joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003a9b0
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test rcx, rcx
je 0x14003aa5f
mov rbx, rdx
mov rdi, rcx
lea rsi, [rcx + 0x10]
mov rcx, rsi
call sub.kernel32.dll_AcquireSRWLockExclusive
movzx eax, byte [rdi + 0x18]
test al, al
jne 0x14003abf6
cmp dword [rdi + 0x58], 0x3b9aca00
je 0x14003aac4
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_QueryPerformanceCounter
test eax, eax
je 0x14003abf1
mov r14, qword [rsp + 0x20]
mov rcx, qword [0x140206100]
test rcx, rcx
jne 0x14003aa49
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_QueryPerformanceFrequency
test eax, eax
je 0x14003abf1
mov rcx, qword [rsp + 0x20]
mov qword [0x140206100], rcx
test rcx, rcx
je 0x14003abf6
mov rax, r14
or rax, rcx
shr rax, 0x20
je 0x14003aa69
mov rax, r14
xor edx, edx
div rcx
jmp 0x14003aa70
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
mov eax, r14d
xor edx, edx
div ecx
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x14003aa94
xor edx, edx
div rcx
mov rcx, rax
jmp 0x14003aa9a
xor edx, edx
div ecx
mov ecx, eax
add rcx, r8
mov rax, rcx
shr rax, 9
movabs rdx, 0x44b82fa09b5a53
mul rdx
shr rdx, 0xb
imul eax, edx, 0x3b9aca00
sub ecx, eax
mov qword [rdi + 0x50], rdx
mov dword [rdi + 0x58], ecx
cmp dword [rdi + 0x48], 0x3b9aca00
jne 0x14003aaf6
lea rcx, [rdi + 0x20]
cmp qword [rcx], 0
je 0x14003abe0
add qword [rdi + 0x28], rbx
cmp dword [rdi + 0x38], 0x3b9aca00
jne 0x14003abe0
call fcn.14003ac00
jmp 0x14003abe0
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_QueryPerformanceCounter
test eax, eax
je 0x14003abf1
mov r14, qword [rsp + 0x20]
mov rcx, qword [0x140206100]
test rcx, rcx
jne 0x14003ab52
mov qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call sub.kernel32.dll_QueryPerformanceFrequency
test eax, eax
je 0x14003abf1
mov rcx, qword [rsp + 0x20]
mov qword [0x140206100], rcx
test rcx, rcx
je 0x14003abf6
mov rax, r14
or rax, rcx
shr rax, 0x20
je 0x14003ab68
mov rax, r14
xor edx, edx
div rcx
jmp 0x14003ab6f
mov eax, r14d
xor edx, edx
div ecx
imul r8, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rax
or rdx, rcx
shr rdx, 0x20
je 0x14003ab93
xor edx, edx
div rcx
mov rcx, rax
jmp 0x14003ab99
xor edx, edx
div ecx
mov ecx, eax
add rcx, r8
mov rax, rcx
shr rax, 9
movabs rdx, 0x44b82fa09b5a53
mul rdx
shr rdx, 0xb
imul rax, rdx, 0x3b9aca00
sub rcx, rax
cmp rdx, qword [rdi + 0x40]
jb 0x14003abe0
jne 0x14003abcb
cmp dword [rdi + 0x48], ecx
ja 0x14003abe0
mov dword [rdi + 0x48], 0x3b9aca00
lea rcx, [rdi + 0x20]
cmp qword [rcx], 0
jne 0x14003aadb
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.1401168fc
call sub.kernel32.dll_GetLastError
ud2
Function at 0x14003d8a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x14003d8c0
test al, 1
je 0x14003da26
test al, 2
jne 0x14003da26
test al, 8
jne 0x14003d904
mov rdi, qword [rsi + 0x20]
xor ecx, ecx
call fcn.140102a40
test rax, rax
je 0x14003d91e
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
jmp 0x14003d921
test al, 0x10
je 0x14003d984
mov rax, qword [rsi + 0x60]
test rax, rax
je 0x14003da26
mov rcx, qword [rsi + 0x68]
call qword [rax + 0x10]
jmp 0x14003d984
xorps xmm6, xmm6
lea rdi, [rsi + 0x28]
mov rcx, qword [rsi + 0x28]
add rcx, 0xfffffffffffffffe
cmp rcx, 3
mov eax, 1
cmovb rax, rcx
cmp rax, 1
je 0x14003d965
test rax, rax
jne 0x14003d96d
mov r8, qword [rsi + 0x30]
test r8, r8
je 0x14003d96d
cmp qword [rsi + 0x38], 0
je 0x14003d96d
mov rcx, qword [0x140206128]
xor edx, edx
call sub.kernel32.dll_HeapFree
jmp 0x14003d96d
mov rcx, rdi
call fcn.14003d6a0
mov qword [rdi], 4
xor ecx, ecx
call fcn.140102a40
test rax, rax
je 0x14003d984
movups xmmword [rax + 0x20], xmm6
mov rax, 0xffffffffffffffc0
lock xadd qword [rsi], rax
cmp rax, 0x3f
jbe 0x14003da26
and rax, 0xffffffffffffffc0
cmp rax, 0x40
jne 0x14003d9e4
mov rcx, qword [rsi + 0x28]
add rcx, 0xfffffffffffffffe
cmp rcx, 3
mov eax, 1
cmovb rax, rcx
cmp rax, 1
je 0x14003d9f0
test rax, rax
jne 0x14003d9f9
mov r8, qword [rsi + 0x30]
test r8, r8
je 0x14003d9f9
cmp qword [rsi + 0x38], 0
je 0x14003d9f9
mov rcx, qword [0x140206128]
xor edx, edx
call sub.kernel32.dll_HeapFree
jmp 0x14003d9f9
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
lea rcx, [rsi + 0x28]
call fcn.14003d6a0
mov rax, qword [rsi + 0x60]
test rax, rax
je 0x14003da09
mov rcx, qword [rsi + 0x68]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140206128]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
ud2
Function at 0x140060150
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140060170
test al, 1
je 0x140060287
test al, 2
jne 0x140060287
test al, 8
jne 0x1400601b4
mov rdi, qword [rsi + 0x28]
xor ecx, ecx
call fcn.140102a40
test rax, rax
je 0x1400601d4
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
jmp 0x1400601d7
test al, 0x10
je 0x1400601f7
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x140060287
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x10]
jmp 0x1400601f7
xorps xmm6, xmm6
lea rcx, [rsi + 0x30]
call fcn.14005d6c0
mov byte [rsi + 0xa8], 4
xor ecx, ecx
call fcn.140102a40
test rax, rax
je 0x1400601f7
movups xmmword [rax + 0x20], xmm6
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140100340
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140060287
jne 0x14006027b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14006023f
mov rcx, rdi
call fcn.1400f3f00
lea rcx, [rsi + 0x30]
call fcn.14005d6c0
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x14006025e
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140206128]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
ud2

Function at 0x140060290
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xfa8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400602a0
test al, 1
je 0x140060386
test al, 2
jne 0x140060386
test al, 8
jne 0x1400602db
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 4
lea rdx, [rsp + 0x28]
call fcn.14009f300
jmp 0x1400602f9
test al, 0x10
je 0x1400602f9
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x140060386
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140100340
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140060386
jne 0x14006037b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140060341
mov rcx, rdi
call fcn.1400f3f00
lea rcx, [rsi + 0x30]
call fcn.14005df50
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x140060360
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140206128]
xor edx, edx
add rsp, 0xfa8
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0xfa8
pop rdi
pop rsi
ret
ud2
Function at 0x140060390
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400603a0
test al, 1
je 0x140060470
test al, 2
jne 0x140060470
test al, 8
jne 0x1400603d7
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x40], 5
lea rdx, [rsp + 0x20]
call fcn.14009dfe0
jmp 0x1400603ef
test al, 0x10
je 0x1400603ef
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x140060470
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140100660
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140060470
jne 0x140060468
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140060437
mov rcx, rdi
call fcn.1400a3180
lea rcx, [rsi + 0x30]
call fcn.14005e9e0
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x140060450
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140206128]
xor edx, edx
add rsp, 0x48
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x48
pop rdi
pop rsi
ret
ud2

Function at 0x140060480
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0xa0
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140060490
test al, 1
je 0x140060531
test al, 2
jne 0x140060531
test al, 8
jne 0x1400604ca
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x98], 4
lea rdx, [rsp + 0x28]
call fcn.14009e960
jmp 0x1400604e4
test al, 0x10
je 0x1400604e4
mov rax, qword [rsi + 0xb8]
test rax, rax
je 0x140060531
mov rcx, qword [rsi + 0xc0]
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140100340
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140060531
jne 0x140060527
mov rcx, rsi
add rsp, 0xa0
pop rsi
jmp fcn.14005dd10
nop
add rsp, 0xa0
pop rsi
ret
ud2

Function at 0x140060540
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x48
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140060550
test al, 1
je 0x140060620
test al, 2
jne 0x140060620
test al, 8
jne 0x140060587
lea rcx, [rsi + 0x20]
mov byte [rsp + 0x40], 5
lea rdx, [rsp + 0x20]
call fcn.14009dfe0
jmp 0x14006059f
test al, 0x10
je 0x14006059f
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x140060620
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140100340
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140060620
jne 0x140060618
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x1400605e7
mov rcx, rdi
call fcn.1400f3f00
lea rcx, [rsi + 0x30]
call fcn.14005e9e0
mov rax, qword [rsi + 0x68]
test rax, rax
je 0x140060600
mov rcx, qword [rsi + 0x70]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140206128]
xor edx, edx
add rsp, 0x48
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x48
pop rdi
pop rsi
ret
ud2
Function at 0x140060630
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140060650
test al, 1
je 0x140060768
test al, 2
jne 0x140060768
test al, 8
jne 0x140060694
mov rdi, qword [rsi + 0x28]
xor ecx, ecx
call fcn.140102a40
test rax, rax
je 0x1400606b4
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
jmp 0x1400606b7
test al, 0x10
je 0x1400606d8
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x140060768
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
jmp 0x1400606d8
xorps xmm6, xmm6
lea rcx, [rsi + 0x30]
call fcn.14009e1f0
mov qword [rsi + 0x30], 3
xor ecx, ecx
call fcn.140102a40
test rax, rax
je 0x1400606d8
movups xmmword [rax + 0x20], xmm6
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140100660
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140060768
jne 0x14006075c
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140060720
mov rcx, rdi
call fcn.1400a3180
lea rcx, [rsi + 0x30]
call fcn.14005d9a0
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x14006073f
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140206128]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
ud2

Function at 0x140060770
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140060780
test al, 1
je 0x140060853
test al, 2
jne 0x140060853
test al, 8
jne 0x1400607ba
lea rcx, [rsi + 0x20]
mov dword [rsp + 0x30], 0x3b9aca01
lea rdx, [rsp + 0x28]
call fcn.14009dd20
jmp 0x1400607d2
test al, 0x10
je 0x1400607d2
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x140060853
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140100340
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140060853
jne 0x14006084b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x14006081a
mov rcx, rdi
call fcn.1400f3f00
lea rcx, [rsi + 0x30]
call fcn.14005ddd0
mov rax, qword [rsi + 0x70]
test rax, rax
je 0x140060833
mov rcx, qword [rsi + 0x78]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140206128]
xor edx, edx
add rsp, 0x58
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x58
pop rdi
pop rsi
ret
ud2
Function at 0x140060860
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140060880
test al, 1
je 0x140060998
test al, 2
jne 0x140060998
test al, 8
jne 0x1400608c4
mov rdi, qword [rsi + 0x28]
xor ecx, ecx
call fcn.140102a40
test rax, rax
je 0x1400608e4
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
jmp 0x1400608e7
test al, 0x10
je 0x140060908
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x140060998
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x10]
jmp 0x140060908
xorps xmm6, xmm6
lea rcx, [rsi + 0x30]
call fcn.14009e1f0
mov qword [rsi + 0x30], 3
xor ecx, ecx
call fcn.140102a40
test rax, rax
je 0x140060908
movups xmmword [rax + 0x20], xmm6
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140100340
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140060998
jne 0x14006098c
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140060950
mov rcx, rdi
call fcn.1400f3f00
lea rcx, [rsi + 0x30]
call fcn.14005d9a0
mov rax, qword [rsi + 0xe8]
test rax, rax
je 0x14006096f
mov rcx, qword [rsi + 0xf0]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140206128]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
ud2

Function at 0x1400609a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x1d8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x1400609b0
test al, 1
je 0x140060a96
test al, 2
jne 0x140060a96
test al, 8
jne 0x1400609eb
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 0xc
lea rdx, [rsp + 0x20]
call fcn.14009ea70
jmp 0x140060a09
test al, 0x10
je 0x140060a09
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x140060a96
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140100660
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140060a96
jne 0x140060a8b
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140060a51
mov rcx, rdi
call fcn.1400a3180
lea rcx, [rsi + 0x30]
call fcn.14005f440
mov rax, qword [rsi + 0x1f8]
test rax, rax
je 0x140060a70
mov rcx, qword [rsi + 0x200]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140206128]
xor edx, edx
add rsp, 0x1d8
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x1d8
pop rdi
pop rsi
ret
ud2
Function at 0x140060aa0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov rsi, rcx
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140060ac0
test al, 1
je 0x140060bd7
test al, 2
jne 0x140060bd7
test al, 8
jne 0x140060b04
mov rdi, qword [rsi + 0x28]
xor ecx, ecx
call fcn.140102a40
test rax, rax
je 0x140060b24
movups xmm6, xmmword [rax + 0x20]
mov qword [rax + 0x20], 1
mov qword [rax + 0x28], rdi
jmp 0x140060b27
test al, 0x10
je 0x140060b47
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x140060bd7
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x10]
jmp 0x140060b47
xorps xmm6, xmm6
lea rcx, [rsi + 0x30]
call fcn.14005d6c0
mov byte [rsi + 0xa8], 4
xor ecx, ecx
call fcn.140102a40
test rax, rax
je 0x140060b47
movups xmmword [rax + 0x20], xmm6
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140100660
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140060bd7
jne 0x140060bcb
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140060b8f
mov rcx, rdi
call fcn.1400a3180
lea rcx, [rsi + 0x30]
call fcn.14005d6c0
mov rax, qword [rsi + 0xc0]
test rax, rax
je 0x140060bae
mov rcx, qword [rsi + 0xc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140206128]
xor edx, edx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rdi
pop rsi
ret
ud2

Function at 0x140060be0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x208
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140060bf0
test al, 1
je 0x140060cd6
test al, 2
jne 0x140060cd6
test al, 8
jne 0x140060c2b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x20], 7
lea rdx, [rsp + 0x20]
call fcn.14009df00
jmp 0x140060c49
test al, 0x10
je 0x140060c49
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x140060cd6
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140100660
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140060cd6
jne 0x140060ccb
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140060c91
mov rcx, rdi
call fcn.1400a3180
lea rcx, [rsi + 0x30]
call fcn.14005ec40
mov rax, qword [rsi + 0x228]
test rax, rax
je 0x140060cb0
mov rcx, qword [rsi + 0x230]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140206128]
xor edx, edx
add rsp, 0x208
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x208
pop rdi
pop rsi
ret
ud2
Function at 0x140060ce0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xfa8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140060cf0
test al, 1
je 0x140060dd6
test al, 2
jne 0x140060dd6
test al, 8
jne 0x140060d2b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 4
lea rdx, [rsp + 0x28]
call fcn.14009f300
jmp 0x140060d49
test al, 0x10
je 0x140060d49
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x140060dd6
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140100660
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140060dd6
jne 0x140060dcb
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140060d91
mov rcx, rdi
call fcn.1400a3180
lea rcx, [rsi + 0x30]
call fcn.14005df50
mov rax, qword [rsi + 0xfc0]
test rax, rax
je 0x140060db0
mov rcx, qword [rsi + 0xfc8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140206128]
xor edx, edx
add rsp, 0xfa8
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0xfa8
pop rdi
pop rsi
ret
ud2

Function at 0x140060de0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x2c8
mov rsi, rcx
mov rax, qword [rcx]
nop
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x140060df0
test al, 1
je 0x140060ed6
test al, 2
jne 0x140060ed6
test al, 8
jne 0x140060e2b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 4
lea rdx, [rsp + 0x28]
call fcn.14009e880
jmp 0x140060e49
test al, 0x10
je 0x140060e49
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x140060ed6
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x10]
lea rdi, [rsi + 0x20]
mov rcx, qword [rsi + 0x20]
mov rdx, rsi
call fcn.140100340
cmp rax, 1
mov eax, 2
sbb rax, 0
mov rcx, rax
shl rcx, 6
neg rcx
lock xadd qword [rsi], rcx
shr rcx, 6
cmp rcx, rax
jb 0x140060ed6
jne 0x140060ecb
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140060e91
mov rcx, rdi
call fcn.1400f3f00
lea rcx, [rsi + 0x30]
call fcn.14005fce0
mov rax, qword [rsi + 0x2e0]
test rax, rax
je 0x140060eb0
mov rcx, qword [rsi + 0x2e8]
call qword [rax + 0x18]
mov r8, qword [rsi - 8]
mov rcx, qword [0x140206128]
xor edx, edx
add rsp, 0x2c8
pop rdi
pop rsi
jmp sub.kernel32.dll_HeapFree
nop
add rsp, 0x2c8
pop rdi
pop rsi
ret
ud2