joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6e5b80
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.DLL_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x00844f58], eax
je 0x6e5b9a
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop

Function at 0x6e60a0
Capabilities:
Print debug messages

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
test rcx, rcx
mov rbx, rcx
je 0x6e60c3
call fcn.006e8ce0
cmp eax, 1
je 0x6e60ce
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x90
pop rbx
pop rsi
pop rdi
ret
lea rdi, [rsp + 0x20]
xor eax, eax
mov ecx, 0xa
lea rsi, str.Error_cleaning_up_spin_keys_for_thread
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x48]
mov ecx, 0x43
rep stosb byte [rdi], al
lea rbx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
lea rdx, [rbx + 0x27]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x6e6145
mov eax, 0x28
jmp 0x6e612a
add rax, 1
cmp rax, 0x6b
je 0x6e6137
cmp byte [rbx + rax], 0
mov edx, eax
jne 0x6e6120
cmp eax, 0x6a
jne 0x6e614a
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov edx, 0x27
movsxd rax, edx
mov byte [rsp + rax + 0x20], 0xa
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rax + 0x20], 0
jmp 0x6e6137

Function at 0x6e61f0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp dword [0x00de2500], 1
je 0x6e6206
call fcn.006e6160
mov ecx, dword [0x00844f58]
call qword [sym.imp.KERNEL32.DLL_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x6e6230
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.006e5fe0
cmp qword [0x00de8050], 0
mov rsi, rax
je 0x6e621a
test rax, rax
je 0x6e621a
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
mov dword [rsi + 0x70], eax
call qword [sym.imp.KERNEL32.DLL_CreateEventA]
lea rcx, [rsi + 0x68]
mov qword [rsi + 0x38], 0xffffffffffffffff
mov qword [rsi + 0x30], rax
call fcn.006e60a0
mov rbx, qword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
mov dword [rsi + 0xb8], 0
mov qword [rsi + 0x28], 0
call rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.DLL_GetCurrentThread]
mov rdi, rax
call rbx
mov dword [rsp + 0x30], 2
mov r8, rbp
mov rdx, rdi
mov dword [rsp + 0x28], 0
lea r9, [rsi + 0x28]
mov rcx, rax
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.DLL_DuplicateHandle]
test eax, eax
je 0x6e6320
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.DLL_GetThreadPriority]
mov rdx, rsi
mov ecx, dword [0x00844f58]
mov dword [rsi + 0xbc], 0
mov dword [rsi + 0xc0], eax
movzx eax, byte [rsi + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rsi + 0x40], al
call qword [sym.imp.KERNEL32.DLL_TlsSetValue]
test eax, eax
je 0x6e6320
mov rbx, rsi
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sub.msvcrt.dll_abort
nop
nop word cs:[rax + rax]
Function at 0x6e78c0
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbp, rcx
mov r13, rdx
mov rsi, r8
mov rdi, r9
call fcn.006e5fe0
test rax, rax
mov rbx, rax
je 0x6e7a48
test rbp, rbp
je 0x6e78fb
mov rax, qword [rax + 0x1d8]
mov qword [rbp], rax
mov r12, qword [sym.imp.KERNEL32.DLL_Sleep]
mov qword [rbx + 8], rdi
mov rdi, qword [sym.imp.KERNEL32.DLL_CreateEventA]
mov qword [rbx + 0x10], rsi
xor esi, esi
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0x44], 1
mov qword [rbx + 0x28], 0xffffffffffffffff
mov r14, r12
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
call rdi
test rax, rax
mov qword [rbx + 0x30], rax
jne 0x6e7970
test rsi, rsi
je 0x6e7960
mov ecx, 0x14
call r14
cmp esi, 4
je 0x6e7970
add rsi, 1
jmp 0x6e792f
xor ecx, ecx
call r12
jmp 0x6e7959
lea rsi, [rbx + 0x68]
mov qword [rbx + 0x38], 0xffffffffffffffff
mov rcx, rsi
call fcn.006e60a0
cmp qword [rbx + 0x30], 0
mov dword [rbx], 0xbab1f00d
mov dword [rbx + 0xc0], 0
mov dword [rbx + 0xb8], 0
je 0x6e7a2d
xor edx, edx
test r13, r13
je 0x6e79cd
mov eax, dword [r13]
mov edx, dword [r13 + 0x10]
test al, 8
mov dword [rbx + 0x44], eax
jne 0x6e7b00
mov eax, dword [r13 + 0x18]
mov dword [rbx + 0xc0], eax
xor ecx, ecx
mov dword [rsp + 0x20], 4
mov r9, rbx
mov qword [rsp + 0x28], 0
lea r8, [0x006e66a0]
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov rdi, rax
lea rax, [rax - 1]
cmp rax, 0xfffffffffffffffd
jbe 0x6e7a60
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x6e7a0c
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
lea rcx, [rbx + 0x38]
call fcn.006e5360
mov rcx, rsi
call fcn.006e60a0
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x28], 0
test rbp, rbp
je 0x6e7a3a
mov qword [rbp], 0
cmp qword [rbx + 0x1d0], 0
je 0x6e7af0
mov eax, 0xb
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, dword [rbx + 0xc0]
mov edx, 0xfffffff1
cmp eax, 0xfffffff2
jl 0x6e7a90
add edx, 0xd
cmp eax, 0xffffffff
jl 0x6e7a90
cmp eax, 0xe
mov edx, 0xf
jle 0x6e7b20
nop word cs:[rax + rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_SetThreadPriority]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.DLL_ResetEvent]
test byte [rbx + 0x44], 4
jne 0x6e7ad0
mov qword [rbx + 0x28], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_ResumeThread]
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_Sleep]
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov rcx, rdi
mov qword [rbx + 0x28], 0
call qword [sym.imp.KERNEL32.DLL_ResumeThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x6e7ab6
mov rcx, rbx
call fcn.006e5da0
jmp 0x6e7a48
mov dword [rsp + 0x3c], edx
call fcn.006e61f0
mov edx, dword [rsp + 0x3c]
mov eax, dword [rax + 0xc0]
mov dword [rbx + 0xc0], eax
jmp 0x6e79cd
cmp eax, 2
mov edx, 2
cmovle edx, eax
jmp 0x6e7a90
Function at 0x6f3df0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x138
mov rbx, rcx
call sub.msvcrt.dll__errno
test rbx, rbx
mov dword [rax], 0
je 0x6f3f80
cmp byte [rbx], 0
je 0x6f3f41
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x6f3f70
test al, 0x10
je 0x6f3f41
lea rdi, [rsp + 0x20]
mov rdx, rbx
mov r8d, 0x104
mov rcx, rdi
mov rbx, rdi
call sub.msvcrt.dll__fullpath
mov edx, dword [rbx]
add rbx, 4
lea eax, [rdx - 0x1010101]
not edx
and eax, edx
and eax, 0x80808080
je 0x6f3e4e
mov edx, eax
shr edx, 0x10
test eax, 0x8080
cmove eax, edx
lea rdx, [rbx + 2]
mov ecx, eax
cmove rbx, rdx
add cl, al
sbb rbx, 3
sub rbx, rdi
lea rcx, [rbx + 0x24b]
call sub.msvcrt.dll_malloc
test rax, rax
mov rsi, rax
je 0x6f3f60
lea r9, [rax + 0x244]
mov rdx, rdi
lea rbp, [rbx + 1]
mov rcx, r9
mov r8, rbp
call sub.msvcrt.dll_memcpy
cmp byte [rsi + 0x244], 0
mov r9, rax
jne 0x6f3f20
add rbx, rax
mov eax, 0x2a
mov ecx, 0x20
lea rdx, [rsi + 0x130]
mov word [rbx], ax
xor eax, eax
mov qword [rsi + 0x238], 0xffffffffffffffff
mov rdi, rdx
mov dword [rsi + 0x240], 0
mov qword [rsi + 0x128], 0
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov rax, rsi
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
movzx eax, byte [rsi + rbx + 0x243]
add rbx, r9
cmp al, 0x5c
je 0x6f3ec5
cmp al, 0x2f
je 0x6f3ec5
mov edx, 0x5c
mov word [rbx], dx
lea rbx, [r9 + rbp]
jmp 0x6f3ec5
call sub.msvcrt.dll__errno
xor esi, esi
mov dword [rax], 0x14
mov rax, rsi
add rsp, 0x138
pop rbx
pop rsi
pop rdi
pop rbp
ret
call sub.msvcrt.dll__errno
mov dword [rax], 0xc
jmp 0x6f3f07
call sub.msvcrt.dll__errno
xor esi, esi
mov dword [rax], 2
jmp 0x6f3f07
call sub.msvcrt.dll__errno
xor esi, esi
mov dword [rax], 0xe
jmp 0x6f3f07
Function at 0x6ffc30
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00de3504]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6ffdb8
mov rax, qword [0x00de3508]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6ffc7c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6ffd05
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6ffc60
mov rcx, rbx
call fcn.007008d0
test rax, rax
mov r12, rax
je 0x6ffded
mov rax, qword [0x00de3508]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.00700a00
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00de3508]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.DLL_VirtualQuery]
test rax, rax
je 0x6ffdd0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6ffcfe
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6ffd60
add dword [0x00de3504], 1
cmp edi, 8
jae 0x6ffd33
test dil, 4
jne 0x6ffda4
test edi, edi
je 0x6ffd28
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6ffdbf
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6ffd28
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6ffd4c
jmp 0x6ffd28
add rsi, qword [0x00de3508]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.DLL_VirtualProtect]
test eax, eax
jne 0x6ffcfe
call qword [sym.imp.KERNEL32.DLL_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00806610
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6ffd28
xor esi, esi
jmp 0x6ffc87
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6ffd28
mov rax, qword [0x00de3508]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.00806610
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.00806610
nop
nop dword [rax]

Function at 0x700540
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00de37e0]
call qword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov rbx, qword [0x00de37c0]
test rbx, rbx
je 0x700594
mov rbp, qword [sym.imp.KERNEL32.DLL_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.DLL_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x70058b
test rsi, rsi
je 0x70058b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x700570
lea rcx, [0x00de37e0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
Function at 0x7008d0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00afaf80]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x70093d
mov rcx, r8
call fcn.007007b0
test eax, eax
je 0x70093d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x70093d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x700934
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x70093f
add rax, 0x28
cmp rax, r9
jne 0x700920
xor eax, eax
add rsp, 0x28
ret

Function at 0x702230
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x68
movaps xmmword [rsp], xmm6
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x50], xmm11
mov rax, qword [0x00afa0f0]
movdqa xmm11, xmmword [rcx]
movdqa xmm10, xmmword [rcx + 0x10]
movdqa xmm9, xmmword [rax + 0xc0]
movdqa xmm8, xmmword [rax + 0xd0]
add rdx, r8
movdqa xmm7, xmmword [rax + 0xe0]
cmp r8, rdx
movdqa xmm6, xmmword [rax + 0xf0]
movdqa xmm5, xmmword [rax + 0x100]
movdqa xmm4, xmmword [rax + 0x110]
movdqa xmm3, xmmword [rax + 0x120]
movdqa xmm2, xmmword [rax + 0x130]
movdqa xmm1, xmmword [rcx + 0x20]
movdqa xmm0, xmmword [rcx + 0x30]
jae 0x702335
nop dword [rax + rax]
aesdec xmm11, xmm9
aesenc xmm10, xmm9
aesdec xmm1, xmm5
aesenc xmm0, xmm5
aesdec xmm11, xmm8
aesenc xmm10, xmm8
aesdec xmm1, xmm4
add r8, 0x40
aesenc xmm0, xmm4
aesdec xmm11, xmm7
aesenc xmm10, xmm7
aesdec xmm1, xmm3
aesenc xmm0, xmm3
aesdec xmm11, xmm6
aesenc xmm10, xmm6
movaps xmmword [r8 - 0x40], xmm11
movaps xmmword [r8 - 0x30], xmm10
aesdec xmm1, xmm2
aesenc xmm0, xmm2
movaps xmmword [r8 - 0x20], xmm1
movaps xmmword [r8 - 0x10], xmm0
cmp rdx, r8
ja 0x7022c0
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
add rsp, 0x68
ret
lea r8, [rcx + 0x40]
mov rax, rdx
mov rdx, qword [0x00afa0f0]
mov rcx, rax
mov edx, dword [rdx + 0x34]
lea edx, [rdx*8 + 0x80]
jmp 0x702230

Function at 0x7026a0
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
movdqa xmm0, xmmword [str._f__nc]
movdqa xmm1, xmmword [0x00ae6290]
movdqa xmm2, xmmword [0x00ae62a0]
movdqa xmm3, xmmword [0x00ae62b0]
add rdx, rcx
cmp rcx, rdx
jae 0x7026f0
nop dword [rax + rax]
aesenc xmm3, xmmword [rcx]
aesdec xmm2, xmmword [rcx + 0x10]
aesenc xmm1, xmmword [rcx + 0x20]
aesdec xmm0, xmmword [rcx + 0x30]
add rcx, 0x40
cmp rdx, rcx
ja 0x7026d0
movdqa xmm4, xmmword [0x00ae62c0]
aesenc xmm3, xmm4
aesdec xmm2, xmm4
aesenc xmm1, xmm4
aesdec xmm0, xmm4
movdqa xmm4, xmmword [0x00ae62d0]
aesenc xmm3, xmm4
aesdec xmm2, xmm4
aesenc xmm1, xmm4
aesdec xmm0, xmm4
movaps xmmword [r8], xmm3
movaps xmmword [r8 + 0x10], xmm2
movaps xmmword [r8 + 0x20], xmm1
movaps xmmword [r8 + 0x30], xmm0
ret
Function at 0x768840
Capabilities:
Decrypt data using aes via x86 extensions
Encrypt data using aes via x86 extensions

Disassembly:
sub rsp, 0x68
movaps xmmword [rsp], xmm6
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x30], xmm9
movaps xmmword [rsp + 0x40], xmm10
movaps xmmword [rsp + 0x50], xmm11
mov rax, qword [0x00afa0f0]
movdqa xmm11, xmmword [rcx]
movdqa xmm10, xmmword [rcx + 0x10]
movdqa xmm9, xmmword [rax + 0xc0]
movdqa xmm8, xmmword [rax + 0xd0]
add rdx, r8
movdqa xmm7, xmmword [rax + 0xe0]
cmp r8, rdx
movdqa xmm6, xmmword [rax + 0xf0]
movdqa xmm5, xmmword [rax + 0x100]
movdqa xmm4, xmmword [rax + 0x110]
movdqa xmm3, xmmword [rax + 0x120]
movdqa xmm2, xmmword [rax + 0x130]
movdqa xmm1, xmmword [rcx + 0x20]
movdqa xmm0, xmmword [rcx + 0x30]
jae 0x702335
nop dword [rax + rax]
aesdec xmm11, xmm9
aesenc xmm10, xmm9
aesdec xmm1, xmm5
aesenc xmm0, xmm5
aesdec xmm11, xmm8
aesenc xmm10, xmm8
aesdec xmm1, xmm4
add r8, 0x40
aesenc xmm0, xmm4
aesdec xmm11, xmm7
aesenc xmm10, xmm7
aesdec xmm1, xmm3
aesenc xmm0, xmm3
aesdec xmm11, xmm6
aesenc xmm10, xmm6
movaps xmmword [r8 - 0x40], xmm11
movaps xmmword [r8 - 0x30], xmm10
aesdec xmm1, xmm2
aesenc xmm0, xmm2
movaps xmmword [r8 - 0x20], xmm1
movaps xmmword [r8 - 0x10], xmm0
cmp rdx, r8
ja 0x7022c0
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
add rsp, 0x68
ret
lea r8, [rcx + 0x40]
mov rax, rdx
mov rdx, qword [0x00afa0f0]
mov rcx, rax
mov edx, dword [rdx + 0x34]
lea edx, [rdx*8 + 0x80]
jmp 0x702230
Function at 0x7cc890
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rbp, rcx
mov rdi, rdx
mov esi, r8d
jmp 0x7cc8b8
call r12
cmp dword [rax], 4
jne 0x7cc8d6
mov rcx, rbp
call fcn.007cc790
mov r8d, esi
mov rdx, rdi
mov ecx, eax
call sub.msvcrt.dll__read_1
movsxd rbx, eax
cmp rbx, 0xffffffffffffffff
je 0x7cc8b0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x806610
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp fcn.00401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00701940
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.00701940
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x25df821c0
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rdi, rcx
mov rbx, rdx
push r10
sar r10w, 0xa
xorps xmm5, xmm9
psrld mm7, 0x2c
push r15
dec r15
por mm2, mm0
adc r15, r10
push r14
psrlq mm0, 0x13
nop
push r12
movups xmm5, xmm12
psrld mm3, 0x37
pop r12
psrlq mm6, 0x43
sbb r10b, r15b
pcmpgtb mm1, mm5
pop r14
movhlps xmm15, xmm11
maxss xmm8, xmm6
pop r15
emms
emms
pop r10
call fcn.25df9b018
xor eax, eax
mov dl, byte [rbx + rax]
mov byte [rdi + rax], dl
inc rax
test dl, dl
jne 0x25df8221e
movabs rax, 0x55004d0071002c
mov dword [rsp + 0x30], 0x29
mov qword [rsp + 0x28], rax
push rcx
nop
movss xmm6, xmm11
emms
subss xmm4, xmm15
rcl ecx, 0x16
push r11
xorps xmm15, xmm4
sub cl, r11b
psubw mm5, mm1
nop
rol cl, 3
pop r11
dec ecx
paddusb mm1, mm2
sub rcx, 0xc
psrld mm5, 0x21
sub cl, 0x15
ror ecx, 0xb
pop rcx
movabs rax, 0x600024005d0023
mov dword [rsp + 0x3c], 0x42
mov qword [rsp + 0x34], rax
push r13
shl r13d, 0xa
push r11
dec r11
push r8
punpckhbw mm5, mm4
push rax
psllq mm7, 0xd
push rbx
shr r8d, 0xb
pop rbx
nop
pop rax
dec r11
pop r8
packssdw mm0, mm6
pop r11
rcl r13d, 9
pop r13
lea rbx, [rsp + 0x34]
lea rsi, [rsp + 0x28]
mov rdx, rbx
mov rcx, rsi
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x25df8232f
mov rax, rsi
lea rdx, [rsp + 0x32]
push r14
pslld mm6, 0x40
push rdx
movlhps xmm9, xmm15
mov edx, r14d
pop rdx
emms
pop r14
xor word [rax], 0x78
push rdx
psllq mm1, 0x43
psraw mm4, 0x3d
rol dl, 0x12
push r8
nop
neg r8w
push rcx
punpckhbw mm1, mm2
pop rcx
xchg r8, rdx
psrlq mm2, 8
pop r8
psraw mm2, 0x49
rcpss xmm0, xmm9
movups xmm6, xmm10
pop rdx
add rax, 2
cmp rax, rdx
jne 0x25df822de
jmp 0x25df823a7
mov rax, rbx
lea rdx, [rsp + 0x3e]
cmp r13b, r11b
jne 0x25df82362
push r8
nop
push rcx
nop
xchg cx, r8w
pop rcx
paddsb mm1, mm6
pop r8
jmp 0x25df82376
push r14
subss xmm4, xmm6
push r11
mov r11, r14
nop
pop r11
andnps xmm3, xmm14
pop r14
push r10
subss xmm9, xmm2
push rbx
paddb mm5, mm3
mulps xmm3, xmm4
pop rbx
emms
pop r10
xor word [rax], 0x22
push r10
pslld mm2, 0x61
push r8
paddsb mm7, mm6
pop r8
emms
pop r10
add rax, 2
cmp rax, rdx
jne 0x25df82337
push r12
paddsw mm7, mm5
rcl r12b, 3
dec r12d
push r15
inc r12
movlhps xmm11, xmm6
emms
push rbx
not ebx
nop
not r15d
pop rbx
nop
xorps xmm9, xmm5
emms
pop r15
inc r12d
shl r12b, 0x17
nop
pop r12
mov rax, rdi
add rsp, 0x40
pop rbx
pop rsi
pop rdi
ret
Function at 0x25df9d762
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
movabs rax, 0x5000360041
mov qword [rsp + 0x28], rax
mov rbx, rcx
push rbx
psrld mm5, 0x3e
push r9
emms
dec r9
push r12
rcpss xmm1, xmm10
psllq mm6, 0x28
rcpps xmm4, xmm12
push rdx
maxps xmm2, xmm10
addss xmm14, xmm7
addps xmm2, xmm6
nop
pop rdx
psrlq mm6, 0x2c
orps xmm15, xmm12
inc ebx
pop r12
psubsb mm6, mm4
shr r9b, 5
pop r9
psllq mm6, 0x6a
pop rbx
lea rcx, [rsp + 0x28]
call sub.msvcrt.dll_wcslen
cmp rax, 3
jne 0x25df9d7e7
push r10
mov r10, 0x15
push rbx
nop
add r10w, bx
pop rbx
psraw mm5, 0x39
pop r10
jmp 0x25df9d7ee
push r13
dec r13
pop r13
cmp r13, 4
jne 0x25df9d803
push r10
nop
pop r10
jmp 0x25df9d807
push rax
emms
pop rax
push r11
nop
pop r11
mov rcx, rbx
call fcn.25df9c540
push r12
mov r12, 3
push r11
nop
push r13
mov r11b, r13b
push r12
emms
push rdx
andnps xmm15, xmm11
push rbx
or r11, rbx
push r10
nop
push rax
neg ebx
pop rax
psrld mm2, 0xf
pop r10
nop
pop rbx
paddsb mm2, mm7
pop rdx
psrld mm2, 0x2e
pop r12
rcr r11b, 2
pop r13
emms
pop r11
dec r12
jne 0x25df9d81d
pop r12
mov edi, 3
push r8
sbb r8, 4
push r13
emms
push rax
subss xmm6, xmm8
push r10
nop
pop r10
nop
pop rax
inc r8d
pop r13
neg r8w
pop r8
mov rdx, qword [rbx + 8]
mov r9d, 4
mov r8d, 0x3000
xor ecx, ecx
call fcn.25df89307
mov rsi, rax
push r12
mov r12, 3
push r11
nop
push r13
mov r11b, r13b
push r12
emms
push rdx
andnps xmm15, xmm11
push rbx
or r11, rbx
push r10
nop
push rax
neg ebx
pop rax
psrld mm2, 0xf
pop r10
nop
pop rbx
paddsb mm2, mm7
pop rdx
psrld mm2, 0x2e
pop r12
rcr r11b, 2
pop r13
emms
pop r11
dec r12
jne 0x25df9d8a6
pop r12
mov edx, dword [rbx + 8]
mov rcx, qword [rbx]
mov r8, rax
call section..text
mov eax, eax
mov qword [rbx + 8], rax
push rcx
mov rcx, 1
push r9
neg r9b
push rdx
pxor mm1, mm3
dec r9d
pop rdx
shl r9, 0xa
pop r9
dec rcx
jne 0x25df9d901
pop rcx
mov rcx, qword [rbx]
mov r8d, 0x8000
xor edx, edx
call fcn.25df893be
push r9
andps xmm11, xmm0
push rax
neg r9
sbb r9d, eax
push r8
psllq mm5, 0x45
not r8
emms
pop r8
nop
psrad mm1, 0x60
pop rax
packssdw mm6, mm2
pop r9
mov qword [rbx], rsi
dec edi
jne 0x25df9d861
mov edx, dword [rbx + 8]
mov rcx, rsi
call fcn.25df9b520
push rdx
xorps xmm2, xmm9
inc rdx
push rax
shl rax, 0xf
sar al, 3
push r15
pslld mm6, 0x10
movups xmm13, xmm1
push rcx
emms
psllq mm4, 0x4a
push r10
rcr al, 4
rol rdx, 6
pop r10
sub cx, dx
psllq mm7, 0x1f
pop rcx
emms
psrlq mm3, 0xa
pop r15
nop
emms
pop rax
nop
paddusb mm0, mm5
pop rdx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
Function at 0x416cc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x416e66
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433480
xorps xmm15, xmm15
mov r14, qword [0x006b3468]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x416d2b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416d40
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x416d65
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x416d79
cmp rbx, 0x1000
jae 0x416d35
nop dword [rax]
jmp 0x416de9
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x416d8d
xor edx, edx
jmp 0x416de0
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00433480
xorps xmm15, xmm15
mov r14, qword [0x006b3468]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x416d6f
jmp 0x416d54
call fcn.00465c80
xorps xmm15, xmm15
mov r14, qword [0x006b3468]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00437b60
lea rax, [0x00559932]
mov ebx, 0x18
call fcn.00438460
mov rax, qword [rsp + 0x38]
call fcn.00438160
lea rax, [0x00559a0a]
mov ebx, 0x19
call fcn.00438460
mov rax, qword [rsp + 0x30]
nop
call fcn.00438160
call fcn.00437dc0
call fcn.00437be0
lea rax, [0x0055cb72]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.00436220
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004620c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00416cc0