joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009700
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14001c010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140009818
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x140009818
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
xor edx, edx
mov qword [rsp + 0x50], rdx
mov ecx, dword [rax + rsi + 0xb0]
test ecx, ecx
jne 0x140009778
mov qword [rdi], rdx
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rdx
jmp 0x140009825
lea rbx, [rsi + rcx]
mov ebp, dword [rax + rsi + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x48]
cmp rbx, rbp
jae 0x140009806
mov r8d, dword [rbx + 4]
test r8d, r8d
je 0x140009806
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [r8 - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, rdx
je 0x1400097df
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
mov rcx, qword [rsp + 0x48]
add rcx, 0x18
mov qword [rsp + 0x48], rcx
jmp 0x1400097f6
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.140009d50
mov rcx, qword [rsp + 0x48]
mov eax, dword [rbx + 4]
add rbx, rax
mov rdx, qword [rsp + 0x50]
cmp rbx, rbp
jb 0x140009790
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rdx
jmp 0x140009825
xor edx, edx
mov qword [rcx], rdx
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], rdx
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14000b720
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14000a9a0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rax, qword [0x14001c010]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
lea rcx, [0x14000ee58]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x14000abaf
mov rcx, qword [rbx + 0x10]
movabs rdi, 0x7ffffffffffffffe
mov rax, rdi
sub rax, rcx
cmp rax, 0x34
jb 0x14000abda
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x14000aa11
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x34
lea r9, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp + 0x1f]
call fcn.1400080b0
nop
lea rdx, [rbp + 0x1f]
cmp qword [rbp + 0x37], 8
cmovae rdx, qword [rbp + 0x1f]
lea rcx, [rbp + 0x3f]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov rax, qword [rbx + 0x10]
sub rdi, rax
cmp rdi, 0x22
jb 0x14000abd4
cmp qword [rbx + 0x18], 8
jb 0x14000aa68
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0x22
lea r9, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp - 1]
call fcn.1400080b0
nop
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
lea r8, [rbp - 9]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x14000aab7
cmp eax, 2
sete bl
jmp 0x14000ab14
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.NtUnloadDriver
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp + 0x3f]
call rax
lea rdx, [rbp - 1]
mov rcx, 0xffffffff80000002
test eax, eax
je 0x14000aafa
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor bl, bl
jmp 0x14000ab14
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x14000ab12
xor bl, bl
jmp 0x14000ab14
mov bl, 1
mov rdx, qword [rbp + 0x17]
cmp rdx, 8
jb 0x14000ab57
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ab52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ab52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b740
xor eax, eax
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x17], 7
mov word [rbp - 1], ax
mov rdx, qword [rbp + 0x37]
cmp rdx, 8
jb 0x14000abac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1f]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000aba7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000aba7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b740
movzx eax, bl
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14000b720
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140001fa0
nop
call fcn.140001fa0
int3
Function at 0x14000abe0
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x14001c010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, rcx
xor ebp, ebp
mov ebx, ebp
mov dword [rsp + 0x20], ebp
lea r9, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
lea ecx, [rbp + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14000ac74
test rbx, rbx
je 0x14000ac3c
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14000ac26
test eax, eax
jns 0x14000acb3
test rbx, rbx
je 0x14000ac8e
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000b720
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
test rbx, rbx
je 0x14000ac8e
mov edi, ebp
cmp dword [rbx], ebp
jbe 0x14000ac7d
nop
mov esi, edi
imul rax, rsi, 0x128
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
lea rdx, [rbx + 0x30]
add rdx, rcx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], 0xf
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x14000acf2
lea rcx, [rsp + 0x28]
call fcn.140006120
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x14000ad13
mov rdx, qword [r14]
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14000ad76
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000ad67
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ad62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000adc7
call fcn.14000b740
inc edi
cmp edi, dword [rbx]
jb 0x14000acc0
jmp 0x14000ac7d
imul rax, rsi, 0x128
mov rdi, qword [rax + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000add3
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000adce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000adce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000b740
mov rax, rdi
jmp 0x14000ac90
Function at 0x180002780
Capabilities:
Access peb ldr_data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
cmp dword [0x180020a94], 0xa
jl 0x1800027b2
mov eax, dword [0x180020a98]
lea edx, [rax - 1]
imul edx, eax
and edx, 1
je 0x1800027b2
nop word cs:[rax + rax]
jmp 0x1800027b0
mov rax, qword gs:[0x60]
mov r11, qword [rax + 0x18]
add r11, 0x10
mov eax, dword [0x180020a78]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020a74], 0xa
setl r8b
or r8b, al
mov eax, dword [0x180020a9c]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x180020aa0], 0xa
setl r9b
or r9b, al
lea r10, [rcx - 1]
xor eax, eax
mov r14, r11
mov r14, qword [r14]
cmp r14, r11
je 0x180002888
mov rsi, r10
test r8b, r8b
je 0x1800028a0
cmp byte [rsi + 1], 0
lea rsi, [rsi + 1]
jne 0x180002820
test r9b, r9b
je 0x1800028b0
sub rsi, rcx
je 0x180002884
mov r15, qword [r14 + 0x60]
xor ebx, ebx
nop
movzx r13d, word [r15 + rbx*2]
lea edi, [r13 - 0x41]
lea ebp, [r13 + 0x20]
cmp di, 0x1a
cmovae ebp, r13d
movsx edi, byte [rcx + rbx]
lea r12d, [rdi - 0x41]
lea edx, [rdi + 0x20]
cmp r12b, 0x1a
cmovae edx, edi
sub ebp, edx
test r13d, r13d
je 0x180002880
test ebp, ebp
jne 0x180002880
add rbx, 1
cmp rsi, rbx
jne 0x180002840
jmp 0x180002884
test ebp, ebp
jne 0x18000280c
mov rax, qword [r14 + 0x30]
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
jmp 0x1800028a0
jmp 0x1800028b0
Function at 0x14012c664
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov dword [rbp + 2], 0x6f7c6b2a
mov dword [rbp - 0x4e], 0xf6f6f6f6
mov dword [rbp + 6], 0x7d78732a
je 0x14012c5ce
jne 0x14012c5ce
syscall
ja 0x14012bd91
pushfq
call rax
cpuid
add r11d, 0x57925157
rol r12d, 0xc
call rcx
syscall
bswap r10
lea ecx, [rbx + 0xcb4d]
movabs rsi, 0x50cf1d000000f6e9
lea r13d, [rcx + 0x5d7c]
test rsi, rbp
call fcn.14012bf08
jmp 0x14012c6c9
add rsp, 0x28
nop
xchg qword [rsp], r14
add rsp, 8
jmp 0x14012c61b
push rax
push rbx
push rdx
push rcx
xchg qword [rsp + 0x20], r15
jmp 0x14012c5e5
mov r9d, 0x10
lea r8, [rsp + 0x46]
lea rdx, [rbp - 0x42]
xor ecx, ecx
jmp 0x14012c8ed
nop
xchg qword [rsp], r12
add rsp, 8
push rdx
jmp 0x14012c7c1
mov dword [rbp - 0x5e], 0xf6f6f6f6
mov dword [rbp - 0xa], 0x737c7e7d
mov dword [rbp - 0x5a], 0xf6f6f6f6
mov dword [rbp - 6], 0x6b7e7f6c
jmp 0x14012c64b
mov dword [rbp - 0x56], 0xf6f6f6f6
mov dword [rbp - 2], 0x7d6f766c
mov dword [rbp - 0x52], 0xf6f6f6f6
jmp 0x14012c58e
invalid
inc edi
fisubr dword [r11 + 0x75]
outsd dx, dword [rsi]
sub al, bh
mov r14b, r14b
div dh
test bh, 0x45
fidivr word [rbp + 0x7f]
jl 0x14012c6e9
mov dword [rbp - 0x72], 0xf6f6f6f6
mov dword [rbp - 0x1e], 0x6f727e2a
mov dword [rbp - 0x6e], 0xf6f6f6f6
je 0x14012c69e
jne 0x14012c69e
call rax
test r8d, 0x9699e1a5
movabs r8, 0x60a50f490e9d6eeb
rcl r14d, 0x60
test ebx, 0x47462b31
jns 0x14012c168
jmp 0x14012c70e
jmp rcx
mov dword [rbp - 0x4a], 0xf6f6f6f6
mov dword [rbp + 0xa], 0x76766b7e
mov word [rbp - 0x46], 0xf6f6
mov dword [rbp + 0xe], 0x386e6f
mov byte [rbp - 0x44], 0xf6
movzx eax, byte [rbp + rdx - 0x42]
jne 0x14012c6fc
mov dh, 0x44
adc eax, 0x740d75be
or ecx, dword [rcx - 9]
fadd dword [rcx - 0x97c400f]
retf 0xbe49
je 0x14012c6fc
neg r8
xor ecx, 0xcaf683bf
invalid
invalid
invalid
invalid
invalid
invalid
Function at 0x14012ca37
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xchg r13, r10
mov r10, qword [rsp + 0x398]
xchg r10, r13
xchg r10, rsi
mov r10, qword [rsp + 0x3a0]
xchg r10, rsi
add rsp, 0x3a8
jmp 0x14012c5f7
mov eax, 0xfffffffe
jmp 0x14012c884
lea r8, [rsp + 0x36]
lea rdx, [rbp + 0x66]
xor ecx, ecx
call r13
xchg rdi, rax
mov rdi, r15
xchg rdi, rax
jmp 0x14012ca8b
mov dword [rbp + 0xa2], 0x6b7e7f6c
mov dword [rbp + 0x52], 0xf6f6f6f6
jg 0x14012cab7
imul eax, edi, 0x45
push rdx
div dh
div dh
mov dword [rbp + 0xa6], 0x7d6f766c
mov dword [rbp + 0x56], 0xf6f6f6f6
mov dword [rbp + 0xaa], 0x6f7c6b2a
mov dword [rbp + 0x5a], 0xf6f6f6f6
mov dword [rbp + 0xae], 0x7d78732a
jmp 0x14012cb5b
nop dword [rax + rax]
movzx eax, byte [rbp + rdx + 0x66]
movzx ecx, byte [rbp + rdx + 0x12]
add cl, al
jmp 0x14012cbe3
nop word [rax + rax]
mov byte [rbp + rax + 0x66], r15b
inc rax
cmp rax, 0x53
jb 0x14012ca96
nop
jmp 0x14012cbcb
jle 0x14012cb06
cmp edx, dword [rdi + rdx*2]
mov dword [rbp + 0x2e], 0xf6f6f6f6
mov dword [rbp + 0x82], 0x2a6f756b
mov dword [rbp + 0x32], 0xf6f6f6f6
mov dword [rbp + 0x86], 0x6f7c7f7d
mov dword [rbp + 0x36], 0xf6f6f6f6
jmp 0x14012cb2a
mov dword [rbp + 0x42], 0xf6f6f6f6
mov dword [rbp + 0x96], 0x2a35354d
mov dword [rbp + 0x46], 0xf6f6f6f6
mov dword [rbp + 0x9a], 0x736e6f5c
mov dword [rbp + 0x4a], 0xf6f6f6f6
add byte [rax], al
add byte [rdi + rbp*2 + 0x6e], bl
jae 0x14012cad5
div sil
div dh
mov dword [rbp + 0x9e], 0x737c7e7d
mov dword [rbp + 0x4e], 0xf6f6f6f6
jmp 0x14012ca30
mov dword [rbp + 0x8a], 0x6f727e2a
mov dword [rbp + 0x3a], 0xf6f6f6f6
mov dword [rbp + 0x8e], 0x7d73602a
mov dword [rbp + 0x3e], 0xf6f6f6f6
mov dword [rbp + 0x92], 0x2a766b7f
jmp 0x14012caeb
mov dword [rbp + 0x5e], 0xf6f6f6f6
mov dword [rbp + 0xb2], 0x76766b7e
mov word [rbp + 0x62], 0xf6f6
mov dword [rbp + 0xb6], 0x386e6f
mov byte [rbp + 0x64], 0xf6
nop dword [rax]
je 0x14012cbaa
jne 0x14012cbaa
xor r13d, 0xa8a7a498
pause
ja 0x14012c12f
add r14d, 0x38f5c4a
cmp r10d, 0x74b2bf8
rcl esi, 0xb2
movabs r9, 0x1085f3fffffec3e9
rcr r9d, 0x2f
and r9d, 0xee173e55
int3
jmp 0x14012ca72
mov byte [rsp + r15 + 0x36], 0
inc r15
cmp r15, 5
jb 0x14012cbcb
jmp 0x14012c8e3
mov byte [rbp + rdx + 0x66], cl
mov byte [rbp + rdx + 0x12], r15b
inc rdx
cmp rdx, 0x53
jb 0x14012ca7a
mov r9d, 0x10
jmp 0x14012c9f4
Function at 0x140005fb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rax, rdx
mov rsi, qword [rbp + 0x70]
mov rdi, qword [rbp + 0x68]
mov rdx, qword [rbp + 0x60]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x140006030
cmp r11, r10
ja 0x1400060a7
cmp r10, rdx
ja 0x1400060b9
add r11, r9
xor r15d, r15d
nop dword [rax + rax]
cmp r14, r15
je 0x140006032
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x140006010
jmp 0x140006094
ja 0x14000603a
mov r11, r10
cmp rax, r8
jne 0x140005fde
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x140006070
mov rdi, r8
sub ecx, edx
jns 0x14000608b
jmp 0x140006096
cmp r8, rsi
je 0x1400060c8
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x140006096
xor al, 1
cmp rdi, rsi
jne 0x140006050
jmp 0x140006096
xor eax, eax
and al, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140004170
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140003660
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140004b60
int3

Function at 0x140009054
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov ecx, dword [0x140037018]
test ecx, ecx
je 0x14000906d
dec ecx
add rsp, 0x28
jmp fcn.140035464
lea rcx, section..data
call fcn.1400148a0
mov ecx, eax
jmp 0x140009064

Function at 0x14000907d
Capabilities:
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
mov rax, rcx
mov ecx, dword [rcx + 0x18]
test ecx, ecx
je 0x14000909e
dec ecx
mov rdx, rsi
add rsp, 0x20
pop rsi
jmp fcn.14003546c
mov rcx, rax
call fcn.1400148a0
mov ecx, eax
jmp 0x140009091
Function at 0x140009b0c
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0xa0
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
lea rcx, [rsp + 0x20]
movaps xmmword [rcx + 0x10], xmm0
movaps xmmword [rcx], xmm0
call fcn.14000bfa4
test rax, rax
je 0x140009b44
mov edx, 4
mov rcx, rax
call fcn.140002070
jmp 0x140009b7d
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
lea rdx, [rsp + 0x40]
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rbx, [rsp + 0x70]
mov rcx, rbx
call fcn.140009012
movaps xmm0, xmmword [rbx]
movaps xmm1, xmmword [rbx + 0x10]
movaps xmm2, xmmword [rbx + 0x20]
movaps xmmword [rdi + 0x20], xmm2
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi], xmm0
and qword [rdi + 0x40], 0
mov rax, 0xffffffffffffff00
add rax, qword [rdi + 0x30]
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov rdx, rsi
add rsp, 0xa0
pop rbx
pop rdi
pop rsi
jmp fcn.1400090ea
Function at 0x14000bfa4
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov r12d, 0x20
xor esi, esi
mov r13d, 0xffffffff
test r12, r12
je 0x14000c030
mov r14, rdi
cmp r12, r13
mov r15d, 0xffffffff
cmovb r15, r12
add rdi, r15
sub r12, r15
xor ecx, ecx
mov rdx, r14
mov r8d, r15d
mov r9d, 2
call sub.bcrypt.dll_BCryptGenRandom
cmp eax, 0xc0000000
jb 0x14000bfc4
mov ebx, eax
mov rcx, r14
mov edx, r15d
call sub.ADVAPI32.dll_SystemFunction036
test al, al
jne 0x14000bfc4
and ebx, 0x7fffffff
je 0x14000c02e
mov al, byte [0x1400440c8]
mov ecx, 4
call fcn.140031200
test rax, rax
je 0x14000c043
mov rsi, rax
mov dword [rax], ebx
jmp 0x14000c030
xor esi, esi
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ecx, 4
mov edx, 4
call fcn.140002460
int3
Function at 0x140010220
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
mov rax, rdx
sub rdx, rcx
cmp rdx, 0x20
jae 0x140010245
cmp rax, rcx
je 0x14001024b
cmp rdx, 4
jae 0x140010252
xor eax, eax
xor r8d, r8d
jmp 0x1400102f0
pop rbp
jmp fcn.140003180
xor eax, eax
jmp 0x140010307
mov r8d, edx
and r8d, 0x1c
pxor xmm0, xmm0
xor eax, eax
movdqa xmm2, xmmword [0x1400384f0]
movdqa xmm3, xmmword [0x140038500]
pxor xmm1, xmm1
nop word cs:[rax + rax]
movzx r9d, word [rcx + rax]
movd xmm4, r9d
movzx r9d, word [rcx + rax + 2]
movd xmm5, r9d
pcmpgtb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpgtb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add rax, 4
cmp r8, rax
jne 0x140010280
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rax, xmm0
cmp r8, rdx
je 0x140010307
nop dword [rax]
xor r9d, r9d
cmp byte [rcx + r8], 0xc0
setge r9b
add rax, r9
inc r8
cmp rdx, r8
jne 0x1400102f0
pop rbp
ret
Function at 0x1400112e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov r10, qword [rcx]
test r10, r10
je 0x140011364
mov r11, qword [rcx + 8]
mov r8, qword [rcx + 0x10]
cmp r8, r11
jae 0x140011364
movzx eax, byte [r10 + r8]
cmp eax, 0x49
mov rbx, rcx
je 0x14001137d
cmp eax, 0x42
jne 0x140011364
lea rsi, [r8 + 1]
mov qword [rcx + 0x10], rsi
mov r9b, 1
cmp rsi, r11
jae 0x1400114ad
cmp byte [r10 + rsi], 0x5f
jne 0x14001143c
lea rax, [r8 + 2]
mov qword [rcx + 0x10], rax
xor eax, eax
cmp rax, r8
jae 0x1400114ad
mov edx, dword [rcx + 0x18]
inc edx
cmp edx, 0x1f4
jbe 0x140011507
mov dil, 1
xor r9d, r9d
jmp 0x1400114af
xor edx, edx
call fcn.14000ce20
mov esi, eax
add sil, sil
mov eax, esi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
inc r8
mov qword [rcx + 0x10], r8
xor edx, edx
call fcn.14000ce20
test al, al
jne 0x1400114ed
mov rdx, rbx
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400113bc
lea rdx, [0x14003bf7c]
mov r8d, 1
call fcn.1400036e0
mov rdx, rbx
test al, al
jne 0x1400114ed
mov rax, qword [rdx]
mov sil, 1
test rax, rax
je 0x140011370
xor r14d, r14d
lea rdi, [0x14003c2d1]
nop word cs:[rax + rax]
mov rcx, qword [rdx + 0x10]
cmp rcx, qword [rdx + 8]
jae 0x1400113f4
cmp byte [rax + rcx], 0x45
je 0x140011540
sub r14, 1
jb 0x14001141c
mov rcx, qword [rdx + 0x20]
test rcx, rcx
je 0x14001141c
mov r8d, 2
mov rdx, rdi
call fcn.1400036e0
mov rdx, rbx
test al, al
jne 0x1400114ed
mov rcx, rdx
call fcn.14000e680
test al, al
jne 0x1400114ed
mov rdx, rbx
mov rax, qword [rbx]
test rax, rax
jne 0x1400113e0
jmp 0x140011370
xor eax, eax
mov r14d, 0x3e
nop word cs:[rax + rax]
movzx edx, byte [r10 + rsi]
cmp dl, 0x5f
je 0x14001149d
lea edi, [rdx - 0x30]
cmp dil, 0xa
jb 0x14001147f
lea edi, [rdx - 0x61]
cmp dil, 0x1a
jae 0x140011471
add dl, 0xa9
jmp 0x14001147d
lea edi, [rdx - 0x41]
cmp dil, 0x1a
jae 0x1400114ad
add dl, 0xe3
mov edi, edx
inc rsi
mov qword [rcx + 0x10], rsi
mul r14
jo 0x1400114ad
movzx edx, dil
xor edi, edi
add rax, rdx
jb 0x1400114af
cmp rsi, r11
jb 0x140011450
jmp 0x1400114af
inc rsi
mov qword [rcx + 0x10], rsi
inc rax
jne 0x14001133f
xor edi, edi
mov rax, qword [rcx + 0x20]
test rax, rax
je 0x1400114f5
mov ecx, r9d
xor cl, 1
movzx ecx, cl
lea r8, [rcx + rcx*8]
add r8, 0x10
lea rcx, str.invalid_syntaxrecursion_limit_reached_for_______::closureshim_as__mut_const___dyn___unsafe_extern__
lea rdx, [0x14003c2b0]
test r9b, r9b
cmovne rdx, rcx
mov rcx, rax
call fcn.1400036e0
mov rcx, rbx
test al, al
je 0x1400114f5
mov sil, 2
jmp 0x140011370
mov qword [rcx], 0
mov byte [rcx + 8], dil
xor esi, esi
jmp 0x140011370
cmp qword [rcx + 0x20], 0
je 0x140011500
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movaps xmmword [rbp - 0x10], xmm1
movaps xmmword [rbp - 0x20], xmm0
mov qword [rcx + 0x10], rax
mov dword [rcx + 0x18], edx
mov rsi, rcx
call fcn.1400112e0
movaps xmm0, xmmword [rbp - 0x20]
movaps xmm1, xmmword [rbp - 0x10]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x140011372
inc rcx
mov qword [rdx + 0x10], rcx
jmp 0x140011370
Function at 0x1400145d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov ecx, dword [0x1400370b8]
test ecx, ecx
je 0x1400146cd
dec ecx
call fcn.140035464
cmp rax, 2
jb 0x140014601
cmp qword [rax + 8], 0
jne 0x1400146be
mov ecx, dword [0x1400370b8]
test ecx, ecx
je 0x1400146e0
dec ecx
call fcn.140035464
cmp rax, 1
je 0x1400146c4
test rax, rax
jne 0x14001467f
mov qword [rbp - 8], 0
lea rax, [0x1400370a0]
mov qword [rbp - 0x10], rax
movzx eax, byte [0x1400440c8]
mov ecx, 0x18
call fcn.140031200
test rax, rax
je 0x14001470c
mov rcx, qword [rbp]
mov qword [rax + 0x10], rcx
movups xmm0, xmmword [rbp - 0x10]
movups xmmword [rax], xmm0
mov ecx, dword [0x1400370b8]
test ecx, ecx
je 0x1400146f3
dec ecx
mov rdx, rax
mov rsi, rax
call fcn.14003546c
mov rax, rsi
mov rdx, qword [rax + 8]
mov rcx, qword [rax + 0x10]
mov qword [rbp - 0x10], rdx
mov qword [rbp - 8], rcx
mov qword [rax + 8], 1
mov qword [rax + 0x10], 0
test rdx, rdx
je 0x1400146be
test rcx, rcx
je 0x1400146be
lock dec qword [rcx]
jne 0x1400146be
lea rcx, [rbp - 8]
mov rsi, rax
call fcn.1400147e0
mov rax, rsi
add rax, 0x10
jmp 0x1400146c6
xor eax, eax
add rsp, 0x38
pop rsi
pop rbp
ret
lea rcx, [0x1400370a0]
call fcn.1400148a0
mov ecx, eax
jmp 0x1400145eb
lea rcx, [0x1400370a0]
call fcn.1400148a0
mov ecx, eax
jmp 0x140014611
lea rcx, [0x1400370a0]
mov rsi, rax
call fcn.1400148a0
mov ecx, eax
mov rax, rsi
jmp 0x140014671
mov ecx, 8
mov edx, 0x18
call fcn.140002460
ud2