joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1dc4e24e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
push rcx
emms
push r11
nop
push r8
nop
pop r8
pcmpeqd mm6, mm4
pop r11
sar cx, 0xb
pop rcx
mov eax, 2
push rcx
psrad mm3, 0x15
movaps xmm15, xmm3
psubusw mm2, mm7
neg rcx
punpckhbw mm4, mm0
pxor mm2, mm6
paddsw mm4, mm2
mulps xmm0, xmm8
nop
not rcx
nop
nop
pop rcx
push rax
inc eax
push r14
psraw mm0, 0x61
psubw mm3, mm0
push r10
add r10w, ax
psllq mm2, 0x61
cmp r14, rax
pop r10
pcmpeqw mm0, mm7
punpcklbw mm6, mm4
pop r14
nop
pop rax
dec eax
je 0x1dc4e2556
mov eax, 1
jmp 0x1dc4e2503
push r14
rcpps xmm4, xmm6
push r8
dec r14
sub r8b, r14b
push r10
inc r14
paddd mm5, mm7
packsswb mm5, mm6
push r12
pslld mm1, 0x61
emms
neg r8w
psadbw mm7, mm3
pop r12
not r8w
test r14w, r8w
nop
pop r10
mov r8b, 0x11
dec r14d
pop r8
nop
pop r14
mov rdx, qword [rsi + 8]
mov rcx, qword [rsi]
lea r9, [rsp + 0x20]
mov r8d, 0x40
call fcn.1dc4e36bb
mov dword [rsp + 0x2c], 0x6a
movabs rax, 0x6c0071007a002e
mov qword [rsp + 0x24], rax
push r14
not r14d
push rax
psraw mm2, 0x2f
push rbx
not r14b
pop rbx
sbb al, 0x15
pop rax
emms
pop r14
lea rbx, [rsp + 0x24]
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov rdx, rax
mov rax, rbx
cmp rdx, 2
lea rdx, [rsp + 0x2e]
jne 0x1dc4e264e
push rcx
mov rcx, 2
push r11
push r13
pop r13
pop r11
dec rcx
jne 0x1dc4e25ff
pop rcx
xor word [rax], 0x96
push r13
subps xmm14, xmm0
pmulhuw mm7, mm6
inc r13
pcmpgtw mm6, mm4
push r11
packssdw mm7, mm1
sar r13b, 7
nop
pslld mm1, 0x4f
pop r11
not r13d
emms
sub r13b, 0xb
psrlq mm2, 0x11
pop r13
add rax, 2
cmp rax, rdx
jne 0x1dc4e25f7
jmp 0x1dc4e26ef
push r14
mulss xmm4, xmm13
push rcx
ror rcx, 8
not ecx
push r11
psrlw mm7, 0x24
emms
pmaxsw mm2, mm4
push r12
rol r12b, 0xb
emms
neg r14w
nop
push rdx
rcl dl, 0xd
xorps xmm14, xmm2
dec r11
xor cx, r14w
inc rcx
pop rdx
xadd cl, r12b
nop
add r12, r14
movaps xmm13, xmm4
pop r12
sar rcx, 0x12
movaps xmm10, xmm12
movhlps xmm14, xmm3
pop r11
sbb ecx, r14d
dec r14
pop rcx
inc r14
pop r14
xor word [rax], 0x82
push r11
nop
psrad mm6, 0x58
inc r11d
push r13
inc r11
movhlps xmm8, xmm12
push r15
psraw mm3, 0x3d
pop r15
dec r11
psraw mm2, 0x6b
pop r13
emms
rol r11w, 0xc
nop
pop r11
add rax, 2
cmp rax, rdx
jne 0x1dc4e264e
push r10
pcmpeqd mm3, mm5
nop
nop
push rbx
adc rbx, r10
emms
movhlps xmm13, xmm5
push rax
packssdw mm4, mm6
andnps xmm7, xmm10
push r11
inc r11
nop
pop r11
emms
minps xmm0, xmm6
punpcklbw mm5, mm4
pop rax
test bl, r10b
not r10d
pop rbx
nop
emms
pop r10
call qword [rsi]
ret
Function at 0x1dc4e36bb
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov esi, r8d
mov rdi, r9
push r9
mov r9, 1
push r12
pop r12
dec r9
jne 0x1dc4e36d6
pop r9
movabs rax, 0x6c0071007a002e
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x44], rax
mov dword [rsp + 0x4c], 0x6a
push r14
not r14d
push rax
psraw mm2, 0x2f
push rbx
not r14b
pop rbx
sbb al, 0x15
pop rax
emms
pop r14
lea rbx, [rsp + 0x44]
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov rdx, rax
mov rax, rbx
cmp rdx, 2
lea rdx, [rsp + 0x4e]
jne 0x1dc4e3788
push rcx
mov rcx, 2
push r11
push r13
pop r13
pop r11
dec rcx
jne 0x1dc4e3739
pop rcx
xor word [rax], 0x96
push r13
subps xmm14, xmm0
pmulhuw mm7, mm6
inc r13
pcmpgtw mm6, mm4
push r11
packssdw mm7, mm1
sar r13b, 7
nop
pslld mm1, 0x4f
pop r11
not r13d
emms
sub r13b, 0xb
psrlq mm2, 0x11
pop r13
add rax, 2
cmp rax, rdx
jne 0x1dc4e3731
jmp 0x1dc4e3829
push r14
mulss xmm4, xmm13
push rcx
ror rcx, 8
not ecx
push r11
psrlw mm7, 0x24
emms
pmaxsw mm2, mm4
push r12
rol r12b, 0xb
emms
neg r14w
nop
push rdx
rcl dl, 0xd
xorps xmm14, xmm2
dec r11
xor cx, r14w
inc rcx
pop rdx
xadd cl, r12b
nop
add r12, r14
movaps xmm13, xmm4
pop r12
sar rcx, 0x12
movaps xmm10, xmm12
movhlps xmm14, xmm3
pop r11
sbb ecx, r14d
dec r14
pop rcx
inc r14
pop r14
xor word [rax], 0x82
push r11
nop
psrad mm6, 0x58
inc r11d
push r13
inc r11
movhlps xmm8, xmm12
push r15
psraw mm3, 0x3d
pop r15
dec r11
psraw mm2, 0x6b
pop r13
emms
rol r11w, 0xc
nop
pop r11
add rax, 2
cmp rax, rdx
jne 0x1dc4e3788
push r10
pcmpeqd mm3, mm5
nop
nop
push rbx
adc rbx, r10
emms
movhlps xmm13, xmm5
push rax
packssdw mm4, mm6
andnps xmm7, xmm10
push r11
inc r11
nop
pop r11
emms
minps xmm0, xmm6
punpcklbw mm5, mm4
pop rax
test bl, r10b
not r10d
pop rbx
nop
emms
pop r10
mov qword [rsp + 0x20], rdi
mov r9d, esi
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x70]
or rcx, 0xffffffffffffffff
call fcn.1dc4ecc3c
cmp dl, 0x16
jne 0x1dc4e3887
push r12
emms
pop r12
jmp 0x1dc4e388b
push rcx
emms
pop rcx
push r14
nop
pop r14
test eax, eax
jne 0x1dc4e38c9
push rax
paddsb mm3, mm5
push r14
not r14
push r8
shl r14b, 0x10
push r15
rcl rax, 0xc
push r11
emms
pop r11
movups xmm7, xmm5
pop r15
and r8d, r14d
pop r8
paddusb mm4, mm0
pop r14
por mm6, mm3
pop rax
mov eax, 1
jmp 0x1dc4e3912
push r13
neg r13w
ror r13d, 8
push r8
nop
nop
push rdx
not r13b
nop
push r12
nop
rcpss xmm4, xmm1
push r10
pslld mm4, 0x48
psubw mm6, mm0
pop r10
neg r8b
psrad mm1, 0x3d
pop r12
mov r13d, edx
rcpss xmm5, xmm11
pop rdx
rcpps xmm5, xmm11
or r8, r13
pop r8
rcl r13b, 6
nop
pop r13
xor eax, eax
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
Function at 0x1dc4eecae
Capabilities:
Hash data using murmur3

Disassembly:
push rax
psraw mm0, 0x10
addss xmm14, xmm13
push r11
psadbw mm5, mm4
psllq mm7, 0x60
push r8
rcl ax, 0xa
cmp al, r11b
push r12
shl r8, 0x15
sbb ax, 4
pop r12
nop
dec r8
pop r8
dec rax
psrlw mm7, 0x34
pop r11
ucomiss xmm7, xmm5
inc eax
pop rax
mov qword [rsp + 8], rcx
cmp dl, 0x10
jne 0x1dc4eed3b
push r14
rcr r14b, 4
push r13
psrlq mm6, 0x6a
push r12
pcmpgtd mm5, mm3
push rdx
adc r13d, r12d
push rax
nop
push r8
psraw mm1, 0x4e
pop r8
nop
pop rax
punpckhwd mm4, mm6
pop rdx
nop
pop r12
mov r13d, r14d
pop r13
pmulhuw mm2, mm6
pop r14
jmp 0x1dc4eed52
cmp dx, 0x4d
jne 0x1dc4eed48
push rbx
packuswb mm6, mm5
pop rbx
jmp 0x1dc4eed4d
push rax
not rax
pop rax
push rdx
pmulhuw mm1, mm7
pop rdx
push rax
neg al
push r9
xchg r9b, al
emms
push r14
emms
and r9, r14
emms
push r11
sub r11d, 0xd
pxor mm3, mm5
nop
sar r9w, 0x14
push rcx
adc r11, r9
emms
movlhps xmm13, xmm9
nop
sbb ecx, r11d
pop rcx
emms
neg rax
nop
neg r14w
pop r11
sub ax, r9w
pxor mm3, mm5
add r9, rax
pop r14
subss xmm5, xmm7
pmullw mm1, mm3
pop r9
sar al, 5
pop rax
mov qword [rsp + 0x10], rdx
push r14
rcpss xmm2, xmm6
mov r14w, 8
inc r14d
psrld mm5, 0x2f
sbb r14, 0xd
nop
pmaddwd mm0, mm4
nop
neg r14d
maxss xmm15, xmm13
nop
addps xmm11, xmm10
pop r14
mov qword [rsp + 0x18], r8
push r13
mov r13, 3
push r8
pop r8
dec r13
jne 0x1dc4eede5
pop r13
mov qword [rsp + 0x20], r9
push r15
shr r15w, 0x11
push r11
dec r15d
xadd r15d, r11d
push r9
sub r15, r11
not r15b
neg r11w
pop r9
psadbw mm6, mm3
pmullw mm3, mm1
pop r11
psubw mm0, mm6
pop r15
sub rsp, 0x64
push rbx
pminsw mm6, mm4
emms
dec ebx
push r8
adc r8, rbx
and rbx, r8
shr ebx, 0x14
push r15
psrad mm1, 0x6a
nop
cmp bl, r15b
pop r15
psraw mm2, 0x63
pcmpeqd mm3, mm5
xchg ebx, r8d
pop r8
not bx
neg bl
neg bl
pop rbx
movabs rcx, 0xcf99e145
cmp dl, r10b
jne 0x1dc4eee74
push rax
pslld mm7, 0x2d
pop rax
jmp 0x1dc4eee7b
push r13
inc r13d
pop r13
push r12
movss xmm1, xmm13
pop r12
call fcn.1dc4e7769
push r9
mov r9, 3
push r11
pop r11
dec r9
jne 0x1dc4eee92
pop r9
add rsp, 0x64
push r10
mov r10, 3
push r8
packuswb mm1, mm6
push rax
pcmpeqd mm6, mm1
push r15
nop
push rdx
nop
push rcx
emms
push r9
neg r8w
pop r9
adc r8d, eax
pop rcx
emms
pop rdx
emms
pop r15
sbb r8d, 0x17
pop rax
nop
pop r8
dec r10
jne 0x1dc4eeeaa
pop r10
mov rcx, qword [rsp + 8]
push rbx
sub bx, 0xd
push r15
emms
push r11
sub r15b, r11b
push rdx
not r11b
push r13
cmp r13b, bl
push r10
punpcklwd mm6, mm7
pop r10
emms
pop r13
pand mm5, mm2
pop rdx
emms
pop r11
psrlq mm6, 0x45
pop r15
dec ebx
pop rbx
mov rdx, qword [rsp + 0x10]
push r13
inc r13
push rbx
nop
pop rbx
rcl r13w, 0xe
pop r13
mov r8, qword [rsp + 0x18]
push rax
psllq mm5, 0xb
nop
nop
push r12
rol ax, 0xd
xorps xmm0, xmm8
addps xmm15, xmm8
push r14
emms
adc eax, r12d
mov al, r12b
pop r14
sar r12, 0xd
emms
rol al, 0xf
pop r12
nop
inc rax
psrlq mm1, 0x3b
pop rax
mov r9, qword [rsp + 0x20]
push r15
emms
psrld mm4, 0x55
not r15w
nop
neg r15d
push rax
nop
andnps xmm6, xmm1
psubw mm3, mm6
ror r15, 0x11
psraw mm7, 0x11
pop rax
packsswb mm5, mm0
punpckldq mm2, mm7
punpckldq mm0, mm3
maxss xmm4, xmm0
dec r15d
emms
pop r15
jmp rax
Function at 0x1dc4eff90
Capabilities:
Check for peb beingdebugged flag
Encode data using xor

Disassembly:
push r11
mov r11, 3
push r14
nop
maxps xmm10, xmm11
nop
xorps xmm15, xmm1
nop
push r13
sub r13d, r14d
punpcklwd mm3, mm2
por mm2, mm5
rcl r14w, 1
nop
pop r13
shr r14w, 0xb
pmaxub mm1, mm6
mov r14d, 6
psrld mm0, 0x1e
neg r14
neg r14
pop r14
dec r11
jne 0x1dc4eff99
pop r11
cmp dx, cx
jne 0x1dc4f0004
push r12
sub r12d, 0xd
push rax
xchg r12d, eax
dec rax
pop rax
not r12w
pop r12
jmp 0x1dc4f0018
push rdx
maxss xmm4, xmm9
push r8
emms
maxss xmm6, xmm15
pop r8
emms
pop rdx
push rbx
rcpss xmm11, xmm3
push r13
neg bl
not bl
pop r13
inc ebx
pop rbx
mov rax, qword gs:[0x60]
push rbx
nop
nop
pand mm5, mm6
push r15
emms
not rbx
xadd r15b, bl
push r13
pcmpeqb mm7, mm3
pxor mm6, mm0
rcr rbx, 6
pop r13
psrld mm7, 0x15
rcpss xmm10, xmm11
dec rbx
pop r15
pcmpgtb mm3, mm0
nop
psrad mm0, 0x69
pop rbx
movzx eax, byte [rax + 2]
mov dword [rcx], eax
push r9
mov r9, 2
push r15
pop r15
dec r9
jne 0x1dc4f0077
pop r9
ret
Function at 0x1dc4f1fbc
Capabilities:
Encode data using xor

Disassembly:
push rbx
nop
push r13
inc r13d
push r15
dec rbx
push r12
psrlw mm5, 0x57
push r9
not ebx
push r8
inc r15
push r14
emms
pop r14
nop
pop r8
adc ebx, r13d
pop r9
emms
pop r12
and r15b, bl
pop r15
emms
pop r13
shl rbx, 0x13
pop rbx
push r10
nop
push rbx
pmullw mm3, mm0
push r9
movlhps xmm13, xmm6
push rcx
not rcx
pop rcx
por mm0, mm3
pop r9
neg r10d
pop rbx
orps xmm8, xmm3
pop r10
push rbx
mov rbx, 1
push r12
nop
nop
psllq mm2, 0x5c
pslld mm0, 0x1f
nop
push r9
inc r9d
emms
neg r9w
pslld mm6, 0xf
push r15
pmulhuw mm0, mm2
movlhps xmm2, xmm1
nop
push r8
nop
nop
push r10
nop
pop r10
psraw mm3, 5
movaps xmm5, xmm11
pop r8
xor r9b, r15b
emms
paddsw mm6, mm0
pop r15
emms
rcpss xmm12, xmm15
dec r9
pxor mm6, mm0
pop r9
paddusw mm1, mm6
emms
emms
not r12w
rcpss xmm7, xmm12
pop r12
dec rbx
jne 0x1dc4f2020
pop rbx
push r9
psllq mm1, 0x3b
emms
push rbx
ror bx, 0x13
nop
push r15
nop
psllq mm0, 0x13
push rdx
adc r15d, edx
nop
pop rdx
pslld mm6, 0x29
subps xmm10, xmm7
pop r15
emms
and r9d, ebx
pop rbx
psrld mm3, 0xf
subss xmm6, xmm14
pop r9
ret
Function at 0x1dc4f5540
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
push rax
paddsb mm3, mm5
push r14
not r14
push r8
shl r14b, 0x10
push r15
rcl rax, 0xc
push r11
emms
pop r11
movups xmm7, xmm5
pop r15
and r8d, r14d
pop r8
paddusb mm4, mm0
pop r14
por mm6, mm3
pop rax
movsxd rdx, edx
test edx, edx
jle 0x1dc4f55ed
push r13
psraw mm2, 0x59
dec r13
paddsw mm6, mm3
mov r13d, 0x12
psraw mm3, 0x36
emms
punpckldq mm6, mm1
psrld mm3, 0x54
dec r13
ucomiss xmm13, xmm5
psrlq mm3, 0x69
pslld mm6, 0x49
pop r13
cmp word [rcx + rdx*2 - 2], 0x5c
lea rax, [rdx - 1]
jne 0x1dc4f55e8
mov ebx, edx
push rax
paddb mm1, mm2
nop
dec rax
mulps xmm15, xmm12
psrlw mm2, 0x55
not rax
inc eax
psrld mm6, 0x16
ror al, 0x15
nop
movhlps xmm13, xmm5
xorps xmm4, xmm13
pop rax
call fcn.1dc4f1fbc
jmp 0x1dc4f5768
mov rdx, rax
jmp 0x1dc4f5576
movabs rax, 0x6c0071007a002e
mov dword [rsp + 0x2c], 0x6a
mov qword [rsp + 0x24], rax
push r14
not r14d
push rax
psraw mm2, 0x2f
push rbx
not r14b
pop rbx
sbb al, 0x15
pop rax
emms
pop r14
lea rbx, [rsp + 0x24]
mov rcx, rbx
call sub.msvcrt.dll_wcslen
mov rdx, rax
mov rax, rbx
cmp rdx, 2
lea rdx, [rsp + 0x2e]
jne 0x1dc4f568f
push rcx
mov rcx, 2
push r11
push r13
pop r13
pop r11
dec rcx
jne 0x1dc4f5640
pop rcx
xor word [rax], 0x96
push r13
subps xmm14, xmm0
pmulhuw mm7, mm6
inc r13
pcmpgtw mm6, mm4
push r11
packssdw mm7, mm1
sar r13b, 7
nop
pslld mm1, 0x4f
pop r11
not r13d
emms
sub r13b, 0xb
psrlq mm2, 0x11
pop r13
add rax, 2
cmp rax, rdx
jne 0x1dc4f5638
jmp 0x1dc4f5730
push r14
mulss xmm4, xmm13
push rcx
ror rcx, 8
not ecx
push r11
psrlw mm7, 0x24
emms
pmaxsw mm2, mm4
push r12
rol r12b, 0xb
emms
neg r14w
nop
push rdx
rcl dl, 0xd
xorps xmm14, xmm2
dec r11
xor cx, r14w
inc rcx
pop rdx
xadd cl, r12b
nop
add r12, r14
movaps xmm13, xmm4
pop r12
sar rcx, 0x12
movaps xmm10, xmm12
movhlps xmm14, xmm3
pop r11
sbb ecx, r14d
dec r14
pop rcx
inc r14
pop r14
xor word [rax], 0x82
push r11
nop
psrad mm6, 0x58
inc r11d
push r13
inc r11
movhlps xmm8, xmm12
push r15
psraw mm3, 0x3d
pop r15
dec r11
psraw mm2, 0x6b
pop r13
emms
rol r11w, 0xc
nop
pop r11
add rax, 2
cmp rax, rdx
jne 0x1dc4f568f
push r10
pcmpeqd mm3, mm5
nop
nop
push rbx
adc rbx, r10
emms
movhlps xmm13, xmm5
push rax
packssdw mm4, mm6
andnps xmm7, xmm10
push r11
inc r11
nop
pop r11
emms
minps xmm0, xmm6
punpcklbw mm5, mm4
pop rax
test bl, r10b
not r10d
pop rbx
nop
emms
pop r10
xor ebx, ebx
mov eax, ebx
add rsp, 0x30
pop rbx
ret
Function at 0x1dc4f6d34
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x38
cmp dl, cl
jne 0x1dc4f6d58
push r15
rcpps xmm4, xmm8
push r14
pmaddwd mm7, mm5
psllq mm4, 0x62
pop r14
movss xmm3, xmm8
pop r15
jmp 0x1dc4f6d65
push r12
nop
push rcx
emms
emms
pop rcx
emms
pop r12
push rbx
psrld mm1, 0x50
push r8
dec ebx
movups xmm13, xmm5
pop r8
sbb rbx, 0x11
pop rbx
push r12
inc r12d
push r10
movups xmm5, xmm0
pop r10
emms
pop r12
rdtsc
push r15
emms
nop
neg r15
nop
nop
movlhps xmm10, xmm9
psllq mm0, 0x2e
punpcklwd mm7, mm1
nop
neg r15d
sar r15d, 0x14
not r15w
pop r15
shl rdx, 0x20
mov eax, eax
mov dword [rsp + 0x2c], 0x6a
mov rbx, rdx
or rbx, rax
movabs rax, 0x6c0071007a002e
mov qword [rsp + 0x24], rax
push r14
not r14d
push rax
psraw mm2, 0x2f
push rbx
not r14b
pop rbx
sbb al, 0x15
pop rax
emms
pop r14
lea rsi, [rsp + 0x24]
mov rcx, rsi
call sub.msvcrt.dll_wcslen
mov rdx, rax
mov rax, rsi
cmp rdx, 2
lea rdx, [rsp + 0x2e]
jne 0x1dc4f6e5c
push rcx
mov rcx, 2
push r11
push r13
pop r13
pop r11
dec rcx
jne 0x1dc4f6e0d
pop rcx
xor word [rax], 0x96
push r13
subps xmm14, xmm0
pmulhuw mm7, mm6
inc r13
pcmpgtw mm6, mm4
push r11
packssdw mm7, mm1
sar r13b, 7
nop
pslld mm1, 0x4f
pop r11
not r13d
emms
sub r13b, 0xb
psrlq mm2, 0x11
pop r13
add rax, 2
cmp rax, rdx
jne 0x1dc4f6e05
jmp 0x1dc4f6efd
push r14
mulss xmm4, xmm13
push rcx
ror rcx, 8
not ecx
push r11
psrlw mm7, 0x24
emms
pmaxsw mm2, mm4
push r12
rol r12b, 0xb
emms
neg r14w
nop
push rdx
rcl dl, 0xd
xorps xmm14, xmm2
dec r11
xor cx, r14w
inc rcx
pop rdx
xadd cl, r12b
nop
add r12, r14
movaps xmm13, xmm4
pop r12
sar rcx, 0x12
movaps xmm10, xmm12
movhlps xmm14, xmm3
pop r11
sbb ecx, r14d
dec r14
pop rcx
inc r14
pop r14
xor word [rax], 0x82
push r11
nop
psrad mm6, 0x58
inc r11d
push r13
inc r11
movhlps xmm8, xmm12
push r15
psraw mm3, 0x3d
pop r15
dec r11
psraw mm2, 0x6b
pop r13
emms
rol r11w, 0xc
nop
pop r11
add rax, 2
cmp rax, rdx
jne 0x1dc4f6e5c
push r10
pcmpeqd mm3, mm5
nop
nop
push rbx
adc rbx, r10
emms
movhlps xmm13, xmm5
push rax
packssdw mm4, mm6
andnps xmm7, xmm10
push r11
inc r11
nop
pop r11
emms
minps xmm0, xmm6
punpcklbw mm5, mm4
pop rax
test bl, r10b
not r10d
pop rbx
nop
emms
pop r10
movzx eax, bx
add rax, 0x1f0000
add rsp, 0x38
pop rbx
pop rsi
ret
Function at 0x140d29880
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140d2988d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140d2989d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140d29885
lea eax, [rcx + 1]
jmp 0x140d298ab
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140d298be
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140d298a4
sub eax, 3
jb 0x140d298de
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140d2992d
sar eax, 1
movsxd rbp, eax
jb 0x140d29914
jmp 0x140d298ec
add ebx, ebx
jne 0x140d298ea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140d29914
inc ecx
add ebx, ebx
jne 0x140d298fa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140d29914
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140d2990d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140d298fc
add ecx, 2
jmp 0x140d29919
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140d29842
jmp 0x140d2988d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0xd08000]
mov eax, dword [rdi]
or eax, eax
je 0x140d2998d
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xd84114]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140d2993d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140d29987
mov qword [rbx], rax
add rbx, 8
jmp 0x140d2995d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140d299d1
cmp al, 0xef
ja 0x140d299b9
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140d29999
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140d299a8
mov eax, dword [rdi]
add rdi, 4
jmp 0x140d299a8
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140d29a50], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140d29a50
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140d29a40
sub rsp, 0xffffffffffffff80
jmp 0x1400013c9
Function at 0x14000a810
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140011250
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.140011250
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x14000a880
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x14001b0a4]
mov rbx, rcx
test esi, esi
jle 0x14000a9b0
mov rax, qword [0x14001b0a8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x14000a8cb
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x14000a955
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x14000a8b0
mov rcx, rbx
call fcn.14000b2d0
mov rdi, rax
test rax, rax
je 0x14000a9d2
mov rax, qword [0x14001b0a8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.14000b410
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x14001b0a8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000a9b7
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x14000a94e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x14000a960
add dword [0x14001b0a4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x14001b0a8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14000a94e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.14000a810
nop dword [rax]
xor esi, esi
jmp 0x14000a8d8
mov rax, qword [0x14001b0a8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.14000a810
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.14000a810
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x14000af40
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x14001b100]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x14001b0e0]
test rbx, rbx
je 0x14000af9c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x14000af93
test rsi, rsi
je 0x14000af93
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x14000af78
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x14000b2d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140017570]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x14000b2f0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x14000b2f8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x14000b2f0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000b34d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000b344
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x14000b2f0
add rax, 0x28
cmp rax, r9
jne 0x14000b330
xor eax, eax
ret

Function at 0x14000b350
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140017570]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000b36f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x14000b378
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000b36f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x14000b410
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140017570]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000b42f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14000b438
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret