joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002470
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000249d
xor eax, eax
jmp 0x1400025fa
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x1400024c8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x1400024c8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x1400025fa
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400025ed
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14000250b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002536
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400025f2
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400025a5
sub eax, 1
je 0x1400025a5
cmp eax, 2
jne 0x1400025ed
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400025f2
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400025d3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400025ed
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400025f2
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140003640
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140002980
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140008010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002a53
cmp byte [rcx + 0x71], 0
je 0x140002a53
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140002a4f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002a14
sub eax, 1
je 0x140002a18
cmp eax, 2
jne 0x140002a4f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003640
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002a46
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140002a4f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400029fc
xor al, al
jmp 0x1400029fc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140003640
add rsp, 0x60
pop rbx
ret

Function at 0x140003fd4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000401e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000401e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000401e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000401e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000401e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004020
xor al, al
add rsp, 0x28
ret
Function at 0x140119800
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ebx, 1
mov edx, ebx
xor ecx, ecx
xor ebp, ebp
call qword [fcn.14018696c]
mov rdi, rax
test rax, rax
je 0x14011987d
nop word [rax + rax]
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
mov rbp, rdi
mov esi, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
test eax, eax
je 0x1401198a8
cmp ebx, esi
je 0x1401198a8
cmp ebx, 0x8000
ja 0x1401198a8
cmp ebx, esi
jb 0x1401198a3
mov edx, ebx
mov rcx, rdi
call qword [fcn.14018696c]
mov rdi, rax
test rax, rax
jne 0x140119840
mov rcx, rbp
call qword [fcn.140186974]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rax, rdi
jmp 0x140119888
mov rcx, rdi
jmp 0x140119880

Function at 0x14011ff50
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x1402124a0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbp, qword [rcx + 0x4c8]
lea r8, [rsp + 0x20]
mov rsi, qword [rcx]
lea rdx, [rsp + 0x30]
mov rdi, rcx
mov dword [rsp + 0x20], 0x80
mov rcx, rbp
mov rbx, 0xffffffffffffffff
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x14011ffca
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x80
lea rdx, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_accept]
mov rbx, rax
mov rdx, rbp
mov rcx, rdi
call fcn.140103ae0
mov rcx, rsi
cmp rbx, 0xffffffffffffffff
jne 0x14011ffef
lea rdx, str.Error_accept__ing_server_connect
call fcn.1400f3c20
lea eax, [rbx + 0x1f]
jmp 0x140120068
lea rdx, str.Connection_accepted_from_server_n
call fcn.1400f3d80
mov edx, 1
mov byte [rdi + 0x682], 0
mov rcx, rbx
mov qword [rdi + 0x4c8], rbx
call fcn.140112dd0
mov byte [rdi + 0x695], 1
cmp qword [rsi + 0x710], 0
je 0x140120066
mov dl, 1
mov rcx, rsi
call fcn.1400f6b30
mov rcx, qword [rsi + 0x718]
mov r8d, 1
mov rdx, rbx
call qword [rsi + 0x710]
xor edx, edx
mov rcx, rsi
mov ebx, eax
call fcn.1400f6b30
test ebx, ebx
je 0x140120066
mov rcx, rdi
call fcn.140120590
mov eax, Ordinal_45
jmp 0x140120068
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140173c50
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14017433c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140174386
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140174386
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140174386
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140174386
cmp dword [rcx + 0x84], 0xe
jbe 0x140174386
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140174388
xor al, al
add rsp, 0x28
ret

Function at 0x140183008
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140182e9b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140182e9b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140182e9b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140182e9b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140182e9b
cmp dword [rcx + 0x84], 0xe
jbe 0x140182e9b
cmp dword [rcx + 0xf8], 0
je 0x140182e9b
mov ecx, ebx
call fcn.140182f3c
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140182d2c
cmp dword [rbp + 0x20], 0
je 0x140182ee8
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140182ef0
int3
xor r8d, r8d
xor edx, edx
jmp 0x140182e34

Function at 0x1401a05b4
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
mov rdx, rcx
test rcx, rcx
jne 0x1401a0591
call fcn.1401830cc
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
call fcn.14018271c
or eax, 0xffffffff
jmp 0x1401a05ae
sub dword [rcx + 0x10], 1
jns 0x1401a05a0
add rsp, 0x28
jmp fcn.14019efa8
mov rax, qword [rcx]
movzx ecx, byte [rax]
inc rax
mov qword [rdx], rax
mov eax, ecx
add rsp, 0x28
ret
jmp 0x1401a0570
Function at 0x1401a611c
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1401a613c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14018305c
or eax, 0xffffffff
jmp 0x1401a613e
xor eax, eax
add rsp, 0x28
ret

Function at 0x1401aa460
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x60]
movzx r8d, byte [rcx + 0x5c]
test eax, eax
jle 0x1401aa49c
mov edx, dword [rcx + 0x288]
lea r11, [0x140213980]
mov r9d, eax
nop dword [rax]
mov eax, edx
shr rax, 0x18
xor rax, r8
shl edx, 8
xor edx, dword [r11 + rax*4]
mov dword [rcx + 0x288], edx
sub r9, 1
jne 0x1401aa480
mov eax, dword [rcx + 0x5c]
mov byte [rax + rcx + 0x80], 1
movsxd r9, dword [rcx + 0x60]
mov edx, r9d
sub edx, 1
je 0x1401aa57e
sub edx, 1
je 0x1401aa570
cmp edx, 1
je 0x1401aa530
mov byte [r9 + rcx + 0x7c], 1
mov rax, qword [rcx + 0x40]
movsxd rdx, dword [rcx + 0x6c]
mov byte [rdx + rax], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
movzx r8d, byte [rcx + 0x60]
mov rax, qword [rcx + 0x40]
sub r8b, 4
mov byte [rdx + rax + 1], r8b
inc dword [rcx + 0x6c]
ret
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
movsxd rdx, dword [rcx + 0x6c]
lea eax, [rdx + 1]
mov dword [rcx + 0x6c], eax
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax + 1], r8b
inc dword [rcx + 0x6c]
ret
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
jmp 0x1401aa54f
movsxd rdx, dword [rcx + 0x6c]
mov rax, qword [rcx + 0x40]
mov byte [rdx + rax], r8b
inc dword [rcx + 0x6c]
ret
Function at 0x140026000
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x1400260f7
mov qword [rsp + 0x10], rbx
xchg rsi, rbp
mov qword [rsp + 0x18], rsi
xchg rsi, rbp
push rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
xchg rbp, rbx
mov rbp, rdx
xchg rbx, rbp
xchg rdi, r12
mov r12, rcx
xchg rdi, r12
mov esi, r8d
sub rdi, rdx
xchg rcx, rbx
mov rbp, rbx
xchg rcx, rbx
sub rdi, 0x2b0a4081
add rdi, 0x2b0a4171
dec rsi
shr rsi, 4
inc rsi
nop dword [rax]
xchg rbx, r10
movups xmm0, xmmword [r10]
xchg r10, rbx
xchg rbp, r13
mov rdx, r13
xchg rbp, r13
mov rcx, rbx
call fcn.1400267b0
mov ecx, 0x627430a7
xor ecx, 0x55feeb2f
xor ecx, 0x68d9e31b
add ecx, 0x1a7fb098
xor ecx, 0x59c12f47
xor ecx, 0x2013c67c
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1400260aa
add rdi, 0xfffffffffffffff0
xchg r12, rbp
movups xmmword [r12 + 0xf0], xmm0
xchg r12, rbp
sub rsi, 1
jne 0x14002605f
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rsi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140026100
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
xchg r12, rsi
mov qword [rsp + 0x18], r12
xchg rsi, r12
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov edi, r8d
xchg rdx, rbx
mov rdx, rbx
xchg rdx, rbx
lea r9, [rcx + 0xf0]
xchg rsi, r13
mov r13, rcx
xchg r13, rsi
test r8d, r8d
je 0x1400261d8
dec rdi
shr rdi, 4
inc rdi
nop dword [rax]
nop word [rax + rax]
xchg rdi, rax
mov rdi, rbx
xchg rdi, rax
sub r9, rbx
mov edx, 0x434b30ce
sub edx, 0x37af84ac
add edx, 0x53eac911
xor edx, 0x62cd28ab
add edx, 0x2271c82c
xor edx, 0x5fbd25d4
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140026190
xchg rdx, rbx
mov rbx, rsi
xchg rdx, rbx
mov rcx, rbx
call fcn.140026290
xchg rcx, r9
mov rcx, rbx
xchg rcx, r9
nop
sub rbx, 0x13b35e74
add rbx, 0x13b35e84
sub rdi, 1
jne 0x14002615e
movups xmm0, xmmword [r9]
xchg rcx, rbx
mov rcx, qword [rsp + 0x30]
xchg rbx, rcx
mov rbp, qword [rsp + 0x38]
xchg rsi, r13
movups xmmword [r13 + 0xf0], xmm0
xchg rsi, r13
xchg rsi, r10
mov r10, qword [rsp + 0x40]
xchg r10, rsi
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x1400279a0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
xchg rbx, r8
mov qword [rsp + 8], r8
xchg rbx, r8
push rdi
sub rsp, 0x10
xchg rdx, rbx
mov rdx, rbx
xchg rdx, rbx
mov r10, rcx
test r8b, 0xf
je 0x1400279dc
xor al, al
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
xor edx, edx
test r8d, r8d
je 0x140027a93
movdqa xmm2, xmmword [rsp]
nop
movdqu xmm1, xmmword [rdx + rbx]
test edx, edx
jne 0x140027a09
xchg r10, r8
movdqu xmm2, xmmword [r8 + 0x200]
xchg r8, r10
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
pxor xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0x593dacd6
sub ecx, 0x31b6964f
xor ecx, 0x2593c654
xor ecx, 0x6e66d6ec
sub ecx, 0x39b0c66e
sub ecx, 0x346eb8f
xor ecx, 0x187f3ea8
xor ecx, 0x5508e3c0
xor ecx, 0x620d8927
nop dword [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027a57
aesdeclast xmm0, xmmword [r10 + 0x1e0]
pxor xmm0, xmm2
movdqa xmm2, xmm1
xchg r14, rdx
movups xmmword [r14 + r9], xmm0
xchg r14, rdx
sub edx, 0xfffffff0
cmp edx, r8d
jb 0x1400279ed
mov rbx, qword [rsp + 0x20]
mov al, 0xf
add al, 0x4b
add al, 0x21
xor al, 0x27
sub al, 0xf
sub al, 0x44
xor al, 8
add rsp, 0x10
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140028940
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r13
mov qword [rsp + 8], r13
xchg r13, rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg r10, r8
mov rbx, r10
xchg r10, r8
mov rdi, rdx
xchg rcx, rsi
mov rcx, rsi
xchg rcx, rsi
jne 0x1400289cf
nop
mov r8, qword [rbx + 0x10]
xchg r9, rdi
mov rdx, r9
xchg rdi, r9
xchg rsi, rbx
mov rcx, rbx
xchg rbx, rsi
call fcn.140028940
mov rcx, rbx
mov edx, 0x2360c29f
xor edx, 0x126c00c1
xor edx, 0x36f2305
add edx, 0x4203b069
sub edx, 0xa2a3066
sub edx, 0x618c5b03
sub edx, 0x8b1062b
mov rbx, qword [rbx]
call fcn.1401fd0ac
cmp byte [rbx + 0x19], 0
je 0x140028976
xchg rdx, rbx
mov rdx, qword [rsp + 0x30]
xchg rbx, rdx
xchg rsi, r15
mov r15, qword [rsp + 0x38]
xchg r15, rsi
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x1400298e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
xor ebx, ebx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x14002996d
xchg r14, rdx
mov r14, qword [rdi + 0x28]
xchg rdx, r14
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x140029956
mov r8, qword [rcx - 8]
nop
add rdx, 0x663e8e27
sub rdx, 0x663e8e00
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140029a18
xchg r15, rcx
mov r15, r8
xchg rcx, r15
call fcn.1401fd0ac
mov qword [rdi + 0x18], rbx
xchg rbp, rbx
mov qword [rdi + 0x20], rbp
xchg rbp, rbx
mov qword [rdi + 0x28], rbx
mov rcx, qword [rdi + 8]
xchg rdi, rax
mov rdi, qword [rcx + 8]
xchg rdi, rax
xchg rbx, r10
mov qword [rax], r10
xchg rbx, r10
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400299d3
nop dword [rax + rax]
mov rbx, qword [rcx]
mov edx, 0xe72ae2c
xor edx, 0x44b3f83f
add edx, 0xe7cbfda
sub edx, 0x21261552
sub edx, 0xd171c7c
sub edx, 0x2b00e407
call fcn.1401fd0ac
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
test rbx, rbx
jne 0x140029996
mov rcx, qword [rdi + 8]
mov edx, 0x50259581
add edx, 0x6985bf
xor edx, 0x65e144ac
add edx, 0x1bbdaa2e
sub edx, 0x17185d57
sub edx, 0x3a13acab
xchg r8, rbx
mov r8, qword [rsp + 0x30]
xchg r8, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
jmp fcn.1401fd0ac
call 0x1406114ba
int3
Function at 0x14002ca80
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
xchg rdx, rdi
mov qword [rsp + 0x20], rdx
xchg rdx, rdi
push r14
sub rsp, 0x30
xchg r14, rcx
mov rsi, r14
xchg rcx, r14
mov rax, qword gs:[0x30]
xchg r9, rdi
mov r9, qword [rax + 0x60]
xchg rdi, r9
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
xchg rbx, r13
mov qword [rsp + 0x40], r13
xchg r13, rbx
sub rcx, 0x928111b
add rcx, 0x92811e3
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x1e15a69d
sub dword [rsp + 0x20], 0x196ca744
xor dword [rsp + 0x20], 0x78bc8d75
sub dword [rsp + 0x20], 0x92aba9b
sub dword [rsp + 0x20], 0x190bb732
xor dword [rsp + 0x20], 0xeb447bb
sub dword [rsp + 0x20], 0x9fc4438
xor dword [rsp + 0x20], 0x4d6e03a4
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b6e0
test eax, eax
js 0x14002cb4c
cmp qword [rsp + 0x40], rbx
je 0x14002cb4c
lea eax, [rbx + 1]
jmp 0x14002cc7b
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0x70], 2
jbe 0x14002cb86
mov eax, 0x769c1633
sub eax, 0x23cdfb00
sub eax, 0x34f4ac2e
sub eax, 0xac7570d
add eax, 0x1c880d15
sub eax, 0x2f9a250b
jmp 0x14002cc7b
cmp dword [rcx + 0x74], ebx
jbe 0x14002cbb7
mov eax, 0x7904c85b
sub eax, 0x3df28bb1
sub eax, 0x2b83e827
add eax, 0x6148a43d
sub eax, 0xcc55f43
sub eax, 0x5f05af9a
xor eax, 0x50be9e0
jmp 0x14002cc7b
cmp byte [rdi + 2], bl
je 0x14002cbf2
mov eax, 0x459d1f33
add eax, 0xe90da69
sub eax, 0x51356b09
xor eax, 0x3d259b2b
add eax, 0x3c31b1c3
xor eax, 0x12cb12cf
xor eax, 0x28211c66
xor eax, 0x4593b1af
xor eax, 0x3777879
jmp 0x14002cc7b
cmp r14d, 0xa
jb 0x14002cc34
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002cc34
mov eax, 0x4e52d6f5
sub eax, 0x370b8366
add eax, 0x3e639e39
sub eax, 0x299297d8
add eax, 0x40240e21
xor eax, 0x6c3c6819
jmp 0x14002cc7b
lea rcx, [rsi + 0xb8]
mov edx, 0x436aaa14
sub edx, 0x9410c8
xor edx, 0x455e2f28
xor edx, 0x536e7057
sub edx, 0x1f3cf8a3
add edx, 0x1c1f3db8
sub edx, 0x41d49eb4
add edx, 0x89a52d05
call fcn.14002c050
jmp 0x14002cc79
mov eax, ebx
mov rbx, qword [rsp + 0x48]
xchg rsi, r15
mov r15, qword [rsp + 0x50]
xchg r15, rsi
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
push rbx
push rcx
push rdx
push rdx
xchg qword [rsp + 0x20], r14
pop rdx
pop rdx
pop rcx
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140033c10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rbx, rbp
mov qword [rsp + 0x18], rbx
xchg rbp, rbx
nop
sub rsp, 8
mov qword [rsp], rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg rbx, rdi
mov rdi, r8
xchg rbx, rdi
mov rsi, rdx
xchg r13, rbp
mov r13, rcx
xchg r13, rbp
jne 0x140033ce0
xchg rcx, rdi
mov qword [rsp + 0x30], rcx
xchg rcx, rdi
nop dword [rax]
nop dword [rax + rax]
xchg r12, r8
mov r12, qword [rbx + 0x10]
xchg r8, r12
xchg rbp, rsi
mov rdx, rbp
xchg rsi, rbp
mov rcx, rbp
call fcn.140033c10
xchg rdi, rbx
mov rbx, rdi
xchg rbx, rdi
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004cd50
mov edx, 0x382eae78
add edx, 0x1a48e9e2
xor edx, 0xb333c86
sub edx, 0x1137ec7
add edx, 0x67a8776
xor edx, 0x620731e2
sub edx, 0x22bae7ab
sub edx, 0x19f1b46e
mov rcx, rdi
call fcn.1401fd0ac
cmp byte [rbx + 0x19], 0
je 0x140033c64
xchg r9, rdi
mov r9, qword [rsp + 0x30]
xchg rdi, r9
mov rbx, qword [rsp + 0x38]
xchg rdx, rbp
mov rdx, qword [rsp + 0x40]
xchg rdx, rbp
add rsp, 0x20
nop
add rsp, 8
mov rsi, qword [rsp - 8]
ret

Function at 0x140033d00
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r11
mov qword [rsp + 0x10], r11
xchg rbx, r11
mov qword [rsp + 0x18], rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg r8, rbx
mov r8, rbx
xchg rbx, r8
xchg r8, rdx
mov rsi, r8
xchg rdx, r8
xchg rbx, rcx
mov rbp, rbx
xchg rcx, rbx
jne 0x140033de3
xchg rbp, rdi
mov qword [rsp + 0x30], rbp
xchg rbp, rdi
nop dword [rax]
nop dword [rax + rax]
xchg r8, rdi
mov rdi, qword [rbx + 0x10]
xchg r8, rdi
xchg rdx, rbx
mov rbx, rsi
xchg rdx, rbx
xchg rcx, rbp
mov rbp, rcx
xchg rcx, rbp
call fcn.140033d00
xchg r8, rbx
mov rdi, r8
xchg r8, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004cd50
mov edx, 0x79c7b1a5
xor edx, 0x1753bb47
sub edx, 0x2a8d807d
add edx, 0x17d48f2f
sub edx, 0x1b75446f
sub edx, 0x15d78dbe
add edx, 0x3945e936
add edx, 0xd93acf3
sub edx, 0x7167dd40
xchg rcx, rdi
mov rdi, rcx
xchg rdi, rcx
call fcn.1401fd0ac
cmp byte [rbx + 0x19], 0
je 0x140033d5b
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
xchg rbp, r8
mov r8, qword [rsp + 0x40]
xchg rbp, r8
add rsp, 0x20
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140035a20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbx
nop
mov qword [rsp - 8], rsi
sub rsp, 8
push rdi
push r12
nop
push 0x762a7c03
mov qword [rsp], r13
push r14
push r15
sub rsp, 0x30
xchg rdx, r15
mov rdx, r15
xchg rdx, r15
xchg rcx, r14
mov rcx, r14
xchg rcx, r14
movabs rsi, 0xfffffff4435bda6
xor rsi, 0x154f480f
add rsi, 0x1eb44cdc
xor rsi, 0x3209589e
add rsi, 0x15d97e7a
xor rsi, 0x5c203126
add rsi, 0x7fffffff
add rsi, 0x7420564d
cmp rdx, rsi
ja 0x140035c53
xchg rdx, r12
mov rdx, qword [rcx + 8]
xchg rdx, r12
sub r12, qword [rcx]
sar r12, 4
mov rcx, qword [rcx + 0x10]
sub rcx, qword [r14]
sar rcx, 1
sar rcx, 2
sar rcx, 1
xchg rcx, rdx
mov rcx, rdx
xchg rdx, rcx
shr rdx, 1
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
sub rax, rdx
cmp rcx, rax
ja 0x140035ae7
lea rsi, [rdx + rcx]
cmp rsi, r15
cmovb rsi, r15
mov qword [rsp + 0x88], rsi
xchg rbx, rsi
mov rdx, rbx
xchg rbx, rsi
mov rcx, r14
call fcn.1400538a0
xchg rsi, r13
mov rsi, rax
xchg r13, rsi
xchg rbp, rax
mov qword [rsp + 0x28], rbp
xchg rbp, rax
xchg rbx, r13
mov r13, r12
xchg rbx, r13
shl rbx, 3
shl rbx, 1
add rbx, rax
mov qword [rsp + 0x20], rbx
xchg rdi, r15
mov r15, rdi
xchg r15, rdi
sub rdi, r12
xchg rbx, r8
mov qword [rsp + 0x78], r8
xchg r8, rbx
je 0x140035b91
nop word [rax + rax]
mov byte [rbx], 0x46
xor byte [rbx], 0x1e
xor byte [rbx], 0xa
xor byte [rbx], 0x6c
sub byte [rbx], 0x2c
add byte [rbx], 0x4e
xor byte [rbx], 0x60
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004bb60
nop
neg rbx
add rbx, 0xfffffffffffffff0
neg rbx
xchg rbx, r11
mov qword [rsp + 0x78], r11
xchg rbx, r11
sub rdi, 1
jne 0x140035b51
xchg r15, r8
mov r15, qword [r14 + 8]
xchg r8, r15
xchg rcx, r13
mov rdx, rcx
xchg rcx, r13
xchg rcx, r11
mov r11, qword [r14]
xchg rcx, r11
cmp rcx, r8
je 0x140035be6
xor r9d, r9d
movzx eax, byte [rcx]
mov byte [rdx], al
xchg r12, rax
mov r12, qword [rcx + 8]
xchg r12, rax
xchg r9, rax
mov qword [rdx + 8], r9
xchg r9, rax
mov byte [rcx], r9b
mov qword [rcx + 8], r9
lea rdx, [rdx + 0x10]
sub rcx, 0xfffffffffffffff0
cmp rcx, r8
jne 0x140035bb9
mov r9, rsi
mov r8, r15
xchg r13, r14
mov rdx, r14
xchg r14, r13
xchg rbx, rcx
mov rbx, r14
xchg rcx, rbx
add rsp, 0x30
push rbx
xchg qword [rsp + 8], r15
add rsp, 0x10
nop
add rsp, 8
xchg qword [rsp - 8], r14
push rdx
push rbx
push rcx
push rbx
push rdx
xchg qword [rsp + 0x28], r13
pop rdx
pop rbx
pop rcx
pop rbx
pop rdx
add rsp, 8
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
nop
mov rsi, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rbx
jmp fcn.140052a00
call fcn.14002f9c0
int3