joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001cb9c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
mov rax, qword [0x1400871c0]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x24], 0
mov byte [rsp + 0x78], 0x4f
mov byte [rsp + 0x79], 0x70
mov byte [rsp + 0x7a], 0x65
mov byte [rsp + 0x7b], 0x6e
mov byte [rsp + 0x7c], 0x50
mov byte [rsp + 0x7d], 0x72
mov byte [rsp + 0x7e], 0x6f
mov byte [rsp + 0x7f], 0x63
mov byte [rsp + 0x80], 0x65
mov byte [rsp + 0x81], 0x73
mov byte [rsp + 0x82], 0x73
mov byte [rsp + 0x83], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov r8d, dword [rsp + 0xb8]
mov edx, dword [rsp + 0xb0]
mov ecx, dword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0x38]
call fcn.140002540
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x40]
mov rdx, rax
mov rcx, qword [rsp + 0x48]
call fcn.14001c3d8
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
mov ecx, 8
call fcn.1400436f0
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x14001ccb0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
jmp 0x14001ccb9
mov qword [rsp + 0x30], 0
mov r8b, byte [rsp + 0x20]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0xa0]
call fcn.14001bd6c
mov eax, dword [rsp + 0x24]
or eax, 1
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140043850
add rsp, 0x90
pop rdi
ret

Function at 0x14001ccfc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [0x1400871c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov byte [rsp + 0x58], 0x53
mov byte [rsp + 0x59], 0x65
mov byte [rsp + 0x5a], 0x74
mov byte [rsp + 0x5b], 0x49
mov byte [rsp + 0x5c], 0x6e
mov byte [rsp + 0x5d], 0x66
mov byte [rsp + 0x5e], 0x6f
mov byte [rsp + 0x5f], 0x72
mov byte [rsp + 0x60], 0x6d
mov byte [rsp + 0x61], 0x61
mov byte [rsp + 0x62], 0x74
mov byte [rsp + 0x63], 0x69
mov byte [rsp + 0x64], 0x6f
mov byte [rsp + 0x65], 0x6e
mov byte [rsp + 0x66], 0x4a
mov byte [rsp + 0x67], 0x6f
mov byte [rsp + 0x68], 0x62
mov byte [rsp + 0x69], 0x4f
mov byte [rsp + 0x6a], 0x62
mov byte [rsp + 0x6b], 0x6a
mov byte [rsp + 0x6c], 0x65
mov byte [rsp + 0x6d], 0x63
mov byte [rsp + 0x6e], 0x74
mov byte [rsp + 0x6f], 0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov r9d, dword [rsp + 0xa8]
mov r8, qword [rsp + 0xa0]
mov edx, dword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
call fcn.140002540
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x20]
mov edx, eax
mov rcx, qword [rsp + 0x30]
call fcn.14001c320
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140043850
add rsp, 0x88
ret
Function at 0x14001ce0c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xe8
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x1400871c0]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov byte [rsp + 0xc0], 0x56
mov byte [rsp + 0xc1], 0x69
mov byte [rsp + 0xc2], 0x72
mov byte [rsp + 0xc3], 0x74
mov byte [rsp + 0xc4], 0x75
mov byte [rsp + 0xc5], 0x61
mov byte [rsp + 0xc6], 0x6c
mov byte [rsp + 0xc7], 0x41
mov byte [rsp + 0xc8], 0x6c
mov byte [rsp + 0xc9], 0x6c
mov byte [rsp + 0xca], 0x6f
mov byte [rsp + 0xcb], 0x63
mov byte [rsp + 0xcc], 0x45
mov byte [rsp + 0xcd], 0x78
mov byte [rsp + 0xce], 0
mov eax, dword [rsp + 0x108]
mov dword [rsp + 0x20], eax
mov r9d, dword [rsp + 0x100]
mov r8, qword [rsp + 0xf8]
xor edx, edx
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
jne 0x14001cf7b
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsp + 0x40]
call fcn.140002540
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x30]
mov r8d, eax
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x80]
call fcn.140017450
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x68]
call fcn.140002824
lea rdx, [0x140084fe8]
lea rcx, [rsp + 0x68]
call fcn.1400452d8
nop
lea rcx, [rsp + 0x80]
call fcn.14000289c
nop
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.140043850
add rsp, 0xe8
ret
Function at 0x14001e2e0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400871c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r12, rcx
xor r15d, r15d
cmp qword [rcx + 0x68], r15
je 0x14001e465
cmp byte [rcx + 0x71], r15b
je 0x14001e465
mov rax, qword [rcx]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call fcn.140044494
or edx, 0xffffffff
mov rcx, r12
call rbx
cmp eax, 0xffffffff
jne 0x14001e352
xor al, al
jmp 0x14001e467
mov edx, 0xf
mov qword [rbp - 0x18], rdx
xor ecx, ecx
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x20], 8
lea rax, [rbp - 0x30]
cmp rdx, 0x10
cmovae rax, rcx
mov byte [rax + 8], r15b
mov r8, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x18]
lea r9, [rbp - 0x30]
cmp rdx, 0x10
cmovae r9, r8
lea r14, [rbp - 0x30]
cmovae r14, r8
mov rsi, qword [r12 + 0x68]
mov rdx, qword [rsi]
mov rbx, qword [rbp - 0x20]
add rbx, r9
mov rdi, qword [rdx + 0x40]
mov rcx, rdi
call fcn.140044494
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov r8, r14
lea rdx, [r12 + 0x74]
mov rcx, rsi
call rdi
mov ecx, eax
test eax, eax
je 0x14001e3d6
sub ecx, 1
jne 0x14001e44a
jmp 0x14001e3db
mov byte [r12 + 0x71], r15b
lea rax, [rbp - 0x30]
mov r8, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
cmovae rax, r8
mov rbx, qword [rbp - 0x40]
sub rbx, rax
je 0x14001e426
lea rcx, [rbp - 0x30]
cmp rdx, 0x10
cmovae rcx, r8
mov r9, qword [r12 + 0x80]
mov r8, rbx
mov edx, 1
call fcn.14004dd08
cmp rbx, rax
jne 0x14001e452
mov rdx, qword [rbp - 0x18]
mov r8, qword [rbp - 0x30]
cmp byte [r12 + 0x71], r15b
je 0x14001e44f
test rbx, rbx
jne 0x14001e381
xor r8d, r8d
lea edx, [rbx + 8]
lea rcx, [rbp - 0x30]
call fcn.14000d3b4
jmp 0x14001e379
cmp ecx, 2
jne 0x14001e452
mov r15b, 1
xor r8d, r8d
mov dl, 1
lea rcx, [rbp - 0x30]
call fcn.1400041ac
mov al, r15b
jmp 0x14001e467
mov al, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140043850
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400415e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
mov ebp, 0x7ff
movzx ecx, word [rcx + 6]
mov esi, edx
shr cx, 4
and cx, bp
cmp cx, bp
jne 0x140041644
test byte [rbx + 6], 0xf
jne 0x140041635
xor edi, edi
cmp word [rbx + 4], di
jne 0x140041635
cmp word [rbx + 2], di
jne 0x140041635
cmp word [rbx], di
jne 0x140041635
lea r10d, [rdi + 1]
jmp 0x14004163b
mov r10d, 2
movzx eax, r10w
jmp 0x14004184f
xor edi, edi
test cx, cx
jne 0x14004165f
mov rcx, rbx
call fcn.140043380
movzx ecx, ax
cmp di, ax
jl 0x14004184c
test esi, esi
jle 0x140041694
movsx eax, cx
sub ebp, eax
cmp ebp, esi
jg 0x140041694
movsd xmm0, qword [0x140087100]
mov ebp, 0x8000
test word [rbx + 6], bp
je 0x140041686
xorps xmm0, xmmword [0x14006cdf0]
movsd qword [rbx], xmm0
mov eax, 1
jmp 0x14004184f
movsx edx, cx
mov eax, edx
neg eax
cmp eax, esi
jge 0x1400416bb
add si, cx
mov eax, 0x800f
and word [rbx + 6], ax
shl si, 4
or word [rbx + 6], si
or eax, 0xffffffff
jmp 0x14004184f
movzx ecx, word [rbx + 6]
lea r11d, [rsi - 1]
movzx r14d, cx
add r11d, edx
and cx, 0xf
mov ebp, 0x8000
mov r15d, 0x10
and r14w, bp
or cx, r15w
lea eax, [r11 + 0x35]
mov word [rbx + 6], cx
cmp eax, 0x34
ja 0x140041841
lea r10d, [r15 - 0xf]
movzx esi, di
cmp r11w, 0xfff0
jg 0x140041759
movzx edx, word [rbx + 2]
mov eax, 0xfff0
sub ax, r11w
movzx r9d, cx
movzx ecx, word [rbx + 4]
shr ax, 4
add ax, r10w
movzx r8d, ax
movzx eax, r8w
shl ax, 4
add r11w, ax
test si, si
mov eax, edi
setne al
movzx esi, ax
or si, word [rbx]
mov word [rbx], dx
movzx edx, cx
movzx ecx, r9w
mov r9d, edi
sub r8, r10
jne 0x14004172d
mov word [rbx + 6], di
mov word [rbx + 4], cx
mov word [rbx + 2], dx
neg r11w
je 0x1400417e3
movzx r8d, word [rbx]
mov eax, edi
movzx edx, r8w
movsx r9d, r11w
sub r15d, r9d
mov ecx, r15d
shl dx, cl
test si, si
movzx esi, dx
movzx edx, word [rbx + 2]
setne al
or si, ax
movzx eax, dx
shl ax, cl
movzx ecx, r11w
shr r8w, cl
mov ecx, r15d
or ax, r8w
movzx r8d, word [rbx + 4]
mov word [rbx], ax
movzx eax, r8w
shl ax, cl
movzx ecx, r11w
shr dx, cl
mov ecx, r15d
or ax, dx
movzx edx, word [rbx + 6]
mov word [rbx + 2], ax
movzx eax, dx
shl ax, cl
movzx ecx, r11w
shr r8w, cl
mov ecx, r9d
or ax, r8w
shr dx, cl
mov word [rbx + 6], dx
mov word [rbx + 4], ax
or word [rbx + 6], r14w
movzx eax, word [rbx + 6]
cmp bp, si
jb 0x1400417f8
jne 0x140041819
test byte [rbx], r10b
je 0x140041819
add word [rbx], r10w
jne 0x140041819
add word [rbx + 2], r10w
jne 0x140041819
add word [rbx + 4], r10w
jne 0x140041819
add ax, r10w
mov word [rbx + 6], ax
jmp 0x1400416b3
cmp ax, r14w
jne 0x1400416b3
cmp word [rbx + 4], di
jne 0x1400416b3
cmp word [rbx + 2], di
jne 0x1400416b3
cmp word [rbx], di
je 0x14004184c
jmp 0x1400416b3
mov word [rbx + 6], r14w
mov dword [rbx + 2], edi
mov word [rbx], di
movzx eax, di
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140043acc
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140043b5d
movsxd rax, dword [0x14000003c]
lea rdx, [0x140000000]
lea rcx, [rax + rdx]
cmp dword [rcx], 0x4550
jne 0x140043b5d
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140043b5d
sub r8, rdx
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
add rdx, rax
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x140043b41
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140043b3b
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140043b43
add rdx, 0x28
jmp 0x140043b20
xor edx, edx
test rdx, rdx
jne 0x140043b4c
xor al, al
jmp 0x140043b63
test dword [rdx + 0x24], 0x80000000
je 0x140043b59
xor al, al
jmp 0x140043b63
mov al, 1
jmp 0x140043b63
xor al, al
jmp 0x140043b63
add rsp, 0x18
ret

Function at 0x140048a10
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x1400487e4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400487e4
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400487e4
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400487e4
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400487e4
cmp dword [rcx + 0x84], 0xe
jbe 0x1400487e4
cmp dword [rcx + 0xf8], esi
je 0x1400487e4
mov ecx, r14d
call fcn.14004892c
mov ecx, 2
call fcn.14004c6b4
nop
cmp byte [0x14008a9c8], 0
jne 0x1400488ae
mov r15d, 1
mov eax, r15d
xchg dword [0x14008a9b8], eax
test ebx, ebx
jne 0x140048857
mov rdi, qword [0x1400871c0]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14008a9c0]
cmp rcx, rax
je 0x14004884e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.140047d70]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14008ac28]
jmp 0x140048863
cmp ebx, r15d
jne 0x140048869
lea rcx, [0x14008ac40]
call fcn.140051dd4
nop
test ebx, ebx
jne 0x140048880
lea rdx, [0x140067610]
lea rcx, [0x1400675e8]
call fcn.14005245c
lea rdx, [0x140067620]
lea rcx, [0x140067618]
call fcn.14005245c
movzx eax, byte [0x14008a9c8]
test esi, esi
cmove eax, r15d
mov byte [0x14008a9c8], al
jmp 0x1400488ae
mov ecx, 2
call fcn.14004c708
test esi, esi
jne 0x1400488c5
mov ecx, r14d
call fcn.1400488e0
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140048774
Function at 0x18003b784
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
movaps xmmword [rax - 0x18], xmm6
mov rax, qword [0x1802ac070]
xor rax, rsp
mov qword [rsp + 0x90], rax
movss xmm6, dword [0x18028c87c]
movss dword [rsp + 0x24], xmm6
mov rdx, qword [rcx]
cmp rdx, 2
jb 0x18003b966
mov ecx, 0x68
mov dword [rsp + 0x20], ecx
mov eax, dword [0x1802dece0]
cmp eax, 0x9f3
jl 0x18003b7ee
mov ecx, 0x70
jmp 0x18003b800
add eax, 0xfffff766
mov r8d, 0x40
cmp eax, 0x45
cmovbe ecx, r8d
mov dword [rsp + 0x20], ecx
movsxd rax, ecx
mov rcx, qword [rax + rdx]
test rcx, rcx
jne 0x18003b818
movaps xmm0, xmm6
jmp 0x18003b969
mov r14d, dword [rcx + 0x18]
mov rsi, qword [rcx + 0x10]
test rsi, rsi
jne 0x18003b82d
movaps xmm0, xmm6
jmp 0x18003b969
xor ebx, ebx
movabs r15, 0x6e87a39799ab08a
mov dword [rsp + 0x28], ebx
cmp ebx, r14d
jge 0x18003b95e
lea eax, [rbx*8]
movsxd rcx, eax
mov rdi, qword [rcx + rsi + 0x20]
and qword [rsp + 0x30], 0
mov qword [rsp + 0x30], rdi
test rdi, rdi
jne 0x18003b86a
jmp 0x18003b957
lea rcx, [rsp + 0x30]
call fcn.18003b540
movsd xmm0, qword [rax]
movsd qword [rsp + 0x38], xmm0
mov eax, dword [rax + 8]
mov dword [rsp + 0x40], eax
mov rax, qword [rdi]
cmp byte [rsp + 0x38], 0
je 0x18003b957
movabs rcx, 0x46b6268b69114d47
mov qword [rsp + 0x50], rcx
movabs rcx, 0x29a3335ec0055274
mov qword [rsp + 0x58], rcx
movabs rcx, 0x4dce7ed09d8d87bc
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], r15
movabs rcx, 0x2fc245ee037e3f17
mov qword [rsp + 0x70], rcx
movabs rcx, 0x47cc433fa5523718
mov qword [rsp + 0x78], rcx
movabs rcx, 0x4dce7ed09de9e8f1
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x88], r15
movdqa xmm0, xmmword [rsp + 0x50]
pxor xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [rsp + 0x60]
pxor xmm1, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x60], xmm1
lea rdx, [rsp + 0x50]
mov rcx, qword [rax + 0x10]
call fcn.180198630
test rax, rax
je 0x18003b957
movss xmm0, dword [rsp + 0x3c]
comiss xmm0, dword [0x18028c838]
jb 0x18003b95e
comiss xmm6, xmm0
jb 0x18003b95e
mulss xmm6, xmm0
movss dword [rsp + 0x24], xmm6
jmp 0x18003b95e
inc ebx
jmp 0x18003b839
jmp 0x18003b966
movaps xmm0, xmm6
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180196190
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
ret
Function at 0x18003d260
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
mov rax, qword [0x1802ac070]
xor rax, rsp
mov qword [rsp + 8], rax
mov eax, dword [0x1802dece0]
mov r10, rcx
mov qword [rsp], rcx
cmp eax, 0x9fb
jne 0x18003d2ca
mov qword [rsp], rcx
lea rdx, [rsp]
mov r8d, 2
mov eax, dword [rdx]
mov ecx, eax
shl ecx, 0x1f
lea rdx, [rdx + 4]
add ecx, 0x80000000
add eax, 0x3ea11ff
shr eax, 1
or ecx, eax
sub ecx, 0x49842854
xor ecx, 0xe6981334
mov dword [rdx - 4], ecx
sub r8d, 1
jne 0x18003d295
mov rax, qword [rsp]
jmp 0x18003d33d
cmp eax, 0x9f9
jne 0x18003d2ee
xor r9d, r9d
mov al, byte [rsp + r9]
add al, 0x6d
ror al, 1
ror al, 2
mov byte [rsp + r9], al
inc r9
cmp r9, 8
jl 0x18003d2d4
jmp 0x18003d2c4
cmp eax, 0x9f8
jne 0x18003d33b
xor r9d, r9d
mov r11d, r9d
lea ecx, [r11*8]
mov rdx, r10
shr rdx, cl
inc r11d
mov al, dl
xor al, 0x3d
shl al, 4
movzx r8d, al
movzx eax, dl
xor eax, 0x30
shr eax, 4
or r8d, eax
xor r8d, 0xd0
shl r8d, cl
or r9d, r8d
cmp r11d, 4
jl 0x18003d2fb
mov eax, r9d
jmp 0x18003d33d
xor eax, eax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.180196190
add rsp, 0x18
ret

Function at 0x1800400dc
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1802ac070]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor ebx, ebx
cmp byte [0x1802debb0], bl
je 0x18004022b
mov eax, dword [0x1802dece0]
cmp eax, 0x9fb
je 0x18004022b
cmp eax, 0x9f9
jne 0x18004014f
call fcn.18003fee8
movss xmm0, dword [rax]
movss dword [rsp + 0x28], xmm0
mov al, byte [rsp + rbx + 0x28]
lea ecx, [rax - 0x50]
shl al, 7
xor cl, 0x78
shr cl, 1
or cl, al
mov byte [rsp + rbx + 0x28], cl
inc rbx
cmp rbx, 4
jl 0x180040126
movss xmm0, dword [rsp + 0x28]
jmp 0x180040234
call fcn.18003fcf4
mov edx, dword [rax]
mov eax, dword [0x1802dece0]
mov dword [rsp + 0x20], edx
cmp eax, 0x9fb
je 0x18004021f
cmp eax, 0x9f9
jne 0x1800401a0
xorps xmm0, xmm0
cvtsi2ss xmm0, rdx
movss dword [rsp + 0x28], xmm0
mov al, byte [rsp + rbx + 0x28]
lea ecx, [rax - 0x50]
shl al, 7
xor cl, 0x78
shr cl, 1
or cl, al
mov byte [rsp + rbx + 0x28], cl
inc rbx
cmp rbx, 4
jl 0x180040180
jmp 0x180040218
cmp eax, 0x9f8
jne 0x18004021f
mov al, byte [rsp + 0x23]
mov r10b, 0x3d
mov cl, al
mov r9b, 0x30
xor cl, r10b
xor al, r9b
shl cl, 4
mov r8b, 0xd0
shr al, 4
or cl, al
mov al, byte [rsp + 0x22]
xor cl, r8b
mov byte [rsp + 0x2b], cl
mov cl, al
xor cl, r10b
xor al, r9b
shr al, 4
shl cl, 4
or cl, al
mov al, byte [rsp + 0x21]
xor cl, r8b
mov byte [rsp + 0x2a], cl
mov cl, al
xor al, r9b
xor cl, r10b
shr al, 4
shl cl, 4
or cl, al
mov al, dl
xor al, r10b
xor dl, r9b
shl al, 4
xor cl, r8b
shr dl, 4
or al, dl
mov byte [rsp + 0x29], cl
xor al, r8b
mov byte [rsp + 0x28], al
cvttss2si rbx, dword [rsp + 0x28]
mov eax, ebx
xorps xmm0, xmm0
cvtsi2ss xmm0, rax
jmp 0x180040234
call fcn.18003fee8
movss xmm0, dword [rax]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180196190
add rsp, 0x40
pop rbx
ret
Function at 0x180044690
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1802ac070]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, qword [0x1802de968]
test rax, rax
je 0x1800447c1
mov rcx, qword [rax]
test rcx, rcx
je 0x1800447c1
mov rax, qword [rcx + 0xb8]
test rax, rax
je 0x1800447c1
mov rax, qword [rax]
test rax, rax
je 0x1800447c1
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov ebx, 2
mov r8d, ebx
mov qword [rsp + 0x28], rbx
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
mov eax, dword [rdx]
add rdx, 4
mov qword [rsp + 0x20], rdx
mov ecx, eax
shl ecx, 7
add ecx, 0x13e7e780
add eax, 0x8027cfcf
shr eax, 0x19
or ecx, eax
xor ecx, 0xb13b7cb5
rol ecx, 9
mov dword [rdx - 4], ecx
cmp r8d, 1
sete cl
dec r8d
mov qword [rsp + 0x28], r8
test cl, cl
je 0x1800446fd
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov ecx, eax
call fcn.180039770
test rax, rax
je 0x1800447c1
mov rax, qword [rax + 0x10]
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rbx
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x58], rax
mov eax, dword [rdx]
add rdx, 4
mov qword [rsp + 0x30], rdx
mov ecx, eax
shl ecx, 7
add ecx, 0x13e7e780
add eax, 0x8027cfcf
shr eax, 0x19
or ecx, eax
xor ecx, 0xb13b7cb5
rol ecx, 9
mov dword [rdx - 4], ecx
cmp ebx, 1
sete cl
dec ebx
mov qword [rsp + 0x38], rbx
test cl, cl
je 0x18004476e
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x48], rax
mov ecx, eax
call fcn.180039770
test rax, rax
jne 0x1800447c5
jmp 0x1800447c3
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180196190
add rsp, 0x70
pop rbx
ret
Function at 0x180064b58
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x1802ac070]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov eax, 0x5a4d
mov r14, r9
mov rbp, r8
cmp word [rdx], ax
jne 0x180064bfd
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x180064bfd
movzx esi, word [rcx + 0x14]
xor r11d, r11d
movzx ebx, word [rcx + 6]
add rsi, rcx
test rbx, rbx
je 0x180064bfd
xor r8d, r8d
lea rcx, [rsi + 0x18]
test dword [rcx + 0x24], 0x20000
jne 0x180064bee
mov rax, qword [rcx]
mov rdi, rbp
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
sub rdi, rax
mov byte [rsp + 0x38], 0
movzx r9d, byte [rax]
movzx r10d, byte [rax + rdi]
sub r9d, r10d
jne 0x180064be9
inc rax
test r10d, r10d
jne 0x180064bd3
test r9d, r9d
je 0x180064c21
inc r11d
inc r8
add rcx, 0x28
cmp r8, rbx
jl 0x180064bb2
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180196190
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
movsxd rax, r11d
mov r9, r14
lea rcx, [rax + rax*4]
mov ebx, dword [rsi + rcx*8 + 0x24]
mov r8d, dword [rsi + rcx*8 + 0x20]
add rbx, rdx
mov rdx, rbx
call fcn.180064a60
cmp rax, 0xffffffffffffffff
je 0x180064bfd
add rax, rbx
jmp 0x180064bff
Function at 0x18007ca94
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rbx, rax
test rax, rax
je 0x18007cad2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
add eax, 0xffffff80
test eax, 0xffffff7f
je 0x18007cad2
mov edx, 0x80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18007cb48
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x18007cb48
mov esi, dword [r9 + 0x20]
dec edx
mov r11d, 0xd4758d8d
lea rcx, [rsi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x18007cb44
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x18007cb24
cmp r11d, 0xff3dde4d
je 0x18007cb4d
test edx, edx
jne 0x18007cb07
mov rax, qword [rax]
jmp 0x18007cae3
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
mov rcx, rbx
add rax, r8
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp rax