joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400027f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x140010520]
mov r10, rax
sub rbx, rax
movabs rdi, 0x40782d10e6566065
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 4]
mov rax, rdi
mov rcx, r8
mul r8
mov rax, r8
add r11d, 2
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 2
jb 0x140002840
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1400028d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x140010520]
mov r10, rax
sub rbx, rax
movabs rdi, 0x40782d10e6566065
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 6]
mov rax, rdi
mov rcx, r8
mul r8
mov rax, r8
add r11d, 3
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 3
jb 0x140002920
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140003530
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Sandbox_tsharepoint_tshortlist_taamb_tcatads_tiso_tkat_tbart_tnewsevents_ttest_tjsp_tbigbrother_ttestwp_thilfe_tsmap_trelated_tkp_tvectors_tcosmo_twedstrijden_tinc_tphotopost_tjamaica_tspike_taspect_tfpoll_tbgt_tservererrors_tsecuredcontent_tsitefinity_ttvprogramm_tDefault_tdrm_tcampania_tasset_tmailto_ttestbereich_tevps_tmanagers_tlicences_totherresources_titc_tusercpsentbox_tdrukuj_tinglesespanol_thottrends_tprojbase_tpricing_taspadmin_tcache_trevistas
mov r10, rax
sub rbx, rax
movabs rdi, 0x40782d10e6566065
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
mov rax, rcx
lea r9, [r9 + 0xa]
sub rax, rdx
add r11d, 0xa
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xa
jb 0x140003580
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004cc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Sandbox_tsharepoint_tshortlist_taamb_tcatads_tiso_tkat_tbart_tnewsevents_ttest_tjsp_tbigbrother_ttestwp_thilfe_tsmap_trelated_tkp_tvectors_tcosmo_twedstrijden_tinc_tphotopost_tjamaica_tspike_taspect_tfpoll_tbgt_tservererrors_tsecuredcontent_tsitefinity_ttvprogramm_tDefault_tdrm_tcampania_tasset_tmailto_ttestbereich_tevps_tmanagers_tlicences_totherresources_titc_tusercpsentbox_tdrukuj_tinglesespanol_thottrends_tprojbase_tpricing_taspadmin_tcache_trevistas
mov r10, rax
sub rbx, rax
movabs rdi, 0x40782d10e6566065
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 6]
mov rax, rdi
mov rcx, r8
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 7]
mov byte [r9 - 7], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 6]
mov byte [r9 - 6], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
add r11d, 6
cmp r11d, 6
jb 0x140004d10
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140005ca0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Sandbox_tsharepoint_tshortlist_taamb_tcatads_tiso_tkat_tbart_tnewsevents_ttest_tjsp_tbigbrother_ttestwp_thilfe_tsmap_trelated_tkp_tvectors_tcosmo_twedstrijden_tinc_tphotopost_tjamaica_tspike_taspect_tfpoll_tbgt_tservererrors_tsecuredcontent_tsitefinity_ttvprogramm_tDefault_tdrm_tcampania_tasset_tmailto_ttestbereich_tevps_tmanagers_tlicences_totherresources_titc_tusercpsentbox_tdrukuj_tinglesespanol_thottrends_tprojbase_tpricing_taspadmin_tcache_trevistas
mov r10, rax
sub rbx, rax
movabs rdi, 0x40782d10e6566065
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x199
sub rcx, rax
movzx eax, byte [rcx + rsi]
add r11d, 6
xor al, byte [rbx + r9 + 8]
lea r9, [r9 + 0xc]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 6
jb 0x140005cf0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140009ee0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400151c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x90000
mov dword [rbp - 0x1c], 0x8000b
mov dword [rbp - 0x18], 0x5c000e
mov dword [rbp - 0x14], 0x27004a
mov dword [rbp - 0x10], 0x40017
mov dword [rbp - 0xc], 0x72000d
call fcn.140002e40
mov rcx, rax
call rbx
mov rbx, qword [0x1400151c0]
lea rcx, [rbp - 0x20]
mov qword [0x1400151a0], rax
mov dword [rbp - 0x20], 0x80004
mov dword [rbp - 0x1c], 0xd0000
mov dword [rbp - 0x18], 0xa000c
mov dword [rbp - 0x14], 0x27000c
mov dword [rbp - 0x10], 0x40017
mov dword [rbp - 0xc], 0x72000d
call fcn.140002e40
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x140014520]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140015130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400151b0], rax
mov word [rbp - 0x10], 0x2318
mov byte [rbp - 0xe], 9
call fcn.140005220
mov rcx, qword [0x1400151a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140015130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x80b0900
mov dword [rbp - 0x1c], 0x6c002a0e
mov dword [rbp - 0x18], 0x17151d10
mov word [rbp - 0x14], 0x7032
call fcn.140001180
mov rcx, qword [0x1400151a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140015130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x11a0f1a
mov dword [rbp - 0x1c], 0x7d1d0110
mov dword [rbp - 0x18], 0x1c04183c
mov word [rbp - 0x14], 0x7024
call fcn.140001180
mov rcx, qword [0x1400151b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140014580]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140015130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400150e8], rax
mov byte [rbp - 0x10], 0x6e
call fcn.140004e60
mov rcx, qword [0x1400151b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400144b0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140015130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400150f0], rax
mov dword [rbp - 0x10], 0x736c180a
call fcn.1400029f0
mov rcx, qword [0x1400151b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140014500]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140015130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400150e0], rax
mov byte [rbp - 0x10], 0x6e
call fcn.140004e60
mov rcx, qword [0x1400151b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140014550]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140015130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400150d8], rax
mov dword [rbp - 0x10], 0x32671b07
mov byte [rbp - 0xc], 0x68
call fcn.140003790
mov rcx, qword [0x1400151b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140014490]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140015130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x3500
mov byte [rbp - 0xe], 9
call fcn.140005220
mov rcx, qword [0x1400151b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp rax
Function at 0x14000eac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x61
mov dword [rbp - 0x20], 0x240018
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x2a003c
mov dword [rbp - 0x18], 0x230027
mov dword [rbp - 0x14], 0x48003a
mov dword [rbp - 0x10], 0x2d0020
call fcn.140005e60
mov rcx, rax
call 0x14000f280
mov qword [0x1400151b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x73
mov dword [rbp - 0x20], 0x240018
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x2a003c
mov dword [rbp - 0x18], 0x230027
mov dword [rbp - 0x14], 0x3b004b
call fcn.140002590
mov rcx, rax
call 0x14000f280
lea rcx, [rbp - 0x20]
mov qword [0x1400151a8], rax
mov dword [rbp - 0x20], 0x15003d
mov dword [rbp - 0x1c], 0x8000a
mov dword [rbp - 0x18], 0x6f000e
call fcn.140005ca0
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000f280
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000f2e2
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000f460
test al, al
jne 0x14000f2f4
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000f2b0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000ebb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x14000edde
mov word [rbp + 0x50], 0x6153
mov word [rbp + 0x58], 0x6153
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000ec64
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x14000ec50
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x14000ec95
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x14000ec80
cmp rdi, rbx
jne 0x14000edb2
mov r13, rsi
mov word [rbp - 0x50], 0x6153
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000ecd6
lea rcx, [rbp - 0x50]
inc rbx
call fcn.1400018c0
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x14000ecc2
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x14000edd8
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x610032
call fcn.1400027f0
movzx eax, word [rax]
cmp r15d, eax
jl 0x14000ed48
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x610029
call fcn.1400027f0
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x14000ed48
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x610032
mov dword [rbp - 0x42], 0x610012
call fcn.1400027f0
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.1400027f0
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x610032
call fcn.1400027f0
movzx eax, word [rax]
cmp edi, eax
jl 0x14000eda5
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x610029
call fcn.1400027f0
movzx ecx, word [rax]
cmp edi, ecx
jg 0x14000eda5
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x610032
mov dword [rbp - 0x32], 0x610012
call fcn.1400027f0
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.1400027f0
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x14000edb2
inc r14
jmp 0x14000ecb0
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x14000edde
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x14000ec20
mov rax, qword [rbp - 8]
jmp 0x14000ede0
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000f280
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x61
mov dword [rbp - 0x20], 0x240018
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x2a003c
mov dword [rbp - 0x18], 0x230027
mov dword [rbp - 0x14], 0x48003a
mov dword [rbp - 0x10], 0x2d0020
call fcn.140005e60
mov rcx, rax
call 0x14000f280
mov qword [0x1400151b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x73
mov dword [rbp - 0x20], 0x240018
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x2a003c
mov dword [rbp - 0x18], 0x230027
mov dword [rbp - 0x14], 0x3b004b
call fcn.140002590
mov rcx, rax
call 0x14000f280
lea rcx, [rbp - 0x20]
mov qword [0x1400151a8], rax
mov dword [rbp - 0x20], 0x15003d
mov dword [rbp - 0x1c], 0x8000a
mov dword [rbp - 0x18], 0x6f000e
call fcn.140005ca0
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000f280
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000f2e2
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000f460
test al, al
jne 0x14000f2f4
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000f2b0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x60c755
Capabilities:
Execute anti-debugging instructions

Disassembly:
movabs r15, 0x180000000
jmp 0x60c9fe
cpuid
mov ecx, dword [rsp]
bswap rdi
mov esi, r10d
bswap r9
cpuid
jmp 0x60c73d
mov r14, rsp
rol r15b, cl
jle 0x60c71b
cpuid
jmp 0x60c77c
mov r9b, byte [rsp]
mov eax, dword [rsp]
bsf ebx, eax
jo 0x60c766
bts r11, r12
jmp 0x60c7f9
lea r14, [r14*4]
sub rsp, 0x238
jmp 0x60c731
bts r11, r12
jmp 0x60c784
mov ecx, dword [rsp]
bswap rdi
jmp 0x60c723
lea r9, [rdx + rdi]
mov dx, 0x8d8c
mov r15w, word [rsp]
bsf rbx, rax
pushfq
jmp 0x60c898
lea r9, [rdx + rdi]
mov dx, 0x8d8c
mov r15w, word [rsp]
call fcn.0060c7b4
invalid
push qword [rsp + 4]
jge 0x60d11b
jl 0x60d11b
invalid
xchg r8w, cx
bsr r13, rsp
jae 0x60c91b
mov r13, 0xffffffffbda2f8c8
jmp 0x60c8f4
mov r13d, eax
not r10d
rdtsc
mov cl, 0x33
bswap edx
jmp 0x60c8c4
xchg edx, r9d
rdtsc
not r11b
jmp 0x60c92a
sub r10d, 0x3c3522d5
xchg r8w, dx
lea r11, [rdi + riz - 0x25b9]
mov r8w, r10w
jmp 0x60c92c
mov r13, 0xffffffffbda2f8c8
xchg edx, r9d
rdtsc
not r11b
jmp 0x60c8fe
xchg dl, bl
mov rbx, 0x17183996
mov cl, byte [rsp]
mov ecx, dword [rsp]
mov ax, 0x11ae
xchg r12d, ecx
jmp 0x60ca26
bswap r11
mov rcx, 0xfffffffff4a47422
mov rbx, qword [rsp]
jmp 0x60ccf8
mov r9w, bx
mov r12w, 0x57b4
call fcn.0060c95f
mov r8d, 0xc6d63acb
lea rsp, [rsp + 4]
jmp 0x60c9d1
mov r13, qword [rsp]
jmp 0x60bff0
lea rsp, [rsp + 0x10]
inc r10d
mov r8w, word [rsp]
mov edi, 0x34aa2237
lea rdx, [r14*8]
jmp 0x60c9bb
lea rax, [r13 + riz - 0x5d]
jmp 0x60c975
mov rdx, 0xfffffffff78a89d8
stc
jmp 0x60cb3e
mov r13b, 0xd4
cpuid
jmp 0x60caba
rol r10d, 0
bt r8, r13
jnp 0x60c9f4
lea rax, [r13 + riz - 0x5d]
mov r9w, bx
mov r12w, 0x57b4
jmp 0x60c97e
jno 0x60cce3
bswap rdi
lea rax, [rdi + r9]
jmp 0x60c94c
lea r9, [rax + rdx]
btr r15w, r11w
jmp 0x60ca9b
cpuid
jmp 0x60ca64
mov cl, byte [rsp]
jmp 0x60cb11
add r10, qword [rbp + riz]
or r15b, bpl
jae 0x60ca85
mov cl, byte [rsp]
mov r8b, 0xf8
bswap edx
jmp 0x60cae7
add r10, r15
xor eax, 0x9dd8e3cb
jl 0x60ca81
cpuid
lea r9, [rax + rdx]
btr r15w, r11w
jmp 0x60ca9b
mov r12d, 0xe92b5f7f
call fcn.0060caef
movabs byte [0xfb98b9f534c5a22c], al
ror byte [rbp + 0x4d], cl
movzx edi, byte [rdx + riz - 1]
movzx r15, byte [r10 + riz - 1]
jmp 0x60cad1
mov r8b, 0xf8
bswap edx
jmp 0x60cae7
jbe 0x60ca0c
mov r13b, 0xd4
cpuid
jmp 0x60caba
bswap rdi
lea rax, [rdi + r9]
bswap r11
mov rcx, 0xfffffffff4a47422
mov rbx, qword [rsp]
mov r12b, byte [rsp]
jmp 0x60c8e6
lea rsp, [rsp + 0x10]
dec r10d
inc ebx
jmp 0x60ca52

Function at 0x60c7e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
bswap r12d
lea rsp, [rsp + 1]
jmp 0x60c822
xchg qword [rsp + 0x18], rsi

Function at 0x60c83d
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov word [rsp + 4], r11w
neg cx
mov r9, 0xffffffff8d00643d
mov r8w, 0x5bf7
xchg qword [rsp + 0x20], rsi
jmp 0x60c88b
mov r8w, 0xbc9f
mov rbx, rbp
call 0x60c875

Function at 0x60c95f
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub rsp, 4
jns 0x60c9b9
push qword [rsp + 8]
jmp 0x60c983
push qword [rsp + 8]
mov r8d, 0xc6d63acb
lea rsp, [rsp + 4]
jmp 0x60c9d1
jmp 0x60c999