joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff6456dd330
Capabilities:
Encode data using xor
Print debug messages

Disassembly:
push rbx
sub rsp, 0x30
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
movsd xmm0, qword [0x7ff6457ad140]
xor ebx, ebx
cmp byte [0x7ff6457ad14d], bl
movzx eax, word [0x7ff6457ad14c]
mov edx, dword [0x7ff6457ad148]
movsd qword [rsp + 0x20], xmm0
mov word [rsp + 0x2c], ax
mov dword [rsp + 0x28], edx
je 0x7ff6456dd50d
cmp dword [0x7ff6457cea98], 2
mov ecx, ebx
jl 0x7ff6456dd4c9
movdqa xmm5, xmmword [0x7ff6457bbc30]
mov ecx, 0xc
movdqa xmm2, xmmword [0x7ff6457bbb00]
movdqa xmm3, xmmword [0x7ff6457bbb20]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x7ff6457bbbe0]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x7ff6457bbb60]
psubd xmm2, xmm0
movd xmm0, dword [0x7ff6457ad140]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x7ff6457bbc00]
xorps xmm2, xmm0
movd dword [rsp + 0x20], xmm2
movdqa xmm2, xmmword [0x7ff6457bbb10]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
pmulld xmm0, xmmword [0x7ff6457bbb60]
psubd xmm2, xmm0
punpckldq xmm1, xmm3
movd xmm0, dword [rsp + 0x24]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x7ff6457bbc00]
xorps xmm2, xmm0
pmuldq xmm1, xmm5
movdqa xmm0, xmm3
movd dword [rsp + 0x24], xmm2
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x7ff6457bbb60]
psubd xmm3, xmm0
movd xmm0, edx
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [0x7ff6457bbc00]
xorps xmm3, xmm0
movd dword [rsp + 0x28], xmm3
mov eax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x35
xor byte [r8 - 1], al
cmp ecx, 0xe
jl 0x7ff6456dd4e0
lea rcx, [rsp + 0x20]
call qword [sym.imp.kernel32.dll_OutputDebugStringA]
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
setne bl
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x7ff6456e0840
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
mov ecx, 0xbeef
call qword [sym.imp.kernel32.dll_CloseHandle]
jmp 0x7ff6456e085a
test ebx, ebx
je 0x7ff6456e0867
xor ecx, ecx
call qword [sym.imp.ucrtbase.dll_exit]
int3
add rsp, 0x20
pop rbx
ret

Function at 0x7ff6456e0890
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, [0x7ff6457ab270]
call qword [sym.imp.kernel32.dll_OutputDebugStringW]
jmp 0x7ff6456e08a3
add rsp, 0x28
ret
Function at 0x7ff6456e08b0
Capabilities:
Check for debugger via api
Hide thread from debugger

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x7ff6457cea40]
xor rax, rsp
mov qword [rsp + 0x48], rax
lea rcx, [0x7ff6457ab3a8]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBegin_1]
call fcn.7ff6456e0890
call fcn.7ff6456e0870
call fcn.7ff6456e0840
call fcn.7ff6456e0740
lea rcx, [0x7ff6457aaee0]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x7ff6456e092b
lea rdx, [0x7ff6457ab1e8]
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x7ff6456e092b
call qword [sym.imp.kernel32.dll_GetCurrentThread]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x11
call rbx
mov dword [rsp + 0x40], 0
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.kernel32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0x40], 0
jne 0x7ff6456e0a77
call qword [sym.imp.kernel32.dll_IsDebuggerPresent]
test eax, eax
jne 0x7ff6456e0a93
call fcn.7ff6456fa4d0
call fcn.7ff6456d8c80
call fcn.7ff6456dd330
call fcn.7ff6456dd5f0
call fcn.7ff6456e0720
call fcn.7ff6456e0220
call qword [sym.imp.kernel32.dll_IsDebuggerPresent]
test eax, eax
jne 0x7ff6456e0aaf
call fcn.7ff6456e0670
test al, al
jne 0x7ff6456e0acb
lea rcx, [0x7ff6457aaee0]
call qword [sym.imp.kernel32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, [0x7ff6457ab1e8]
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.kernel32.dll_GetCurrentThread]
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
mov edx, 0x11
call rbx
test eax, eax
jne 0x7ff6456e0ae7
call fcn.7ff6456dd530
test eax, eax
jne 0x7ff6456e0b03
call fcn.7ff6456e0310
test eax, eax
jne 0x7ff6456e0a5b
lea rcx, [rsp + 0x40]
call fcn.7ff6456d5ff0
mov rax, qword [rsp + 0x40]
movabs r8, 0x7fffffffc46535ff
mov qword [rsp + 0x40], rax
cmp rax, r8
je 0x7ff6456e0a29
mov ecx, 0xff
mov edx, 1
cmovge ecx, edx
test cl, cl
jns 0x7ff6456e0a29
add rax, 0x3b9aca00
jmp 0x7ff6456e0a33
movabs rax, 0x7fffffffffffffff
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.7ff6456efcd0
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBegin]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.7ff64578c730
add rsp, 0x50
pop rbx
ret
lea rdx, [0x7ff6457ab380]
lea rcx, [rsp + 0x20]
call fcn.7ff6456e6e10
lea rcx, [rsp + 0x20]
call fcn.7ff6456da640
int3
lea rdx, [0x7ff6457ab200]
lea rcx, [rsp + 0x20]
call fcn.7ff6456e6e10
lea rcx, [rsp + 0x20]
call fcn.7ff6456da640
int3
lea rdx, [0x7ff6457ab200]
lea rcx, [rsp + 0x20]
call fcn.7ff6456e6e10
lea rcx, [rsp + 0x20]
call fcn.7ff6456da640
int3
lea rdx, [0x7ff6457ab350]
lea rcx, [rsp + 0x20]
call fcn.7ff6456e6e10
lea rcx, [rsp + 0x20]
call fcn.7ff6456da640
int3
lea rdx, [0x7ff6457ab368]
lea rcx, [rsp + 0x20]
call fcn.7ff6456e6e10
lea rcx, [rsp + 0x20]
call fcn.7ff6456da640
int3
lea rdx, [0x7ff6457ab200]
lea rcx, [rsp + 0x20]
call fcn.7ff6456e6e10
lea rcx, [rsp + 0x20]
call fcn.7ff6456da640
int3
lea rdx, [0x7ff6457ab200]
lea rcx, [rsp + 0x20]
call fcn.7ff6456e6e10
lea rcx, [rsp + 0x20]
call fcn.7ff6456da640
int3
Function at 0x7ff6456e0b30
Capabilities:
Create thread
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x7ff6457cea40]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor ebx, ebx
mov ecx, 8
call fcn.7ff64578c9f0
lea rcx, [0x7ff6456e0b20]
mov qword [rax], rcx
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x7ff6456f3a50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbase.dll__beginthreadex]
mov qword [rbp - 0x20], rax
test rax, rax
je 0x7ff6456e0cc3
cmp dword [rbp - 0x18], ebx
je 0x7ff6456e0cb7
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x40], xmm0
lea rcx, [rbp - 0x40]
call qword [sym.imp.msvcp140.dll__Thrd_detach]
test eax, eax
jne 0x7ff6456e0cb7
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x20], xmm0
mov ecx, 8
call fcn.7ff64578c9f0
lea rcx, [0x7ff6456dd020]
mov qword [rax], rcx
mov qword [rbp - 0x40], rax
lea rcx, [rbp - 0x28]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x7ff6456f3a50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbase.dll__beginthreadex]
mov qword [rbp - 0x30], rax
test rax, rax
je 0x7ff6456e0ca8
cmp dword [rbp - 0x28], ebx
je 0x7ff6456e0c9c
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp - 0x40], xmm0
lea rcx, [rbp - 0x40]
call qword [sym.imp.msvcp140.dll__Thrd_detach]
test eax, eax
jne 0x7ff6456e0c9c
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x30], xmm0
mov eax, dword [0x7ff6457ad638]
mov dword [rbp - 0x40], eax
movzx eax, word [0x7ff6457ad63c]
mov word [rbp - 0x3c], ax
mov byte [rbp - 0x40], 0x2e
xor byte [rbp - 0x3f], 0x36
xor byte [rbp - 0x3e], 0x37
xor byte [rbp - 0x3d], 0x38
xor al, 0x39
mov byte [rbp - 0x3c], al
xor byte [rbp - 0x3b], 0x3a
lea rcx, [rbp - 0x40]
call fcn.7ff6456dd0c0
test al, al
jne 0x7ff6456e0c93
call qword [sym.imp.kernel32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.kernel32.dll_CloseHandle]
test eax, eax
je 0x7ff6456e0c93
cmp dword [rbp - 0x28], ebx
je 0x7ff6456e0c86
call qword [sym.imp.ucrtbase.dll_terminate]
nop
cmp dword [rbp - 0x18], 0
je 0x7ff6456e0cd2
call qword [sym.imp.ucrtbase.dll_terminate]
nop
xor ecx, ecx
call qword [sym.imp.ucrtbase.dll_exit]
int3
mov ecx, 1
call qword [sym.imp.msvcp140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x28], ebx
mov ecx, 6
call qword [sym.imp.msvcp140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.msvcp140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp - 0x18], ebx
mov ecx, 6
call qword [sym.imp.msvcp140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.7ff64578c730
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x7ff6456e7e60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x7ff6457cea40]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x7ff6456e7f33
cmp byte [rcx + 0x71], 0
je 0x7ff6456e7f33
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x7ff6456e7f2f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.msvcp140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x7ff6456e7ef4
sub eax, 1
je 0x7ff6456e7ef8
cmp eax, 2
jne 0x7ff6456e7f2f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.7ff64578c730
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x7ff6456e7f26
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.ucrtbase.dll_fwrite]
cmp rdi, rax
jne 0x7ff6456e7f2f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x7ff6456e7edc
xor al, al
jmp 0x7ff6456e7edc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.7ff64578c730
add rsp, 0x60
pop rbx
ret
Function at 0x7ff6456f66f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x7ff6456f6751
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x7ff6456f6710
mov ecx, dword [r9]
jmp 0x7ff6456f6838
cmp ecx, 0x4e0
jb 0x7ff6456f6838
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x7ff6456f6770
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x7ff6456f67c0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x7ff6456f9440
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
test rcx, rcx
je 0x7ff6456f95e3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x7ff6456f95e3
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x7ff6456f95e3
mov edx, 0x20b
cmp word [rax + rcx + 0x18], dx
jne 0x7ff6456f95e3
mov qword [rbx], rcx
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
mov qword [rsp + 0x40], rdi
mov qword [rbx + 8], rcx
xor edi, edi
mov qword [rsp + 0x48], r14
lea rax, [rcx + 0x18]
mov qword [rbx + 0x18], rax
lea rdx, [rcx + 4]
mov qword [rbx + 0x10], rdx
lea rax, [rcx + 0x88]
mov qword [rbx + 0x20], rax
lea r14, [rcx + 0x18]
lea rax, [rcx + 0x90]
mov qword [rbx + 0x28], rax
lea rax, [rcx + 0x98]
mov qword [rbx + 0x30], rax
lea rax, [rcx + 0xa0]
mov qword [rbx + 0x38], rax
lea rax, [rcx + 0xa8]
mov qword [rbx + 0x40], rax
lea rax, [rcx + 0xb0]
mov qword [rbx + 0x48], rax
lea rax, [rcx + 0xb8]
mov qword [rbx + 0x50], rax
lea rax, [rcx + 0xc0]
mov qword [rbx + 0x58], rax
lea rax, [rcx + 0xc8]
mov qword [rbx + 0x60], rax
lea rax, [rcx + 0xd0]
mov qword [rbx + 0x68], rax
lea rax, [rcx + 0xd8]
mov qword [rbx + 0x70], rax
lea rax, [rcx + 0xe0]
mov qword [rbx + 0x78], rax
lea rax, [rcx + 0xe8]
mov qword [rbx + 0x80], rax
lea rax, [rcx + 0xf0]
mov qword [rbx + 0x88], rax
lea rax, [rcx + 0xf8]
mov qword [rbx + 0x90], rax
lea rax, [rcx + 0x100]
mov qword [rbx + 0x98], rax
movzx eax, word [rcx + 0x14]
add r14, rax
cmp di, word [rdx + 2]
jae 0x7ff6456f95d1
mov qword [rsp + 0x38], rsi
nop dword [rax]
mov rdx, qword [rbx + 0xa8]
movsxd rax, edi
lea rcx, [rax + rax*4]
lea rax, [r14 + rcx*8]
mov qword [rsp + 0x30], rax
cmp rdx, qword [rbx + 0xb0]
je 0x7ff6456f95ad
mov qword [rdx], rax
add qword [rbx + 0xa8], 8
jmp 0x7ff6456f95be
lea r8, [rsp + 0x30]
lea rcx, [rbx + 0xa0]
call fcn.7ff6456f6cb0
mov rax, qword [rbx + 0x10]
inc edi
movzx ecx, word [rax + 2]
cmp edi, ecx
jl 0x7ff6456f9580
mov rsi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x48]
mov al, 1
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x7ff6456fa4d0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Parse pe header

Disassembly:
push rbx
sub rsp, 0x20
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleA]
mov rcx, rax
mov rbx, rax
call fcn.7ff6456f9fe0
test al, al
je 0x7ff6456fa5a8
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
test rbx, rbx
je 0x7ff6456fa529
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x7ff6456fa529
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x7ff6456fa529
mov ecx, 0x20b
cmp word [rax + rbx + 0x18], cx
jne 0x7ff6456fa529
mov ecx, dword [rax + rbx + 0x50]
jmp 0x7ff6456fa52b
xor ecx, ecx
mov esi, ecx
mov r9d, 0x40
mov edx, ecx
mov r8d, 0x3000
xor ecx, ecx
call qword [sym.imp.kernel32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x7ff6456fa591
mov r8d, esi
mov rdx, rbx
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [0x7ff6456f95f0]
mov rcx, rdi
sub rdx, rbx
add rdx, rdi
call rdx
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.kernel32.dll_VirtualFree]
mov rcx, rbx
call fcn.7ff6456fa230
mov ecx, 0xbb8
call qword [sym.imp.kernel32.dll_Sleep]
jmp 0x7ff6456fa584
cmp rbx, 1
jne 0x7ff6456fa59c
call fcn.7ff6456f8aa0
mov rdi, qword [rsp + 0x38]
xor eax, eax
mov rsi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x7ff6456fa880
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov eax, 0x35
movaps xmmword [rsp + 0x30], xmm7
xorps xmm6, xmm6
movaps xmmword [rsp + 0x20], xmm8
mov rbx, rcx
movsd xmm8, qword [0x7ff6457932a8]
cvtsi2sd xmm6, rax
test rax, rax
jns 0x7ff6456fa8b9
addsd xmm6, xmm8
movaps xmm0, xmm8
call qword [sym.imp.ucrtbase.dll_log2]
divsd xmm6, xmm0
movaps xmm0, xmm6
call sub.ucrtbase.dll_ceil
movsd xmm6, qword [0x7ff6457932a0]
mov ecx, 1
cvttsd2si eax, xmm0
xorps xmm7, xmm7
cmp eax, ecx
cmovl eax, ecx
test eax, eax
jle 0x7ff6456fa9f3
mov qword [rsp + 0x60], rbp
movabs rbp, 0x38eb3ffff6d3
mov qword [rsp + 0x68], rsi
movabs rsi, 0xb5026f5aa96619e9
mov qword [rsp + 0x70], rdi
mov edi, eax
mov eax, dword [rbx]
cmp eax, 0x138
jne 0x7ff6456fa96c
lea r8, [rbx + 0x10]
mov r9d, eax
nop word [rax + rax]
mov edx, dword [r8 - 8]
xor edx, dword [r8]
lea r8, [r8 + 8]
btr edx, 0x1f
xor rdx, qword [r8 - 0x10]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rsi
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x7ff6456fa930
jmp 0x7ff6456fa97b
cmp eax, 0x270
jb 0x7ff6456fa97b
mov rcx, rbx
call fcn.7ff6456fbfd0
mov eax, dword [rbx]
xorps xmm1, xmm1
mov rcx, qword [rbx + rax*8 + 8]
inc eax
mov dword [rbx], eax
mov rax, rcx
shr rax, 0x1d
and rax, qword [rbx + 0x1388]
xor rcx, rax
mov rax, rcx
and rax, rbp
shl rax, 0x11
xor rcx, rax
mov rax, rcx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rcx, rax
mov rax, rcx
shr rax, 0x2b
xor rax, rcx
cvtsi2sd xmm1, rax
jns 0x7ff6456fa9cd
addsd xmm1, xmm8
mulsd xmm1, xmm6
mulsd xmm6, xmm8
addsd xmm7, xmm1
sub rdi, 1
jne 0x7ff6456fa915
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
movaps xmm8, xmmword [rsp + 0x20]
divsd xmm7, xmm6
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm0, xmm7
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x50
pop rbx
ret

Function at 0x7ff6456fbfd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov r10, rcx
lea r9, [rcx + 0x9c8]
movabs rbx, 0xb5026f5aa96619e9
mov r11d, 0x9c
nop
mov edx, dword [r9]
xor edx, dword [r9 + 8]
lea r9, [r9 + 8]
btr edx, 0x1f
xor rdx, qword [r9 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rbx
xor rcx, qword [r9 + 0x4d8]
xor rcx, rdx
mov qword [r9 - 0x9c8], rcx
sub r11, 1
jne 0x7ff6456fbff0
lea r9, [r10 + 0xea8]
mov r11d, 0x9b
nop word [rax + rax]
mov edx, dword [r9]
xor edx, dword [r9 + 8]
lea r9, [r9 + 8]
btr edx, 0x1f
xor rdx, qword [r9 - 8]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rbx
xor rcx, qword [r9 - 0xea8]
xor rcx, rdx
mov qword [r9 - 0x9c8], rcx
sub r11, 1
jne 0x7ff6456fc040
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 8]
btr edx, 0x1f
xor rdx, qword [r10 + 0x1380]
movzx eax, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rbx
mov rbx, qword [rsp + 8]
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 + 0x9c0], rcx
mov dword [r10], r11d
ret
Function at 0x7ff6456fcd50
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0xae0
mov rax, qword [0x7ff6457cea40]
xor rax, rsp
mov qword [rsp + 0xad0], rax
mov rbx, rdx
mov dword [rsp + 0x28], 0x20
lea rax, [rsp + 0x80]
mov r8, rcx
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
or r9d, 0xffffffff
call qword [sym.imp.kernel32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 0x20
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, rbx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.kernel32.dll_MultiByteToWideChar]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x7ff645793418]
mov rcx, 0xffffffff80000001
call qword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
je 0x7ff6456fcdff
mov ecx, 2
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
lea rdx, [0x7ff645793448]
jmp 0x7ff6456fcec7
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x7ff645793468]
lea rax, [rsp + 0xc0]
mov dword [rsp + 0x30], 0x208
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.advapi32.dll_RegCloseKey]
test ebx, ebx
jne 0x7ff6456fceb5
mov ecx, dword [rsp + 0x30]
cmp ecx, 1
jb 0x7ff6456fceb5
shr ecx, 1
je 0x7ff6456fce73
lea rax, [rsp + 0xc0]
lea edx, [rbx + 0x5c]
nop
cmp word [rax], 0x2f
jne 0x7ff6456fce69
mov word [rax], dx
add rax, 2
sub rcx, 1
jne 0x7ff6456fce60
lea rax, [rsp + 0x40]
mov edx, 0x800
lea r9, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r8, [0x7ff6457934a0]
lea rcx, [rsp + 0x2d0]
call fcn.7ff6456fcbe0
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x80]
call fcn.7ff6456fc840
jmp 0x7ff6456fcecf
mov ecx, 2
call qword [sym.imp.ucrtbase.dll___acrt_iob_func]
lea rdx, [0x7ff645793480]
mov rcx, rax
call fcn.7ff6456fcef0
mov rcx, qword [rsp + 0xad0]
xor rcx, rsp
call fcn.7ff64578c730
add rsp, 0xae0
pop rbx
ret
Function at 0x7ff6456fcf90
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x7ff6457cea40]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov eax, dword [0x7ff645793500]
xor edi, edi
movups xmm0, xmmword [0x7ff6457934d8]
mov dword [rsp + 0x68], eax
mov rbx, rcx
movzx eax, word [0x7ff645793504]
lea rcx, [rsp + 0x40]
movups xmm1, xmmword [0x7ff6457934e8]
mov word [rsp + 0x6c], ax
mov eax, 0x30
movups xmmword [rsp + 0x40], xmm0
xor r9d, r9d
mov qword [rsp + 0x30], rdi
movsd xmm0, qword [0x7ff6457934f8]
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov edx, 0xc0000000
movsd qword [rsp + 0x60], xmm0
mov word [rsp + 0x6a], ax
movups xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x20], 3
call qword [sym.imp.kernel32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x7ff6456fd094
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 2
jne 0x7ff6456fd048
movzx eax, word [rsp + 0x6a]
cmp ax, 0x39
jae 0x7ff6456fd0b7
inc ax
mov word [rsp + 0x6a], ax
jmp 0x7ff6456fd063
cmp eax, 0xe7
jne 0x7ff6456fd0b7
mov edx, 0x2710
lea rcx, [rsp + 0x40]
call qword [sym.imp.kernel32.dll_WaitNamedPipeW]
test eax, eax
je 0x7ff6456fd0b7
mov qword [rsp + 0x30], rdi
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], edi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
mov edx, 0xc0000000
call qword [sym.imp.kernel32.dll_CreateFileW]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
je 0x7ff6456fd028
mov byte [rbx], 1
mov al, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.7ff64578c730
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
xor al, al
jmp 0x7ff6456fd099

Function at 0x7ff6456fd0c0
Capabilities:
Read file on windows
Read pipe

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
test rdx, rdx
jne 0x7ff6456fd0e0
xor al, al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
test rbx, rbx
je 0x7ff6456fd0d6
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x7ff6456fd0d6
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rbp
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x28], rbp
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x58], ebp
call qword [sym.imp.kernel32.dll_PeekNamedPipe]
test eax, eax
je 0x7ff6456fd16b
mov eax, dword [rsp + 0x58]
cmp rax, rdi
jb 0x7ff6456fd180
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x68]
mov r8d, edi
mov dword [rsp + 0x68], ebp
mov rdx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.kernel32.dll_ReadFile]
cmp eax, 1
jne 0x7ff6456fd154
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, rbx
call fcn.7ff6456fcf40
mov rbp, qword [rsp + 0x50]
xor al, al
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
mov rcx, qword [rbx + 8]
call qword [sym.imp.kernel32.dll_CloseHandle]
mov qword [rbx + 8], 0xffffffffffffffff
mov byte [rbx], bpl
xor al, al
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x7ff6456fd190
Capabilities:
Write file on windows

Disassembly:
push rdi
sub rsp, 0x30
mov rdi, r8
test r8, r8
jne 0x7ff6456fd1a6
mov al, 1
add rsp, 0x30
pop rdi
ret
test rcx, rcx
jne 0x7ff6456fd1b3
xor al, al
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rcx + 8]
cmp rcx, 0xffffffffffffffff
je 0x7ff6456fd1ab
test rdx, rdx
je 0x7ff6456fd1ab
mov qword [rsp + 0x40], rbx
lea r9, [rsp + 0x50]
xor ebx, ebx
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.kernel32.dll_WriteFile]
cmp eax, 1
jne 0x7ff6456fd1ea
cmp dword [rsp + 0x50], edi
jne 0x7ff6456fd1ea
mov ebx, eax
movzx eax, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret