joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400bce70
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x1401b08f0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x1400bce90
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x1400bce98
ret
cmp word [rdx + 0x18], 0x20b
jne 0x1400bce90
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x1400bcee0
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x1400bced7
test rcx, rcx
je 0x1400bce90
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x1400bcec8
xor eax, eax
ret

Function at 0x1400bcef0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1401b08f0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400bcf0f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400bcf18
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x1400bcf30
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1401b08f0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400bcf50
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400bcf58
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400bcf50
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x1400bcf50
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x1400bcfa4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400bcfb0
add rdx, 0x28
cmp rdx, r9
jne 0x1400bcf90
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x1400bcfc0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x1401b08f0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x1400bcfe2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x1400bcff0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400bcfe2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x1400bcfe2
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x1400bcfe2
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x1400bd045
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x1400bd058
add rdx, 0x28
cmp r10, rdx
jne 0x1400bd030
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x1400bd067
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x1400bd077
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400bd04e
test ecx, ecx
jg 0x1400bd060
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x180002da0
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x180002dd2
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x180002dd2
nop word cs:[rax + rax]
jmp 0x180002dd0
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a80]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a7c], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x180002ea8
mov rsi, r10
test r8b, r8b
je 0x180002ec0
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002e40
test r9b, r9b
je 0x180002ed0
sub rsi, rcx
je 0x180002ea4
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x180002ea0
test ebp, ebp
jne 0x180002ea0
add rbx, 1
cmp rsi, rbx
jne 0x180002e60
jmp 0x180002ea4
test ebp, ebp
jne 0x180002e2c
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x180002ec0
jmp 0x180002ed0
Function at 0x100d72620
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x100d7262d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x100d7263d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x100d72625
lea eax, [rcx + 1]
jmp 0x100d7264b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x100d7265e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x100d72644
sub eax, 3
jb 0x100d7267e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x100d726cd
sar eax, 1
movsxd rbp, eax
jb 0x100d726b4
jmp 0x100d7268c
add ebx, ebx
jne 0x100d7268a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x100d726b4
inc ecx
add ebx, ebx
jne 0x100d7269a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x100d726b4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x100d726ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x100d7269c
add ecx, 2
jmp 0x100d726b9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.100d725e2
jmp 0x100d7262d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x4994c0
mov dl, 0xa2
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x100d72719
cmp rsi, rcx
jae 0x100d72721
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x100d72700
cmp al, 0x8f
ja 0x100d72700
cmp byte [rsi - 2], 0xf
je 0x100d72706
sub al, 0xe8
cmp al, 1
ja 0x100d726ea
cmp rsi, rcx
jae 0x100d72721
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x100d726f0
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x100d72721
lodsb al, byte [rsi]
jmp 0x100d72700
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xd6e000]
mov eax, dword [rdi]
or eax, eax
je 0x100d7277e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xd8b148]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x100d7272e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x100d72778
mov qword [rbx], rax
add rbx, 8
jmp 0x100d7274e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.100d72801], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.100d72801
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x100d727f1
sub rsp, 0xffffffffffffff80
jmp 0x1000032a0
Function at 0x141049ec8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x141049ed2
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x141049efb
pop rbp
sub rbp, 0x33
sub rbp, 0x1049ec8
sub rsp, 0x20
jmp 0x141049f1a
mov rax, 0x1049ec8
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x3c462f1d
xor byte [rax], dl
inc rax
dec rcx
jne 0x141049f39
jmp 0x141049f50
push rbp
xchg esp, eax
hlt
Function at 0x140002080
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
lea rbp, [rcx + 2]
mov qword [rsp + 0x20], 4
mov qword [rsp + 0x18], rbp
nop word [rax + rax]
movzx r9d, byte [rbp - 1]
movzx edx, byte [rbp - 2]
movzx ebx, r9b
movzx r8d, byte [rbp]
movzx eax, dl
shr al, 7
add bl, bl
movzx ecx, byte [rbp + 1]
movzx eax, al
imul eax, eax, 0x1b
mov byte [rsp + 0x78], r9b
mov byte [rsp + 0x88], dl
add dl, dl
mov byte [rsp + 0x80], r8b
xor dl, al
mov dword [rsp + 8], eax
movzx eax, dl
movzx esi, dl
shr al, 7
add sil, sil
movzx eax, al
imul eax, eax, 0x1b
xor sil, al
mov dword [rsp + 4], eax
movzx eax, r9b
movzx r9d, r8b
shr al, 7
add r9b, r9b
movzx eax, al
imul r15d, eax, 0x1b
xor bl, r15b
movzx eax, bl
movzx r10d, bl
shr al, 7
add r10b, r10b
movzx eax, al
imul eax, eax, 0x1b
xor r10b, al
mov dword [rsp + 0x10], eax
movzx eax, r8b
shr al, 7
movzx eax, al
imul r12d, eax, 0x1b
xor r9b, r12b
mov dword [rsp + 0xc], r12d
movzx eax, r9b
movzx r8d, r9b
shr al, 7
xor r9b, dl
movzx eax, al
add r8b, r8b
imul ebp, eax, 0x1b
movzx eax, cl
shr al, 7
add cl, cl
movzx eax, al
imul eax, eax, 0x1b
xor r8b, bpl
xor cl, al
mov dword [rsp + 0x14], eax
movzx eax, cl
movzx r13d, cl
shr al, 7
add r13b, r13b
movzx eax, al
imul r14d, eax, 0x1b
xor r13b, r14b
xor r9b, r13b
movzx eax, r13b
shr al, 7
xor r9b, r8b
movzx eax, al
xor r9b, r10b
imul edi, eax, 0x1b
xor r9b, sil
movzx eax, r8b
mov byte [rsp], r9b
shr al, 7
movzx eax, al
imul r11d, eax, 0x1b
movzx eax, r10b
shr al, 7
xor r13b, cl
movzx eax, al
xor r13b, r8b
imul r9d, eax, 0x1b
xor r13b, r10b
mov r12, qword [rsp + 0x18]
xor r13b, bl
movzx ebx, byte [rsp + 0x80]
xor r13b, sil
mov rcx, qword [rsp + 0x18]
movzx eax, sil
shr al, 7
movzx esi, byte [rsp + 0x78]
mov r8d, dword [rsp + 0x10]
movzx r10d, byte [rcx + 1]
movzx eax, al
imul edx, eax, 0x1b
movzx eax, byte [rsp]
xor al, byte [rsp + 0x78]
xor al, byte [rsp + 0x88]
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, bpl
xor al, r15b
xor al, byte [rsp + 4]
xor al, byte [rsp + 8]
xor al, byte [r12 + 1]
xor al, byte [rsp + 0x80]
xor al, byte [rsp + 0x78]
mov byte [r12 - 2], al
movzx eax, r13b
mov r12d, dword [rsp + 0xc]
xor al, bl
xor al, sil
xor r13b, r10b
add al, al
xor al, dl
xor al, r9b
xor al, r11b
xor al, dil
xor al, r14b
xor al, r12b
xor al, r8b
xor al, r15b
movzx r15d, byte [rsp + 0x88]
xor r13b, r15b
xor al, r10b
add r13b, r13b
xor al, bl
xor r13b, dl
xor al, r15b
mov byte [rcx - 1], al
xor r13b, r9b
mov eax, dword [rsp + 0x14]
xor r13b, r11b
movzx ecx, byte [rsp]
xor r13b, dil
xor cl, r10b
xor r13b, r14b
xor cl, bl
xor r13b, al
add cl, cl
xor r13b, r8b
xor cl, dl
xor cl, r9b
xor cl, r11b
xor cl, dil
xor cl, al
xor cl, bpl
mov rbp, qword [rsp + 0x18]
xor cl, r12b
xor cl, byte [rsp + 4]
xor cl, r10b
xor cl, sil
xor cl, r15b
xor r13b, byte [rsp + 8]
mov byte [rbp], cl
xor r13b, bl
xor r13b, sil
xor r13b, r15b
mov byte [rbp + 1], r13b
add rbp, 4
sub qword [rsp + 0x20], 1
mov qword [rsp + 0x18], rbp
jne 0x1400020b0
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002620
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
sub rsi, rcx
mov r9d, 4
nop dword [rax]
mov r8d, 4
nop word [rax + rax]
movzx eax, byte [rsi + rcx + 0xe0]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x140002660
sub r9, 1
jne 0x140002650
mov bpl, 0xd
lea rdi, [rsi + 0xd0]
lea r14, [0x14005abd0]
nop word [rax + rax]
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x140002700
inc r8
sub r9, 1
jne 0x1400026f0
mov rax, rbx
lea r8d, [rdx + 4]
nop word [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x140002740
sub r8, 1
jne 0x140002730
mov rcx, rbx
call fcn.140002080
sub rdi, 0x10
add bpl, 0xff
jne 0x140002690
movzx eax, byte [rbx + 9]
mov r8, rbx
movzx ecx, byte [rbx + 0xd]
mov r9d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax + rax]
mov rcx, r8
mov edx, 4
nop dword [rax + rax]
movzx eax, byte [rcx]
lea rcx, [rcx + 4]
movzx eax, byte [rax + r14]
mov byte [rcx - 4], al
sub rdx, 1
jne 0x1400027e0
inc r8
sub r9, 1
jne 0x1400027d0
lea edx, [r9 + 4]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rbx + rsi]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140002810
sub rdx, 1
jne 0x140002802
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140013310
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov eax, dword [rcx]
xor r9d, r9d
mov rsi, r8
mov r11, rdx
mov r10, rcx
mov ebx, r9d
mov edi, r9d
test eax, eax
jle 0x14001335b
mov rdx, r8
nop word [rax + rax]
movzx eax, byte [rdx]
lea rdi, [rdi + 1]
mov rcx, qword [r11]
lea rdx, [rdx + 4]
inc ebx
xor byte [rcx + rdi - 1], al
mov eax, dword [r10]
cmp ebx, eax
jl 0x140013340
mov r8d, r9d
mov rbx, r9
test eax, eax
jle 0x14001338e
lea rdx, [rsi + 1]
nop dword [rax]
movzx eax, byte [rdx]
lea rbx, [rbx + 1]
mov rcx, qword [r11 + 8]
lea rdx, [rdx + 4]
inc r8d
xor byte [rcx + rbx - 1], al
mov eax, dword [r10]
cmp r8d, eax
jl 0x140013370
mov r8d, r9d
mov rbx, r9
test eax, eax
jle 0x1400133be
lea rdx, [rsi + 2]
nop dword [rax]
movzx eax, byte [rdx]
lea rbx, [rbx + 1]
mov rcx, qword [r11 + 0x10]
lea rdx, [rdx + 4]
inc r8d
xor byte [rcx + rbx - 1], al
mov eax, dword [r10]
cmp r8d, eax
jl 0x1400133a0
mov r8, r9
test eax, eax
jle 0x1400133ec
lea rdx, [rsi + 3]
nop dword [rax]
movzx eax, byte [rdx]
lea r8, [r8 + 1]
mov rcx, qword [r11 + 0x18]
lea rdx, [rdx + 4]
inc r9d
xor byte [rcx + r8 - 1], al
cmp r9d, dword [r10]
jl 0x1400133d0
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1400136d0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov eax, dword [rcx]
lea rdi, [0x14005add0]
xor r8d, r8d
mov r11, rdx
mov r10, rcx
mov r9d, r8d
mov ebx, r8d
test eax, eax
jle 0x14001372b
nop word [rax + rax]
mov rdx, qword [r11]
lea rbx, [rbx + 1]
inc r9d
movzx eax, byte [rdx + rbx - 1]
mov ecx, eax
and eax, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [rdx + rbx - 1], al
mov eax, dword [r10]
cmp r9d, eax
jl 0x140013700
mov r9d, r8d
mov rbx, r8
test eax, eax
jle 0x14001376c
nop word [rax + rax]
mov rdx, qword [r11 + 8]
lea rbx, [rbx + 1]
inc r9d
movzx eax, byte [rdx + rbx - 1]
mov ecx, eax
and eax, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [rdx + rbx - 1], al
mov eax, dword [r10]
cmp r9d, eax
jl 0x140013740
mov r9d, r8d
mov rbx, r8
test eax, eax
jle 0x1400137ac
nop word [rax + rax]
mov rdx, qword [r11 + 0x10]
lea rbx, [rbx + 1]
inc r9d
movzx eax, byte [rdx + rbx - 1]
mov ecx, eax
and eax, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [rdx + rbx - 1], al
mov eax, dword [r10]
cmp r9d, eax
jl 0x140013780
mov r9, r8
test eax, eax
jle 0x1400137de
mov rdx, qword [r11 + 0x18]
lea r9, [r9 + 1]
inc r8d
movzx eax, byte [rdx + r9 - 1]
mov ecx, eax
and eax, 0xf
and rcx, 0xfffffffffffffff0
add rcx, rax
movzx eax, byte [rcx + rdi]
mov byte [rdx + r9 - 1], al
cmp r8d, dword [r10]
jl 0x1400137b3
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x140013fb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10d, dword [rsp + 0x30]
xor r11d, r11d
test r10d, r10d
je 0x1400140b9
mov qword [rsp + 0x10], rbx
cmp r10d, 0x40
jb 0x140014082
lea eax, [r10 - 1]
mov ecx, eax
lea rbx, [rax + r9]
add rax, r8
cmp r9, rax
ja 0x140013fef
cmp rbx, r8
jae 0x140014082
lea rax, [rcx + rdx]
cmp r9, rax
ja 0x140014001
cmp rbx, rdx
jae 0x140014082
mov ebx, r10d
mov qword [rsp], rdi
and ebx, 0xffffffc0
mov edi, 0x20
movdqu xmm0, xmmword [r11 + r8]
lea eax, [rdi - 0x10]
movdqu xmm1, xmmword [r11 + rdx]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax + r8]
movdqu xmmword [r11 + r9], xmm1
add r11d, 0x40
movdqu xmm1, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + r9], xmm1
mov eax, edi
movdqu xmm0, xmmword [rax + r8]
movdqu xmm1, xmmword [rax + rdx]
pxor xmm1, xmm0
movdqu xmmword [rax + r9], xmm1
lea eax, [rdi + 0x10]
add edi, 0x40
movdqu xmm1, xmmword [rax + rdx]
movdqu xmm0, xmmword [rax + r8]
pxor xmm1, xmm0
movdqu xmmword [rax + r9], xmm1
cmp r11d, ebx
jb 0x140014010
mov rdi, qword [rsp]
cmp r11d, r10d
jae 0x1400140b4
sub rdx, r8
mov eax, r11d
add rax, r8
sub r9, r8
sub r10d, r11d
mov r8d, r10d
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rdx + rax]
xor cl, byte [rax]
mov byte [r9 + rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x1400140a0
mov rbx, qword [rsp + 0x10]
add rsp, 8
ret
Function at 0x1400152d0
Capabilities:
Connect to http server
Create http request

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x140063030]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
mov edx, 0x39
lea rcx, [rsp + 0x60]
call fcn.1400140c0
nop
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
add r8, rdx
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.1400146e0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x140015374
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001536f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001545a
call fcn.14002453c
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
xor edi, edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 1]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov qword [rbx + 8], rax
mov rdx, qword [rsp + 0x58]
cmp rdx, 8
jb 0x1400153dc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400153d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015454
call fcn.14002453c
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14001542d
lea rdx, [0x140068888]
cmp qword [0x1400688a0], 8
cmovae rdx, qword [0x140068888]
mov r8d, 0x1bb
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rdi
xor r9d, r9d
call qword [sym.imp.WININET.dll_InternetConnectW]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x14001542d
mov byte [rbx], 1
cmp byte [rbx], 1
sete al
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400244f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
call fcn.14002ae98
int3
call fcn.14002ae98
int3
Function at 0x14001a8c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x130
mov rax, qword [0x140063030]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov ebp, edx
mov rbx, r8
add ebp, 0xfffffff0
mov r14, rcx
test rcx, rcx
je 0x14001a8f7
movups xmm0, xmmword [rcx]
jmp 0x14001a90a
call fcn.14002fb7c
mov dword [rax], 0x16
call fcn.14002ae78
xorps xmm0, xmm0
mov rdx, qword [rbx]
lea rcx, [rsp + 0x20]
add r14, 0x10
call fcn.140001c10
movaps xmmword [rsp + 0x110], xmm0
mov rbx, r14
mov esi, ebp
test ebp, ebp
je 0x14001a999
mov qword [rsp + 0x158], rdi
lea rdi, [rsp + 0x110]
sub rdi, r14
dec rsi
shr rsi, 4
inc rsi
nop dword [rax]
movups xmm0, xmmword [rbx]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140002620
mov ecx, 0x10
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x14001a970
sub rdi, 0x10
movaps xmmword [rsp + 0x110], xmm0
sub rsi, 1
jne 0x14001a950
mov rdi, qword [rsp + 0x158]
lea eax, [rbp - 1]
xor ecx, ecx
movzx eax, byte [rax + r14]
sub ebp, eax
cmp eax, 0x10
cmova ebp, ecx
mov eax, ebp
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1400244f0
mov rbx, qword [rsp + 0x160]
add rsp, 0x130
pop r14
pop rsi
pop rbp
ret
Function at 0x14001a9e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x13e0
call fcn.1400251d0
sub rsp, rax
mov rax, qword [0x140063030]
xor rax, rsp
mov qword [rsp + 0x13d0], rax
mov r15, r8
mov r14, rdx
mov r12, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x28], xmm1
mov qword [rsp + 0x38], rdi
lea ecx, [rdi + 0x10]
call fcn.140024544
mov qword [rsp + 0x28], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 0x38], rcx
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rsp + 0x30], rcx
mov ebx, 1
mov dword [rsp + 0x20], ebx
call fcn.140023c08
mov dword [rsp + 0x13c4], 0xffffffff
mov dword [rsp + 0x44], eax
nop dword [rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, ebx
mov dword [rsp + rbx*4 + 0x44], eax
inc rbx
cmp rbx, 0x270
jb 0x14001aa70
mov dword [rsp + 0x40], 0x270
nop word [rax + rax]
lea rcx, [rsp + 0x40]
call fcn.14001c560
mov rcx, qword [rsp + 0x28]
mov byte [rdi + rcx], al
inc rdi
cmp rdi, 0x10
jl 0x14001aaa0
mov rsi, qword [rsp + 0x28]
mov r12, qword [r12]
mov rax, qword [r15]
test rax, rax
je 0x14001abc0
mov ebp, dword [r14 + 0x10]
test rsi, rsi
je 0x14001aae1
movups xmm0, xmmword [rsi]
movups xmmword [rax], xmm0
jmp 0x14001aaf7
xorps xmm0, xmm0
movups xmmword [rax], xmm0
call fcn.14002fb7c
mov dword [rax], 0x16
call fcn.14002ae78
cmp qword [r14 + 0x18], 0x10
jb 0x14001ab01
mov r14, qword [r14]
mov rcx, qword [r15]
add rcx, 0x10
mov r9, rbp
mov r8, r14
mov rdx, rbp
call fcn.14001c6f0
mov eax, ebp
and eax, 0xf
mov edi, 0x10
sub edi, eax
movzx eax, bpl
and eax, 0xf
mov r8d, 0x10
sub r8, rax
mov rcx, qword [r15]
add rcx, 0x10
add rcx, rbp
mov edx, edi
call fcn.140026e20
mov rdx, r12
lea rcx, [rsp + 0x40]
call fcn.140001c10
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x130], xmm0
mov rbx, qword [r15]
add rbx, 0x10
lea r8, [rsp + 0x130]
lea eax, [rdi + rbp]
mov edi, eax
test eax, eax
je 0x14001abbb
dec rdi
shr rdi, 4
inc rdi
nop dword [rax]
mov rax, rbx
sub r8, rbx
mov edx, 0x10
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x14001ab90
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140002320
mov r8, rbx
add rbx, 0x10
sub rdi, 1
jne 0x14001ab80
mov rsi, qword [rsp + 0x28]
test rsi, rsi
je 0x14001abf6
mov rdx, qword [rsp + 0x38]
sub rdx, rsi
mov rax, rsi
cmp rdx, 0x1000
jb 0x14001abee
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ac22
mov rcx, rsi
call fcn.14002453c
mov rcx, qword [rsp + 0x13d0]
xor rcx, rsp
call fcn.1400244f0
lea r11, [rsp + 0x13e0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.14002ae98
int3