joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140181d94
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
test rcx, rcx
jne 0x140181dc6
call fcn.14016f93c
mov dword [rax], 0x16
call fcn.14015671c
jmp 0x140181ee5
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140181ee5
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x140181ee5
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x140181df5
lock or dword [rcx + 0x14], 0x10
jmp 0x140181ee5
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x140181e09
call fcn.1401824b8
mov rdi, qword [rsi + 8]
mov rcx, rsi
mov ebx, dword [rsi + 0x20]
mov qword [rsi], rdi
call fcn.14017f3ac
mov r8d, ebx
mov rdx, rdi
mov ecx, eax
call fcn.1401691c4
mov dword [rsi + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 1
jbe 0x140181ed3
mov eax, dword [rsi + 0x14]
or edi, 0xffffffff
test al, 6
jne 0x140181e9e
mov rcx, rsi
call fcn.14017f3ac
cmp eax, edi
je 0x140181e89
mov rcx, rsi
call fcn.14017f3ac
cmp eax, 0xfffffffe
je 0x140181e89
mov rcx, rsi
call fcn.14017f3ac
movsxd rbx, eax
lea r14, [0x14023cd30]
mov rcx, rsi
sar rbx, 6
call fcn.14017f3ac
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rbx*8]
lea rdx, [rax + rcx*8]
jmp 0x140181e90
lea rdx, [0x14022c220]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140181e9e
lock or dword [rsi + 0x14], 0x20
cmp dword [rsi + 0x20], 0x200
jne 0x140181ec2
mov eax, dword [rsi + 0x14]
shr eax, 6
test al, 1
je 0x140181ec2
mov eax, dword [rsi + 0x14]
shr eax, 8
test al, 1
jne 0x140181ec2
mov dword [rsi + 0x20], 0x1000
mov rax, qword [rsi]
add dword [rsi + 0x10], edi
movzx edi, byte [rax]
inc rax
mov qword [rsi], rax
jmp 0x140181ee8
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rsi + 0x14], eax
and dword [rsi + 0x10], 0
or edi, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x140183884
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1401838b4
xor eax, eax
jmp 0x140183977
mov rbp, rbx
cmp word [rax], si
je 0x1401838d9
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x1401838c0
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1401838bc
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14017df24
movsxd r14, eax
test eax, eax
jne 0x140183917
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1401838ad
mov rcx, r14
call fcn.14017988c
mov rdi, rax
test rax, rax
jne 0x140183930
xor ecx, ecx
call fcn.140178e5c
jmp 0x14018390c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14017df24
test eax, eax
jne 0x140183961
mov rcx, rdi
call fcn.140178e5c
jmp 0x14018396b
xor ecx, ecx
call fcn.140178e5c
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140183994
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140183a1b
mov rsi, rbx
cmp word [rax], bp
je 0x1401839da
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x1401839c4
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x1401839c0
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14017988c
mov rdi, rax
test rax, rax
je 0x140183a08
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140151a90
mov rbp, rdi
xor ecx, ecx
call fcn.140178e5c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14000b9ac
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140016950], eax
call fcn.14000b730
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140016950], 0
jne case.default.0x14000ba02
mov ecx, 1
call fcn.14000b730
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
add edi, ebp
cmp bl, byte [rdx + 0xba0a133]
push rdi
push rsi
xchg ecx, eax
in eax, 0xd9
invalid
Function at 0x140c5e5d8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140c5e75f
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140c5e609
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c5e5ef
add dl, dl
jne 0x140c5e616
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c5e676
xor eax, eax
add dl, dl
jne 0x140c5e625
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c5e72d
add dl, dl
jne 0x140c5e636
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c5e643
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c5e650
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c5e65d
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140c5e66a
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140c5e5fe
mov eax, 1
add dl, dl
jne 0x140c5e686
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c5e693
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c5e67b
sub eax, ebx
mov ebx, 1
jne 0x140c5e6cc
mov ecx, 1
add dl, dl
jne 0x140c5e6ae
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c5e6bb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c5e6a3
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c5e5fe
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140c5e6e8
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c5e6f5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c5e6dd
cmp eax, 0x7d00
jae 0x140c5e71b
cmp eax, 0x500
jb 0x140c5e716
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c5e5fe
cmp eax, 0x7f
ja 0x140c5e71e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c5e5fe
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140c5e752
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140c5e5fe
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1001304e8
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push r13
sub rsp, 0xb0
xor ebx, ebx
mov dword [rsp + 0x20], ebx
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
mov r12d, ebx
xor eax, eax
lock cmpxchg qword [0x100178108], rdi
je 0x100130548
cmp rax, rdi
jne 0x10013053b
mov r12d, 1
jmp 0x100130548
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100130521
mov eax, dword [0x100178100]
cmp eax, 1
jne 0x10013055d
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x1001305c4
mov eax, dword [0x100178100]
cmp eax, ebx
jne 0x1001305ba
mov dword [0x100178100], 1
lea r13, [0x100001c08]
lea rdi, [0x100001bf0]
mov qword [rsp + 0x30], rdi
mov eax, ebx
mov dword [rsp + 0x24], ebx
cmp rdi, r13
jae 0x1001305ac
cmp eax, ebx
jne 0x1001305ac
mov rcx, qword [rdi]
cmp rcx, rbx
je 0x1001305a1
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x10013058a
cmp eax, ebx
je 0x1001305c4
mov eax, 0xff
jmp 0x10013070c
mov dword [0x100177464], 1
mov eax, dword [0x100178100]
cmp eax, 1
jne 0x1001305ec
lea rdx, [0x100001be8]
lea rcx, [0x100001b60]
call sub.msvcrt.dll__initterm
mov dword [0x100178100], 2
cmp r12d, ebx
jne 0x1001305fb
mov rax, rbx
xchg qword [0x100178108], rax
cmp qword [0x100178120], rbx
je 0x100130623
lea rcx, [0x100178120]
call fcn.100130cac
cmp eax, ebx
je 0x100130623
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100178120]
mov rcx, qword [sym.imp.msvcrt.dll__wcmdln]
cmp qword [rcx], rbx
jne 0x100130639
mov eax, 0xff
jmp 0x10013070c
mov rcx, qword [rcx]
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
cmp word [rcx], 0x20
ja 0x1001306be
cmp word [rcx], bx
je 0x100130654
cmp edx, ebx
jne 0x1001306be
cmp word [rcx], bx
je 0x10013066a
cmp word [rcx], 0x20
ja 0x10013066a
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x100130654
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x100000000]
call fcn.10005060c
mov dword [0x100177460], eax
cmp dword [0x100177444], ebx
jne 0x1001306a8
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100177464], ebx
jne 0x1001306bc
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100177460]
jmp 0x10013070c
cmp word [rcx], 0x22
jne 0x1001306d1
mov eax, ebx
cmp edx, ebx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x100130645
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov r12, qword [r11 + 0x20]
mov rsp, r11
pop r13
ret
sub rsp, 0x28
call 0x100217000
add rsp, 0x28
jmp 0x1001304e8
Function at 0x140009c00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x40]
sub rsp, 0x140
mov rax, qword [0x14001b040]
xor rax, rsp
mov qword [rbp + 0x30], rax
mov rdi, rcx
mov qword [rsp], rcx
xor r8b, r8b
lea r9, [rsp + 0x30]
mov r10d, send
nop word [rax + rax]
movzx ecx, r8b
lea r9, [r9 + 4]
movzx eax, r8b
add r8b, 4
movzx edx, byte [rax + rdi + 1]
movzx eax, byte [rcx + rdi]
shl eax, 8
or edx, eax
movzx eax, byte [rcx + rdi + 2]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + rdi + 3]
shl edx, 8
or edx, eax
mov dword [r9 - 4], edx
sub r10, 1
jne 0x140009c50
mov esi, dword [rsp + 0x30]
lea rbx, [rsp + 0x30]
mov r11b, 0x10
nop dword [rax + rax]
mov r9d, dword [rbx + 4]
lea r10, [rbx]
movzx eax, r11b
lea rbx, [rbx + 4]
mov r8d, r9d
inc r11b
ror r8d, 0x12
mov edx, dword [rsp + rax*4 + 0x28]
mov ecx, edx
ror ecx, 0x13
mov eax, r9d
ror eax, 7
xor r8d, eax
mov eax, r9d
shr eax, 3
xor r8d, eax
mov eax, edx
ror eax, 0x11
xor ecx, eax
shr edx, 0xa
xor ecx, edx
add r8d, ecx
add r8d, dword [r10 + 0x24]
add r8d, esi
mov esi, r9d
mov dword [r10 + 0x40], r8d
cmp r11b, 0x40
jb 0x140009ca0
movups xmm0, xmmword [rdi + 0x48]
lea rax, [rdi + 0x48]
xor esi, esi
movups xmm1, xmmword [rax + 0x10]
mov qword [rsp + 8], rax
mov edi, 0x40
movups xmmword [rsp + 0x10], xmm0
mov r12d, dword [rsp + 0x18]
mov r13d, dword [rsp + 0x14]
mov r11d, dword [rsp + 0x10]
movups xmmword [rsp + 0x20], xmm1
mov r14d, dword [rsp + 0x28]
mov r15d, dword [rsp + 0x24]
mov ebx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x2c]
nop word [rax + rax]
mov ecx, ebx
lea rsi, [rsi + 4]
ror ecx, 0xb
mov r10d, ebx
ror r10d, 0x19
mov edx, ebx
xor r10d, ecx
not edx
and edx, r14d
mov ecx, ebx
ror ecx, 6
mov r8d, r12d
xor r10d, ecx
mov r9d, r13d
mov ecx, r15d
and r9d, r8d
and ecx, ebx
xor edx, ecx
lea rcx, [0x140013aa0]
add r10d, edx
mov edx, r11d
add r10d, dword [rsi + rcx - 4]
mov ecx, r11d
add r10d, dword [rsp + rsi + 0x2c]
ror ecx, 0xd
add r10d, eax
ror edx, 0x16
mov eax, r14d
xor edx, ecx
mov r14d, r15d
mov ecx, r11d
mov r15d, ebx
mov ebx, dword [rsp + 0x1c]
ror ecx, 2
add ebx, r10d
xor edx, ecx
mov dword [rsp + 0x1c], r12d
mov r12d, r13d
mov r13d, r11d
mov ecx, r12d
or ecx, r8d
and r11d, ecx
lea ecx, [r10 + rdx]
or r11d, r9d
add r11d, ecx
sub rdi, 1
jne 0x140009d40
lea r8, [rsp + 0x10]
mov dword [rsp + 0x2c], eax
sub r8, qword [rsp]
mov edx, 8
mov rax, qword [rsp + 8]
mov dword [rsp + 0x10], r11d
mov dword [rsp + 0x20], ebx
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x24], r15d
mov dword [rsp + 0x18], r12d
mov dword [rsp + 0x14], r13d
nop dword [rax + rax]
mov ecx, dword [rax + r8 - 0x48]
add dword [rax], ecx
lea rax, [rax + 4]
sub rdx, 1
jne 0x140009e10
mov rcx, qword [rbp + 0x30]
xor rcx, rsp
call fcn.14000fc90
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14000bcc0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
xor ecx, ecx
call qword [0x1400120c8]
mov ebp, 0x5a4d
lea rsi, str..text
mov r9, rax
test rax, rax
jne 0x14000bd11
call qword [0x140012030]
lea r8, str._Failed_to_get_module_handle:__d___GetSectionAddress_n
mov edx, 2
mov r9d, eax
call fcn.1400039c0
xor edi, edi
jmp 0x14000bda9
cmp word [rax], bp
je 0x14000bd2e
lea r8, str._Invalid_DOS_header___GetSectionAddress._n
mov edx, 2
call fcn.140003810
xor edi, edi
jmp 0x14000bda9
movsxd rcx, dword [rax + 0x3c]
add rcx, r9
cmp dword [rcx], 0x4550
je 0x14000bd52
lea r8, str._Invalid_NT_header___GetSectionAddress._n
mov edx, 2
call fcn.140003810
xor edi, edi
jmp 0x14000bda9
movzx edx, word [rcx + 0x14]
add rdx, 0x18
add rdx, rcx
xor edi, edi
mov r8d, edi
test rdx, rdx
je 0x14000bd8b
mov rcx, rdi
nop word [rax + rax]
movzx eax, byte [rdx + rcx]
inc rcx
cmp al, byte [rsi + rcx - 1]
jne 0x14000bd8b
cmp rcx, 6
jne 0x14000bd70
mov ebx, dword [rdx + 0xc]
add rbx, r9
jmp 0x14000bdac
add rdx, 0x28
inc r8d
cmp r8d, 6
jl 0x14000bd62
lea r8, str..text_section_not_found._n
mov edx, 1
call fcn.140003810
mov rbx, rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
test rbx, rbx
jne 0x14000bdeb
lea r8, str.textAddr_was_NULL___Detections::IsTextSectionWritable
mov edx, 2
call fcn.140003810
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
xor ecx, ecx
call qword [0x140012078]
cmp word [rax], bp
je 0x14000be0b
lea r8, str.Invalid_DOS_signature___GetTextSectionSize
mov edx, 2
call fcn.140003810
jmp 0x14000be68
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x14000be2d
lea r8, str.Invalid_NT_signature___GetTextSectionSize
mov edx, 2
call fcn.140003810
jmp 0x14000be68
movzx r9d, word [rcx + 0x14]
mov edx, edi
add r9, 0x18
add r9, rcx
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rax + rax*4]
mov rax, rdi
lea r8, [r9 + rcx*8]
nop
movzx ecx, byte [r8 + rax]
inc rax
cmp cl, byte [rsi + rax - 1]
jne 0x14000bec5
cmp rax, 6
jne 0x14000be50
mov edi, dword [r8 + 8]
mov edi, edi
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
add rdi, rbx
call qword [0x1400120a0]
test rax, rax
je 0x14000bdd4
nop word [rax + rax]
cmp rbx, rdi
jae 0x14000bdd4
cmp dword [rsp + 0x44], 0x20
jne 0x14000bed2
add rbx, 0x1000
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov r8d, 0x30
call qword [0x1400120a0]
test rax, rax
jne 0x14000be90
jmp 0x14000bdd4
inc edx
cmp edx, 6
jl 0x14000be40
jmp 0x14000be68
mov r9, rbx
call fcn.14000c9e0
mov rax, rbx
jmp 0x14000bdd6
Function at 0x14000dd30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
mov rdx, qword [rdx]
test rdx, rdx
je 0x14000dd13
cmp qword [rcx + 8], 0xffffffffffffffff
jne 0x14000dc83
mov eax, 0xd
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movsxd r11, dword [rbx + 8]
mov qword [rsp + 0x30], rsi
xor esi, esi
mov r10d, esi
test r11, r11
jle 0x14000dccb
mov r9, rdx
nop dword [rax]
movzx ecx, byte [r9]
lea r9, [r9 + 1]
xor cl, 0x90
lea eax, [rcx + 0x70]
sub cl, 0x70
test r10b, 1
movzx ecx, cl
movzx eax, al
cmovne ecx, eax
inc r10d
mov byte [r9 - 1], cl
sub r11, 1
jne 0x14000dca0
mov r8d, dword [rbx + 8]
xor r9d, r9d
mov rcx, qword [rdi + 8]
call qword [0x140012500]
mov rcx, qword [rbx]
mov edi, 8
cmp eax, dword [rbx + 8]
cmove edi, esi
mov rsi, qword [rsp + 0x30]
test rcx, rcx
je 0x14000dcf9
call fcn.14000fcec
mov edx, send
mov rcx, rbx
call fcn.14000fcec
mov eax, edi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
mov eax, send
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov ebp, edx
mov r14, rcx
mov ecx, send
call fcn.14000fcb0
mov rdi, rax
mov qword [rsp + 0x50], rax
mov ecx, 0x3e8
call fcn.14000ff60
mov qword [rdi], rax
mov dword [rdi + 8], 0
mov dword [rdi + 0xc], 0x3e8
mov word [rax], 5
mov esi, dword [rdi + 8]
add esi, 2
mov dword [rdi + 8], esi
lea ecx, [rsi + 4]
mov eax, dword [rdi + 0xc]
cmp eax, ecx
jge 0x14000ddba
nop dword [rax]
add eax, eax
cmp eax, ecx
jl 0x14000dd90
mov dword [rdi + 0xc], eax
movsxd rcx, eax
call fcn.14000ff60
mov rbx, rax
movsxd rsi, esi
mov r8, rsi
mov rdx, qword [rdi]
mov rcx, rax
call fcn.140010ea9
mov qword [rdi], rbx
jmp 0x14000ddbd
movsxd rsi, esi
mov rax, qword [rdi]
mov dword [rsi + rax], ebp
add dword [rdi + 8], 4
mov rdx, rdi
mov rcx, r14
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
jmp 0x14000dc50
Function at 0x14000f0a0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x60]
xor ebp, ebp
mov rdi, rdx
mov rbx, rcx
mov esi, ebp
mov r8, qword [rax + 0x18]
mov r14, qword [r8 + 0x20]
nop dword [rax]
mov rax, qword [rbx + 0x18]
cmp esi, 0x100
jge 0x14000f1d2
mov rdx, rbx
cmp rax, 7
jbe 0x14000f0ec
mov rdx, qword [rbx]
mov rcx, qword [r14 + 0x40]
call qword [0x140012478]
test rax, rax
jne 0x14000f102
mov r14, qword [r14]
inc esi
jmp 0x14000f0d0
cmp qword [rdi + 0x18], 7
mov r8, rdi
jbe 0x14000f10f
mov r8, qword [rdi]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [r14 + 0x40]
inc rdx
call qword [0x1400126e0]
movzx eax, word [rdi + 0x10]
add ax, ax
inc ax
mov word [r14 + 0x38], ax
movzx eax, word [rdi + 0x10]
add ax, ax
inc ax
mov word [r14 + 0x3a], ax
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x14000f17d
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000f178
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000f277
mov rcx, r8
call fcn.14000fcec
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 7
mov word [rbx], bp
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x14000f1cb
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000f1c6
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000f277
mov rcx, r8
call fcn.14000fcec
mov al, 1
jmp 0x14000f255
cmp rax, 7
jbe 0x14000f209
mov rcx, qword [rbx]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000f204
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000f277
mov rcx, r8
call fcn.14000fcec
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 7
mov word [rbx], bp
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x14000f253
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000f24e
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000f277
mov rcx, r8
call fcn.14000fcec
xor al, al
mov rbx, qword [rsp + 0x50]
mov word [rdi], bp
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbp
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
call qword [0x1400125e0]
int3
Function at 0x14000f910
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x650
mov rax, qword [0x14001b040]
xor rax, rsp
mov qword [rsp + 0x640], rax
mov rax, qword gs:[0x60]
mov ecx, 0x18
mov rsi, qword [rax + 0x18]
add rsi, 0x10
mov rbx, qword [rsi]
call fcn.14000fcb0
mov rdi, rax
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov r8, qword [rbx + 0x50]
lea rcx, [rsp + 0x220]
mov edx, 0x200
call qword [0x1400126e0]
mov r8, qword [rbx + 0x60]
lea rcx, [rsp + 0x20]
mov edx, 0x100
call qword [0x1400126e0]
mov rax, qword [rbx + 0x30]
mov rdx, qword [rdi + 8]
mov qword [rsp + 0x638], rax
mov rax, qword [rbx + 0x30]
mov qword [rsp + 0x620], rax
mov eax, dword [rbx + 0x40]
mov dword [rsp + 0x628], eax
cmp rdx, qword [rdi + 0x10]
je 0x14000f9d6
mov rcx, rdx
mov r8d, 0x620
lea rdx, [rsp + 0x20]
call fcn.140010ea9
add qword [rdi + 8], 0x620
jmp 0x14000f9e3
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.140007020
mov rbx, qword [rbx]
cmp rbx, rsi
jne 0x14000f962
mov rax, rdi
mov rcx, qword [rsp + 0x640]
xor rcx, rsp
call fcn.14000fc90
lea r11, [rsp + 0x650]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x14000fa20
Capabilities:
Access peb ldr_data

Disassembly:
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov r8, rcx
mov r10, rcx
mov r9, qword [rax + 0x18]
add r9, 0x10
mov rdi, qword [r9]
mov rax, qword [rdi + 0x60]
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000fa64
add rax, 2
test ecx, ecx
jne 0x14000fa50
test edx, edx
je 0x14000faa8
nop dword [rax + rax]
mov rdi, qword [rdi]
cmp rdi, r9
je 0x14000fb1f
mov rax, qword [rdi + 0x60]
mov r8, r10
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000faa4
add rax, 2
test ecx, ecx
jne 0x14000fa90
test edx, edx
jne 0x14000fa70
mov ecx, 0x620
mov qword [rsp + 0x30], rbx
call fcn.14000fcb0
xor edx, edx
mov r8d, 0x620
mov rcx, rax
mov rbx, rax
call fcn.140010c84
mov r8, qword [rdi + 0x50]
lea rcx, [rbx + 0x200]
mov edx, 0x200
call qword [0x1400126e0]
mov r8, qword [rdi + 0x60]
mov edx, 0x100
mov rcx, rbx
call qword [0x1400126e0]
mov rcx, qword [rdi + 0x30]
mov qword [rbx + 0x618], rcx
mov rax, qword [rdi + 0x30]
mov qword [rbx + 0x600], rax
mov eax, dword [rdi + 0x40]
mov dword [rbx + 0x608], eax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x140010a20
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x140012078]
test rax, rax
je 0x140010a6a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140010a6a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140010a6a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140010a6a
cmp dword [rcx + 0x84], 0xe
jbe 0x140010a6a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140010a6c
xor al, al
add rsp, 0x28
ret