rdx + r9 + 0xc]
cmp dword [rcx + r11*8], r10d
jb 0x1400031c0
mov byte [rbp + 0x14], 0x54
mov byte [rbp + 0x1f], 0x54
movzx r11d, byte [rbp + 0x1f]
movzx ebx, byte [rbp + 0x14]
sub rsp, rdi
mov r15, rsp
mov edi, esp
mov byte [r15], bl
sub rsp, rdi
mov r14, rsp
mov byte [r14], r11b
movzx r14d, byte [r15]
not r14b
or bl, r11b
not r11b
or r11b, r14b
and r11b, bl
movzx r11d, r11b
add r10d, dword [r9 + rdx + 8]
cmp dword [rcx + r11*8], r10d
jae 0x1400031c0
mov byte [rbp - 0x30], 0x6f
mov byte [rbp + 0x18], 0x6f
movzx edx, byte [rbp + 0x18]
movzx r8d, byte [rbp - 0x30]
sub rsp, rdi
mov r9, rsp
mov byte [r9], r8b
mov r9d, edx
xor r9b, dl
not r9b
and r9b, r8b
xor r9b, dl
movzx edx, r9b
mov ecx, dword [rcx + rdx*8]
or al, 0xd1
mov r8d, dword [rcx + rax + 0x20]
add rcx, rax
add r8, rax
xor edx, edx
jmp 0x1400032a2
inc edx
movzx edx, dx
mov r9d, dword [r8 + rdx*4]
movzx r11d, byte [r9 + rax]
test r11b, r11b
je 0x1400032a0
add r9, rax
inc r9
mov r10d, 0xab43
nop
movsx r11d, r11b
sub rsp, rdi
mov rbx, rsp
mov dword [rbx], r10d
sub rsp, rdi
mov r14, rsp
mov dword [r14], r11d
mov ebx, dword [rbx]
not ebx
or r10d, r11d
not r11d
or r11d, ebx
and r11d, r10d
imul r10d, r11d, 0x127aa3
movzx r11d, byte [r9]
inc r9
test r11b, r11b
jne 0x1400032c0
cmp r10d, 0xdd833843
jne 0x1400032a0
mov r8d, dword [rcx + 0x1c]
mov ecx, dword [rcx + 0x24]
add rcx, rax
movzx ecx, word [rcx + rdx*2]
add r8, rax
mov edx, dword [r8 + rcx*4]
mov edx, dword [rax + rcx*4]
add rdx, rax
sub rsp, 0x20
mov rcx, rsi
call rdx
add rsp, 0x20
mov byte [rbp - 0x30], 0x69
movzx eax, byte [rbp - 0x30]
add al, 0xf7
movzx eax, al
mov rax, qword gs:[rax]
mov rax, qword [rax + 0x18]