joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400077d0
Capabilities:
Create directory
Get disk information
Query environment variable

Disassembly:
push rdi
mov eax, 0x4040
call fcn.14000bb70
sub rsp, rax
mov rax, qword [0x14003e040]
xor rax, rsp
mov qword [rsp + 0x4030], rax
xor r8d, r8d
xor edx, edx
call fcn.1400086b0
mov rdi, rax
test rax, rax
jne 0x140007816
lea rcx, str.LOADER:_failed_to_convert_runtime_tmpdir_to_a_wide_string._n
call fcn.1400026c0
xor eax, eax
jmp 0x140007997
mov r8d, 0x1000
mov qword [rsp + 0x4058], rbx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rdi
mov ebx, eax
call fcn.14001415c
test ebx, ebx
jne 0x140007853
lea rcx, str.LOADER:_failed_to_expand_environment_variables_in_the_runtime_tmpdir._n
call fcn.1400026c0
xor eax, eax
jmp 0x14000798f
lea rcx, [rsp + 0x30]
call fcn.140008520
test eax, eax
je 0x1400078bf
cmp word [rsp + 0x34], 0x5c
je 0x140007885
lea rcx, [rsp + 0x30]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140007872
mov eax, dword [0x14002d490]
mov dword [rcx], eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jg 0x1400078b0
mov r8d, eax
lea rdx, [rsp + 0x30]
lea rcx, str.LOADER:_runtime_tmpdir_points_to_non_existent_drive__ls__type:__d___n
call fcn.1400026c0
xor eax, eax
jmp 0x14000798f
lea rcx, [rsp + 0x30]
call fcn.140016c7c
jmp 0x14000798f
mov r8d, 0x1000
lea rdx, [rsp + 0x30]
xor ecx, ecx
call fcn.140017118
mov rbx, rax
test rax, rax
jne 0x1400078ec
lea rcx, str.LOADER:_failed_to_obtain_the_absolute_path_of_the_runtime_tmpdir._n
call fcn.1400026c0
xor eax, eax
jmp 0x14000798f
mov edx, 0x5c
mov rcx, rbx
call fcn.14000c8f0
mov rdi, rax
test rax, rax
je 0x14000794e
mov r9, rdi
mov qword [rsp + 0x20], rbx
sub r9, rbx
lea r8, [0x14002d5b8]
sar r9, 1
lea rcx, [rsp + 0x2030]
mov edx, 0x1000
call fcn.140002590
xor edx, edx
lea rcx, [rsp + 0x2030]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, 0x5c
lea rcx, [rdi + 2]
call fcn.14000c8f0
mov rdi, rax
test rax, rax
jne 0x140007901
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000798c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14000798c
mov r8, rbx
lea rdx, str.LOADER:_failed_to_create_runtime_tmpdir_path__ls__n
lea rcx, str.CreateDirectory
call fcn.1400029e0
mov rcx, rbx
call fcn.14001415c
xor eax, eax
jmp 0x14000798f
mov rax, rbx
mov rbx, qword [rsp + 0x4058]
mov rcx, qword [rsp + 0x4030]
xor rcx, rsp
call fcn.14000b870
add rsp, 0x4040
pop rdi
ret
Function at 0x14007004c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x140055a36
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x140055a19
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x140055a04

Function at 0x140070060
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x140055a6e
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x140055a51
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x140055a3c

Function at 0x14008cfe0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14008cd68
Function at 0x1400ce91c
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400ce932
mov al, 1
jmp 0x1400ce992
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400ce943
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400ce990
mov ecx, dword [rcx + 0x18]
nop
call fcn.1400db5f0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400ce990
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400ce990
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400ce990
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400ce992
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x1400d9c48
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1400d9c78
xor eax, eax
jmp 0x1400d9d3b
mov rbp, rbx
cmp word [rax], si
je 0x1400d9c9d
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1400d9c84
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1400d9c80
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1400d5da4
movsxd r14, eax
test eax, eax
jne 0x1400d9cdb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1400d9c71
mov rcx, r14
call fcn.1400d0b18
mov rdi, rax
test rax, rax
jne 0x1400d9cf4
xor ecx, ecx
call fcn.1400cca88
jmp 0x1400d9cd0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1400d5da4
test eax, eax
jne 0x1400d9d25
mov rcx, rdi
call fcn.1400cca88
jmp 0x1400d9d2f
xor ecx, ecx
call fcn.1400cca88
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x1400d9d58
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400d9ddf
mov rsi, rbx
cmp word [rax], bp
je 0x1400d9d9e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1400d9d88
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1400d9d84
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.1400d0b18
mov rdi, rax
test rax, rax
je 0x1400d9dcc
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14007ea80
mov rbp, rdi
xor ecx, ecx
call fcn.1400cca88
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400de0a8
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1400cb914
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1400de149
cmp ebx, dword [rsp + 0x30]
je 0x1400de142
test esi, esi
je 0x1400de142
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x1400de11d
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1400de12a
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x1400de107
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x1400de12e
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1400de14b
mov eax, 1
jmp 0x1400de14b
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400e10b4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x1402aa480]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x1400e110b
cmp word [rdx], r13w
jne 0x1400e110b
or byte [rax + rdi*8 + 0x38], cl
jmp 0x1400e1110
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x1400e1235
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x1400e1256
lea r9, [rdx + 2]
cmp cx, r11w
je 0x1400e1149
mov rdx, r9
mov word [rbx], cx
jmp 0x1400e1170
cmp r9, r8
jae 0x1400e1180
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x1400e112a
jmp 0x1400e1235
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400e122a
cmp dword [rsp + 0x80], esi
je 0x1400e122a
lea r8, [0x1402aa480]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x1400e1202
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x1400e11d2
mov word [rbx], r13w
jmp 0x1400e1232
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x1400e11df
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x1400e1232
cmp word [rsp + 0x70], r13w
jne 0x1400e120f
cmp rbx, r14
je 0x1400e11cc
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.1400e0250
cmp word [rsp + 0x70], r13w
je 0x1400e1235
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1402aa480]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x1400e122f
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x1400e1235
Function at 0x1400e890c
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1400e0250
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1400e0250
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x1400e8a5c
cmp rax, 0xffffffffffffffff
je 0x1400e8a5c
xor edi, edi
test rbp, rbp
jle 0x1400e8a07
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400d0b78
mov rbx, rax
test rax, rax
jne 0x1400e8994
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1400e89fd
mov edx, 0x8000
mov ecx, r14d
call fcn.1400c7770
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1400ce288
cmp eax, 0xffffffff
je 0x1400e89dd
cdqe
sub rbp, rax
test rbp, rbp
jg 0x1400e89a4
mov edx, r15d
mov ecx, r14d
call fcn.1400c7770
jmp 0x1400e89fd
cmp byte [rsi + 0x38], dil
je 0x1400e89f4
cmp dword [rsi + 0x34], 5
jne 0x1400e89f4
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1400e89fd
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.1400cca88
jmp 0x1400e8a70
jns 0x1400e8a70
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1400e0250
cmp rax, 0xffffffffffffffff
jne 0x1400e8a28
cmp byte [rsi + 0x30], dil
je 0x1400e8a70
mov edi, dword [rsi + 0x2c]
jmp 0x1400e8a70
mov ecx, r14d
call fcn.1400db5f0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1400e8a70
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x1400e8a70
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x1400e8a69
mov eax, dword [rsi + 0x2c]
jmp 0x1400e8a6e
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1400e0250
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1400f5cc8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
push r15
sub rsp, 0x20
mov r13d, pe_nt_image_headers64
mov r14, rdx
mov ecx, r13d
xor edi, edi
call fcn.14007c318
mov rcx, rax
mov rbx, rax
lea rdx, [rax + 0x100]
call fcn.14004aea4
xor eax, eax
mov rcx, rbx
mov byte [rcx], al
inc eax
inc rcx
cmp eax, r13d
jl 0x1400f5d0f
mov r11, qword [0x1402aaa58]
xor r8d, r8d
mov rcx, qword [0x1402aaa50]
xor r9d, r9d
sub r11, rcx
mov r10, rbx
xor esi, esi
mov rbp, r13
movzx r15d, byte [r10]
xor edx, edx
mov rax, rsi
div r11
movzx eax, byte [rdx + rcx]
mov edx, 0xffffff00
add edi, eax
add edi, r15d
and edi, 0x800000ff
jge 0x1400f5d62
dec edi
or edi, edx
inc edi
movsxd rcx, edi
inc rsi
mov al, byte [rcx + rbx]
mov byte [r10], al
inc r10
mov byte [rcx + rbx], r15b
sub rbp, 1
je 0x1400f5d84
mov rcx, qword [0x1402aaa50]
jmp 0x1400f5d3a
mov edi, 0x49e00
inc r8d
mov ecx, 0x800000ff
and r8d, ecx
jge 0x1400f5d9f
dec r8d
or r8d, edx
inc r8d
movsxd r10, r8d
movzx r11d, byte [r10 + rbx]
add r9d, r11d
and r9d, ecx
jge 0x1400f5db8
dec r9d
or r9d, edx
inc r9d
movsxd rcx, r9d
mov al, byte [rcx + rbx]
mov byte [r10 + rbx], al
mov byte [rcx + rbx], r11b
movzx ecx, byte [r10 + rbx]
add rcx, r11
movzx eax, cl
mov cl, byte [rax + rbx]
xor byte [r14], cl
inc r14
sub rdi, 1
jne 0x1400f5d89
test rbx, rbx
je 0x1400f5df0
mov rdx, r13
mov rcx, rbx
call fcn.14007c798
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
ret
Function at 0x140001ad0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140042760]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rcx
mov qword [rbp - 0x39], rcx
add rcx, 0xe0
call fcn.14000bc20
nop
xor edx, edx
mov rcx, rdi
call fcn.14000ca00
nop
lea rax, [0x14002add0]
mov qword [rdi], rax
lea rsi, [rdi + 0x1a0]
mov qword [rsi + 0x18], 0xf
xor r15d, r15d
mov qword [rsi + 0x10], r15
cmp qword [rsi + 0x18], 0x10
jb 0x140001b50
mov rax, qword [rsi]
jmp 0x140001b53
mov rax, rsi
mov byte [rax], r15b
lea rbx, [rdi + 0x1c0]
mov qword [rbp - 0x49], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov rcx, rbx
call fcn.140003cf0
mov qword [rbx], rax
lea rbx, [rdi + 0x1d0]
mov qword [rbp - 0x49], rbx
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r15
mov qword [rbx + 0x20], r15
mov ecx, 0x10
call fcn.14000f518
test rax, rax
jne 0x140001ba6
call fcn.140013a30
int3
mov qword [rbx], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov rax, qword [rbx]
mov qword [rax], rbx
lea rcx, [rdi + 0x1f8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
lea rcx, [rdi + 0xe8]
mov r8d, 8
lea rdx, str.ACE_BOOT
call fcn.1400052e0
mov dword [rbp - 0x29], 0x6c0047
mov dword [rbp - 0x25], 0x62006f
mov dword [rbp - 0x21], 0x6c0061
mov dword [rbp - 0x1d], 0x7b005c
mov dword [rbp - 0x19], 0x370041
mov dword [rbp - 0x15], 0x340042
mov dword [rbp - 0x11], 0x430035
mov dword [rbp - 0xd], 0x360034
mov dword [rbp - 9], 0x38002d
mov dword [rbp - 5], 0x350043
mov dword [rbp - 1], 0x2d0035
mov dword [rbp + 3], 0x460034
mov dword [rbp + 7], 0x410042
mov dword [rbp + 0xb], 0x39002d
mov dword [rbp + 0xf], 0x430045
mov dword [rbp + 0x13], 0x2d0045
mov dword [rbp + 0x17], 0x350035
mov dword [rbp + 0x1b], 0x340036
mov dword [rbp + 0x1f], 0x460031
mov dword [rbp + 0x23], 0x300043
mov dword [rbp + 0x27], 0x330035
mov dword [rbp + 0x2b], 0x440039
mov dword [rbp + 0x2f], 0x7d
lea rcx, [rdi + 0x108]
mov r9, qword [rcx + 0x18]
cmp r9, 8
jb 0x140001c93
mov rdx, qword [rcx]
jmp 0x140001c96
mov rdx, rcx
mov rax, qword [rcx + 0x10]
lea r8, [rdx + rax*2]
cmp r9, 8
jb 0x140001ca9
mov rdx, qword [rcx]
jmp 0x140001cac
mov rdx, rcx
lea rax, [rbp + 0x33]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x29]
call fcn.140006b10
mov dword [rdi + 0x128], 0x809
mov dword [rdi + 0x130], 0x80d
mov dword [rdi + 0x12c], 0x80b
mov dword [rdi + 0x138], 0x6b17d2d1
mov dword [rdi + 0x13c], 0x1343bed
mov dword [rdi + 0x140], 0xf
mov dword [rdi + 0x144], 3
mov dword [rdi + 0x148], 0x966
mov dword [rdi + 0x14c], 0x3443
lea rcx, [rdi + 0x150]
xor edx, edx
lea r8d, [rdx + 0x50]
call fcn.140012bb0
mov r8d, 8
lea rdx, [0x14002ae10]
mov rcx, rsi
call fcn.140005070
mov word [rdi + 0x220], 0
mov rax, rdi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14000fc20
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14000cb90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
xor dil, dil
mov rsi, rdx
mov rbx, rcx
cmp byte [rcx + 9], dil
je 0x14000cbb6
mov dil, 1
jmp 0x14000cc3f
mov qword [rsp + 0x50], r14
lea r8, [0x14000ccf0]
lea r14, [rcx + 0x18]
mov r9, rbx
mov qword [rsp + 0x28], r14
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.1400153bc
mov qword [rbx + 0x10], rax
test rax, rax
je 0x14000cc3a
test rsi, rsi
je 0x14000cbf2
mov eax, dword [r14]
mov dword [rsi], eax
lea rcx, [rbx + 0x20]
call fcn.14000c8c0
lea rcx, [rbx + 0x50]
mov qword [rsp + 0x30], rax
call fcn.14000c8c0
xor r8d, r8d
mov qword [rsp + 0x38], rax
or r9d, 0xffffffff
lea rdx, [rsp + 0x30]
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
jne 0x14000cc31
mov byte [rbx + 9], 1
mov dil, 1
jmp 0x14000cc3a
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx + 0x10]
mov r14, qword [rsp + 0x50]
lea rcx, [rbx + 0xb0]
call fcn.14000c9d0
mov rbx, qword [rsp + 0x58]
movzx eax, dil
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14000cc70
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 9], 0
mov rbx, rcx
je 0x14000ccdb
sub rcx, 0xffffffffffffff80
mov qword [rsp + 0x30], rdi
call fcn.14000c9d0
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14000ccc6
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000ccb4
mov rcx, qword [rbx + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], 0
lea rcx, [rbx + 0x80]
call fcn.14000c9a0
mov rdi, qword [rsp + 0x30]
mov byte [rbx + 9], 0
add rsp, 0x20
pop rbx
ret
Function at 0x14000dd70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x110
mov rax, qword [0x140042760]
xor rax, rsp
mov qword [rsp + 0x100], rax
xor r10d, r10d
mov edi, edx
mov r11d, r10d
lea rbx, [rsp]
mov r9, rcx
nop
mov eax, r11d
and eax, 0x80000007
jge 0x14000ddb1
dec eax
or eax, 0xfffffff8
inc eax
shl eax, 3
mov rdx, r8
movzx ecx, al
shr rdx, cl
xor dl, r11b
inc r11d
mov byte [rbx], dl
inc rbx
cmp r11d, 0x100
jl 0x14000dda0
test r9, r9
je 0x14000ddf9
cmp edi, 1
jb 0x14000ddf9
mov rdx, rdi
nop
movzx eax, r10b
lea r9, [r9 + 1]
inc r10
movzx ecx, byte [rsp + rax]
xor byte [r9 - 1], cl
sub rdx, 1
jne 0x14000dde0
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.14000fc20
mov rbx, qword [rsp + 0x128]
add rsp, 0x110
pop rdi
ret

Function at 0x14001a694
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14001a468
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001a468
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001a468
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001a468
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001a468
cmp dword [rcx + 0x84], 0xe
jbe 0x14001a468
cmp dword [rcx + 0xf8], esi
je 0x14001a468
mov ecx, r14d
call fcn.14001a5b0
mov ecx, 2
call fcn.140016b58
nop
cmp byte [0x140044bb8], 0
jne 0x14001a532
mov r15d, 1
mov eax, r15d
xchg dword [0x140044ba8], eax
test ebx, ebx
jne 0x14001a4db
mov rdi, qword [0x140042760]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140044bb0]
cmp rcx, rax
je 0x14001a4d2
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.1400082f0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x140044ce8]
jmp 0x14001a4e7
cmp ebx, r15d
jne 0x14001a4ed
lea rcx, [0x140044d00]
call fcn.14001b024
nop
test ebx, ebx
jne 0x14001a504
lea rdx, [0x14002a508]
lea rcx, [0x14002a4e8]
call fcn.14001b360
lea rdx, [0x14002a518]
lea rcx, [0x14002a510]
call fcn.14001b360
movzx eax, byte [0x140044bb8]
test esi, esi
cmove eax, r15d
mov byte [0x140044bb8], al
jmp 0x14001a532
mov ecx, 2
call fcn.140016bac
test esi, esi
jne 0x14001a549
mov ecx, r14d
call fcn.14001a564
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14001a3f8
Function at 0x140155beb
Capabilities:
Authenticate hmac

Disassembly:
lea r11, [rdi + r11 - 0x2c1d0290]
mov eax, dword [rdi + r11 - 0x2c1d028c]
movsx edx, dil
mov qword [rsp + rdi*2 - 0x583a0518], rdi
xor eax, esi
rol eax, 1
call fcn.1402b9499
movzx edx, word [rax + r11 - 0x176bfffe]
lea r8, [rcx + rbx*4 - 0x767ed9cb]
lea r11, [r11 + rax*2 - 0x2ed7fffa]
or rax, r8
inc r8
sbb r8, 0x15906c1c
xor dx, r10w
lea rbx, [rbp*4 + 0x3eb92582]
neg sil
adc dx, 0x3836
dec eax
xor dx, 0xc881
call fcn.1401aa891
setae dl
bswap ebp
dec ebp
movzx r8d, cx
xor ebp, 0x55110220
mov ebx, 0x98980597
sal r8, 0x4f
neg ebp
and ebx, eax
cwde
push r11
xor dword [rsp + rcx*2 - 0x4f2f8452], ebp
pop r11
or cl, bh
sar r8b, 0x23
neg sil
movsxd rbp, ebp
bts r8w, ax
jae 0x1402e3388
ror cl, 0x21
add r9, rbp
inc bl
mov ebp, dword [rcx + r10 - 0x2797c294]
mov cl, byte [r10 + rax*4 - 0x14e0c]
sar rbx, 0x8f
seta bl
lea r10, [rax + r10 - 0x5382]
cmovb r8w, si
adc r8b, sil
shr ebp, cl
not rdx
xchg si, dx
xchg ebx, esi
mov dword [rsi + r10], ebp
inc rbx
add rsi, r9
jmp rsi

Function at 0x140155c97
Capabilities:
Authenticate hmac

Disassembly:
jnp 0x140190d8e
mul sil
xor dword [rsp + rsi - 0x4eb746d6], r11d
mov r9, qword [rsp + rdi - 0x4eb74696]
mov qword [rsp + rcx - 0x4c39ce94], 0x543cf09f
cqo
movsxd r11, r11d
sub al, 0x34
add r10, r11
mov qword [rsp + rsi - 0x4eb746e6], r10
ret 0x10

Function at 0x140164839
Capabilities:
Authenticate hmac

Disassembly:
mov qword [rsp + rcx - 0x18], rcx
cqo
lea r11d, [rcx + r11 - 0x4684cdb2]
movzx esi, al
xadd dword [rsp + rcx*2 - 0x30], ecx
jge 0x1401fa2ee
xchg word [rsp + rax - 0x481ee617], cx
xadd dword [rsp + rax - 0x481ee614], ecx
mov qword [rsp + rcx], r8
call fcn.1401c09a7
mov edx, 0xf99f02a2
mov ebp, dword [r11]
lea rcx, [rdx*8 - 0x33d75165]
mov ebx, 0x7096b30e
lea r11, [rbx + r11 - 0x7096b30a]
xor ebp, r10d
rol ebp, 3
ror edx, cl
shl edx, cl
inc ebp
neg ebp
movzx esi, dx
rol cl, 0xe7
rol ebp, 1
mov r8d, 0x9b9f6624
shr r8b, 0xa2
not ebp
and r8, rdx
bts bx, dx
adc r8, rdx
push r10
mov r10d, 0x7382002c
xor dword [rsp + rsi], ebp
btr rbx, 0x3b
pop r10
shl rsi, cl
push rbx
movsxd rbp, ebp
sub qword [rsp + rbx - 0x7096b30f], rbx
bts si, dx
or rsi, rsi
adc r9, rbp
xchg byte [rsp + rbx - 0x7096b30a], cl
mov rax, qword [rdi + rbx - 0x7096b30f]
push rdx
or qword [rsp + rsi*2 + 1], rbx
add r8b, byte [rbx + rdi - 0x7096b307]
lea rdi, [rbx + rdi - 0x7096b305]
mov byte ss:[rax + rbx - 0x7096b30f], r8b
call fcn.1401b63f2
not r11d
ja 0x1401947c9

Function at 0x140169ed3
Capabilities:
Authenticate hmac

Disassembly:
not r11w
inc rdi
xor cx, bp
mov word [rbx + rdi - 0x6dbcdc97], r11w
call fcn.140174874