joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003174
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rdx, rax
jbe 0x1400031b2
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rbx, qword [0x1400109f8]
lea rax, [rdx - 1]
or rax, 1
mov edi, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x140010a08]
lea rdx, [rdi + rdi]
call fcn.1400023f4
mov rax, qword [0x1400109f8]
lea r11, [rdi - 1]
mov qword [0x140010a20], r11
mov qword [0x140010a28], rdi
mov rax, qword [rax]
mov rdx, rax
cmp rax, rbx
je 0x14000336e
movabs rbp, 0xcbf29ce484222325
movabs r14, 0x100000001b3
mov rdx, qword [rdx]
mov r9, rbp
xor r8d, r8d
movzx ecx, byte [r8 + rax + 0x10]
inc r8
xor r9, rcx
imul r9, r14
cmp r8, 8
jb 0x140003227
mov r8, rbp
xor r10d, r10d
movzx ecx, byte [rax + r10 + 0x18]
inc r10
xor r8, rcx
imul r8, r14
cmp r10, 2
jb 0x140003243
mov rdi, qword [0x140010a08]
imul r10, r9, 0x7be0
add r10, 0x3253
xor r10, r8
and r10, r11
add r10, r10
cmp qword [rdi + r10*8], rbx
jne 0x14000328b
mov qword [rdi + r10*8], rax
mov qword [rdi + r10*8 + 8], rax
jmp 0x140003334
mov rcx, qword [rdi + r10*8 + 8]
mov r9, qword [rax + 0x10]
cmp r9, qword [rcx + 0x10]
jne 0x1400032ab
movzx r8d, word [rcx + 0x18]
cmp word [rax + 0x18], r8w
jne 0x1400032ab
mov r8b, 1
jmp 0x1400032ae
xor r8b, r8b
test r8b, r8b
je 0x1400032de
mov r11, qword [rcx]
cmp r11, rax
je 0x140003281
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r11
mov rcx, qword [r11 + 8]
mov qword [rcx], rax
mov qword [r11 + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
jmp 0x140003281
mov r11, rcx
jmp 0x140003309
mov rcx, qword [rcx + 8]
mov r11, rcx
cmp r9, qword [rcx + 0x10]
jne 0x140003301
movzx r8d, word [rcx + 0x18]
cmp word [rax + 0x18], r8w
jne 0x140003301
mov r8b, 1
jmp 0x140003304
xor r8b, r8b
test r8b, r8b
jne 0x140003348
cmp qword [rdi + r10*8], rcx
jne 0x1400032e3
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r11
mov rcx, qword [r11 + 8]
mov qword [rcx], rax
mov qword [r11 + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
mov qword [rdi + r10*8], rax
mov rax, rdx
cmp rdx, rbx
je 0x14000336e
mov r11, qword [0x140010a20]
jmp 0x14000321e
mov r10, qword [rcx]
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rcx, qword [r10 + 8]
mov qword [rcx], rax
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
jmp 0x140003334
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140003384
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rdx, rax
jbe 0x1400033c2
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rbx, qword [0x1400109b8]
lea rax, [rdx - 1]
or rax, 1
mov edi, 1
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x1400109c8]
lea rdx, [rdi + rdi]
call fcn.1400023f4
mov rax, qword [0x1400109b8]
lea r11, [rdi - 1]
mov qword [0x1400109e0], r11
mov qword [0x1400109e8], rdi
mov rax, qword [rax]
mov rdx, rax
cmp rax, rbx
je 0x14000357e
movabs rbp, 0xcbf29ce484222325
movabs r14, 0x100000001b3
mov rdx, qword [rdx]
mov r9, rbp
xor r8d, r8d
movzx ecx, byte [r8 + rax + 0x10]
inc r8
xor r9, rcx
imul r9, r14
cmp r8, 8
jb 0x140003437
mov r8, rbp
xor r10d, r10d
movzx ecx, byte [rax + r10 + 0x18]
inc r10
xor r8, rcx
imul r8, r14
cmp r10, 2
jb 0x140003453
mov rdi, qword [0x1400109c8]
imul r10, r9, 0x7be0
add r10, 0x3253
xor r10, r8
and r10, r11
add r10, r10
cmp qword [rdi + r10*8], rbx
jne 0x14000349b
mov qword [rdi + r10*8], rax
mov qword [rdi + r10*8 + 8], rax
jmp 0x140003544
mov rcx, qword [rdi + r10*8 + 8]
mov r9, qword [rax + 0x10]
cmp r9, qword [rcx + 0x10]
jne 0x1400034bb
movzx r8d, word [rcx + 0x18]
cmp word [rax + 0x18], r8w
jne 0x1400034bb
mov r8b, 1
jmp 0x1400034be
xor r8b, r8b
test r8b, r8b
je 0x1400034ee
mov r11, qword [rcx]
cmp r11, rax
je 0x140003491
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r11
mov rcx, qword [r11 + 8]
mov qword [rcx], rax
mov qword [r11 + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
jmp 0x140003491
mov r11, rcx
jmp 0x140003519
mov rcx, qword [rcx + 8]
mov r11, rcx
cmp r9, qword [rcx + 0x10]
jne 0x140003511
movzx r8d, word [rcx + 0x18]
cmp word [rax + 0x18], r8w
jne 0x140003511
mov r8b, 1
jmp 0x140003514
xor r8b, r8b
test r8b, r8b
jne 0x140003558
cmp qword [rdi + r10*8], rcx
jne 0x1400034f3
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r11
mov rcx, qword [r11 + 8]
mov qword [rcx], rax
mov qword [r11 + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
mov qword [rdi + r10*8], rax
mov rax, rdx
cmp rdx, rbx
je 0x14000357e
mov r11, qword [0x1400109e0]
jmp 0x14000342e
mov r10, qword [rcx]
mov r9, qword [rax + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], r10
mov rcx, qword [r10 + 8]
mov qword [rcx], rax
mov qword [r10 + 8], r8
mov qword [rdx + 8], r9
mov qword [rax + 8], rcx
jmp 0x140003544
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140003858
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
movabs rcx, 0xcbf29ce484222325
xor r8d, r8d
mov r10, rcx
mov r9d, r8d
mov r11, rdx
movabs rbx, 0x100000001b3
movzx eax, byte [r9 + rdx]
inc r9
xor r10, rax
imul r10, rbx
cmp r9, 4
jb 0x14000387d
mov rdx, rcx
mov r9, r8
movzx eax, byte [r11 + r9 + 4]
inc r9
xor rdx, rax
imul rdx, rbx
cmp r9, 2
jb 0x140003898
movzx eax, byte [r11 + r8 + 8]
inc r8
xor rcx, rax
imul rcx, rbx
cmp r8, 4
jb 0x1400038ae
mov rbx, qword [rsp + 8]
mov r8d, 0x3253
imul rax, r10, 0x7be0
add rax, r8
xor rax, rdx
imul rax, rax, 0x7be0
add rax, r8
xor rax, rcx
ret
Function at 0x1400041f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
test rcx, rcx
jne 0x140004232
mov rcx, qword [0x14000fa88]
lea r8, [0x1400101c0]
mov r9d, 0x200
mov edx, 0x80f6
call qword [sym.imp.USER32.dll_LoadStringW]
lea r9, [0x14000bf84]
jmp 0x1400042e7
lea r9, [rsp + 0x30]
mov r8, rbx
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
dec eax
cmp eax, 0x103
ja 0x1400042c5
mov rcx, rbx
call fcn.140006550
mov edi, eax
test eax, eax
je 0x14000428b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140004275
test al, 0x10
je 0x140004275
mov edx, 0x8112
jmp 0x1400042ca
mov edx, 1
mov ecx, edi
call fcn.1400065a0
test ax, ax
je 0x14000428b
movzx edx, ax
jmp 0x1400042ca
mov rcx, rbx
call fcn.140001b3c
test eax, eax
jns 0x1400042be
mov rcx, qword [0x14000fa88]
mov r9d, 0x200
lea r8, [0x1400101c0]
mov edx, 0x8116
cmp eax, 0x80040903
je 0x1400042de
mov edx, 0x8117
jmp 0x1400042de
mov eax, 1
jmp 0x140004301
mov edx, 0x80f6
mov rcx, qword [0x14000fa88]
lea r8, [0x1400101c0]
mov r9d, 0x200
call qword [sym.imp.USER32.dll_LoadStringW]
mov r9, rbx
lea r8, [0x1400101c0]
mov edx, 0x304
lea rcx, [0x14000fbb0]
call fcn.1400077d8
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140005ad0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x14000f008]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0x104
lea rax, [rsp + 0x38]
mov rcx, 0xffffffff80000001
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftOffice16.0OutlookPST
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
test eax, eax
jne 0x140005b93
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.LastCorruptStore
lea rax, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005b88
mov eax, dword [rsp + 0x30]
and rax, 0xfffffffffffffffe
add rax, 2
cmp rax, 0x20a
jae 0x140005bb6
lea r8, [rsp + 0x40]
mov word [rsp + rax + 0x40], di
mov edx, 0x3ec
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetDlgItemTextW]
lea eax, [rdi + 1]
jmp 0x140005b95
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400095c0
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret
call fcn.140009be8
int3
Function at 0x1400062f4
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x14000f008]
xor rax, rsp
mov qword [rbp + 0x37], rax
cmp dword [0x14000faa0], 0
mov rdi, rdx
mov rsi, rcx
je 0x1400064b1
mov rcx, qword [0x14000f9d0]
mov edx, 0x10
call qword [sym.imp.USER32.dll_GetWindowLongPtrA]
test rax, rax
je 0x140006359
mov r8, qword [rax + 0x10]
test r8, r8
je 0x140006359
lea rdx, [0x14000fa98]
mov rcx, rdi
call qword [sym.imp.USER32.dll_FillRect]
mov edx, 0x3f2
mov rcx, rsi
call qword [sym.imp.USER32.dll_GetDlgItem]
mov rcx, rax
lea rdx, [rbp - 9]
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowRect]
mov r9d, 2
lea r8, [rbp - 9]
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
movaps xmm0, xmmword [rbp - 9]
lea rdx, [rbp + 0x17]
mov r8d, 0x20
movdqa xmmword [rbp + 7], xmm0
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextA]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
lea edx, [r9 + 0x31]
call qword [sym.imp.USER32.dll_SendMessageA]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [0x14000faa0]
mov ebx, 6
cmp eax, dword [rbp - 9]
jl 0x140006441
lea ecx, [rbx - 4]
call qword [sym.imp.USER32.dll_GetSysColor]
mov edx, eax
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SetBkColor]
mov edx, 0xffffff
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [0x14000faa0]
lea rcx, [rbp + 0x17]
mov dword [rbp + 0xf], eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
and qword [rsp + 0x38], 0
mov r9d, ebx
mov r8d, dword [rbp - 5]
mov rcx, rdi
mov edx, dword [rbp - 9]
mov dword [rsp + 0x30], eax
lea rax, [rbp + 0x17]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
call qword [sym.imp.GDI32.dll_ExtTextOutA]
mov eax, dword [0x14000faa0]
cmp eax, dword [rbp - 1]
jge 0x1400064b1
mov ecx, 0xf
call qword [sym.imp.USER32.dll_GetSysColor]
mov edx, eax
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SetBkColor]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [0x14000faa0]
lea rcx, [rbp + 0x17]
inc eax
mov dword [rbp + 7], eax
mov eax, dword [rbp - 1]
mov dword [rbp + 0xf], eax
call qword [sym.imp.KERNEL32.dll_lstrlenA]
and qword [rsp + 0x38], 0
mov r9d, ebx
mov r8d, dword [rbp - 5]
mov rcx, rdi
mov edx, dword [rbp - 9]
mov dword [rsp + 0x30], eax
lea rax, [rbp + 0x17]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
call qword [sym.imp.GDI32.dll_ExtTextOutA]
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400095c0
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x140008850
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x14000f008]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rdx
mov r8, rcx
or rdi, 0xffffffffffffffff
lea rcx, [rsp + 0x20]
mov r9, rdi
mov edx, 0x104
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea edx, [rdi + 0x5d]
lea rcx, [rsp + 0x20]
call qword [sym.imp.VCRUNTIME140.dll_wcsrchr]
lea rdx, [rsp + 0x228]
mov r9, rdi
add rax, 2
mov r8, rbx
sub rdx, rax
mov rcx, rax
sar rdx, 1
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea rcx, [rsp + 0x20]
call fcn.1400087c8
xor ebx, ebx
mov rdi, rax
test rax, rax
je 0x1400088d3
mov eax, ebx
jmp 0x1400088d9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x1400108fc], eax
test rdi, rdi
je 0x1400088e8
mov eax, ebx
jmp 0x1400088f3
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [0x1400108f4], eax
cmp eax, 0xffffffff
jne 0x140008906
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [0x1400108f8], ebx
mov rax, rdi
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400095c0
mov rbx, qword [rsp + 0x260]
add rsp, 0x240
pop rdi
ret

Function at 0x140008930
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x14000f008]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor ebx, ebx
mov dword [rsp + 0x40], 0x208
lea rax, [rsp + 0x40]
mov rdi, rcx
mov qword [rsp + 0x30], rax
lea r8, str.CommonFilesDir
lea rax, [rsp + 0x50]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x28], rax
lea esi, [rbx + 2]
mov r9d, esi
mov qword [rsp + 0x20], rbx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1400089e3
cmp dword [rsp + 0x40], 4
jb 0x1400089e3
mov eax, dword [rsp + 0x40]
lea r8, str.Microsoft_SharedOffice16_
shr rax, 1
lea rcx, [rsp + 0x50]
mov edx, 0x104
cmp word [rsp + rax*2 + 0x4c], 0x5c
cmove ebx, esi
or r9, 0xffffffffffffffff
add r8, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.140008850
jmp 0x1400089e5
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400095c0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140008a0c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x14000f008]
xor rax, rsp
mov qword [rsp + 0x260], rax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x208
mov qword [rsp + 0x30], rax
lea rdx, str.SoftwareMicrosoftOffice16.0CommonFilesPaths
lea rax, [rsp + 0x50]
mov rbx, rcx
mov r8, rcx
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
mov r9d, 2
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140008a83
cmp dword [rsp + 0x40], 4
jb 0x140008a83
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140008850
jmp 0x140008a85
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400095c0
add rsp, 0x270
pop rbx
ret
Function at 0x14000a030
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000a07a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000a07a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000a07a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000a07a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000a07a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000a07c
xor al, al
add rsp, 0x28
ret

Function at 0x14000a60c
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x14000a684
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x14000a684
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x14000a684
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x14000a678
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x14000a696
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x14000a666
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x14000a686
Function at 0x140001cd0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r9, rdx
test rdx, rdx
je 0x140001e7e
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140001e7e
movsxd r13, dword [rdx + 0x3c]
add r13, rdx
cmp dword [r13], 0x4550
jne 0x140001e7e
xor r10d, r10d
movzx r12d, r10w
cmp r10w, word [r13 + 6]
jae 0x140001e7e
lea r11, [0x140030250]
nop word [rax + rax]
movzx eax, r12w
lea rcx, [rax + rax*4]
lea r8, [rcx*8]
lea rdx, [r8 + r13]
mov eax, dword [rdx + 0x12c]
bt eax, 0x19
jb 0x140001e6f
bt eax, 0x1d
jae 0x140001e6f
mov rcx, r10
movzx eax, byte [r11 + rcx]
inc rcx
cmp al, byte [rdx + rcx + 0x107]
jne 0x140001e6f
cmp rcx, 6
jne 0x140001d71
mov r15d, dword [r8 + r13 + 0x114]
mov esi, r10d
mov r14d, dword [r8 + r13 + 0x110]
add r15, r9
test r14d, r14d
je 0x140001e6f
mov rbp, r15
nop
mov edi, r14d
lea rdx, str.48_B8_F8_FF_FF_FF_7F_00_00_00_48_23_C8_48_B8
mov ebx, r10d
sub edi, esi
je 0x140001e55
mov r11, rbp
movzx eax, byte [rdx]
cmp al, 0x20
jne 0x140001ddb
nop
movzx eax, byte [rdx + 1]
inc rdx
cmp al, 0x20
je 0x140001dd0
test al, al
je 0x140001e91
cmp byte [rdx], 0x3f
movzx r10d, byte [r11]
jne 0x140001df2
cmp byte [rdx + 1], 0x3f
je 0x140001e41
mov word [rsp + 0x58], 0
xor r8b, r8b
nop dword [rax]
movzx r9d, r8b
movzx eax, byte [r9 + rdx]
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x140001e15
sub al, 0x30
jmp 0x140001e1f
lea ecx, [rax - 0x41]
cmp cl, 5
ja 0x140001e52
sub al, 0x37
inc r8b
mov byte [rsp + r9 + 0x58], al
cmp r8b, 2
jb 0x140001e00
movzx ecx, byte [rsp + 0x58]
movzx eax, byte [rsp + 0x59]
shl ecx, 4
or ecx, eax
cmp ecx, r10d
jne 0x140001e52
inc ebx
inc r11
add rdx, 2
cmp ebx, edi
jb 0x140001dc8
xor r10d, r10d
inc esi
inc rbp
cmp esi, r14d
jb 0x140001db0
mov r9, qword [rsp + 0x48]
lea r11, [0x140030250]
inc r12w
cmp r12w, word [r13 + 6]
jb 0x140001d40
xor al, al
mov rbx, qword [rsp + 0x50]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov eax, esi
add rax, r15
mov qword [rcx], rax
mov al, 1
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x140008f9e
Capabilities:
Packed with generic packer

Disassembly:
sets dl
mov rdx, qword [rsp + 0x20]
cmp r14, 0x284f7f4f
seta bl
mov bx, 0x3eb5
sub qword [rsp + 0x30], r14
add byte [rsp + 0x30], bl
mov rbx, qword [rsp + 0x28]
not byte [rsp + 0x30]
test r14b, r14b
jne 0x14003f1fb
mov r14, qword [rsp + 0x48]
not dword [rsp + 0x30]
neg byte [rsp + 0x30]
mov byte [rsp + 0x30], 0xc2
test byte [rsp + 0x30], 0xe0
mov qword [rsp + 0x30], 0x77943362
jno 0x140170773
jg 0x14019ed02
lea rdi, [r10 + rdi*8 + 0x3cad7d4d]
call fcn.1401c1bd3
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x68]
ret
call fcn.140201cad
Function at 0x14001c0c4
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0xdeac
cmp ecx, eax
ja 0x14001c11c
je 0x14001c113
mov eax, 0xc433
cmp ecx, eax
ja 0x14001c0f7
je 0x14001c113
mov eax, ecx
sub eax, 0x2a
je 0x14001c113
sub eax, 0xc402
je 0x14001c113
sub eax, 1
je 0x14001c113
sub eax, 1
je 0x14001c113
cmp eax, 3
jmp 0x14001c111
mov eax, ecx
sub eax, 0xc435
je 0x14001c113
sub eax, 0x1263
je 0x14001c14f
sub eax, 0x812
je 0x14001c113
cmp eax, 1
jne 0x14001c115
xor edx, edx
call fcn.1401da2d9
movabs byte [0x740000dead2dc18b], al
out dx, al
mov eax, ecx
sub eax, 0xdead
je 0x14001c113
sub eax, 1
je 0x14001c113
sub eax, 1
je 0x14001c113
sub eax, 1
je 0x14001c113
sub eax, 1
je 0x14001c113
sub eax, 1
je 0x14001c113
sub eax, 1
je 0x14001c113
sub eax, 0x1f35
je 0x14001c113
cmp eax, 1
jne 0x14001c115
and edx, 8
jmp 0x14001c115

Function at 0x140023a40
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140023a68
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140023a68
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x14009f37f
Capabilities:
Encode data using xor

Disassembly:
add dword [rsp + 0x38], r13d
xchg qword [rsp + r13 - 0x69feaa41], rdi
and r13, qword [rsp + 0x38]
sub word [rsp + 0x38], 0xfa6
or qword [rsp + 0x38], 0x43807d78
xor r13b, dl
add dx, dx
mov rdx, qword [rsp + 0x18]
add word [rsp + 0x38], 0x311c
or word [rsp + 0x38], 0x2640
add qword [rsp + 0x30], 0xb114f
cmp dword [rsp + 0x38], 0x48887c10
call fcn.1401f095d
stosd dword [rdi], eax
xor bl, byte [rbx - 0x521e5a3a]
sub byte [rbx], dl
out 0xa0, eax
jns 0x14009f39b
and al, 0x38
js 0x14009f41c
add byte [rbx + 0x44], 0x32
invalid
in al, dx
adc r14, 0xffffffffffffffec
mov ebx, 0x13420f9f
push rcx
invalid
xchg ebp, eax
adc ebp, dword ds:[rdx + 0x133a6ff4]
movabs byte [0x337af41cecc39f92], al
adc ebx, edx
sub ebp, ebp
cmp dword [rbx], edx
test dword [rcx], eax
sub byte [rcx], ch
adc edi, dword [rdi - 0x134003c8]
xchg esi, eax
xchg ebp, eax
invalid
mov al, byte [rbx + 0x13]
mov ecx, 0x13285856
mov al, 0xde
jle 0x14009f3f4
in al, dx
xor ah, al
adc byte [rdi], bh
adc edi, dword [rdx]
push 0x7b
xor edx, dword [rbx]
jno 0x14009f47b
invalid
xchg esi, eax
invalid

Function at 0x1400e67ee
Capabilities:
Encode data using xor

Disassembly:
stosd dword [rdi], eax
scasb al, byte [rdi]
mov word [rax - 0x18], gs
invalid
neg qword [rsp + 0x18]
mov qword [rsp + 0x18], 0x7182e08
not byte [rsp + 0x18]
xor word [rsp + 0x18], 0x5b76
push qword [rsp + 0x20]
popfq
lea rsp, [rsp + 0x38]
call fcn.140254b95
movsb byte [rdi], byte [rsi]
add eax, 0x2756b7ae
cdq
rol dword [rdi + 0x55], cl
pop rdx
cmp cl, byte [rcx]
loope 0x1400e67e4
sbb bl, byte [rax + rcx*2]
sub eax, 0xb8769987
mov ch, 0x8c
and dword [rbp + 0x6312eeb7], edi
or dword [rax - 0x48], eax
test eax, 0x1a48008b
rcl dword [rax + rdx]
mov eax, 0xdc6bc0a
pop rdi
insd dword [rdi], dx
sbb al, 0xe
xor sil, bl
cwde
and byte [rax - 0x5c47967], bh
mov bh, 0xc
xor bl, byte [rbx]
out dx, eax
mov bh, 0x30
mov ebx, 0x41478598
enter 0x4e20, 0x48
adc bh, byte [rsi]
invalid