joyce8/EMBER2024-capa huggingface dataset:
Function at 0x15048
Capabilities:
Hash data using sha1

Disassembly:
sub rsp, 0x38
test rdx, rdx
mov dword [rsp + 0x20], 0x67452301
je 0x15204
mov rax, rdx
and rax, 3
neg rax
and rax, 3
lea r8, [rdx + rax]
test ecx, ecx
jle 0x151ee
cmp ecx, 0x200
jg 0x151ee
test cl, 7
jne 0x151ee
mov r9d, dword [rsp + 0x20]
mov dword [rsp + 0x30], 0xc3d2e1f0
mov dword [r8 + 4], ecx
mov ecx, 0xffffffff
mov dword [rsp + 0x2c], 0x10325476
mov dword [r8 + 8], ecx
mov dword [r8 + 0xc], ecx
mov dword [r8 + 0x10], ecx
mov dword [rsp + 0x28], 0x98badcfe
mov dword [r8 + 0x14], ecx
mov dword [r8 + 0x18], ecx
mov dword [r8 + 0x1c], r9d
mov dword [rsp + 0x24], 0xefcdab89
lea rcx, [rdx + rax + 0x30]
and rcx, 0xf
mov r10d, ecx
mov dword [r8], 0x50524e47
test r10d, r10d
mov dword [r8 + 0x20], 0xefcdab89
mov dword [r8 + 0x24], 0x98badcfe
mov dword [r8 + 0x28], 0x10325476
mov dword [r8 + 0x2c], 0xc3d2e1f0
je 0x1513b
test r10d, 3
jne 0x151f8
neg r10d
add r10d, 0x10
shr r10d, 2
xor ecx, ecx
mov r9d, r10d
mov dword [r8 + rcx*4 + 0x30], 0
add rcx, 1
cmp rcx, r9
jl 0x15127
jmp 0x1513e
movsxd r9, ecx
neg r10d
and r10d, 3
neg r10d
add r10d, 0x10
pxor xmm0, xmm0
movdqa xmmword [r8 + r9*4 + 0x30], xmm0
add r9, 4
cmp r9, r10
jl 0x15150
cmp r10, 0x10
jge 0x15179
mov dword [r8 + r10*4 + 0x30], 0
add r10, 1
cmp r10, 0x10
jl 0x15166
lea rax, [rdx + rax + 0x70]
and rax, 0xf
mov ecx, eax
test ecx, ecx
je 0x151ad
test cl, 3
jne 0x15200
neg ecx
add ecx, 0x10
shr ecx, 2
xor eax, eax
mov edx, ecx
mov dword [r8 + rax*4 + 0x70], 0
add rax, 1
cmp rax, rdx
jl 0x15199
jmp 0x151b0
movsxd rdx, eax
neg ecx
and ecx, 3
neg ecx
add ecx, 0x10
pxor xmm0, xmm0
movdqa xmmword [r8 + rdx*4 + 0x70], xmm0
add rdx, 4
cmp rdx, rcx
jl 0x151be
cmp rcx, 0x10
jge 0x151e7
mov dword [r8 + rcx*4 + 0x70], 0
add rcx, 1
cmp rcx, 0x10
jl 0x151d4
xor eax, eax
add rsp, 0x38
ret
mov eax, 0xffffff89
add rsp, 0x38
ret
xor r10d, r10d
jmp 0x15160
xor ecx, ecx
jmp 0x151ce
mov eax, 0xfffffff8
add rsp, 0x38
ret
Function at 0x17854
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rdi
push rsi
sub rsp, 0x28
mov rsi, r8
mov r15d, edx
mov r14, rcx
test rsi, rsi
je 0x1799a
mov rdi, rsi
and rdi, 0xf
neg rdi
and rdi, 0xf
lea r13, [rsi + rdi]
mov eax, dword [r13]
cmp eax, 0x434d4143
je 0x178a5
mov eax, 0xffffffef
add rsp, 0x28
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
test r14, r14
je 0x1799a
test r15d, r15d
jle 0x178b9
cmp r15d, 0x10
jle 0x178cd
mov eax, 0xffffff89
add rsp, 0x28
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, dword [r13 + 4]
lea r12, [rsi + rdi + 0x50]
cmp r8d, 0x10
je 0x1797e
movsxd rax, r8d
lea rdx, [r13 + rax + 0x30]
neg r8d
add r8d, 0x10
xor ecx, ecx
call fcn.000179b8
movsxd rax, dword [r13 + 4]
mov byte [rax + r13 + 0x30], 0x80
lea rax, [rsi + rdi + 0x30]
xor edx, edx
movzx ecx, byte [rdx + r13 + 0x20]
xor byte [rdx + rax], cl
add rdx, 1
cmp rdx, 0x10
jl 0x17907
lea rsi, [rsi + rdi + 0x40]
xor edx, edx
movzx ecx, byte [rdx + rax]
xor byte [rdx + rsi], cl
add rdx, 1
cmp rdx, 0x10
jl 0x17921
mov r8d, dword [r12 + 0xc]
lea r9, [r12 + 0x10]
mov rcx, rsi
mov rdx, rsi
call fcn.00017a54
mov rcx, rsi
mov rdx, r14
mov r8d, r15d
call fcn.00016c84
mov dword [r13 + 4], 0
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x10
call fcn.000179b8
xor eax, eax
add rsp, 0x28
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
lea rax, [rsi + rdi + 0x30]
xor edx, edx
movzx ecx, byte [rdx + r13 + 0x10]
xor byte [rdx + rax], cl
add rdx, 1
cmp rdx, 0x10
jl 0x17985
jmp 0x1791a
mov eax, 0xfffffff8
add rsp, 0x28
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x9ae7c0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x9ae7cd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x9ae7dd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x9ae7c5
lea eax, [rcx + 1]
jmp 0x9ae7eb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x9ae7fe
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x9ae7e4
sub eax, 3
jb 0x9ae81e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x9ae86d
sar eax, 1
movsxd rbp, eax
jb 0x9ae854
jmp 0x9ae82c
add ebx, ebx
jne 0x9ae82a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x9ae854
inc ecx
add ebx, ebx
jne 0x9ae83a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x9ae854
call r11
adc ecx, ecx
add ebx, ebx
jne 0x9ae84d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x9ae83c
add ecx, 2
jmp 0x9ae859
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.009ae782
jmp 0x9ae7cd
pop rsi
push rsi
nop
pop rdi
push rsi
push rsi
nop
pop rdi
mov rsi, 0x284800
mov dl, 0x4f
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x9ae8b9
cmp rsi, rcx
jae 0x9ae8c1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x9ae8a0
cmp al, 0x8f
ja 0x9ae8a0
cmp byte [rsi - 2], 0xf
je 0x9ae8a6
sub al, 0xe8
cmp al, 1
ja 0x9ae88a
cmp rsi, rcx
jae 0x9ae8c1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x9ae890
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x9ae8c1
lodsb al, byte [rsi]
jmp 0x9ae8a0
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x5a7000]
mov eax, dword [rdi]
or eax, eax
je 0x9ae91e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x5d9c0c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x9ae8ce
push rdi
nop
pop rcx
push rdi
nop
pop rdx
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x9ae918
mov qword [rbx], rax
add rbx, 8
jmp 0x9ae8ee
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
sub eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x9ae962
cmp al, 0xef
ja 0x9ae94a
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x9ae92a
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x9ae939
mov eax, dword [rdi]
add rdi, 4
jmp 0x9ae939
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
nop
push rbx
pop rdx
push rdi
pop rcx
nop
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
nop
push rbx
pop rdx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x9ae9b6
sub rsp, 0xffffffffffffff80
jmp 0x4683c0
Function at 0x1400024b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3f], 0
mov r8, rcx
je 0x140002621
xor eax, eax
cmp dword [0x14000c008], 5
jl 0x1400025ef
movdqa xmm2, xmmword [0x140008d40]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x140008d80]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140008ea0]
sub r9, rcx
movdqa xmm5, xmmword [0x140008d90]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x38
jb 0x140002503
cmp rax, 0x3f
jae 0x14000261c
movabs r9, 0x991135b13b4b4b1b
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x3f
jb 0x140002600
mov byte [r8 + 0x3f], 0
ret
Function at 0x140002630
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
mov r8, rcx
je 0x1400027a1
xor eax, eax
cmp dword [0x14000c008], 5
jl 0x14000276f
movdqa xmm2, xmmword [0x140008d40]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x140008d80]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140008e90]
sub r9, rcx
movdqa xmm5, xmmword [0x140008d90]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x10
jb 0x140002683
cmp rax, 0x12
jae 0x14000279c
movabs r9, 0x95355dfd798dc5a3
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x12
jb 0x140002780
mov byte [r8 + 0x12], 0
ret
Function at 0x1400027b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x8c0], 0
mov r8, rcx
je 0x140002936
xor eax, eax
cmp dword [0x14000c008], 5
jl 0x140002905
movdqa xmm2, xmmword [0x140008d40]
mov r9, 0xfffffffffffffffe
movdqa xmm3, xmmword [0x140008d80]
mov r10d, 2
movdqa xmm4, xmmword [0x140008ef0]
sub r9, r8
movdqa xmm5, xmmword [0x140008d90]
sub r10, r8
add rcx, 4
mov rdx, 0xfffffffffffffffc
sub rdx, r8
lea rax, [rdx + rcx]
movq xmm0, rax
movzx eax, word [rcx - 4]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 4], ax
lea rax, [r9 + rcx]
movq xmm0, rax
movzx eax, word [rcx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 2], ax
mov rax, rcx
sub rax, r8
movq xmm0, rax
movzx eax, word [rcx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx], ax
lea rax, [r10 + rcx]
movq xmm0, rax
movzx eax, word [rcx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 2], ax
add rcx, 8
lea rax, [rdx + rcx]
cmp rax, 0x8c0
jb 0x140002810
mov byte [r8 + 0x8c0], 0
ret
movabs r9, 0xa31121ed077965d7
nop
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x8c0
jb 0x140002910
mov byte [r8 + 0x8c0], 0
ret
Function at 0x140002940
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
mov r8, rcx
je 0x140002ab1
xor eax, eax
cmp dword [0x14000c008], 5
jl 0x140002a7f
movdqa xmm2, xmmword [0x140008d40]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x140008d80]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140008db0]
sub r9, rcx
movdqa xmm5, xmmword [0x140008d90]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x18
jb 0x140002993
cmp rax, 0x19
jae 0x140002aac
movabs r9, 0x5ad23c3cb0b3da5
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x19
jb 0x140002a90
mov byte [r8 + 0x19], 0
ret
Function at 0x140002ac0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x36], 0
mov r8, rcx
je 0x140002c31
xor eax, eax
cmp dword [0x14000c008], 5
jl 0x140002bff
movdqa xmm2, xmmword [0x140008d40]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x140008d80]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140008da0]
sub r9, rcx
movdqa xmm5, xmmword [0x140008d90]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x30
jb 0x140002b13
cmp rax, 0x36
jae 0x140002c2c
movabs r9, 0x1cdc31f65f3d5f1
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x36
jb 0x140002c10
mov byte [r8 + 0x36], 0
ret
Function at 0x140002c40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
mov r8, rcx
je 0x140002dc1
xor eax, eax
cmp dword [0x14000c008], 5
jl 0x140002d90
movdqa xmm2, xmmword [0x140008d40]
mov r9, 0xfffffffffffffffe
movdqa xmm3, xmmword [0x140008d80]
mov r10d, 2
movdqa xmm4, xmmword [0x140008fe0]
sub r9, r8
movdqa xmm5, xmmword [0x140008d90]
sub r10, r8
add rcx, 4
mov rdx, 0xfffffffffffffffc
sub rdx, r8
nop dword [rax]
lea rax, [rdx + rcx]
movq xmm0, rax
movzx eax, word [rcx - 4]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 4], ax
lea rax, [r9 + rcx]
movq xmm0, rax
movzx eax, word [rcx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 2], ax
mov rax, rcx
sub rax, r8
movq xmm0, rax
movzx eax, word [rcx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx], ax
lea rax, [r10 + rcx]
movq xmm0, rax
movzx eax, word [rcx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 2], ax
add rcx, 8
lea rax, [rdx + rcx]
cmp rax, 0x10
jb 0x140002ca0
mov byte [r8 + 0x10], 0
ret
movabs r9, 0xdb63d3a5df2fa55d
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x10
jb 0x140002da0
mov byte [r8 + 0x10], 0
ret
Function at 0x140002dd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
mov r8, rcx
je 0x140002f41
xor eax, eax
cmp dword [0x14000c008], 5
jl 0x140002f0f
movdqa xmm2, xmmword [0x140008d40]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x140008d80]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140008f80]
sub r9, rcx
movdqa xmm5, xmmword [0x140008d90]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x10
jb 0x140002e23
cmp rax, 0x14
jae 0x140002f3c
movabs r9, 0xcd15890f1fef9f7d
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x14
jb 0x140002f20
mov byte [r8 + 0x14], 0
ret
Function at 0x140002f50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
mov r8, rcx
je 0x1400030c1
xor eax, eax
cmp dword [0x14000c008], 5
jl 0x14000308f
movdqa xmm2, xmmword [0x140008d40]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x140008d80]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140008e70]
sub r9, rcx
movdqa xmm5, xmmword [0x140008d90]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x10
jb 0x140002fa3
cmp rax, 0x13
jae 0x1400030bc
movabs r9, 0x7fd3adb181e15bed
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x13
jb 0x1400030a0
mov byte [r8 + 0x13], 0
ret
Function at 0x140003290
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2c], 0
mov r8, rcx
je 0x140003401
xor eax, eax
cmp dword [0x14000c008], 5
jl 0x1400033cf
movdqa xmm2, xmmword [0x140008d40]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x140008d80]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140009070]
sub r9, rcx
movdqa xmm5, xmmword [0x140008d90]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x28
jb 0x1400032e3
cmp rax, 0x2c
jae 0x1400033fc
movabs r9, 0xffc3978bc98f5399
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x2c
jb 0x1400033e0
mov byte [r8 + 0x2c], 0
ret
Function at 0x140003b40
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x140
mov r15, rcx
xor r12d, r12d
mov ecx, 0x20
call fcn.14000587c
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
mov ecx, 0x20
call fcn.14000587c
mov rsi, rax
mov qword [rsp + 0x180], rax
mov dword [rsp + 0x178], 0x101
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], r12
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x140003bd0
movabs rbp, 0x7fffffffffffffff
cmp rbx, rbp
ja 0x140003d33
cmp rbx, 0xf
ja 0x140003c17
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 0xf
mov r8, rbx
lea rdx, [rsp + 0x30]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
jmp 0x140003caf
mov rax, rbx
or rax, 0xf
cmp rax, rbp
jbe 0x140003c4c
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14000587c
test rax, rax
je 0x140003c81
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140003c90
mov ecx, 0x16
cmp rax, rcx
cmovb rax, rcx
mov rbp, rax
lea rcx, [rax + 1]
test rcx, rcx
jne 0x140003c69
mov rdi, r12
jmp 0x140003c90
cmp rcx, 0x1000
jb 0x140003c88
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003d39
jmp 0x140003c31
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000587c
mov rdi, rax
mov qword [rsi], rdi
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], rbp
mov r8, rbx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x140003ce5
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x140003ce0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003d2c
mov rcx, r8
call fcn.1400058c0
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov edx, 0x20
mov rcx, r14
call fcn.1400058c0
mov rdx, rsi
mov rcx, r15
call fcn.140003f20
mov rax, r15
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140001410
nop
call fcn.140001370
int3