joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003800
Capabilities:
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x80
xor r14d, r14d
mov dword [rbp - 0x4c], 0x20
lea rcx, [rbp - 0x38]
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x30], r14
mov rsi, r9
mov rbx, r8
mov dword [rbp - 0x38], 0x18
mov rdi, rdx
mov dword [rbp - 0x34], 0xf0000000
call fcn.180003118
test rax, rax
jne 0x18000386e
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x180003866
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
or ebx, 0xffffffff
jmp 0x1800039c2
mov r9, rbx
mov qword [rbp - 0x48], r14
mov r8, rdi
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x48]
call fcn.180003280
test eax, eax
je 0x18000389e
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x180003855
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov qword [rbp - 0x48], r14
jmp 0x180003855
lea rcx, [rbp - 0x38]
call fcn.180003118
mov r8, qword [rbp - 0x48]
mov rcx, rax
lea rax, [rbp - 0x40]
xor r9d, r9d
mov edx, 0x8009
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x1800038fe
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x48]
mov ebx, eax
test rcx, rcx
je 0x1800038e4
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov qword [rbp - 0x48], r14
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1800039c2
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
jmp 0x1800039c2
mov rcx, qword [rbp - 0x40]
lea r8, [rbp - 0x28]
xor eax, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xor r9d, r9d
mov qword [rbp - 8], rax
movups xmmword [rbp - 0x18], xmm0
lea edx, [rax + 5]
mov dword [rbp - 0x28], 0x800c
call qword [sym.imp.ADVAPI32.dll_CryptSetHashParam]
test eax, eax
je 0x1800038c9
mov r8d, dword [rbp + 0x30]
xor r9d, r9d
mov rcx, qword [rbp - 0x40]
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1800038c9
mov rcx, qword [rbp - 0x40]
lea r9, [rbp - 0x50]
xor r8d, r8d
mov dword [rbp - 0x50], r14d
mov dword [rsp + 0x20], r14d
lea ebx, [r8 + 2]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1800038c9
mov eax, dword [rbp - 0x4c]
cmp dword [rbp - 0x50], eax
jne 0x180003889
mov r8, qword [rbp + 0x38]
lea r9, [rbp - 0x4c]
mov rcx, qword [rbp - 0x40]
mov edx, ebx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x1800038c9
mov rcx, qword [rbp - 0x48]
test rcx, rcx
je 0x1800039ae
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov qword [rbp - 0x48], r14
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1800039bf
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ebx, r14d
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1800039d1
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
lea r11, [rsp + 0x80]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1800040f4
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x420
mov rcx, rdx
mov rdi, r8
call fcn.180002c9c
mov edx, 0x200
mov rcx, rdi
mov ebx, eax
call fcn.180002d74
mov edx, ebx
mov dword [rdi + 0x20], 0x16
mov rcx, rdi
call fcn.180002e1c
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor ecx, ecx
lea r8, [rsp + 0x20]
mov edx, ecx
mov r9d, eax
mov r10d, 0x100
mov byte [r8], dl
inc edx
inc r8
cmp edx, r10d
jl 0x180004149
mov al, byte [rsp + 0x45]
mov byte [rsp + 0x430], al
lea rax, [rsp + 0x20]
mov byte [rax], cl
inc ecx
inc rax
cmp ecx, r10d
jl 0x180004166
mov al, byte [rsp + 0x95]
lea rdx, [rsp + 0x430]
mov byte [rsp + 0x431], al
mov r8d, r9d
xor eax, eax
mov rcx, rdi
mov dword [rsp + 0x432], eax
mov word [rsp + 0x436], ax
call fcn.180002e4c
mov rbx, qword [rsp + 0x438]
xor eax, eax
add rsp, 0x420
pop rdi
ret
Function at 0x1800041b8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r13
push r14
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov r14, r8
mov rbx, rdx
mov rcx, rdx
call fcn.180002c9c
mov edi, eax
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.180002ccc
nop
mov edx, 0x400000
mov rcx, r14
call fcn.180002d74
mov dword [r14 + 0x20], 0x16
mov edx, edi
mov rcx, r14
call fcn.180002e1c
lea r13, [0x1800136a8]
mov qword [rbp + 0x390], r13
xor eax, eax
lea rcx, [rsp + 0x50]
mov edx, 0x100
mov byte [rcx], al
inc eax
inc rcx
cmp eax, edx
jl 0x18000422f
mov al, byte [rsp + 0x7e]
mov byte [rbp + 0x380], al
xor eax, eax
lea rcx, [rsp + 0x50]
mov byte [rcx], al
inc eax
inc rcx
cmp eax, edx
jl 0x18000424b
mov al, byte [rbp - 0x54]
mov byte [rbp + 0x381], al
xor eax, eax
mov dword [rbp + 0x382], eax
mov word [rbp + 0x386], ax
lea rax, [rbp + 0x380]
or rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x18000427c
lea rdx, [rbp + 0x380]
mov rdi, qword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_strncmp]
test eax, eax
jne 0x18000432b
mov edi, 0x104
mov r8d, edi
xor edx, edx
lea rcx, [rsp + 0x50]
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x50]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea rax, [rsp + 0x50]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1800042cc
xor edi, edi
mov qword [rsp + 0x30], rdi
xor esi, esi
mov qword [rsp + 0x38], rsi
test r8, r8
je 0x180004302
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.180002c00
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.180002c58
mov r8, rsi
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.180002c00
lea rcx, [rsp + 0x30]
call fcn.180002c58
mov rdi, qword [rsp + 0x40]
mov r8, rbx
inc r8
cmp byte [rdi + r8], 0
jne 0x18000432e
mov rdx, rdi
mov rcx, r14
call fcn.180002dd4
mov r8d, 1
lea rdx, [0x1800134e4]
mov rcx, r14
call fcn.180002dd4
lea rax, [0x1800136d0]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], r14
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp + 0x390]
call fcn.180005a94
nop
test eax, eax
je 0x1800043a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
mov r8d, eax
lea edx, [r9 + 0x34]
mov rcx, r14
call fcn.180002ee4
jmp 0x1800043a6
xor ebx, ebx
mov qword [rbp + 0x390], r13
lea rcx, [rsp + 0x40]
call fcn.180002c58
mov eax, ebx
mov rbx, qword [rsp + 0x488]
add rsp, 0x450
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800043d0
Capabilities:
Delete directory
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rdi
push r14
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov ecx, dword [rdx + 0x18]
xor r9d, r9d
test ecx, ecx
je 0x180004412
mov r9, qword [rdx + 0x10]
movsxd rax, ecx
add rax, r9
mov qword [rdx + 0x10], rax
mov eax, ecx
sub eax, ecx
mov dword [rdx + 0x18], eax
mov r8, rcx
xor ebx, ebx
mov qword [rsp + 0x20], rbx
and qword [rsp + 0x28], rbx
test ecx, ecx
je 0x180004437
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.180002c00
mov rbx, qword [rsp + 0x20]
lea r14, [0x1800136a8]
mov qword [rbp + 0xa0], r14
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
or rdi, 0xffffffffffffffff
cmp rax, rdi
je 0x1800044b7
test byte [rsp + 0x30], 0x10
je 0x18000449e
lea rax, [0x1800136c0]
mov qword [rbp + 0x90], rax
lea r9, [rbp + 0x90]
mov r8b, 1
mov rdx, rbx
lea rcx, [rbp + 0xa0]
call fcn.180005a94
nop
test rbx, rbx
je 0x1800044ac
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x1800044ac
test rbx, rbx
je 0x1800044ac
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
xor edi, edi
mov qword [rbp + 0xa0], r14
lea rcx, [rsp + 0x20]
call fcn.180002c58
mov eax, edi
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180005a94
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f8]
sub rsp, 0x6d0
mov r15b, r8b
mov rsi, rdx
mov r12, rcx
mov r13d, 0x104
mov r8d, r13d
lea rcx, [rbp + 0x2b0]
xor edx, edx
mov r14, r9
call sub.msvcrt.dll_memset
test rsi, rsi
je 0x180005cbf
lea ebx, [r13 - 1]
xor edx, edx
mov r8d, ebx
lea rcx, [rbp + 0x1a1]
call sub.msvcrt.dll_memset
lea r8, [rbp + 0x1a0]
mov byte [rbp + 0x1a0], 0x2a
mov rdx, rsi
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.SHLWAPI.dll_PathCombineA]
test rax, rax
je 0x180005cb9
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180005cb9
mov r8d, ebx
lea rcx, [rbp + 0x3c1]
xor edx, edx
call sub.msvcrt.dll_memset
mov r8d, r13d
lea rcx, [rbp + 0x4c4]
xor edx, edx
call sub.msvcrt.dll_memset
mov r8d, r13d
mov byte [rbp + 0x3c0], 0x2e
xor edx, edx
mov word [rbp + 0x4c4], 0x2e2e
lea rcx, [rbp + 0x90]
call sub.msvcrt.dll_memset
xor edx, edx
mov eax, edx
lea r9, [rbp + 0x3c0]
imul rcx, rax, 0x104
lea rax, [rsp + 0x7c]
add r9, rcx
sub r9, rax
movzx ecx, byte [rax]
movzx r8d, byte [rax + r9]
sub ecx, r8d
jne 0x180005bb6
inc rax
test r8d, r8d
jne 0x180005ba1
test ecx, ecx
je 0x180005c95
inc edx
cmp edx, 2
jl 0x180005b86
mov r8, r13
lea rcx, [rbp + 0x90]
xor edx, edx
call sub.msvcrt.dll_memset
lea r8, [rsp + 0x7c]
mov rdx, rsi
lea rcx, [rbp + 0x90]
call qword [sym.imp.SHLWAPI.dll_PathCombineA]
test rax, rax
je 0x180005c95
mov ebx, dword [rsp + 0x50]
shr ebx, 4
and bl, 1
je 0x180005c1a
test r15b, r15b
je 0x180005c1a
mov r9, r14
lea rdx, [rbp + 0x90]
mov r8b, 1
mov rcx, r12
call fcn.180005a94
xorps xmm0, xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x64]
movups xmmword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
cmp eax, 1
jne 0x180005cb5
xorps xmm0, xmm0
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x30]
xor ecx, ecx
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
cmp eax, 1
jne 0x180005cb5
mov eax, dword [rsp + 0x70]
lea r8, [rsp + 0x7c]
mov r10, qword [r14]
mov r9b, bl
mov dword [rbp + 0x608], eax
mov rdx, rsi
mov eax, dword [rsp + 0x6c]
mov rcx, r14
mov dword [rbp + 0x60c], eax
mov rax, qword [rbp + 0x608]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [r10 + reloc.WS2_32.dll_htonl]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
je 0x180005b84
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x180005cc2
call qword [sym.imp.KERNEL32.dll_GetLastError]
or eax, 0xffffffff
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180007970
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rdi
sub rsp, 0x68
mov rdi, rcx
mov dword [rax - 0x38], 0
mov qword [rax - 0x30], rcx
mov qword [rax - 0x28], r8
mov rax, qword gs:[0x30]
mov rdx, qword [rax + 0x60]
mov eax, dword [rdx + 0x118]
shl eax, 0x10
or eax, dword [rdx + 0x11c]
cmp eax, 0x60000
jb 0x1800079e8
call sub.msvcrt.dll__errno
lea rbx, [rax - 0x10]
mov rcx, qword [rbx + 8]
dec rcx
cmp rcx, 0xfffffffffffffffd
ja 0x1800079df
xor ebx, ebx
lea ecx, [rbx + 0x10]
call qword [sym.imp.msvcrt.dll__amsg_exit]
mov rax, qword [rbx + 0xe0]
jmp 0x180007a10
call sub.msvcrt.dll__errno
lea rbx, [rax - 0x10]
mov rcx, qword [rbx + 8]
dec rcx
cmp rcx, 0xfffffffffffffffd
ja 0x180007a09
xor ebx, ebx
lea ecx, [rbx + 0x10]
call qword [sym.imp.msvcrt.dll__amsg_exit]
mov rax, qword [rbx + 0xd8]
lea rdx, [rsp + 0x48]
mov ecx, dword [rdi]
call rax
mov dword [rsp + 0x40], 0
jmp 0x180007a23
mov eax, dword [rsp + 0x40]
add rsp, 0x68
pop rdi
pop rbx
ret
Function at 0x180009970
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
mov rax, qword gs:[0x30]
mov rsi, r9
mov r14, r8
mov rbp, rdx
mov rbx, rcx
mov r10, qword [rax + 0x60]
mov eax, dword [r10 + 0x118]
shl eax, 0x10
or eax, dword [r10 + 0x11c]
cmp eax, 0x60000
jb 0x1800099e4
call sub.msvcrt.dll__errno
lea rdi, [rax - 0x10]
mov rax, qword [rax - 8]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1800099dc
xor edi, edi
lea ecx, [rdi + 0x10]
call qword [sym.imp.msvcrt.dll__amsg_exit]
mov eax, dword [rdi + 0x2c0]
jmp 0x1800099f1
mov ecx, 1
call fcn.18000d850
mov eax, dword [rax + 0x28]
mov rdi, qword [rsp + 0xa0]
test eax, eax
jne 0x180009a2d
mov eax, dword [rbx]
cmp eax, 0xe06d7363
je 0x180009a2d
cmp eax, 0x80000029
jne 0x180009a1d
cmp dword [rbx + 0x18], 0xf
jne 0x180009a24
cmp qword [rbx + 0x60], 0x19930520
je 0x180009a2d
cmp eax, 0x80000026
je 0x180009a2d
test byte [rdi], 0x20
jne 0x180009bba
mov r8d, dword [rbx + 4]
test r8b, 0x66
je 0x180009af3
movsxd rax, dword [rdi + 8]
test eax, eax
je 0x180009bba
mov rdx, rax
lea r9, [0x180000000]
add rdx, qword [rsi + 8]
movzx ecx, byte [rdx]
and ecx, 0xf
movsx rax, byte [rcx + r9 + 0x12460]
movzx ecx, byte [rcx + r9 + 0x12470]
sub rdx, rax
mov eax, dword [rdx - 4]
shr eax, cl
test eax, eax
je 0x180009bba
cmp dword [rsp + 0xa8], 0
jne 0x180009bba
test r8b, 0x20
je 0x180009ae0
mov ecx, dword [rbx]
cmp ecx, 0x80000026
jne 0x180009ac0
mov r8, qword [rsi + 0x20]
mov rdx, rsi
mov rcx, rdi
call fcn.18000ac70
mov r9d, eax
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.18000a360
jmp 0x180009bba
cmp ecx, 0x80000029
jne 0x180009ae0
mov r9d, dword [rbx + 0x38]
mov r8, rdi
mov rcx, qword [rbx + 0x28]
mov rdx, rsi
call fcn.18000a360
jmp 0x180009bba
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
call fcn.180007b70
jmp 0x180009bba
mov r8, qword [rsi + 8]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.180009be0
cmp dword [rsp + 0x40], 0
jne 0x180009b14
test byte [rdi], 0x40
je 0x180009bba
cmp dword [rbx], 0xe06d7363
jne 0x180009b80
cmp dword [rbx + 0x18], 3
jb 0x180009b80
cmp dword [rbx + 0x20], 0x19930522
jbe 0x180009b80
mov rax, qword [rbx + 0x30]
cmp dword [rax + 8], 0
je 0x180009b80
call fcn.180008470
mov rcx, qword [rbx + 0x30]
movsxd rdx, dword [rcx + 8]
add rax, rdx
je 0x180009b80
movzx ecx, byte [rsp + 0xb8]
mov r9, rsi
mov dword [rsp + 0x38], ecx
mov r8, r14
mov rcx, qword [rsp + 0xb0]
mov rdx, rbp
mov qword [rsp + 0x30], rcx
mov ecx, dword [rsp + 0xa8]
mov dword [rsp + 0x28], ecx
mov rcx, rbx
mov qword [rsp + 0x20], rdi
call rax
jmp 0x180009bbf
mov rax, qword [rsp + 0xb0]
mov r9, rsi
mov qword [rsp + 0x38], rax
mov r8, r14
mov eax, dword [rsp + 0xa8]
mov rdx, rbp
mov dword [rsp + 0x30], eax
mov rcx, rbx
movzx eax, byte [rsp + 0xb8]
mov byte [rsp + 0x28], al
mov qword [rsp + 0x20], rdi
call fcn.180008b00
mov eax, 1
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x18000d3b0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x4f0]
sub rsp, 0x5f0
mov rax, qword [0x180016008]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x18000d3ec
mov ecx, 5
int 0x29
mov ecx, 2
call fcn.180011528
xorps xmm0, xmm0
lea rcx, [rbp + 0x10]
xor eax, eax
xor edx, edx
mov r8d, 0x4d0
mov qword [rbp], rax
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
call sub.msvcrt.dll_memset
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], rax
lea rcx, [rbp + 0x10]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rbp + 0x108]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x18000d4a8
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], 0
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
mov rax, qword [rbp + 0x4f8]
mov qword [rbp + 0x108], rax
lea rax, [rbp + 0x4f8]
add rax, 8
mov dword [rsp + 0x70], 0xc0000417
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x80], rax
mov dword [rsp + 0x74], 1
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor ecx, ecx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x18000d50e
test ebx, ebx
jne 0x18000d50e
lea ecx, [rax + 2]
call fcn.180011528
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000417
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.180011390
mov rbx, qword [rsp + 0x600]
add rsp, 0x5f0
pop rbp
ret
Function at 0x140001180
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x140010040]
mov r10, rax
sub rbx, rax
movabs rdi, 0x2c47f4ee02c47f4f
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xe]
mul rcx
add r11d, 0xe
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 6]
mov byte [r9 - 6], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xb]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xc]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xd]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xe
jb 0x1400011d0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x72]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea rsi, [0x140010040]
mov r11, rax
sub rbx, rax
movabs rdi, 0x2c47f4ee02c47f4f
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r10d
lea r9, [r9 + 2]
mov rax, rdi
mov rcx, r8
mul r8
add r10d, 2
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r10d, 0x7a
jb 0x140001450
mov rbx, qword [rsp + 0x30]
mov rax, r11
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400014c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x140010040]
mov r10, rax
sub rbx, rax
movabs rdi, 0x2c47f4ee02c47f4f
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xb]
mul rcx
add r11d, 0xb
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x172
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xb
jb 0x140001510
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret