joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003790
Capabilities:
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x260
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov r14, rdx
lea r8, str.RegistryMachineSystemCurrentControlSetServices_
mov rbx, rdx
mov rsi, rcx
mov edx, 0x35
mov edi, 0x34
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
movzx ecx, word [rbx]
mov rdx, rbx
test cx, cx
je 0x14000382e
nop dword [rax]
add rdx, 2
cmp cx, 0x5c
mov rax, rdx
cmovne rax, rbx
movzx ecx, word [rdx]
mov rbx, rax
test cx, cx
jne 0x1400037e0
movzx ecx, word [rax]
test cx, cx
je 0x14000382e
movzx eax, word [rax]
lea rcx, [rsi + 0x68]
movzx edx, ax
nop dword [rax]
cmp dx, 0x2e
je 0x14000382e
add rbx, 2
mov word [rcx], ax
inc edi
add rcx, 2
movzx eax, word [rbx]
movzx edx, ax
test ax, ax
jne 0x140003810
movsxd rax, edi
xor ecx, ecx
mov rdx, rsi
mov word [rsi + rax*2], cx
call qword [sym.imp.ntdll.dll_RtlCreateRegistryKey]
test eax, eax
js 0x1400038f7
lea r8, [0x14000aea8]
mov dword [rsp + 0x30], 1
mov edx, 5
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov r8, r14
lea rcx, [rsp + 0x40]
mov edx, 0x87
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea rcx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140003890
lea eax, [rax*2 + 2]
mov r9d, 1
mov dword [rsp + 0x28], eax
lea r8, str.ImagePath
lea rax, [rsp + 0x40]
mov rdx, rsi
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntdll.dll_RtlWriteRegistryValue]
test eax, eax
js 0x1400038f7
lea rax, [rsp + 0x30]
mov dword [rsp + 0x28], 4
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, str.Type
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlWriteRegistryValue]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140003f80
mov rbx, qword [rsp + 0x290]
add rsp, 0x260
pop r14
pop rdi
pop rsi
ret
Function at 0x140004b54
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004b9e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004b9e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004b9e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004b9e
cmp dword [rcx + 0x84], 0xe
jbe 0x140004b9e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004ba0
xor al, al
add rsp, 0x28
ret

Function at 0x16fdb40
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x16fdb4d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x16fdb5d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x16fdb45
lea eax, [rcx + 1]
jmp 0x16fdb6b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x16fdb7e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x16fdb64
sub eax, 3
jb 0x16fdb9e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x16fdbed
sar eax, 1
movsxd rbp, eax
jb 0x16fdbd4
jmp 0x16fdbac
add ebx, ebx
jne 0x16fdbaa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x16fdbd4
inc ecx
add ebx, ebx
jne 0x16fdbba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x16fdbd4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x16fdbcd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x16fdbbc
add ecx, 2
jmp 0x16fdbd9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.016fdb02
jmp 0x16fdb4d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x12e7000]
mov eax, dword [rdi]
or eax, eax
je 0x16fdc49
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1302f2c]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x16fdbf9
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x16fdc43
mov qword [rbx], rax
add rbx, 8
jmp 0x16fdc19
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x16fdc8d
cmp al, 0xef
ja 0x16fdc75
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x16fdc55
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x16fdc64
mov eax, dword [rdi]
add rdi, 4
jmp 0x16fdc64
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x16fdce1
sub rsp, 0xffffffffffffff80
jmp 0x4660e0
Function at 0x140001510
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x28], rcx
lea rdx, [rsp + 0x28]
mov rdi, rcx
mov dword [rsp + 0x28], 0x101
lea rcx, [rsp + 0x30]
xor esi, esi
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
test eax, eax
je 0x14000168d
mov qword [rsp + 0x168], rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x170], rbp
mov rbx, 0xffffffffffffffff
mov qword [rdi + 0x18], rsi
inc rbx
cmp byte [rax + rbx], sil
jne 0x140001583
movabs rbp, 0x7fffffffffffffff
cmp rbx, rbp
ja 0x14000169d
cmp rbx, 0xf
ja 0x1400015ca
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x30]
mov qword [rdi + 0x18], 0xf
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rdi], sil
jmp 0x140001659
mov rax, rbx
or rax, 0xf
cmp rax, rbp
jbe 0x1400015ff
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140006070
test rax, rax
je 0x14000162b
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x14000163a
mov ecx, 0x16
mov rbp, rax
cmp rax, rcx
cmovb rbp, rcx
lea rcx, [rbp + 1]
test rcx, rcx
je 0x14000163a
cmp rcx, 0x1000
jb 0x140001632
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400016a3
jmp 0x1400015e4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006070
mov rsi, rax
mov r8, rbx
mov qword [rdi], rsi
lea rdx, [rsp + 0x30]
mov qword [rdi + 0x10], rbx
mov rcx, rsi
mov qword [rdi + 0x18], rbp
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
mov rbx, qword [rsp + 0x168]
mov rax, rdi
mov rbp, qword [rsp + 0x170]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140006050
mov rsi, qword [rsp + 0x178]
add rsp, 0x150
pop rdi
ret
mov qword [rdi + 0x18], 0xf
mov rax, rdi
mov byte [rdi], sil
jmp 0x14000166c
call fcn.1400011b0
int3
call fcn.140001110
int3
Function at 0x140003740
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140003768
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000378e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140003790
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400037e9
test ecx, ecx
jle 0x1400037c9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400037e9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400037e9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140003810
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140003832
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140003848
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140003864
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140003866
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400038a2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000393e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400038dd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000391e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000393e
cmp rbx, rax
ja 0x1400038f0
test rbx, rbx
je 0x14000393e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140003da0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140003dcd
xor eax, eax
jmp 0x140003f39
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140003e07
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140003e07
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140003f39
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140003f2c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140003e4a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003e75
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003f31
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140003ee4
sub eax, 1
je 0x140003ee4
cmp eax, 2
jne 0x140003f2c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140003f31
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140003f12
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140003f2c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140003f31
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140006050
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140004fc0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140005093
cmp byte [rcx + 0x71], 0
je 0x140005093
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000508f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005054
sub eax, 1
je 0x140005058
cmp eax, 2
jne 0x14000508f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140006050
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140005086
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000508f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000503c
xor al, al
jmp 0x14000503c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140006050
add rsp, 0x60
pop rbx
ret

Function at 0x1400069d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140006a1a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140006a1a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140006a1a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140006a1a
cmp dword [rcx + 0x84], 0xe
jbe 0x140006a1a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140006a1c
xor al, al
add rsp, 0x28
ret
Function at 0x140001463
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rsp + 4]
mov ecx, dword [rax]
lea edx, [rax + 6]
mov al, byte [rax + 4]
xor byte [rdx], al
test r9, rcx
jne 0x14000146f
ret 4

Function at 0x1400015b8
Capabilities:
Hash data using fnv

Disassembly:
push rbp
mov ebp, esp
sub esp, 0x10
push rsi
push rdi
mov edi, dword [rbp + 8]
mov eax, dword [rdi + 0x3c]
mov eax, dword [rdi + rax + 0x78]
add eax, edi
mov ecx, dword [rax + 0x18]
mov dword [rbp - 4], ecx
mov edx, dword [rax + 0x1c]
add edx, edi
mov dword [rbp - 8], edx
mov ecx, dword [rax + 0x20]
add ecx, edi
mov dword [rbp - 0xc], ecx
mov edx, dword [rax + 0x24]
add edx, edi
mov dword [rbp - 0x10], edx
xor esi, esi
test ebx, ebx
je 0x140001688
mov eax, dword [rcx + rsi*4]
add eax, edi
mov edx, 0x811c9dc5
movzx ecx, byte [rax]
test cl, cl
je 0x140001674
lea eax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
jmp 0x1400015fe
mov eax, dword [rbp - 8]
mov ecx, dword [rbp - 0x10]
movzx ecx, word [rcx + rsi*2]
mov eax, dword [rax + rcx*4]
add eax, edi
mov ecx, dword [rbp + 0xc]
mov dword [rcx + 4], eax
mov ecx, eax
xor eax, eax
cmp dword [rbp + 0x10], 1
jne 0x14000168a
xor rdx, rdx
cmp byte [rcx + rdx], 0xf
jne 0x140001642
cmp byte [rcx + rdx + 1], 5
je 0x140001688
cmp byte [rcx + rdx], 0xc2
je 0x140001688
cmp byte [rcx + rdx], 0xc3
je 0x140001688
cmp byte [rcx + rdx], 0xb8
jne 0x140001671
cmp byte [rcx + rdx + 5], 0xba
jne 0x140001671
mov esi, dword [rcx + rdx + 1]
mov edi, dword [rcx + rdx + 6]
mov dword [rbx + 5], edi
mov eax, dword [rbp + 0xc]
mov dword [rax + 4], esi
xor eax, eax
jmp 0x14000168a
jmp 0x140001635
mov eax, dword [rbp + 0xc]
cmp edx, dword [rax]
je 0x140001612
mov ecx, dword [rbp - 0xc]
cmp r14d, dword [rbp - 4]
jb 0x1400015f4
xor eax, eax
pop rdi
pop rsi
add esp, 0x10
pop rbp
ret 0xc
Function at 0x1400016a4
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov ebp, esp
sub esp, 0x30
push rsi
push rdi
xor edx, edx
mov esi, dword [rbp + 8]
mov edi, dword [rbp + 0xc]
push qword [rsi + 0x48]
call fcn.140001693
push rdx
push rdx
push 0x60
push 1
push rdx
push 0x80
push rdx
lea eax, [rbp - 0x24]
push rax
push rdi
push 0xffffffff80100080
lea eax, [rbp - 4]
push rax
call fcn.14000169d
add esp, 0x2c
test eax, eax
jne 0x14000182e
cmp dword [rbp - 0x20], 1
jne 0x14000182e
xor edx, edx
xorps xmm0, xmm0
mov dword [rbp - 0x2c], edx
movups xmmword [rbp - 0x1c], xmm0
mov dword [rbp - 0xc], edx
mov dword [rbp - 8], edx
push qword [rsi + 0x40]
call fcn.140001693
push 5
push 0x18
lea eax, [rbp - 0x1c]
push rax
lea eax, [rbp - 0x24]
push rax
push qword [rbp - 4]
call fcn.14000169d
add esp, 0x14
test eax, eax
jne 0x14000182e
mov ecx, dword [rbp - 0x10]
test ecx, ecx
jne 0x14000182e
push qword [rbp - 0x14]
push 8
mov eax, dword [rsi]
mov eax, dword [rax + 0x18]
push rax
call qword [rsi + 0x20]
mov dword [rbp - 0x2c], eax
push qword [rsi + 0x58]
call fcn.140001693
xor edx, edx
push rdx
push rdx
push qword [rbp - 0x14]
push qword [rbp - 0x2c]
lea eax, [rbp - 0x24]
push rax
push rdx
push rdx
push rdx
push qword [rbp - 4]
call fcn.14000169d
add esp, 0x24
test eax, eax
jne 0x14000182e
push qword [rsi + 0x50]
call fcn.140001693
push qword [rbp - 4]
call fcn.14000169d
add esp, 4
mov eax, dword [rbp - 0x2c]
cmp word [rax], 0x5a4d
je 0x14000182a
movdqu xmm0, xmmword [rbx + 9]
xor ecx, ecx
mov edx, dword [rbp - 0x14]
mov eax, dword [rbp - 0x2c]
movdqu xmm1, xmmword [rax + rcx]
xorps xmm1, xmm0
movdqu xmmword [rax + rcx], xmm1
add ecx, 0x10
mov eax, edx
sub eax, ecx
cmp eax, 0x10
jge 0x14000179d
test eax, eax
je 0x1400017ce
push rdx
mov dl, byte [rbx + 9]
mov eax, dword [rbp - 0x2c]
xor byte [rax + rcx], dl
cmp ecx, dword [r12]
jne 0x1400017c4
pop rdx
push qword [rsi + 0x48]
call fcn.140001693
xor edx, edx
push rdx
push rdx
push 0x60
push 1
push rdx
push 0x80
push rdx
lea eax, [rbp - 0x24]
push rax
push rdi
push 0x40100080
lea eax, [rbp - 4]
push rax
call fcn.14000169d
add esp, 0x2c
test eax, eax
jne 0x14000182e
push qword [rsi + 0x60]
call fcn.140001693
xor edx, edx
push rdx
push rdx
push qword [rbp - 0x14]
push qword [rbp - 0x2c]
lea eax, [rbp - 0x24]
push rax
push rdx
push rdx
push rdx
push qword [rbp - 4]
call fcn.14000169d
add esp, 0x24
test eax, eax
jne 0x14000182e
jmp 0x140001831
xor eax, eax
jmp 0x140001831
xor eax, eax
push rax
push rax
mov eax, dword [rbp - 0x2c]
test eax, eax
je 0x140001846
push rax
xor edx, edx
push rdx
mov eax, dword [rsi]
mov eax, dword [rax + 0x18]
push rax
call qword [rsi + 0x28]
pop rax
pop rdi
pop rsi
add esp, 0x30
pop rbp
ret 8

Function at 0x140001daf
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
mov ecx, dword [rax]
lea rdx, [rax + 6]
mov al, byte [rax + 4]
xor byte [rdx], al
inc rdx
dec ecx
test ecx, ecx
jne 0x140001dbb
ret
Function at 0x140001dc7
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rbx, rcx
mov qword [rbx], rax
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov rax, qword [rax]
mov rdi, qword [rax + 0x30]
mov rcx, rdi
lea rdx, [rbx + 8]
mov dword [rdx], 0x3376500f
xor r8d, r8d
call fcn.140001f72
test rax, rax
je 0x140001f6e
mov rcx, rdi
lea rdx, [rbx + 0x18]
mov dword [rdx], 0x2dfc830f
xor r8d, r8d
call fcn.140001f72
test rax, rax
je 0x140001f6e
mov rcx, rdi
lea rdx, [rbx + 0x28]
mov dword [rdx], 0x552e48c2
xor r8d, r8d
call fcn.140001f72
test rax, rax
je 0x140001f6e
mov rcx, rdi
lea rdx, [rbx + 0x38]
mov dword [rdx], 0xb3f819f8
xor r8d, r8d
call fcn.140001f72
test rax, rax
je 0x140001f6e
mov rcx, rdi
lea rdx, [rbx + 0x48]
mov dword [rdx], 0x7c76ecf5
xor r8d, r8d
call fcn.140001f72
test rax, rax
je 0x140001f6e
mov rcx, rdi
lea rdx, [rbx + 0x58]
mov dword [rdx], 0x116893e9
mov r8d, 1
call fcn.140001f72
test rax, rax
je 0x140001f6e
mov rcx, rdi
lea rdx, [rbx + 0x68]
mov dword [rdx], 0x529977e2
mov r8d, 1
call fcn.140001f72
test rax, rax
je 0x140001f6e
mov rcx, rdi
lea rdx, [rbx + 0x78]
mov dword [rdx], 0x7b62ef3
mov r8d, 1
call fcn.140001f72
test rax, rax
je 0x140001f6e
mov rcx, rdi
lea rdx, [rbx + 0x88]
mov dword [rdx], 0xa9c5b599
mov r8d, 1
call fcn.140001f72
test rax, rax
je 0x140001f6e
mov rcx, rdi
lea rdx, [rbx + 0x98]
mov dword [rdx], 0x6b372c05
mov r8d, 1
call fcn.140001f72
test rax, rax
je 0x140001f6e
mov rcx, rdi
lea rdx, [rbx + 0xa8]
mov dword [rdx], 0xa9e25a1d
mov r8d, 1
call fcn.140001f72
test rax, rax
je 0x140001f6e
mov rcx, rdi
lea rdx, [rbx + 0xb8]
mov dword [rdx], 0xf67464e4
mov r8d, 1
call fcn.140001f72
add rsp, 0x20
pop rdi
mov rbx, qword [rsp + 8]
ret
xor eax, eax
jmp 0x140001f63
Function at 0x140001f72
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
xor r12d, r12d
mov r10, rcx
mov rsi, rdx
mov ebx, dword [rsi]
mov r14d, r8d
movsxd rax, dword [r10 + 0x3c]
mov r9d, dword [rax + r10 + 0x88]
add r9, r10
xor r8d, r8d
mov edi, dword [r9 + 0x20]
add rdi, r10
mov ebp, dword [r9 + 0x24]
add rbp, r10
mov r13d, dword [r9 + 0x1c]
add r13, r10
mov r11d, dword [r9 + 0x18]
test r11d, r11d
je 0x14000206d
mov r9d, r8d
mov eax, dword [rdi + r9*4]
add rax, r10
mov edx, 0x811c9dc5
movzx ecx, byte [rax]
test cl, cl
je 0x14000205a
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
jmp 0x140001fdd
movzx ecx, word [rbp + r9*2]
mov r8d, dword [r13 + rcx*4]
add r8, r10
mov qword [rsi + 8], r8
mov rax, r12
inc rax
test r14d, r14d
je 0x14000206d
dec rax
mov rcx, rax
cmp byte [r8 + rcx], 0xf
jne 0x140002024
cmp byte [r8 + rcx + 1], 5
je 0x14000206a
cmp byte [r8 + rcx], 0xc2
je 0x14000206a
cmp byte [r8 + rcx], 0xc3
je 0x14000206a
cmp dword [r8 + rcx], 0xb8d18b4c
jne 0x140002055
cmp word [r8 + rcx + 6], r12w
jne 0x140002055
mov ecx, dword [r8 + rcx + 4]
mov qword [rsi + 8], r12
mov dword [rsi + 8], ecx
inc rax
jmp 0x14000206d
inc rcx
jmp 0x140002015
cmp edx, ebx
je 0x140001ff2
inc r8d
cmp r8d, r11d
jb 0x140001fce
xor rax, rax
pop r14
pop r13
pop r12
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret

Function at 0x14000208c
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [rbx + 7]
syscall
ret