joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011cef0
Capabilities:
Encode data using xor

Disassembly:
push r15
mov qword [rsp], rbx
add rsp, 0x35cd9f11
sub rsp, 0x35cda141
mov rax, qword [0x1401422b0]
lea rdx, [rsp + 0x20]
xchg r13, r13
xchg rcx, r11
mov rbx, r11
xchg r11, rcx
xor r9d, r9d
xchg r14, r14
movabs rcx, 0x4a9969ef3cceb2c6
sub rcx, 0x28108318
xor rcx, 0x49e824c5
add rcx, 0x7fffffff
xor rcx, 0x3f55f75c
xor rax, rcx
mov dword [rsp - 0x40], ebx
movabs rcx, 0xaf54db905f738114
xor rcx, 0x1c68c251
add rcx, 0x368b6cef
sub rcx, 0x3b6b279e
rol rax, 8
rol rax, 0xb
rol rax, 1
rol rax, 1
rol rax, 1
xor rax, rcx
lea r8d, [r9 + 8]
mov dword [rsp - 0x1c], ebx
rol rax, 0x1d
rol rax, 2
rol rax, 0xf
rol rax, 9
rol rax, 1
rol rax, 1
movabs rcx, 0x4b6b591f2cd10c9f
xor rcx, 0x71c69f74
add rcx, 0xa3835d7
sub rcx, 0x52b7f00c
add rcx, 0x39d83397
add rax, rcx
mov dword [rsp - 0x3c], 0x26ec05f1
xor ecx, ecx
call rax
lea rcx, [rbx + 8]
xorps xmm0, xmm0
mov dword [rsp - 0x14], edx
xchg rcx, r13
mov qword [rbx], r13
xchg r13, rcx
movups xmmword [rcx], xmm0
xchg rdi, rdi
xchg rdi, rcx
movups xmmword [rdi + 0x10], xmm0
xchg rdi, rcx
movups xmmword [rcx + 0x20], xmm0
xchg r9, r9
test eax, eax
je 0x14011d128
lea rax, [rsp + 0x20]
nop
movabs rdx, 0xffffffff6deb0e27
xor rdx, 0x69bf9b71
xor rdx, 0x4032b77f
add rdx, 0x7fffffff
xor rdx, 0x3b99ddd7
nop dword [rax + rax]
mov rbx, rbx
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14011d03c
xchg r9, r9
xchg rbx, r15
mov rcx, r15
xchg rbx, r15
mov qword [rbx + 0x38], rdx
mov dword [rsp - 0x20], edi
call fcn.14001795c
xor r8d, r8d
xchg rdx, rax
mov rax, rdx
xchg rdx, rax
mov ecx, 0x5781c180
add ecx, 0x846fcca
xor ecx, 0x5e3ccb6a
add ecx, 0x57051551
xor ecx, 0x75acc97e
cmp qword [rbx + 0x38], r8
mov dword [rsp - 0x30], 0x6d82edf0
jbe 0x14011d12f
lea r9, [rsp + 0x20]
mov r10d, 0x7ca95fae
xor r10d, 0xd4668c8
sub r10d, 0x2c695e8b
xor r10d, 0x3600b859
sub r10d, 0x73855f83
sub r9, rax
nop word [rax + rax]
mov dword [rsp - 0xc], 0xbe3578a
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r10w
xchg rsi, rsi
ror ecx, 7
ror ecx, 1
xor ax, word [r9 + rdx - 2]
inc r8
xchg r12, r12
mov word [rdx - 2], ax
cmp r8, qword [rbx + 0x38]
jb 0x14011d0d9
xchg rsp, rbx
mov rax, rsp
xchg rbx, rsp
add rsp, 0x107c77c0
sub rsp, 0x107c7590
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
xor r8d, r8d
mov qword [rbx + 0x38], r8
xchg r9, rax
mov r9, rbx
xchg r9, rax
add rsp, 0x230
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
Function at 0x1401340d0
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [0x140142ba4]
mov dword [rsp - 0x34], edx
cmp qword [0x140142bb8], 0
jne 0x14008d610
syscall
ret
jmp 0x14008e144
Function at 0x140136818
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rdx, rbx
mov qword [rsp + 0x10], rsi
mov dword [rsp - 0x24], edi
mov qword [rsp + 0x18], rdi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
push r12
nop
mov qword [rsp - 8], r14
sub rsp, 8
xchg rdi, rsp
mov rbp, rdi
xchg rsp, rdi
nop
sub rsp, 0x5c2f3ecd
add rsp, 0x5c2f3e5d
xchg r14, r8
mov rdi, r14
xchg r14, r8
mov r14, rdx
mov dword [rsp - 0x38], 0x44125ef
xchg rcx, r13
mov rsi, r13
xchg rcx, r13
movabs r12, 0x77ee73b4435e03d3
sub r12, 0x3c2643a4
add r12, 0x5d2b2598
sub r12, 0x4887c42e
cmp r9d, 0x60001
jne 0x140136a25
mov dword [rbp - 0x40], 0x25b84a3
add dword [rbp - 0x40], 0x2bfdc5b7
xor dword [rbp - 0x40], 0x41b6f673
sub dword [rbp - 0x40], 0x443e1232
add dword [rbp - 0x40], 0xa4f72304
xor edx, edx
xchg rsp, rsp
mov dword [rbp - 0x3c], 0x1e5cfc76
xor dword [rbp - 0x3c], 0x4220ac81
sub dword [rbp - 0x3c], 0x4dcbf6d2
add dword [rbp - 0x3c], 0x781de97c
mov dword [rbp - 0x38], 0x55b80bd6
xor dword [rbp - 0x38], 0x7de21f7f
add dword [rbp - 0x38], 0x3e700228
xor dword [rbp - 0x38], 0x7e296a1e
mov ecx, edx
mov dword [rsp - 0x34], edx
mov eax, 0x50b8e755
xor eax, 0x5c682f20
add eax, 0x422903fe
sub eax, 0x47eb1646
add eax, 0x12f2ab8d
rol eax, cl
mov dword [rsp - 0x14], esi
xor al, byte [rbp + rdx - 0x40]
mov byte [rbp + rdx - 0x34], al
inc rdx
cmp rdx, 0xc
mov r13, r13
jb 0x140136908
mov r9d, 0x356446da
sub r9d, 0x2ae2c235
add r9d, 0x6610e4d4
sub r9d, 0x37156987
sub r9d, 0x397ceff3
mov qword [rsp + 0x20], 0xb6cda7a
add qword [rsp + 0x20], 0x44abd6a1
sub qword [rsp + 0x20], 0xee81f0f
xor qword [rsp + 0x20], 0x41309200
lea r8, [rbp - 0x34]
xchg rdi, rsi
mov rdx, rsi
xchg rdi, rsi
mov rcx, r14
call fcn.140133cf0
xchg r9, r9
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
lea rdi, [rbp - 0x34]
xor eax, eax
mov r9, r9
lea ecx, [rax + 0xc]
rep stosb byte [rdi], al
test rbx, rbx
je 0x140136a69
xchg r15, r15
lea rdx, [rbp - 0x28]
lea rcx, [rbx + 0xc]
call fcn.14008f9e0
test dword [rbp - 7], 0x1000
mov dword [rsp - 0x1c], esp
jne 0x140136a69
cmp byte [rbp - 0x1d], 0xe8
jne 0x140136a69
mov r14, r14
lea rdx, [rbx + 0xc]
xchg r14, rcx
mov r14, rcx
xchg rcx, r14
call fcn.1400851f0
mov r9, r9
movzx edx, byte [rbp - 0x28]
add edx, dword [rbp - 0x13]
add edx, eax
mov rax, qword [rsi + 8]
xchg rdx, rdx
xor rax, r12
add rdx, rax
xor rdx, r12
mov dword [rsp - 0x3c], esi
mov qword [rsi + 0x20], rdx
cmp qword [rsi + 0x20], r12
setne al
lea r11, [rsp + 0x70]
mov dword [rsp - 0x3c], edi
xchg rbp, rbx
mov rbp, qword [r11 + 0x20]
xchg rbx, rbp
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
xchg rbp, r11
mov rsp, rbp
xchg rbp, r11
pop r14
mov dword [rsp - 0x14], 0x2ad6de51
nop
add rsp, 8
mov r12, qword [rsp - 8]
pop rbp
mov rdx, rdx
ret
xor al, al
jmp 0x140136a2c
Function at 0x2b36514a0
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x70
movzx ebx, word [section..rdata]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x90], rcx
mov r11, rdx
mov r12, r8
mov rsi, qword [rax]
lea r10, [rsi - 0x10]
nop dword [rax]
mov r8, r10
mov r10, qword [r10]
cmp rsi, r10
je 0x2b365154e
mov rax, qword [r8 + 0x60]
lea rcx, [rax + 2]
movzx eax, word [rax]
test ax, ax
je 0x2b36514e0
mov edx, 0x2108
mov r9d, edx
add rcx, 2
shl r9d, 6
add edx, r9d
add edx, eax
movzx eax, word [rcx - 2]
test ax, ax
jne 0x2b3651500
cmp edx, 0xfcdfbd0e
jne 0x2b36514e0
mov edx, dword [r8 + 0x40]
mov rax, qword [r8 + 0x30]
cmp edx, 2
je 0x2b365154e
sub edx, 3
lea rdx, [rax + rdx + 1]
nop word cs:[rax + rax]
cmp word [rax], bx
je 0x2b3651550
add rax, 1
cmp rax, rdx
jne 0x2b3651540
xor eax, eax
movq xmm0, rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], 0
mov rdx, r12
mov rcx, r11
movhps xmm0, qword [rsp + 0x90]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x60], 0
movaps xmmword [rsp + 0x50], xmm0
call fcn.2b3656520
add rsp, 0x70
pop rbx
pop rsi
pop r12
ret

Function at 0x2b36515c0
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x88
movzx ebx, word [section..rdata]
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov r11, rcx
mov r12, rdx
mov r8d, r8d
mov dword [rsp + 0x5c], 0
mov rdi, qword [rax]
lea r10, [rdi - 0x10]
mov rsi, r10
mov r10, qword [r10]
cmp rdi, r10
je 0x2b3651666
mov rax, qword [rsi + 0x60]
lea rcx, [rax + 2]
movzx eax, word [rax]
test ax, ax
je 0x2b3651600
mov edx, 0x2108
mov r9d, edx
add rcx, 2
shl r9d, 6
add edx, r9d
add edx, eax
movzx eax, word [rcx - 2]
test ax, ax
jne 0x2b3651620
cmp edx, 0xfcdfbd0e
jne 0x2b3651600
mov edx, dword [rsi + 0x40]
mov rax, qword [rsi + 0x30]
cmp edx, 2
je 0x2b3651666
sub edx, 3
lea rdx, [rax + rdx + 1]
nop dword [rax]
cmp word [rax], bx
je 0x2b3651668
add rax, 1
cmp rdx, rax
jne 0x2b3651658
xor eax, eax
mov qword [rsp + 0x60], rax
lea r9, [rsp + 0x5c]
mov rdx, r12
mov rcx, r11
mov qword [rsp + 0x40], 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x70], 0
call fcn.2b3656520
test eax, eax
mov eax, 0
cmovne eax, dword [rsp + 0x5c]
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop r12
ret
Function at 0x2b3651880
Capabilities:
Access peb ldr_data

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x78
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0xa0], rcx
mov r13, r8
mov r8, r9
movzx r9d, word [section..rdata]
mov r12, rdx
mov rsi, qword [rax]
lea r11, [rsi - 0x10]
nop
mov rbx, r11
mov r11, qword [r11]
cmp rsi, r11
je 0x2b3651927
mov rax, qword [rbx + 0x60]
lea rcx, [rax + 2]
movzx eax, word [rax]
test ax, ax
je 0x2b36518c0
mov edx, 0x2108
mov r10d, edx
add rcx, 2
shl r10d, 6
add edx, r10d
add edx, eax
movzx eax, word [rcx - 2]
test ax, ax
jne 0x2b36518e0
cmp edx, 0xfcdfbd0e
jne 0x2b36518c0
mov edx, dword [rbx + 0x40]
mov rax, qword [rbx + 0x30]
cmp edx, 2
je 0x2b3651927
sub edx, 3
lea rdx, [rax + rdx + 1]
nop dword [rax]
cmp word [rax], r9w
je 0x2b3651929
add rax, 1
cmp rax, rdx
jne 0x2b3651918
xor eax, eax
movq xmm0, rax
mov rax, qword [rsp + 0xe0]
mov rdx, r13
mov rcx, r12
mov r9, qword [rsp + 0xc0]
movhps xmm0, qword [rsp + 0xa0]
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xd8]
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.2b3656520
add rsp, 0x78
pop rbx
pop rsi
pop r12
pop r13
ret
Function at 0x2b3657200
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r9d, 1
mov edx, 1
mov ecx, 1
mov r8d, 1
jmp fcn.2b3656960
Function at 0x2b366cf80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, ecx
mov r9, rdx
not eax
cmp r8, 3
jbe 0x2b366d050
lea rdx, [r8 - 4]
lea r10, [0x2b3757be0]
shr rdx, 2
lea rcx, [r9 + rdx*4 + 4]
nop dword [rax]
mov edx, eax
xor al, byte [r9]
add r9, 4
movzx eax, al
shr edx, 8
xor edx, dword [r10 + rax*4]
mov eax, edx
xor dl, byte [r9 - 3]
movzx edx, dl
shr eax, 8
xor eax, dword [r10 + rdx*4]
mov edx, eax
xor al, byte [r9 - 2]
movzx eax, al
shr edx, 8
xor edx, dword [r10 + rax*4]
mov eax, edx
xor dl, byte [r9 - 1]
movzx edx, dl
shr eax, 8
xor eax, dword [r10 + rdx*4]
cmp r9, rcx
jne 0x2b366cfa8
and r8d, 3
test r8, r8
je 0x2b366d044
mov r9d, eax
xor al, byte [rcx]
lea rdx, [0x2b3757be0]
movzx eax, al
shr r9d, 8
xor r9d, dword [rdx + rax*4]
mov eax, r9d
sub r8, 1
je 0x2b366d044
xor al, byte [rcx + 1]
shr r9d, 8
movzx eax, al
xor r9d, dword [rdx + rax*4]
mov eax, r9d
cmp r8, 1
je 0x2b366d044
xor al, byte [rcx + 2]
mov r8d, r9d
movzx eax, al
shr r8d, 8
xor r8d, dword [rdx + rax*4]
mov eax, r8d
not eax
ret
mov rcx, rdx
jmp 0x2b366cff4
Function at 0x2b3680e70
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push rdi
push rsi
push rbx
mov rax, rcx
lea rcx, [rcx + 0xf]
sub rcx, rdx
cmp rcx, 0x1e
jbe 0x2b3680f54
movdqu xmm1, xmmword [rdx]
movups xmmword [rax], xmm1
movdqu xmm0, xmmword [rdx + 0x10]
movups xmmword [rax + 0x10], xmm0
movzx edi, byte [rax + 0x1f]
movzx r9d, byte [rax + 0x1e]
mov r10d, 8
lea r11, [0x2b3758e80]
movzx r8d, byte [rax + 0x1d]
movzx edx, byte [rax + 0x1c]
lea rbx, [0x2b3758d60]
jmp 0x2b3680f19
movzx r8d, r8b
movzx edx, dl
movzx ecx, byte [r11 + r8]
movzx r8d, r9b
movzx r9d, dil
movzx edi, byte [r11 + rdx]
mov edx, r10d
movzx r8d, byte [r11 + r8]
movzx r9d, byte [r11 + r9]
shr edx, 3
xor cl, byte [rbx + rdx]
mov edx, ecx
xor dl, byte [rax]
xor r8b, byte [rax + 1]
add r10d, 1
add rax, 4
xor r9b, byte [rax - 2]
xor dil, byte [rax - 1]
mov byte [rax + 0x1c], dl
mov byte [rax + 0x1d], r8b
mov byte [rax + 0x1e], r9b
mov byte [rax + 0x1f], dil
cmp r10d, 0x3c
je 0x2b3680f50
mov ecx, r10d
and ecx, 7
je 0x2b3680ec0
cmp ecx, 4
jne 0x2b3680eee
movzx edx, dl
movzx r8d, r8b
movzx esi, r9b
movzx ecx, dil
movzx edx, byte [r11 + rdx]
movzx r8d, byte [r11 + r8]
movzx r9d, byte [r11 + rsi]
movzx edi, byte [r11 + rcx]
jmp 0x2b3680eee
pop rbx
pop rsi
pop rdi
ret
movzx ecx, byte [rdx]
mov byte [rax], cl
movzx ecx, byte [rdx + 1]
mov byte [rax + 1], cl
movzx ecx, byte [rdx + 2]
mov byte [rax + 2], cl
movzx ecx, byte [rdx + 3]
mov byte [rax + 3], cl
movzx ecx, byte [rdx + 4]
mov byte [rax + 4], cl
movzx ecx, byte [rdx + 5]
mov byte [rax + 5], cl
movzx ecx, byte [rdx + 6]
mov byte [rax + 6], cl
movzx ecx, byte [rdx + 7]
mov byte [rax + 7], cl
movzx ecx, byte [rdx + 8]
mov byte [rax + 8], cl
movzx ecx, byte [rdx + 9]
mov byte [rax + 9], cl
movzx ecx, byte [rdx + 0xa]
mov byte [rax + 0xa], cl
movzx ecx, byte [rdx + 0xb]
mov byte [rax + 0xb], cl
movzx ecx, byte [rdx + 0xc]
mov byte [rax + 0xc], cl
movzx ecx, byte [rdx + 0xd]
mov byte [rax + 0xd], cl
movzx ecx, byte [rdx + 0xe]
mov byte [rax + 0xe], cl
movzx ecx, byte [rdx + 0xf]
mov byte [rax + 0xf], cl
movzx ecx, byte [rdx + 0x10]
mov byte [rax + 0x10], cl
movzx ecx, byte [rdx + 0x11]
mov byte [rax + 0x11], cl
movzx ecx, byte [rdx + 0x12]
mov byte [rax + 0x12], cl
movzx ecx, byte [rdx + 0x13]
mov byte [rax + 0x13], cl
movzx ecx, byte [rdx + 0x14]
mov byte [rax + 0x14], cl
movzx ecx, byte [rdx + 0x15]
mov byte [rax + 0x15], cl
movzx ecx, byte [rdx + 0x16]
mov byte [rax + 0x16], cl
movzx ecx, byte [rdx + 0x17]
mov byte [rax + 0x17], cl
movzx ecx, byte [rdx + 0x18]
mov byte [rax + 0x18], cl
movzx ecx, byte [rdx + 0x19]
mov byte [rax + 0x19], cl
movzx ecx, byte [rdx + 0x1a]
mov byte [rax + 0x1a], cl
movzx ecx, byte [rdx + 0x1b]
mov byte [rax + 0x1b], cl
movzx ecx, byte [rdx + 0x1c]
mov byte [rax + 0x1c], cl
movzx ecx, byte [rdx + 0x1d]
mov byte [rax + 0x1d], cl
movzx ecx, byte [rdx + 0x1e]
mov byte [rax + 0x1e], cl
movzx edx, byte [rdx + 0x1f]
mov byte [rax + 0x1f], dl
jmp 0x2b3680e97
Function at 0x2b3685ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
mov r8, rcx
movzx ecx, byte [rcx + 0x1f]
lea r9, [r8 + 0x20]
mov edx, ecx
and ecx, 0x7f
shr dl, 7
mov byte [r8 + 0x1f], cl
movzx edx, dl
lea eax, [rdx + rdx*8]
lea eax, [rdx + rax*2]
mov rdx, r8
nop word [rax + rax]
movzx ecx, byte [rdx]
add rdx, 1
add eax, ecx
mov byte [rdx - 1], al
shr ax, 8
cmp r9, rdx
jne 0x2b3685d10
xor edx, edx
mov eax, 0x13
mov r9, rsp
nop
movzx ecx, byte [r8 + rdx]
add eax, ecx
mov byte [r9 + rdx], al
add rdx, 1
shr ax, 8
cmp rdx, 0x1f
jne 0x2b3685d30
movzx edx, byte [r8 + 0x1f]
movdqu xmm1, xmmword [r8]
pxor xmm1, xmmword [rsp]
lea eax, [rax + rdx - 0x80]
mov byte [rsp + 0x1f], al
sar ax, 0xf
movd xmm0, eax
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
pand xmm1, xmm0
pxor xmm1, xmmword [rsp]
movups xmmword [r8], xmm1
movdqu xmm1, xmmword [r8 + 0x10]
pxor xmm1, xmmword [rsp + 0x10]
pand xmm0, xmm1
pxor xmm0, xmmword [rsp + 0x10]
movups xmmword [r8 + 0x10], xmm0
add rsp, 0x28
ret

Function at 0x2b36864c0
Capabilities:
Encrypt data using curve25519
Hash data using sha512

Disassembly:
push r12
push rbx
sub rsp, 0xe8
movdqa xmm0, xmmword [0x2b3759400]
movdqa xmm1, xmmword [0x2b3759410]
movdqa xmm2, xmmword [0x2b3759420]
movdqa xmm3, xmmword [0x2b3759430]
movdqu xmm4, xmmword [rdx]
movdqu xmm5, xmmword [rdx + 0x10]
lea r8, [rsp + 0x60]
mov rbx, rcx
lea r12, [rsp + 0x20]
mov qword [rsp + 0x80], 0
mov rdx, r8
mov rcx, r12
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov byte [rsp + pe_nt_image_headers64], 0x80
mov byte [rsp + 0xde], 1
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x40], xmm2
movaps xmmword [rsp + 0x50], xmm3
movaps xmmword [rsp + 0x60], xmm4
movaps xmmword [rsp + 0x70], xmm5
call fcn.2b3685f70
mov r8d, 0x40
mov rdx, rbx
mov rcx, r12
call fcn.2b3686420
movzx eax, byte [rbx + 0x1f]
and byte [rbx], 0xf8
and eax, 0x7f
or eax, 0x40
mov byte [rbx + 0x1f], al
add rsp, 0xe8
pop rbx
pop r12
ret
Function at 0x2b36867d0
Capabilities:
Hash data using sha512

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
movdqa xmm0, xmmword [0x2b3759400]
movdqa xmm1, xmmword [0x2b3759410]
movdqa xmm2, xmmword [0x2b3759420]
movdqa xmm3, xmmword [0x2b3759430]
mov rbp, qword [rsp + 0xe0]
mov r14, rcx
mov ecx, r8d
mov r13, rdx
mov r12, r9
lea r15, [rbp + rcx]
movaps xmmword [rsp + 0x30], xmm0
add rcx, rdx
movaps xmmword [rsp + 0x40], xmm1
movaps xmmword [rsp + 0x50], xmm2
movaps xmmword [rsp + 0x60], xmm3
cmp rbp, 0x7f
ja 0x2b36868a0
cmp r15, 0x7f
jbe 0x2b3686970
mov edx, pe_nt_image_headers64
lea rdi, [rcx + 8]
mov rsi, r12
sub edx, r8d
mov r8, qword [r9]
and rdi, 0xfffffffffffffff8
mov eax, edx
lea r9, [r9 + rax]
mov qword [rcx], r8
mov r8, qword [r9 - 8]
mov qword [rsp + 0x20], r9
mov qword [rcx + rax - 8], r8
sub rcx, rdi
add edx, ecx
sub rsi, rcx
shr edx, 3
mov ecx, edx
mov rdx, r13
rep movsq qword [rdi], qword [rsi]
lea rdi, [rsp + 0x30]
mov rcx, rdi
call fcn.2b3685f70
mov r9, qword [rsp + 0x20]
jmp 0x2b368692c
mov edx, pe_nt_image_headers64
lea rdi, [rcx + 8]
mov rsi, r12
sub edx, r8d
mov r8, qword [r9]
and rdi, 0xfffffffffffffff8
mov eax, edx
lea r9, [r9 + rax]
mov qword [rcx], r8
mov r8, qword [r9 - 8]
mov qword [rsp + 0x28], r9
mov qword [rcx + rax - 8], r8
sub rcx, rdi
sub rsi, rcx
add ecx, edx
mov qword [rsp + 0x20], rax
mov rdx, r13
shr ecx, 3
rep movsq qword [rdi], qword [rsi]
lea rdi, [rsp + 0x30]
mov rcx, rdi
call fcn.2b3685f70
mov rax, qword [rsp + 0x20]
mov r9, qword [rsp + 0x28]
lea rbx, [rax + 0x80]
cmp rbp, rbx
jb 0x2b368692c
lea rsi, [r12 - 0x80]
nop dword [rax + rax]
lea rdx, [rsi + rbx]
mov rcx, rdi
call fcn.2b3685f70
mov rax, rbx
sub rbx, 0xffffffffffffff80
cmp rbx, rbp
jbe 0x2b3686910
lea r9, [r12 + rax]
mov r8, r15
mov rdx, r9
mov rcx, rdi
call fcn.2b3686290
mov rdx, r13
mov rcx, rdi
mov r8d, 0x40
call fcn.2b3686420
mov r8d, 0x40
mov rdx, r13
mov rcx, r14
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.2b3686600
mov r8, rbp
mov rdx, r9
lea rdi, [rsp + 0x30]
call sub.msvcrt.dll_memcpy
mov r8, r15
mov rdx, r13
mov rcx, rdi
call fcn.2b3686290
jmp 0x2b368693a
Function at 0x2b368b090
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov eax, dword [rdx]
mov dword [rcx + 0x10], eax
mov eax, dword [rdx + 4]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x18], eax
mov eax, dword [rdx + 0xc]
mov dword [rcx + 0x1c], eax
lea rax, str.expand_16_byte_k
cmp r8d, 0x100
jne 0x2b368b0c2
add rdx, 0x10
lea rax, str.expand_32_byte_k
mov r8d, dword [rdx]
mov dword [rcx + 0x20], r8d
mov r8d, dword [rdx + 4]
mov dword [rcx + 0x24], r8d
mov r8d, dword [rdx + 8]
mov dword [rcx + 0x28], r8d
mov edx, dword [rdx + 0xc]
mov dword [rcx + 0x2c], edx
movsx edx, byte [rax + 1]
movsx r8d, byte [rax + 2]
shl edx, 8
shl r8d, 0x10
or edx, r8d
movsx r8d, byte [rax]
or edx, r8d
movsx r8d, byte [rax + 3]
shl r8d, 0x18
or edx, r8d
mov dword [rcx], edx
movsx edx, byte [rax + 5]
movsx r8d, byte [rax + 6]
shl edx, 8
shl r8d, 0x10
or edx, r8d
movsx r8d, byte [rax + 4]
or edx, r8d
movsx r8d, byte [rax + 7]
shl r8d, 0x18
or edx, r8d
mov dword [rcx + 4], edx
movsx edx, byte [rax + 9]
movsx r8d, byte [rax + 0xa]
shl edx, 8
shl r8d, 0x10
or edx, r8d
movsx r8d, byte [rax + 8]
or edx, r8d
movsx r8d, byte [rax + 0xb]
shl r8d, 0x18
or edx, r8d
mov dword [rcx + 8], edx
movsx edx, byte [rax + 0xd]
movsx r8d, byte [rax + 0xe]
shl edx, 8
shl r8d, 0x10
or edx, r8d
movsx r8d, byte [rax + 0xc]
movsx eax, byte [rax + 0xf]
or edx, r8d
shl eax, 0x18
or eax, edx
mov dword [rcx + 0xc], eax
ret
Function at 0x2b368b1d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, r9d
je 0x2b368b1e0
jmp 0x2b368a3f0
ret
Function at 0x2b368ef30
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
sub rsp, 0x68
xor r9d, r9d
mov r10, rcx
mov qword [rsp + 0x30], r8
mov rcx, rdx
lea r8, [rsp + 0x58]
mov qword [rsp + 0x58], 0
mov rdx, r10
mov dword [rsp + 0x48], 0x40
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 1
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.ntdll.dll_NtMapViewOfSection]
cmp eax, 0x40000003
je 0x2b368ef91
xor r8d, r8d
test eax, eax
jne 0x2b368ef96
mov r8, qword [rsp + 0x58]
mov rax, r8
add rsp, 0x68
ret
Function at 0x2b36927f0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
test rcx, rcx
je 0x2b3692819
cmp word [rcx], 0x5a4d
jne 0x2b3692819
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x2b3692819
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x2b3692819
mov r8d, dword [rcx + 0x28]
mov eax, r8d
ret

Function at 0x2b3692820
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
test rcx, rcx
je 0x2b369284f
cmp word [rcx], 0x5a4d
jne 0x2b369284f
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x2b369284f
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x2b369284f
cmp word [rcx + 0x18], 0x20b
sete r8b
mov eax, r8d
ret
Function at 0x2b3693af0
Capabilities:
Process ghostly hollowing

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xb0
lea rbp, [rsp + 0x90]
mov r12, rcx
lea rdi, [rsp + 0x80]
mov qword [rsp + 0x80], rbp
test rcx, rcx
je 0x2b3693d10
call sub.msvcrt.dll_wcslen
lea rbx, [rax + rax]
mov rsi, rbx
sar rsi, 1
mov qword [rsp + 0x60], rsi
cmp rbx, 0xe
ja 0x2b3693d30
mov rcx, qword [rsp + 0x80]
mov rax, rsi
cmp rsi, 1
je 0x2b3693d20
test rsi, rsi
jne 0x2b3693cf0
xor r8d, r8d
mov qword [rsp + 0x88], rax
lea rbx, str.___
mov word [rcx + rax*2], r8w
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov r9, rbx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, rdi
call fcn.2b3740740
lea rbx, [rsp + 0x70]
lea rdx, [rax + 0x10]
mov qword [rsp + 0x60], rbx
mov rcx, qword [rax]
cmp rcx, rdx
je 0x2b3693d60
mov qword [rsp + 0x60], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
mov rcx, qword [rax + 8]
mov qword [rsp + 0x68], rcx
mov qword [rax], rdx
mov rcx, qword [rsp + 0x80]
xor edx, edx
mov qword [rax + 8], 0
mov word [rax + 0x10], dx
cmp rcx, rbp
je 0x2b3693bf2
mov rax, qword [rsp + 0x90]
lea rdx, [rax + rax + 2]
call fcn.2b37520f0
lea rsi, [rsp + 0x40]
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov rcx, rsi
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov qword [rsp + 0x80], 0
mov r8, rdi
lea rcx, [rsp + 0x38]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x98], 0
mov edx, 0xc0110000
mov qword [rsp + 0x88], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0x80], 0x30
mov dword [rsp + 0x98], 0x40
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x38], 0xffffffffffffffff
mov dword [rsp + 0x28], 0x20
mov dword [rsp + 0x20], 3
call qword [sym.imp.ntdll.dll_NtOpenFile]
mov rcx, qword [rsp + 0x60]
test eax, eax
mov r12, 0xffffffffffffffff
cmovns r12, qword [rsp + 0x38]
cmp rcx, rbx
je 0x2b3693cdc
mov rax, qword [rsp + 0x70]
lea rdx, [rax + rax + 2]
call fcn.2b37520f0
mov rax, r12
add rsp, 0xb0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov r8, rbx
mov rdx, r12
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x80]
jmp 0x2b3693b5d
lea rcx, [0x2b3759870]
call fcn.2b3753100
nop dword [rax]
movzx edx, word [r12]
mov word [rcx], dx
jmp 0x2b3693b5d
mov rcx, rdi
lea rdx, [rsp + 0x60]
xor r8d, r8d
call fcn.2b3742d50
mov qword [rsp + 0x80], rax
mov rcx, rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x90], rax
jmp 0x2b3693b4a
movdqu xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x70], xmm0
jmp 0x2b3693bb9