joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001d330
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x14001d4e7
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14001d3c6
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14001cd10
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14001c320
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x14001d3b7
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.140012370
mov dword [rbx + 0x80], 0
jmp 0x14001d4d3
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.14001b240
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14002bc80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x13f0
call fcn.140033a30
sub rsp, rax
mov rax, qword [0x140040010]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], r12b
lea r8d, [r12 + 0x3e]
lea rdx, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
lea rcx, [rsp + 0x30]
call fcn.140030fc0
nop
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
lea ecx, [r12 + 1]
nop dword [rax]
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x54], edx
inc rcx
cmp rcx, 0x270
jb 0x14002bd10
mov dword [rsp + 0x50], 0x270
mov ebx, dword [rsp + 0x40]
dec ebx
mov qword [rdi], r12
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov dword [rsp + 0x20], 1
mov ebp, 0xc8
mov r15, qword [rsp + 0x48]
mov r14, qword [rsp + 0x30]
cmp ebx, 0xffffffff
jne 0x14002bd79
lea rcx, [rsp + 0x50]
call fcn.140031aa0
mov edx, eax
jmp 0x14002bdbb
lea esi, [rbx + 1]
nop dword [rax]
mov ecx, r12d
mov eax, r12d
test ebx, ebx
je 0x14002bd9b
lea rcx, [rsp + 0x50]
call fcn.140031aa0
mov ecx, eax
mov eax, 0xffffffff
xor edx, edx
div esi
mov r9d, edx
mov r8d, eax
xor edx, edx
mov eax, ecx
div esi
cmp eax, r8d
jb 0x14002bdb5
cmp r9d, ebx
jne 0x14002bd80
xor edx, edx
mov eax, ecx
div esi
lea rcx, [rsp + 0x30]
cmp r15, 0x10
cmovae rcx, r14
movsxd rax, edx
movzx r9d, byte [rax + rcx]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x14002bdfc
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x14002bdf1
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14002be04
mov rcx, rdi
call fcn.1400315f0
sub rbp, 1
jne 0x14002bd66
cmp r15, 0x10
jb 0x14002be48
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14002be40
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002be40
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.140032de8
mov rax, rdi
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.140032840
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140031aa0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140031b01
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140031ac0
mov ecx, dword [r10]
jmp 0x140031bea
cmp ecx, 0x4e0
jb 0x140031bea
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140031b20
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140031b70
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140002720
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000277d
lea rbx, [0x14003e930]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002764
cmp r10, 2
jb 0x140002764
cmp byte [r9], r8b
jne 0x140002764
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002740
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x1400027bf
lea rbx, [0x14003e930]
cmp r8b, 0x23
jne 0x1400027a3
cmp byte [r9], r8b
jne 0x1400027a3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140002790
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140002900
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000291a
mov qword [r8], 0
lea rdx, [0x14003e4b0]
call fcn.1400027d0
mov rbx, rax
test rax, rax
jne 0x14000293a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140002a11
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002a11
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140002a11
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002a11
cmp rdi, 0xffffffffffffffff
je 0x140002a11
mov rax, qword [0x14004a810]
test rax, rax
je 0x1400029ae
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140002a11
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x1400029fe
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14004a810]
test rax, rax
je 0x1400029f3
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140002a1a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140002a0c
mov qword [r14], rdi
mov rax, rsi
jmp 0x140002a1c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140005f60
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
lea r11, [0x14003e930]
mov rax, qword [rcx + 0xf8]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x3f18], ebx
jne 0x140005ff6
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.140019420
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x140012920
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14004a010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14004a810]
mov edi, ecx
cmp byte [rbx + 0x4a55], 0
jne 0x140012981
cmp byte [rbx + 0x4a56], 0
jne 0x140012981
movsx r9d, word [rbx + 0x5b7a]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140002580
test dil, 1
je 0x140012aaf
jmp 0x140012a0a
movss xmm1, dword [rbx + 0x389c]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5b7a]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400437ec]
mulss xmm1, dword [0x1400437e0]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xe08]
addss xmm1, dword [rbx + 0xe0c]
mov qword [rbx + 0x47c0], rax
mov dword [rbx + 0x47ac], 1
movss dword [rbx + 0x47b8], xmm0
movss dword [rbx + 0x47bc], xmm1
movss xmm0, dword [rbx + 0x38f8]
mulss xmm0, dword [0x140043768]
or dword [rbx + 0x47a8], 0x41
movss dword [rbx + 0x4808], xmm0
call fcn.140002580
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140012a60
lea r11, [0x14003e930]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140012a43
cmp byte [r8], r9b
jne 0x140012a43
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140012a30
not ecx
call fcn.140009af0
test rax, rax
je 0x140012aaf
cmp byte [rax + 0xb6], 0
je 0x140012aaf
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, 0x10
inc word [rbx + 0x5b7a]
movsx r9d, word [rbx + 0x5b7a]
call fcn.140002580
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000c200
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14003aa10
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140017d50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c60], 0
lea rbx, [rcx + 0x5c68]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140017df7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x140017daa
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001a210
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140002d90
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c60]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c70]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14004a808]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x140017dff
mov rcx, rbx
call fcn.140002d90
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140018280
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x14004a810]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x1400182e3
mov qword [rsp], rbx
lea rbx, [0x14003e930]
nop dword [rax]
cmp r9b, 0x23
jne 0x1400182c3
cmp byte [r8], r9b
jne 0x1400182c3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1400182b0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5bd8]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x140018317
mov r10, qword [r10 + 0x5be0]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14001831e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x140018304
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x1400387c0
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x14004a010]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14003882b
lea rdx, str.VALORANT_Win64_Shipping.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x14003884f
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140038803
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.14003aa10
add rsp, 0x160
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x140038836
Function at 0x14003b5f0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003b63a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003b63a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003b63a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003b63a
cmp dword [rcx + 0x84], 0xe
jbe 0x14003b63a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003b63c
xor al, al
add rsp, 0x28
ret
Function at 0x1400072b0
Capabilities:
Access peb ldr_data
Encode data using base64
Encrypt data using speck
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
movabs r12, 0xcbf29ce484222325
movabs r14, 0x1d12a89b9e723ff5
lea rcx, [0x1400ce915]
jmp 0x1403b00e5

Function at 0x140008210
Capabilities:
Access peb ldr_data
Encrypt data using speck
Get kernel32 base address
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
movabs r14, 0xcbf29ce484222325
lea rcx, [0x1400ce987]
jmp 0x1403b1d07

Function at 0x1400ec48c
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jmp 0x140223fe6
sub eax, eax
jmp 0x14026758e
cmp dword [rdx], 0x4550
jmp 0x140281b42
jne 0x140197ae0
movsxd rdx, dword [rcx + 0x3c]
cmp r9b, 0x98
lea rdx, [rdx + rcx]
test r12d, ebx
jmp 0x14020b1da
ret
jne 0x140197ae0
sub eax, eax
sal al, 0xf
mov ecx, 0x20b
sar al, 0x42
cmp word [rdx + 0x18], cx
setl al
not al
mov al, r13b
sete al
ret
Function at 0x140211415
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404b3f96
sub edx, edx
adc r8w, 0x5391
test r10w, r14w
sub ecx, ecx
lea r8d, [rdx + 1]
jmp 0x1400e4a9c
Function at 0x140255de0
Capabilities:
Enumerate pe sections

Disassembly:
jb 0x140255e29
xor eax, eax
jmp 0x1401c0999
jb 0x1401c0999
inc r9d
add rax, 0x28
test r8b, r9b
test r11b, 0x58
jmp 0x14022a211
jb 0x140129846
mov ecx, dword [rax + 8]
add ecx, edx
test r11b, spl
stc
cmp r10, rcx
jmp 0x140129840
ret
cmp r9d, r11d
jmp 0x140112597
movsxd r8, dword [rcx + 0x3c]
add r11w, 0x5e4d
sal r10, cl
bsr r11w, si
sub r9d, r9d
cwde
add r8, rcx
mov r10, rdx
movzx eax, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
test rdi, 0x1aa9245f
cmp dil, 0x4c
add rax, 0x18
test cl, bh
stc
cmp di, r9w
add rax, r8
stc
test r11d, r11d
je 0x14011259d
mov edx, dword [rax + 0xc]
clc
cmp r15d, r13d
test r12d, 0x6a07453f
cmp r10, rdx
jmp 0x1401a48fe

Function at 0x14028dbe3
Capabilities:
Encrypt data using speck
Execute anti-debugging instructions
Resolve function by parsing pe exports

Disassembly:
jmp 0x140448f07
mov rcx, qword [rcx]
jmp 0x1401d877c
push rsi
test r11, rbx
rcl ah, cl
sal rsi, 0xc4
push rdi
cbw
sub si, 0x32b2
jmp 0x140448f1e
sub rsp, 0x28
adc ax, 0x48d4
btc ax, ax
mov rsi, rcx
clc
mov rcx, qword [rcx + 0x18]
mov rax, qword [rcx]
clc
sub edx, edx
cmp dil, 0xc0
sub r8d, r8d
call qword [rax + 0x188]
mov edi, eax
movsx cx, r11b
movzx rcx, r8w
movsx rcx, r9w
lea rcx, [rsi + 0x30]
call fcn.14045cb2b
test edi, edi
je 0x140448fad
cmp edi, 0x8899000c
jmp 0x140448f70
jne 0x140448fcf
mov rcx, rsi
btc di, bp
mov si, 0x4a45
shld rdi, r9, 0x3f
add rsp, 0x28
movzx rdi, r8w
mov sil, sil
movzx di, r9b
pop rdi
movsx esi, r15w
cmovle rsi, rbx
movsxd rsi, r8d
pop rsi
jmp 0x140448fa8
jmp fcn.140448bd7
nop
bt edi, r11d
add rsp, 0x28
movsxd rdi, eax
not sil
pop rdi
mov sil, r11b
mov esi, 0x78d22eb9
not si
pop rsi
jmp 0x140448fce
ret
mov ecx, edi
ror si, 0x8c
xadd r9w, r9w
sbb sil, spl
movabs r8, 0xad4a5352d2edebd0
jmp 0x140448fec
mov dl, 3
add sil, r15b
mov r9d, 0x54
add rsp, 0x28
movsxd rsi, r13d
pop rdi
pop rsi
jmp fcn.1403b22f3

Function at 0x14028fcb8
Capabilities:
Parse pe header

Disassembly:
jmp 0x1404b3f96
xor r8d, r8d
clc
test rdi, r15
sub edx, edx
jmp 0x1401efb15
Function at 0x1402967bc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, qword gs:[0x30]
movsx r9, ax
jmp 0x14026b7b2
je 0x1400e034c
cmp rdx, 0x104
mov r8d, 0x104
jmp 0x1401469ac
je 0x14016ec8e
mov word [rcx], 0
jmp 0x14016ec8e
je 0x14011991f
mov word [r10], 0
btc ax, 0x10
sbb ah, 0x2e
movzx eax, word [0x1400b8f10]
add r8d, 0x75680c72
bsr r8, r12
cmp rdx, 0x104
setno r8b
xchg r8b, r8b
movsxd r8, r9d
mov r8d, 0x104
jmp 0x1401ae18a
cmovb r8, rdx
jmp 0x1401ae197
test r8, r8
jmp 0x14011990b
ret
jne 0x140295e7c
sub r8, rax
clc
jmp 0x140168b71
je 0x140119911
mov word [r10], r11w
mov r11w, r13w
add r10, 2
movsx r11, r13w
movzx r11d, word [r9 + rax*2 + 2]
jmp 0x14022b0f8
cmovb r8, rdx
test ax, ax
je 0x140229f06
sub edx, edx
lea r9, [0x1400b8f10]
cmc
cmp r8, rdx
jmp 0x1401b2d4c
je 0x1401148de
mov word [rcx], ax
shl al, cl
add rcx, 2
movzx eax, word [r9 + rdx*2 + 2]
jmp 0x1401f0061
inc rdx
test ax, ax
jmp 0x140229efc
jne 0x1401ae1a1
sub r8, rdx
cmc
test r8, r8
jmp 0x1401148d8
inc rax
clc
cmp esi, r15d
test r11w, r11w
jmp 0x1401825cf
mov rax, qword [rax + 0x60]
bswap r10w
mov rax, qword [rax + 0x18]
add r8b, bl
mov rax, qword [rax + 0x10]
xadd r10d, r11d
movzx r8d, word [rax + 0x58]
bts r9w, dx
xor r11b, r13b
cmp r8, rdx
movzx r10w, r13b
movsxd r11, r12d
cmovnp r10d, r8d
cmovae r8, rdx
movsx r10w, sil
mov r9, qword [rax + 0x60]
cmp r10b, bl
movsxd r10, eax
movzx r11d, word [r9]
lea r10, [0x1400b8f10]
jmp 0x140291dab
test r11w, r11w
jmp 0x140295e60
je 0x140168b71
xor eax, eax
cmc
test r9, rsp
test r12b, 0x1f
nop word [rax + rax]
cmc
test di, 0x12ef
cmp r8, rax
jmp 0x1401aa1ab
movzx eax, word [0x1400b8f10]
clc
test ax, ax
jmp 0x140103e47
Function at 0x1403bfcde
Capabilities:
Encode data using base64

Disassembly:
push r15
stc
cmp ch, 0xc7
push r14
xchg r14, r14
push r12
or r14w, r13w
push rsi
clc
push rdi
push rbx
sbb r14b, dl
stc
sub rsp, 0x28
movabs r14, 0x2aaaaaaaaaaaaaa
cmp rdx, r14
ja 0x1403bff72
mov rax, rdx
btr rdi, rdx
neg di
mov r15, rcx
and edi, 0x7f44663b
shr r12b, 0x8d
neg dl
mov rdi, qword [rcx]
mov rdx, qword [rcx + 0x10]
sbb bx, cx
xadd r12b, r12b
shrd bx, sp, 0x7c
sub rdx, rdi
adc cl, r10b
shr bx, 0x5d
shl bh, 0xf8
mov rcx, rdx
sar rcx, 5
shl r12b, cl
btc r12w, 0x4b
xchg ebx, ebx
movabs rbx, 0xaaaaaaaaaaaaaaab
btr r12, rbp
imul rbx, rcx
dec r12b
shr r12, 0x27
jmp 0x1403bfd77
mov r12, rbx
sbb cx, cx
sbb ecx, 0x440f5308
bts ecx, edi
shr r12, 1
jmp 0x1403bfd95
mov rcx, r14
sub rcx, r12
cmp ah, 0x90
lea r12, [r12 + rbx]
stc
jmp 0x1403bfda8
cmp r12, rax
jmp 0x1403bfdb0
cmovbe r12, rax
cmp rbx, rcx
jmp 0x1403bfdbc
cmova r12, r14
clc
test rdi, rdi
jmp 0x1403bfdc9
je 0x1403bfe8b
mov rsi, qword [r15 + 8]
stc
cmp r13b, dl
test r11b, 0x3d
cmp rdi, rsi
je 0x1403bfe1e
mov rcx, rdi
call fcn.1403bcbbe
add rdi, 0x60
stc
cmp rdi, rsi
jmp 0x1403bfdf9
jne 0x1403bfde4
mov rdi, qword [r15]
test rbp, 0x15e3467f
mov rdx, qword [r15 + 0x10]
cmc
test si, 0x48ec
cmp r10, 0x6d8476c0
sub rdx, rdi
clc
cmp rdx, 0x1000
jmp 0x1403bfe2a
jb 0x1403bfe60
mov rax, qword [rdi - 8]
cmp r11b, r12b
sub rdi, rax
stc
add rdi, 0xfffffffffffffff8
cmp rdi, 0x20
jmp 0x1403bfe48
jae 0x1403bff7c
add rdx, 0x27
mov cx, 0x3125
xchg dil, cl
movsx di, al
mov rdi, rax
mov rcx, rdi
jmp 0x1403bfe68
call fcn.1401d61ed
xorps xmm0, xmm0
movups xmmword [r15], xmm0
test r14w, 0x1b4b
test r12w, si
jmp 0x1403bfe83
mov qword [r15 + 0x10], 0
cmp r12, r14
jmp 0x1403bfe93
ja 0x1403bff77
mov rax, r12
shl rax, 5
bts rcx, r11
lea rcx, [rax + rax*2]
clc
cmp r12, 0x2b
jmp 0x1403bfeb2
jb 0x1403bfee7
add rcx, 0x27
jmp 0x1403bfec1
call fcn.14044ae17
mov rcx, rax
add rax, 0x27
test ch, 0x99
and rax, 0xffffffffffffffe0
jmp 0x1403bfed9
mov qword [rax - 8], rcx
jmp 0x1403bfee2
jmp 0x1403bff08
test r12, r12
jmp 0x1403bfeef
je 0x1403bfeff
call fcn.14044ae17
jmp 0x1403bff08
xor eax, eax
add si, r11w
cmp r15d, edx
mov qword [r15], rax
mov qword [r15 + 8], rax
bt ebx, 0x94
not r14
lea rcx, [r12 + r12*2]
clc
shl rcx, 5
test r11b, 0xe1
bt r14w, 0x1e
neg dil
add rcx, rax
cmovae r14d, ebx
sar r12w, cl
mov qword [r15 + 0x10], rcx
movsx r12w, r14b
add rsp, 0x28
jmp 0x1403bff4d
pop rbx
pop rdi
movzx r14w, sil
pop rsi
mov r12w, 0x378e
movsx r15w, r12b
pop r12
movzx r15d, r12w
mov r15b, 0x3f
pop r14
pop r15
jmp 0x1403bff71
ret
call fcn.1403be6ab
call fcn.1403b5ac9
call fcn.1404b907c
int3