joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400247e0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14002b138]
jne 0x1400247fb
rol rcx, 0x10
test cx, 0xffff
jne 0x1400247f7
ret 0
ror rcx, 0x10
jmp 0x140024dcc
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14002b5c0]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x14002b6b8]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140024e51
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14002b5c0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x140024e73
mov rax, qword [rsp + 0x88]
mov qword [0x14002b6b8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14002b658], rax
mov rax, qword [0x14002b6b8]
mov qword [0x14002b530], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14002b640], rax
mov dword [0x14002b520], 0xc0000409
mov dword [0x14002b524], 1
mov rax, qword [0x14002b138]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14002b140]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140001b98]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x140024c68
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x140024cb5
cmp rcx, 0xffffffffffffffff
je 0x140024cb5
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140024cad
cmp dword [rcx + 0x3c], edx
jl 0x140024cad
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140024cad
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140024cb5
mov rax, rdx
add rsp, 0x18
ret

Function at 0x140024f00
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x530
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x140024f6b
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x140024f8b
mov rax, qword [rsp + 0x538]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x538]
mov qword [rsp + 0xf8], rax
lea rcx, [0x140001ba8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x530
pop rbx
ret
Function at 0x1400029e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
movabs rax, 0xc2b2ae3d27d4eb4f
movabs rdx, 0x9e3779b185ebca87
movabs r10, 0x85ebca77c2b2ae63
movabs r8, 0x27d4eb2f165667c5
mov r9d, dword [rcx + 0x48]
add r9, rcx
add r9, 0x28
mov rsi, qword [rcx]
cmp rsi, 0x20
jb 0x140002ab9
mov r14, qword [rcx + 8]
mov rbx, qword [rcx + 0x10]
mov rdi, qword [rcx + 0x18]
mov r11, qword [rcx + 0x20]
mov r15, r14
rol r15, 1
mov r12, rbx
rol r12, 7
add r12, r15
mov r15, rdi
rol r15, 0xc
mov r13, r11
rol r13, 0x12
add r13, r15
add r13, r12
imul r14, rax
rol r14, 0x1f
imul r14, rdx
xor r14, r13
imul r14, rdx
add r14, r10
imul rbx, rax
rol rbx, 0x1f
imul rbx, rdx
xor rbx, r14
imul rbx, rdx
imul rdi, rax
rol rdi, 0x1f
add rbx, r10
imul rdi, rdx
xor rdi, rbx
imul rdi, rdx
add rdi, r10
imul r11, rax
rol r11, 0x1f
imul r11, rdx
xor r11, rdi
imul r11, rdx
add r11, r10
jmp 0x140002ac0
mov r11, qword [rcx + 0x18]
add r11, r8
lea rdi, [rcx + 0x28]
add r11, rsi
add rcx, 0x30
cmp rcx, r9
jbe 0x140002ae0
mov rsi, r11
mov rbx, rdi
jmp 0x140002b10
mov rsi, qword [rdi]
imul rsi, rax
rol rsi, 0x1f
imul rsi, rdx
xor rsi, r11
rol rsi, 0x1b
imul rsi, rdx
add rsi, r10
lea rbx, [rdi + 8]
add rdi, 0x10
mov r11, rsi
cmp rdi, r9
mov rdi, rbx
jbe 0x140002ae0
movabs rcx, 0x165667b19e3779f9
lea r10, [rbx + 4]
cmp r10, r9
jbe 0x140002b2d
mov r10, rbx
cmp r10, r9
jb 0x140002b50
jmp 0x140002b70
mov r11d, dword [rbx]
imul r11, rdx
xor r11, rsi
rol r11, 0x17
imul r11, rax
add r11, rcx
mov rsi, r11
cmp r10, r9
jae 0x140002b70
nop word [rax + rax]
movzx r11d, byte [r10]
imul r11, r8
xor r11, rsi
rol r11, 0xb
imul r11, rdx
inc r10
mov rsi, r11
cmp r10, r9
jb 0x140002b50
jmp 0x140002b73
mov r11, rsi
mov rdx, r11
shr rdx, 0x21
xor rdx, r11
imul rdx, rax
mov r8, rdx
shr r8, 0x1d
xor r8, rdx
imul r8, rcx
mov rax, r8
shr rax, 0x20
xor rax, r8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140012c60
Capabilities:
Check if file exists
Get file attributes
Terminate process

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x90
movaps xmmword [rsp + 0x80], xmm8
movaps xmmword [rsp + 0x70], xmm7
movaps xmmword [rsp + 0x60], xmm6
mov rax, qword [0x140036008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rcx, qword [0x14003aab8]
test rcx, rcx
je 0x140012cca
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140012cbd
mov rcx, qword [0x14003aab8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14003aab8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14003d2d0], 1
jne 0x140012d77
mov rbx, qword [0x14002abe0]
mov qword [rsp + 0x50], rbx
movups xmm6, xmmword [0x14002abd0]
movaps xmmword [rsp + 0x40], xmm6
movups xmm7, xmmword [0x14002abc0]
movaps xmmword [rsp + 0x30], xmm7
movups xmm8, xmmword [0x14002abb0]
movaps xmmword [rsp + 0x20], xmm8
lea rsi, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebp, 0x14
lea rdi, [0x14003aad0]
mov r14, qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r15, qword [sym.imp.KERNEL32.dll_Sleep]
mov r12, qword [sym.imp.SHELL32.dll_SHFileOperationW]
nop dword [rax + rax]
mov rcx, rdi
call r14
cmp eax, 0xffffffff
je 0x140012d77
and eax, 0x10
je 0x140012d77
mov ecx, 0x64
call r15
mov qword [rsp + 0x50], rbx
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm7
movaps xmmword [rsp + 0x20], xmm8
mov rcx, rsi
call r12
dec ebp
jne 0x140012d40
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140014180
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm8, xmmword [rsp + 0x80]
add rsp, 0x90
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140013fc0
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
mov eax, 0x2030
call fcn.140014120
sub rsp, rax
mov rsi, rcx
mov rax, qword [0x140036008]
xor rax, rsp
mov qword [rsp + 0x2028], rax
mov eax, dword [0x14003aac0]
test eax, eax
je 0x140013ff5
test eax, eax
jg 0x14001403d
jmp 0x140014072
lea rdx, str._HOME_
lea rcx, [rsp + 0x20]
mov r8d, 0x1000
call fcn.1400124d0
test al, al
je 0x1400140fa
lea rcx, [rsp + 0x20]
call fcn.14001ad54
movsxd rcx, dword [0x14003aac0]
lea rdx, [0x140047b30]
mov qword [rdx + rcx*8], rax
lea eax, [rcx + 1]
mov dword [0x14003aac0], eax
test eax, eax
jle 0x140014072
lea rdi, [0x140047b30]
xor ebx, ebx
nop word cs:[rax + rax]
mov rdx, qword [rdi]
mov rcx, rsi
call fcn.14001b9b0
test eax, eax
je 0x1400140db
inc rbx
movsxd rax, dword [0x14003aac0]
add rdi, 8
cmp rbx, rax
jl 0x140014050
mov rcx, rsi
call fcn.14001b9e8
cmp rax, 2
jne 0x140014089
mov bl, 1
cmp word [rsi + 2], 0x3a
je 0x1400140dd
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov bl, 1
test eax, eax
jne 0x1400140a8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
sete bl
test bl, bl
je 0x1400140dd
cmp dword [0x14003aac0], 0x3ff
jg 0x1400140dd
mov rcx, rsi
call fcn.14001ad54
movsxd rcx, dword [0x14003aac0]
lea rdx, [0x140047b30]
mov qword [rdx + rcx*8], rax
lea eax, [rcx + 1]
mov dword [0x14003aac0], eax
mov bl, 1
mov rcx, qword [rsp + 0x2028]
xor rcx, rsp
call fcn.140014180
mov eax, ebx
add rsp, 0x2030
pop rbx
pop rdi
pop rsi
ret
lea rcx, str._HOME_
call fcn.1400134b0
int3

Function at 0x140014900
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001494a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001494a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001494a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001494a
cmp dword [rcx + 0x84], 0xe
jbe 0x14001494a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001494c
xor al, al
add rsp, 0x28
ret
Function at 0x140019b20
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140019c68
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140019cd7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140019cd7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140019cd7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140019cd7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140019cd7
cmp dword [rcx + 0x84], 0xe
jbe 0x140019cd7
cmp dword [rcx + 0xf8], 0
je 0x140019cd7
mov ecx, ebx
call fcn.140019ba0
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140019dfc
nop
cmp dword [rbp + 0x20], 0
je 0x140019d25
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140019c34
int3

Function at 0x14001be70
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14001be98
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14001be98
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400217e4
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14002186b
mov rsi, rbx
cmp word [rax], bp
je 0x14002182a
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140021814
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140021810
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14001ec24
mov rdi, rax
test rax, rax
je 0x140021858
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140015150
mov rbp, rdi
xor ecx, ecx
call fcn.14001dcd4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140025920
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x140025936
mov al, 1
jmp 0x140025996
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x140025947
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x140025994
mov ecx, dword [rcx + 0x18]
nop
call fcn.140021cdc
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140025994
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x140025994
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x140025994
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x140025996
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140026020
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x14002612a
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
nop
push 0x78cc3abf
mov qword [rsp], rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
xchg r11, rbx
mov r11, rdx
xchg r11, rbx
mov rdi, rcx
mov esi, r8d
sub rdi, rdx
xchg rbp, rcx
mov rcx, rbp
xchg rcx, rbp
add rdi, 0xf0
dec rsi
shr rsi, 3
shr rsi, 1
inc rsi
nop dword [rax]
xchg r10, rbx
movups xmm0, xmmword [r10]
xchg rbx, r10
xchg r8, rbp
mov rdx, r8
xchg r8, rbp
xchg rsi, rcx
mov rsi, rbx
xchg rcx, rsi
call fcn.1400267c0
mov ecx, 0x1e3e1b4d
xor ecx, 0x2dacfb0f
xor ecx, 0x1606f1bd
add ecx, 0x34264298
xor ecx, 0x9e8a749
xor ecx, 0x5052f3ce
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1400260c9
nop
sub rdi, 0x3ef72f68
add rdi, 0x3ef72f58
xchg rbp, rsi
movups xmmword [rsi + 0xf0], xmm0
xchg rbp, rsi
sub rsi, 1
jne 0x140026078
xchg rbp, rdi
mov rbp, qword [rsp + 0x30]
xchg rdi, rbp
xchg r12, rbx
mov r12, qword [rsp + 0x38]
xchg rbx, r12
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
nop
mov rsi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140026140
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
xchg r14, rsi
mov qword [rsp + 0x18], r14
xchg rsi, r14
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov edi, r8d
xchg rdx, rdi
mov rbx, rdi
xchg rdx, rdi
lea r9, [rcx + 0xf0]
xchg rsi, rbx
mov rbx, rcx
xchg rbx, rsi
test r8d, r8d
je 0x140026215
dec rdi
shr rdi, 2
shr rdi, 1
shr rdi, 1
inc rdi
nop dword [rax]
nop word [rax + rax]
xchg rbx, rsi
mov rax, rsi
xchg rsi, rbx
sub r9, rbx
mov edx, 0x415d74e0
xor edx, 0x3e41267d
sub edx, 0x7b303af7
add edx, 0x73abec7b
sub edx, 0x100837bd
sub edx, 0x678fcc54
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400261d8
xchg rsi, rdx
mov rsi, rdx
xchg rsi, rdx
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.1400262a0
mov r9, rbx
sub rbx, 0xfffffffffffffff0
sub rdi, 1
jne 0x1400261a4
movups xmm0, xmmword [r9]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
xchg rsi, rdi
movups xmmword [rdi + 0xf0], xmm0
xchg rsi, rdi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400279d0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov qword [rsp + 8], rbx
nop
push r14
mov qword [rsp], rdi
sub rsp, 0x10
mov rbx, rdx
xchg rbx, r10
mov rbx, rcx
xchg r10, rbx
test r8b, 0xf
je 0x140027a13
xor al, al
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
xor edx, edx
test r8d, r8d
je 0x140027ac5
movdqa xmm2, xmmword [rsp]
nop
xchg r13, rdx
movdqu xmm1, xmmword [r13 + rbx]
xchg rdx, r13
test edx, edx
jne 0x140027a42
movdqu xmm2, xmmword [r10 + 0x200]
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
pxor xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0x1c933ab5
sub ecx, 0x1a9c3850
add ecx, 0x49674d61
xor ecx, 0x1f691345
add ecx, 0x12d89d58
sub ecx, 0x670ff9ce
nop dword [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027a7e
aesdeclast xmm0, xmmword [r10 + 0x1e0]
pxor xmm0, xmm2
movdqa xmm2, xmm1
xchg rbp, rdx
movups xmmword [rbp + r9], xmm0
xchg rdx, rbp
nop
sub edx, 0x50f399c9
add edx, 0x50f399d9
cmp edx, r8d
jb 0x140027a24
xchg r13, rbx
mov r13, qword [rsp + 0x20]
xchg r13, rbx
mov al, 0x7c
sub al, 0x55
add al, 0x45
sub al, 0x48
sub al, 0x13
xor al, 0x70
sub al, 0x60
add rsp, 0x10
push rax
push rax
push rax
xchg qword [rsp + 0x18], rdi
add rsp, 0x20
ret

Function at 0x140027af0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x10
mov rbx, rdx
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
test r8b, 0xf
je 0x140027b2a
xor al, al
add rsp, 0x10
push rax
push rcx
push rax
push rcx
push rax
push rdx
push rax
xchg qword [rsp + 0x38], rbx
pop rax
pop rdx
pop rax
pop rcx
pop rax
pop rcx
pop rax
add rsp, 8
ret
xor edx, edx
test r8d, r8d
je 0x140027bff
movdqa xmm0, xmmword [rsp]
xchg rdi, r15
mov qword [rsp + 0x20], r15
xchg rdi, r15
nop dword [rax + rax]
xchg rdx, r15
movdqu xmm1, xmmword [r15 + rbx]
xchg r15, rdx
test edx, edx
jne 0x140027b6e
xchg r10, r12
movdqu xmm0, xmmword [r12 + 0x200]
xchg r10, r12
pxor xmm0, xmm1
lea rax, [r10 + 0x10]
pxor xmm0, xmmword [r10 + 0x1e0]
mov ecx, 0x25c5fee6
sub ecx, 0xe316eb3
xor ecx, 0x44059bd8
sub ecx, 0x4f736ee
xor ecx, 0x45157eec
add ecx, 0x196fa78f
sub ecx, 0x1d6cd8d9
sub ecx, 0x78f78ba
nop dword [rax + rax]
aesenc xmm0, xmmword [rax]
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x140027bb6
aesenclast xmm0, xmmword [r10 + 0xe0]
xchg rdi, rdx
movups xmmword [rdi + r9], xmm0
xchg rdx, rdi
nop
sub edx, 0x2a60cb94
add edx, 0x2a60cba4
cmp edx, r8d
jb 0x140027b4a
xchg rdi, r12
mov r12, qword [rsp + 0x20]
xchg r12, rdi
mov al, 0x47
xor al, 0x58
add al, 0x48
xor al, 0x2a
sub al, 0xb
sub al, 0x41
add rsp, 0x10
push rax
push rdx
push rcx
xchg qword [rsp + 0x18], rbx
pop rcx
pop rdx
pop rax
add rsp, 8
ret
Function at 0x1400289c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r14, rsi
mov qword [rsp + 0x10], r14
xchg rsi, r14
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg rbx, r8
mov r8, rbx
xchg r8, rbx
xchg rdi, rdx
mov rdx, rdi
xchg rdi, rdx
mov rsi, rcx
jne 0x140028a5e
nop
xchg r9, r8
mov r9, qword [rbx + 0x10]
xchg r9, r8
xchg rdx, rcx
mov rcx, rdi
xchg rdx, rcx
xchg rcx, rsi
mov rsi, rcx
xchg rsi, rcx
call fcn.1400289c0
xchg rbx, rbp
mov rcx, rbp
xchg rbx, rbp
mov edx, 0x6de1f5c1
sub edx, 0x2f0739b4
sub edx, 0x228d8a27
add edx, 0x5976beb7
xor edx, 0x4c9c73ce
xor edx, 0x395f8363
mov rbx, qword [rbx]
call fcn.1401fc804
cmp byte [rbx + 0x19], 0
je 0x1400289ff
mov rbx, qword [rsp + 0x30]
xchg rdx, rsi
mov rdx, qword [rsp + 0x38]
xchg rdx, rsi
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140029970
Capabilities:
Encode data using xor

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg r12, rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
xor ebx, ebx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x140029a09
xchg r8, rdx
mov r8, qword [rdi + 0x28]
xchg r8, rdx
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1400299ec
xchg r14, r8
mov r14, qword [rcx - 8]
xchg r14, r8
nop
add rdx, 0x1d19cf33
sub rdx, 0x1d19cf0c
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140029abc
mov rcx, r8
call fcn.1401fc804
xchg r8, rbx
mov qword [rdi + 0x18], r8
xchg rbx, r8
mov qword [rdi + 0x20], rbx
xchg r13, rbx
mov qword [rdi + 0x28], r13
xchg r13, rbx
xchg rcx, r11
mov r11, qword [rdi + 8]
xchg r11, rcx
mov rax, qword [rcx + 8]
xchg r12, rbx
mov qword [rax], r12
xchg rbx, r12
mov rcx, qword [rcx]
test rcx, rcx
je 0x140029a7d
nop dword [rax + rax]
xchg rbx, rbp
mov rbp, qword [rcx]
xchg rbp, rbx
mov edx, 0x655ac416
sub edx, 0x42d13d04
add edx, 0x134ee3b0
add edx, 0x1aeac4b6
xor edx, 0x458a0b18
xor edx, 0x4ede8bf2
sub edx, 0x5b97af7a
call fcn.1401fc804
xchg rbx, r13
mov rcx, r13
xchg rbx, r13
test rbx, rbx
jne 0x140029a34
mov rcx, qword [rdi + 8]
mov edx, 0x4daaad1f
sub edx, 0x57e9bcd
xor edx, 0x4bc2832f
add edx, 0x1d245874
add edx, 0x34e2dbe6
sub edx, 0x55f5c6bf
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
jmp fcn.1401fc804
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14002cb70
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
xchg r12, rbx
mov qword [rsp + 0x10], r12
xchg r12, rbx
xchg rbp, rsi
mov qword [rsp + 0x18], rbp
xchg rsi, rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rsi, rcx
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x60]
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
xchg rdi, rbx
mov qword [rsp + 0x40], rdi
xchg rbx, rdi
add rcx, 0xc8
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x1eba054b
xor dword [rsp + 0x20], 0x409caad7
xor dword [rsp + 0x20], 0x773a4934
xor dword [rsp + 0x20], 0x1415839e
sub dword [rsp + 0x20], 0x2c215b60
xor dword [rsp + 0x20], 0x11891e27
add dword [rsp + 0x20], 0x4fd6312
add dword [rsp + 0x20], 0x25e3c5b
xor dword [rsp + 0x20], 0x8bcb756
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b830
test eax, eax
js 0x14002cc37
cmp qword [rsp + 0x40], rbx
je 0x14002cc37
lea eax, [rbx + 1]
jmp 0x14002cd6a
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0x70], 2
jbe 0x14002cc7b
mov eax, 0x244f210f
add eax, 0x399fdbac
sub eax, 0x524e93a2
sub eax, 0x80d3f21
add eax, 0x6b5e312b
add eax, 0xdc10d10
sub eax, 0x40c3905a
xor eax, 0x3beed7db
jmp 0x14002cd6a
cmp dword [rcx + 0x74], ebx
jbe 0x14002ccb1
mov eax, 0x2890c0bd
add eax, 0xcc9b5a7
xor eax, 0x6611e988
sub eax, 0x469f89c5
add eax, 0x4d513425
sub eax, 0x39ceea8c
xor eax, 0x3216c0cc
sub eax, 0x12389f09
jmp 0x14002cd6a
cmp byte [rdi + 2], bl
je 0x14002cce7
mov eax, 0x1604b0f5
add eax, 0x1dd86a23
sub eax, 0x16bdd788
xor eax, 0x30e5e8d6
xor eax, 0x1fe61f95
xor eax, 0x4f03e2d9
sub eax, 0x2dea18ff
sub eax, 0x4f353d07
jmp 0x14002cd6a
cmp r14d, 0xa
jb 0x14002cd29
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002cd29
mov eax, 0x9d905ed
xor eax, 0x13bc4eab
add eax, 0x574dd215
xor eax, 0x3788f571
sub eax, 0x1189a492
xor eax, 0x34b24390
jmp 0x14002cd6a
lea rcx, [rsi + 0xb8]
mov edx, 0x12044b5e
add edx, 0x160eeb52
add edx, 0xe51b2c8
sub edx, 0xb9369a6
add edx, 0x51b26b
add edx, 0x1a9bf5bd
add edx, 0x53da719f
call fcn.14002c140
jmp 0x14002cd68
mov eax, ebx
mov rbx, qword [rsp + 0x48]
xchg rsi, rdi
mov rdi, qword [rsp + 0x50]
xchg rdi, rsi
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
push rax
push rcx
push rbx
push rax
push rdx
push rbx
xchg qword [rsp + 0x30], r14
pop rbx
pop rdx
pop rax
pop rbx
pop rcx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14002db60
Capabilities:
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
xchg rcx, rbx
mov rcx, rbx
xchg rbx, rcx
cmp byte [rcx + 6], 0
je 0x14002db9f
xor eax, eax
add rsp, 0x20
push rcx
push rdx
push rax
push rcx
push rcx
push rdx
push rdx
xchg qword [rsp + 0x38], rbx
pop rdx
pop rdx
pop rcx
pop rcx
pop rax
pop rdx
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx + 1], 0
je 0x14002dbed
mov eax, 0x6825544f
sub eax, 0x1f7e781a
xor eax, 0x2bf51493
sub eax, 0x26ddc1a1
sub eax, 0x1575d13d
add eax, 0x9421c22
add eax, 0x19657cfb
xor eax, 0x1e82a3f
sub eax, 0x484fe4d7
add rsp, 0x20
nop
add rsp, 8
mov rbx, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
je 0x14002dc31
mov eax, 0x4c884d49
sub eax, 0x44de1a55
add eax, 0x22c23f93
add eax, 0x9bbd91e
sub eax, 0x4c44cf5
add eax, 0x3bb68f44
sub eax, 0xe8b5a6c
xor eax, 0x15656917
xor eax, 0x49ea5a9b
add rsp, 0x20
nop
xchg qword [rsp], rbx
add rsp, 8
ret
cmp byte [rcx + 4], 0
je 0x14002dc77
mov eax, 0x21a3b180
add eax, 0x1c64914f
sub eax, 0x62e07e0
sub eax, 0x1fc1a0b8
add eax, 0x4a752232
xor eax, 0x630320f1
xor eax, 0x18e9c9f
add rsp, 0x20
push rcx
push rdx
push rdx
xchg qword [rsp + 0x18], rbx
add rsp, 0x20
nop
add rsp, 8
jmp qword [rsp - 8]
mov edx, 0x1d067556
add edx, 0x41365523
xor edx, 0x5cd52868
xor edx, 0x24023555
xor edx, 0x106c8c8e
sub edx, 0x36875bc6
mov ecx, dword [rcx + 0xc]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
int3