joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140081e10
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0x27], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rax, qword [0x1402f7010]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov dword [rbp - 0x19], 0x5b465659
mov dword [rbp - 0x15], 0x585a5b53
mov dword [rbp - 0x11], 0x59125e49
mov dword [rbp - 0xd], 0x1005352
xor ecx, ecx
nop word [rax + rax]
lea eax, [rcx + 0x32]
xor byte [rbp + rcx - 0x19], al
inc rcx
cmp rcx, 0xe
jb 0x140081e70
mov byte [rbp - 0xa], 0
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x17]
call fcn.1400817c0
mov r15, rax
mov dword [rbp + 0x2f], 0x567a4c79
mov dword [rbp + 0x33], 0x584f54
mov byte [rbp + 0x37], 1
xor ecx, ecx
nop dword [rax + rax]
lea eax, [rcx + 0x37]
xor byte [rbp + rcx + 0x2f], al
inc rcx
cmp rcx, 7
jb 0x140081eb0
mov byte [rbp + 0x37], 0
movdqa xmm0, xmmword [0x1402d8a80]
movdqu xmmword [rbp + 7], xmm0
mov byte [rbp - 9], 0
lea rax, [rbp + 0x2f]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140081ee0
lea rdx, [rbp + 0x2f]
lea rcx, [rbp - 9]
call fcn.14007c4c0
nop
mov qword [rbp + 0x2f], 0
lea r8, [rbp - 9]
lea rdx, [rbp + 0x2f]
mov rcx, r15
call fcn.140088ec0
mov rbx, qword [rbp + 0x2f]
cmp rbx, qword [r15]
je 0x140081f71
lea rdx, [rbx + 0x20]
mov rsi, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140081f2b
mov rdx, qword [rdx]
lea rcx, [rbp - 9]
mov rdi, qword [rbp - 9]
mov r14, qword [rbp + 0xf]
cmp r14, 0x10
cmovae rcx, rdi
mov r12, qword [rbp + 7]
mov r8, r12
cmp rsi, r12
cmovb r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140081f6a
cmp r12, rsi
jae 0x140081f62
mov eax, 0xffffffff
jmp 0x140081f6a
xor eax, eax
cmp r12, rsi
seta al
shr eax, 0x1f
test al, al
je 0x140081fa9
lea rax, [rbp - 9]
mov qword [rbp + 0x2f], rax
lea r8, [rbp + 0x2f]
mov rcx, r15
call fcn.140089110
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rbp + 0x2f]
mov rcx, r15
call fcn.140089160
mov rbx, qword [rbp + 0x2f]
mov r14, qword [rbp + 0xf]
mov rdi, qword [rbp - 9]
mov rbx, qword [rbx + 0x40]
cmp r14, 0x10
jb 0x140081fe7
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140081fdf
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140081fdf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140089e7c
movdqa xmm0, xmmword [0x1402d8a80]
movdqu xmmword [rbp + 7], xmm0
mov byte [rbp - 9], 0
mov r9, qword [rbp + 0x17]
mov r8, qword [r9]
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 0x17]
call fcn.140087550
mov edx, 0x48
mov rcx, qword [rbp + 0x17]
call fcn.140089e7c
mov rax, rbx
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140089e50
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140082050
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
push r15
lea rbp, [rsp - 0x3358]
mov eax, 0x3458
call fcn.140227720
sub rsp, rax
mov rax, qword [0x1402f7010]
xor rax, rsp
mov qword [rbp + 0x3340], rax
mov r15, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rbp + 0x2f40]
mov r8d, 0x400
call sub.VCRUNTIME140.dll_memset
lea rdx, [0x1402d7c14]
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
je 0x1400820bf
mov edx, 0x5c
mov rcx, rdi
call qword [sym.imp.VCRUNTIME140.dll_strrchr]
lea r8, [rax + 1]
jmp 0x1400820c2
mov r8, rdi
lea rcx, [rbp + 0x2f40]
dec rcx
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400820d0
xor edx, edx
nop dword [rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400820e0
lea rcx, [rbp + 0x2f40]
call fcn.1400814c0
mov rbx, rax
test rax, rax
jne 0x1400822ef
mov qword [rsp + 0x3490], rsi
mov dword [rsp + 0x20], 0x5950475c
mov dword [rsp + 0x24], 0x555c195a
mov word [rsp + 0x28], 0x56
mov byte [rsp + 0x2a], 1
nop dword [rax]
lea ecx, [rax + 0x32]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 9
jb 0x140082130
lea rcx, [rsp + 0x20]
mov byte [rsp + 0x2a], 0
call fcn.1400814c0
mov rsi, rax
test rax, rax
je 0x1400822e4
mov rcx, r15
mov qword [rsp + 0x3450], r14
call fcn.140087fc0
mov r14, rax
test rax, rax
je 0x1400822dc
mov rbx, 0xffffffffffffffff
add rsi, 0x1000
mov rcx, rbx
nop dword [rax + rax]
inc rcx
cmp byte [rdi + rcx], 0
jne 0x140082190
lea rax, [rsi + 1]
mov rdx, rsi
add rax, rcx
lea rcx, [rbp + 0xf30]
mov qword [rbp + 0x1f30], rax
call fcn.140088060
mov rdx, rax
lea rcx, [rsp + 0x30]
mov r8d, 0x1000
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x1000
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x1f40]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x1402f99e3], rax
mov qword [0x1402f99b8], r15
mov qword [0x1402f99c2], r14
mov qword [0x1402f99d9], rsi
cmp byte [rdi + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x140082203
lea r8d, [rbx + 1]
mov rdx, rdi
mov rcx, rsi
call fcn.140081350
mov rcx, qword [rbp + 0x1f30]
lea rdx, str.QRUVSWAPAQARASATAUAVAWH
mov r8d, WSAGetLastError
call fcn.140081350
mov ecx, 4
call fcn.14008a2a8
mov edx, 8
mov r9, rax
mov rcx, r15
lea r8d, [rdx - 4]
call fcn.1400812b0
mov r8d, 8
lea rdx, [rbp + 0x1f30]
mov rcx, r15
call fcn.140081350
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea edi, [rax + 0x1b58]
nop word [rax + rax]
lea rcx, [rbp + 0x2f40]
call fcn.1400814c0
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
ja 0x1400822a9
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
test rbx, rbx
je 0x140082280
mov ecx, 4
call fcn.14008a2a8
mov edx, 8
mov r9, rax
mov rcx, r15
lea r8d, [rdx - 6]
call fcn.1400812b0
mov r8d, 0x1000
lea rdx, [rbp + 0x1f40]
mov rcx, rsi
call fcn.140081350
mov r14, qword [rsp + 0x3450]
mov rsi, qword [rsp + 0x3490]
mov rax, rbx
mov rcx, qword [rbp + 0x3340]
xor rcx, rsp
call fcn.140089e50
add rsp, 0x3458
pop r15
pop rdi
pop rbx
pop rbp
ret
Function at 0x140082940
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
je 0x140082963
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1b
jb 0x140082950
mov byte [rcx + 0x1c], 0
mov rax, rcx
ret
Function at 0x140082fb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
je 0x140082fd3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x18
jb 0x140082fc0
mov byte [rcx + 0x19], 0
mov rax, rcx
ret

Function at 0x140082fe0
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov qword [r11 - 0x70], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x1402f7010]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, rdx
mov rdi, rcx
mov qword [r11 - 0x68], rcx
xor r15d, r15d
mov dword [r11 - 0x78], r15d
mov dword [r11 - 0x60], r15d
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], r15b
xor r8d, r8d
lea rdx, [0x1402d7c53]
call fcn.14007c4c0
mov dword [rsp + 0x30], 1
mov rsi, 0xffffffffffffffff
mov rbx, rsi
inc rbx
cmp byte [r14 + rbx], 0
jne 0x140083051
test ebx, ebx
je 0x1400831bf
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r9 + 1]
mov edx, ebx
mov rcx, r14
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x140083125
xor ecx, ecx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], rcx
mov edx, eax
lea rcx, [rsp + 0x50]
call fcn.140086f80
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov rbp, qword [rsp + 0x50]
mov r9, rbp
mov r8d, 1
mov edx, ebx
mov rcx, r14
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
nop dword [rax]
inc rsi
cmp byte [rsi + rbp], 0
jne 0x1400830d0
mov r8, rsi
mov rdx, rbp
mov rcx, rdi
call fcn.14007c4c0
nop
test rbp, rbp
je 0x140083125
mov rdx, qword [rsp + 0x60]
sub rdx, rbp
mov rax, rbp
cmp rdx, 0x1000
jb 0x14008311d
add rdx, 0x27
mov rbp, qword [rbp - 8]
sub rax, rbp
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14008311d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbp
call fcn.140089e7c
mov rcx, rdi
call fcn.1400871c0
cmp rax, 0xffffffffffffffff
je 0x1400831bf
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
mov r8d, 2
lea rdx, [0x1402d89e4]
lea rcx, [rsp + 0x50]
call fcn.14007c4c0
nop
mov rcx, rdi
call fcn.1400871c0
mov qword [rsp + 0x20], r15
mov r8, qword [rsp + 0x60]
mov rdx, rax
mov rcx, rdi
call fcn.140087370
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140083125
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140083120
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140083120
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, rdi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140089e50
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140083570
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1402f7010]
xor rax, rsp
mov qword [rsp + 0x68], rax
movdqa xmm0, xmmword [0x1402d8bc0]
xor eax, eax
movdqa xmm1, xmmword [str._________________a_t_v_t]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x40], 0x20202020
movdqu xmmword [rsp + 0x30], xmm1
mov word [rsp + 0x44], 0x100
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax + 0x37]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0x24
jb 0x1400835c0
movdqa xmm0, xmmword [0x1402d8a80]
lea rax, [rsp + 0x20]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x45], 0
mov r8, 0xffffffffffffffff
mov byte [rsp + 0x48], 0
inc r8
cmp byte [rax + r8], 0
jne 0x1400835f4
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.14007c4c0
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
movabs rax, 0x842108421084211
and r8d, 0x1f
mul r8
mov ecx, r8d
lea rax, [rsp + 0x48]
sub rcx, rdx
shr rcx, 1
add rcx, rdx
mov rdx, qword [rsp + 0x60]
shr rcx, 4
imul rcx, rcx, 0x1f
sub r8, rcx
mov rcx, qword [rsp + 0x48]
cmp rdx, 0x10
cmovae rax, rcx
movzx ebx, byte [rax + r8 + 1]
jb 0x14008368d
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140083688
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140083688
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140089e7c
movzx eax, bl
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140089e50
add rsp, 0x70
pop rbx
ret
Function at 0x140084a50
Capabilities:
Create thread
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x10]
sub rsp, 0x110
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x44405763
mov dword [rsp + 0x34], 0x8594154
mov dword [rsp + 0x38], 0x1000b09
call fcn.14007b1a0
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140084b9f
mov qword [rsp + 0x28], rax
lea r8, [0x14007e960]
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor edx, edx
mov qword [rsp + 0x120], rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
lea rcx, [0x14068a1b0]
call fcn.14007b500
movdqa xmm0, xmmword [0x1402d9050]
lea rcx, [rsp + 0x40]
movdqa xmm1, xmmword [0x1402d9040]
mov rbx, rax
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm0, xmmword [0x1402d8ba0]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm1, xmmword [0x1402d8e90]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x1402d9090]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm1, xmmword [0x1402d8f70]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [str.5Np]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm1, xmmword [0x1402d9020]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x1402d9080]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x1402d8b90]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x1402d8df0]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm1, xmmword [0x1402d8dd0]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x10], xmm1
mov dword [rbp], 0x1004226
call fcn.140084c30
mov r9d, reloc.WS2_32.dll_recv
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov rbx, qword [rsp + 0x120]
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x140084c0f
nop dword [rax + rax]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x44405763
mov dword [rsp + 0x34], 0x8594154
mov dword [rsp + 0x38], 0x1000b09
call fcn.14007b1a0
xor edx, edx
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_FindWindowA]
mov rcx, rax
lea rdx, [0x14068d200]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
jne 0x140084c08
cmp byte [reloc.WS2_32.dll_accept], al
jne 0x140084bb0
jmp 0x140084c0f
mov byte [reloc.WS2_32.dll_accept], 0
mov ecx, dword [0x14068d200]
call fcn.1400845f0
mov al, 1
add rsp, 0x110
pop rbp
ret

Function at 0x140084c30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc3], 0
je 0x140084c58
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc2
jb 0x140084c40
mov byte [rcx + 0xc3], 0
mov rax, rcx
ret
Function at 0x140086620
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4a], 0
je 0x140086643
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x49
jb 0x140086630
mov byte [rcx + 0x4a], 0
mov rax, rcx
ret

Function at 0x140086650
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6f], 0
je 0x140086673
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x6e
jb 0x140086660
mov byte [rcx + 0x6f], 0
mov rax, rcx
ret
Function at 0x140086d40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x7f], 0
je 0x140086d63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x7e
jb 0x140086d50
mov byte [rcx + 0x7f], 0
ret

Function at 0x140086d70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x140086d93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x140086d80
mov byte [rcx + 4], 0
ret

Function at 0x140086da0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x26], 0
je 0x140086dc3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x25
jb 0x140086db0
mov byte [rcx + 0x26], 0
ret

Function at 0x140086dd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x57], 0
je 0x140086df3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x56
jb 0x140086de0
mov byte [rcx + 0x57], 0
ret

Function at 0x140086e00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x52], 0
je 0x140086e23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x51
jb 0x140086e10
mov byte [rcx + 0x52], 0
ret

Function at 0x140086e30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1b], 0
je 0x140086e53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1a
jb 0x140086e40
mov byte [rcx + 0x1b], 0
ret

Function at 0x140086e60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x24], 0
je 0x140086e83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x23
jb 0x140086e70
mov byte [rcx + 0x24], 0
ret

Function at 0x140086e90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x140086eb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x17
jb 0x140086ea0
mov byte [rcx + 0x18], 0
ret

Function at 0x140086ec0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1d], 0
je 0x140086ee3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1c
jb 0x140086ed0
mov byte [rcx + 0x1d], 0
ret

Function at 0x140086ef0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x140086f13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x140086f00
mov byte [rcx + 3], 0
ret

Function at 0x140086fe0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x140087003
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 5
jb 0x140086ff0
mov byte [rcx + 6], 0
ret

Function at 0x140087010
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x140087033
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x140087020
mov byte [rcx + 0xc], 0
ret
Function at 0x140087040
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
je 0x140087063
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x13
jb 0x140087050
mov byte [rcx + 0x14], 0
ret

Function at 0x140087070
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1a], 0
je 0x140087093
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x19
jb 0x140087080
mov byte [rcx + 0x1a], 0
ret

Function at 0x1400870a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x1400870c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x1400870b0
mov byte [rcx + 0x12], 0
ret

Function at 0x1400870d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x1400870f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x1400870e0
mov byte [rcx + 0x10], 0
ret

Function at 0x140087100
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x140087123
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x140087110
mov byte [rcx + 8], 0
ret

Function at 0x140087130
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x140087153
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x140087140
mov byte [rcx + 0xe], 0
ret

Function at 0x140087160
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x140087183
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140087170
mov byte [rcx + 9], 0
ret

Function at 0x140087190
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x1400871b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x37]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x1400871a0
mov byte [rcx + 0x11], 0
ret

Function at 0x140087fc0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x78
mov rax, qword [0x1402f7010]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov eax, dword [0x14068d204]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x4c], 0
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x30], 0x64
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x48], 8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x14068d210]
lea r9, [rsp + 0x58]
mov r8d, reloc.WLDAP32.dll_Ordinal_41
mov dword [rsp + 0x4c], eax
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140089e50
add rsp, 0x78
ret
Function at 0x140088060
Capabilities:
Write file on windows

Disassembly:
push rbx
mov eax, 0x1070
call fcn.140227720
sub rsp, rax
mov rax, qword [0x1402f7010]
xor rax, rsp
mov qword [rsp + 0x1060], rax
mov eax, dword [0x14068d204]
mov rbx, rcx
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x4c], 0
mov dword [rsp + 0x54], 0
mov dword [rsp + 0x30], 0x64
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x48], 0x1000
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, qword [0x14068d210]
lea r9, [rsp + 0x58]
mov r8d, reloc.WLDAP32.dll_Ordinal_41
mov dword [rsp + 0x4c], eax
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov r8d, 0x1000
lea rdx, [rsp + 0x60]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, rbx
mov rcx, qword [rsp + 0x1060]
xor rcx, rsp
call fcn.140089e50
add rsp, 0x1070
pop rbx
ret

Function at 0x140088f80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140088fe1
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140088fa0
mov ecx, dword [r10]
jmp 0x1400890ca
cmp ecx, 0x4e0
jb 0x1400890ca
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140089000
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140089050
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140093990
Capabilities:
Set thread local storage value

Disassembly:
mov eax, Ordinal_41
call fcn.140227720
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret