joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455300
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4553d4
jb 0x455433
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004551e0
aeskeygenassist xmm1, xmm0, 1
call fcn.00455200
aeskeygenassist xmm1, xmm2, 2
call fcn.004551e0
aeskeygenassist xmm1, xmm0, 2
call fcn.00455200
aeskeygenassist xmm1, xmm2, 4
call fcn.004551e0
aeskeygenassist xmm1, xmm0, 4
call fcn.00455200
aeskeygenassist xmm1, xmm2, 8
call fcn.004551e0
aeskeygenassist xmm1, xmm0, 8
call fcn.00455200
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004551e0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00455200
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004551e0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00455200
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004551e0
jmp 0x4554a1
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.00455140
aeskeygenassist xmm1, xmm2, 2
call fcn.004551a0
aeskeygenassist xmm1, xmm2, 4
call fcn.00455140
aeskeygenassist xmm1, xmm2, 8
call fcn.004551a0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.00455140
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004551a0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.00455140
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004551a0
jmp 0x4554a1
aeskeygenassist xmm1, xmm0, 1
call fcn.00455100
aeskeygenassist xmm1, xmm0, 2
call fcn.00455100
aeskeygenassist xmm1, xmm0, 4
call fcn.00455100
aeskeygenassist xmm1, xmm0, 8
call fcn.00455100
aeskeygenassist xmm1, xmm0, 0x10
call fcn.00455100
aeskeygenassist xmm1, xmm0, 0x20
call fcn.00455100
aeskeygenassist xmm1, xmm0, 0x40
call fcn.00455100
aeskeygenassist xmm1, xmm0, 0x80
call fcn.00455100
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.00455100
aeskeygenassist xmm1, xmm0, 0x36
call fcn.00455100
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4554ae
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x4555e0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
shr rdx, 2
dec rdx
movdqu xmm15, xmmword [0x004db8f0]
movdqu xmm14, xmmword [0x004db900]
movdqu xmm0, xmmword [rsi]
movdqu xmm11, xmmword [rsi + 0x10]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x20]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x30]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x40]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x50]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x60]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x70]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x80]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x90]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xa0]
cmp rdx, 0xc
jb 0x4556cb
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xb0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xc0]
je 0x4556cb
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xd0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xe0]
aesenclast xmm0, xmm11
pshufb xmm0, xmm15
pshufd xmm11, xmm0, 0xff
movdqu xmm12, xmm0
psrad xmm11, 0x1f
pand xmm11, xmm14
psrld xmm12, 0x1f
pslldq xmm12, 4
pslld xmm0, 1
pxor xmm0, xmm11
pxor xmm0, xmm12
movdqu xmmword [rdi + 0xe0], xmm0
pshufd xmm1, xmm0, 0x4e
pxor xmm1, xmm0
movdqu xmmword [rdi + 0xf0], xmm1
movdqu xmm2, xmm0
movdqu xmm3, xmm1
mov rax, 7
movdqu xmm11, xmm2
movdqu xmm12, xmm2
movdqu xmm13, xmm3
pclmulqdq xmm11, xmm0, 0
pclmulqdq xmm12, xmm0, 0x11
pclmulqdq xmm13, xmm1, 0
pxor xmm13, xmm11
pxor xmm13, xmm12
movdqu xmm4, xmm13
pslldq xmm4, 8
psrldq xmm13, 8
pxor xmm11, xmm4
pxor xmm12, xmm13
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm11, xmm2
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm2, xmm11
pxor xmm2, xmm12
movdqu xmmword [rdi + 0xc0], xmm2
pshufd xmm3, xmm2, 0x4e
pxor xmm3, xmm2
movdqu xmmword [rdi + 0xd0], xmm3
dec rax
lea rdi, [rdi - 0x20]
jne 0x455730
ret
Function at 0x457340
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45740a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004026a0
xorps xmm15, xmm15
mov r14, qword [0x0057d248]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4573ef
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004658a0]
xor ebx, ebx
mov rcx, rdx
call fcn.00439ec0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004576a0
inc rbx
cmp rcx, rbx
jae 0x4573de
mov edi, 1
lea rsi, [0x004658a0]
call fcn.00439fa0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004dbbc8]
lea rsi, [0x004db810]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044a100
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00457340
Function at 0x140001450
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xb113a7bd
call fcn.1400027c0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140001490
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x296ec07
call fcn.1400027c0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400014d0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x514d8410
call fcn.1400027c0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140001510
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x5d87420c
call fcn.1400027c0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140001550
Capabilities:
Execute syscall

Disassembly:
push rcx
push rdx
push r8
push r9
mov ecx, 0x59f1507
call fcn.1400027c0
pop r9
pop r8
pop rdx
pop rcx
mov r10, rcx
syscall
ret

Function at 0x14000156c
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x1b950117
call fcn.1400027c0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140001870
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140002690
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140002690
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]
Function at 0x1400018e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140009294]
mov rbx, rcx
test esi, esi
jle 0x140001a10
mov rax, qword [0x140009298]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000192b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400019b5
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x140001910
mov rcx, rbx
call fcn.140002330
mov rdi, rax
test rax, rax
je 0x140001a32
mov rax, qword [0x140009298]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.140002470
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140009298]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001a17
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400019ae
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400019c0
add dword [0x140009294], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140009298]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400019ae
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140001870
nop dword [rax]
xor esi, esi
jmp 0x140001938
mov rax, qword [0x140009298]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140001870
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.140001870
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x140001fa0
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140009300]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400092e0]
test rbx, rbx
je 0x140001ffc
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x140001ff3
test rsi, rsi
je 0x140001ff3
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140001fd8
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x140002330
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140005ad0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002350
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002358
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002350
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400023ad
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400023a4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002350
add rax, 0x28
cmp rax, r9
jne 0x140002390
xor eax, eax
ret

Function at 0x1400023b0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140005ad0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400023cf
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400023d8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400023cf
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002470
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140005ad0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000248f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002498
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x140002830
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cmp dword [0x140008040], 0
jne 0x140002987
push r13
push r12
push rbp
push rdi
push rsi
push rbx
xor ebx, ebx
sub rsp, 0x28
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r8, qword [rax + 0x10]
xor eax, eax
mov rdx, qword [r8 + 0x30]
test rdx, rdx
je 0x140002899
movsxd rcx, dword [rdx + 0x3c]
mov ecx, dword [rdx + rcx + 0x88]
test ecx, ecx
je 0x140002891
lea rax, [rcx + rdx]
mov ecx, dword [rax + 0xc]
add rcx, rdx
cmp dword [rcx], 0x6c64746e
jne 0x140002891
cmp dword [rcx + 4], 0x6c642e6c
je 0x1400028a3
mov r8, qword [r8]
mov rbx, rdx
jmp 0x14000285e
test rax, rax
jne 0x1400028a6
jmp 0x140002978
mov rbx, rdx
mov ebp, dword [rax + 0x1c]
mov esi, dword [rax + 0x24]
xor r10d, r10d
lea r13, [0x140008044]
mov edx, dword [rax + 0x18]
mov eax, dword [rax + 0x20]
add rsi, rbx
add rbp, rbx
lea r11d, [rdx - 1]
add rax, rbx
lea rdi, [rax + r11*4]
add r11, r11
add r11, rsi
mov ecx, dword [rdi]
add rcx, rbx
cmp word [rcx], 0x775a
jne 0x140002909
mov eax, r10d
inc r10d
lea r12, [r13 + rax*8]
call fcn.140002800
mov dword [r12], eax
movzx eax, word [r11]
mov eax, dword [rbp + rax*4]
mov dword [r12 + 4], eax
cmp r10d, 0x1f4
je 0x14000291b
sub rdi, 4
lea rax, [r11 - 2]
cmp rsi, r11
je 0x14000291b
mov r11, rax
jmp 0x1400028d3
mov dword [0x140008040], r10d
lea r11, [0x140008044]
dec r10d
test r10d, r10d
jne 0x140002938
mov edx, 1
jmp 0x140002978
lea rax, [0x140008040]
xor edx, edx
lea ecx, [rdx + 1]
mov r8d, dword [rax + 8]
mov rdx, rcx
lea rcx, [r11 + rcx*8]
mov r9d, dword [rcx + 4]
cmp r9d, r8d
jae 0x14000296a
mov ebx, dword [rax + 4]
mov esi, dword [rcx]
mov dword [rax + 8], r9d
mov dword [rax + 4], esi
mov dword [rcx], ebx
mov dword [rcx + 4], r8d
add rax, 8
cmp edx, r10d
jb 0x140002941
dec r10d
jmp 0x14000292c
add rsp, 0x28
mov eax, edx
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov eax, 1
ret
Function at 0x14008a744
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [rsp + 4], r14b
lea rsp, [rsp + 3]
lea rsp, [rsp + 3]
jmp 0x14008a7c9
mov qword [rsp + 4], r11
mov qword [rsp + 3], r10
jmp 0x14008a72e
push r15w
mov byte [rsp], bl
jmp 0x14008a766
lea rsp, [rsp + 2]
mov qword [rsp + 0x30], r14
push r12w
jg 0x14008a793
mov byte [rsp], bl
push r15w
jmp 0x14008a76a

Function at 0x14008a750
Capabilities:
Execute anti-debugging instructions

Disassembly:
call fcn.14008a76f
movabs dword [reloc.mfc90.dll_Ordinal_5463], eax
std
or al, 0xbf
xor dword [rax], esi
xor ebp, dword [rdx]
push r15w
call fcn.14008a750

Function at 0x14008a76f
Capabilities:
Execute anti-debugging instructions

Disassembly:
movabs rbx, 0xffffffffc0072f2c
jmp 0x14008a798
mov word [rsp + 0xb], bp
lea rsp, [rsp + 8]
lea rsp, [rsp + 4]
mov qword [rsp + 0x30], r15
jmp 0x14008a7ae
push rbx
mov si, word [rsp]
jmp 0x14008a82f
lea rsp, [rsp + 0x30]
pushfq
jmp 0x140089d48
lea r14, [r9 + r9]
rdtsc
setb cl
not r8b
jmp 0x14008a817
mov edi, dword [rsp + 0x90]
jmp 0x14008a7e2
lea r13, [rsi*4]
not r8
jmp 0x14008a853
lea rsi, [rsp]
mov r12w, word [rsp]
mov r13, qword [rsp]
jmp 0x14008a801
setb dl
xchg rcx, r8
bsf edi, r9d
jo 0x14008a7f8
jno 0x14008a7f8
mov r8, rsp
mov r10b, al
cpuid
bswap rax
mov r11w, word [rsp]
jmp fcn.14008aadc
sub rsp, 0x240
jmp 0x14008a83d

Function at 0x14021c1bd
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
inc dword [0x14006a016]
pushfq
call fcn.140213d17
cmp dword [0x14006a016], 0
jmp 0x14021526b
lea rsp, [rsp + 0x10]
jmp 0x140215465
je 0x140213db8
jne 0x140215255
cmp eax, ebx
push rbx
invalid
pushfq
push word [rsp + 4]
pop qword [rsp]
mov byte [rsp], r14b
mov dword [rsp + 1], edi
mov dword [rsp], r8d
jmp fcn.14021538d
add rsp, 8
push cx
push r12
pop word [rsp + 2]
pop word [rsp + 2]
jmp 0x140215400
call 0x14021c003
jmp 0x14021c036
mov rax, qword [rax + riz]
mov rax, qword [rax + riz + 0x10]
push rax
jmp 0x14021bffe
pop rax
sub rax, 0x21c003
push rax
jmp 0x140213ded
mov rax, qword gs:[0x60]
mov rax, qword [rax + riz + 0x18]
mov rax, qword [rax + riz + 0x30]
jmp 0x14021c014
pop qword [rsp]
mov qword [rsp], rax
push qword [rsp + 1]
push word [rsp + 7]
lea rsp, [rsp + 1]
lea rsp, [rsp + 0x18]
jmp 0x14021c08a
jmp 0x14021c11d
Function at 0x140002510
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov r9, qword [rcx]
mov rax, rdx
mov rbx, rcx
mov rcx, rax
mov edx, 1
call fcn.140073870
sub qword [rbx + 0x20], rax
add rsp, 0x20
pop rbx
ret
Function at 0x140003fe0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, rdx
mov rbx, rcx
test rdx, rdx
je 0x140004009
mov r9, qword [rcx]
mov edx, 1
mov rcx, rax
lea r8d, [rdx + 3]
call fcn.140073870
sub qword [rbx + 0x20], rax
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140012af0
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
lea rcx, [0x140091910]
jmp 0x1403178e8

Function at 0x14001ed30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rsi, rdx
mov r14, rcx
mov qword [rcx + 0x18], 0xf
xor ebx, ebx
mov qword [rcx + 0x10], rbx
mov byte [rcx], bl
or r9, 0xffffffffffffffff
xor r8d, r8d
call fcn.140003560
nop
mov eax, dword [rsi + 0x20]
mov dword [r14 + 0x20], eax
mov eax, dword [rsi + 0x24]
mov dword [r14 + 0x24], eax
mov eax, dword [rsi + 0x28]
mov dword [r14 + 0x28], eax
mov eax, dword [rsi + 0x2c]
mov dword [r14 + 0x2c], eax
mov eax, dword [rsi + 0x30]
mov dword [r14 + 0x30], eax
mov eax, dword [rsi + 0x34]
mov dword [r14 + 0x34], eax
mov eax, dword [rsi + 0x38]
mov dword [r14 + 0x38], eax
mov eax, dword [rsi + 0x3c]
mov dword [r14 + 0x3c], eax
mov eax, dword [rsi + 0x40]
mov dword [r14 + 0x40], eax
movzx eax, word [rsi + 0x44]
mov word [r14 + 0x44], ax
movzx eax, byte [rsi + 0x46]
mov byte [r14 + 0x46], al
movzx eax, byte [rsi + 0x47]
mov byte [r14 + 0x47], al
lea rcx, [r14 + 0x48]
mov qword [rcx + 0x18], 0xf
mov qword [rcx + 0x10], rbx
mov byte [rcx], bl
lea rdx, [rsi + 0x48]
or r9, 0xffffffffffffffff
xor r8d, r8d
call fcn.140003560
nop
movups xmm0, xmmword [rsi + 0x68]
movups xmmword [r14 + 0x68], xmm0
movups xmm1, xmmword [rsi + 0x78]
movups xmmword [r14 + 0x78], xmm1
movups xmm0, xmmword [rsi + 0x88]
movups xmmword [r14 + 0x88], xmm0
movups xmm1, xmmword [rsi + 0x98]
movups xmmword [r14 + 0x98], xmm1
movups xmm0, xmmword [rsi + 0xa8]
movups xmmword [r14 + 0xa8], xmm0
movups xmm1, xmmword [rsi + 0xb8]
movups xmmword [r14 + 0xb8], xmm1
lea rdx, [rsi + 0xc8]
lea rcx, [r14 + 0xc8]
call fcn.14001f120
nop
mov eax, dword [rsi + 0xe0]
mov dword [r14 + 0xe0], eax
movzx eax, word [rsi + 0xe4]
mov word [r14 + 0xe4], ax
movzx eax, word [rsi + 0xe6]
mov word [r14 + 0xe6], ax
movzx eax, word [rsi + 0xe8]
mov word [r14 + 0xe8], ax
movzx eax, byte [rsi + 0xea]
mov byte [r14 + 0xea], al
movzx eax, byte [rsi + 0xeb]
mov byte [r14 + 0xeb], al
lea rdi, [r14 + 0xf0]
mov qword [rsp + 0x58], rdi
lea rdx, [rsi + 0xf0]
mov rcx, rdi
call fcn.1400043e0
nop
lea rdx, [rsi + 0x108]
lea rcx, [rdi + 0x18]
call fcn.1400043e0
mov eax, dword [rsi + 0x120]
mov dword [rdi + 0x30], eax
movzx eax, word [rsi + 0x128]
mov word [r14 + 0x128], ax
lea rdi, [r14 + 0x130]
mov qword [rsp + 0x58], rdi
lea rdx, [rsi + 0x130]
mov rcx, rdi
call fcn.140004450
nop
lea rdx, [rsi + 0x148]
lea rcx, [rdi + 0x18]
call fcn.14001f050
nop
mov rax, r14
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14001f9f9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rcx, rdx
je 0x14001fb20
push rsi
push r12
push r15
sub rsp, 0x40
mov rax, qword [0x1400a1a90]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rdi
lea rdi, [rcx + 6]
mov r15, r8
mov r12, rdx
mov rsi, rcx
cmp rdi, rdx
je 0x14001fb05
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x30], r14
lea rbp, [rdi - 6]
nop
mov eax, dword [rdi]
lea rcx, [rsp + 0x20]
mov rdx, rsi
mov dword [rsp + 0x20], eax
movzx eax, word [rdi + 4]
mov r14, rdi
mov word [rsp + 0x24], ax
call r15
test al, al
je 0x14001fa98
mov rax, rdi
cmp rsi, rdi
je 0x14001fa87
nop dword [rax]
mov ecx, dword [rax - 6]
sub rax, 6
mov dword [rax + 6], ecx
movzx ecx, word [rax + 4]
mov word [rax + 0xa], cx
cmp rax, rsi
jne 0x14001fa70
mov eax, dword [rsp + 0x20]
mov dword [rsi], eax
movzx eax, word [rsp + 0x24]
mov word [rsi + 4], ax
jmp 0x14001fae5
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov rbx, rbp
call r15
test al, al
je 0x14001fad4
nop word [rax + rax]
mov eax, dword [rbx]
lea rcx, [rsp + 0x20]
mov dword [r14], eax
movzx eax, word [rbx + 4]
mov word [r14 + 4], ax
mov r14, rbx
sub rbx, 6
mov rdx, rbx
call r15
test al, al
jne 0x14001fab0
mov eax, dword [rsp + 0x20]
mov dword [r14], eax
movzx eax, word [rsp + 0x24]
mov word [r14 + 4], ax
add rdi, 6
add rbp, 6
cmp rdi, r12
jne 0x14001fa40
mov r14, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140072e00
add rsp, 0x40
pop r15
pop r12
pop rsi
ret
Function at 0x1400b8560
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1400b858c
xor al, al
jmp 0x1400b86b0
movdqa xmm0, xmmword [0x1400d9aa0]
movdqa xmm1, xmmword [0x1400d9ab0]
mov rax, qword [r9]
xor r11d, r11d
mov qword [rsp + 0x50], r12
mov rcx, r8
movdqa xmmword [rsp], xmm0
movdqa xmm0, xmmword [0x1400d9ac0]
movdqa xmmword [rsp + 0x10], xmm1
lea r12, [r8 + rax]
mov edx, r11d
movdqa xmm1, xmmword [0x1400d9ad0]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm1
test rbx, rbx
je 0x1400b86a2
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1400b8609
mov r11d, 2
jmp 0x1400b862d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1400b8623
mov r11d, 1
jmp 0x1400b862d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, r12
ja 0x1400b86c5
mov eax, r10d
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov eax, r10d
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1400b866a
mov byte [rcx + 2], 0x3d
jmp 0x1400b867a
shr r10, 6
and r10d, 0x3f
movzx eax, byte [rsp + r10]
mov byte [rcx + 2], al
add rcx, 3
add r8, 3
test r11, r11
je 0x1400b868c
mov byte [rcx], 0x3d
jmp 0x1400b8693
movzx eax, byte [rsp + r9]
mov byte [rcx], al
inc rcx
inc r8
cmp rdx, rbx
jb 0x1400b85f0
sub rcx, rsi
mov al, 1
mov qword [rbp], rcx
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor al, al
jmp 0x1400b86ab

Function at 0x1402a8b07
Capabilities:
Execute anti-debugging instructions

Disassembly:
bswap edi
push rbx
xor dword [rsp], edi
add bl, 0xe2
setge bh
pop rbx
movsxd rdi, edi
cmp r13w, 0x5ccc
add r9, rdi
jmp 0x14029c4a8
pushfq
bts r10w, cx
rol r10w, 0xfd
push r14
dec rax
adc al, spl
push rbx
shr dx, cl
sal dh, cl
push rsi
push rcx
add dx, 0x258f
rdtsc
push r13
bts rsi, r8
push rdi
push rbp
lahf
btr bx, 0x88
push r15
movzx r10w, dil
cqo
shl dil, 0x8d
push r12
rol dil, 0xf6
sub r10w, di
cwde
push r8
rdtsc
bts edx, esi
sal ebx, 0x18
push r9
sal sil, cl
movsxd r9, r14d
movabs rcx, 0
setbe r10b
ror rbx, cl
push rcx
xor ebx, r8d
btr ax, r12w
movsx esi, r10w
mov r10d, dword [rsp + 0x90]
bswap bx
sub r9w, dx
neg si
add r10d, 0x655b278f
ror r10d, 3
bswap r10d
setge bh
dec rbx
dec r10d
lahf
rcl dil, cl
ror bh, cl
add r10, rcx
neg r9d
or dil, 0x4e
cmovae r9w, r8w
movabs rax, 0x100000000
xor sil, 0xee
adc r9b, bpl
lea r10, [r10 + rax]
mov rsi, rsp
btr r9d, 0x9e
sar dx, cl
btr bx, r13w
sub rsp, 0x180
rcl r9w, 0x98
not di
and edx, 0xeac25f1
and rsp, 0xfffffffffffffff0
mov rbx, r10
cmp bh, 0x72
movabs rdx, 0
sub rbx, rdx
ror r9d, cl
bt r9w, bx
test r14w, 0x619e
lea r9, [0x14020b175]
add dil, 0x37
sub r10, 4
neg edi
bt di, r12w
mov edi, dword [r10]
xor edi, ebx
jmp 0x1402ae794
jmp r9
push rdx
push r10
push rax
push r11
jmp 0x14020b05d
dec edi
xor edi, 0x83562f5
dec edi
jmp 0x1401dde45