joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400139e0
Capabilities:
Create thread
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa8
mov r13, r9
mov r12, r8
mov rsi, rdx
mov qword [rsp + 0x80], rcx
call fcn.1400019a0
mov r15, rax
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov r8d, 0x10
lea rdx, str.NtCreateThreadEx
lea rcx, [rsp + 0x60]
call fcn.140002600
nop
call fcn.140008470
lea rcx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x60]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x78]
cmp r14, 0x10
cmovae rdx, rdi
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r8, qword [rsp + 0x70]
test r8, r8
je 0x140013a95
movabs r10, 0x100000001b3
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x140013a82
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x88]
mov rcx, r15
call fcn.140003160
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x140013acb
cmp rbx, qword [r15 + 8]
je 0x140013acb
mov rbx, qword [rbx + 0x30]
lea rcx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebp, ebp
jmp 0x140013ad9
lea rcx, [r15 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebp, ebp
mov ebx, ebp
cmp r14, 0x10
jb 0x140013b10
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140013b08
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013bbb
mov rcx, rdi
call fcn.140079aa4
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx + 8]
mov eax, dword [rsp + 0x110]
xor r8d, r8d
test rbx, rbx
je 0x140013b6d
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], 0x100000
mov qword [rsp + 0x40], 0x1000
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
mov r9, rcx
mov edx, dword [rsp + 0x118]
mov rcx, rsi
call rbx
test eax, eax
jns 0x140013ba7
mov qword [rsi], rbp
jmp 0x140013ba7
and eax, 1
shl eax, 2
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
mov r9, r12
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rsi], rax
test rax, rax
je 0x140013b98
mov eax, ebp
jmp 0x140013ba7
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1400892cc
int3
Function at 0x140013c00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r12, r8
mov r15, rdx
cmp byte [rcx + 0x15], 0
jne 0x140013c29
xor eax, eax
jmp 0x140013d55
call fcn.1400019a0
mov rsi, rax
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], dil
lea r8d, [rdi + 0x15]
lea rdx, str.Wow64GetThreadContext
lea rcx, [rsp + 0x20]
call fcn.140002600
nop
call fcn.140008470
lea rbp, [rsi + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x20]
mov rbx, qword [rsp + 0x20]
mov r14, qword [rsp + 0x38]
cmp r14, 0x10
cmovae rdx, rbx
movabs r9, 0xcbf29ce484222325
mov ecx, edi
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x140013cc3
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x140013cb0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140003160
mov r8, qword [rax + 8]
test r8, r8
je 0x140013d02
cmp r8, qword [rsi + 8]
je 0x140013d02
mov rsi, qword [r8 + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rsi, rsi
je 0x140013d0b
mov rdx, r12
mov rcx, r15
call rsi
mov esi, eax
jmp 0x140013d0d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, edi
cmp r14, 0x10
jb 0x140013d40
lea rdx, [r14 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140013d38
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013d6e
mov rcx, rbx
call fcn.140079aa4
test esi, esi
jne 0x140013d53
mov rax, qword gs:[0x30]
mov edi, dword [rax + 0x1250]
mov eax, edi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.1400892cc
int3
Function at 0x140013db0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov r12, r8
mov r15, rdx
cmp byte [rcx + 0x15], 0
jne 0x140013dd9
xor eax, eax
jmp 0x140013f05
call fcn.1400019a0
mov rsi, rax
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], dil
lea r8d, [rdi + 0x15]
lea rdx, str.Wow64SetThreadContext
lea rcx, [rsp + 0x20]
call fcn.140002600
nop
call fcn.140008470
lea rbp, [rsi + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x20]
mov rbx, qword [rsp + 0x20]
mov r14, qword [rsp + 0x38]
cmp r14, 0x10
cmovae rdx, rbx
movabs r9, 0xcbf29ce484222325
mov ecx, edi
mov r8, qword [rsp + 0x30]
test r8, r8
je 0x140013e73
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x140013e60
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140003160
mov r8, qword [rax + 8]
test r8, r8
je 0x140013eb2
cmp r8, qword [rsi + 8]
je 0x140013eb2
mov rsi, qword [r8 + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rsi, rsi
je 0x140013ebb
mov rdx, r12
mov rcx, r15
call rsi
mov esi, eax
jmp 0x140013ebd
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, edi
cmp r14, 0x10
jb 0x140013ef0
lea rdx, [r14 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140013ee8
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013f1e
mov rcx, rbx
call fcn.140079aa4
test esi, esi
jne 0x140013f03
mov rax, qword gs:[0x30]
mov edi, dword [rax + 0x1250]
mov eax, edi
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.1400892cc
int3
Function at 0x140013f30
Capabilities:
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x60
mov r13, r9
mov r12, r8
mov r15, rdx
cmp dword [rcx + 0x10], 3
jne 0x140014098
call fcn.1400019a0
mov rbx, rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov r8d, 0x16
lea rdx, str.RtlQueueApcWow64Thread
lea rcx, [rsp + 0x30]
call fcn.140002600
nop
call fcn.140008470
lea rbp, [rbx + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x30]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
cmp rsi, 0x10
cmovae r8, rdi
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r10, qword [rsp + 0x40]
test r10, r10
je 0x140013ff4
movabs rdx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor r9, rax
imul r9, rdx
inc rcx
cmp rcx, r10
jb 0x140013fe0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140003160
mov r9, qword [rax + 8]
test r9, r9
je 0x140014042
cmp r9, qword [rbx + 8]
je 0x140014042
mov rbx, qword [r9 + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14001404b
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, r13
mov rdx, r12
mov rcx, r15
call rbx
mov ebx, eax
jmp 0x140014050
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
cmp rsi, 0x10
jb 0x140014087
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14001407f
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400141c7
mov rcx, rdi
call fcn.140079aa4
mov eax, ebx
add rsp, 0x60
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1400019a0
mov rbx, rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
mov r8d, 0x10
lea rdx, str.NtQueueApcThread
lea rcx, [rsp + 0x30]
call fcn.140002600
nop
call fcn.140008470
lea rbp, [rbx + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r8, [rsp + 0x30]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
cmp rsi, 0x10
cmovae r8, rdi
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
mov r10, qword [rsp + 0x40]
test r10, r10
je 0x140014134
movabs rdx, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
xor r9, rax
imul r9, rdx
inc rcx
cmp rcx, r10
jb 0x140014120
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140003160
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140014182
cmp rdx, qword [rbx + 8]
je 0x140014182
mov rbx, qword [rdx + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14001418b
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, r13
mov rdx, r12
mov rcx, r15
call rbx
mov ebx, eax
jmp 0x140014190
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
cmp rsi, 0x10
jb 0x140014087
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14001407f
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001407f
call fcn.1400892cc
int3
Function at 0x1400141d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140230a00]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, rdx
mov rbx, rcx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
cmp byte [rcx + 0x15], r12b
jne 0x140014213
xor eax, eax
jmp 0x140014380
mov qword [rsp + 0x68], r12
call fcn.1400019a0
mov rdi, rax
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], r12b
mov r8d, 0x19
lea rdx, str.NtQueryInformationProcess
lea rcx, [rsp + 0x38]
call fcn.140002600
nop
mov dword [rsp + 0x30], 1
call fcn.140008470
lea rbp, [rdi + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x38]
mov rsi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x50]
cmp r15, 0x10
cmovae rdx, rsi
movabs r9, 0xcbf29ce484222325
mov rcx, r12
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x1400142b3
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1400142a0
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.140003160
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140014314
cmp rdx, qword [rdi + 8]
je 0x140014314
mov rdi, qword [rdx + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x14001431d
add rbx, 8
mov qword [rsp + 0x20], r12
mov r9d, 8
lea r8, [rsp + 0x68]
lea edx, [r9 + 0x12]
mov rcx, qword [rbx]
call rdi
mov rcx, rbx
test eax, eax
js 0x140014321
test r14, r14
je 0x140014321
mov dil, 1
jmp 0x140014327
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rbx + 8]
xor dil, dil
mov rbx, rcx
cmp r15, 0x10
jb 0x14001435a
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140014352
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400143a9
mov rcx, rsi
call fcn.140079aa4
test dil, dil
je 0x14001437b
mov qword [rsp + 0x20], r12
mov r9d, 0x250
mov r8, r14
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140079bc0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.1400892cc
int3
Function at 0x1400143b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x140230a00]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r15, rdx
mov r14, rcx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [r11 - 0x50], xmm0
mov dword [r11 - 0x40], r12d
call fcn.1400019a0
mov rdi, rax
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], r12b
lea r8d, [r12 + 0x19]
lea rdx, str.NtQueryInformationProcess
lea rcx, [rsp + 0x38]
call fcn.140002600
nop
mov dword [rsp + 0x30], 1
call fcn.140008470
lea rbx, [rdi + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x38]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x50]
cmp rbp, 0x10
cmovae rdx, rsi
movabs r9, 0xcbf29ce484222325
mov ecx, r12d
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x1400144a3
movabs r10, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x140014490
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.140003160
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14001450a
cmp rdx, qword [rdi + 8]
je 0x14001450a
mov rdi, qword [rdx + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rdi, rdi
je 0x140014513
lea rbx, [r14 + 8]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, qword [rbx]
call rdi
mov rcx, rbx
test eax, eax
js 0x140014517
test r15, r15
je 0x140014517
mov dil, 1
jmp 0x14001451d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [r14 + 8]
xor dil, dil
mov rbx, rcx
cmp rbp, 0x10
jb 0x140014550
lea rdx, [rbp + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140014548
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400145a2
mov rcx, rsi
call fcn.140079aa4
test dil, dil
je 0x140014571
mov qword [rsp + 0x20], r12
mov r9d, 0x388
mov r8, r15
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140079bc0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.1400892cc
int3
Function at 0x1400145b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x140230a00]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbp, r8
mov r12, rdx
mov r15, rcx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
cmp byte [rcx + 0x15], r13b
jne 0x1400145f7
xor eax, eax
jmp 0x140014783
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [rsp + 0x88], xmm0
mov dword [rsp + 0x98], r13d
call fcn.1400019a0
mov rbx, rax
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], r13b
mov r8d, 0x18
lea rdx, str.NtQueryInformationThread
lea rcx, [rsp + 0x38]
call fcn.140002600
nop
mov dword [rsp + 0x30], 1
call fcn.140008470
lea rsi, [rbx + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x38]
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x50]
cmp r14, 0x10
cmovae rdx, rdi
movabs r9, 0xcbf29ce484222325
mov rcx, r13
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x1400146b3
movabs r10, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1400146a0
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.140003160
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140014712
cmp rcx, qword [rbx + 8]
je 0x140014712
mov rbx, qword [rcx + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14001471b
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, r12
call rbx
test eax, eax
js 0x14001471b
test rbp, rbp
je 0x14001471b
mov bl, 1
jmp 0x14001471d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor bl, bl
cmp r14, 0x10
jb 0x140014750
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140014748
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400147ae
mov rcx, rdi
call fcn.140079aa4
test bl, bl
je 0x140014778
mov rdx, qword [rsp + 0x70]
add rdx, 0x2000
mov qword [rsp + 0x20], r13
mov r9d, 0x1000
mov r8, rbp
mov rcx, qword [r15 + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x70]
add rax, 0x2000
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140079bc0
mov rbx, qword [rsp + 0x108]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400892cc
int3
Function at 0x1400147c0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x140230a00]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r14, r8
mov r15, rdx
mov r13, rcx
xor r12d, r12d
mov dword [rsp + 0x30], r12d
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
movups xmmword [r11 - 0x60], xmm0
mov dword [r11 - 0x50], r12d
call fcn.1400019a0
mov rbx, rax
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], r12b
lea r8d, [r12 + 0x18]
lea rdx, str.NtQueryInformationThread
lea rcx, [rsp + 0x38]
call fcn.140002600
nop
mov dword [rsp + 0x30], 1
call fcn.140008470
lea rsi, [rbx + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rdx, [rsp + 0x38]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x50]
cmp rbp, 0x10
cmovae rdx, rdi
movabs r9, 0xcbf29ce484222325
mov ecx, r12d
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x1400148b3
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, r8
jb 0x1400148a0
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.140003160
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140014912
cmp rcx, qword [rbx + 8]
je 0x140014912
mov rbx, qword [rcx + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x14001491b
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0x30
lea r8, [rsp + 0x68]
xor edx, edx
mov rcx, r15
call rbx
test eax, eax
js 0x14001491b
test r14, r14
je 0x14001491b
mov bl, 1
jmp 0x14001491d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor bl, bl
cmp rbp, 0x10
jb 0x140014950
lea rdx, [rbp + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140014948
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400149a1
mov rcx, rdi
call fcn.140079aa4
test bl, bl
je 0x140014971
mov qword [rsp + 0x20], r12
mov r9d, 0x1838
mov r8, r14
mov rdx, qword [rsp + 0x70]
mov rcx, qword [r13 + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140079bc0
mov rbx, qword [rsp + 0x108]
add rsp, 0xb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400892cc
int3
Function at 0x1400170e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x140230a00]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x58], r8
mov rsi, rdx
mov r13, rcx
mov rax, qword [rsp + 0xf0]
xor ebx, ebx
mov qword [rsp + 0x70], rbx
lea rbp, [rsp + 0x70]
test rax, rax
cmovne rbp, rax
cmp byte [rcx + 0x15], bl
je 0x14001716e
cmp rdx, 0x7fffffff
jae 0x14001716e
mov rax, qword gs:[0x30]
mov dword [rax + 0x1250], ebx
mov qword [rsp + 0x20], rbp
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
jmp 0x14001729a
call fcn.1400019a0
mov r12, rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], bl
mov r8d, 0x1a
lea rdx, str.NtWow64ReadVirtualMemory64
lea rcx, [rsp + 0x30]
call fcn.140002600
nop
call fcn.140008470
lea rcx, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x30]
mov rdi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x48]
cmp r14, 0x10
cmovae rcx, rdi
movabs r9, 0xcbf29ce484222325
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x140017203
movabs r8, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rbx]
xor r9, rax
imul r9, r8
inc rbx
cmp rbx, rdx
jb 0x1400171f0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, r12
call fcn.140003160
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140017255
cmp rdx, qword [r12 + 8]
je 0x140017255
mov rbx, qword [rdx + 0x30]
lea rcx, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x140017260
mov qword [rsp + 0x20], rbp
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, rsi
mov rcx, qword [r13 + 8]
call rbx
mov ebx, eax
jmp 0x140017265
lea rcx, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
cmp r14, 0x10
jb 0x140017298
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140017290
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400172bb
mov rcx, rdi
call fcn.140079aa4
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140079bc0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1400892cc
int3
Function at 0x1400172d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x88
mov rax, qword [0x140230a00]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x50], r9
mov qword [rsp + 0x58], r8
mov rsi, rdx
mov r13, rcx
mov rax, qword [rsp + 0xf0]
xor ebx, ebx
mov qword [rsp + 0x70], rbx
lea rbp, [rsp + 0x70]
test rax, rax
cmovne rbp, rax
cmp byte [rcx + 0x15], bl
je 0x14001735e
cmp rdx, 0x7fffffff
jae 0x14001735e
mov rax, qword gs:[0x30]
mov dword [rax + 0x1250], ebx
mov qword [rsp + 0x20], rbp
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rax, qword gs:[0x30]
mov eax, dword [rax + 0x1250]
jmp 0x14001748a
call fcn.1400019a0
mov r12, rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], bl
mov r8d, 0x1b
lea rdx, str.NtWow64WriteVirtualMemory64
lea rcx, [rsp + 0x30]
call fcn.140002600
nop
call fcn.140008470
lea rcx, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rsp + 0x30]
mov rdi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x48]
cmp r14, 0x10
cmovae rcx, rdi
movabs r9, 0xcbf29ce484222325
mov rdx, qword [rsp + 0x40]
test rdx, rdx
je 0x1400173f3
movabs r8, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + rbx]
xor r9, rax
imul r9, r8
inc rbx
cmp rbx, rdx
jb 0x1400173e0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x60]
mov rcx, r12
call fcn.140003160
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x140017445
cmp rdx, qword [r12 + 8]
je 0x140017445
mov rbx, qword [rdx + 0x30]
lea rcx, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
je 0x140017450
mov qword [rsp + 0x20], rbp
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, rsi
mov rcx, qword [r13 + 8]
call rbx
mov ebx, eax
jmp 0x140017455
lea rcx, [r12 + 0x40]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 0xc0000138
cmp r14, 0x10
jb 0x140017488
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140017480
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400174ab
mov rcx, rdi
call fcn.140079aa4
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140079bc0
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.1400892cc
int3