joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004e9b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x14004e9e4
mov eax, esi
lea ecx, [rax - 0x35]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x14004e9d0
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003e550
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14004ea09
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14004d620
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14004ea83
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ea7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004ea7e
call fcn.141438ffd
nop
int3
call fcn.1400ae72c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14004ea90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x14004eac4
mov eax, esi
lea ecx, [rax - 0x35]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x14004eab0
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003e550
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14004eae9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14004d620
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14004eb63
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004eb5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004eb5e
call fcn.141438ffd
nop
int3
call fcn.1400ae72c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14004eb70
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x14004eba4
mov eax, esi
lea ecx, [rax - 0x35]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x14004eb90
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14003e550
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x14004ebc9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.14004d620
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14004ec43
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ec3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004ec3e
call fcn.141438ffd
nop
int3
call fcn.1400ae72c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400553e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x140055403
lea edx, [rax - 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x1400553f0
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14003e550
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140055420
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x140055443
lea edx, [rax - 0x35]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x140055430
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.14003e550
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140057270
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xa8
cmp byte [0x1410b3298], 0
jne 0x140057337
movdqa xmm0, xmmword [0x1400b4250]
xor edx, edx
movdqa xmm1, xmmword [0x1400b3ff0]
movdqa xmmword [rax - 0x68], xmm0
movdqa xmm0, xmmword [0x1400b41c0]
movdqa xmmword [rax - 0x58], xmm1
movdqa xmm1, xmmword [0x1400b3fc0]
movdqa xmmword [rax - 0x48], xmm0
movdqa xmm0, xmmword [0x1400b3fa0]
movdqa xmmword [rax - 0x38], xmm1
movdqa xmmword [rax - 0x28], xmm0
mov dword [rax - 0x18], 0x1006f75
mov eax, edx
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 0x35]
xor byte [rsp + rax + 0x40], cl
inc rax
cmp rax, 0x52
jb 0x1400572e0
xorps xmm0, xmm0
mov byte [rsp + 0x93], dl
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rdx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dl
jne 0x140057315
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14004d110
lea rcx, [rsp + 0x20]
call fcn.140058e00
add rsp, 0xa8
ret
Function at 0x140058e00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x1400df088]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rbx, rcx
mov qword [rbp + 0x47], rcx
movdqa xmm0, xmmword [0x1400b4200]
movdqu xmmword [rbp - 0x49], xmm0
mov word [rbp - 0x39], 0xf9
mov byte [rbp - 0x37], 1
xor ecx, ecx
lea eax, [rcx - 0x35]
xor byte [rbp + rcx - 0x49], al
inc rcx
cmp rcx, 0x11
jb 0x140058e40
mov byte [rbp - 0x37], 0
movdqa xmm0, xmmword [0x1400b4130]
movdqu xmmword [rbp - 0x31], xmm0
movdqa xmm1, xmmword [0x1400b40f0]
movdqu xmmword [rbp - 0x21], xmm1
mov dword [rbp - 0x11], 0x9c829e99
mov dword [rbp - 0xd], 0xd2d7d6cf
mov dword [rbp - 9], 0x999d9796
mov word [rbp - 5], 0xd7
mov byte [rbp - 3], 1
xor eax, eax
nop
lea ecx, [rax - 0x35]
xor byte [rbp + rax - 0x31], cl
inc rax
cmp rax, 0x2d
jb 0x140058e90
mov byte [rbp - 3], 0
mov r8, rbx
lea rdx, [rbp - 0x31]
lea rcx, [rbp + 0x27]
call fcn.14004cc80
nop
lea rcx, [rbp - 0x49]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rcx + r8], 0
jne 0x140058ec0
lea rdx, [rbp - 0x49]
mov rcx, rax
call fcn.14003d610
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 1], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xf], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rcx, qword [rbp - 1]
call fcn.141435a4f
nop
mov rdx, qword [rbp + 0x17]
cmp rdx, 0x10
jb 0x140058f59
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058f54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058f54
call fcn.141438ffd
nop
int3
call fcn.1400ae72c
movdqa xmm0, xmmword [0x1400cfa10]
movdqu xmmword [rbp + 0xf], xmm0
mov byte [rbp - 1], 0
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140058fa8
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140058fa3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140058fa3
call fcn.141438ffd
nop
int3
call fcn.1400ae72c
xor ecx, ecx
int 0x29
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140058fe2
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140058fdd
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140059012
mov rcx, r8
call fcn.1400ae72c
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400aef70
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rbp
ret
call fcn.141438ffd
nop
int3
Function at 0x14005b970
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400df088]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rbp - 0x18], rdx
xor edi, edi
mov dword [rbp - 0x50], 0xadaeb9b8
mov dword [rbp - 0x4c], 0xa2a3aa
mov byte [rbp - 0x48], 1
mov ecx, edi
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 7
jb 0x14005b9b0
mov byte [rbp - 0x48], 0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x38]
call fcn.14003e550
nop
cmp byte [rbx], 0
jne 0x14005b9eb
mov byte [rbx], 1
call fcn.1400501f0
mov qword [rbx + 8], rax
cmp byte [rbx], 1
jne 0x14005ba02
lea rdx, [rbp - 0x38]
mov rcx, qword [rbx + 8]
call fcn.1400552f0
mov rcx, rax
jmp 0x14005ba06
mov rcx, qword [rbp - 0x18]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, rdi
movzx eax, byte [rax]
mov byte [rsi + 0x210], al
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14005ba58
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ba53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005ba53
call fcn.141438ffd
nop
int3
call fcn.1400ae72c
mov dword [rbp - 0x50], 0xbdbea9a6
mov dword [rbp - 0x4c], 0xb4b7ae
mov byte [rbp - 0x48], 1
mov rcx, rdi
nop dword [rax]
lea eax, [rcx - 0x35]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 7
jb 0x14005ba70
mov byte [rbp - 0x48], 0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x38]
call fcn.14003e550
nop
cmp byte [rbx], 0
jne 0x14005baab
mov byte [rbx], 1
call fcn.1400501f0
mov qword [rbx + 8], rax
cmp byte [rbx], 1
jne 0x14005babf
lea rdx, [rbp - 0x38]
mov rcx, qword [rbx + 8]
call fcn.1400552f0
jmp 0x14005bac3
mov rax, qword [rbp - 0x18]
cmp byte [rax], 3
jne 0x14005bacc
mov rdi, qword [rax + 8]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14005bad9
mov rdx, qword [rdi]
lea rcx, [rsi + 0x218]
mov r8, qword [rdi + 0x10]
call fcn.1400564f0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14005bb29
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005bb23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005bb23
call fcn.141438ffd
nop
int3
call fcn.1400ae72c
nop
lea rcx, [rbx + 8]
movzx edx, byte [rbx]
call fcn.140058270
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400aef70
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x140079a20
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [rcx + 0x28]
mov rdi, rdx
mov rbx, rcx
cmp r8d, 0x40
jae 0x140079bd8
lea ecx, [r8*8]
mov qword [rsp + 0x30], rsi
add qword [rbx], rcx
mov byte [r8 + rbx + 0x2c], 0x80
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jbe 0x140079a98
cmp eax, 0x40
jae 0x140079a82
nop word [rax + rax]
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x40
jb 0x140079a70
lea rsi, [rbx + 0x2c]
mov rcx, rbx
mov rdx, rsi
call fcn.140079d00
xor eax, eax
mov dword [rbx + 0x28], eax
jmp 0x140079aa0
lea rsi, [rbx + 0x2c]
jae 0x140079ab2
nop
mov byte [rax + rbx + 0x2c], 0
mov eax, dword [rbx + 0x28]
inc eax
mov dword [rbx + 0x28], eax
cmp eax, 0x38
jb 0x140079aa0
movzx eax, byte [rbx + 7]
mov rdx, rsi
mov byte [rbx + 0x64], al
mov rcx, rbx
movzx eax, byte [rbx + 6]
mov byte [rbx + 0x65], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 0x66], al
movzx eax, byte [rbx + 4]
mov byte [rbx + 0x67], al
movzx eax, byte [rbx + 3]
mov byte [rbx + 0x68], al
movzx eax, byte [rbx + 2]
mov byte [rbx + 0x69], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 0x6a], al
movzx eax, byte [rbx]
mov byte [rbx + 0x6b], al
call fcn.140079d00
movzx eax, byte [rbx + 0xb]
mov byte [rdi], al
movzx eax, byte [rbx + 0xa]
mov byte [rdi + 1], al
movzx eax, byte [rbx + 9]
mov byte [rdi + 2], al
movzx eax, byte [rbx + 8]
mov byte [rdi + 3], al
movzx eax, byte [rbx + 0xf]
mov byte [rdi + 4], al
movzx eax, byte [rbx + 0xe]
mov byte [rdi + 5], al
movzx eax, byte [rbx + 0xd]
mov byte [rdi + 6], al
movzx eax, byte [rbx + 0xc]
mov byte [rdi + 7], al
movzx eax, byte [rbx + 0x13]
mov byte [rdi + 8], al
movzx eax, byte [rbx + 0x12]
mov byte [rdi + 9], al
movzx eax, byte [rbx + 0x11]
mov byte [rdi + 0xa], al
movzx eax, byte [rbx + 0x10]
mov byte [rdi + 0xb], al
movzx eax, byte [rbx + 0x17]
mov byte [rdi + 0xc], al
movzx eax, byte [rbx + 0x16]
mov byte [rdi + 0xd], al
movzx eax, byte [rbx + 0x15]
mov byte [rdi + 0xe], al
movzx eax, byte [rbx + 0x14]
mov byte [rdi + 0xf], al
movzx eax, byte [rbx + 0x1b]
mov byte [rdi + 0x10], al
movzx eax, byte [rbx + 0x1a]
mov byte [rdi + 0x11], al
movzx eax, byte [rbx + 0x19]
mov byte [rdi + 0x12], al
movzx eax, byte [rbx + 0x18]
mov byte [rdi + 0x13], al
movzx eax, byte [rbx + 0x1f]
mov byte [rdi + 0x14], al
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 0x15], al
movzx eax, byte [rbx + 0x1d]
mov byte [rdi + 0x16], al
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 0x17], al
movzx eax, byte [rbx + 0x23]
mov byte [rdi + 0x18], al
movzx eax, byte [rbx + 0x22]
mov byte [rdi + 0x19], al
movzx eax, byte [rbx + 0x21]
mov byte [rdi + 0x1a], al
movzx eax, byte [rbx + 0x20]
mov byte [rdi + 0x1b], al
movzx eax, byte [rbx + 0x27]
mov byte [rdi + 0x1c], al
movzx eax, byte [rbx + 0x26]
mov byte [rdi + 0x1d], al
movzx eax, byte [rbx + 0x25]
mov byte [rdi + 0x1e], al
movzx eax, byte [rbx + 0x24]
mov rsi, qword [rsp + 0x30]
mov byte [rdi + 0x1f], al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140079bf0
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov qword [rcx + 0x24], 0x5be0cd19
mov qword [rcx], rax
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
ret
Function at 0x140093c10
Capabilities:
Check http status code

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
lea eax, [rdx - 0xc8]
mov rdi, rcx
mov rcx, qword [rcx]
mov esi, r8d
cmp eax, 0x64
jb 0x140093c45
lea rdx, [0x1400bcbf0]
call fcn.140075f50
lea eax, [rbx + 0x11]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
cmp edx, 0xc8
je 0x140093c5c
mov r8d, edx
lea rdx, [0x1400bcc10]
call fcn.1400760d0
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], r14
cmp esi, 0x13
jne 0x140093c78
mov rcx, rdi
call fcn.140093b50
jmp 0x140093daf
cmp esi, 0x14
jne 0x140093d91
mov rsi, qword [rdi]
mov rbp, rbx
cmp dword [rsi + 0xba0], 2
jne 0x140093cf9
mov rax, qword [rsi + 0x1e0]
mov rdx, qword [rax]
test rdx, rdx
je 0x140093cf9
mov byte [rsp + 0x28], 1
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rcx, rsi
mov qword [rsp + 0x50], rbx
call fcn.140060680
test eax, eax
jne 0x140093daf
mov rcx, qword [rsp + 0x50]
lea edx, [rax + 0x2f]
call fcn.1400af9d6
test rax, rax
je 0x140093cee
mov rbp, qword [rsp + 0x50]
mov ecx, 1
sub rax, rbp
cmovne rcx, rax
mov byte [rcx + rbp], bl
jmp 0x140093cf9
mov rcx, qword [rsp + 0x50]
call qword [fcn.1400df028]
mov rdx, qword [rsi + 0xc08]
test rdx, rdx
jne 0x140093d1d
cmp byte [rsi + 0xf0d], bl
lea rax, [0x1400bc890]
lea rdx, [0x1400bb9dc]
cmovne rdx, rax
lea r8, [0x1400c199a]
test rbp, rbp
mov r9, r8
lea rax, [0x1400cb1fc]
cmovne r9, rbp
lea rcx, [0x1400b72c0]
cmovne r8, rax
call fcn.1400648d0
mov rcx, rbp
mov r14, rax
call qword [fcn.1400df028]
test r14, r14
jne 0x140093d5c
lea ebx, [r14 + 0x1b]
jmp 0x140093db1
lea rcx, [rdi + 0xa00]
mov r8, r14
lea rdx, [0x1400c6408]
call fcn.1400a9d70
mov rcx, r14
mov esi, eax
call qword [fcn.1400df028]
test esi, esi
je 0x140093d85
mov ebx, esi
jmp 0x140093db1
mov dword [rdi + 0xab8], 0x1f
jmp 0x140093db1
cmp esi, 0x15
jne 0x140093d9c
lea r8d, [rsi - 8]
jmp 0x140093da5
cmp esi, 0x16
jne 0x140093db1
lea r8d, [rsi - 8]
mov dl, 1
mov rcx, rdi
call fcn.140093680
mov ebx, eax
mov r14, qword [rsp + 0x60]
mov eax, ebx
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400ae5f0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [fcn.1400df020]
mov rdi, rax
test rax, rax
jne 0x1400ae632
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1400ae679
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + 8]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + 0x10]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x1400ae6d2
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + 8]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + 8]
sub rbp, 1
jne 0x1400ae690
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1400ae713
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1400c11a2]
mov r8d, 1
call qword [rbx + 8]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1400c11a3]
mov r8d, 1
call qword [rbx + 8]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x1400ae6e0
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400078b0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x14000d610], rbx
je 0x1400078fc
cmp rax, rbx
jne 0x1400078ef
mov ebx, 1
mov esi, ebx
jmp 0x140007901
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400078d4
mov ebx, 1
mov eax, dword [0x14000d618]
cmp eax, ebx
jne 0x140007917
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x14000797c
mov eax, dword [0x14000d618]
test eax, eax
jne 0x140007976
mov dword [0x14000d618], ebx
lea r15, [0x140009560]
lea rdi, [0x140009548]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140007968
test eax, eax
jne 0x14000796c
cmp qword [rdi], 0
je 0x14000795d
mov rax, qword [rdi]
mov rcx, qword [vtable.H_MA8HI.0]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x14000793e
test eax, eax
je 0x14000797c
mov eax, 0xff
jmp 0x140007a58
mov dword [0x14000b164], ebx
mov eax, dword [0x14000d618]
cmp eax, ebx
jne 0x1400079a3
lea rdx, [0x140009540]
lea rcx, [0x140009530]
call sub.msvcrt.dll__initterm
mov dword [0x14000d618], 2
test esi, esi
jne 0x1400079b0
xor eax, eax
xchg qword [0x14000d610], rax
cmp qword [0x14000d620], 0
je 0x1400079e4
lea rcx, [0x14000d620]
call fcn.140007e30
test eax, eax
je 0x1400079e4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14000d620]
mov r9, qword [vtable.H_MA8HI.0]
call r9
mov r8, qword [0x14000b178]
mov rdx, qword [0x14000b170]
mov ecx, dword [0x14000b168]
call fcn.140002630
mov dword [0x14000b160], eax
cmp dword [0x14000b180], 0
jne 0x140007a14
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x14000b164], 0
jne 0x140007a29
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x14000b160]
jmp 0x140007a58
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.14017f000
add rsp, 0x28
jmp 0x1400078b0

Function at 0x140007d1c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140007d68
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140007d60
cmp dword [rcx + 0x3c], edx
jl 0x140007d60
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140007d60
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140007d68
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140003e60
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x490], rbx
mov rax, qword [0x140089040]
xor rax, rbp
mov qword [rbp + 0x440], rax
mov rdi, rdx
mov dword [rbp], 0x438
mov edx, dword [rcx + 0x10]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
xor r14d, r14d
movabs r15, 0xffffffffffffff0
lea rcx, [rbp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140003ed0
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x140003f4a
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x140003efb
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14006b1f0
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x140003f4a
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r14
xor edx, edx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
lea r8, [rbp + 0x30]
mov r9d, 0xffffffff
mov byte [rbx], r14b
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, r14
jmp 0x140003f4d
mov rbx, r14
cmp qword [rdi + 0x18], 0xf
mov rdx, rdi
jbe 0x140003f5a
mov rdx, qword [rdi]
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x140003f72
inc rbx
test eax, eax
jne 0x140003f60
test ecx, ecx
mov rcx, rsi
je 0x140003fd2
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140003ec1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140003fce
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140003fc9
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004049
mov rcx, r8
call fcn.14006a5dc
xor eax, eax
jmp 0x140004015
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
mov rbx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140004012
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14000400d
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004049
mov rcx, r8
call fcn.14006a5dc
mov rax, rbx
mov byte [rdi], r14b
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], r14
mov rcx, qword [rbp + 0x440]
xor rcx, rbp
call fcn.14006a150
mov rbx, qword [rbp + 0x490]
lea rsp, [rbp + 0x450]
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3