joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403072fb
Capabilities:
Delete file
Execute command

Disassembly:
cmp r13, 0x7f671ebc
mov qword [rsp + rbx - 0x50216198], rdx
call fcn.1401eb123
mov word [rsp + 0x18], 0x2b58
xchg qword [rsp + 0x20], rax
push rsi
push r13
movabs r13, 0x19f06ece31307f89
movabs rsi, 0x76347d4b31803a69
xor rsi, qword [rsp + 0x28]
mov dword [rsp + 0x28], 0x543f2a91
push r13
mov rsi, qword [rsp + 0x10]
mov byte [rsp], r13b
not byte [rsp]
not byte [rsp + 0x30]
sub r13, qword [rsp + 0x30]
test qword [rsp + 0x30], 0x52055af9
mov r13, qword [rsp + 8]
js 0x14035612c
add qword [rsp + 0x20], 0xffffffffbfd1e0c9
cmp dword [rsp], 0x79243806
not byte [rsp + 0x30]
call fcn.1402add97

Function at 0x14031ff3d
Capabilities:
Send data
Send data on socket

Disassembly:
mov rdi, qword [rsp + 0x70]
movabs r9, 0x5261080a60523a27
call fcn.140165382

Function at 0x14031ff51
Capabilities:
Send data
Send data on socket

Disassembly:
call fcn.1402804f9
call fcn.14028c4a5

Function at 0x140328872
Capabilities:
Encode data using xor
Terminate process

Disassembly:
and byte [rsp + 0x68], 0x40
call fcn.140283887

Function at 0x1403373df
Capabilities:
Send data
Send data on socket

Disassembly:
mov r13, qword [rsp + 0x48]
mov ecx, dword [rsp + 0x5b]
call fcn.14016938b

Function at 0x14033740f
Capabilities:
Send data
Send data on socket

Disassembly:
js 0x1402fcdd8
lea r10, [r10*4 + 0x201f1539]
cmp byte [rsp + 0x30], r10b
movzx r10w, word [rsp + 0x43]
lea rdx, [rdx + r10 + 0x5dc8570b]
mov qword [rsp + 0x28], r10
not word [rsp + 0x30]
mov dword [rsp + 0x40], r10d
push rdi
call fcn.1401b6a12

Function at 0x14034381d
Capabilities:
Encode data using xor

Disassembly:
mov r8, qword [rsp + 0x18]
call fcn.140306906
push rbx
call fcn.140156d6e
pushfq
test r8w, 0x65e8
jne 0x140333fe7

Function at 0x140356120
Capabilities:
Delete file
Execute command

Disassembly:
xor r10b, byte [rsp + 0x38]
call fcn.1401b172d

Function at 0x14035612a
Capabilities:
Delete file
Execute command

Disassembly:
push r10
push r12
movabs rbp, 0x714473ea63403d18

Function at 0x14035ca8e
Capabilities:
Encode data using xor

Disassembly:
add r9d, 0x4ee85d19
lea r9, [r9 + 0xfb671a3]
cmp r9w, 0x190b
lea rdx, [rdx + 1]
bswap r9
push r11
setge r9b
mov r11, r9
push rsi
push rbp
movabs rsi, 0x52c62c5f2798190d
add r11b, 0x8f
mov qword [rsp + 0x40], rdx
movabs rbp, 0x787010649e66662
not bp
jb 0x1400b4a5c
neg r11b
sub ebp, 0x62fb482e
bswap esi
not rsi
call fcn.1401660fb
pop rdi
push rdi
push r12
push rbp
pushfq
movabs rbp, 0x396442810040529
mov rdi, rbp
or dil, 0xd0
push rdx
cmp di, bp
mov rdx, rdi
mov rdi, qword [rsp + 0x20]
xchg qword [rsp + 0x28], rdi
mov r12, rbp
not bpl
mov qword [rsp + 0x20], rdx
push rdi
mov qword [rsp + 0x28], rdi
not bpl
not dl
call fcn.14013b934
setge r9b
jno 0x14021da89

Function at 0x140379488
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x38], r13
push r15
lea rbp, [rbp + 0x1ec326d6]
bswap r13
movabs r15, 0x2d177210fac7cc6
test byte [rsp + 0x40], 3
call fcn.14034636b

Function at 0x1403794ad
Capabilities:
Send data
Send data on socket

Disassembly:
setge byte [rsp + 8]
mov r12, r9
add byte [rsp + 8], 0x44
call fcn.140220074
Function at 0x140385e39
Capabilities:
Execute command
Self delete
Set registry value

Disassembly:
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32FirstFolder___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRU___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRULegacy___va__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorer_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist___f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_ADD__HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist_
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.REG_DELETE__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlSession_ManagerAppCompatCache___va__f
movzx r10, byte [rsp + 0x50]
sub rbx, qword [rsp + 0x30]
seta bl
mov rbx, qword [rsp + 0x10]
sub r10d, r10d
mov byte [rsp + 0x30], Ordinal_217
sets r10b
setbe r10b
or byte [rsp + 0x50], 0xde
or r10w, word [rsp + 0x30]
mov r10, qword [rsp + 0x40]
and dword [rsp + 0x30], 0x3ac75b58
je 0x14000669b
not word [rsp + 0x30]
or dword [rsp + 0x50], 0x66dd48ff
call fcn.14021f00e

Function at 0x14038ef05
Capabilities:
Encode data using xor

Disassembly:
or dl, 0x8a
lea rax, [rax + r9 - 0x6db24749]
push rbx
setne dl
test qword [rsp + 0x20], 0x7b045f36
push r11
xchg qword [rsp + 0x80], rax
call fcn.1401e659d
jns 0x140368e67
Function at 0x140003d90
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003dc4
cmp word [rcx], 0x5a4d
jne 0x140003dc4
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003dc4
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003dc4
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003cd0
test eax, eax
jne 0x140003de0
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003d40
test rax, rax
je 0x140003dd5
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.14000458c
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004490
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140004430
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x1400048f4
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
mov rax, qword [0x1405635b8]
xor ebx, ebx
add rax, 0x18
mov r12, rcx
mov ecx, dword [0x1405635b4]
mov rsi, rdx
mov rdi, r8
cmp ebx, ecx
jge 0x140004942
mov rdx, qword [rax]
cmp r12, rdx
jb 0x14000493a
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140004a29
inc ebx
add rax, 0x28
jmp 0x14000491a
mov rcx, r12
call fcn.140005121
mov rbp, rax
test rax, rax
jne 0x140004961
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140004890
movsxd rbx, ebx
mov rax, qword [0x1405635b8]
xor edx, edx
imul rbx, rbx, 0x28
add rax, rbx
mov dword [rax], edx
mov qword [rax + 0x20], rbp
call fcn.1400051cf
mov edx, dword [rbp + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1405635b8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1400049c3
mov rax, qword [0x1405635b8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.140004890
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x140004a23
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140004a23
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x1405635b8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140004a23
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140004890
inc dword [0x1405635b4]
mov ecx, edi
mov rdi, r12
rep movsb byte [rdi], byte [rsi]
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x140004e50
Capabilities:
Get thread local storage value

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
lea rdi, [0x140563620]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140563600]
test rbx, rbx
je 0x140004e9c
mov ecx, dword [rbx]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test rsi, rsi
je 0x140004e96
test eax, eax
jne 0x140004e96
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
jmp 0x140004e6e
mov rcx, rdi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140005050
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140005073
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140005073
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140005074
Capabilities:
Enumerate pe sections

Disassembly:
xor r8d, r8d
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r9d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
cmp r8d, r9d
jae 0x1400050ae
mov r10d, dword [rax + 0xc]
mov rcx, r10
cmp rdx, r10
jb 0x1400050a5
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x1400050b0
inc r8d
add rax, 0x28
jmp 0x14000508c
xor eax, eax
ret

Function at 0x140005121
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14055f690]
mov r8, rcx
mov rcx, r9
call fcn.140005050
test eax, eax
je 0x14000514d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140005074
xor eax, eax
add rsp, 0x28
ret
Function at 0x14000d410
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x1402d6010]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rdx
xor esi, esi
call fcn.140001f20
call fcn.140001de0
xor edx, edx
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000d47a
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x14000d47e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x14000d4cf
call fcn.140001f20
call fcn.140001de0
nop dword [rax + rax]
lea rdx, [rsp + 0x4c]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x14000d4b6
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14000d490
jmp 0x14000d4ba
mov esi, dword [rsp + 0x28]
call fcn.140001f20
call fcn.140001de0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14000d9d0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000d500
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1402d6010]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, r9
mov rbx, r8
mov rbp, rdx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x14000d694
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.1401ab480
xor eax, eax
test rdi, rdi
je 0x14000d5f9
cmp rdi, 8
jb 0x14000d5fe
movdqa xmm2, xmmword [0x1402af880]
cmp rdi, 0x40
jb 0x14000d5d7
mov rdx, rdi
lea rcx, [rsi + 0x20]
and edx, 0x3f
mov r8, rdi
sub r8, rdx
nop dword [rax + rax]
movdqu xmm0, xmmword [rcx - 0x20]
add rax, 0x40
lea rcx, [rcx + 0x40]
andnps xmm0, xmm2
movdqu xmmword [rcx - 0x60], xmm0
movdqu xmm0, xmmword [rcx - 0x50]
andnps xmm0, xmm2
movdqu xmmword [rcx - 0x50], xmm0
movdqu xmm1, xmmword [rcx - 0x40]
andnps xmm1, xmm2
movdqu xmmword [rcx - 0x40], xmm1
movdqu xmm0, xmmword [rcx - 0x30]
andnps xmm0, xmm2
movdqu xmmword [rcx - 0x30], xmm0
cmp rax, r8
jb 0x14000d590
cmp rdx, 8
jb 0x14000d5f9
mov rcx, rdi
mov rdx, rdi
and ecx, 7
sub rdx, rcx
movq xmm0, qword [rax + rsi]
andnps xmm0, xmm2
movq qword [rax + rsi], xmm0
add rax, 8
cmp rax, rdx
jb 0x14000d5e3
cmp rax, rdi
jae 0x14000d61c
mov r8, rdi
lea rdx, [rax + rsi]
sub r8, rax
nop dword [rax + rax]
not byte [rdx]
lea rdx, [rdx + 1]
sub r8, 1
jne 0x14000d610
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov rcx, rbp
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
mov r8d, edi
mov rdx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rsi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000d9d0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000d6b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, r8
mov r14, rdx
mov rdx, rax
lea r8, [0x1402af56c]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rdi, rax
test rax, rax
je 0x14000d771
call fcn.140001f20
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rdi
xor ecx, ecx
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rbx, rax
call fcn.140001de0
test rbx, rbx
je 0x14000d771
mov qword [rsp + 0x30], rsi
call fcn.140001de0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
test rax, rax
je 0x14000d74e
call fcn.140001f20
lea r9d, [rbp - 0x400]
mov r8, rsi
mov rdx, r14
call fcn.14000d500
test eax, eax
je 0x14000d74e
call fcn.140001de0
call fcn.140001f20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [rsp + 0x30]
mov eax, 1
jmp 0x14000d773
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14000e688
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000e6d2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000e6d2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000e6d2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000e6d2
cmp dword [rcx + 0x84], 0xe
jbe 0x14000e6d2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000e6d4
xor al, al
add rsp, 0x28
ret

Function at 0x1400312b0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1402d6010]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
mov qword [rcx], 0
mov dword [rsp + 0x20], 0xf0000000
mov r9d, 1
xor r8d, r8d
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140031346
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov dword [rsp + 0x20], 8
mov r9d, 1
xor r8d, r8d
lea rdx, str.Crypto_RNG
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x140031346
mov dword [rsp + 0x20], 0x28
lea r9d, [rax + 1]
xor r8d, r8d
lea rdx, str.Crypto_RNG
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x14003136a
mov rax, rbx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14000d9d0
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.CryptAcquireContext
lea rcx, [rsp + 0x30]
call fcn.140007ba0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140031420
lea rdx, [0x1402d4390]
lea rcx, [rsp + 0x50]
call fcn.1401aafdc
int3
Function at 0x140031820
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1402d6010]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, r8
mov rdi, rdx
mov ecx, dword [0x14035bb00]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x14035c158], ecx
jg 0x1400318ff
mov eax, ebx
cmp rbx, rax
jne 0x1400318c1
xor ecx, ecx
mov eax, ecx
test rbx, rbx
setne al
test ebx, ebx
setne cl
cmp eax, ecx
jne 0x1400318c1
mov r8, rdi
mov edx, ebx
mov rcx, qword [0x14035c150]
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x140031942
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000d9d0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
mov ecx, 0x5b6
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rdx, str.GenerateBlock_size
lea rcx, [rsp + 0x20]
call fcn.140007ba0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140031420
lea rdx, [0x1402d4390]
lea rcx, [rsp + 0x40]
call fcn.1401aafdc
nop
lea rcx, [0x14035c158]
call fcn.14000daa0
cmp dword [0x14035c158], 0xffffffff
jne 0x14003186c
lea rcx, [0x14035c150]
call fcn.1400312b0
lea rcx, [0x1401e59c0]
call fcn.14000dd9c
nop
lea rcx, [0x14035c158]
call fcn.14000da34
jmp 0x14003186c
lea rdx, [0x1401eb318]
lea rcx, [rsp + 0x20]
call fcn.140007ba0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140031420
lea rdx, [0x1402d4390]
lea rcx, [rsp + 0x40]
call fcn.1401aafdc
int3
Function at 0x140036f60
Capabilities:
Encode data using xor

Disassembly:
mov r9, r8
xor r11d, r11d
mov r10, rdx
mov r8d, r11d
cmp r9, 8
jb 0x140036f97
mov rdx, r9
shr rdx, 3
imul rax, rdx, 0xfffffffffffffff8
add r9, rax
mov rax, qword [rcx]
add rcx, 8
xor rax, qword [r10]
add r10, 8
or r8, rax
sub rdx, 1
jne 0x140036f80
mov rdx, r8
shr rdx, 0x20
or edx, r8d
mov r8d, edx
mov eax, edx
shr r8d, 8
or r8d, edx
shr eax, 0x10
and r8d, 0xff00
or r8d, eax
movzx eax, dl
shr r8d, 8
or r8d, eax
test r9, r9
je 0x140037088
sub rcx, r10
cmp r9, 8
jb 0x140037069
mov rax, r9
lea rdx, [r10 + 4]
and rax, 0xfffffffffffffff8
xorps xmm4, xmm4
xorps xmm3, xmm3
nop dword [rax + rax]
movd xmm2, dword [rcx + rdx - 4]
xorps xmm0, xmm0
movd xmm1, dword [rdx - 4]
lea rdx, [rdx + 8]
punpcklbw xmm2, xmm0
add r11, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
movd xmm1, dword [rdx - 8]
punpcklbw xmm1, xmm0
orps xmm4, xmm2
movd xmm2, dword [rcx + rdx - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
xorps xmm2, xmm1
orps xmm3, xmm2
cmp r11, rax
jb 0x140036ff0
orps xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
orps xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
orps xmm3, xmm0
movd eax, xmm3
or r8d, eax
cmp r11, r9
jae 0x140037088
add r10, r11
sub r9, r11
nop
movzx edx, byte [rcx + r10]
movzx eax, byte [r10]
lea r10, [r10 + 1]
xor edx, eax
or r8d, edx
sub r9, 1
jne 0x140037070
test r8d, r8d
sete al
ret
Function at 0x140037090
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x140037234
cmp r9, 4
jb 0x1400370da
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x1400370c0
xor r11d, r11d
test r9, r9
je 0x140037234
cmp r9, 8
jb 0x14003720d
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x14003710c
cmp rdx, r8
jae 0x14003720d
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x140037121
cmp rdx, r10
jae 0x14003720d
mov rdx, r10
mov qword [rsp + 0x10], rbx
sub rdx, r8
mov qword [rsp], rdi
cmp r9, 0x40
jb 0x1400371c7
mov rdi, r9
mov qword [rsp + 0x18], rsi
and edi, 0x3f
mov rsi, r9
sub rsi, rdi
mov rbx, rcx
lea rax, [r8 + 0x10]
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
xorps xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
xorps xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rsi
jb 0x140037160
mov rsi, qword [rsp + 0x18]
cmp rdi, 8
jb 0x1400371ff
mov rbx, r9
and rbx, 0xfffffffffffffff8
mov rdi, rcx
lea rax, [r11 + r8]
sub rdi, r8
nop dword [rax + rax]
movq xmm1, qword [rax + rdx]
add r11, 8
movq xmm0, qword [rax]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rax + rdi - 8], xmm1
cmp r11, rbx
jb 0x1400371e0
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
jae 0x140037234
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
nop word [rax + rax]
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x140037220
add rsp, 8
ret
Function at 0x140037240
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
test r8, r8
je 0x1400373a2
cmp r8, 4
jb 0x140037282
mov r9, r8
shr r9, 2
imul rax, r9, 0xfffffffffffffffc
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rdx]
add rdx, 4
xor dword [rcx], eax
add rcx, 4
sub r9, 1
jne 0x140037270
xor r10d, r10d
test r8, r8
je 0x1400373a2
cmp r8, 8
jb 0x140037384
lea r9, [rcx - 1]
lea rax, [rdx - 1]
add r9, r8
add rax, r8
cmp rcx, rax
ja 0x1400372b4
cmp r9, rdx
jae 0x140037384
mov r9, rdx
cmp r8, 0x40
jb 0x140037348
mov r11, r8
mov qword [rsp], rbx
and r11d, 0x3f
mov rbx, r8
sub rbx, r11
lea rax, [rcx + 0x10]
sub r9, rcx
nop dword [rax]
movdqu xmm0, xmmword [rax - 0x10]
add r10, 0x40
movdqu xmm1, xmmword [r9 + rax - 0x10]
movdqu xmm2, xmmword [r9 + rax]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [r9 + rax - 0x30]
xorps xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [r9 + rax - 0x20]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
cmp r10, rbx
jb 0x1400372e0
mov rbx, qword [rsp]
cmp r11, 8
jb 0x14003737f
jmp 0x14003734b
sub r9, rcx
mov r11, r8
and r11, 0xfffffffffffffff8
lea rax, [r10 + rcx]
nop word [rax + rax]
movq xmm0, qword [rax]
add r10, 8
movq xmm1, qword [r9 + rax]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rax - 8], xmm1
cmp r10, r11
jb 0x140037360
cmp r10, r8
jae 0x1400373a2
sub rdx, rcx
lea r9, [r10 + rcx]
sub r8, r10
nop
movzx eax, byte [r9 + rdx]
xor byte [r9], al
lea r9, [r9 + 1]
sub r8, 1
jne 0x140037390
add rsp, 8
ret
Function at 0x1400487d0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1401e1b20
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x140054ae0
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x140054b07
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x140054af0
movzx eax, r9b
ret