joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140031d90
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
sub rsp, 0x188
mov rax, qword [0x1400a52f8]
xor rax, rsp
mov qword [rsp + 0x180], rax
mov eax, dword [0x1400a8ed8]
mov ecx, dword [0x1400a8940]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140031df0
lea rsi, [0x1400a8ed0]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.14005ecd0
mov rax, rsi
add rsp, 0x188
pop rdi
pop rsi
ret
lea rcx, [0x1400a8ed8]
call fcn.14005ea60
cmp dword [0x1400a8ed8], 0xffffffff
jne 0x140031dcc
lea rcx, [rsp + 0x64]
mov r8d, 0x118
xor edx, edx
call fcn.140061960
mov dword [rsp + 0x60], 0x11c
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [rsp + 0x2c], 0
mov ecx, dword [rsp + 0x64]
mov edx, dword [rsp + 0x68]
lea rax, [rsp + 0x2c]
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetProductInfo]
mov ecx, 0x80
call fcn.14005e874
mov rsi, rax
mov edi, dword [rsp + 0x2c]
mov eax, dword [0x1400a8f10]
mov ecx, dword [0x1400a8940]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140031eb1
lea r8, [0x1400a8ee0]
lea rdx, [rsp + 0x60]
mov rcx, rsi
mov r9d, edi
call fcn.140032060
mov qword [0x1400a8ed0], rsi
lea rcx, [0x1400a8ed8]
call fcn.14005eaf8
jmp 0x140031dcc
lea rcx, [0x1400a8f10]
call fcn.14005ea60
cmp dword [0x1400a8f10], 0xffffffff
jne 0x140031e82
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsp + 0x30]
movaps xmm1, xmmword [rsp + 0x40]
movaps xmm2, xmmword [rsp + 0x50]
movups xmmword [0x1400a8f00], xmm2
movups xmmword [0x1400a8ef0], xmm1
movups xmmword [0x1400a8ee0], xmm0
lea rcx, [0x1400a8f10]
call fcn.14005eaf8
jmp 0x140031e82

Function at 0x140031f40
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x60
mov rax, qword [0x1400a52f8]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov eax, dword [0x1400a8f10]
mov ecx, dword [0x1400a8940]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140031fc3
movzx eax, word [0x1400a8ee0]
cmp rax, 0xc
ja case.0x140031f92.1
xor esi, esi
lea rcx, [0x14003202c]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov esi, 2
jmp case.0x140031f92.0
mov esi, 4
jmp case.0x140031f92.0
mov esi, 1
jmp case.0x140031f92.0
mov esi, 3
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14005ecd0
mov eax, esi
add rsp, 0x60
pop rsi
ret
lea rcx, [0x1400a8f10]
call fcn.14005ea60
cmp dword [0x1400a8f10], 0xffffffff
jne 0x140031f75
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmm2, xmmword [rsp + 0x40]
movups xmmword [0x1400a8f00], xmm2
movups xmmword [0x1400a8ef0], xmm1
movups xmmword [0x1400a8ee0], xmm0
lea rcx, [0x1400a8f10]
call fcn.14005eaf8
jmp 0x140031f75
Function at 0x1400336f0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, r8
mov rax, qword [0x1400a52f8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x3c], 4
mov dword [rsp + 0x38], 4
mov dword [rsp + 0x34], 0
mov rcx, qword [rcx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14003376b
mov eax, dword [rsp + 0x3c]
add eax, 0xfffffffd
mov edi, 0x3f4
cmp eax, 1
ja 0x14003376b
cmp dword [rsp + 0x38], 4
jne 0x14003376b
mov eax, dword [rsp + 0x34]
mov dword [rsi], eax
xor edi, edi
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14005ecd0
mov eax, edi
add rsp, 0x48
pop rdi
pop rsi
ret

Function at 0x140033790
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rsi
push rdi
mov eax, 0x1048
call fcn.14005ec60
sub rsp, rax
mov rsi, r8
mov rax, qword [0x1400a52f8]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov dword [rsp + 0x3c], 1
mov dword [rsp + 0x38], 0x800
mov rcx, qword [rcx]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x840]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
jne 0x14003384a
mov eax, dword [rsp + 0x3c]
cmp eax, 2
je 0x14003380f
mov edi, 0x3f4
cmp eax, 1
jne 0x14003384a
lea rdx, [rsp + 0x840]
jmp 0x140033840
lea rcx, [rsp + 0x840]
lea rdx, [rsp + 0x40]
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x38], eax
add eax, 0xffffffff
mov edi, 0xea
cmp eax, 0x3ff
ja 0x14003384a
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14001bc5a
xor edi, edi
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14005ecd0
mov eax, edi
add rsp, 0x1048
pop rdi
pop rsi
ret

Function at 0x140035b50
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x1400a660c]
cmp ecx, 0xffffffff
je 0x140035b73
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
add eax, 0xffffffff
cmp eax, 2
setb al
jmp 0x140035b75
xor eax, eax
add rsp, 0x28
ret
Function at 0x140035b80
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, rdx
mov r15, rcx
mov ecx, dword [0x1400a660c]
cmp ecx, 0xffffffff
je 0x140035ba6
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x140035bab
call fcn.140035cc0
mov eax, dword [0x1400aad38]
mov ecx, dword [0x1400a8940]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x140035c73
mov rbx, qword [0x1400aad30]
mov rcx, rbx
call fcn.140030370
mov rcx, qword [0x1400a9520]
add rcx, 1
mov edx, 0x100
lea rax, [0x1400a9530]
nop word cs:[rax + rax]
movzx edi, cl
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x140035c2a
lea edi, [rcx + 1]
movzx edi, dil
lea rsi, [rdi + rdi*2]
cmp dword [rax + rsi*8], 0
je 0x140035c2a
add rcx, 2
add rdx, 0xfffffffffffffffe
jne 0x140035c00
jmp 0x140035c4f
lea rcx, [rax + rsi*8]
mov dword [rcx], 1
lea rcx, [rdi + rdi*2]
mov qword [rax + rcx*8 + 8], r14
mov qword [0x1400a9520], rdi
mov dword [r15], edi
mov eax, dword [rax + rcx*8 + 0x10]
mov dword [r15 + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [r15]
cmp eax, 0xffffffff
je 0x140035cb9
cmp eax, 0x100
jge 0x140035cbc
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
lea rcx, [0x1400aad38]
call fcn.14005ea60
cmp dword [0x1400aad38], 0xffffffff
jne 0x140035bd0
mov ecx, 8
call fcn.14005e874
mov rbx, rax
mov rcx, rax
call fcn.140030360
mov qword [0x1400aad30], rbx
lea rcx, [0x1400aad38]
call fcn.14005eaf8
jmp 0x140035bd0
int3
int3

Function at 0x140035cc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
mov eax, 0x1038
call fcn.14005ec60
sub rsp, rax
mov rax, qword [0x1400a52f8]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov ecx, dword [0x1400a660c]
mov dword [rsp + 0x2c], ecx
cmp ecx, 0xffffffff
jne 0x140035d58
lea rcx, [rsp + 0x2c]
call fcn.14003e000
test al, al
je 0x140035dd3
mov ecx, dword [rsp + 0x2c]
cmp ecx, 0xffffffff
jne 0x140035d36
lea rcx, [rsp + 0x2c]
call fcn.14003e000
test al, al
je 0x140035dd6
cmp dword [rsp + 0x2c], 0xffffffff
je 0x140035dd6
mov ecx, 0xffffffff
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [rsp + 0x2c]
mov eax, 0xffffffff
lock cmpxchg dword [0x1400a660c], ecx
mov ecx, dword [rsp + 0x2c]
je 0x140035d58
call sub.KERNEL32.dll_TlsFree
mov ecx, dword [0x1400a660c]
mov dword [rsp + 0x2c], ecx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x140035dd0
lea rsi, [rsp + 0x30]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call fcn.140061960
mov ecx, dword [rsp + 0x2c]
lea rdx, [rsp + 0x33]
call sub.KERNEL32.dll_TlsSetValue
mov ecx, 0x1000
call fcn.14005e8ec
mov rdi, rax
mov r8d, 0x1000
mov rcx, rax
mov rdx, rsi
call fcn.140061500
mov ecx, dword [rsp + 0x2c]
mov rdx, rdi
or rdx, 3
call sub.KERNEL32.dll_TlsSetValue
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.14005ecd0
mov rax, rdi
add rsp, 0x1038
pop rdi
pop rsi
ret
int3
int3
int3
Function at 0x140035eb0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x1400a660c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
je 0x140035ee0
movsxd rcx, dword [rsi]
shl rcx, 4
mov edx, dword [rax + rcx + 8]
cmp edx, dword [rsi + 4]
jne 0x140035ee0
mov rax, qword [rax + rcx]
jmp 0x140035ee2
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x140035ef0
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, rdx
mov rsi, rcx
mov ecx, dword [0x1400a660c]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
and rax, 0xfffffffffffffffc
jne 0x140035f18
test rdi, rdi
je 0x140035f31
call fcn.140035cc0
movsxd rcx, dword [rsi]
shl rcx, 4
mov qword [rax + rcx], rdi
mov ecx, dword [rsi + 4]
movsxd rdx, dword [rsi]
shl rdx, 4
mov dword [rax + rdx + 8], ecx
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400369b0
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r14, r8
mov r12, rdx
mov r13, rcx
lea r15, [rcx + 0x18]
mov rcx, r15
call fcn.140030370
mov r8, qword [r13 + 0x28]
test r8, r8
je 0x140036af8
mov rax, r12
shr rax, 0x20
lea edx, [r12*8]
add rdx, 8
xor rdx, rax
movabs rbx, 0x9ddfea08eb382d69
imul rdx, rbx
mov rcx, rdx
shr rcx, 0x2f
xor rdx, rax
xor rdx, rcx
imul rdx, rbx
mov rcx, rdx
shr rcx, 0x2f
xor rcx, rdx
imul rcx, rbx
mov rax, r8
shr rax, 1
movabs rdx, 0x5555555555555555
and rdx, rax
mov rax, r8
sub rax, rdx
movabs rdx, 0x3333333333333333
mov rbx, rax
and rbx, rdx
shr rax, 2
and rax, rdx
add rax, rbx
mov rdx, rax
shr rdx, 4
add rdx, rax
movabs rax, 0xf0f0f0f0f0f0f0f
and rax, rdx
movabs rdi, 0x101010101010101
imul rdi, rax
shr rdi, 0x38
cmp rdi, 1
jbe 0x140036a9b
mov rbx, rcx
cmp rcx, r8
jb 0x140036aa2
mov rax, rcx
xor edx, edx
div r8
mov rbx, rdx
jmp 0x140036aa2
lea rbx, [r8 - 1]
and rbx, rcx
mov rax, qword [r13 + 0x20]
mov rax, qword [rax + rbx*8]
test rax, rax
je 0x140036af8
mov rsi, qword [rax]
test rsi, rsi
je 0x140036af8
lea r9, [r8 - 1]
jmp 0x140036ace
cmp qword [rsi + 0x10], r12
je 0x140036b11
mov rsi, qword [rsi]
test rsi, rsi
je 0x140036af8
mov rax, qword [rsi + 8]
cmp rax, rcx
je 0x140036ac0
cmp edi, 1
jbe 0x140036af0
cmp rax, r8
jb 0x140036af3
xor edx, edx
div r8
mov rax, rdx
jmp 0x140036af3
and rax, r9
cmp rax, rbx
je 0x140036ac6
mov rcx, r15
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov rdi, qword [0x1400aaf18]
cmp rdi, 1
ja 0x140036b74
lea rcx, [0x1400aaf18]
call fcn.14003db50
test al, al
je 0x140036b6d
mov qword [0x1400aaf20], 0
lea rbx, [0x1400aaf18]
lea rdi, [0x1400aaf20]
mov rcx, rdi
xor edx, edx
call fcn.140035f40
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.14003dbf0
jmp 0x140036b74
mov rdi, qword [0x1400aaf18]
mov rcx, rdi
call fcn.140035eb0
mov rbx, rax
mov rcx, rdi
mov rdx, r14
call fcn.140035ef0
mov rcx, qword [r14 + 0x28]
mov rdx, r12
call qword [rcx + 8]
mov rcx, rdi
mov rdx, rbx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.140035ef0
Function at 0x14003e000
Capabilities:
Allocate thread local storage

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x14003e019
mov dword [rsi], eax
mov al, 1
jmp 0x14003e01b
xor eax, eax
add rsp, 0x20
pop rsi
ret

Function at 0x14003f530
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x1400aaf30]
mov ecx, dword [0x1400a8940]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14003f565
lea rcx, [0x1400aaf28]
add rsp, 0x28
jmp fcn.140035eb0
lea rcx, [0x1400aaf30]
call fcn.14005ea60
cmp dword [0x1400aaf30], 0xffffffff
jne 0x14003f555
mov qword [0x1400aaf28], 0
lea rcx, [0x1400aaf28]
xor edx, edx
call fcn.140035f40
lea rcx, [0x1400aaf30]
call fcn.14005eaf8
jmp 0x14003f555

Function at 0x140044560
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140044580
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret

Function at 0x1400445c0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400445e0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret

Function at 0x140044620
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140044643
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret
Function at 0x1400111f4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
jmp 0x140014430
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rcx, [0x14002b05c]
call fcn.140011668
call fcn.140011181
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 0x68], rax
movzx eax, word [rbp + 0x160]
mov r8, qword [rbp + 0x168]
mov edx, eax
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x1400144d9
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x1400144d9
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_LockResource]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
je 0x1400144d9
mov rdx, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rcx, qword [rbp + 0x170]
mov dword [rcx], eax
mov rax, qword [rbp + 0x48]
jmp 0x1400144e8
mov rax, qword [rbp + 0x170]
mov dword [rax], 0
xor eax, eax
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret

Function at 0x140011398
Capabilities:
Terminate process

Disassembly:
jmp 0x1400180d0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011492
Capabilities:
Parse pe header

Disassembly:
jmp 0x140019420
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140019440
xor al, al
jmp 0x1400194c1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140019453
xor al, al
jmp 0x1400194c1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001947d
xor al, al
jmp 0x1400194c1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140019491
xor al, al
jmp 0x1400194c1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400194a3
xor al, al
jmp 0x1400194c1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400194bf
xor al, al
jmp 0x1400194c1
mov al, 1
add rsp, 0x38
ret
Function at 0x140001000
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Encode data using xor
Inject apc
Resume thread
Use process replacement

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
movdqa xmm2, xmmword [str.ffffffffffffffff]
lea rdi, [0x140003040]
xor esi, esi
mov eax, 0x1c0
mov ecx, esi
nop word [rax + rax]
movdqu xmm0, xmmword [rcx + rdi]
movdqa xmm1, xmm2
pxor xmm0, xmm2
movdqu xmmword [rcx + rdi], xmm0
movdqu xmm0, xmmword [rcx + rdi + 0x10]
pxor xmm1, xmm0
movdqu xmmword [rcx + rdi + 0x10], xmm1
movdqu xmm0, xmmword [rcx + rdi + 0x20]
movdqa xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rcx + rdi + 0x20], xmm1
movdqu xmm0, xmmword [rcx + rdi + 0x30]
pxor xmm0, xmm2
movdqu xmmword [rcx + rdi + 0x30], xmm0
add rcx, 0x40
cmp rcx, rax
jl 0x140001030
nop
xor byte [rax + rdi], 0x66
inc rax
cmp rax, 0x1f7
jl 0x140001080
xorps xmm0, xmm0
mov dword [0x140003860], 0x68
xor eax, eax
lea rcx, str.C:WindowsSystem32calc.exe
mov dword [0x1400038c4], eax
xor r9d, r9d
mov qword [0x140003850], rax
xor r8d, r8d
lea rax, [0x140003840]
xor edx, edx
mov qword [rsp + 0x48], rax
lea rax, [0x140003860]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], esi
movups xmmword [0x140003864], xmm0
movups xmmword [0x140003874], xmm0
movups xmmword [0x140003884], xmm0
movups xmmword [0x140003894], xmm0
movups xmmword [0x1400038a4], xmm0
movups xmmword [0x1400038b4], xmm0
movups xmmword [0x140003840], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [0x140003840]
xor edx, edx
mov r9d, 0x1000
mov dword [rsp + 0x20], 0x40
mov r8d, 0x1f7
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rcx, qword [0x140003840]
mov r9d, 0x1f7
mov rdx, rax
mov qword [rsp + 0x20], rsi
mov r8, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rdx, qword [0x140003848]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [0x140003848]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rbx, qword [rsp + 0x60]
xor eax, eax
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140016660
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140016694
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140016680
ret
Function at 0x14002a0f0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x120
mov r11, rcx
lea r10, [rsp + 0x20]
mov ecx, reloc.WS2_32.dll_recv
xor r9b, r9b
nop dword [rax]
movzx edx, r9b
lea r10, [r10 + 4]
movzx eax, r9b
add r9b, 4
movzx r8d, byte [rax + r11 + 1]
movzx eax, byte [rdx + r11]
shl eax, 8
or r8d, eax
movzx eax, byte [rdx + r11 + 2]
shl r8d, 8
or r8d, eax
movzx eax, byte [rdx + r11 + 3]
shl r8d, 8
or r8d, eax
mov dword [r10 - 4], r8d
sub rcx, 1
jne 0x14002a120
mov r10b, reloc.WS2_32.dll_recv
lea r9, [rsp + 0x20]
nop dword [rax]
mov ecx, dword [r9 + 4]
lea r9, [r9 + 4]
mov r8d, ecx
movzx eax, r10b
rol r8d, 0xe
inc r10b
mov edx, dword [rsp + rax*4 + 0x18]
mov eax, ecx
shr ecx, 3
ror eax, 7
xor r8d, eax
mov eax, edx
xor r8d, ecx
rol eax, 0xd
mov ecx, edx
shr edx, 0xa
rol ecx, 0xf
xor ecx, eax
xor ecx, edx
add r8d, ecx
add r8d, dword [r9 + 0x20]
add r8d, dword [r9 - 4]
mov dword [r9 + 0x3c], r8d
cmp r10b, 0x40
jb 0x14002a170
movups xmm0, xmmword [r11 + 0x50]
lea rax, [r11 + 0x50]
xor esi, esi
movups xmm1, xmmword [rax + 0x10]
mov qword [rsp + 0x168], rax
movups xmmword [rsp], xmm0
mov r15d, dword [rsp + 8]
lea r13d, [rsi + 0x40]
mov r12d, dword [rsp + 4]
mov ebx, dword [rsp]
mov r11d, dword [rsp + 0xc]
movups xmmword [rsp + 0x10], xmm1
mov ebp, dword [rsp + 0x18]
mov r14d, dword [rsp + 0x14]
mov edi, dword [rsp + 0x10]
mov eax, dword [rsp + 0x1c]
nop word [rax + rax]
mov ecx, edi
lea rsi, [rsi + 4]
rol ecx, 7
mov r10d, edi
ror r10d, 0xb
mov edx, edi
xor r10d, ecx
not edx
and edx, ebp
mov ecx, edi
ror ecx, 6
mov r9d, r12d
xor r10d, ecx
mov r8d, r15d
mov ecx, r14d
and ecx, edi
xor edx, ecx
lea rcx, [0x140106890]
add r10d, edx
mov edx, ebx
add r10d, dword [rsi + rcx - 4]
mov ecx, ebx
add r10d, dword [rsp + rsi + 0x1c]
rol ecx, 0xa
add r10d, eax
ror edx, 0xd
mov eax, ebp
xor edx, ecx
mov ebp, r14d
mov ecx, ebx
mov r14d, edi
ror ecx, 2
lea edi, [r11 + r10]
xor edx, ecx
mov r11d, r15d
mov r15d, r12d
and r9d, r11d
mov r12d, ebx
mov ecx, r15d
or ecx, r11d
and ebx, ecx
lea ecx, [r10 + rdx]
or ebx, r9d
add ebx, ecx
sub r13, 1
jne 0x14002a210
lea r8, [rsp]
mov dword [rsp + 0x1c], eax
sub r8, qword [rsp + 0x160]
lea edx, [r13 + 8]
mov rax, qword [rsp + 0x168]
mov dword [rsp], ebx
mov dword [rsp + 0x10], edi
mov dword [rsp + 0x18], ebp
mov dword [rsp + 0x14], r14d
mov dword [rsp + 8], r15d
mov dword [rsp + 4], r12d
mov dword [rsp + 0xc], r11d
nop word [rax + rax]
mov ecx, dword [r8 + rax - 0x50]
add dword [rax], ecx
lea rax, [rax + 4]
sub rdx, 1
jne 0x14002a2e0
mov rbx, qword [rsp + 0x170]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140035a40
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x140035b22
call fcn.14004d540
test al, al
jne 0x140035b22
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x140035a72
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.140058780
test rax, rax
je 0x140035ab7
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.140058780
mov rsi, rax
test rax, rax
je 0x140035ab7
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x140035aeb
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.140048250
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x140035ad0
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret