joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62c040
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x62c115
movdqa xmm0, xmmword [0x00794090]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x62c081
movdqa xmm0, xmmword [0x007940a0]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x62c197
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x62c16b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x00793ce8]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x007940b0]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x638f80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x63911b
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x638fa1
inc rcx
cmp rbx, rcx
jle 0x639111
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x638f9e
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.0053ccc0
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rdi
mov rdx, qword [0x0096ffd0]
test rsi, rsi
mov r8, qword [rsp + 0x88]
cmovne rbx, r8
mov r8, qword [rsp + 0x80]
cmovne rax, r8
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.00635340
mov rdx, qword [rsp + 0x58]
test rdx, rdx
mov rdx, qword [rsp + 0x48]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x60]
mov r9d, 0
cmovne r8, r9
nop word [rax + rax]
test rcx, rcx
jne 0x639105
test rdx, rdx
je 0x6390fa
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x48], rdx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403b20
xorps xmm15, xmm15
mov r14, qword [0x009cee28]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x6390c9
xor eax, eax
lea rbx, [0x00793ccc]
mov ecx, 1
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x50]
lea r8, [0x0070da6d]
mov r9d, 2
mov r10, qword [rsp + 0x60]
mov r11, qword [rsp + 0x48]
call fcn.004512a0
jmp 0x6390f0
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x007922a0]
mov esi, 1
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x48]
call fcn.004511e0
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
mov rdi, r9
add rsp, 0x70
pop rbp
ret
mov rax, r9
mov rbx, rsi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004710c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00638f80
Function at 0x679da0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x679ea2
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov rcx, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
nop
mov rax, rcx
call fcn.00506ec0
test rdi, rdi
jne 0x679df3
mov rbx, qword [0x00987338]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rdx]
mov rdi, qword [rdx + 8]
lea rax, [0x006bcd40]
call fcn.004105e0
mov rdi, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x48], rdi
mov rax, qword [rsp + 0x78]
call fcn.00679d40
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
nop
call fcn.00403b20
xorps xmm15, xmm15
mov r14, qword [0x009cee28]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x679e75
xor eax, eax
lea rbx, [0x00793ccc]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
lea r8, [0x0070da6d]
mov r9d, 2
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
call fcn.004512a0
jmp 0x679e9c
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x007922a0]
mov esi, 1
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
call fcn.004511e0
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.004710c0
mov rax, qword [rsp + 8]
jmp fcn.00679da0
Function at 0x14002b900
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14002b90d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14002b91d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14002b905
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14002b935
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14002b922
sub eax, 3
jb 0x14002b94f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14002b986
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14002b976
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14002b974
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14002b963
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14002b8c2
jmp 0x14002b90d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x1b400
mov dl, 9
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14002b9d2
cmp rsi, rcx
jae 0x14002b9da
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14002b9b9
cmp al, 0x8f
ja 0x14002b9b9
cmp byte [rsi - 2], 0xf
je 0x14002b9bf
sub al, 0xe8
cmp al, 1
ja 0x14002b9a3
cmp rsi, rcx
jae 0x14002b9da
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14002b9a9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14002b9da
lodsb al, byte [rsi]
jmp 0x14002b9b9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x29000]
mov eax, dword [rdi]
or eax, eax
je 0x14002ba43
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x2ca34]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14002b9e7
jns 0x14002ba1c
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14002ba26
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14002ba3d
mov qword [rbx], rax
add rbx, 8
jmp 0x14002ba07
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14002ba9b
sub rsp, 0xffffffffffffff80
jmp 0x14001bce0
Function at 0x140032380
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400ae1b0]
lea rcx, [rsp + 0x20]
xor rax, qword [0x1400adac0]
mov rbx, rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp - 0x18], ebp
call rax
test eax, eax
je 0x14003241e
mov dword [rsp - 0x14], 0x7a7ef6b0
nop word [rax + rax]
mov rax, qword [0x1400ae1d0]
lea rcx, [rsp + 0x20]
xor rax, qword [0x1400adac0]
mov dword [rsp - 0x2c], ecx
call rax
mov rax, qword [0x1400ae1e0]
lea rcx, [rsp + 0x20]
xor rax, qword [0x1400adac0]
mov dword [rsp - 0x38], edx
call rax
mov rax, qword [0x1400ae1b0]
lea rcx, [rsp + 0x20]
xor rax, qword [0x1400adac0]
mov dword [rsp - 0x38], ebp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call rax
mov dword [rsp - 0x28], 0x3d20c6b4
test eax, eax
jne 0x1400323bf
add rsp, 0x58
ret

Function at 0x140034650
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov rsi, rsi
sub rsp, 0x30
mov rdi, rcx
lea rdx, [rcx + 0x30]
lea rcx, [rsp + 0x20]
mov rdx, rdx
call fcn.1400060b0
mov rbx, qword [rax]
mov eax, 0x2b0ef5b5
add eax, 0x4cbcd13
mov rsp, rsp
xor eax, 0x7091e89
add eax, 0x4a5cd99
add eax, 0x36cbf445
add eax, 0x9bba61e0
mov dword [rsp - 0x18], 0x229f3f4a
mov dword [rsp + 0x40], eax
cmp byte [rbx], 0
je 0x14003470c
mov dword [rsp - 0x20], 0x27b617bb
nop dword [rax]
mov r8d, 0x1e5a38a8
sub r8d, 0xa83481f
sub r8d, 0x4a3e014
mov dword [rsp - 0x44], ebp
add r8d, 0x4e18222b
sub r8d, 0x3ec3f37
xor r8d, 0x595ef368
mov dword [rsp - 0x24], 0x445c65f7
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.1400713b0
mov dword [rsp - 0x38], 0x30460de3
inc rbx
cmp byte [rbx], 0
jne 0x1400346b2
mov eax, dword [rsp + 0x40]
mov dword [rsp - 0x30], ebp
mov ebx, dword [rdi + 0x58]
not eax
xor ebx, 0x7f86
shl ebx, 0x10
mov dword [rsp - 0x40], 0x1e303a1
or ebx, dword [rdi + 0x40]
xor ebx, eax
cmp byte [rsp + 0x28], 0
mov dword [rsp - 0x28], 0x1ea3968e
je 0x140034743
mov rcx, qword [rsp + 0x20]
call fcn.14007afb0
mov r12, r12
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
mov r13, r13
ret
Function at 0x140034760
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov r11, r11
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov eax, dword [rcx + 0x50]
mov dword [rsp - 0x28], edx
mov r14, rdx
mov edi, dword [rcx + 0x5c]
xor eax, 0xae97f86
mov r8, r8
movaps xmmword [rsp + 0x20], xmm6
mov rbp, rcx
xor ebx, ebx
xor edi, 0xae97f86
mov r14, r14
xor edx, edx
mov rcx, r14
movd xmm6, eax
add edi, edi
xchg rbx, rbx
cvtdq2ps xmm6, xmm6
mov esi, ebx
call fcn.140071140
xchg r12, r12
test ax, ax
je 0x140034834
nop dword [rax]
mov dword [rsp - 0xc], 0x11f904f3
nop word [rax + rax]
movzx ecx, ax
inc rsi
mov dword [rsp - 0x40], edi
mov rax, qword [rbp + 0x60]
add rcx, rcx
mov rdx, rsi
mov dword [rsp - 0x10], ebx
movups xmm1, xmmword [rax + rcx*8]
xorps xmm1, xmmword [0x1400b2f80]
movaps xmm0, xmm1
xchg rbx, rbx
shufps xmm0, xmm1, 0xaa
subss xmm0, xmm1
mulss xmm0, xmm6
mov dword [rsp - 0x2c], esp
cvttss2si ecx, xmm0
sub ecx, edi
add ebx, ecx
mov r15, r15
mov rcx, r14
call fcn.140071140
test ax, ax
mov dword [rsp - 0x38], 0x75a4d072
jne 0x1400347db
mov rbp, qword [rsp + 0x48]
mov eax, ebx
xchg rsp, rsp
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
xchg r13, r13
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop r14
xchg rcx, rcx
ret

Function at 0x140034a00
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x50]
xor r8d, r8d
mov dword [rsp - 0x40], 0x5fd3ff0d
mov r9d, dword [rcx + 0x5c]
xor eax, 0xae97f86
xor r9d, 0xae97f86
xchg rbx, rbx
add r9d, r9d
movd xmm3, eax
movzx eax, word [rdx]
cvtdq2ps xmm3, xmm3
xchg r12, r12
test ax, ax
je 0x140034a99
mov r10, qword [rcx + 0x60]
movaps xmm2, xmmword [0x1400b2f80]
xchg rbx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, ax
mov rbp, rbp
add rdx, 2
add rax, rax
movups xmm1, xmmword [r10 + rax*8]
mov r10, r10
movzx eax, word [rdx]
xorps xmm1, xmm2
movaps xmm0, xmm1
mov r10, r10
shufps xmm0, xmm1, 0xaa
subss xmm0, xmm1
mulss xmm0, xmm3
cvttss2si ecx, xmm0
mov dword [rsp - 0x44], edi
sub ecx, r9d
add r8d, ecx
test ax, ax
jne 0x140034a51
mov dword [rsp - 0x38], 0x38909850
mov eax, r8d
ret
Function at 0x140063880
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x34], ebp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov dword [rsp - 0x44], esp
movsxd rbx, dword [rcx + 0x3c]
mov rdi, rdx
mov rsi, rcx
mov edx, dword [rbx + rcx + 0xb0]
mov dword [rsp - 0xc], 0x289217b5
call fcn.140064c30
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov r11, r11
mov ebp, dword [rbx + rsi + 0xb4]
mov r11, rax
mov ebx, r14d
test ebp, ebp
mov dword [rsp - 0x3c], esi
je 0x1400639f1
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
mov dword [rsp - 0x34], 0x1bb0f4d8
mov r9d, dword [r11]
add rdx, rcx
movzx r8d, r14w
mov dword [rsp - 0x28], ecx
movzx eax, word [rcx + rsi + 0x14]
movzx r10d, word [rcx + rsi + 6]
add rdx, rax
cmp r14w, r10w
xchg r9, r9
jae 0x140063956
mov eax, dword [rdx + 8]
test eax, eax
jne 0x14006392a
mov dword [rsp - 0xc], ebx
mov eax, dword [rdx + 0x10]
mov ecx, dword [rdx + 0xc]
cmp r9d, ecx
mov dword [rsp - 0x38], ebp
jb 0x140063940
add eax, ecx
cmp r9d, eax
jb 0x1400639ab
mov r11, r11
inc r8w
add rdx, 0x28
cmp r8w, r10w
jb 0x14006391c
mov dword [rsp - 0x1c], 0x11653492
mov r8, r14
mov eax, dword [r11 + 4]
lea rdx, [r11 + 8]
mov dword [rsp - 0x44], edi
sub rax, 8
shr rax, 1
test eax, eax
xchg rsi, rsi
je 0x1400639df
mov r9d, eax
nop word [rax + rax]
xchg rdi, rdi
movzx eax, word [rdx]
mov ecx, eax
shr ecx, 0xc
xchg rcx, rcx
cmp ecx, 3
je 0x1400639c8
cmp ecx, 0xa
mov dword [rsp - 0x24], ecx
jne 0x1400639d1
and eax, 0xfff
add qword [rax + r8], rdi
mov dword [rsp - 0x18], ebx
jmp 0x1400639d1
test rdx, rdx
je 0x140063956
xchg rbx, rbx
mov r8d, dword [rdx + 0x14]
mov eax, dword [rdx + 0xc]
sub r8, rax
add r8, rsi
mov r14, r14
add r8, r9
jmp 0x140063959
and eax, 0xfff
add dword [rax + r8], edi
add rdx, 2
mov dword [rsp - 0x28], ebx
sub r9, 1
jne 0x140063983
add ebx, dword [r11 + 4]
mov r11, rdx
mov rbx, rbx
cmp ebx, ebp
jb 0x1400638e7
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov dword [rsp - 0x2c], 0x14e1bafd
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
mov dword [rsp - 0x24], 0x5afec36a
ret

Function at 0x140064c30
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
movsxd r8, dword [rcx + 0x3c]
mov dword [rsp - 0x3c], 0x1e896619
xor r9d, r9d
add r8, rcx
mov r10d, edx
mov rbx, rcx
mov dword [rsp - 0x18], ecx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
mov r11, r11
cmp r9w, r11w
jae 0x140064ca7
nop dword [rax]
mov ecx, dword [rax + 8]
xchg r10, r10
test ecx, ecx
jne 0x140064c7c
mov ecx, dword [rax + 0x10]
mov edx, dword [rax + 0xc]
mov rbx, rbx
cmp r10d, edx
jb 0x140064c96
add ecx, edx
cmp r10d, ecx
mov dword [rsp - 0x14], 0x1541b446
jb 0x140064cb2
inc r9w
add rax, 0x28
mov r13, r13
cmp r9w, r11w
jb 0x140064c6f
xor eax, eax
mov r9, r9
mov rbx, qword [rsp + 8]
ret
test rax, rax
je 0x140064ca7
mov edx, dword [rax + 0x14]
mov dword [rsp - 0x18], edi
mov ecx, dword [rax + 0xc]
sub rdx, rcx
lea rax, [rbx + rdx]
mov rbx, qword [rsp + 8]
mov dword [rsp - 0x34], 0x52ced628
add rax, r10
ret
Function at 0x140064ce0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
xchg rcx, rcx
push r12
push r13
push r14
mov rsi, rsi
push r15
sub rsp, 0x20
movzx eax, word [rcx]
mov dword [rsp - 0x14], ebp
mov r15d, edx
xor eax, 0x15a049ec
mov rsi, rcx
mov r12, r12
cmp eax, 0x15a013a1
jne 0x140064e62
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
mov r15, r15
xor eax, 0x15a049ec
cmp eax, 0x15a00cbc
jne 0x140064e62
mov edx, dword [rdx + rcx + 0x88]
mov dword [rsp - 0xc], 0x3d06626c
call fcn.140064c30
mov rcx, rsi
mov r14, rax
mov r12, r12
mov edx, dword [rax + 0x20]
call fcn.140064c30
mov edx, dword [r14 + 0x24]
mov rcx, rsi
mov dword [rsp - 0x30], ebx
mov r12, rax
call fcn.140064c30
mov edx, dword [r14 + 0x1c]
mov rcx, rsi
xchg r12, r12
mov r13, rax
call fcn.140064c30
xor edi, edi
mov qword [rsp + 0x70], rax
mov dword [rsp - 0x24], 0x7d80a1fe
cmp dword [r14 + 0x18], edi
jbe 0x140064e62
nop dword [rax]
mov dword [rsp - 0x40], esp
mov edx, dword [r12 + rdi*4]
mov rcx, rsi
call fcn.140064c30
mov ecx, 0x6a4a0bb7
xchg r9, r9
sub ecx, 0x41c2588e
xor ecx, 0xe17df8c
add ecx, 0x19512c70
mov dword [rsp - 0x40], 0x5b8d0663
xor ecx, 0xc01e66ea
mov rbx, rax
mov dword [rsp + 0x60], ecx
xchg r15, r15
cmp byte [rax], 0
je 0x140064e4b
nop dword [rax]
mov r8d, 0x68dfe380
xchg r9, r9
sub r8d, 0xa293009
sub r8d, 0x25f9bd90
add r8d, 0x4e32438
sub r8d, 0x34e5e461
mov dword [rsp - 0x34], 0x2c63a2d2
add r8d, 0x141fea97
sub r8d, 0x1cda2054
lea rcx, [rsp + 0x60]
mov rsi, rsi
mov rdx, rbx
call fcn.1400713b0
inc rbx
mov dword [rsp - 0x34], 0x558abf76
cmp byte [rbx], 0
jne 0x140064de8
mov ecx, dword [rsp + 0x60]
mov dword [rsp - 0x10], esp
not ecx
cmp ecx, r15d
je 0x140064e8c
inc edi
mov dword [rsp - 0x40], edx
cmp edi, dword [r14 + 0x18]
jb 0x140064da2
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov dword [rsp - 0x44], 0x7ba3496c
add rsp, 0x20
pop r15
pop r14
pop r13
xchg r10, r10
pop r12
pop rdi
pop rsi
mov dword [rsp - 0x30], 0x6e9aa283
pop rbp
ret
movzx edx, word [r13 + rdi*2]
mov rcx, rsi
mov rsp, rsp
mov rax, qword [rsp + 0x70]
mov edx, dword [rax + rdx*4]
call fcn.140064c30
jmp 0x140064e64
Function at 0x1400652d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x240
xchg r8, r8
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x71d7fda6
mov dword [rsp - 0x1c], esi
sub r8d, 0x1574190a
xor r8d, 0x5b13f723
add r8d, 0x4808a1ec
mov dword [rsp - 0x38], esi
sub r8d, 0xe58e9c
sub r8d, 0x4a806c58
sub r8d, 0x412b8af
mov dword [rsp - 0x2c], esp
call fcn.14007b3d0
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x10]
mov r13, r13
mov r8, qword [rax]
test r8, r8
je 0x1400654c6
mov r8, qword [r8 + 0x50]
xchg rdi, rdi
test r8, r8
je 0x1400654c6
mov edx, 0x9655ba3
add edx, 0x5ab8709b
mov dword [rsp - 0x24], ecx
sub edx, 0x29f234df
add edx, 0x228f3c64
sub edx, 0x7f504bf
mov r11, r11
xor edx, 0x7d7164aa
xor edx, 0x29b4aaaa
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x38], esi
mov r9d, 0x6d1ab4e1
xor r9d, 0x1869fb1e
sub r9d, 0xcc3043b
mov dword [rsp - 0x14], edx
add r9d, 0xc435312
sub r9d, 0x74f39dd3
call fcn.14007b950
mov dword [rsp - 0x38], 0x713d9312
mov edx, 0x1d37f811
sub edx, 0x7c8429c
sub edx, 0x15638529
add edx, 0x1589442f
mov dword [rsp - 0xc], 0x653caa0d
add edx, 0x18785adb
sub edx, 0x2e0dcefa
lea rcx, [rsp + 0x30]
call fcn.14007ba20
mov dword [rsp - 0x3c], 0x2d9d9ca3
test rax, rax
je 0x1400654c6
mov qword [rsp + 0x250], rdi
lea rcx, [rsp + 0x20]
mov r10, r10
xor edi, edi
mov rdx, rbx
mov word [rax], di
mov dword [rsp - 0x20], esp
mov rax, qword [0x1400adb00]
xor rax, qword [0x1400adac0]
call rax
mov r13, r13
mov rax, qword [0x1400adae0]
lea r9, [rsp + 0x260]
xor rax, qword [0x1400adac0]
lea r8, [rsp + 0x20]
xchg r12, r12
lea rdx, [rsp + 0x258]
mov qword [rsp + 0x260], rdi
lea rcx, [rsp + 0x30]
call rax
mov r8, r8
mov rdi, qword [rsp + 0x250]
test eax, eax
jns 0x1400654ad
mov dword [rsp - 0x3c], esp
mov rdx, qword [0x1400adb80]
mov ecx, eax
xor rdx, qword [0x1400adac0]
xchg rbx, rbx
call rdx
mov rdx, qword [0x1400ade60]
mov ecx, eax
xor rdx, qword [0x1400adac0]
xchg r8, r8
call rdx
mov rax, qword [rsp + 0x260]
add rsp, 0x240
pop rbx
mov dword [rsp - 0x3c], 0x60630f8e
ret
xor eax, eax
add rsp, 0x240
mov dword [rsp - 0x2c], edx
pop rbx
ret
Function at 0x140065590
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x20
mov dword [rsp - 0x24], ebx
mov rdi, qword [0x1400adaa8]
test rdi, rdi
je 0x14006566e
mov rcx, qword [rdi + 8]
mov dword [rsp - 0x24], 0x4d2b4432
mov qword [rsp + 0x30], rbx
test rcx, rcx
je 0x14006560f
xchg rcx, rcx
mov rbx, qword [rdi]
mov qword [rsp + 0x38], rsi
lea rsi, [rbx + rcx*8]
cmp rbx, rsi
mov dword [rsp - 0x30], 0x66fedcf6
je 0x14006560a
mov rax, qword [0x1400adaf0]
xor rax, qword [0x1400adac0]
mov dword [rsp - 0x14], 0x620bab5b
mov rcx, qword [rbx]
call rax
add rbx, 8
cmp rbx, rsi
mov rbp, rbp
jne 0x1400655dc
mov rdi, qword [0x1400adaa8]
mov rsi, qword [rsp + 0x38]
xor ebx, ebx
mov dword [rsp - 0x24], ecx
test rdi, rdi
je 0x140065662
mov rcx, qword [rdi]
mov dword [rsp - 0x1c], edi
test rcx, rcx
je 0x140065631
call fcn.14007afb0
mov qword [rdi], rbx
xchg r12, r12
mov edx, 0x286eaf04
xor edx, 0x77db531e
xor edx, 0x4adcebdf
add edx, 0x5b7917e7
mov rdx, rdx
sub edx, 0x1918a92f
sub edx, 0x57c9865d
mov rcx, rdi
xchg rdi, rdi
call fcn.14007afb0
mov qword [0x1400adaa8], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
xchg rdx, rdx
pop rdi
ret
Function at 0x140067bf0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov ebx, dword [rsp + 0x80]
mov r12, r8
mov rdi, qword [rsp + 0x70]
mov r15, rdx
mov ebp, r9d
mov r14, rcx
test ebx, ebx
jne 0x140067c4b
cmp byte [rcx + 9], 0
mov ebx, 5
jne 0x140067c4b
cmp rdx, rdi
mov r10, rdx
mov rax, rdi
cmovb rax, rdx
cmovb r10, rdi
sub r10, rax
mov eax, 0xe
cmp r10, 0x7ffff000
cmova ebx, eax
cmp byte [rcx + 9], 0
mov qword [rsp + 0x50], rsi
jne 0x140067cb1
cmp ebx, 5
je 0x140067c91
mov eax, ebx
cmp ebx, 0xe
jne 0x140067dc1
lea ecx, [rbp + 1]
mov byte [rbp + r8], 0xff
mov byte [rcx + r8], 0x25
xor esi, esi
lea ecx, [rbp + 2]
mov dword [rcx + r8], esi
lea ecx, [rbp + 6]
mov r8d, dword [rsp + 0x78]
add r8, rdi
mov qword [rcx + r12], r8
jmp 0x140067dc1
mov edx, dword [rsp + 0x78]
lea eax, [rbp + 1]
sub edi, r15d
mov byte [rbp + r8], 0xe9
sub edi, ebp
add edx, 0xfffffffb
add edx, edi
mov dword [rax + r8], edx
jmp 0x140067dbf
mov rax, qword [rcx]
mov qword [rsp + 0x58], r13
call qword [rax + 0x30]
mov ecx, 0x5a4d
xor esi, esi
cmp word [rax], cx
jne 0x140067cd7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140067cda
mov rcx, rsi
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
movzx r10d, word [rcx + 6]
lea r9d, [r15 + rbp]
add rdx, rax
movzx r8d, si
cmp si, r10w
jae 0x140067d1b
test r9d, r9d
je 0x140067d0d
mov ecx, dword [rdx + 0x14]
cmp r9d, ecx
jb 0x140067d0d
add ecx, dword [rdx + 0x10]
cmp r9d, ecx
jb 0x140067d1e
inc r8w
add rdx, 0x28
cmp r8w, r10w
jb 0x140067cf8
mov rdx, rsi
mov r13d, dword [rdx + 0xc]
mov rcx, r14
sub r13d, dword [rdx + 0x14]
mov rax, qword [r14]
add r13d, r15d
add r13d, ebp
call qword [rax + 0x30]
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140067d4e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140067d51
mov rcx, rsi
mov r11d, dword [rsp + 0x78]
lea rdx, [rcx + 0x18]
movzx eax, word [rcx + 0x14]
movzx r8d, si
movzx r10d, word [rcx + 6]
add rdx, rax
lea r9d, [rdi + r11]
cmp si, r10w
jae 0x140067d97
test r9d, r9d
je 0x140067d89
mov ecx, dword [rdx + 0x14]
cmp r9d, ecx
jb 0x140067d89
add ecx, dword [rdx + 0x10]
cmp r9d, ecx
jb 0x140067d9a
inc r8w
add rdx, 0x28
cmp r8w, r10w
jb 0x140067d74
mov rdx, rsi
mov eax, dword [rdx + 0x14]
mov edx, dword [rdx + 0xc]
sub edx, eax
mov byte [rbp + r12], 0xe9
add edx, edi
lea eax, [rbp + 1]
add edx, r11d
sub edx, r13d
mov r13, qword [rsp + 0x58]
sub edx, 5
mov dword [rax + r12], edx
mov eax, ebx
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret