joyce8/EMBER2024-capa huggingface dataset:
Function at 0x442d60
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x442eca
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x442d78
cmp edx, ecx
jne 0x442eb8
nop dword [rax]
test rsi, rsi
jne 0x442eb8
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x442dd4
nop
call fcn.00461140
xorps xmm15, xmm15
mov r14, qword [0x005b1be8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00442c60
mov rcx, qword [0x0055ec88]
mov rdx, qword [0x0055ec80]
mov rbx, qword [rsp + 0x28]
mov esi, dword [rbx]
mov edi, esi
sar esi, 0x1f
shr esi, 0x1b
add esi, edi
mov r8d, esi
and esi, 0xffffffe0
sub edi, esi
test edi, edi
jl 0x442eb3
cmp edi, 0x20
sbb esi, esi
sar r8d, 5
mov rax, rcx
mov ecx, edi
mov r9d, 1
shl r9d, cl
and r9d, esi
movsxd rsi, r8d
cmp rax, rsi
jbe 0x442ea8
lea rcx, [rdx + rsi*4]
lock or dword [rcx], r9d
mov rcx, qword [0x0055f710]
mov qword [rbx + 8], rcx
nop
mov rcx, rbx
mov qword [0x0055f710], rbx
nop
mov edx, 1
lea rsi, [0x0055f718]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1220]
shr rdx, 0x3d
test dl, dl
jne 0x442e97
nop
nop
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
xchg qword [rcx + 0x1220], rdx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
lea rax, [0x004bf7ac]
mov ebx, 0x28
call fcn.004345a0
mov rcx, rax
mov rax, rsi
call fcn.0045f7a0
call fcn.00432bc0
lea rax, [0x004bead6]
mov ebx, 0x23
call fcn.004345a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045d140
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00442d60
Function at 0x44dd20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44de98
movzx edx, byte [rax]
nop
test edx, edx
jne 0x44dd5c
test r8b, r8b
jne 0x44dd5c
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
bt edx, 7
jae 0x44dd6f
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44de58
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
cmp rbx, r8
jb 0x44de46
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rcx
sar rcx, 0x3f
and r8, rcx
lea rsi, [rax + r8]
test rbx, rbx
jbe 0x44de3c
movzx r8d, byte [rax + r8]
bt r8d, 7
jae 0x44ddc3
xor eax, eax
xor ecx, ecx
xor r8d, r8d
jmp 0x44de06
mov eax, 1
cmp rax, rbx
ja 0x44ddf5
add qword [rdi], r8
sub rdx, rax
sub rbx, rax
mov rcx, rdx
neg rdx
sar rdx, 0x3f
and rax, rdx
add rax, rsi
mov edi, 1
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov rcx, rbx
call fcn.0045f860
lea r8d, [rcx + 7]
mov ecx, eax
mov eax, r10d
cmp rax, rbx
jae 0x44de34
movzx r9d, byte [rax + rsi]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov eax, ecx
mov ecx, r8d
shl r9d, cl
or eax, r9d
test r11b, 0x80
jne 0x44ddfd
mov r8d, eax
mov eax, r10d
jmp 0x44ddc8
mov rcx, rbx
call fcn.0045f7a0
xor eax, eax
mov rcx, rax
call fcn.0045f7a0
mov eax, r8d
mov rcx, rbx
call fcn.0045f860
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44de8e
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x44de51
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44dd75
mov eax, edx
mov rcx, rbx
call fcn.0045f7a0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.0045f7a0
nop
int3
Function at 0x455560
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x455619
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x00455660]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045d000
xorps xmm15, xmm15
mov r14, qword [0x005b1be8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045d140
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00455560
Function at 0x45f1e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x402fef
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409880
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045d140
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x402fc0
cmp byte [0x005b1a11], 0
je 0x45f1f5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45c240
jmp 0x402fc0

Function at 0x45f200
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005b1ce0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005b1a11], 0
je 0x45f235
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005b2020]
aesenc xmm0, xmmword [0x005b2030]
aesenc xmm0, xmmword [0x005b2040]
movq rax, xmm0
ret
jmp 0x409a80

Function at 0x45f240
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x005b1ce0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x005b1a11], 0
je 0x45f276
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005b2020]
aesenc xmm0, xmmword [0x005b2030]
aesenc xmm0, xmmword [0x005b2040]
movq rax, xmm0
ret
jmp 0x409ae0

Function at 0x460c60
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x005b1fa0]
mov qword [rsp + 8], rdx
lea r8d, [0x005b1a28]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.0045f120
add rsp, 0x30
ret

Function at 0x4611a0
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4611cc
call fcn.0045f120
shl rcx, 3
add rcx, 0x1480
mov qword [0x005b1be8], rcx
ret
Function at 0x46c080
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x46c0eb
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x46c0a4
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x46c0c1
cmp rdx, 0
je 0x46c10d
test rdx, 0xf
je 0x46c09d
test rdx, 7
jne 0x46c0c1
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x46c09d
ret
Function at 0x47a6a0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x47a6df
jb 0x47a6f4
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x47a760
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x47a830
jb 0x47a88f
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.0047a640
aeskeygenassist xmm1, xmm0, 1
call fcn.0047a660
aeskeygenassist xmm1, xmm2, 2
call fcn.0047a640
aeskeygenassist xmm1, xmm0, 2
call fcn.0047a660
aeskeygenassist xmm1, xmm2, 4
call fcn.0047a640
aeskeygenassist xmm1, xmm0, 4
call fcn.0047a660
aeskeygenassist xmm1, xmm2, 8
call fcn.0047a640
aeskeygenassist xmm1, xmm0, 8
call fcn.0047a660
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0047a640
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0047a660
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0047a640
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0047a660
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0047a640
jmp 0x47a8fd
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.0047a5a0
aeskeygenassist xmm1, xmm2, 2
call fcn.0047a600
aeskeygenassist xmm1, xmm2, 4
call fcn.0047a5a0
aeskeygenassist xmm1, xmm2, 8
call fcn.0047a600
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0047a5a0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0047a600
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0047a5a0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.0047a600
jmp 0x47a8fd
aeskeygenassist xmm1, xmm0, 1
call fcn.0047a560
aeskeygenassist xmm1, xmm0, 2
call fcn.0047a560
aeskeygenassist xmm1, xmm0, 4
call fcn.0047a560
aeskeygenassist xmm1, xmm0, 8
call fcn.0047a560
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0047a560
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0047a560
aeskeygenassist xmm1, xmm0, 0x40
call fcn.0047a560
aeskeygenassist xmm1, xmm0, 0x80
call fcn.0047a560
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.0047a560
aeskeygenassist xmm1, xmm0, 0x36
call fcn.0047a560
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x47a90a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x1800011c0
Capabilities:
Hash data using fnv

Disassembly:
movsx eax, byte [rcx]
test al, al
jne 0x1800011ca
mov eax, edx
ret
xor eax, edx
imul edx, eax, 0x1000193
inc rcx
jmp fcn.1800011c0
Function at 0x180009f50
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3f
syscall
ret

Function at 0x180009f5b
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, 0x3a
syscall
ret
Function at 0x180014430
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180014460
xor eax, eax
jmp 0x180014523
mov rbp, rbx
cmp word [rax], si
je 0x180014485
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x18001446c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180014468
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180014380
movsxd r14, eax
test eax, eax
jne 0x1800144c3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180014459
mov rcx, r14
call fcn.180012970
mov rdi, rax
test rax, rax
jne 0x1800144dc
xor ecx, ecx
call fcn.1800129d0
jmp 0x1800144b8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180014380
test eax, eax
jne 0x18001450d
mov rcx, rdi
call fcn.1800129d0
jmp 0x180014517
xor ecx, ecx
call fcn.1800129d0
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1800196f0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180019718
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x180019718
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14013ba10
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
lea rbx, [rcx + 0x58]
movsd xmm6, qword [0x1402b2980]
mov rdi, rcx
movaps xmmword [rsp + 0x30], xmm7
mov esi, 4
movsd xmm7, qword [0x1402b29f0]
movaps xmmword [rsp + 0x20], xmm8
xorps xmm8, xmm8
nop
movsd xmm1, qword [rdi + 8]
mulsd xmm1, qword [rbx]
movsd xmm0, qword [rbx - 0x20]
mulsd xmm0, qword [rdi]
addsd xmm0, xmm8
addsd xmm0, xmm1
xorps xmm0, xmm7
call fcn.140175cf0
addsd xmm0, xmm6
movaps xmm1, xmm6
divsd xmm1, xmm0
movsd qword [rbx - 0x48], xmm1
add rbx, 8
sub rsi, 1
jne 0x14013ba50
movsd xmm1, qword [rdi + 0x80]
mulsd xmm1, qword [rdi + 0x18]
movsd xmm2, qword [rdi + 0x88]
mulsd xmm2, qword [rdi + 0x20]
movsd xmm0, qword [rdi + 0x78]
mulsd xmm0, qword [rdi + 0x10]
addsd xmm0, xmm8
addsd xmm0, xmm1
movsd xmm1, qword [rdi + 0x90]
mulsd xmm1, qword [rdi + 0x28]
addsd xmm0, xmm2
addsd xmm0, xmm1
xorps xmm0, xmm7
call fcn.140175cf0
mov rbx, qword [rsp + 0x60]
addsd xmm0, xmm6
mov rsi, qword [rsp + 0x68]
movaps xmm7, xmmword [rsp + 0x30]
movaps xmm8, xmmword [rsp + 0x20]
divsd xmm6, xmm0
movsd qword [rdi + 0x30], xmm6
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop rdi
ret
Function at 0x14013dad0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x1402ba010]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
xor esi, esi
call fcn.14013bb10
call fcn.14013ab00
xor edx, edx
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14013db3a
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x14013db3e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14013db8f
call fcn.14013bb10
call fcn.14013ab00
nop dword [rax + rax]
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x14013db76
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14013db50
jmp 0x14013db7a
mov esi, dword [rsp + 0x28]
call fcn.14013bb10
call fcn.14013ab00
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14013f360
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14013dbc0
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1402ba010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x14013dcc2
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.14014f740
xor r9d, r9d
mov eax, 0xa3b69df1
test rdi, rdi
je 0x14013dc4a
movzx r8d, byte [r9 + rsi]
mov edx, eax
movzx ecx, r9b
shl eax, 8
and cl, 3
or eax, r8d
shl cl, 3
shr edx, cl
xor dl, r8b
mov byte [r9 + rsi], dl
inc r9
cmp r9, rdi
jb 0x14013dc22
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov rcx, rbp
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, edi
mov rdx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14013f360
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x14013dd90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x1402ba010]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor esi, esi
movsxd r15, r9d
mov ebp, esi
mov r14d, esi
mov rdi, r8
mov rbx, rcx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], sil
jne 0x14013ddd0
test rax, rax
je 0x14013de1e
mov rcx, rsi
movsxd rax, r14d
lea r8, [rsp + 0x20]
add r8, rax
lea rdx, str._2hhx
add rcx, rbx
call fcn.14013bf40
add ebp, 2
mov rax, 0xffffffffffffffff
inc r14d
movsxd rcx, ebp
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], sil
jne 0x14013de10
cmp rcx, rax
jb 0x14013dde1
lea rbp, [0x1402b2910]
test r15d, r15d
jle 0x14013df4f
cmp r15d, 8
jb 0x14013df4f
lea rcx, [r15 - 1]
lea rax, [rsp + 0x20]
add rax, rcx
lea rdx, [rcx + rdi]
cmp rdi, rax
ja 0x14013de5b
lea rax, [rsp + 0x20]
cmp rdx, rax
jae 0x14013df4f
lea rax, [rcx + rbp]
cmp rdi, rax
ja 0x14013de6d
cmp rdx, rbp
jae 0x14013df4f
cmp r15d, 0x40
jb 0x14013df1f
mov eax, r15d
and eax, 0xffffffc0
mov rdx, rbp
movsxd rbx, eax
lea r8, [rsp + 0x20]
sub rdx, rdi
lea r9, [0x1402b2920]
sub r8, rdi
lea r10, [rsp + 0x30]
sub r9, rdi
sub r10, rdi
lea rcx, [rdi + 0x20]
mov r11, 0xffffffffffffffe0
sub r11, rdi
nop
movdqu xmm0, xmmword [rdx + rcx - 0x20]
add esi, 0x40
movdqu xmm1, xmmword [r8 + rcx - 0x20]
movdqu xmm2, xmmword [r10 + rcx - 0x20]
lea rcx, [rcx + 0x40]
xorps xmm1, xmm0
lea rax, [r11 + rcx]
movdqu xmm0, xmmword [r9 + rcx - 0x60]
movdqu xmmword [rcx - 0x60], xmm1
xorps xmm2, xmm0
movdqu xmm0, xmmword [rdx + rcx - 0x40]
movdqu xmm1, xmmword [r8 + rcx - 0x40]
movdqu xmmword [rcx - 0x50], xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [r9 + rcx - 0x40]
movdqu xmm2, xmmword [r10 + rcx - 0x40]
movdqu xmmword [rcx - 0x40], xmm1
xorps xmm2, xmm0
movdqu xmmword [rcx - 0x30], xmm2
cmp rax, rbx
jl 0x14013deb0
mov eax, r15d
and al, 0x3f
cmp al, 8
jb 0x14013df4f
mov eax, r15d
and eax, 0xfffffff8
movsxd rcx, esi
movsxd rdx, eax
nop dword [rax + rax]
movq xmm1, qword [rcx + rbp]
add esi, 8
movq xmm0, qword [rsp + rcx + 0x20]
xorps xmm1, xmm0
movq qword [rcx + rdi], xmm1
add rcx, 8
cmp rcx, rdx
jl 0x14013df30
movsxd rcx, esi
cmp rcx, r15
jge 0x14013df73
nop word [rax + rax]
movzx eax, byte [rcx + rbp]
xor al, byte [rsp + rcx + 0x20]
mov byte [rcx + rdi], al
inc rcx
cmp rcx, r15
jl 0x14013df60
mov byte [r15 + rdi], 0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14013f360
mov rbx, qword [rsp + 0xd8]
add rsp, 0xa0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14013ffc4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14014000e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14014000e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14014000e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14014000e
cmp dword [rcx + 0x84], 0xe
jbe 0x14014000e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140140010
xor al, al
add rsp, 0x28
ret

Function at 0x1401419b0
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x1401419de
xor eax, eax
jmp 0x140141ac4
cmp qword [rcx + 0x68], 0
je 0x1401419ef
call fcn.140141ae0
jmp 0x140141ac4
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140141a06
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140141a08
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140141a3a
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.14014f740
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x140141abe
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x140141a71
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x140141a9a
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.140160238
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x140141abe
cmp rsi, rbx
ja 0x140141a78
test rsi, rsi
je 0x140141abe
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.140160238
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x140145e10
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [rbx + 4], eax
cmp eax, 0xffffffff
jne 0x140145e40
lea rdx, [0x140192d90]
mov ecx, 0x10008
call fcn.14014a6e0
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov dword [rbx], 1
mov eax, 1
add rsp, 0x20
pop rbx
ret