joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400025e0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x1400025f8
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140002600
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140002610
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x140002655
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x14000264c
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x140002657
add rax, 0x28
cmp rax, r9
jne 0x140002638
xor eax, eax
ret

Function at 0x140002660
Capabilities:
Parse pe header

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.strlen
cmp rax, 8
ja 0x1400026f0
mov rdx, qword [0x14000a7c0]
xor r12d, r12d
cmp word [rdx], 0x5a4d
jne 0x1400026de
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x1400026de
cmp word [rax + 0x18], 0x20b
jne 0x1400026de
movzx edx, word [rax + 0x14]
lea r12, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x1400026f0
sub eax, 1
lea rax, [rax + rax*4]
lea rsi, [r12 + rax*8 + 0x28]
jmp 0x1400026c9
add r12, 0x28
cmp r12, rsi
je 0x1400026f0
mov r8d, 8
mov rdx, rbx
mov rcx, r12
call sym.strncmp
test eax, eax
jne 0x1400026c0
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x140002700
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000a7c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002720
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002728
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002720
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x140002775
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x14000276c
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002720
add rax, 0x28
cmp rax, r9
jne 0x140002758
xor eax, eax
ret

Function at 0x140002780
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000a7c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1400027a0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400027a8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400027a0
movzx r8d, word [rax + 6]
mov eax, r8d
ret
Function at 0x1400027c0
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x14000a7c0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x1400027e0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x1400027e8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x1400027e0
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x140002828
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x14000281f
test rcx, rcx
je 0x1400027e0
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x140002810
xor eax, eax
ret

Function at 0x140002830
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000a7c0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x140002850
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x140002858
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x140002870
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000a7c0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002890
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002898
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002890
sub rcx, rdx
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x140002890
lea eax, [r8 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop dword [rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x1400028dc
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400028f0
add rdx, 0x28
cmp rdx, r9
jne 0x1400028c8
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140002900
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x14000a7c0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002922
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002930
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002922
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002922
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x140002922
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x14000297d
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140002990
add rdx, 0x28
cmp r10, rdx
jne 0x140002968
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x14000299f
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x1400029af
mov edx, dword [rax + 0xc]
test edx, edx
je 0x140002986
test ecx, ecx
jg 0x140002998
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x14095d058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x14095d1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14095d089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14095d06f
add dl, dl
jne 0x14095d096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14095d0f6
xor eax, eax
add dl, dl
jne 0x14095d0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14095d1ad
add dl, dl
jne 0x14095d0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14095d0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14095d0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14095d0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14095d0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14095d07e
mov eax, 1
add dl, dl
jne 0x14095d106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14095d113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14095d0fb
sub eax, ebx
mov ebx, 1
jne 0x14095d14c
mov ecx, 1
add dl, dl
jne 0x14095d12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14095d13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14095d123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14095d07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14095d168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14095d175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14095d15d
cmp eax, 0x7d00
jae 0x14095d19b
cmp eax, 0x500
jb 0x14095d196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14095d07e
cmp eax, 0x7f
ja 0x14095d19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14095d07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14095d1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14095d07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140011127
Capabilities:
Create thread

Disassembly:
jmp 0x140012580
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x140020018]
xor rax, rbp
mov qword [rbp + 0x120], rax
lea rcx, [0x14002610e]
call fcn.140011546
mov edx, 8
lea rcx, [rbp + 8]
call fcn.1400111a9
mov rdx, qword [rbp + 0x158]
lea rcx, [rbp + 0x108]
call fcn.1400112cb
mov qword [rbp + 0x118], rax
mov rdx, qword [rbp + 0x118]
lea rcx, [rbp + 8]
call fcn.140011145
nop
lea rcx, [rbp + 0x108]
call fcn.140011235
lea rax, [0x1400113a7]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x150]
add rax, 8
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 8]
call fcn.1400113c5
mov rcx, qword [rbp + 0x118]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x150]
mov qword [rcx], rax
mov rax, qword [rbp + 0x150]
cmp qword [rax], 0
je 0x140012680
lea rcx, [rbp + 8]
call fcn.140011253
jmp 0x140012699
mov rax, qword [rbp + 0x150]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.140011154
nop
lea rcx, [rbp + 8]
call fcn.140011235
lea rcx, [rbp - 0x30]
lea rdx, [0x14001cd00]
call fcn.140011492
mov rcx, qword [rbp + 0x120]
xor rcx, rbp
call fcn.1400112b2
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret

Function at 0x14001131b
Capabilities:
Terminate process

Disassembly:
jmp 0x1400153f0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400113de
Capabilities:
Parse pe header

Disassembly:
jmp 0x140016740
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140016760
xor al, al
jmp 0x1400167e1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140016773
xor al, al
jmp 0x1400167e1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001679d
xor al, al
jmp 0x1400167e1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400167b1
xor al, al
jmp 0x1400167e1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400167c3
xor al, al
jmp 0x1400167e1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400167df
xor al, al
jmp 0x1400167e1
mov al, 1
add rsp, 0x38
ret
Function at 0x140026030
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x140026134
xchg rbx, r15
mov qword [rsp + 0x10], r15
xchg r15, rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
xchg rdi, rsi
mov qword [rsp + 0x30], rsi
xchg rdi, rsi
mov rbx, rdx
xchg rcx, r9
mov rdi, r9
xchg r9, rcx
mov esi, r8d
sub rdi, rdx
xchg rcx, rbp
mov rcx, rbp
xchg rcx, rbp
add rdi, 0xf0
dec rsi
shr rsi, 1
shr rsi, 1
shr rsi, 2
inc rsi
nop dword [rax]
xchg rbx, rcx
movups xmm0, xmmword [rcx]
xchg rbx, rcx
xchg rbp, r11
mov rdx, r11
xchg r11, rbp
mov rcx, rbx
call fcn.140026810
mov ecx, 0x15e981e2
add ecx, 0x1bbabed5
xor ecx, 0x6fe8db33
add ecx, 0x1a12b19a
xor ecx, 0x56900994
sub ecx, 0x19028a4e
add ecx, 0x5d9b5392
sub ecx, 0x73680dbe
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1400260e4
add rdi, 0xfffffffffffffff0
movups xmmword [rbp + 0xf0], xmm0
sub rsi, 1
jne 0x14002608e
xchg rbx, rdi
mov rbx, qword [rsp + 0x30]
xchg rdi, rbx
xchg rcx, rbx
mov rcx, qword [rsp + 0x38]
xchg rcx, rbx
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
nop
mov rsi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140026140
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
nop
push r14
mov qword [rsp], rdi
sub rsp, 0x20
mov edi, r8d
xchg rbx, r9
mov r9, rdx
xchg rbx, r9
lea r9, [rcx + 0xf0]
mov rsi, rcx
test r8d, r8d
je 0x140026203
dec rdi
shr rdi, 2
shr rdi, 2
inc rdi
nop dword [rax]
nop word [rax + rax]
xchg r12, rax
mov r12, rbx
xchg r12, rax
sub r9, rbx
mov edx, 0x4074a5c6
sub edx, 0x18f4f24b
add edx, 0x2c06f41c
add edx, 0x27e1cfcb
xor edx, 0x4248a7c1
sub edx, 0x3920d093
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400261c6
xchg rdx, rsi
mov rsi, rdx
xchg rdx, rsi
mov rcx, rbx
call fcn.1400262b0
xchg rbp, r9
mov rbp, rbx
xchg r9, rbp
sub rbx, 0xfffffffffffffff0
sub rdi, 1
jne 0x140026194
xchg r9, rbx
movups xmm0, xmmword [rbx]
xchg rbx, r9
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
xchg r13, rsi
movups xmmword [r13 + 0xf0], xmm0
xchg r13, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400279a0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov qword [rsp + 8], rbx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x10
mov rbx, rdx
mov r10, rcx
test r8b, 0xf
je 0x1400279d7
xor al, al
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
nop
mov rdi, qword [rsp]
add rsp, 8
ret
xor edx, edx
test r8d, r8d
je 0x140027a83
movdqa xmm2, xmmword [rsp]
nop
xchg r12, rdx
movdqu xmm1, xmmword [r12 + rbx]
xchg r12, rdx
test edx, edx
jne 0x140027a05
movdqu xmm2, xmmword [r10 + 0x200]
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
pxor xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0x7cbaf5de
xor ecx, 0x119525ca
sub ecx, 0x20021820
xor ecx, 0x5eb3449f
add ecx, 0x4dfa01ec
sub ecx, 0x77a1ea2
xor ecx, 0x5a1ed6b8
nop dword [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027a47
aesdeclast xmm0, xmmword [r10 + 0x1e0]
pxor xmm0, xmm2
movdqa xmm2, xmm1
xchg r15, rdx
movups xmmword [r15 + r9], xmm0
xchg rdx, r15
add edx, 0x10
cmp edx, r8d
jb 0x1400279e8
mov rbx, qword [rsp + 0x20]
mov al, 0x17
add al, 0x14
xor al, 0x1c
xor al, 0x5d
xor al, 1
sub al, 0x6a
add rsp, 0x10
push rax
push rax
push rdx
xchg qword [rsp + 0x18], rdi
add rsp, 0x20
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140028920
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rbx
mov qword [rsp + 8], rcx
xchg rbx, rcx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg r8, r9
mov rbx, r9
xchg r8, r9
xchg rdi, rdx
mov rdx, rdi
xchg rdx, rdi
xchg r8, rcx
mov rsi, r8
xchg rcx, r8
jne 0x1400289b5
nop
mov r8, qword [rbx + 0x10]
mov rdx, rdi
xchg rsi, r9
mov rcx, r9
xchg r9, rsi
call fcn.140028920
mov rcx, rbx
mov edx, 0x4dadb23e
xor edx, 0x2b5ab534
sub edx, 0x1cf3b6fa
sub edx, 0x37ced84
xor edx, 0x77eaa14
sub edx, 0x1f8182e3
add edx, 0x19fa3926
xor edx, 0x3c717eeb
mov rbx, qword [rbx]
call fcn.1401fcdd8
cmp byte [rbx + 0x19], 0
je 0x14002895c
xchg rbx, r12
mov r12, qword [rsp + 0x30]
xchg rbx, r12
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x1400298a0
Capabilities:
Encode data using xor

Disassembly:
xchg rbp, rbx
mov qword [rsp + 8], rbp
xchg rbx, rbp
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov rdi, rcx
xor ebx, ebx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x14002992d
xchg rdx, rsi
mov rsi, qword [rdi + 0x28]
xchg rsi, rdx
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x14002991c
xchg r8, rdx
mov rdx, qword [rcx - 8]
xchg rdx, r8
nop
add rdx, 0x2f17ef9d
sub rdx, 0x2f17ef76
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400299fc
xchg rbx, rcx
mov rbx, r8
xchg rcx, rbx
call fcn.1401fcdd8
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x20], rbx
mov qword [rdi + 0x28], rbx
xchg r15, rcx
mov r15, qword [rdi + 8]
xchg rcx, r15
xchg rdi, rax
mov rdi, qword [rcx + 8]
xchg rdi, rax
mov qword [rax], rbx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14002999f
nop dword [rax + rax]
xchg rbx, r10
mov r10, qword [rcx]
xchg r10, rbx
mov edx, 0x1ec835cb
xor edx, 0x7e9e8cf2
xor edx, 0x207c08ca
sub edx, 0x3519a7e6
add edx, 0x1169640f
xor edx, 0x784b5e86
xor edx, 0x64313082
call fcn.1401fcdd8
xchg r12, rbx
mov rcx, r12
xchg rbx, r12
test rbx, rbx
jne 0x140029956
xchg rcx, r10
mov r10, qword [rdi + 8]
xchg rcx, r10
mov edx, 0x18dbc1f3
xor edx, 0x2d1f3ee2
xor edx, 0x3dc09886
add edx, 0x670b9338
add edx, 0x937015a
sub edx, 0xa208d0a
sub edx, 0x649d844f
add edx, 0xe7d4152
sub edx, 0x18062c0a
xchg rbx, r12
mov r12, qword [rsp + 0x30]
xchg rbx, r12
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
jmp fcn.1401fcdd8
call 0x1404b9ca5
int3
Function at 0x14002ca50
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
xchg r9, rbx
mov qword [rsp + 0x10], r9
xchg rbx, r9
mov qword [rsp + 0x18], rsi
xchg rdi, rbp
mov qword [rsp + 0x20], rbp
xchg rdi, rbp
push r14
sub rsp, 0x30
xchg rcx, rsi
mov rcx, rsi
xchg rcx, rsi
mov rax, qword gs:[0x30]
xchg rcx, rdi
mov rcx, qword [rax + 0x60]
xchg rdi, rcx
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
xchg rbx, r10
mov qword [rsp + 0x40], r10
xchg r10, rbx
add rcx, 0xc8
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x63ddd43f
add dword [rsp + 0x20], 0x99aa7c8
add dword [rsp + 0x20], 0xa9e1028
sub dword [rsp + 0x20], 0x3f39995b
sub dword [rsp + 0x20], 0x5d8e27d
sub dword [rsp + 0x20], 0x2fd00477
xor dword [rsp + 0x20], 0x5c49f22a
xor dword [rsp + 0x20], 0x5f7df9c2
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b720
test eax, eax
js 0x14002cb1b
cmp qword [rsp + 0x40], rbx
je 0x14002cb1b
lea eax, [rbx + 1]
jmp 0x14002cc3f
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0x70], 2
jbe 0x14002cb64
mov eax, 0x6be3a84b
sub eax, 0x4c44aab8
add eax, 0x2d3b5f9b
add eax, 0x263c36df
sub eax, 0x2e724573
sub eax, 0x2a4a9674
add eax, 0xd79aead
add eax, 0xfb064aa
sub eax, 0x3783cb7b
jmp 0x14002cc3f
cmp dword [rcx + 0x74], ebx
jbe 0x14002cb90
mov eax, 0x92b60c3
add eax, 0x34b05ae2
add eax, 0x71713ad
sub eax, 0x1530e48b
add eax, 0x1d43e1e2
sub eax, 0x4d05cca6
jmp 0x14002cc3f
cmp byte [rdi + 2], bl
je 0x14002cbbc
mov eax, 0x44853bce
sub eax, 0x2a9b7f36
add eax, 0x30a42dc1
sub eax, 0x4a36a704
add eax, 0x6946cdf0
xor eax, 0x699e1141
jmp 0x14002cc3f
cmp r14d, 0xa
jb 0x14002cbfe
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002cbfe
mov eax, 0x69c84f32
sub eax, 0x61d3c7ae
add eax, 0x246159b0
add eax, 0x5145840
add eax, 0x131d2cc2
sub eax, 0x4487662e
jmp 0x14002cc3f
lea rcx, [rsi + 0xb8]
mov edx, 0x7b957d2f
xor edx, 0x1ee9a6e5
add edx, 0x184a221f
xor edx, 0x40e6c83
sub edx, 0x589e3599
xor edx, 0x137807f0
add edx, 0x67473d78
call fcn.14002c030
jmp 0x14002cc3d
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
xchg rdi, rsi
mov rsi, qword [rsp + 0x58]
xchg rdi, rsi
add rsp, 0x30
push rdx
push rbx
push rax
push rcx
push rdx
push rcx
push rdx
push rdx
xchg qword [rsp + 0x40], r14
add rsp, 0x48
ret
Function at 0x140033b00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rbp, r13
mov qword [rsp + 0x18], r13
xchg rbp, r13
nop
sub rsp, 8
mov qword [rsp], rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg rbx, r8
mov r8, rbx
xchg rbx, r8
mov rsi, rdx
xchg rbp, rsi
mov rsi, rcx
xchg rsi, rbp
jne 0x140033bca
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
mov rdx, rsi
xchg r8, rcx
mov r8, rbp
xchg rcx, r8
call fcn.140033b00
mov rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004cbd0
mov edx, 0x753bf0a2
sub edx, 0x68ad4953
xor edx, 0x6bd80501
sub edx, 0xc27eb1f
sub edx, 0x13081b71
sub edx, 0x92906a7
sub edx, 0x77e7024
add edx, 0x32bb953f
sub edx, 0x6a3ab9e2
xchg rdi, rcx
mov rdi, rcx
xchg rdi, rcx
call fcn.1401fcdd8
cmp byte [rbx + 0x19], 0
je 0x140033b4e
xchg rdi, r15
mov r15, qword [rsp + 0x30]
xchg r15, rdi
xchg r10, rbx
mov r10, qword [rsp + 0x38]
xchg rbx, r10
xchg rbp, r15
mov r15, qword [rsp + 0x40]
xchg rbp, r15
add rsp, 0x20
nop
xchg qword [rsp], rsi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140033c00
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rdi, rbp
mov qword [rsp + 0x18], rdi
xchg rbp, rdi
nop
push 0x21035474
mov qword [rsp], rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg rbx, r8
mov r8, rbx
xchg rbx, r8
xchg rsi, rdx
mov rdx, rsi
xchg rdx, rsi
xchg rdx, rcx
mov rbp, rdx
xchg rdx, rcx
jne 0x140033ccb
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
xchg r8, r10
mov r10, qword [rbx + 0x10]
xchg r8, r10
xchg rdx, rsi
mov rsi, rdx
xchg rsi, rdx
xchg r10, rbp
mov rcx, r10
xchg rbp, r10
call fcn.140033c00
xchg rsi, rbx
mov rdi, rsi
xchg rbx, rsi
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004cbd0
mov edx, 0x10eb7e10
add edx, 0x5cba24f9
xor edx, 0x16a862f3
sub edx, 0x1b22e35e
xor edx, 0x5f8deeab
xor edx, 0x673067
mov rcx, rdi
call fcn.1401fcdd8
cmp byte [rbx + 0x19], 0
je 0x140033c55
xchg rdi, rbp
mov rbp, qword [rsp + 0x30]
xchg rdi, rbp
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
push rax
push rax
push rcx
push rdx
xchg qword [rsp + 0x20], rsi
pop rdx
pop rcx
pop rax
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140035990
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rcx
mov qword [rsp + 8], r9
xchg r9, rcx
nop
sub rsp, 8
mov qword [rsp], rbx
push rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
push r12
push r13
nop
sub rsp, 8
mov qword [rsp], r14
push r15
sub rsp, 0x30
xchg r15, r13
mov r13, rdx
xchg r15, r13
xchg rdi, r14
mov rdi, rcx
xchg r14, rdi
movabs rsi, 0xfffffff4be8c535
sub rsi, 0x2d454f73
add rsi, 0xab4941d
add rsi, 0x3a2be2bd
xor rsi, 0x45ca3d5f
add rsi, 0x1b16b288
add rsi, 0x7fffffff
add rsi, 0x3e9f7bb5
cmp rdx, rsi
ja 0x140035bfb
xchg r13, r12
mov r13, qword [rcx + 8]
xchg r12, r13
sub r12, qword [rcx]
sar r12, 2
sar r12, 2
mov rcx, qword [rcx + 0x10]
sub rcx, qword [r14]
sar rcx, 1
sar rcx, 3
xchg r15, rdx
mov r15, rcx
xchg rdx, r15
shr rdx, 1
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
sub rax, rdx
cmp rcx, rax
ja 0x140035a65
lea rsi, [rdx + rcx]
cmp rsi, r15
cmovb rsi, r15
xchg rsi, r9
mov qword [rsp + 0x88], r9
xchg rsi, r9
xchg r11, rsi
mov rdx, r11
xchg rsi, r11
xchg rcx, r14
mov r14, rcx
xchg rcx, r14
call fcn.140053750
mov r13, rax
mov qword [rsp + 0x28], rax
xchg rbx, rdi
mov rdi, r12
xchg rbx, rdi
shl rbx, 1
shl rbx, 3
add rbx, rax
xchg rbx, r11
mov qword [rsp + 0x20], r11
xchg r11, rbx
xchg r15, r13
mov rdi, r13
xchg r13, r15
sub rdi, r12
mov qword [rsp + 0x78], rbx
je 0x140035b14
nop word [rax + rax]
mov byte [rbx], 1
add byte [rbx], 0x77
sub byte [rbx], 0x34
add byte [rbx], 0x2b
add byte [rbx], 4
xor byte [rbx], 0x57
sub byte [rbx], 0xd
xor byte [rbx], 0x17
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004ba30
nop
neg rbx
add rbx, 0xfffffffffffffff0
neg rbx
xchg rbx, r8
mov qword [rsp + 0x78], r8
xchg r8, rbx
sub rdi, 1
jne 0x140035ad1
xchg r13, r8
mov r13, qword [r14 + 8]
xchg r13, r8
mov rdx, r13
xchg rcx, rsi
mov rsi, qword [r14]
xchg rsi, rcx
cmp rcx, r8
je 0x140035b70
xor r9d, r9d
movzx eax, byte [rcx]
mov byte [rdx], al
mov rax, qword [rcx + 8]
xchg rcx, rax
mov qword [rdx + 8], rcx
xchg rcx, rax
mov byte [rcx], r9b
xchg rbx, r9
mov qword [rcx + 8], rbx
xchg rbx, r9
lea rdx, [rdx + 0x10]
nop
sub rcx, 0x44db2cb5
add rcx, 0x44db2cc5
cmp rcx, r8
jne 0x140035b36
xchg rsi, r9
mov rsi, r9
xchg r9, rsi
xchg r15, r11
mov r8, r11
xchg r15, r11
xchg r10, r13
mov rdx, r10
xchg r10, r13
mov rcx, r14
add rsp, 0x30
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
mov r14, qword [rsp - 8]
push rbx
push rcx
push rax
push rdx
push rdx
push rbx
xchg qword [rsp + 0x30], r13
add rsp, 0x38
push rdx
push rbx
push rcx
push rdx
push rbx
push rax
push rax
xchg qword [rsp + 0x38], r12
pop rax
pop rax
pop rbx
pop rdx
pop rcx
pop rbx
pop rdx
add rsp, 8
nop
xchg qword [rsp], rdi
add rsp, 8
push rbx
push rdx
push rcx
push rbx
push rax
push rbx
push rcx
xchg qword [rsp + 0x38], rsi
pop rcx
pop rbx
pop rax
pop rbx
pop rcx
pop rdx
pop rbx
add rsp, 8
nop
add rsp, 8
mov rbx, qword [rsp - 8]
jmp fcn.1400528c0
call fcn.14002f8b0
int3