joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18009c800
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
cmp byte [rcx + 8], 0
mov rbx, r8
mov rdi, rcx
je 0x18009c8f1
mov ecx, 0x5a
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18009c8f1
mov rcx, rbx
call fcn.18006b580
test al, al
je 0x18009c8f1
movaps xmmword [rsp + 0x70], xmm6
lea rdx, [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm7
mov rcx, rbx
movaps xmmword [rsp + 0x50], xmm8
call fcn.18006b260
movss xmm7, dword [rdi + 0x28]
lea rdx, [rsp + 0x20]
mov rcx, rbx
cvtps2pd xmm7, xmm7
call fcn.18006b0c0
movsd xmm0, qword [rax + 8]
movsd xmm8, qword [rax]
mulsd xmm0, qword [0x18033fe20]
mulsd xmm8, qword [0x18033fe20]
call sub.api_ms_win_crt_math_l1_1_0.dll_cos
movaps xmm6, xmm0
movaps xmm0, xmm8
mulsd xmm6, xmm7
call sub.api_ms_win_crt_math_l1_1_0.dll_sin
movsd xmm1, qword [rsp + 0x30]
mulsd xmm0, xmm6
subsd xmm1, xmm0
movaps xmm0, xmm8
movsd qword [rsp + 0x30], xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll_cos
movsd xmm1, qword [rsp + 0x40]
lea rdx, [rsp + 0x30]
mulsd xmm0, xmm6
mov rcx, rbx
addsd xmm1, xmm0
movsd qword [rsp + 0x40], xmm1
call fcn.18006baa0
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x70]
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
Function at 0x18009d6a0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
cmp byte [rcx + 8], 0
je 0x18009d7bb
cmp byte [0x180353370], 0
je 0x18009d6d9
mov ecx, 1
call qword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x18009d7bb
mov rdi, qword [0x180357760]
cmp qword [rdi + 0x28], 0
jne 0x18009d6ee
xor ebx, ebx
jmp 0x18009d78c
mov rbx, qword [rdi + 0x20]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov r8d, 0x11
lea rdx, str.hurtResistantTime
lea rcx, [rsp + 0x20]
call fcn.180005930
nop
lea rdx, [rsp + 0x20]
lea rcx, [0x180357578]
call fcn.180073150
mov r8, qword [rbx]
mov r9, qword [r8 + 0x320]
mov r8, rax
mov rdx, qword [rdi + 0x28]
mov rcx, rbx
call r9
mov ebx, eax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x18009d785
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18009d780
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18009d780
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800ae784
mov rdi, qword [0x180357760]
mov eax, 0x14
sub eax, dword [rsi + 0x34]
cmp ebx, eax
jne 0x18009d7bb
lea rcx, [rdi + 0x18]
lea rdx, [rsp + 0x20]
call fcn.18006b260
mov rcx, qword [0x180357760]
add rcx, 0x18
lea rdx, [rsp + 0x20]
call fcn.18006baa0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x1800a03f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x180352040]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor esi, esi
call fcn.18006f970
call fcn.18009a980
mov rbx, qword [0x180357760]
test rbx, rbx
je 0x1800a043b
mov rcx, rbx
call fcn.1800a0680
mov edx, 0xf8
mov rcx, rbx
call fcn.1800ae784
mov qword [0x180357760], rsi
mov rcx, qword [0x1803570d0]
test rcx, rcx
je 0x1800a0480
call fcn.180070c80
mov rdi, qword [rax + 0x10]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x1800a0480
nop
mov rcx, qword [0x1803570d0]
mov rax, qword [rcx]
mov r8, qword [rax + 0xb0]
mov rdx, qword [rbx + 0x30]
call r8
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1800a0460
mov rcx, qword [0x1803570c8]
test rcx, rcx
je 0x1800a0498
mov rax, qword [rcx]
mov rdx, qword [rax + 0x3f0]
call rdx
call fcn.18006e900
mov rcx, qword [0x180357068]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [0x180357090]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [0x180357088]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
call qword [sym.imp.KERNEL32.dll_FreeConsole]
mov rcx, qword [0x180357078]
test rcx, rcx
je 0x1800a04db
call fcn.1800a05c0
mov rcx, qword [0x180357060]
test rcx, rcx
je 0x1800a04ec
call fcn.1800a05c0
cmp qword [0x180356fe0], rsi
je 0x1800a0501
lea rcx, [0x180356fe0]
call fcn.1800a0c90
mov qword [0x1803570d0], rsi
mov ecx, 0x10
call fcn.1800ae300
mov rcx, qword [0x180357120]
mov qword [rax], rcx
mov rcx, qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [rax + 8], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x1800a0c60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1800a05a2
cmp dword [rsp + 0x38], 0
je 0x1800a0596
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1800a0596
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800ae1c0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], esi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1800a05c0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x180352040]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp byte [rcx], 0
mov rbx, rcx
jne 0x1800a0655
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x20], 0
cmp byte [rcx], 0xe9
jne 0x1800a0631
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov r8d, 0x40
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1800a0631
movzx r8d, byte [rbx + 1]
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
call sub.VCRUNTIME140.dll_memcpy
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rbx + 0x20]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, 0x38
mov rcx, rbx
call fcn.1800ae784
mov rax, rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800ae1c0
add rsp, 0x30
pop rbx
ret
Function at 0x1800a08e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x180352040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov word [rcx], 1
lea rax, [0x18009fd00]
mov qword [rcx + 8], rax
mov rcx, qword [0x180357098]
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
mov dword [rbx + 0x28], 0x25ff
mov dword [rbx + 0x2c], 0x1010000
mov dword [rbx + 0x30], 0x1010101
mov word [rbx + 0x34], 0x101
call fcn.18006f8c0
mov rcx, qword [rbx + 0x10]
mov edx, 0xe
mov r8d, 0x40
mov byte [rbx + 1], al
call fcn.180070880
mov qword [rbx + 0x20], rax
mov rcx, rax
test rax, rax
jne 0x1800a097e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Hook:_Failed_to_allocate_memory_n
call fcn.180004990
jmp 0x1800a0a80
mov rax, qword [rbx + 8]
mov r9d, 0x40
mov qword [rbx + 0x2e], rax
mov r8d, 0x3000
movsd xmm0, qword [rbx + 0x28]
movsd qword [rcx], xmm0
mov eax, dword [rbx + 0x30]
mov dword [rcx + 8], eax
movzx eax, word [rbx + 0x34]
mov word [rcx + 0xc], ax
xor ecx, ecx
movzx edx, byte [rbx + 1]
add rdx, 0xe
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x1800a0966
mov qword [0x180357080], rax
movzx r8d, byte [rbx + 1]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x48], rdi
call sub.VCRUNTIME140.dll_memcpy
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
mov r8d, 0x40
add rcx, rdx
mov qword [rbx + 0x2e], rcx
mov rcx, qword [rbx + 0x18]
movsd xmm0, qword [rbx + 0x28]
movsd qword [rcx + rdx], xmm0
mov eax, dword [rbx + 0x30]
mov dword [rcx + rdx + 8], eax
movzx eax, word [rbx + 0x34]
mov word [rcx + rdx + 0xc], ax
mov edx, 5
mov edi, dword [rbx + 0x20]
sub edi, dword [rbx + 0x10]
mov rcx, qword [rbx + 0x10]
sub edi, 5
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800a0a51
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Hook:_Failed_to_change_target_function_protection_n
call fcn.180004990
jmp 0x1800a0a7b
mov rax, qword [rbx + 0x10]
lea r9, [rsp + 0x20]
mov edx, 5
mov byte [rax], 0xe9
mov rax, qword [rbx + 0x10]
mov dword [rax + 1], edi
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbx], 0
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800ae1c0
add rsp, 0x30
pop rbx
ret
Function at 0x1800a0aa0
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x180352040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov word [rcx], 1
lea rax, [0x18009fc20]
mov qword [rcx + 8], rax
mov rcx, qword [0x180357018]
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
mov dword [rbx + 0x28], 0x25ff
mov dword [rbx + 0x2c], 0x1010000
mov dword [rbx + 0x30], 0x1010101
mov word [rbx + 0x34], 0x101
call fcn.18006f8c0
mov rcx, qword [rbx + 0x10]
mov edx, 0xe
mov r8d, 0x40
mov byte [rbx + 1], al
call fcn.180070880
mov qword [rbx + 0x20], rax
mov rcx, rax
test rax, rax
jne 0x1800a0b3e
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Hook:_Failed_to_allocate_memory_n
call fcn.180004990
jmp 0x1800a0c40
mov rax, qword [rbx + 8]
mov r9d, 0x40
mov qword [rbx + 0x2e], rax
mov r8d, 0x3000
movsd xmm0, qword [rbx + 0x28]
movsd qword [rcx], xmm0
mov eax, dword [rbx + 0x30]
mov dword [rcx + 8], eax
movzx eax, word [rbx + 0x34]
mov word [rcx + 0xc], ax
xor ecx, ecx
movzx edx, byte [rbx + 1]
add rdx, 0xe
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x1800a0b26
mov qword [0x180357070], rax
movzx r8d, byte [rbx + 1]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x18]
mov qword [rsp + 0x48], rdi
call sub.VCRUNTIME140.dll_memcpy
movzx edx, byte [rbx + 1]
lea r9, [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
mov r8d, 0x40
add rcx, rdx
mov qword [rbx + 0x2e], rcx
mov rcx, qword [rbx + 0x18]
movsd xmm0, qword [rbx + 0x28]
movsd qword [rcx + rdx], xmm0
mov eax, dword [rbx + 0x30]
mov dword [rcx + rdx + 8], eax
movzx eax, word [rbx + 0x34]
mov word [rcx + rdx + 0xc], ax
mov edx, 5
mov edi, dword [rbx + 0x20]
sub edi, dword [rbx + 0x10]
mov rcx, qword [rbx + 0x10]
sub edi, 5
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800a0c11
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, str.Hook:_Failed_to_change_target_function_protection_n
call fcn.180004990
jmp 0x1800a0c3b
mov rax, qword [rbx + 0x10]
lea r9, [rsp + 0x20]
mov edx, 5
mov byte [rax], 0xe9
mov rax, qword [rbx + 0x10]
mov dword [rax + 1], edi
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [rbx], 0
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800ae1c0
add rsp, 0x30
pop rbx
ret
Function at 0x1800a2ff0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
movzx eax, byte [rdx]
mov rbx, r8
dec eax
mov r8, rdx
mov rdi, rcx
cmp eax, 0x20
ja case.0x1800a30d9.4
lea rsi, [0x180000000]
nop dword [rax]
cdqe
movzx eax, byte [rsi + rax + 0xa3258]
mov ecx, dword [rsi + rax*4 + 0xa322c]
add rcx, rsi
jmp rcx
mov rax, qword [rbx + 0xd0]
movzx r8d, byte [r8 + 1]
add rax, 0xffffffffffffffc4
lea r8, [rax + r8*2]
movzx eax, byte [r8]
dec eax
cmp eax, 0x20
jbe 0x1800a3020
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rax, dword [rbx + 0xcc]
movzx edx, word [rsi + rax*2 + 0xb7e80]
mov rcx, rdi
call fcn.1800a18a0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rbx + 0x9c]
cmp al, 8
jae case.0x1800a30d9.4
lea edx, [rax + 0x6d]
mov rcx, rdi
call fcn.1800a18a0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [r8 + 1]
add eax, 0xfffffffe
cmp eax, 0x1a
ja case.0x1800a30d9.4
cdqe
movzx eax, byte [rsi + rax + 0xa3288]
mov ecx, dword [rsi + rax*4 + 0xa327c]
add rcx, rsi
jmp rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1800a4090
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1800a32b0
movzx eax, byte [rbx + 0xa2]
mov r9, rbx
mov rcx, rdi
mov rdx, qword [rbx + rax*8 + 0xa8]
inc al
mov byte [rbx + 0xa2], al
call fcn.1800a1e20
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx edx, byte [rbx + 0x34]
mov rcx, rdi
call fcn.1800a1870
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 0x60]
cmp eax, 2
jne 0x1800a316e
lea edx, [rax + 0x35]
jmp 0x1800a3180
cmp eax, 1
jne 0x1800a317b
lea edx, [rax + 0x1f]
lea eax, [rdx + 0x19]
jmp 0x1800a3185
mov edx, 0x39
mov eax, 0x20
cmp byte [rbx + 0x37], 0
mov rcx, rdi
cmovne edx, eax
call fcn.1800a18a0
movsxd rax, dword [rbx + 8]
mov rcx, rdi
movzx edx, byte [rax + rsi + 0xb8040]
call fcn.1800a18a0
xor al, al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, dword [rbx + 0x60]
cmp eax, 2
jne 0x1800a31c7
lea edx, [rax + 0x31]
jmp 0x1800a31d9
cmp eax, 1
jne 0x1800a31d4
lea edx, [rax + 0x19]
lea eax, [rdx - 0xa]
jmp 0x1800a31de
mov edx, 0x10
mov eax, 0x1a
cmp byte [rbx + 0x37], 0
mov rcx, rdi
cmovne edx, eax
call fcn.1800a18a0
mov rbx, qword [rsp + 0x30]
xor al, al
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd rax, dword [rbx + 0xb8]
jmp 0x1800a306e
movzx edx, byte [rbx + 0xa0]
and edx, 7
add edx, 0x85
jmp 0x1800a3076
movsxd rax, dword [rbx + 0x98]
jmp 0x1800a306e
Function at 0x140009038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rbx + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000905c
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400090b3
cmp qword [rcx + rdx*8], rbx
jne 0x1400090a8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400090ac
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400090c0
cmp qword [rcx + rdx*8], rbx
jne 0x1400090c0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x1400090f5
mov rcx, qword [rbx + 0x18]
inc rdx
mov r8d, 2
call fcn.1400020a4
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x37]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b51c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400148a0], eax
call fcn.14000b2a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
cmp dword [0x1400148a0], 0
jne case.default.0x14000b572
mov ecx, 1
call fcn.14000b2a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
sub al, 0x26
imul dword [rdx + 0x73]
pop rsi
sbb dword [rbp + 0x34], ebx
out dx, eax
lahf
invalid
test al, 0x17
in eax, dx
jg 0x140020a05
mov bh, 0xb
mov bh, byte [rdx]
mov bl, 0xd2
fisubr word [rbp + 0x1a]
and esi, esp
jg 0x140020a35
scasd eax, dword [rdi]
sar dword [rdx + 0x25317bb8], 1
dec qword [rdx + r15*4 - 0x5ca9a31b]
fimul word [rbx - 0x5f]
and eax, 0xfdbb65ad
std
push rdi
jno 0x1400209ae
mov ebp, 0xde3b7eea
lodsb al, byte [rsi]
pop rsi
pop rdi
packsswb mm6, mm5
test dword [rbp - 0x2995dbd1], edx
loope 0x140020a41
and al, 0x6a
invalid
movabs eax, dword [0xdd3eb927aa8a983b]
or dword [rbp + 0xed0b9a1], edx
loopne 0x140020a51
invalid
invalid
mov dword [rbx], ecx
sub eax, 0x1f4929ac
lodsb al, byte [rsi]
leave
sub dword [rcx], esi
invalid
or ebp, eax
call 0x176ccbb67
shr dword [rbx + 0x5a], 0x58
or byte gs:[rdi], bh
stosd dword [rdi], eax
and byte [rdi], 0x31
invalid
Function at 0x140776058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407761df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140776089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14077606f
add dl, dl
jne 0x140776096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407760f6
xor eax, eax
add dl, dl
jne 0x1407760a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407761ad
add dl, dl
jne 0x1407760b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407760c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407760d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407760dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407760ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14077607e
mov eax, 1
add dl, dl
jne 0x140776106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140776113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407760fb
sub eax, ebx
mov ebx, 1
jne 0x14077614c
mov ecx, 1
add dl, dl
jne 0x14077612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14077613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140776123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14077607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140776168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140776175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14077615d
cmp eax, 0x7d00
jae 0x14077619b
cmp eax, 0x500
jb 0x140776196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14077607e
cmp eax, 0x7f
ja 0x14077619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14077607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407761d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14077607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1401468da
Capabilities:
Encode data using xor

Disassembly:
call fcn.1401468da
not al
push rdx
shl dx, 0x82
neg al
dec dl
dec al
push rdx
jmp 0x1401648a0
dec r11
mov r11, qword [rdi + 8]
push 0x53361120
ror byte [rsp + 1], 0x43
adc rdi, 0xc
xor eax, eax
test r11, r11
lea rsp, [rsp + 8]
je 0x14016b227
push r10
lea rbx, [0x1401696d8]
mov r10d, 0xe7385c2d
movzx r10d, byte [rsi]
xor r10d, eax
push 0x1b370c0c
and r10d, 0xff
mov r10d, dword [rbx + r10*4]
shr eax, 8
push 0x692a5103
xor eax, r10d
inc rsi
shr dword [rsp + 1], 0x18
inc byte [rsp + 4]
xor eax, 0xaf2d8104
dec r11
lea rsp, [rsp + 0x10]
jne 0x1401348aa
mov r10d, 0x302c201f
lea r10, [r10 + r10*8 - 0x73f3c163]
call fcn.14016b21d
xor ecx, edi
inc rdx
xor ecx, 0xeb3beea7
dec r10
lea rsp, [rsp + 0x10]
jne 0x140155b28
jmp 0x14014f05a
push 0xffffffff8d221123
sub r10, 2
mov word [r10], bp
lea rsp, [rsp + 8]
jmp 0x140164e1f
pop rdi
mov ebx, 0xd8b9c30d
pop rbx
call fcn.14014cff0
mov esi, 0x79ba3417
mov rsi, qword [rdi + rsi - 0x79ba3417]
mov r11d, 0x868f6116
jmp 0x140134879
mov edi, 0x763a4a88
neg edi
movzx edi, byte [rdx]
jb 0x14015ba4e
jmp 0x1401594f8
mov byte es:[rsi], dl
call fcn.140140a3a
mov r9, qword [r8]
mov r10d, 0xc19c5595
xor r10w, r10w
mov r10, qword [r8 + 8]
push 0xffffffff9c02fcbb
not word [rsp + 2]
adc r8, 8
not r9
not r10
call fcn.1401364fe
mov ebp, 0x28d608d
mov bp, word [rdx + rbp*4 - 0xa358234]
jmp 0x140147860
xor edi, ecx
push 0x5982fd0b
and edi, 0xff
mov edi, dword [rbx + rdi*4]
shr dword [rsp], 0xbd
ror byte [rsp + 3], 0x24
shr ecx, 8
jmp 0x14012c032
xor al, 0xbf
neg byte [rsp + 0x1a]
dec al
ror dword [rsp + 0xa], 0xe4
xor bpl, al
ror edx, 0x5e
neg qword [rsp + 3]
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x10], r11
call fcn.14015b629
jmp 0x140164ce6
mov dword [r9], r10d
call fcn.14015fd68
call fcn.14012bb71

Function at 0x14016ddff
Capabilities:
Encode data using xor

Disassembly:
add r8, 6
mov word [r8], r10w
push 0x778e692a
lea rsp, [rsp + 8]
jmp fcn.140150bed
sub rsp, rcx
and rsp, 0xfffffffffffffff0
push 0xffffffff850424b7
lea rsp, [rsp + 8]
add rsp, rcx
test ebx, ebx
push 0xffffffffb28be18d
lea rsp, [rsp + 8]
je 0x140160261
add rax, rdx
mov qword [rbp + riz - 8], rax
mov qword [rsp], 0x523bbc3a
neg qword [rsp + 6]
lea rsp, [rsp + 0x10]
mov qword [rbp + riz - 0x10], rsp
jb 0x14016a98f
mov esi, 0x8e27cc37
mov rsi, qword [r8]
mov r10d, 0x8699370c
inc r10d
neg r10
movzx r10w, byte ss:[rsi]
jbe 0x140153f7f
mov ecx, 0x821f22a
inc ecx
mov rax, qword [rdi + rcx*4 - 0x2087c8ac]
mov rcx, qword [rdi + rcx*2 - 0x1043e44e]
push 0x410bf915
add rdi, 0xc
xor edx, edx
test rcx, rcx
lea rsp, [rsp + 8]
je 0x14016def7
mov r11d, 0x2708fd80
shl r11w, 0x81
push r10
lea r11, [0x140152b10]
mov r10d, 0x2d3af119
xor r10, r10
and r10w, 0xc51e
add r10b, byte [rax + r10*8]
push 0x5b36963d
xor r10d, edx
rol word [rsp + 5], 0xad
and r10d, 0xff
not qword [rsp]
sar qword [rsp], 0x98
mov r10d, dword [r11 + r10*4]
shr edx, 8
dec word [rsp + 6]
xor edx, r10d
push 0xffffffff9d34a23a
inc rax
xor edx, 0x8501cb29
and dword [rsp + 9], 0xc393d738
dec rcx
lea rsp, [rsp + 0x10]
jne 0x14016de8b
mov r10d, 0x51bbb325
pop r10
call fcn.140149b9e