joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140154520
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x140154533
add rsp, 0x48
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx edx, ax
lea rcx, [rsp + 0x20]
or edx, 0x80070000
test eax, eax
cmovle edx, eax
call fcn.140155660
lea rdx, [0x140267b98]
lea rcx, [rsp + 0x20]
call fcn.14017ebbc
int3

Function at 0x140162e28
Capabilities:
Set thread local storage value

Disassembly:
mov ecx, dword [0x140273590]
xor edx, edx
jmp fcn.140154520

Function at 0x140164898
Capabilities:
Set thread local storage value

Disassembly:
mov rdx, rcx
mov ecx, dword [0x140273590]
jmp fcn.140154520

Function at 0x140176138
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140176218]
mov r9, qword [r9 + 8]
jmp fcn.14015fab0

Function at 0x1401761f0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rcx + 0x98], rdx
mov r8, rcx
mov r9, qword [rdx + 0x1a8]
add rcx, 0x40
lea rdx, [0x140176228]
mov r9, qword [r9 + 8]
jmp fcn.14015fab0

Function at 0x1401a9450
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1401a9470
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1401ad72c
or eax, 0xffffffff
jmp 0x1401a9472
xor eax, eax
add rsp, 0x28
ret
Function at 0x1401c82ec
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
jne 0x1401c7f92
call fcn.1401ad79c
mov dword [rax], SafeArrayPutElement
call fcn.14018c52c
jmp 0x1401c80dd
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1401c80dd
mov eax, dword [rcx + 0x14]
shr eax, 0xc
test al, 1
jne 0x1401c80dd
mov eax, dword [rcx + 0x14]
shr eax, 1
test al, 1
je 0x1401c7fc1
lock or dword [rcx + 0x14], 0x10
jmp 0x1401c80dd
lock or dword [rcx + 0x14], 1
mov eax, dword [rcx + 0x14]
test eax, 0x4c0
jne 0x1401c7fd5
call fcn.1401c99e0
mov esi, dword [rbx + 0x10]
cmp esi, 1
jne 0x1401c7fe5
mov rax, qword [rbx]
mov bpl, byte [rax]
jmp 0x1401c7fe8
xor bpl, bpl
mov rdi, qword [rbx + 8]
mov rcx, rbx
mov qword [rbx], rdi
call fcn.1401c2da4
mov r8d, dword [rbx + 0x20]
mov ecx, eax
mov rdx, rdi
call fcn.1401c900c
mov dword [rbx + 0x10], eax
lea ecx, [rax + 1]
cmp ecx, 2
jbe 0x1401c80cb
mov eax, dword [rbx + 0x14]
test al, 6
jne 0x1401c8079
mov rcx, rbx
call fcn.1401c2da4
cmp eax, 0xffffffff
je 0x1401c8064
mov rcx, rbx
call fcn.1401c2da4
cmp eax, 0xfffffffe
je 0x1401c8064
mov rcx, rbx
call fcn.1401c2da4
movsxd rdi, eax
lea r14, [0x1402744c0]
mov rcx, rbx
sar rdi, 6
call fcn.1401c2da4
and eax, 0x3f
lea rcx, [rax + rax*8]
mov rax, qword [r14 + rdi*8]
lea rdx, [rax + rcx*8]
jmp 0x1401c806b
lea rdx, [0x14026e340]
mov al, byte [rdx + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1401c8079
lock or dword [rbx + 0x14], 0x20
cmp dword [rbx + 0x20], 0x200
jne 0x1401c809d
mov eax, dword [rbx + 0x14]
shr eax, 6
test al, 1
je 0x1401c809d
mov eax, dword [rbx + 0x14]
shr eax, 8
test al, 1
jne 0x1401c809d
mov dword [rbx + 0x20], 0x1000
mov rax, qword [rbx]
cmp esi, 1
jne 0x1401c80bb
movzx ecx, byte [rax]
dec dword [rbx + 0x10]
shl cx, 8
movzx eax, bpl
or cx, ax
inc qword [rbx]
jmp 0x1401c80c6
movzx ecx, word [rax]
add dword [rbx + 0x10], 0xfffffffe
add qword [rbx], 2
movzx eax, cx
jmp 0x1401c80e2
neg eax
sbb eax, eax
and eax, 8
add eax, 8
lock or dword [rbx + 0x14], eax
and dword [rbx + 0x10], 0
mov eax, 0xffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
jmp 0x1401c7f5c
Function at 0x140001030
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140025010]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
mov dword [rbp - 0x18], edx
mov esi, r9d
mov qword [rbp - 0x30], rax
mov rdi, r8
mov qword [rbp - 0x28], rax
mov ebx, edx
mov qword [rbp - 0x20], rax
mov r14, rcx
mov dword [rsp + 0x20], eax
lea r9d, [rax + 1]
xor edx, edx
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
lea rcx, [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1400010ae
lea r9d, [rax + 1]
mov dword [rsp + 0x20], 8
lea r8, str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
xor edx, edx
lea rcx, [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140001153
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x28]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8004
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140001147
mov rcx, qword [rbp - 0x28]
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x14000113d
mov r8, qword [rbp - 0x28]
lea rax, [rbp - 0x20]
mov rcx, qword [rbp - 0x30]
xor r9d, r9d
mov edx, 0x6801
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x14000113d
mov rcx, qword [rbp - 0x20]
lea rax, [rbp - 0x18]
xor r9d, r9d
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], r14
lea r8d, [r9 + 1]
call qword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov rcx, qword [rbp - 0x20]
test eax, eax
jne 0x140001157
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x140001178
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp - 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 1
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140004530
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140001190
Capabilities:
Encode data using base64 via winapi

Disassembly:
push rbx
push rsi
push r12
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x140025010]
xor rax, rsp
mov qword [rsp + 0x90], rax
xorps xmm0, xmm0
mov dword [rsp + 0x30], 0x46
mov r14, rdx
mov eax, 0xaaaaaaab
mul dword [rdx]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
xor eax, eax
mov r12, rcx
shr edx, 1
xor ebx, ebx
movups xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x80], eax
lea ecx, [rax + 0x40]
mov word [rsp + 0x84], ax
lea r15d, [rdx*4 + 0x68]
mov edx, r15d
movups xmmword [rsp + 0x70], xmm0
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rsi, rax
test rax, rax
je 0x140001354
mov ecx, dword [r14]
mov eax, 0xaaaaaaab
mul ecx
mov qword [rsp + 0xe0], rbp
shr edx, 5
mov qword [rsp + 0xe8], rdi
mov edi, ebx
add edx, 1
je 0x140001322
mov ebp, ebx
nop dword [rax]
mov eax, 0xaaaaaaab
mov r8d, ecx
mul ecx
shr edx, 5
lea eax, [rdx + rdx*2]
shl eax, 4
sub r8d, eax
cmp edi, edx
jne 0x140001263
test r8d, r8d
je 0x140001322
sub ecx, ebp
mov dword [rsp + 0x30], 0x46
mov edx, 0x30
lea rax, [rsp + 0x30]
cmp ecx, edx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
mov r8d, 1
cmovb edx, ecx
movsxd rcx, ebp
add rcx, r12
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
je 0x140001374
mov r8d, 0x40
mov ecx, ebx
cmp dword [rsp + 0x30], r8d
mov edx, r15d
cmovb r8d, dword [rsp + 0x30]
sub edx, ebx
add rcx, rsi
mov dword [rsp + 0x30], r8d
test r8, r8
je 0x140001302
test rcx, rcx
jne 0x1400012d7
call fcn.140008ccc
mov dword [rax], 0x16
jmp 0x1400012fd
cmp rdx, r8
jb 0x1400012e8
lea rdx, [rsp + 0x40]
call fcn.1400085c0
jmp 0x140001302
mov r8, rdx
xor edx, edx
call fcn.140005d00
call fcn.140008ccc
mov dword [rax], 0x22
call fcn.140008bac
mov ecx, dword [r14]
mov eax, 0xaaaaaaab
add ebx, dword [rsp + 0x30]
inc edi
mul ecx
add ebp, 0x30
shr edx, 5
inc edx
cmp edi, edx
jb 0x140001240
lea eax, [rbx - 1]
cmp byte [rax + rsi], 0xa
jne 0x14000133e
lea edx, [rbx - 2]
cmp byte [rdx + rsi], 0xd
jne 0x14000133e
mov byte [rax + rsi], 0
mov ebx, edx
mov byte [rdx + rsi], 0
mov dword [r14], ebx
mov rax, rsi
mov rbp, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140004530
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rsi
pop rbx
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
jmp 0x140001344
Function at 0x14000bd20
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000bb4c
Function at 0x140026010
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x140026134
xchg rbx, r15
mov qword [rsp + 0x10], r15
xchg r15, rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
xchg rdi, r9
mov qword [rsp + 0x30], r9
xchg rdi, r9
xchg rdx, rbx
mov rdx, rbx
xchg rbx, rdx
xchg r8, rdi
mov r8, rcx
xchg r8, rdi
mov esi, r8d
sub rdi, rdx
xchg r8, rcx
mov rbp, r8
xchg rcx, r8
sub rdi, 0x4b98bd22
add rdi, 0x4b98be12
dec rsi
shr rsi, 1
shr rsi, 2
shr rsi, 1
inc rsi
nop dword [rax]
xchg r8, rbx
movups xmm0, xmmword [r8]
xchg rbx, r8
xchg rbp, rdx
mov rbp, rdx
xchg rdx, rbp
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.1400267f0
mov ecx, 0xaa97631
add ecx, 0x44d18f14
sub ecx, 0x14f62d20
add ecx, 0xd5fa8fe
add ecx, 0x94c0bc5
add ecx, 0xa6d7f48
sub ecx, 0x5b9e0c20
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1400260d2
nop
sub rdi, 0x22d6a494
add rdi, 0x22d6a484
xchg rcx, rbp
movups xmmword [rcx + 0xf0], xmm0
xchg rcx, rbp
sub rsi, 1
jne 0x14002607b
xchg rdx, rdi
mov rdx, qword [rsp + 0x30]
xchg rdx, rdi
mov rbx, qword [rsp + 0x38]
xchg rbp, r8
mov r8, qword [rsp + 0x40]
xchg rbp, r8
add rsp, 0x20
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140026140
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rbp
mov qword [rsp + 0x10], rdx
xchg rbp, rdx
mov qword [rsp + 0x18], rsi
nop
push 0x1d6315d9
mov qword [rsp], rdi
sub rsp, 0x20
mov edi, r8d
mov rbx, rdx
lea r9, [rcx + 0xf0]
xchg rsi, rcx
mov rcx, rsi
xchg rcx, rsi
test r8d, r8d
je 0x140026213
dec rdi
shr rdi, 1
shr rdi, 3
inc rdi
nop dword [rax]
nop word [rax + rax]
xchg r8, rbx
mov rax, r8
xchg r8, rbx
sub r9, rbx
mov edx, 0x386d44a5
xor edx, 0x78426d32
sub edx, 0x12112c29
sub edx, 0x12071728
add edx, 0x2ddecba3
sub edx, 0x49f5b1d9
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400261d0
xchg rdi, rsi
mov rdx, rdi
xchg rdi, rsi
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.1400262c0
xchg r9, rbx
mov rbx, r9
xchg rbx, r9
sub rbx, 0xfffffffffffffff0
sub rdi, 1
jne 0x14002619c
xchg r9, rbp
movups xmm0, xmmword [rbp]
xchg rbp, r9
xchg rbx, rsi
mov rsi, qword [rsp + 0x30]
xchg rsi, rbx
mov rbp, qword [rsp + 0x38]
xchg rbx, rsi
movups xmmword [rbx + 0xf0], xmm0
xchg rbx, rsi
xchg rbx, rsi
mov rbx, qword [rsp + 0x40]
xchg rsi, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1400279c0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov qword [rsp + 8], rbx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x10
xchg rdx, r13
mov rbx, r13
xchg r13, rdx
mov r10, rcx
test r8b, 0xf
je 0x140027a0d
xor al, al
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
push rdx
push rcx
push rcx
push rax
push rdx
push rcx
push rdx
push rbx
xchg qword [rsp + 0x40], rdi
pop rbx
pop rdx
pop rcx
pop rdx
pop rax
pop rcx
pop rcx
pop rdx
add rsp, 8
ret
xor edx, edx
test r8d, r8d
je 0x140027acb
movdqa xmm2, xmmword [rsp]
nop
xchg rdx, r12
movdqu xmm1, xmmword [r12 + rbx]
xchg r12, rdx
test edx, edx
jne 0x140027a41
xchg r10, r13
movdqu xmm2, xmmword [r13 + 0x200]
xchg r10, r13
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
pxor xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0x35a1ba68
sub ecx, 0x204dc1ac
add ecx, 0x568b26ad
sub ecx, 0x1ba69c96
sub ecx, 0x433c08e5
xor ecx, 0x27b0b2c2
add ecx, 0x2f018245
xor ecx, 0x2ce714a5
xor ecx, 0x76a959d9
nop dword [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027a8f
aesdeclast xmm0, xmmword [r10 + 0x1e0]
pxor xmm0, xmm2
movdqa xmm2, xmm1
xchg rdx, rsi
movups xmmword [rsi + r9], xmm0
xchg rsi, rdx
sub edx, 0xfffffff0
cmp edx, r8d
jb 0x140027a1e
xchg rbx, r11
mov r11, qword [rsp + 0x20]
xchg r11, rbx
mov al, 0x71
xor al, 0x1b
xor al, 0x21
xor al, 0x70
xor al, 0x17
sub al, 0x1c
sub al, 0xf
add rsp, 0x10
push rcx
push rdx
xchg qword [rsp + 0x10], rdi
pop rdx
pop rcx
add rsp, 8
ret

Function at 0x140027b00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x10
xchg rdx, r12
mov rbx, r12
xchg r12, rdx
xchg r12, r10
mov r12, rcx
xchg r12, r10
test r8b, 0xf
je 0x140027b46
xor al, al
add rsp, 0x10
push rax
push rax
push rdx
push rax
push rcx
push rax
xchg qword [rsp + 0x30], rbx
pop rax
pop rcx
pop rax
pop rdx
pop rax
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
xor edx, edx
test r8d, r8d
je 0x140027c01
movdqa xmm0, xmmword [rsp]
mov qword [rsp + 0x20], rdi
nop dword [rax + rax]
xchg rcx, rdx
movdqu xmm1, xmmword [rcx + rbx]
xchg rdx, rcx
test edx, edx
jne 0x140027b82
xchg r15, r10
movdqu xmm0, xmmword [r15 + 0x200]
xchg r10, r15
pxor xmm0, xmm1
lea rax, [r10 + 0x10]
pxor xmm0, xmmword [r10 + 0x1e0]
mov ecx, 0x7a34819c
xor ecx, 0x67224dc1
add ecx, 0xaaeb419
add ecx, 0x56ca4a5a
xor ecx, 0x2301c2de
xor ecx, 0x5e575c89
sub ecx, 0x3d9547a
nop dword [rax + rax]
aesenc xmm0, xmmword [rax]
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x140027bc4
aesenclast xmm0, xmmword [r10 + 0xe0]
xchg r12, rdx
movups xmmword [r12 + r9], xmm0
xchg r12, rdx
neg edx
add edx, 0xfffffff0
neg edx
cmp edx, r8d
jb 0x140027b60
mov rdi, qword [rsp + 0x20]
mov al, 0x11
xor al, 0x53
add al, 1
add al, 0x1a
add al, 0x13
xor al, 0x71
add al, 0
add rsp, 0x10
push rax
push rcx
push rcx
xchg qword [rsp + 0x18], rbx
add rsp, 0x20
ret
Function at 0x14002cbf0
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rsi, rbx
mov qword [rsp + 0x18], rbx
xchg rbx, rsi
xchg rdi, r13
mov qword [rsp + 0x20], r13
xchg rdi, r13
push r14
sub rsp, 0x30
xchg r10, rsi
mov r10, rcx
xchg rsi, r10
mov rax, qword gs:[0x30]
xchg r9, rdi
mov r9, qword [rax + 0x60]
xchg r9, rdi
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
xchg rbp, rbx
mov qword [rsp + 0x40], rbp
xchg rbx, rbp
sub rcx, 0xffffffffffffff38
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x2f08a6ba
sub dword [rsp + 0x20], 0x46c5e0c
add dword [rsp + 0x20], 0x2406c205
add dword [rsp + 0x20], 0x229aa704
sub dword [rsp + 0x20], 0xb8beea0
sub dword [rsp + 0x20], 0x38ad483b
xor dword [rsp + 0x20], 0x2d047ad4
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b820
test eax, eax
js 0x14002ccb3
cmp qword [rsp + 0x40], rbx
je 0x14002ccb3
lea eax, [rbx + 1]
jmp 0x14002cdee
mov rax, qword gs:[0x60]
xchg r11, rcx
mov r11, qword [rax + 0x30]
xchg r11, rcx
cmp dword [rcx + 0x70], 2
jbe 0x14002ccfd
mov eax, 0x57cce4bf
xor eax, 0x3885673c
xor eax, 0x296bcb
sub eax, 0x193369a5
sub eax, 0x4f4c4a1
xor eax, 0x2e27c5ba
sub eax, 0x9299cae
sub eax, 0x75f5e308
jmp 0x14002cdee
cmp dword [rcx + 0x74], ebx
jbe 0x14002cd29
mov eax, 0x29b5efe1
sub eax, 0x13317bc6
xor eax, 0x7674f696
sub eax, 0x105ff0bf
sub eax, 0x194c570d
sub eax, 0x37443abe
jmp 0x14002cdee
cmp byte [rdi + 2], bl
je 0x14002cd5a
mov eax, 0x3c2cd62f
sub eax, 0x181705a
add eax, 0x3f220087
sub eax, 0x310cfb32
xor eax, 0x20699f5f
xor eax, 0x7d1dcd5b
xor eax, 0x15b4392a
jmp 0x14002cdee
cmp r14d, 0xa
jb 0x14002cda1
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002cda1
mov eax, 0x65d89183
add eax, 0xdf786e6
xor eax, 0x27ab67fd
xor eax, 0x470e2dc5
sub eax, 0x1064d482
sub eax, 0x3453a1
sub eax, 0x2dc2a26
jmp 0x14002cdee
lea rcx, [rsi + 0xb8]
mov edx, 0x56b5c618
xor edx, 0x75e5f48
add edx, 0x15e219e
sub edx, 0x23d23356
add edx, 0x4516c202
sub edx, 0x5b0dca10
add edx, 0x61bfd772
sub edx, 0x2b61c4d8
add edx, 0x49bb0775
call fcn.14002c190
jmp 0x14002cdec
mov eax, ebx
xchg rbx, r15
mov r15, qword [rsp + 0x48]
xchg rbx, r15
xchg r14, rsi
mov r14, qword [rsp + 0x50]
xchg r14, rsi
xchg rbp, rdi
mov rbp, qword [rsp + 0x58]
xchg rdi, rbp
add rsp, 0x30
nop
xchg qword [rsp], r14
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140035b90
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rdi
mov qword [rsp + 8], rdi
xchg rcx, rdi
push rbx
nop
sub rsp, 8
mov qword [rsp], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
push r12
mov qword [rsp], r13
push r14
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x30
xchg rsi, rdx
mov r15, rsi
xchg rsi, rdx
xchg r14, r15
mov r15, rcx
xchg r15, r14
movabs rsi, 0xfffffff5e81d7be
xor rsi, 0x6abfffc0
xor rsi, 0x5f9d5929
xor rsi, 0x790decf1
xor rsi, 0x7f2b0f61
xor rsi, 0x35115d0a
sub rsi, 0x21f70e7a
xor rsi, 0x4091c201
add rsi, 0x7fffffff
add rsi, 0x9f3fcae
cmp rdx, rsi
ja 0x140035dee
mov r12, qword [rcx + 8]
sub r12, qword [rcx]
sar r12, 2
sar r12, 1
sar r12, 1
mov rcx, qword [rcx + 0x10]
sub rcx, qword [r14]
sar rcx, 1
sar rcx, 1
sar rcx, 2
xchg rcx, rdx
mov rcx, rdx
xchg rcx, rdx
shr rdx, 1
xchg r10, rsi
mov rax, r10
xchg r10, rsi
sub rax, rdx
cmp rcx, rax
ja 0x140035c7f
lea rsi, [rdx + rcx]
cmp rsi, r15
cmovb rsi, r15
mov qword [rsp + 0x88], rsi
mov rdx, rsi
xchg r14, r9
mov rcx, r9
xchg r14, r9
call fcn.140053ae0
xchg r13, rax
mov rax, r13
xchg r13, rax
mov qword [rsp + 0x28], rax
mov rbx, r12
shl rbx, 4
add rbx, rax
mov qword [rsp + 0x20], rbx
xchg rdi, r13
mov r13, r15
xchg r13, rdi
sub rdi, r12
xchg r15, rbx
mov qword [rsp + 0x78], r15
xchg rbx, r15
je 0x140035d14
nop word [rax + rax]
mov byte [rbx], 9
add byte [rbx], 0x35
add byte [rbx], 0xd
sub byte [rbx], 0x3e
xor byte [rbx], 0x20
sub byte [rbx], 0x21
xor byte [rbx], 0x79
xor byte [rbx], 0x14
sub byte [rbx], 0x61
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004bd90
nop
sub rbx, 0xfffffffffffffff0
mov qword [rsp + 0x78], rbx
sub rdi, 1
jne 0x140035cda
xchg r11, r8
mov r11, qword [r14 + 8]
xchg r11, r8
mov rdx, r13
xchg rbp, rcx
mov rbp, qword [r14]
xchg rcx, rbp
cmp rcx, r8
je 0x140035d6e
xor r9d, r9d
movzx eax, byte [rcx]
mov byte [rdx], al
xchg rsi, rax
mov rsi, qword [rcx + 8]
xchg rsi, rax
xchg r9, rax
mov qword [rdx + 8], r9
xchg r9, rax
mov byte [rcx], r9b
mov qword [rcx + 8], r9
lea rdx, [rdx + 0x10]
nop
sub rcx, 0x37b36573
add rcx, 0x37b36583
cmp rcx, r8
jne 0x140035d36
xchg r9, r12
mov r12, rsi
xchg r9, r12
xchg r9, r15
mov r8, r9
xchg r15, r9
xchg r13, rdx
mov r13, rdx
xchg rdx, r13
xchg r15, r14
mov rcx, r15
xchg r15, r14
add rsp, 0x30
push rbx
push rax
push rdx
xchg qword [rsp + 0x18], r15
add rsp, 0x20
nop
xchg qword [rsp], r14
add rsp, 8
nop
xchg qword [rsp], r13
add rsp, 8
nop
xchg qword [rsp], r12
add rsp, 8
nop
xchg qword [rsp], rdi
add rsp, 8
push rcx
xchg qword [rsp + 8], rsi
add rsp, 0x10
push rcx
push rdx
push rdx
push rcx
push rcx
push rcx
push rdx
push rcx
xchg qword [rsp + 0x40], rbx
pop rcx
pop rdx
pop rcx
pop rcx
pop rcx
pop rdx
pop rdx
pop rcx
add rsp, 8
jmp fcn.140052bf0
call fcn.14002fa40
int3
Function at 0x140035e70
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r13
mov qword [rsp + 8], r13
xchg r13, rbx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rdx
mov rdx, rdi
xchg rdx, rdi
xchg r12, rbx
mov r12, rcx
xchg r12, rbx
test rdx, rdx
je 0x140035edb
nop word [rax + rax]
mov byte [rbx], 0x12
xor byte [rbx], 0x3e
xor byte [rbx], 0x13
xor byte [rbx], 0x11
xor byte [rbx], 0x46
sub byte [rbx], 0x4a
add byte [rbx], 0x36
add byte [rbx], 0xe
sub byte [rbx], 0x62
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004bd90
nop
add rbx, 0x10
sub rdi, 1
jne 0x140035eaa
xchg rbx, r15
mov rax, r15
xchg r15, rbx
xchg rbx, r13
mov r13, qword [rsp + 0x30]
xchg rbx, r13
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret
Function at 0x14004c530
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x6c
add byte [rcx + rax + 6], 0
sub byte [rcx + rax + 6], 0x12
sub byte [rcx + rax + 6], 0x30
sub byte [rcx + rax + 6], 0x11
xor byte [rcx + rax + 6], 2
xor byte [rcx + rax + 6], 0x6f
sub byte [rcx + rax + 6], 0x2c
sub byte [rcx + rax + 6], 0x48
inc rax
cmp rax, 8
jb 0x14004c532
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14004c580
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x7d
sub byte [rcx + rax + 6], 9
xor byte [rcx + rax + 6], 0x30
xor byte [rcx + rax + 6], 8
sub byte [rcx + rax + 6], 0xe
xor byte [rcx + rax + 6], 0x50
sub byte [rcx + rax + 6], 0x2d
sub byte [rcx + rax + 6], 0x41
inc rax
cmp rax, 0xa
jb 0x14004c582
ret
Function at 0x140076520
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rdx
mov r9, rdx
xchg rdx, rcx
mov r8d, 0x1dd71bb9
add r8d, 0x595a44e4
xor r8d, 0xf619cf
sub r8d, 0x303e45af
xor r8d, 0x8f009a1
add r8d, 0x3126e7b
xor r8d, 0x7e75e7db
xor r8d, 0xd301b059
test rcx, rcx
je 0x14007663d
cmp byte [rcx], 0
je 0x14007663d
test rdx, rdx
jne 0x1400765ce
nop
movabs rdx, 0xffffffff390b3420
add rdx, 0x11fad0c0
add rdx, 0x127e3aa
xor rdx, 0x69605a97
add rdx, 0x21342c40
add rdx, 0x2bd34758
add rdx, 0x7fffffff
add rdx, 0xdaada4b
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x1400765b8
test rdx, rdx
je 0x14007663a
xor r10d, r10d
lea r11, [0x140002dd0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
or rcx, qword [rsp]
add rsp, 0x10
shr r8d, 4
shr r8d, 3
shr r8d, 1
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x1400765e0
not r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b460
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rax
mov r13, qword [rcx + 0x10]
xchg r13, rax
xchg rdx, rbx
mov rbx, rcx
xchg rbx, rdx
test rax, rax
jne 0x14007b47d
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14007b4c6
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b4ab
xchg rsi, rax
mov rsi, qword [rdx + 0x10]
xchg rsi, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b48b
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x64
xor byte [rdx], 0x72
xor byte [rdx], 0x2f
add byte [rdx], 0x37
sub byte [rdx], 0x27
add byte [rdx], 0x18
sub byte [rdx], 0x32
add byte [rdx], 0x14
sub byte [rdx], 0x42
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b4d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
mov rdx, rcx
test rax, rax
jne 0x14007b4eb
xor r8d, r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b530
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b518
xchg rcx, rbp
mov rbp, qword [rdx + 0x10]
xchg rbp, rcx
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b4f9
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x22
xor byte [rdx], 0x17
add byte [rdx], 0xc
xor byte [rdx], 0x3b
sub byte [rdx], 1
sub byte [rdx], 0x25
xor byte [rdx], 0xb
sub byte [rdx], 0x5e
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b850
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rax
mov r15, qword [rcx + 0x10]
xchg r15, rax
xchg rbp, rdx
mov rbp, rcx
xchg rdx, rbp
test rax, rax
jne 0x14007b867
ret
cmp byte [rcx], 0
jne 0x14007b8b3
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b89e
nop dword [rax + rax]
xchg r15, rax
mov r15, qword [rdx + 0x10]
xchg r15, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b87a
xchg r15, rax
mov r15, qword [rdx + 0x10]
xchg r15, rax
mov byte [rdx], 2
sub byte [rdx], 2
add byte [rdx], 0x52
sub byte [rdx], 0x4d
xor byte [rdx], 0x35
xor byte [rdx], 0x1f
xor byte [rdx], 0x2e
ret