joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b08c0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r10
mov qword [rsp + 8], r10
xchg r10, rbx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x40]
xchg rdx, rdi
mov rdx, rdi
xchg rdi, rdx
mov rbx, rcx
mov byte [rax + rcx], 0x71
xor byte [rax + rcx], 0x74
add byte [rax + rcx], 0x74
sub byte [rax + rcx], 0xf
sub byte [rax + rcx], 0x44
xor byte [rax + rcx], 9
add byte [rax + rcx], 0x1b
add byte [rax + rcx], 0x36
lea r8d, [rax + 1]
cmp eax, 0x38
jae 0x1401b094c
cmp r8d, 0x38
jae 0x1401b09c3
mov ecx, r8d
mov eax, 0x339bef8c
sub eax, 0xcbdce47
add eax, 0x2c139a7e
sub eax, 0x48d89db6
add eax, 0x3444cd48
xor eax, 0x3e5deb6d
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call fcn.1401fdcd6
jmp 0x1401b09c3
cmp r8d, 0x40
jae 0x1401b098c
mov ecx, r8d
mov eax, 0x6b902d33
sub eax, 0x38db78d8
sub eax, 0x1a739c63
sub eax, 0x137b4c05
add eax, 0x661337d7
xor eax, 0x40ac0f98
sub eax, 0x2a750c12
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call fcn.1401fdcd6
mov rdx, rbx
mov rcx, rbx
call fcn.1401b0d40
xorps xmm0, xmm0
xor eax, eax
xchg r15, rbx
movups xmmword [r15], xmm0
xchg r15, rbx
xchg r13, rbx
movups xmmword [r13 + 0x10], xmm0
xchg r13, rbx
xchg rbx, rdi
movups xmmword [rdi + 0x20], xmm0
xchg rbx, rdi
xchg r9, rax
mov qword [rbx + 0x30], r9
xchg r9, rax
mov edx, dword [rbx + 0x40]
xchg r14, rbx
mov rcx, r14
xchg r14, rbx
shl edx, 1
shl edx, 1
shl edx, 1
add rdx, qword [rbx + 0x48]
xchg r9, rax
mov r9, rdx
xchg r9, rax
mov qword [rbx + 0x48], rdx
shr rax, 3
shr rax, 2
shr rax, 2
shr rax, 1
mov byte [rbx + 0x3e], al
xchg r11, rdx
mov rax, r11
xchg rdx, r11
shr rax, 4
shr rax, 3
shr rax, 6
shr rax, 2
shr rax, 1
mov byte [rbx + 0x3d], al
xchg r11, rdx
mov rax, r11
xchg r11, rdx
shr rax, 8
shr rax, 0xa
shr rax, 1
shr rax, 2
shr rax, 3
mov byte [rbx + 0x3c], al
xchg rdx, rax
mov rdx, rax
xchg rdx, rax
shr rax, 0x1c
shr rax, 2
shr rax, 1
shr rax, 1
mov byte [rbx + 0x3b], al
xchg rbx, rdx
mov rax, rbx
xchg rdx, rbx
shr rax, 0x21
shr rax, 1
shr rax, 5
shr rax, 1
mov byte [rbx + 0x3a], al
xchg r13, rax
mov r13, rdx
xchg r13, rax
mov byte [rbx + 0x3f], dl
shr rdx, 0x2d
shr rdx, 2
shr rdx, 2
shr rdx, 3
shr rdx, 1
shr rdx, 2
shr rdx, 1
mov byte [rbx + 0x38], dl
mov rdx, rbx
shr rax, 0x1b
shr rax, 0xd
shr rax, 3
shr rax, 1
shr rax, 3
shr rax, 1
mov byte [rbx + 0x39], al
call fcn.1401b0d40
xor r8d, r8d
lea rdx, [rdi + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbx + 0x50]
lea rdx, [rdx + 1]
mov ecx, 0x7b273fa9
xor ecx, 0x14606db2
xor ecx, 0x10f629ae
sub ecx, 0x6c77f6a
sub ecx, 0x16840f47
xor ecx, 0x622f4fa
add ecx, 0x80c3ad9
add ecx, 0xf3da83e
xor ecx, 0x7b90fd0d
lea rdi, [rdi + 1]
sub ecx, r8d
sub r8d, 0xfffffff8
shr eax, cl
mov byte [rdi - 1], al
mov eax, dword [rbx + 0x54]
shr eax, cl
mov byte [rdx - 5], al
mov eax, dword [rbx + 0x58]
shr eax, cl
mov byte [rdx - 1], al
mov eax, dword [rbx + 0x5c]
shr eax, cl
mov byte [rdx + 3], al
mov eax, dword [rbx + 0x60]
shr eax, cl
mov byte [rdx + 7], al
cmp r8d, 0x20
jb 0x1401b0ac2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rax
push rdx
push rdx
xchg qword [rsp + 0x20], rdi
pop rdx
pop rdx
pop rax
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x6d8addb0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d8cf5e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d8adf38
mov rax, qword [0x6d8cf5e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d8addfc
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d8ade85
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d8adde0
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d8adf6d
mov rax, qword [0x6d8cf5e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d8cf5e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d8adf50
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d8ade7e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d8adee0
add dword [0x6d8cf5e4], 1
cmp edi, 8
jae 0x6d8adeb3
test dil, 4
jne 0x6d8adf24
test edi, edi
je 0x6d8adea8
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d8adf3f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d8adea8
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d8adecc
jmp 0x6d8adea8
add rsi, qword [0x6d8cf5e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d8ade7e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d8adea8
xor esi, esi
jmp 0x6d8ade07
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d8adea8
mov rax, qword [0x6d8cf5e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d8ae6c0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d8cf8c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d8cf8a0]
test rbx, rbx
je 0x6d8ae714
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d8ae70b
test rsi, rsi
je 0x6d8ae70b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d8ae6f0
lea rcx, [0x6d8cf8c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d8ae950
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d8ae960
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d8ae970
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d8ae9b1
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d8ae9a8
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d8ae9b3
add rax, 0x28
cmp rax, r9
jne 0x6d8ae994
xor eax, eax
ret

Function at 0x6d8aea50
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8cc1f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d8aeabd
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8aeabd
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8aeabd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8aeab4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8aeabf
add rax, 0x28
cmp rax, r9
jne 0x6d8aeaa0
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d8aebc0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8cc1f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d8aebe0
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8aebd8
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d8aec3d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d8aec34
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d8aec44
add rax, 0x28
cmp rax, r9
jne 0x6d8aec20
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d8aec60
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d8cc1f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d8aecce
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d8aecce
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d8aecce
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d8aecce
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d8aecc5
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d8aecd5
add rcx, 0x28
cmp rcx, rax
jne 0x6d8aecb0
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d8aece8
jmp 0x6d8aecce
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d8aecf6
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d8aecce
test r9d, r9d
jg 0x6d8aece0
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d8af060
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x10000129c
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
mov rcx, qword [0x1000036f8]
lea rdx, [0x100003700]
call qword [sym.imp.API_MS_WIN_Service_Core_L1_1_0.dll_SetServiceStatus]
test eax, eax
jne 0x1000012e6
mov dword [0x100003704], 1
call qword [sym.imp.API_MS_Win_Core_ErrorHandling_L1_1_0.dll_GetLastError]
cmp qword [0x1000036f8], 0
mov dword [0x10000370c], eax
je 0x1000012dd
call fcn.10000129c
xor ecx, ecx
call qword [sym.imp.API_MS_Win_Core_ProcessThreads_L1_1_0.dll_ExitProcess]
inc dword [0x100003714]
add rsp, 0x28
ret

Function at 0x1000014b0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor r12d, r12d
xor eax, eax
lock cmpxchg qword [0x100003740], rdi
je 0x1000014fe
cmp rax, rdi
jne 0x1000014f1
mov edi, 1
mov r12d, edi
jmp 0x100001503
mov ecx, 0x3e8
call qword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_Sleep]
jmp 0x1000014d5
mov edi, 1
mov eax, dword [0x100003738]
cmp eax, edi
jne 0x100001519
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x100001576
mov eax, dword [0x100003738]
test eax, eax
jne 0x100001570
mov dword [0x100003738], edi
lea r13, [0x1000011a0]
lea rsi, [0x100001188]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
cmp rsi, r13
jae 0x100001562
test eax, eax
jne 0x100001562
mov rcx, qword [rsi]
test rcx, rcx
je 0x100001557
call rcx
mov dword [rsp + 0x20], eax
add rsi, 8
mov qword [rsp + 0x28], rsi
jmp 0x100001540
test eax, eax
je 0x100001576
mov eax, 0xff
jmp 0x100001648
mov dword [0x100003164], edi
mov eax, dword [0x100003738]
cmp eax, edi
jne 0x10000159d
lea rdx, [0x100001180]
lea rcx, [0x100001170]
call sub.msvcrt.dll__initterm
mov dword [0x100003738], 2
test r12d, r12d
jne 0x1000015ab
xor eax, eax
xchg qword [0x100003740], rax
cmp qword [0x100003748], 0
je 0x1000015d4
lea rcx, [0x100003748]
call fcn.10000189c
test eax, eax
je 0x1000015d4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100003748]
mov r8, qword [0x100003148]
mov rdx, qword [0x100003150]
mov ecx, dword [0x100003140]
call fcn.100001440
mov dword [0x100003160], eax
cmp dword [0x100003144], 0
jne 0x100001604
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100003164], 0
jne 0x100001619
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100003160]
jmp 0x100001648
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret
sub rsp, 0x28
call fcn.10017e000
add rsp, 0x28
jmp 0x1000014b0

Function at 0x100001908
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100001955
cmp rcx, 0xffffffffffffffff
je 0x100001955
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10000194d
cmp dword [rcx + 0x3c], edx
jl 0x10000194d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10000194d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100001955
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140003c18
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003c62
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003c62
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003c62
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003c62
cmp dword [rcx + 0x84], 0xe
jbe 0x140003c62
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003c64
xor al, al
add rsp, 0x28
ret
Function at 0x140004e74
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.SetDefaultDllDirectories
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140004ea7
mov ecx, 0x800
call rax
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.1400021b0
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14000234c
mov ebx, eax
test eax, eax
js 0x140004f66
lea rdx, str.user
lea rcx, [rsp + 0x20]
call fcn.140001a44
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.140002828
mov rdx, qword [rsp + 0x20]
test al, al
sete dil
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140004f16
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, str.unregister
lea rcx, [rsp + 0x28]
call fcn.140001a44
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
call fcn.140002828
mov rdx, qword [rsp + 0x28]
test al, al
sete bl
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140004f5a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov dl, bl
mov cl, dil
call fcn.140004db0
mov ebx, eax
lea rcx, [rsp + 0x30]
call fcn.1400022c8
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x14000ad24
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000aa88
Function at 0x140026010
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x14002611f
xchg rcx, rbx
mov qword [rsp + 0x10], rcx
xchg rbx, rcx
xchg rbp, r9
mov qword [rsp + 0x18], r9
xchg r9, rbp
push rsi
sub rsp, 0x20
xchg rdi, r15
mov qword [rsp + 0x30], r15
xchg r15, rdi
mov rbx, rdx
xchg rdx, rcx
mov rdi, rdx
xchg rcx, rdx
mov esi, r8d
sub rdi, rdx
xchg rbp, rcx
mov rcx, rbp
xchg rbp, rcx
sub rdi, 0x132d8570
add rdi, 0x132d8660
dec rsi
shr rsi, 3
shr rsi, 1
inc rsi
nop dword [rax]
movups xmm0, xmmword [rbx]
mov rdx, rbp
xchg rcx, rbx
mov rbx, rcx
xchg rcx, rbx
call fcn.1400267d0
mov ecx, 0x599e1f2f
sub ecx, 0x4a955d2f
add ecx, 0x40ba30a8
xor ecx, 0x6e927902
add ecx, 0x46c732b6
sub ecx, 0x6817be50
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1400260bc
nop
add rdi, 0xd4eff92
sub rdi, 0xd4effa2
xchg r13, rbp
movups xmmword [r13 + 0xf0], xmm0
xchg r13, rbp
sub rsi, 1
jne 0x140026078
xchg rdi, r13
mov r13, qword [rsp + 0x30]
xchg rdi, r13
xchg rcx, rbx
mov rcx, qword [rsp + 0x38]
xchg rbx, rcx
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rsi
ret

Function at 0x140026120
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
xchg rsi, rcx
mov qword [rsp + 0x18], rcx
xchg rcx, rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov edi, r8d
xchg rcx, rdx
mov rbx, rcx
xchg rdx, rcx
lea r9, [rcx + 0xf0]
xchg rsi, rcx
mov rcx, rsi
xchg rcx, rsi
test r8d, r8d
je 0x1400261f7
dec rdi
shr rdi, 3
shr rdi, 1
inc rdi
nop dword [rax]
nop word [rax + rax]
xchg r8, rax
mov r8, rbx
xchg r8, rax
sub r9, rbx
mov edx, 0x33f42e3f
xor edx, 0x47c4b1c4
xor edx, 0x1d99859
xor edx, 0xe6f7827
xor edx, 0x2b77dc2f
xor edx, 0x50f1a3ba
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400261b4
xchg rdx, rsi
mov rsi, rdx
xchg rsi, rdx
xchg rcx, rbx
mov rbx, rcx
xchg rbx, rcx
call fcn.1400262a0
mov r9, rbx
neg rbx
add rbx, 0xfffffffffffffff0
neg rbx
sub rdi, 1
jne 0x140026182
movups xmm0, xmmword [r9]
mov rbx, qword [rsp + 0x30]
xchg rbp, r10
mov r10, qword [rsp + 0x38]
xchg rbp, r10
xchg r14, rsi
movups xmmword [r14 + 0xf0], xmm0
xchg r14, rsi
xchg rsi, rdi
mov rdi, qword [rsp + 0x40]
xchg rsi, rdi
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret
Function at 0x140027970
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
xchg r9, rbx
mov qword [rsp + 8], r9
xchg rbx, r9
push rdi
sub rsp, 0x10
mov rbx, rdx
xchg r8, r10
mov r8, rcx
xchg r10, r8
test r8b, 0xf
je 0x1400279b3
xor al, al
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
xor edx, edx
test r8d, r8d
je 0x140027a65
movdqa xmm2, xmmword [rsp]
nop
xchg rdx, r13
movdqu xmm1, xmmword [r13 + rbx]
xchg r13, rdx
test edx, edx
jne 0x1400279e7
xchg r10, rdx
movdqu xmm2, xmmword [rdx + 0x200]
xchg rdx, r10
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
pxor xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0x3b72dfe1
sub ecx, 0x35ff8a4e
xor ecx, 0x398328c1
add ecx, 0x3c5f8fdb
sub ecx, 0x677105bd
add ecx, 0x48444c3c
sub ecx, 0x5a23539f
nop dword [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027a29
aesdeclast xmm0, xmmword [r10 + 0x1e0]
pxor xmm0, xmm2
movdqa xmm2, xmm1
xchg rdx, r14
movups xmmword [r14 + r9], xmm0
xchg rdx, r14
sub edx, 0xfffffff0
cmp edx, r8d
jb 0x1400279c4
xchg rbx, r12
mov r12, qword [rsp + 0x20]
xchg r12, rbx
mov al, 0x28
add al, 0x2c
sub al, 0x36
xor al, 0x39
add al, 0x57
sub al, 0x5f
xor al, 0x37
sub al, 0x27
add rsp, 0x10
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140027aa0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x10
mov rbx, rdx
mov r10, rcx
test r8b, 0xf
je 0x140027acf
xor al, al
add rsp, 0x10
nop
add rsp, 8
xchg qword [rsp - 8], rbx
nop
add rsp, 8
jmp qword [rsp - 8]
xor edx, edx
test r8d, r8d
je 0x140027b81
movdqa xmm0, xmmword [rsp]
mov qword [rsp + 0x20], rdi
nop dword [rax + rax]
xchg rdx, r15
movdqu xmm1, xmmword [r15 + rbx]
xchg r15, rdx
test edx, edx
jne 0x140027b0c
xchg r10, r14
movdqu xmm0, xmmword [r14 + 0x200]
xchg r10, r14
pxor xmm0, xmm1
lea rax, [r10 + 0x10]
pxor xmm0, xmmword [r10 + 0x1e0]
mov ecx, 0x5b0f0f50
add ecx, 0x6f7660e
sub ecx, 0x321644b4
xor ecx, 0x6cc0181c
sub ecx, 0x2b09e248
xor ecx, 0x18264663
nop dword [rax + rax]
aesenc xmm0, xmmword [rax]
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x140027b48
aesenclast xmm0, xmmword [r10 + 0xe0]
xchg r12, rdx
movups xmmword [r12 + r9], xmm0
xchg r12, rdx
add edx, 0x10
cmp edx, r8d
jb 0x140027ae9
mov rdi, qword [rsp + 0x20]
mov al, 0x1e
add al, 0x28
xor al, 0x38
xor al, 0x2b
sub al, 0x1f
sub al, 0x35
add rsp, 0x10
push rax
push rdx
push rcx
push rdx
xchg qword [rsp + 0x20], rbx
add rsp, 0x28
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14002c9e0
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
xchg r8, rbx
mov qword [rsp + 0x10], r8
xchg r8, rbx
xchg rbx, rsi
mov qword [rsp + 0x18], rbx
xchg rsi, rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
xchg rsi, rbp
mov rbp, rcx
xchg rbp, rsi
mov rax, qword gs:[0x30]
xchg r8, rdi
mov r8, qword [rax + 0x60]
xchg rdi, r8
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
xchg rbx, rdi
mov qword [rsp + 0x40], rdi
xchg rbx, rdi
sub rcx, 0xffffffffffffff38
xchg rbx, rdx
mov qword [rsp + 0x28], rdx
xchg rbx, rdx
mov dword [rsp + 0x20], 0x55a61d82
sub dword [rsp + 0x20], 0x4244056
xor dword [rsp + 0x20], 0x16d0457d
add dword [rsp + 0x20], 0x1e2503a
add dword [rsp + 0x20], 0x20aed3ad
sub dword [rsp + 0x20], 0x1f2d9339
sub dword [rsp + 0x20], 0x344dac6f
sub dword [rsp + 0x20], 0x16677c88
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b6d0
test eax, eax
js 0x14002cab1
cmp qword [rsp + 0x40], rbx
je 0x14002cab1
lea eax, [rbx + 1]
jmp 0x14002cbe6
mov rax, qword gs:[0x60]
xchg rcx, r10
mov r10, qword [rax + 0x30]
xchg r10, rcx
cmp dword [rcx + 0x70], 2
jbe 0x14002caf1
mov eax, 0x648d6c3b
sub eax, 0x593cf00a
add eax, 0xcc4eeff
add eax, 0x6050306a
sub eax, 0xe9a9c90
sub eax, 0x69caff08
jmp 0x14002cbe6
cmp dword [rcx + 0x74], ebx
jbe 0x14002cb1d
mov eax, 0x6aaa31bd
add eax, 0x28ec07b
xor eax, 0x48c134d8
add eax, 0x468d8e12
sub eax, 0xa2b72bd
sub eax, 0x625be232
jmp 0x14002cbe6
cmp byte [rdi + 2], bl
je 0x14002cb4e
mov eax, 0x5a4a99d9
sub eax, 0x31f68605
xor eax, 0x78a07b6e
sub eax, 0x2a3eb167
add eax, 0x270e958f
add eax, 0x1b18dda4
xor eax, 0x68dd2a82
jmp 0x14002cbe6
cmp r14d, 0xa
jb 0x14002cb9f
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002cb9f
mov eax, 0x761b4e93
sub eax, 0x4d1304b7
xor eax, 0x84edd10
add eax, 0x1d243ba5
add eax, 0x4bb3709
add eax, 0x13d14548
xor eax, 0xe226963
sub eax, 0x52aab32a
xor eax, 0x62a727f
jmp 0x14002cbe6
lea rcx, [rsi + 0xb8]
mov edx, 0x465cebab
xor edx, 0x63264654
xor edx, 0x8a6db58
sub edx, 0x23f26ec4
add edx, 0x1d3efc46
add edx, 0x305e3dbe
sub edx, 0x4e83d256
xor edx, 0x909af608
call fcn.14002bff0
jmp 0x14002cbe4
mov eax, ebx
xchg r10, rbx
mov r10, qword [rsp + 0x48]
xchg r10, rbx
mov rsi, qword [rsp + 0x50]
xchg rdi, r12
mov r12, qword [rsp + 0x58]
xchg rdi, r12
add rsp, 0x30
push rax
push rcx
push rax
push rdx
push rdx
push rbx
push rbx
push rax
xchg qword [rsp + 0x40], r14
add rsp, 0x48
nop
add rsp, 8
jmp qword [rsp - 8]