joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180054880
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x180054896
mov al, 1
jmp 0x1800548f6
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1800548a7
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1800548f4
mov ecx, dword [rcx + 0x18]
nop
call fcn.180053014
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1800548f4
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1800548f4
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1800548f4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1800548f6
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x180056ea8
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.180049294
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.180049294
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x180056ff8
cmp rax, 0xffffffffffffffff
je 0x180056ff8
xor edi, edi
test rbp, rbp
jle 0x180056fa3
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.18004a370
mov rbx, rax
test rax, rax
jne 0x180056f30
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x180056f99
mov edx, 0x8000
mov ecx, r14d
call fcn.180056d2c
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.18004afc0
cmp eax, 0xffffffff
je 0x180056f79
cdqe
sub rbp, rax
test rbp, rbp
jg 0x180056f40
mov edx, r15d
mov ecx, r14d
call fcn.180056d2c
jmp 0x180056f99
cmp byte [rsi + 0x38], dil
je 0x180056f90
cmp dword [rsi + 0x34], 5
jne 0x180056f90
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x180056f99
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.180048e30
jmp 0x18005700c
jns 0x18005700c
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.180049294
cmp rax, 0xffffffffffffffff
jne 0x180056fc4
cmp byte [rsi + 0x30], dil
je 0x18005700c
mov edi, dword [rsi + 0x2c]
jmp 0x18005700c
mov ecx, r14d
call fcn.180053014
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x18005700c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x18005700c
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x180057005
mov eax, dword [rsi + 0x2c]
jmp 0x18005700a
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.180049294
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14000b97c
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
movaps xmmword [rax - 0x28], xmm6
mov r15, rcx
test r8, r8
je 0x14000baa4
mov rdi, rcx
lea rbp, [r8 - 1]
sub rdi, rdx
shr rbp, 4
add rdi, 0xf0
lea rsi, [rdx + 9]
inc rbp
lea rbx, [rsi - 9]
mov r8, r15
movups xmm6, xmmword [rbx]
mov rdx, rbx
mov cl, 0xe
call fcn.14000baf4
mov r14b, 0xd
mov al, byte [rsi]
mov rdx, rbx
mov cl, byte [rsi + 4]
mov r9d, 4
mov byte [rsi + 4], al
mov al, byte [rsi - 4]
mov byte [rsi], al
mov al, byte [rsi - 8]
mov byte [rsi - 4], al
mov al, byte [rsi + 1]
mov byte [rsi - 8], cl
mov cl, byte [rsi - 7]
mov byte [rsi - 7], al
mov al, byte [rsi + 5]
mov byte [rsi + 1], cl
mov cl, byte [rsi - 3]
mov byte [rsi - 3], al
mov al, byte [rsi - 2]
mov byte [rsi + 5], cl
mov cl, byte [rsi - 6]
mov byte [rsi - 6], al
mov al, byte [rsi + 2]
mov byte [rsi - 2], al
mov al, byte [rsi + 6]
mov byte [rsi + 2], al
mov byte [rsi + 6], cl
mov rcx, rdx
mov r8d, 4
movzx eax, byte [rcx]
lea r10, [0x14002a510]
mov al, byte [rax + r10]
mov byte [rcx], al
lea rcx, [rcx + 4]
sub r8, 1
jne 0x14000ba2f
inc rdx
sub r9, 1
jne 0x14000ba26
mov r8, r15
mov rdx, rbx
mov cl, r14b
call fcn.14000baf4
test r14b, r14b
je 0x14000ba76
mov rcx, rbx
call fcn.14000bc38
add r14b, 0xff
jmp 0x14000b9d7
mov ecx, 0x10
mov al, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x14000ba7b
add rsi, 0x10
sub rdi, 0x10
movdqu xmmword [r15 + 0xf0], xmm6
sub rbp, 1
jne 0x14000b9c0
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x14000baf4
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov al, byte [0x140039230]
xor r10b, r10b
mov byte [rsp + 0x20], al
mov rbx, r8
mov qword [rsp + 0x20], 0x57934ed1
mov qword [rsp + 0x20], 0x8b3e
mov byte [rsp + 0x20], 0x54
mov dword [rsp + 0x20], 0xe375
mov qword [rsp + 0x20], 0x7d7324f
mov rax, qword [0x1400392d0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x20], 0xfdef
mov dword [rsp + 0x20], 0xfc6c21cc
mov byte [rsp + 0x20], 6
mov rax, qword [0x1400392d0]
mov al, byte [0x14003918f]
mov dword [rsp + 0x20], 0xa6aa
mov al, byte [0x14003919f]
mov al, byte [0x14003919f]
movzx eax, word [0x1400392a0]
movzx eax, word [0x140039294]
mov al, byte [0x14003918c]
mov al, byte [0x1400391c6]
mov al, byte [0x14003928c]
mov byte [rsp + 0x20], 0x29
mov byte [rsp + 0x20], al
movsxd rax, dword [0x1400391fc]
mov qword [rsp + 0x20], rax
mov al, byte [0x140039238]
mov byte [rsp + 0x20], al
movzx eax, word [0x140039278]
mov dword [rsp + 0x20], eax
mov rax, qword [0x140039268]
mov qword [rsp + 0x20], 0x2d43
mov al, byte [0x14003918b]
mov al, byte [0x140039230]
mov byte [rsp + 0x20], al
mov al, byte [0x14003918c]
mov al, byte [0x14003918c]
movzx r11d, cl
mov byte [rsp + 0x20], al
shl r11d, 2
movzx r8d, r10b
xor r9b, r9b
add r8d, r11d
shl r8d, 2
movzx eax, r9b
inc r9b
add eax, r8d
mov cl, byte [rax + rbx]
xor byte [rdx], cl
inc rdx
cmp r9b, 4
jb 0x14000bc03
inc r10b
cmp r10b, 4
jb 0x14000bbf5
add dword [0x1400392c8], 0xdc
xor eax, eax
mov rbx, qword [rsp + 8]
ret
Function at 0x140014618
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400399a8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov al, byte [0x1400395dc]
mov rbx, r8
mov byte [rbp - 0x30], al
mov r8, rdx
movzx eax, byte [0x1400395b4]
mov rdx, rcx
mov word [rbp - 0x30], ax
mov rax, qword [0x1400396a8]
movzx eax, word [0x1400396cc]
and qword [r11 - 0x58], 0
and qword [r11 - 0x60], 0
and qword [r11 - 0x68], 0
and qword [r11 - 0x70], 0
mov dword [rbp - 0x30], 0x30
mov qword [rbp - 0x28], 0xd5
mov word [rbp - 0x30], ax
mov dword [rbp - 0x30], 0xfeb1
mov dword [rbp - 0x30], 0x652
mov rax, qword [0x1400396d8]
mov qword [rbp - 0x28], rax
mov eax, dword [0x1400396f4]
movzx eax, word [0x1400395dc]
mov word [rbp - 0x30], ax
mov rax, qword [0x1400396d8]
mov byte [rbp - 0x30], al
mov rax, qword [0x140039688]
mov word [rbp - 0x30], ax
mov al, byte [0x1400395b6]
mov byte [rbp - 0x30], al
mov eax, 0x8dec
mov dword [rbp - 0x30], 0xb7
mov word [rbp - 0x30], ax
mov eax, 0xbc91c4a8
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x30], 0x68f182c2
mov rax, qword [0x1400396a8]
mov byte [rbp - 0x30], al
mov eax, 0x467f
mov qword [rbp - 0x30], 0x22
mov word [rbp - 0x30], ax
movsx eax, word [0x1400396a4]
mov dword [rbp - 0x30], eax
mov rax, qword [0x1400396a8]
movzx eax, word [0x1400396bc]
movzx eax, word [0x1400396bc]
mov eax, dword [0x140039674]
mov edi, r9d
mov r9, rbx
mov dword [rbp - 0x30], eax
mov rax, qword [rbp - 0x28]
imul rcx, rax, 0xffffffffffffff52
mov qword [r11 - 0x78], rdi
add qword [0x140039680], rcx
lea rcx, [0x14001e233]
call fcn.14000b2b0
test rax, rax
jne 0x1400147c0
mov dword [rbp - 0x20], 0x8d9697c5
mov dword [rbp - 0x1c], 0x8c969fd9
mov dword [rbp - 0x18], 0xc79d97
xor byte [rbp + rax - 0x20], 0xf9
inc rax
cmp rax, 0xb
jb 0x140014776
and qword [rsp + 0x40], 0
lea r9d, [rdi - 1]
and qword [rsp + 0x38], 0
lea r8, [rbp - 0x20]
and qword [rsp + 0x30], 0
lea rcx, [0x140020680]
and qword [rsp + 0x28], 0
mov rdx, rbx
and qword [rsp + 0x20], 0
call fcn.14000b2b0
mov eax, 3
jmp 0x1400147c2
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14001e2d0
add rsp, 0x80
pop rdi
pop rbx
pop rbp
ret
Function at 0x140021c00
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140021a2c
Function at 0x180001000
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
xor edi, edi
mov ebx, edi
nop
mov eax, dword [0x1800af7a8]
test eax, eax
je 0x180001036
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r11d, eax
mov eax, dword [0x1800af7b0]
cmp eax, r11d
jne 0x180001045
inc dword [0x1800af7ac]
jmp 0x18000107a
mov eax, 1
xchg dword [0x1800af7a8], eax
test eax, eax
je 0x180001058
inc ebx
test bl, 0x3f
jne 0x180001010
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SleepEx]
jmp 0x180001010
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1800af7ac], eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1800af7b0], eax
mov dword [0x1800af7ac], 1
mov rax, qword [0x1800aea30]
test rax, rax
jne 0x1800010f4
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, dword [rsp + 0x24]
lea rax, [rbx - 1]
test rbx, rax
je 0x1800010a3
call fcn.180086f78
mov qword [0x1800aea40], 0x100000
mov qword [0x1800aea38], rbx
mov qword [0x1800aea48], 0x40000
mov qword [0x1800aea50], 0x200000
mov dword [0x1800aea58], 7
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r11d, eax
and r11, 0xfffffffffffffff8
xor r11, 0x55555550
or r11, 8
mov qword [0x1800aea30], r11
dec dword [0x1800af7ac]
mov ecx, dword [0x1800af7ac]
mov eax, 1
jne 0x180001113
mov dword [0x1800af7b0], edi
xchg dword [0x1800af7a8], edi
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x180003d1a
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r10d, r9d
xor ebx, ebx
movsxd r9, dword [rcx + 0x3c]
mov r12d, r8d
add r9, rcx
mov r13d, edx
mov rsi, rcx
mov eax, dword [r9 + r10*8 + 0x88]
add rax, rcx
mov edi, dword [rax + 0x20]
mov ebp, dword [rax + 0x1c]
add rdi, rcx
mov r14d, dword [rax + 0x24]
add rbp, rcx
mov r15d, dword [rax + 0x18]
add r14, rcx
test r15d, r15d

Function at 0x180003e26
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov esi, ecx
mov rdi, qword [rax + 0x18]
add rdi, 0x10
mov rbx, qword [rdi]
jmp 0x180003e60
mov rcx, qword [rbx + 0x60]
call fcn.180003e7e
lea ecx, [rax + rax*2]
cmp esi, ecx
je 0x180003e77
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x180003e4d
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
cmp byte [rax - 0x7d], cl
invalid
and byte [rdi - 0x3d], bl
mov rax, qword [rbx + 0x30]
jmp 0x180003e67
Function at 0x180003e30
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov esi, ecx
mov rdi, qword [rax + 0x18]
add rdi, 0x10
mov rbx, qword [rdi]
jmp 0x180003e60
mov rcx, qword [rbx + 0x60]
call fcn.180003e7e
lea ecx, [rax + rax*2]
cmp esi, ecx
je 0x180003e77
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x180003e4d
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
cmp byte [rax - 0x7d], cl
invalid
and byte [rdi - 0x3d], bl
mov rax, qword [rbx + 0x30]
jmp 0x180003e67

Function at 0x1800043e0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push r12
sub rsp, 0x30
mov eax, 0x18
mov r12, rdx
mov rdi, rcx
cmp rdx, rax
cmovb r12, rax
mov qword [rsp + 0x58], r12
test rcx, rcx
jne 0x18000441c
cmp dword [0x1800aea78], ecx
lea rdi, [0x1800aea60]
jne 0x18000441c
mov rcx, rdi
call fcn.180003f40
mov ecx, dword [rdi + 0x820]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor ebp, ebp
test eax, eax
jle 0x180004443
cdqe
mov rsi, qword [rdi + rax*8 + 0x18]
mov ebx, dword [rsi]
jmp 0x180004474
jne 0x180004494
mov rcx, rdi
call fcn.180003be0
mov rsi, rax
test rax, rax
jne 0x180004472
mov ecx, dword [rdi + 0x820]
or rdx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
jne 0x18000446e
call fcn.180086f78
mov ebx, ebp
jmp 0x18000449d
mov ebx, dword [rax]
cmp r12, 0x2000
ja 0x18000449d
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.180003d70
test rax, rax
je 0x18000449d
jmp 0x180004534
or rbx, 0xffffffffffffffff
mov rsi, rbp
sub ebx, eax
movsxd rax, ebx
mov dword [rsp + 0x50], ebx
mov rbx, qword [rdi + rax*8 + 0x828]
mov eax, dword [rbx + 0x36c]
test eax, eax
je 0x1800044ce
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [rbx + 0x374]
cmp ecx, eax
jne 0x1800044f5
inc dword [rbx + 0x370]
jmp 0x18000450d
mov eax, 1
xchg dword [rbx + 0x36c], eax
test eax, eax
jne 0x1800044f5
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbx + 0x374], eax
mov dword [rbx + 0x370], 1
jmp 0x18000450d
mov r9, qword [rsp + 0x58]
lea r8, [rsp + 0x50]
mov rdx, rsi
mov rcx, rdi
call fcn.1800040c0
mov rbx, rax
mov rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.180002f70
dec dword [rbx + 0x370]
mov ecx, dword [rbx + 0x370]
jne 0x180004534
mov dword [rbx + 0x374], ebp
xchg dword [rbx + 0x36c], ebp
mov rsi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r12
pop rdi
pop rbp
ret
Function at 0x14000109c
Capabilities:
Read file on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
and qword [rbp + 0x6f], 0
lea rdx, [0x1400030c0]
lea rcx, [rbp + 7]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and dword [rsp + 0x50], 0
lea rax, [rbp + 7]
and qword [rsp + 0x48], 0
lea r9, [rbp + 0x17]
and qword [rbp + 0x2f], 0
lea r8, [rbp + 0x27]
mov dword [rsp + 0x40], 0x20
lea rcx, [rbp + 0x67]
mov dword [rsp + 0x38], 1
xorps xmm0, xmm0
and dword [rsp + 0x30], 0
mov edx, 0x10000000
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
mov dword [rbp + 0x27], 0x30
mov dword [rbp + 0x3f], 0x240
mov qword [rbp + 0x37], rax
movdqu xmmword [rbp + 0x47], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
and qword [rsp + 0x40], 0
lea rax, [rbp + 0x6f]
mov rcx, qword [rbp + 0x67]
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
lea rax, [0x140006050]
mov dword [rsp + 0x30], 0x64
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
add rsp, 0xb0
pop rbp
ret

Function at 0x14000223c
Capabilities:
Encode data using xor

Disassembly:
movabs rax, qword [0xfffff78000000014]
mov r9, rdx
sub rcx, rdx
mov r10d, 0xc
mov dl, al
xor dl, byte [rcx + r9]
xor dl, r8b
mov byte [r9], dl
inc r9
sub r10, 1
jne 0x140002252
ret

Function at 0x14000275c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd r9, dword [rcx + 0x3c]
lea rbx, [rcx + 0x18]
add rbx, r9
xor r10d, r10d
xor edi, edi
mov r14, r8
mov r15, rdx
mov rbp, rcx
movzx eax, word [r9 + rcx + 0x14]
movzx esi, word [r9 + rcx + 6]
add rbx, rax
test esi, esi
je 0x1400027dc
cmp dword [rbx], 0x45474150
je 0x1400027b6
cmp dword [rbx], 0x7865742e
jne 0x1400027d2
cmp byte [rbx + 4], 0x74
jne 0x1400027d2
mov ecx, dword [rbx + 0xc]
mov r9, r14
mov edx, dword [rbx + 8]
add rcx, rbp
mov r8, r15
call fcn.1400026e8
mov r10, rax
test rax, rax
jne 0x1400027dc
inc edi
add rbx, 0x28
cmp edi, esi
jb 0x1400027a0
mov rbx, qword [rsp + 0x40]
mov rax, r10
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400027f8
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x150
xor ebp, ebp
lea r9, [rax + 0x18]
and dword [rax + 0x18], ebp
mov rsi, rdx
mov r14, rcx
xor r8d, r8d
xor edx, edx
lea edi, [rbp + 0xb]
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
cmp eax, 0xc0000004
jne 0x140002874
mov edx, dword [rsp + 0x180]
xor ecx, ecx
mov r8d, 0x6e556353
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov rbx, rax
test rax, rax
je 0x140002874
mov r8d, dword [rsp + 0x180]
xor r9d, r9d
mov rdx, rax
mov ecx, edi
call sub.ntoskrnl.exe_ZwQuerySystemInformation
test eax, eax
jns 0x14000288e
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
xor eax, eax
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
xor edi, edi
cmp dword [rbx], edi
jbe 0x140002950
mov eax, edi
lea rcx, [rsp + 0x20]
imul rax, rax, 0x128
mov edx, 2
add rax, 8
add rax, rbx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x1400028b2
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
lea rcx, [rsp + 0x48]
call fcn.1400029a0
mov rcx, rax
mov rdx, r14
call sub.ntoskrnl.exe_strstr
test rax, rax
jne 0x140002940
inc edi
cmp edi, dword [rbx]
jb 0x140002898
jmp 0x140002950
mov rbp, qword [rsp + 0x30]
test rsi, rsi
je 0x140002950
mov ecx, dword [rsp + 0x38]
mov dword [rsi], ecx
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rbp
jmp 0x140002876

Function at 0x140002964
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r8, rcx
test edx, edx
jne 0x14000296e
xor eax, eax
ret
movzx eax, byte [rcx]
xor eax, 0x4f9ace2f
imul ecx, eax, 0x1000193
cmp edx, 1
jbe 0x14000299b
inc r8
dec edx
movzx eax, byte [r8]
inc r8
xor eax, ecx
imul ecx, eax, 0x1000193
sub rdx, 1
jne 0x140002986
mov eax, ecx
ret
Function at 0x140002a58
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov edi, r8d
mov ebx, ecx
mov edx, r8d
mov rcx, rsi
call fcn.140002964
xor ebx, eax
test edi, edi
je 0x140002ab7
mov r8d, edi
imul ebx, ebx, 0x41c64e6d
mov eax, 0x80808081
add ebx, 0x3039
mov ecx, ebx
shr ecx, 0x10
and ecx, 0x7fff
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
xor byte [rsi], cl
inc rsi
sub r8, 1
jne 0x140002a83
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x100411cb0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
lea rcx, [0x100412270]
call 0x100411cb0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call 0x100411cd0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call 0x100411ce0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call 0x100411cf0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
add rsp, 0x28
jmp 0x100411d00
lahf
sbb byte [rcx - 0x585f6656], 0x34
stosd dword [rdi], eax
test eax, 0x9daa9978
xchg edi, eax
cdq
popfq
cwde
xor al, 0x43
xchg edi, eax
movabs dword [0xa7a6998a9b9d9aa2], eax
popfq
movabs dword [0x86a29597a73b34a2], eax
popfq
cmpsd dword [rsi], dword [rdi]
lahf
sbb byte [rcx + 0x34a099aa], 0x3b
cmpsd dword [rsi], dword [rdi]
xchg edi, eax
xchg ebp, eax
movabs byte [0x889899a7a495a079], al
popfq
movabs eax, dword [0xa0a2aba3983c3499]
movabs dword [0x99809fa79d869895], eax
stosb byte [rdi], al
cdq
movabs al, byte [0xa3a0a2aba3983b34]
xchg ebp, eax
cwde
jns 0x100411caf
xchg ebp, eax
movsb byte [rdi], byte [rsi]
cmpsd dword [rsi], dword [rdi]
cdq
cwde
mov byte [rbp + 0x3c3499a1], bl
popfq
movabs byte [0xa79d86a0a095a8a7], al
lahf
sbb byte [rcx + 0x34a099aa], 0x3b
popfq
movabs byte [0x95a079a0a095a8a7], al
movsb byte [rdi], byte [rsi]
cmpsd dword [rsi], dword [rdi]
cdq
cwde
mov byte [rbp + 0x3c3499a1], bl
popfq
cmpsd dword [rsi], dword [rdi]
xchg dword [rcx - 0x665e6268], ebx
movabs byte [0xffc63434344134a8], al
xchg esi, eax
push rax
xchg r12, rax
imul edi, dword [rdi - 0x4c], 0xffffffe5
jge 0x100411db6
not eax
jno 0x100411dbe
xor al, 0x34
xor al, 0x34
xor esi, dword [rbx]
xor esi, dword [rbx]
cmp byte [rsi], 0x34
xor al, 0x33
xor esi, dword [rbx]
xor esi, dword [rsp + rsi]
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor eax, 0x36343434
xor eax, 0x3435f447
xor al, 0x34
enter 0x3457, 0x34
test al, 0x43
xor al, 0x34
invalid
xor al, 0xc0
cld
movabs al, byte [0x3434343434345334]
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x34
xor al, 0x7c
xor al, 0x40
xor al, 0x35
xor al, 0x6f
xor al, 0x6f
xor al, 0x81
popfq
xchg edi, eax
cmpsb byte [rsi], byte [rdi]
movabs dword [0xa29d8b62a89aa3a7], eax
cwde
movabs dword [0xa89598a48962a7ab], eax
cdq
invalid