joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003d40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbp, rcx
mov ecx, 0x20
call fcn.14000587c
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov ecx, 0x20
call fcn.14000587c
mov r14, rax
mov qword [rsp + 0x58], rax
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
mov rcx, qword gs:[0x58]
mov rsi, qword [rcx]
mov eax, 0xbc8
mov ecx, dword [rax + rsi]
mov edi, 0xbcc
test cl, 1
jne 0x140003dd6
or ecx, 1
mov dword [rax + rsi], ecx
mov word [rdi + rsi + 3], 0x193
mov word [rdi + rsi], 0x93d2
mov byte [rdi + rsi + 2], 0xe0
lea rcx, [0x1400077a0]
call fcn.14000599c
nop
lea r8, [rdi + rsi]
cmp byte [r8 + 4], 0
je 0x140003e91
xor eax, eax
cmp dword [0x14000c008], 5
jl 0x140003e60
movdqa xmm2, xmmword [0x140008d40]
xor ecx, ecx
movdqa xmm3, xmmword [0x140008d80]
movdqa xmm4, xmmword [0x140008e10]
movdqa xmm5, xmmword [0x140008d90]
nop dword [rax]
nop word [rax + rax]
movq xmm0, rcx
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
pshufb xmm1, xmm5
movzx eax, word [r8 + rcx]
movd xmm0, eax
xorps xmm1, xmm0
movd eax, xmm1
mov word [r8 + rcx], ax
add rcx, 2
cmp rcx, 4
jb 0x140003e20
jmp 0x140003e8c
movabs r9, 0x47abcda593a3c787
nop word [rax + rax]
movzx ecx, al
and cl, 7
shl cl, 3
mov rdx, r9
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 4
jb 0x140003e70
mov byte [r8 + 4], 0
mov rdx, r8
mov rcx, r14
call fcn.140002380
nop
test rbx, rbx
je 0x140003ef8
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140003ed8
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140003ed3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003f19
mov rcx, r8
call fcn.1400058c0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov edx, 0x20
mov rcx, rbx
call fcn.1400058c0
mov rdx, r14
mov rcx, rbp
call fcn.140003f20
mov rax, rbp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140004040
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
mov r8, rcx
je 0x1400041c1
xor eax, eax
cmp dword [0x14000c008], 5
jl 0x140004190
movdqa xmm2, xmmword [0x140008d40]
mov r9, 0xfffffffffffffffe
movdqa xmm3, xmmword [0x140008d80]
mov r10d, 2
movdqa xmm4, xmmword [0x140008e00]
sub r9, r8
movdqa xmm5, xmmword [0x140008d90]
sub r10, r8
add rcx, 4
mov rdx, 0xfffffffffffffffc
sub rdx, r8
nop dword [rax]
lea rax, [rdx + rcx]
movq xmm0, rax
movzx eax, word [rcx - 4]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 4], ax
lea rax, [r9 + rcx]
movq xmm0, rax
movzx eax, word [rcx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 2], ax
mov rax, rcx
sub rax, r8
movq xmm0, rax
movzx eax, word [rcx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx], ax
lea rax, [r10 + rcx]
movq xmm0, rax
movzx eax, word [rcx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 2], ax
add rcx, 8
lea rax, [rdx + rcx]
cmp rax, 0x18
jb 0x1400040a0
mov byte [r8 + 0x18], 0
ret
movabs r9, 0x39e3c19bbb935373
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x18
jb 0x1400041a0
mov byte [r8 + 0x18], 0
ret
Function at 0x1400041d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x17], 0
mov r8, rcx
je 0x140004341
xor eax, eax
cmp dword [0x14000c008], 5
jl 0x14000430f
movdqa xmm2, xmmword [0x140008d40]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x140008d80]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140008fc0]
sub r9, rcx
movdqa xmm5, xmmword [0x140008d90]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x10
jb 0x140004223
cmp rax, 0x17
jae 0x14000433c
movabs r9, 0xd993efbb19cfe32d
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x17
jb 0x140004320
mov byte [r8 + 0x17], 0
ret
Function at 0x140004350
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
mov r8, rcx
je 0x1400044c1
xor eax, eax
cmp dword [0x14000c008], 5
jl 0x14000448f
movdqa xmm2, xmmword [0x140008d40]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x140008d80]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140009020]
sub r9, rcx
movdqa xmm5, xmmword [0x140008d90]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x18
jb 0x1400043a3
cmp rax, 0x19
jae 0x1400044bc
movabs r9, 0xe9b5b3b1c77d4573
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x19
jb 0x1400044a0
mov byte [r8 + 0x19], 0
ret
Function at 0x140004ca0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
mov r8, rcx
je 0x140004e11
xor eax, eax
cmp dword [0x14000c008], 5
jl 0x140004ddf
movdqa xmm2, xmmword [0x140008d40]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x140008d80]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140008f70]
sub r9, rcx
movdqa xmm5, xmmword [0x140008d90]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x10
jb 0x140004cf3
cmp rax, 0x13
jae 0x140004e0c
movabs r9, 0xc7d3dbfd570fc78f
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x13
jb 0x140004df0
mov byte [r8 + 0x13], 0
ret
Function at 0x140004e20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
mov r8, rcx
je 0x140004f91
xor eax, eax
cmp dword [0x14000c008], 5
jl 0x140004f5f
movdqa xmm2, xmmword [0x140008d40]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x140008d80]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140008fa0]
sub r9, rcx
movdqa xmm5, xmmword [0x140008d90]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x10
jb 0x140004e73
cmp rax, 0x11
jae 0x140004f8c
movabs r9, 0xcf8ffb89377b9db1
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x11
jb 0x140004f70
mov byte [r8 + 0x11], 0
ret
Function at 0x140004fa0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x28], 0
mov r8, rcx
je 0x140005121
xor eax, eax
cmp dword [0x14000c008], 5
jl 0x1400050f0
movdqa xmm2, xmmword [0x140008d40]
mov r9, 0xfffffffffffffffe
movdqa xmm3, xmmword [0x140008d80]
mov r10d, 2
movdqa xmm4, xmmword [0x140009050]
sub r9, r8
movdqa xmm5, xmmword [0x140008d90]
sub r10, r8
add rcx, 4
mov rdx, 0xfffffffffffffffc
sub rdx, r8
nop dword [rax]
lea rax, [rdx + rcx]
movq xmm0, rax
movzx eax, word [rcx - 4]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 4], ax
lea rax, [r9 + rcx]
movq xmm0, rax
movzx eax, word [rcx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx - 2], ax
mov rax, rcx
sub rax, r8
movq xmm0, rax
movzx eax, word [rcx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx], ax
lea rax, [r10 + rcx]
movq xmm0, rax
movzx eax, word [rcx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, eax
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd eax, xmm1
mov word [rcx + 2], ax
add rcx, 8
lea rax, [rdx + rcx]
cmp rax, 0x28
jb 0x140005000
mov byte [r8 + 0x28], 0
ret
movabs r9, 0xf553e56763671535
nop word [rax + rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x28
jb 0x140005100
mov byte [r8 + 0x28], 0
ret
Function at 0x140005130
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
mov r8, rcx
je 0x1400052a1
xor eax, eax
cmp dword [0x14000c008], 5
jl 0x14000526f
movdqa xmm2, xmmword [0x140008d40]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x140008d80]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140008e10]
sub r9, rcx
movdqa xmm5, xmmword [0x140008d90]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x18
jb 0x140005183
cmp rax, 0x19
jae 0x14000529c
movabs r9, 0x47abcda593a3c787
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x19
jb 0x140005280
mov byte [r8 + 0x19], 0
ret
Function at 0x1400052b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1f], 0
mov r8, rcx
je 0x140005421
xor eax, eax
cmp dword [0x14000c008], 5
jl 0x1400053ef
movdqa xmm2, xmmword [0x140008d40]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x140008d80]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140009020]
sub r9, rcx
movdqa xmm5, xmmword [0x140008d90]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x18
jb 0x140005303
cmp rax, 0x1f
jae 0x14000541c
movabs r9, 0xe9b5b3b1c77d4573
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x1f
jb 0x140005400
mov byte [r8 + 0x1f], 0
ret
Function at 0x140005430
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x30
mov rsi, rcx
cmp qword [rcx + 0x18], 0xf
jbe 0x140005452
mov rsi, qword [rcx]
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0xd24
mov eax, dword [rcx + rdi]
mov edx, 0xd18
test al, 1
jne 0x14000549c
or eax, 1
mov dword [rcx + rdi], eax
lea rbx, [rdi + rdx]
mov dword [rbx + 8], 0x169bdb1
mov dword [rbx], 0x801ebead
mov dword [rbx + 4], 0x106f5ab9
lea rcx, [0x140007970]
call fcn.14000599c
nop
jmp 0x1400054a0
lea rbx, [rdx + rdi]
cmp byte [rbx + 0xb], 0
je 0x1400054d5
xor byte [rbx], 0xdd
xor byte [rbx + 1], 0xd1
xor byte [rbx + 2], 0x69
xor byte [rbx + 3], 0xe5
xor byte [rbx + 4], 0xcb
xor byte [rbx + 5], 0x29
xor byte [rbx + 6], 7
xor byte [rbx + 7], 0x75
xor byte [rbx + 8], 0xdd
xor byte [rbx + 9], 0xd1
xor byte [rbx + 0xa], 0x69
mov byte [rbx + 0xb], 0
mov ecx, 0xd28
mov eax, dword [rcx + rdi]
mov r14d, 0xd10
test al, 1
jne 0x14000550a
or eax, 1
mov dword [rcx + rdi], eax
mov dword [r14 + rdi + 2], 0x1cb8b0c
mov word [r14 + rdi], 0xa1b2
lea rcx, [0x1400079a0]
call fcn.14000599c
nop
lea rdx, [r14 + rdi]
cmp byte [rdx + 5], 0
je 0x14000552b
xor byte [rdx], 0xdd
xor byte [rdx + 1], 0xd1
xor byte [rdx + 2], 0x69
xor byte [rdx + 3], 0xe5
xor byte [rdx + 4], 0xcb
mov byte [rdx + 5], 0
xor eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
mov r9, rsi
mov r8, rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r14
ret
Function at 0x1400056a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
mov r8, rcx
je 0x140005811
xor eax, eax
cmp dword [0x14000c008], 5
jl 0x1400057df
movdqa xmm2, xmmword [0x140008d40]
lea rdx, [rcx + 4]
movdqa xmm3, xmmword [0x140008d80]
mov r9, 0xfffffffffffffffe
movdqa xmm4, xmmword [0x140009010]
sub r9, rcx
movdqa xmm5, xmmword [0x140008d90]
mov r10d, 2
sub r10, rcx
movzx ecx, word [rdx - 4]
movq xmm0, rax
punpcklqdq xmm0, xmm0
add rax, 8
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 4], cx
lea rcx, [r9 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx - 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx - 2], cx
mov rcx, rdx
sub rcx, r8
movq xmm0, rcx
movzx ecx, word [rdx]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx], cx
lea rcx, [r10 + rdx]
movq xmm0, rcx
movzx ecx, word [rdx + 2]
punpcklqdq xmm0, xmm0
paddq xmm0, xmm2
andps xmm0, xmm3
psllq xmm0, 3
vpsrlvq xmm1, xmm4, xmm0
movd xmm0, ecx
pshufb xmm1, xmm5
xorps xmm1, xmm0
movd ecx, xmm1
mov word [rdx + 2], cx
add rdx, 8
cmp rax, 0x18
jb 0x1400056f3
cmp rax, 0x19
jae 0x14000580c
movabs r9, 0xe3912dfd25097b7b
nop dword [rax]
movzx ecx, al
mov rdx, r9
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r8 + rax], dl
inc rax
cmp rax, 0x19
jb 0x1400057f0
mov byte [r8 + 0x19], 0
ret

Function at 0x1400064a0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400064ea
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400064ea
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400064ea
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400064ea
cmp dword [rcx + 0x84], 0xe
jbe 0x1400064ea
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400064ec
xor al, al
add rsp, 0x28
ret
Function at 0x4157c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41594b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432240
xorps xmm15, xmm15
mov r14, qword [0x006304d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x415825
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x415834
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x415853
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x415863
cmp rbx, 0x1000
jae 0x41582b
jmp 0x4158cd
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x415875
xor edx, edx
jmp 0x4158c4
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432240
xorps xmm15, xmm15
mov r14, qword [0x006304d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x415859
jmp 0x415848
call fcn.00463e20
xorps xmm15, xmm15
mov r14, qword [0x006304d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.004362e0
lea rax, [0x004df80c]
mov ebx, 0x18
nop dword [rax]
call fcn.00436b60
mov rax, qword [rsp + 0x38]
call fcn.004368a0
lea rax, [0x004dfb03]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00436b60
mov rax, qword [rsp + 0x30]
call fcn.004368a0
call fcn.00436520
call fcn.00436340
lea rax, [0x004e15cc]
mov ebx, 0x21
call fcn.00434840
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460700
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004157c0
Function at 0x415980
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x415ba6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004322c0
xorps xmm15, xmm15
mov r14, qword [0x006304d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x4159f3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x415a02
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x415a25
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x415a35
cmp rbx, 0x1000
jae 0x4159f9
nop
jmp 0x415ab8
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x415a4d
xor esi, esi
jmp 0x415aaa
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004322c0
xorps xmm15, xmm15
mov r14, qword [0x006304d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x415a2b
jmp 0x415a16
call fcn.00463e20
xorps xmm15, xmm15
mov r14, qword [0x006304d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x415b40
nop dword [rax + rax]
call fcn.004362e0
lea rax, [0x004dfb1c]
mov ebx, 0x19
call fcn.00436b60
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.004368a0
lea rax, [0x004dfb03]
mov ebx, 0x19
call fcn.00436b60
mov eax, dword [rsp + 0x34]
call fcn.004368a0
nop
call fcn.00436520
call fcn.00436340
lea rax, [0x004a62f9]
mov ebx, 0xd
call fcn.00434840
nop dword [rax + rax]
cmp eax, 0x5af
je 0x415ae0
call fcn.004362e0
lea rax, [0x004dfb1c]
mov ebx, 0x19
call fcn.00436b60
mov rax, qword [rsp + 0x38]
call fcn.004368a0
lea rax, [0x004dfb03]
mov ebx, 0x19
call fcn.00436b60
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.004368a0
call fcn.00436520
call fcn.00436340
lea rax, [0x004e0f31]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.00434840
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460700
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00415980