joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002230
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x14000227d
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x140002274
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x14000227f
add rax, 0x28
cmp rax, r9
jne 0x140002260
xor eax, eax
ret

Function at 0x140002280
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x140002310
mov rdx, qword [0x1400043f0]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x1400022fe
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x1400022fe
cmp word [rax + 0x18], 0x20b
jne 0x1400022fe
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x140002310
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x1400022e9
add rbx, 0x28
cmp rbx, rdi
je 0x140002310
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x1400022e0
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140002320
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400043f0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002340
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002348
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002340
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000239d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002394
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140002340
add rax, 0x28
cmp rax, r9
jne 0x140002380
xor eax, eax
ret

Function at 0x1400023a0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400043f0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400023bf
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400023c8
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400023bf
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400023e0
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x1400043f0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140002400
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140002408
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140002400
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x140002450
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140002447
test rcx, rcx
je 0x140002400
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x140002438
xor eax, eax
ret
Function at 0x140002460
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400043f0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000247f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002488
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x1400024a0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400043f0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400024c0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400024c8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400024c0
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x1400024c0
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140002514
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140002520
add rdx, 0x28
cmp r9, rdx
jne 0x140002500
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140002530
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x1400043f0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140002552
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002560
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002552
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140002552
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x140002552
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x1400025b5
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x1400025c8
add rdx, 0x28
cmp rdx, r10
jne 0x1400025a0
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x1400025d7
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x1400025e7
mov edx, dword [rax + 0xc]
test edx, edx
je 0x1400025be
test ecx, ecx
jg 0x1400025d0
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140133630
Capabilities:
Contain obfuscated stackstrings
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov dword [rdx - 0x75], eax
or al, 0x1a
xchg r9, r11
mov qword [rsp + 0x20], r11
xchg r11, r9
mov qword [rsp + 0x18], r8
jmp 0x140133645
mov dword [rsp + 0x10], edx
xchg r12, rcx
mov qword [rsp + 8], r12
xchg rcx, r12
sub rsp, 0x28
lea rax, [0x140133920]
xchg r12, rax
je 0x14013368c
jne 0x14013368c
lea r9d, [rdi + 0xdd92]
ja 0x140132aa0
lea r15d, [rdi - 0x544e]
lea r11d, [rdi - 0xc705]
neg r15
lea ebp, [rdx + 0x2b97]
pop rbx
movabs rdi, 0x14a0838b2ed727eb
lea ecx, [rdx + 0xff0]
cmp rdx, rdx
call 0x140132729
jmp 0x1401336b5
xchg rdx, rax
mov rdx, qword [rsp + 0x30]
xchg rdx, rax
mov qword [rsp + 0x10], rax
jmp 0x1401336d6
mov qword [rsp + 0x18], r12
xchg r12, rax
mov dword [rsp + 8], 0
jmp 0x1401336a2
Function at 0x18000da50
Capabilities:
Encrypt data using aes
Reference aes constants
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov dword [rsp + 0x38], 0x67
mov dword [rsp + 0x3c], 0xa947
movzx eax, byte [0x1800a61b0]
mov byte [rsp + 3], al
mov dword [rsp + 0x40], 0x3e
movsx ax, byte [0x1800a603e]
mov word [rsp + 0x10], ax
movzx eax, byte [0x1800a617c]
mov byte [rsp + 4], al
movzx eax, word [0x1800a61a8]
mov qword [rsp + 0x58], rax
movzx eax, byte [0x1800a603d]
mov word [rsp + 0x14], ax
movsx rax, byte [0x1800a6067]
mov qword [rsp + 0x60], rax
movzx eax, word [0x1800a61d8]
mov word [rsp + 0x18], ax
movzx eax, word [0x1800a6174]
mov byte [rsp + 5], al
movzx eax, word [0x1800a6168]
mov word [rsp + 0x1c], ax
movzx eax, byte [0x1800a617c]
mov byte [rsp + 6], al
movzx eax, byte [0x1800a6066]
mov byte [rsp + 7], al
mov dword [rsp + 0x44], 0x9d
movzx eax, byte [0x1800a61e4]
mov byte [rsp + 8], al
mov eax, 0x18f4
mov word [rsp + 0x20], ax
movzx eax, byte [0x1800a603c]
mov word [rsp + 0x24], ax
mov dword [rsp + 0x48], 0x93653d6f
movsx rax, word [0x1800a6170]
mov qword [rsp + 0x68], rax
mov eax, 0x7004
mov word [rsp + 0x28], ax
movabs rax, 0x825a995a5ac99
mov qword [rsp + 0x70], rax
mov eax, dword [0x1800a61e0]
mov word [rsp + 0x2c], ax
movzx eax, word [0x1800a61b8]
mov qword [rsp + 0x78], rax
mov byte [rsp + 9], 0xc3
mov byte [rsp + 0xa], 0x6c
movzx eax, byte [0x1800a603c]
mov word [rsp + 0x30], ax
mov rax, qword [0x1800a6150]
mov word [rsp + 0x34], ax
movzx eax, byte [str.p_tException_during_c]
mov byte [rsp + 0xb], al
mov rax, qword [0x1800a61d0]
mov qword [rsp + 0x80], rax
mov byte [rsp + 0xc], 0x23
mov rax, qword [0x1800a6190]
mov qword [rsp + 0x88], rax
movsx eax, word [0x1800a6178]
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x50], 0x56
movabs rax, 0x7483db1ece866
mov qword [rsp + 0x90], rax
movzx eax, byte [0x1800a608b]
movzx eax, al
mov ecx, dword [0x1800a608c]
not ecx
add eax, ecx
test eax, eax
jne 0x18000dbf7
mov byte [rsp + 2], 1
jmp 0x18000dbfc
mov byte [rsp + 2], 0
movzx eax, byte [rsp + 2]
mov byte [0x1800a603e], al
mov byte [rsp + 1], 0
jmp 0x18000dc19
movzx eax, byte [rsp + 1]
inc al
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 4
jge 0x18000dc7d
mov byte [rsp], 0
jmp 0x18000dc32
movzx eax, byte [rsp]
inc al
mov byte [rsp], al
movzx eax, byte [rsp]
cmp eax, 4
jge 0x18000dc7b
movzx eax, byte [rsp]
mov rcx, qword [rsp + 0xb0]
lea rax, [rcx + rax*4]
movzx ecx, byte [rsp + 1]
movzx eax, byte [rax + rcx]
lea rcx, str.cw
movzx edx, byte [rsp]
mov r8, qword [rsp + 0xb0]
lea rdx, [r8 + rdx*4]
movzx r8d, byte [rsp + 1]
movzx eax, byte [rcx + rax]
mov byte [rdx + r8], al
jmp 0x18000dc29
jmp 0x18000dc0e
xor eax, eax
add rsp, 0xa8
ret
Function at 0x1800101c0
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov byte [rsp + 1], 0
jmp 0x1800101db
movzx eax, byte [rsp + 1]
inc al
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 4
jge 0x180010239
mov byte [rsp], 0
jmp 0x1800101f4
movzx eax, byte [rsp]
inc al
mov byte [rsp], al
movzx eax, byte [rsp]
cmp eax, 4
jge 0x180010237
movzx eax, byte [rsp]
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + rax*4]
movzx ecx, byte [rsp + 1]
movzx eax, byte [rax + rcx]
lea rcx, [0x180086680]
movzx edx, byte [rsp]
mov r8, qword [rsp + 0x20]
lea rdx, [r8 + rdx*4]
movzx r8d, byte [rsp + 1]
movzx eax, byte [rcx + rax]
mov byte [rdx + r8], al
jmp 0x1800101eb
jmp 0x1800101d0
xor eax, eax
add rsp, 0x18
ret
Function at 0x180015fd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0xd8
mov eax, 0x8ed
mov word [rsp + 0x30], ax
movzx eax, word [0x1800a6364]
mov dword [rsp + 0x4c], eax
mov qword [rsp + 0x70], 0x5419
mov byte [rsp + 0x20], 0x27
mov eax, dword [0x1800a6384]
mov byte [rsp + 0x21], al
movzx eax, word [0x1800a6364]
mov qword [rsp + 0x78], rax
movabs rax, 0x65064226e0c44
mov qword [rsp + 0x80], rax
mov byte [rsp + 0x22], 0x34
mov qword [rsp + 0x88], 0xb9
movzx eax, word [0x1800a6330]
mov word [rsp + 0x34], ax
mov qword [rsp + 0x90], 0x54
movsx eax, word [0x1800a6254]
mov dword [rsp + 0x2c], eax
movabs rax, 0xa4ab50b5a9482
mov qword [rsp + 0x98], rax
movzx eax, word [0x1800a6244]
movsx rax, ax
mov qword [rsp + 0xa0], rax
mov rax, qword [0x1800a6308]
mov qword [rsp + 0xa8], rax
mov rax, qword [0x1800a62f8]
mov dword [rsp + 0x50], eax
movzx eax, word [0x1800a62c4]
mov byte [rsp + 0x23], al
mov eax, dword [0x1800a62dc]
cdqe
mov qword [rsp + 0xb0], rax
movzx eax, byte [0x1800a6284]
mov byte [rsp + 0x24], al
mov rax, qword [0x1800a6328]
mov qword [rsp + 0xb8], rax
mov eax, dword [0x1800a6378]
mov dword [rsp + 0x54], eax
mov byte [rsp + 0x25], 0x4a
movzx eax, byte [0x1800a637c]
mov byte [rsp + 0x26], al
mov rax, qword [0x1800a6338]
mov word [rsp + 0x38], ax
movzx eax, word [0x1800a6380]
mov word [rsp + 0x3c], ax
movzx eax, word [0x1800a6358]
mov word [rsp + 0x40], ax
mov byte [rsp + 0x27], 0xad
mov dword [rsp + 0x58], 0x2336b0c2
mov dword [rsp + 0x5c], 7
mov qword [rsp + 0xc0], 9
mov dword [rsp + 0x60], 0x9897
mov dword [rsp + 0x64], 0x3298
mov eax, 0xde
mov word [rsp + 0x44], ax
mov eax, dword [0x1800a6330]
mov dword [rsp + 0x68], eax
mov byte [rsp + 0x28], 0x2a
movzx eax, word [0x1800a622c]
dec ax
mov word [0x1800a622c], ax
mov eax, 8
imul rax, rax, 1
lea rcx, [0x18054ecf8]
mov eax, dword [rcx + rax]
mov dword [rsp + 0x2c], eax
mov r9, qword [rsp + 0xf0]
mov r8d, dword [rsp + 0xe8]
mov rdx, qword [rsp + 0xe0]
mov rcx, 0xffffffffffffffff
call fcn.1800133c0
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x2c]
sub eax, 0x3e8b
mov byte [0x1800a61fe], al
movzx eax, word [0x1800a6364]
and eax, 0x62
cdqe
mov qword [0x1800a6308], rax
mov eax, dword [rsp + 0x48]
add rsp, 0xd8
ret
Function at 0x180017440
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov byte [rsp + 0x28], 0x80
mov byte [rsp + 0x22], 0xcb
mov byte [rsp + 0x29], 0x94
movzx eax, byte [0x1800a61ff]
mov byte [rsp + 0x2a], al
mov rax, qword [0x1800a6338]
mov word [rsp + 0x38], ax
movzx eax, word [0x1800a6348]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x2b], 0x39
movsx eax, byte [0x1800a6243]
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x54], 0xa5
movzx eax, byte [0x1800a61fb]
movsx eax, al
mov dword [rsp + 0x58], eax
mov byte [rsp + 0x2c], 0x46
mov eax, 0xd0
mov word [rsp + 0x3c], ax
mov dword [rsp + 0x5c], 0xa5
mov rax, qword [0x1800a6310]
mov qword [rsp + 0x70], rax
mov eax, 0xffffca3d
mov word [rsp + 0x34], ax
movzx eax, byte [0x1800a637c]
mov byte [rsp + 0x20], al
mov rax, qword [0x1800a6310]
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x60], 0xfef686a3
mov dword [rsp + 0x64], 0xf1c6ee7d
mov byte [rsp + 0x2d], 0x69
mov eax, dword [0x1800a62dc]
mov byte [rsp + 0x2e], al
movzx eax, byte [0x1800a6360]
mov byte [rsp + 0x2f], al
mov qword [rsp + 0x80], 0xa84f
movzx eax, byte [0x1800a6308]
mov byte [rsp + 0x21], al
mov rax, qword [0x1800a62f8]
mov byte [rsp + 0x30], al
movzx eax, byte [0x1800a6308]
mov byte [rsp + 0x31], al
mov eax, dword [0x1800a6354]
mov dword [rsp + 0x68], eax
movzx eax, word [0x1800a62c4]
movzx eax, ax
mov qword [rsp + 0x88], rax
movzx eax, word [0x1800a6320]
mov word [rsp + 0x40], ax
movzx eax, byte [0x1800a622f]
mov byte [rsp + 0x32], al
mov dword [rsp + 0x6c], 0x502b
movzx eax, word [0x1800a6310]
mov word [rsp + 0x44], ax
mov byte [rsp + 0x33], 0x5c
movabs rax, 0x52cc536d3cc8
mov qword [rsp + 0x90], rax
movzx eax, word [0x1800a6380]
mov word [rsp + 0x48], ax
mov r9d, dword [rsp + 0xc0]
mov r8, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xb0]
mov rcx, 0xffffffffffffffff
call fcn.1800161f0
mov dword [rsp + 0x50], eax
mov byte [0x1800a6243], 0xa0
movsx eax, byte [0x1800a6243]
movzx ecx, word [rsp + 0x24]
add ecx, 0x6a0
cmp eax, ecx
jne 0x180017638
mov eax, dword [0x1800a6378]
movzx ecx, word [rsp + 0x24]
add ecx, 0x9b70530d
cmp eax, ecx
jne 0x180017638
mov dword [rsp + 0x4c], 0xe7
jmp 0x180017638
mov byte [0x1800a6243], 0xa0
movzx eax, word [0x1800a622c]
movzx eax, ax
imul eax, eax, 0xd06596eb
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
imul eax, eax, 0xf7
cdqe
mov qword [0x1800a6338], rax
movzx eax, word [rsp + 0x34]
cwde
movzx ecx, byte [rsp + 0x22]
movsx ecx, cl
imul ecx, ecx, 0
sub eax, ecx
mov ecx, dword [0x1800a6354]
sub eax, ecx
mov eax, eax
mov qword [0x1800a6330], rax
mov eax, dword [rsp + 0x50]
add rsp, 0xa8
ret
Function at 0x1800787fc
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1800786d3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800786d3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1800786d3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1800786d3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1800786d3
cmp dword [rcx + 0x84], 0xe
jbe 0x1800786d3
cmp dword [rcx + 0xf8], 0
je 0x1800786d3
mov ecx, ebx
call fcn.180078774
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.180078564
cmp dword [rbp + 0x20], 0
je 0x180078720
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.180078728
int3
xor r8d, r8d
xor edx, edx
jmp 0x18007866c
Function at 0x1818f2058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1818f21df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1818f2089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1818f206f
add dl, dl
jne 0x1818f2096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1818f20f6
xor eax, eax
add dl, dl
jne 0x1818f20a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1818f21ad
add dl, dl
jne 0x1818f20b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1818f20c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1818f20d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1818f20dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1818f20ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1818f207e
mov eax, 1
add dl, dl
jne 0x1818f2106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1818f2113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1818f20fb
sub eax, ebx
mov ebx, 1
jne 0x1818f214c
mov ecx, 1
add dl, dl
jne 0x1818f212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1818f213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1818f2123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1818f207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1818f2168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1818f2175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1818f215d
cmp eax, 0x7d00
jae 0x1818f219b
cmp eax, 0x500
jb 0x1818f2196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1818f207e
cmp eax, 0x7f
ja 0x1818f219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1818f207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1818f21d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1818f207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x14007b1a0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14007b1ad
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14007b1bd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14007b1a5
lea eax, [rcx + 1]
jmp 0x14007b1cb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14007b1de
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14007b1c4
sub eax, 3
jb 0x14007b1fe
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14007b24d
sar eax, 1
movsxd rbp, eax
jb 0x14007b234
jmp 0x14007b20c
add ebx, ebx
jne 0x14007b20a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14007b234
inc ecx
add ebx, ebx
jne 0x14007b21a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14007b234
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14007b22d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14007b21c
add ecx, 2
jmp 0x14007b239
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14007b162
jmp 0x14007b1ad
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x22e00
mov dl, reloc.COMCTL32.dll_InitCommonControls
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14007b299
cmp rsi, rcx
jae 0x14007b2a1
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14007b280
cmp al, 0x8f
ja 0x14007b280
cmp byte [rsi - 2], 0xf
je 0x14007b286
sub al, 0xe8
cmp al, 1
ja 0x14007b26a
cmp rsi, rcx
jae 0x14007b2a1
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14007b270
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14007b2a1
lodsb al, byte [rsi]
jmp 0x14007b280
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x79000]
mov eax, dword [rdi]
or eax, eax
je 0x14007b30a
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xc1fc8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14007b2ae
jns 0x14007b2e3
movzx rdx, word [rdi]
add rdi, 2
jmp 0x14007b2ed
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14007b304
mov qword [rbx], rax
add rbx, 8
jmp 0x14007b2ce
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x18f]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14007b362
sub rsp, 0xffffffffffffff80
jmp 0x140023590
Function at 0x1400059a0
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1402ed968]
test rax, rax
jne 0x140005ba4
mov rax, qword gs:[0x60]
xor r8d, r8d
mov qword [rsp + 0x48], rbx
mov ebx, 0x694a8c81
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test r8d, r8d
je 0x140005a3d
psrldq xmm0, 8
mov edx, 0x811c9dc5
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r9, [rcx + rax*2]
cmp rcx, r9
je 0x140005a34
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r9
jne 0x140005a20
cmp edx, r8d
jne 0x140005b67
mov r10, qword [rdi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
mov r11d, ecx
shr r15, 0x20
add r11, r10
cmp r11, r10
je 0x140005b67
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140005b67
mov r14d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov edx, 0x811c9dc5
lea rax, [r14 + r9*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140005ab7
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140005aa0
cmp edx, ebx
je 0x140005ac5
test r9d, r9d
jne 0x140005a80
jmp 0x140005b67
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
cmp rax, r11
jbe 0x140005b7f
lea rcx, [r15 + r11]
cmp rax, rcx
jae 0x140005b7f
movzx ecx, byte [rax]
mov r8d, 0x811c9dc5
mov dword [rsp + 0x40], r8d
mov edx, r8d
mov dword [rsp + 0x44], edx
cmp cl, 0x2e
je 0x140005b2d
nop
movsx ecx, cl
inc rax
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rax]
cmp cl, 0x2e
jne 0x140005b10
mov dword [rsp + 0x40], r8d
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
je 0x140005b5a
nop dword [rax + rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
test cl, cl
jne 0x140005b40
mov dword [rsp + 0x44], edx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rbp]
shr rbx, 0x20
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x140005b7d
cmp qword [rax + 0x30], 0
jne 0x1400059f1
xor eax, eax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov qword [0x1402ed968], rax
add rsp, 0x38
jmp rax