joyce8/EMBER2024-capa huggingface dataset:
Function at 0x69d58bf0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx], 0
mov rbx, rcx
jne 0x69d58c20
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x69d58c17
mov rax, qword [rsp + 0x20]
mov qword [rbx], rax
jmp 0x69d58c20
mov qword [rbx], 0xffffffffffffffff
jmp 0x69d58c52
cmp qword [rbx], 0
jle 0x69d58c52
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x69d58c52
mov rax, qword [rbx]
mov r8d, 0x3e8
cqo
idiv r8
mov rcx, rax
mov rax, qword [rsp + 0x28]
cqo
idiv rcx
jmp 0x69d58c5a
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x69d592ff
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x69e02048], eax
inc eax
jne 0x69d59319
call sub.msvcrt.dll_abort
nop
add rsp, 0x28
ret

Function at 0x69d59731
Capabilities:
Print debug messages

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x90
mov rbx, rcx
test rcx, rcx
je 0x69d597d1
call fcn.69d5921a
dec eax
jne 0x69d597ca
xor eax, eax
lea rdi, [rsp + 0x25]
mov ecx, 0xa
lea rsi, str.Error_cleaning_up_spin_keys_for_thread
lea rbx, [rsp + 0x25]
rep movsd dword [rdi], dword [rsi]
lea rdi, [rsp + 0x4d]
mov ecx, 0x43
rep stosb byte [rdi], al
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rbx + 0x27]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
mov edx, 0x27
cmp byte [rbx + rdx], 0
mov eax, edx
je 0x69d597a6
inc rdx
cmp rdx, 0x6b
jne 0x69d59793
jmp 0x69d597bc
cmp edx, 0x6a
je 0x69d597bc
inc eax
movsxd rdx, edx
cdqe
mov byte [rsp + rdx + 0x25], 0xa
mov byte [rsp + rax + 0x25], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x90
pop rbx
pop rsi
pop rdi
ret
Function at 0x69d59892
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
cmp dword [0x69e35470], 1
je 0x69d598a7
call fcn.69d59805
mov ecx, dword [0x69e02048]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
test rax, rax
jne 0x69d599b3
call fcn.69d59687
cmp qword [0x69e3a040], 0
mov rbx, rax
je 0x69d599b3
test rax, rax
je 0x69d599b3
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
mov edx, 1
xor ecx, ecx
mov dword [rbx + 0x70], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.69d59731
mov rsi, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rsi
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rsi
lea r9, [rbx + 0x28]
mov r8, qword [rsp + 0x48]
mov rdx, rdi
mov dword [rsp + 0x30], 2
mov rcx, rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
jne 0x69d59977
call sub.msvcrt.dll_abort
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov rdx, rbx
mov ecx, dword [0x69e02048]
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
mov al, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x69d59972
mov rsi, rbx
mov rax, rsi
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret

Function at 0x69d5a3f8
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rsi, rcx
call fcn.69d59892
mov qword [rax + 8], rsi
mov rcx, qword [rax + 0x1d8]
mov rbx, rax
call fcn.69d59ebc
test byte [rbx + 0x40], 0x30
jne 0x69d5a431
lea rcx, [rbx + 0xd0]
mov edx, 1
call qword [sym.imp.msvcrt.dll_longjmp]
mov ecx, dword [0x69e02048]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbx, rax
test rax, rax
je 0x69d5a4c2
cmp qword [rax + 0x28], 0
mov rcx, qword [rax + 0x30]
jne 0x69d5a46e
mov dword [rax], 0xdeadbeef
test rcx, rcx
je 0x69d5a461
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x30], 0
mov esi, dword [rbx + 8]
jmp 0x69d5a4ac
mov dword [rax + 0xbc], 1
mov esi, dword [rax + 8]
test rcx, rcx
je 0x69d5a486
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x30], 0
test byte [rbx + 0x44], 4
je 0x69d5a4c2
mov dword [rbx], 0xdeadbeef
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x28], 0
mov rcx, rbx
call fcn.69d594a1
xor edx, edx
mov ecx, dword [0x69e02048]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, esi
call qword [sym.imp.msvcrt.dll__endthreadex]
nop
Function at 0x69d5c174
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x69e35a48]
xor ebx, ebx
add rax, 0x18
mov rbp, rcx
mov ecx, dword [0x69e35a44]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x69d5c1c2
mov rdx, qword [rax]
cmp rbp, rdx
jb 0x69d5c1ba
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbp, rdx
jb 0x69d5c2a2
inc ebx
add rax, 0x28
jmp 0x69d5c19a
mov rcx, rbp
call fcn.69d5cb64
mov r12, rax
test rax, rax
jne 0x69d5c1e1
mov rdx, rbp
lea rcx, str.Address__p_has_no_image_section
call fcn.69d5c110
movsxd rbx, ebx
mov rax, qword [0x69e35a48]
imul rbx, rbx, 0x28
add rax, rbx
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.69d5cc1b
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x69e35a48]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x69d5c248
mov rax, qword [0x69e35a48]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.69d5c110
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x69d5c29c
sub eax, 4
and eax, 0xfffffffb
je 0x69d5c29c
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rbx, qword [0x69e35a48]
mov r9, rbx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x69d5c29c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.69d5c110
inc dword [0x69e35a44]
mov ecx, edi
mov rdi, rbp
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x69d5c880
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x69e35d20]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x69e35d00]
test rbx, rbx
je 0x69d5c8c8
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x69d5c8c2
test rsi, rsi
je 0x69d5c8c2
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x69d5c89a
lea rcx, [0x69e35d20]
add rsp, 0x28
pop rbx
pop rsi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x69d5ca80
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x69d5caa3
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x69d5caa3
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x69d5caa4
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r9d, r8d
jbe 0x69d5cade
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp r10, rdx
ja 0x69d5cad5
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x69d5cae0
inc r8d
add rax, 0x28
jmp 0x69d5cabc
xor eax, eax
ret
Function at 0x69d5cb64
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, rcx
mov rcx, qword [0x69e0b0a0]
call fcn.69d5ca80
test eax, eax
je 0x69d5cb91
mov rcx, qword [0x69e0b0a0]
mov rdx, r8
sub rdx, rcx
add rsp, 0x28
jmp fcn.69d5caa4
xor eax, eax
add rsp, 0x28
ret

Function at 0x69d69ea0
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x18
mov r12, rcx
test r9, r9
je 0x69d6a02b
lea rbp, [r8 + r9]
mov rax, r8
mov rsi, rdx
xor ecx, ecx
xor r11d, r11d
lea rdi, [0x69e15120]
nop
movzx r10d, byte [rax]
cmp r10b, 0x3d
je 0x69d69f0b
movzx r10d, byte [rdi + r10]
cmp r10b, 0xff
je 0x69d69f0b
movsxd rbx, r11d
add r11d, 1
add rax, 1
mov byte [rsp + rbx + 0xc], r10b
cmp r11d, 4
je 0x69d69f48
cmp rax, rbp
jne 0x69d69ed0
test cl, cl
je 0x69d69fb0
mov rax, rbp
sub rax, r8
mov r9, rax
mov rax, rsi
sub rax, rdx
test r11d, r11d
jne 0x69d69fb0
movq xmm0, rax
movq xmm1, r9
mov rax, r12
punpcklqdq xmm0, xmm1
movups xmmword [r12], xmm0
add rsp, 0x18
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
movzx ecx, byte [rsp + 0xd]
movzx r10d, byte [rsp + 0xe]
mov ebx, ecx
mov r11d, r10d
sar r10d, 2
sar ebx, 4
shl ecx, 4
and r10d, 0xf
mov r13d, ebx
movzx ebx, byte [rsp + 0xc]
add r10d, ecx
shl r11d, 6
and r13d, 3
add r11b, byte [rsp + 0xf]
lea rcx, [rsi + 3]
mov byte [rsi + 1], r10b
lea ebx, [r13 + rbx*4]
mov byte [rsi + 2], r11b
mov byte [rsi], bl
mov rsi, rcx
cmp rax, rbp
je 0x69d6a023
mov ecx, 1
xor r11d, r11d
jmp 0x69d69ed0
movzx r8d, byte [rsp + 0xd]
movzx ecx, byte [rsp + 0xc]
mov eax, r8d
shl r8d, 4
sar eax, 4
and eax, 3
lea r10d, [rax + rcx*4]
movzx eax, byte [rsp + 0xe]
mov ecx, eax
shl eax, 6
add al, byte [rsp + 0xf]
sar ecx, 2
and ecx, 0xf
add ecx, r8d
mov r8d, r11d
sub r8d, 1
je 0x69d6a018
mov byte [rsi], r10b
cmp r8d, 1
je 0x69d6a001
mov byte [rsi + 1], cl
cmp r8d, 2
je 0x69d6a001
mov byte [rsi + 2], al
lea eax, [r11 - 2]
lea rax, [rsi + rax + 1]
sub rax, rdx
jmp 0x69d69f20
mov rax, rsi
sub rax, rdx
jmp 0x69d69f20
xor r11d, r11d
jmp 0x69d69f08
xor eax, eax
jmp 0x69d69f20
Function at 0x69dc69d0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
jmp 0x69dc69f7
call rbp
cmp dword [rax], 4
jne 0x69dc6a14
mov rcx, rdi
call fcn.69dc67d0
mov r8d, ebx
mov rdx, rsi
mov ecx, eax
call sub.msvcrt.dll__read
movsxd r12, eax
cmp eax, 0xffffffff
je 0x69dc69f0
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140001000
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
sub rsp, 0xc8
mov rax, qword [0x14002d010]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movdqa xmm0, xmmword [0x140028810]
xor eax, eax
movdqa xmm1, xmmword [0x1400287d0]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmm0, xmmword [0x140028c20]
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm1, xmmword [0x140028c00]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [0x140028730]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm1, xmmword [0x140028c30]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x140028b70]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm1, xmmword [0x140028710]
movdqa xmmword [r11 - 0x48], xmm0
movdqa xmmword [r11 - 0x38], xmm1
mov byte [r11 - 0x28], 1
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax + 0x30]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0x7f
jb 0x1400010a0
mov r8d, 0x7f
mov byte [rsp + 0xa0], 0
lea rdx, [rsp + 0x20]
lea rcx, [0x140065d80]
call fcn.14000c750
lea rcx, [0x14001feb0]
call fcn.14000d4bc
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.14000cf80
add rsp, 0xc8
ret
Function at 0x14000b400
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
xor edx, edx
cmp byte [rcx + 0x32], dl
je 0x14000b435
mov r8d, edx
mov r9d, 0x4b30
nop dword [rax]
lea eax, [r9 + r8]
xor word [rcx + r8*2], ax
inc r8
cmp r8, 0x18
jb 0x14000b420
mov byte [rcx + 0x32], dl
lea rax, [rcx + 0x30]
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp rcx, rax
je 0x14000b45e
mov rdx, rcx
mov r8d, 0x18
mov rcx, rbx
call fcn.14000c530
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14000b680
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0xe], 0
mov rbx, rdx
je 0x14000b6b5
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x30]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0xd
jb 0x14000b6a0
mov byte [rcx + 0xe], 0
lea rax, [rcx + 0xd]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14000b6e2
mov rdx, rcx
mov r8d, 0xd
mov rcx, rbx
call fcn.14000c750
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14000b720
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x18], 0
mov rbx, rdx
je 0x14000b755
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x30]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x17
jb 0x14000b740
mov byte [rcx + 0x18], 0
lea rax, [rcx + 0x17]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14000b782
mov rdx, rcx
mov r8d, 0x17
mov rcx, rbx
call fcn.14000c750
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14000b800
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x1f], 0
mov rbx, rdx
je 0x14000b835
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x30]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x1e
jb 0x14000b820
mov byte [rcx + 0x1f], 0
lea rax, [rcx + 0x1e]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14000b862
mov rdx, rcx
mov r8d, 0x1e
mov rcx, rbx
call fcn.14000c750
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14000b8a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x1d], 0
mov rbx, rdx
je 0x14000b8d5
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x30]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x1c
jb 0x14000b8c0
mov byte [rcx + 0x1d], 0
lea rax, [rcx + 0x1c]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14000b902
mov rdx, rcx
mov r8d, 0x1c
mov rcx, rbx
call fcn.14000c750
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14000ba60
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x11], 0
mov rbx, rdx
je 0x14000ba95
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x30]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x10
jb 0x14000ba80
mov byte [rcx + 0x11], 0
lea rax, [rcx + 0x10]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14000bac2
mov rdx, rcx
mov r8d, 0x10
mov rcx, rbx
call fcn.14000c750
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14000bc10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x1e], 0
mov rbx, rdx
je 0x14000bc45
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x30]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x1d
jb 0x14000bc30
mov byte [rcx + 0x1e], 0
lea rax, [rcx + 0x1d]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14000bc72
mov rdx, rcx
mov r8d, 0x1d
mov rcx, rbx
call fcn.14000c750
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14000bcb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0xc], 0
mov rbx, rdx
je 0x14000bce5
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x30]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0xb
jb 0x14000bcd0
mov byte [rcx + 0xc], 0
lea rax, [rcx + 0xb]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14000bd12
mov rdx, rcx
mov r8d, 0xb
mov rcx, rbx
call fcn.14000c750
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14000bd50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x14000bd73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x30]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x14000bd60
mov byte [rcx + 0xb], 0
ret

Function at 0x14000bec0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 4], 0
mov rbx, rdx
je 0x14000bef5
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x30]
xor byte [r8 + rcx], al
inc r8
cmp r8, 3
jb 0x14000bee0
mov byte [rcx + 4], 0
lea rax, [rcx + 3]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14000bf22
mov rdx, rcx
mov r8d, 3
mov rcx, rbx
call fcn.14000c750
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14000bfc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0xd], 0
mov rbx, rdx
je 0x14000bff5
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x30]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0xc
jb 0x14000bfe0
mov byte [rcx + 0xd], 0
lea rax, [rcx + 0xc]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14000c022
mov rdx, rcx
mov r8d, 0xc
mov rcx, rbx
call fcn.14000c750
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x14000c060
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rcx + 0x1c], 0
mov rbx, rdx
je 0x14000c095
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + 0x30]
xor byte [r8 + rcx], al
inc r8
cmp r8, 0x1b
jb 0x14000c080
mov byte [rcx + 0x1c], 0
lea rax, [rcx + 0x1b]
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0xf
mov byte [rdx], 0
cmp rcx, rax
je 0x14000c0c2
mov rdx, rcx
mov r8d, 0x1b
mov rcx, rbx
call fcn.14000c750
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14000cfac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]

Function at 0x14001338c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400131b8
Function at 0x1400021f4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000223e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000223e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000223e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000223e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000223e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002240
xor al, al
add rsp, 0x28
ret
Function at 0x140001154
Capabilities:
Terminate process

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x10], 0
mov dword [rbp - 0x1c], 0x30
mov eax, dword [rbp - 0x1c]
mov rax, qword gs:[rax]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov rax, qword [rax + 8]
mov qword [rbp - 0x18], rax
mov dword [rbp - 4], 0
jmp 0x1400011ac
mov rax, qword [rbp - 0x10]
cmp rax, qword [rbp - 0x18]
jne 0x14000119e
mov dword [rbp - 4], 1
jmp 0x1400011e3
mov ecx, 0x3e8
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
mov rax, qword [0x140028050]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x40], 0
mov rcx, qword [rbp - 0x38]
mov rax, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x30]
lock cmpxchg qword [rdx], rcx
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x14000118b
mov rax, qword [0x140028060]
mov eax, dword [rax]
cmp eax, 1
jne 0x1400011fd
mov ecx, 0x1f
call fcn.1400095b0
jmp 0x14000123c
mov rax, qword [0x140028060]
mov eax, dword [rax]
test eax, eax
jne 0x140001232
mov rax, qword [0x140028060]
mov dword [rax], 1
mov rax, qword [0x1400280b0]
mov rdx, rax
mov rax, qword [0x1400280a0]
mov rcx, rax
call sub.ucrtbase.dll__initterm
jmp 0x14000123c
mov dword [0x14002c024], 1
mov rax, qword [0x140028060]
mov eax, dword [rax]
cmp eax, 1
jne 0x140001270
mov rax, qword [0x140028090]
mov rdx, rax
mov rax, qword [0x140028080]
mov rcx, rax
call sub.ucrtbase.dll__initterm
mov rax, qword [0x140028060]
mov dword [rax], 2
cmp dword [rbp - 4], 0
jne 0x140001294
mov rax, qword [0x140028050]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x50], 0
mov rdx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
xchg qword [rax], rdx
mov rax, qword [0x140027fa0]
mov rax, qword [rax]
test rax, rax
je 0x1400012bf
mov rax, qword [0x140027fa0]
mov rax, qword [rax]
mov r8d, 0
mov edx, 2
mov ecx, 0
call rax
call fcn.140002e68
mov rax, qword [0x1400280f0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call rax
mov rdx, qword [0x140028040]
mov qword [rdx], rax
lea rax, section..text
mov rcx, rax
call sub.ucrtbase.dll__set_invalid_parameter_handler
call fcn.140002660
mov eax, dword [0x14002c004]
lea rdx, [0x14002c008]
mov ecx, eax
call fcn.14000147c
call fcn.1400023f7
mov rax, qword [0x140027fd0]
mov rax, qword [rax]
mov rdx, qword [0x14002c010]
mov qword [rax], rdx
mov rcx, qword [0x14002c010]
mov rdx, qword [0x14002c008]
mov eax, dword [0x14002c004]
mov r8, rcx
mov ecx, eax
call fcn.1400098b0
mov dword [0x14002c01c], eax
mov eax, dword [0x14002c020]
test eax, eax
jne 0x14000135d
mov eax, dword [0x14002c01c]
mov ecx, eax
call sub.ucrtbase.dll_exit
mov eax, dword [0x14002c024]
test eax, eax
jne 0x14000136c
call sub.ucrtbase.dll__cexit
mov eax, dword [0x14002c01c]
add rsp, 0x70
pop rbp
ret
Function at 0x140001378
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140028000]
mov dword [rax], 1
mov rax, qword [0x140028010]
mov dword [rax], 1
mov rax, qword [0x140028020]
mov dword [rax], 1
mov rax, qword [0x140027fc0]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400013c9
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400013f5
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000141b
cmp eax, 0x20b
je 0x140001442
jmp 0x140001471
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000142e
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000145d
mov eax, 0
jmp 0x140001476
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001476
mov eax, 0
add rsp, 0x20
pop rbp
ret