joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b840
Capabilities:
Encode data using xor
Get session user name
Hash data using fnv
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x100
lea rcx, str.ALLUSERSPROFILE
call fcn.0041c560
lea rdx, [rsp + 0x130]
lea rcx, [rsp + 0x20]
mov r12, rax
mov dword [rsp + 0x130], 0x64
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rcx, [rsp + 0x20]
call fcn.004173f0
xor esi, esi
xor edi, edi
test eax, eax
mov ebx, 0x811c9dc5
movsxd rbp, eax
jle 0x40b8c3
movzx ecx, byte [rsp + rdi + 0x20]
mov edx, esi
xor ebx, ecx
movsx r8d, cl
lea rcx, str.__d___d__d_n
imul ebx, ebx, 0x1000193
mov r9d, ebx
call fcn.0040bd0c
add rdi, 1
add esi, 1
cmp rdi, rbp
jl 0x40b895
test ebx, ebx
jns 0x40b8c9
neg ebx
xor edx, edx
lea rcx, [rsp + 0x90]
lea r8d, [rdx + 0x64]
call fcn.00419040
lea rdx, [0x0044d774]
lea rcx, [rsp + 0x90]
mov r8d, ebx
call fcn.00418380
lea rcx, [rsp + 0x20]
xor ebx, ebx
call fcn.004173f0
test rax, rax
je 0x40b923
cmp byte [rsp + rbx + 0x20], 0x80
jb 0x40b910
mov byte [rsp + rbx + 0x20], 0x5f
lea rcx, [rsp + 0x20]
add rbx, 1
call fcn.004173f0
cmp rbx, rax
jb 0x40b904
mov ecx, 0x104
call fcn.004171e0
mov rdx, r12
mov rcx, rax
mov rbx, rax
mov byte [rax], 0
call fcn.004174b0
lea rdx, str.JWUser_
mov rcx, rbx
call fcn.0040bc6c
lea rdx, [rsp + 0x90]
mov rcx, rbx
call fcn.004174b0
lea rdx, [0x0044cab4]
mov rcx, rbx
call fcn.004174b0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.004174b0
mov rcx, rbx
call fcn.0040bc24
mov rax, rbx
add rsp, 0x100
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x40b994
Capabilities:
Check os version
Query environment variable

Disassembly:
push rbx
push rdi
sub rsp, 0xc8
lea rcx, str.APPDATA
mov dword [rsp + 0x20], 0x94
call fcn.0041c560
test rax, rax
mov rdi, rax
je 0x40ba6f
mov rcx, rax
call fcn.004173f0
cmp rax, 2
jbe 0x40ba6f
cmp byte [rdi], 0x5c
jne 0x40ba6f
cmp byte [rdi + 1], 0x5c
jne 0x40ba6f
lea rcx, str._Extractor__Roaming_AppData_directory_detected_n
call fcn.0040bd0c
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40ba7b
cmp dword [rsp + 0x24], 5
jbe 0x40ba25
lea rcx, str.LOCALAPPDATA
call fcn.0041c560
lea rcx, str._Extractor__Local_AppData_directory_resolved_to__s_n
mov rdx, rax
mov rdi, rax
call fcn.0040bd0c
jmp 0x40ba7b
lea rcx, str.USERPROFILE
call fcn.0041c560
mov ecx, 0x104
mov rbx, rax
call fcn.004171e0
mov rdx, rbx
mov rcx, rax
mov rdi, rax
mov byte [rax], 0
call fcn.004174b0
lea rdx, str.Local_Settings
mov rcx, rdi
call fcn.0040bc6c
lea rdx, str.Application_Data
mov rcx, rdi
call fcn.0040bc6c
jmp 0x40ba7b
lea rcx, str._Extractor__Local_AppData_directory_detected_n
call fcn.0040bd0c
lea rcx, str._Utils__Validating_directory..._n
call fcn.0040bd0c
lea rcx, str._Utils__Shared_dir_detected_is__s_n
mov rdx, rdi
call fcn.0040bd0c
mov edx, 6
mov rcx, rdi
call fcn.0041d800
test eax, eax
jne 0x40bb1f
lea rcx, str.Checking_if_string_is_cAscii__s_n
mov rdx, rdi
call fcn.0040bd0c
mov rcx, rdi
xor ebx, ebx
call fcn.004173f0
test rax, rax
je 0x40badc
cmp byte [rbx + rdi], 0x80
jae 0x40bb1f
mov rcx, rdi
add rbx, 1
call fcn.004173f0
cmp rbx, rax
jb 0x40bac5
lea rcx, str.Checking_if__s_contains_a___n
mov rdx, rdi
call fcn.0040bd0c
mov rcx, rdi
xor ebx, ebx
call fcn.004173f0
test rax, rax
je 0x40bb11
cmp byte [rbx + rdi], 0x21
je 0x40bb1f
mov rcx, rdi
add rbx, 1
call fcn.004173f0
cmp rbx, rax
jb 0x40bafa
lea rcx, str._Utils__Shared_directory_appears_valid._n
call fcn.0040bd0c
jmp 0x40bb95
lea rcx, str._Utils__The_directory__s_appears_invalid._n
mov rdx, rdi
call fcn.0040bd0c
lea rcx, str._Utils__Trying_the_short_path_instead._n
mov rdx, rdi
call fcn.0040bd0c
mov ecx, 0x104
call fcn.004171e0
mov r8d, 0x400
mov rcx, rdi
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x40bb85
lea rcx, str._Utils__Got_short_path_of__s_n
mov rdx, rbx
call fcn.0040bd0c
mov edx, 6
mov rcx, rdi
call fcn.0041d800
test eax, eax
jne 0x40bb85
mov rax, rbx
jmp 0x40bb98
mov rcx, rbx
call fcn.004171a0
call fcn.0040b840
mov rdi, rax
mov rax, rdi
add rsp, 0xc8
pop rdi
pop rbx
ret
Function at 0x40e2e0
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
jne 0x40e307
lea rdx, str.._srchashes_sha2_sha256.c
lea rcx, str.md___NULL
mov r8d, 0xd0
call fcn.00410ae0
xor eax, eax
mov dword [rbx + 0x280], 0x6a09e667
mov dword [rbx + 0x284], 0xbb67ae85
mov dword [rbx + 0x288], 0x3c6ef372
mov dword [rbx + 0x28c], 0xa54ff53a
mov dword [rbx + 0x290], 0x510e527f
mov dword [rbx + 0x2a0], eax
mov qword [rbx + 0x278], rax
mov dword [rbx + 0x294], 0x9b05688c
mov dword [rbx + 0x298], 0x1f83d9ab
mov dword [rbx + 0x29c], 0x5be0cd19
add rsp, 0x20
pop rbx
ret

Function at 0x40e8a0
Capabilities:
Hash data using sha224

Disassembly:
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
jne 0x40e8c5
lea r8d, [rcx + 0x2a]
lea rdx, str.c:users_simplehelpworkspace_runner_nativelibtomlibtomcrypt_srchashes_sha2_sha224.c
lea rcx, str.md___NULL
call fcn.00410ae0
xor eax, eax
mov dword [rbx + 0x280], 0xc1059ed8
mov dword [rbx + 0x284], 0x367cd507
mov dword [rbx + 0x288], 0x3070dd17
mov dword [rbx + 0x28c], 0xf70e5939
mov dword [rbx + 0x290], 0xffc00b31
mov dword [rbx + 0x2a0], eax
mov qword [rbx + 0x278], rax
mov dword [rbx + 0x294], 0x68581511
mov dword [rbx + 0x298], 0x64f98fa7
mov dword [rbx + 0x29c], 0xbefa4fa4
add rsp, 0x20
pop rbx
ret
Function at 0x411f60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov eax, dword [rcx + 0xc8]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rsi
test eax, eax
mov qword [rsp + 0x48], rdi
mov rsi, rdx
mov rdi, r8
mov rbx, rcx
js 0x4120de
cdq
and edx, 7
add eax, edx
and eax, 7
cmp eax, edx
jne 0x4120de
cmp r8, 8
mov qword [rsp + 0x38], rbp
jb 0x412001
xor ebp, ebp
nop
nop
mov eax, dword [rbx + 0xc8]
test eax, eax
je 0x412001
cdq
add rsi, 1
and edx, 7
add eax, edx
sar eax, 3
movsxd rcx, eax
movzx eax, byte [rsi - 1]
xor byte [rcx + rbx], al
add dword [rbx + 0xc8], 8
cmp dword [rbx + 0xc8], 0x440
jne 0x411ff7
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.00411bc0
mov dword [rbx + 0xc8], ebp
sub rdi, 8
cmp rdi, 8
jae 0x411fb0
cmp rdi, 0x440
jb 0x41204e
movabs rax, 0xf0f0f0f0f0f0f0f1
mul rdi
mov rbp, rdx
shr rbp, 0xa
mov rax, rbp
imul rax, rax, 0xfffffffffffffbc0
add rdi, rax
nop
nop
mov r8d, 0x11
mov rdx, rsi
mov rcx, rbx
call fcn.00411bc0
add rsi, 0x88
sub rbp, 1
jne 0x412030
cmp rdi, 8
mov rbp, qword [rsp + 0x38]
jb 0x41209a
mov r8, rdi
shr r8, 3
mov rax, r8
imul rax, rax, 0xfffffffffffffff8
add rdi, rax
nop
nop
mov eax, dword [rbx + 0xc8]
add rsi, 1
cdq
and edx, 7
add eax, edx
sar eax, 3
movsxd rcx, eax
movzx eax, byte [rsi - 1]
xor byte [rcx + rbx], al
add dword [rbx + 0xc8], 8
sub r8, 1
jne 0x412070
test rdi, rdi
je 0x4120c8
mov eax, dword [rbx + 0xc8]
mov ecx, 8
cdq
sub cl, dil
and edx, 7
add eax, edx
movzx edx, byte [rsi]
sar eax, 3
shr dl, cl
movsxd r8, eax
xor byte [r8 + rbx], dl
add dword [rbx + 0xc8], edi
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov eax, 1
add rsp, 0x28
ret

Function at 0x418350
Capabilities:
Move file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x418379
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x418379
mov ecx, eax
call fcn.004176f0
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x41d210
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x41d239
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41d239
mov ecx, eax
call fcn.004176f0
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x41d800
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x30
test rcx, rcx
mov ebx, edx
jne 0x41d846
call fcn.004176c0
mov dword [rax], 0
call fcn.00417690
mov ebx, 0x16
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rax], ebx
mov qword [rsp + 0x20], 0
call fcn.0041f940
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
test edx, 0xfffffff9
jne 0x41d80d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41d877
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.004176f0
call fcn.00417690
mov ebx, dword [rax]
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
test al, 0x10
jne 0x41d8ab
test al, 1
je 0x41d8ab
test bl, 2
je 0x41d8ab
call fcn.004176c0
mov dword [rax], 5
call fcn.00417690
mov dword [rax], 0xd
call fcn.00417690
mov ebx, dword [rax]
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
neg ebx
sbb eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x41d8c0
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41d8eb
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41d8eb
mov ecx, eax
call fcn.004176f0
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x41d900
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x41d929
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x41d929
mov ecx, eax
call fcn.004176f0
mov eax, 0xffffffff
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x42a047
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x004586e8]
jne 0x41e09a
rol rcx, 0x10
test cx, 0xffff
jne 0x41e096
repz ret
ror rcx, 0x10
jmp 0x429fa0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x0045c700]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x0045c7f8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x42a025
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x0045c700]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x42a047
mov rax, qword [rsp + 0x88]
mov qword [0x0045c7f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x0045c798], rax
mov rax, qword [0x0045c7f8]
mov qword [0x0045c670], rax
mov rax, qword [rsp + 0x90]
mov qword [0x0045c780], rax
mov dword [0x0045c660], 0xc0000409
mov dword [0x0045c664], 1
mov rax, qword [0x004586e8]
mov qword [rsp + 0x68], rax
mov rax, qword [0x004586f0]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x0045c6f8], eax
mov ecx, 1
call fcn.0042a820
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x0044ab10]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x0045c6f8], 0
jne 0x42a0ce
mov ecx, 1
call fcn.0042a820
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x42a0f0
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
mov edi, r8d
mov r12, rdx
call fcn.0041fad0
xor ebx, ebx
cmp qword [0x0045cbd0], rbx
mov rsi, rax
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
jne 0x42a221
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
mov rbp, rax
jne 0x42a153
xor eax, eax
jmp 0x42a301
lea rdx, str.MessageBoxA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x42a14c
mov rcx, rax
call fcn.0041fa60
lea rdx, str.GetActiveWindow
mov rcx, rbp
mov qword [0x0045cbd0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041fa60
lea rdx, str.GetLastActivePopup
mov rcx, rbp
mov qword [0x0045cbd8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041fa60
lea rcx, [rsp + 0x30]
mov qword [0x0045cbe0], rax
call fcn.00418540
test eax, eax
je 0x42a1d7
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0041f8a0
cmp dword [rsp + 0x30], 2
jne 0x42a221
lea rdx, str.GetUserObjectInformationA
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041fa60
test rax, rax
mov qword [0x0045cbf0], rax
je 0x42a221
lea rdx, str.GetProcessWindowStation
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call fcn.0041fa60
mov qword [0x0045cbe8], rax
mov rcx, qword [0x0045cbe8]
cmp rcx, rsi
je 0x42a2b3
cmp qword [0x0045cbf0], rsi
je 0x42a2b3
call fcn.0041fb30
call rax
test rax, rax
mov rbp, rax
je 0x42a27e
mov rcx, qword [0x0045cbf0]
call fcn.0041fb30
lea rcx, [rsp + 0x38]
mov r9d, 0xc
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
lea r8, [rsp + 0x40]
mov rcx, rbp
call rax
test eax, eax
je 0x42a27e
test byte [rsp + 0x48], 1
jne 0x42a2b3
lea rcx, [rsp + 0x34]
call fcn.00418590
test eax, eax
je 0x42a2a0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rbx
call fcn.0041f8a0
cmp dword [rsp + 0x34], 4
jb 0x42a2ad
bts edi, 0x15
jmp 0x42a2e7
bts edi, 0x12
jmp 0x42a2e7
mov rcx, qword [0x0045cbd8]
cmp rcx, rsi
je 0x42a2e7
call fcn.0041fb30
call rax
test rax, rax
mov rbx, rax
je 0x42a2e7
mov rcx, qword [0x0045cbe0]
cmp rcx, rsi
je 0x42a2e7
call fcn.0041fb30
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x0045cbd0]
call fcn.0041fb30
mov r9d, edi
mov r8, r12
mov rdx, r13
mov rcx, rbx
call rax
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x440480
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
lea rsi, [0x00446140]
mov rbx, rdx
mov r11, rcx
not r8d
cmp rdx, 8
jbe 0x440586
mov qword [rsp + 0x10], rdi
test cl, 7
je 0x4404d4
nop word [rax + rax]
movzx eax, byte [r11]
dec rbx
movzx ecx, r8b
inc r11
xor rcx, rax
mov eax, r8d
shr eax, 8
mov r8d, dword [rsi + rcx*4]
xor r8d, eax
test r11b, 7
jne 0x4404b0
mov rdi, rbx
and ebx, 7
and rdi, 0xfffffffffffffff8
add rdi, r11
cmp r11, rdi
jae 0x440581
nop word [rax + rax]
xor r8d, dword [r11]
mov r10d, dword [r11 + 4]
add r11, 8
mov r9d, r8d
mov eax, r8d
shr rax, 0x10
movzx edx, al
mov eax, r8d
shr rax, 8
movzx ecx, al
mov eax, r10d
mov r8d, dword [rsi + rdx*4 + 0x1400]
shr rax, 0x10
xor r8d, dword [rsi + rcx*4 + 0x1800]
movzx ecx, al
mov eax, r10d
shr rax, 8
xor r8d, dword [rsi + rcx*4 + 0x400]
movzx ecx, al
mov eax, r9d
shr rax, 0x18
xor r8d, dword [rsi + rcx*4 + 0x800]
xor r8d, dword [rsi + rax*4 + 0x1000]
mov eax, r10d
shr rax, 0x18
xor r8d, dword [rsi + rax*4]
movzx eax, r9b
xor r8d, dword [rsi + rax*4 + 0x1c00]
movzx eax, r10b
xor r8d, dword [rsi + rax*4 + 0xc00]
cmp r11, rdi
jb 0x4404f0
mov rdi, qword [rsp + 0x10]
test rbx, rbx
je 0x4405b2
nop dword [rax + rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
movzx ecx, r8b
xor rcx, rax
mov eax, r8d
shr eax, 8
mov r8d, dword [rsi + rcx*4]
xor r8d, eax
sub rbx, 1
jne 0x440590
mov rbx, qword [rsp + 0x18]
not r8d
mov eax, r8d
pop rsi
ret

Function at 0x4405c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
lea r14, [0x00448140]
mov rbx, rdx
mov r11, rcx
not r8
cmp rdx, 4
jbe 0x4406a7
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
test cl, 3
je 0x440615
movzx eax, byte [r11]
dec rbx
movzx ecx, r8b
inc r11
xor rcx, rax
mov rax, r8
shr rax, 8
mov r8, qword [r14 + rcx*8]
xor r8, rax
test r11b, 3
jne 0x4405f0
xor esi, esi
mov rcx, rbx
and rcx, 0xfffffffffffffffc
and ebx, 3
lea rdi, [rcx + 3]
shr rdi, 2
lea rax, [rcx + r11]
cmp r11, rax
cmova rdi, rsi
test rdi, rdi
je 0x44069d
nop dword [rax]
mov r10d, dword [r11]
inc rsi
mov eax, r8d
add r11, 4
xor r10, rax
mov rax, r10
shr rax, 0x10
movzx edx, al
mov rax, r10
shr rax, 8
movzx ecx, al
mov rax, r10
shr rax, 0x18
mov r9, qword [r14 + rdx*8 + 0x800]
xor r9, qword [r14 + rcx*8 + 0x1000]
xor r9, qword [r14 + rax*8]
movzx eax, r10b
xor r9, qword [r14 + rax*8 + 0x1800]
mov rax, r8
shr rax, 0x20
mov r8, r9
xor r8, rax
cmp rsi, rdi
jb 0x440640
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
test rbx, rbx
je 0x4406d3
nop dword [rax]
movzx eax, byte [r11]
lea r11, [r11 + 1]
movzx ecx, r8b
xor rcx, rax
mov rax, r8
shr rax, 8
mov r8, qword [r14 + rcx*8]
xor r8, rax
sub rbx, 1
jne 0x4406b0
mov rbx, qword [rsp + 0x20]
not r8
mov rax, r8
pop r14
ret
Function at 0x1400111ea
Capabilities:
Terminate process

Disassembly:
jmp 0x140015160
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x140011267
Capabilities:
Parse pe header

Disassembly:
jmp 0x140012c90
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140012cb0
xor al, al
jmp 0x140012d31
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140012cc3
xor al, al
jmp 0x140012d31
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140012ced
xor al, al
jmp 0x140012d31
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140012d01
xor al, al
jmp 0x140012d31
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140012d13
xor al, al
jmp 0x140012d31
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140012d2f
xor al, al
jmp 0x140012d31
mov al, 1
add rsp, 0x38
ret

Function at 0x140011a90
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011384
movzx eax, al
test eax, eax
jne 0x140011ab0
mov ecx, 7
call fcn.140011302
nop
mov byte [rsp + 0x20], 0
call fcn.140011316
mov byte [rsp + 0x21], al
cmp dword [0x14001c220], 1
jne 0x140011ad4
mov ecx, 7
call fcn.140011302
nop
jmp 0x140011b2c
cmp dword [0x14001c220], 0
jne 0x140011b27
mov dword [0x14001c220], 1
lea rdx, [0x140019660]
lea rcx, [0x140019330]
call fcn.140011190
test eax, eax
je 0x140011b08
mov eax, 0xff
jmp 0x140011c31
lea rdx, [0x140019220]
lea rcx, [section..rdata]
call fcn.14001130c
mov dword [0x14001c220], 2
jmp 0x140011b2c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400112f3
call fcn.14001128a
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140011b89
mov rcx, qword [rsp + 0x30]
call fcn.14001114f
movzx eax, al
test eax, eax
je 0x140011b89
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140022020]
nop
call fcn.1400112bc
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x140011bbd
mov rcx, qword [rsp + 0x38]
call fcn.14001114f
movzx eax, al
test eax, eax
je 0x140011bbd
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011343
nop
call fcn.140011ce0
mov dword [rsp + 0x28], eax
call fcn.140011267
movzx eax, al
test eax, eax
jne 0x140011bdc
mov ecx, dword [rsp + 0x28]
call fcn.140011055
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x140011beb
call fcn.14001134d
nop
xor edx, edx
mov cl, 1
call fcn.140011140
mov eax, dword [rsp + 0x28]
jmp 0x140011c31
add rsp, 0x68
ret
Function at 0x140f54660
Capabilities:
Encode data using xor

Disassembly:
jmp 0x140f5466a
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x140f54693
pop rbp
sub rbp, 0x33
sub rbp, 0xf54660
sub rsp, 0x20
jmp 0x140f546b2
mov rax, 0xf54660
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0xba7dac4
xor byte [rax], dl
inc rax
dec rcx
jne 0x140f546d1
jmp 0x140f546e8
mov word [rbp + 0x2d], cs
clc
invalid
Function at 0x140013eb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rdx, qword [0x140124508]
movsxd rbx, ecx
test rdx, rdx
jne 0x140013f2e
xor ecx, ecx
mov edx, 0x12000
mov r8d, 0x1000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x140124508], rax
mov rdx, rax
test rax, rax
jne 0x140013f2e
movdqa xmm0, xmmword [0x1400bc650]
movdqu xmmword [rsp + 0x20], xmm0
nop dword [rax]
movsxd rcx, eax
lea rdx, [rsp + 0x20]
add rdx, rcx
lea ecx, [rax - 0x22]
inc eax
xor byte [rdx], cl
cmp eax, 0xf
jb 0x140013f00
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x2f], 0
call fcn.14006f940
xor eax, eax
add rsp, 0x30
pop rbx
ret
lea rcx, [rbx + rbx*8]
lea rax, [rdx + rcx*8]
add rsp, 0x30
pop rbx
ret

Function at 0x140014560
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, qword [0x140124508]
test rbx, rbx
jne 0x1400145d5
mov edx, 0x12000
lea r9d, [rbx + 4]
xor ecx, ecx
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [0x140124508], rax
mov rbx, rax
test rax, rax
jne 0x1400145d5
movdqa xmm0, xmmword [0x1400bc650]
mov edx, ebx
movdqu xmmword [rsp + 0x20], xmm0
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rsp + 0x20]
add rcx, rax
lea eax, [rdx - 0x22]
inc edx
xor byte [rcx], al
cmp edx, 0xf
jb 0x1400145b0
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x2f], bl
call fcn.14006f940
xor edx, edx
mov r8d, 0x12000
mov rcx, rbx
add rsp, 0x30
pop rbx
jmp fcn.14007b990
Function at 0x14001b5c0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14001b61d
lea rbx, [0x1400ba1a0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14001b604
cmp r10, 2
jb 0x14001b604
cmp byte [r9], r8b
jne 0x14001b604
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14001b5e0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14001b65f
lea rbx, [0x1400ba1a0]
cmp r8b, 0x23
jne 0x14001b643
cmp byte [r9], r8b
jne 0x14001b643
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14001b630
mov rbx, qword [rsp + 8]
not eax
ret