joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff738e1bf10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x76], dl
je 0x7ff738e1bf46
mov ecx, edx
mov r8d, 0x5618
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x3a
jb 0x7ff738e1bf30
mov byte [r9 + 0x76], dl
lea rcx, [r9 + 0x74]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1bf6e
mov edx, 0x3a
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1bf80
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x68], dl
je 0x7ff738e1bfb6
mov ecx, edx
mov r8d, 0x5618
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x33
jb 0x7ff738e1bfa0
mov byte [r9 + 0x68], dl
lea rcx, [r9 + 0x66]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1bfde
mov edx, 0x33
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1bff0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x5e], dl
je 0x7ff738e1c026
mov ecx, edx
mov r8d, 0x5618
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x2e
jb 0x7ff738e1c010
mov byte [r9 + 0x5e], dl
lea rcx, [r9 + 0x5c]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1c04e
mov edx, 0x2e
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1c060
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x7c], dl
je 0x7ff738e1c096
mov ecx, edx
mov r8d, 0x5618
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x3d
jb 0x7ff738e1c080
mov byte [r9 + 0x7c], dl
lea rcx, [r9 + 0x7a]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1c0be
mov edx, 0x3d
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1c0d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0xaa], dl
je 0x7ff738e1c119
mov ecx, edx
mov r8d, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x54
jb 0x7ff738e1c100
mov byte [r9 + 0xaa], dl
lea rcx, [r9 + 0xa8]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1c144
mov edx, 0x54
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x7ff738e1c150
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x9e], dl
je 0x7ff738e1c199
mov ecx, edx
mov r8d, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x4e
jb 0x7ff738e1c180
mov byte [r9 + 0x9e], dl
lea rcx, [r9 + 0x9c]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1c1c4
mov edx, 0x4e
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1c1d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0xac], dl
je 0x7ff738e1c219
mov ecx, edx
mov r8d, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x55
jb 0x7ff738e1c200
mov byte [r9 + 0xac], dl
lea rcx, [r9 + 0xaa]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1c244
mov edx, 0x55
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1c250
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x90], dl
je 0x7ff738e1c299
mov ecx, edx
mov r8d, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x47
jb 0x7ff738e1c280
mov byte [r9 + 0x90], dl
lea rcx, [r9 + 0x8e]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1c2c4
mov edx, 0x47
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1c2d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x86], dl
je 0x7ff738e1c319
mov ecx, edx
mov r8d, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x42
jb 0x7ff738e1c300
mov byte [r9 + 0x86], dl
lea rcx, [r9 + 0x84]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1c344
mov edx, 0x42
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1c350
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x88], dl
je 0x7ff738e1c399
mov ecx, edx
mov r8d, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x43
jb 0x7ff738e1c380
mov byte [r9 + 0x88], dl
lea rcx, [r9 + 0x86]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1c3c4
mov edx, 0x43
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x7ff738e1c3d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0xb4], dl
je 0x7ff738e1c419
mov ecx, edx
mov r8d, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x59
jb 0x7ff738e1c400
mov byte [r9 + 0xb4], dl
lea rcx, [r9 + 0xb2]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1c444
mov edx, 0x59
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1c450
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0xb8], dl
je 0x7ff738e1c499
mov ecx, edx
mov r8d, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x5b
jb 0x7ff738e1c480
mov byte [r9 + 0xb8], dl
lea rcx, [r9 + 0xb6]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1c4c4
mov edx, 0x5b
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1c4d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0xb2], dl
je 0x7ff738e1c519
mov ecx, edx
mov r8d, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x58
jb 0x7ff738e1c500
mov byte [r9 + 0xb2], dl
lea rcx, [r9 + 0xb0]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1c544
mov edx, 0x58
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1c550
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x8a], dl
je 0x7ff738e1c599
mov ecx, edx
mov r8d, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x44
jb 0x7ff738e1c580
mov byte [r9 + 0x8a], dl
lea rcx, [r9 + 0x88]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1c5c4
mov edx, 0x44
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1c5d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x8e], dl
je 0x7ff738e1c619
mov ecx, edx
mov r8d, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x46
jb 0x7ff738e1c600
mov byte [r9 + 0x8e], dl
lea rcx, [r9 + 0x8c]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1c644
mov edx, 0x46
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x7ff738e1c650
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x48], dl
je 0x7ff738e1c686
mov ecx, edx
mov r8d, 0x5618
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x23
jb 0x7ff738e1c670
mov byte [r9 + 0x48], dl
lea rcx, [r9 + 0x46]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1c6ae
mov edx, 0x23
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1c6c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x32], dl
je 0x7ff738e1c6f6
mov ecx, edx
mov r8d, 0x5618
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x18
jb 0x7ff738e1c6e0
mov byte [r9 + 0x32], dl
lea rcx, [r9 + 0x30]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1c71e
mov edx, 0x18
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1c730
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x3e], dl
je 0x7ff738e1c766
mov ecx, edx
mov r8d, 0x5618
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x1e
jb 0x7ff738e1c750
mov byte [r9 + 0x3e], dl
lea rcx, [r9 + 0x3c]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1c78e
mov edx, 0x1e
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1c7a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x5a], dl
je 0x7ff738e1c7d6
mov ecx, edx
mov r8d, 0x5618
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x2c
jb 0x7ff738e1c7c0
mov byte [r9 + 0x5a], dl
lea rcx, [r9 + 0x58]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1c7fe
mov edx, 0x2c
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1c810
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x5c], dl
je 0x7ff738e1c846
mov ecx, edx
mov r8d, 0x5618
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x2d
jb 0x7ff738e1c830
mov byte [r9 + 0x5c], dl
lea rcx, [r9 + 0x5a]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1c86e
mov edx, 0x2d
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x7ff738e1c880
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x7a], dl
je 0x7ff738e1c8b6
mov ecx, edx
mov r8d, 0x5618
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x3c
jb 0x7ff738e1c8a0
mov byte [r9 + 0x7a], dl
lea rcx, [r9 + 0x78]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1c8de
mov edx, 0x3c
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1c8f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x82], dl
je 0x7ff738e1c939
mov ecx, edx
mov r8d, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x40
jb 0x7ff738e1c920
mov byte [r9 + 0x82], dl
lea rcx, [r9 + 0x80]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1c964
mov edx, 0x40
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1c970
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x84], dl
je 0x7ff738e1c9b9
mov ecx, edx
mov r8d, 0x5618
nop dword [rax]
nop word [rax + rax]
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x41
jb 0x7ff738e1c9a0
mov byte [r9 + 0x84], dl
lea rcx, [r9 + 0x82]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1c9e4
mov edx, 0x41
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1c9f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x1e], dl
je 0x7ff738e1ca26
mov ecx, edx
mov r8d, 0x5618
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0xe
jb 0x7ff738e1ca10
mov byte [r9 + 0x1e], dl
lea rcx, [r9 + 0x1c]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1ca4e
mov edx, 0xe
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1ca60
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x70], dl
je 0x7ff738e1ca96
mov ecx, edx
mov r8d, 0x5618
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x37
jb 0x7ff738e1ca80
mov byte [r9 + 0x70], dl
lea rcx, [r9 + 0x6e]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1cabe
mov edx, 0x37
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x7ff738e1cad0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rdx
mov r9, rcx
mov qword [rsp + 0x30], rdx
xor edx, edx
cmp byte [rcx + 0x6c], dl
je 0x7ff738e1cb06
mov ecx, edx
mov r8d, 0x5618
lea eax, [r8 + rcx]
xor word [r9 + rcx*2], ax
inc rcx
cmp rcx, 0x35
jb 0x7ff738e1caf0
mov byte [r9 + 0x6c], dl
lea rcx, [r9 + 0x6a]
mov qword [rbx], rdx
mov qword [rbx + 0x10], rdx
mov qword [rbx + 0x18], 7
mov word [rbx], dx
cmp r9, rcx
je 0x7ff738e1cb2e
mov edx, 0x35
mov rcx, rbx
call fcn.7ff738e1dd10
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x7ff738e1ce10
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x7ff738e30008]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x7ff738e1cee3
cmp byte [rcx + 0x71], 0
je 0x7ff738e1cee3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x7ff738e1cedf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.msvcp140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x7ff738e1cea4
sub eax, 1
je 0x7ff738e1cea8
cmp eax, 2
jne 0x7ff738e1cedf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.7ff738e21b30
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x7ff738e1ced6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.ucrtbase.dll_fwrite]
cmp rdi, rax
jne 0x7ff738e1cedf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x7ff738e1ce8c
xor al, al
jmp 0x7ff738e1ce8c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.7ff738e21b30
add rsp, 0x60
pop rbx
ret
Function at 0x7ff738e2275c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x7ff738e227a6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x7ff738e227a6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x7ff738e227a6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x7ff738e227a6
cmp dword [rcx + 0x84], 0xe
jbe 0x7ff738e227a6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x7ff738e227a8
xor al, al
add rsp, 0x28
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1400f2f40]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1400f2f50]
mov dword [rax], 1
mov rax, qword [0x1400f2f60]
mov dword [rax], 1
mov rax, qword [0x1400f2ef0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1400f2f30]
mov dword [0x14010700c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call sym.__p__fmode
mov rdx, qword [0x1400f3010]
mov edx, dword [rdx]
mov dword [rax], edx
call sym.__p__commode
mov rdx, qword [0x1400f2ff0]
mov edx, dword [rdx]
mov dword [rax], edx
call sym._setargv
mov rax, qword [0x1400f2ea0]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [sym._matherr]
call sym.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x140019780
Capabilities:
Encode data using xor
Encrypt data using aes

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x218
mov r15, rdx
mov rsi, rcx
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x100], xmm0
movdqa xmmword [rsp + 0xf0], xmm0
movdqa xmmword [rsp + 0xe0], xmm0
movdqa xmmword [rsp + 0xd0], xmm0
movdqa xmmword [rsp + 0xc0], xmm0
movdqa xmmword [rsp + 0xb0], xmm0
movdqa xmmword [rsp + 0xa0], xmm0
movdqa xmmword [rsp + 0x90], xmm0
movdqa xmmword [rsp + 0x80], xmm0
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x110], 0xa
movdqu xmm1, xmmword [rdx]
movdqa xmm2, xmm1
punpckhbw xmm2, xmm0
pshuflw xmm2, xmm2, 0x1b
pshufhw xmm2, xmm2, 0x1b
punpcklbw xmm1, xmm0
pshuflw xmm0, xmm1, 0x1b
pshufhw xmm0, xmm0, 0x1b
packuswb xmm0, xmm2
movdqa xmmword [rsp + 0x20], xmm0
movd edi, xmm0
xor ecx, ecx
lea rdx, [0x1400cb7c8]
lea r8, [0x1400cbbc8]
lea r9, [0x1400cbfc8]
lea r10, [0x1400cc3c8]
lea r11, [0x1400cc7c8]
nop word [rax + rax]
mov ebx, dword [rsp + rcx*4 + 0x2c]
mov r14d, ebx
shr r14d, 0xe
and r14d, 0x3fc
movzx ebp, byte [r14 + rdx + 3]
shl ebp, 0x18
movzx eax, bh
movzx eax, byte [r8 + rax*4 + 2]
shl eax, 0x10
xor eax, edi
xor eax, ebp
movzx edi, bl
movzx ebp, byte [r9 + rdi*4 + 1]
shl ebp, 8
mov edi, ebx
shr edi, 0x18
movzx edi, byte [r10 + rdi*4]
xor edi, ebp
xor edi, eax
xor edi, dword [rcx + r11]
mov dword [rsp + rcx*4 + 0x30], edi
mov eax, dword [rsp + rcx*4 + 0x24]
xor eax, edi
mov dword [rsp + rcx*4 + 0x34], eax
xor eax, dword [rsp + rcx*4 + 0x28]
mov dword [rsp + rcx*4 + 0x38], eax
xor eax, ebx
mov dword [rsp + rcx*4 + 0x3c], eax
add rcx, 4
cmp rcx, 0x28
jne 0x140019870
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x200], xmm0
movdqa xmmword [rsp + 0x1f0], xmm0
movdqa xmmword [rsp + 0x1e0], xmm0
movdqa xmmword [rsp + 0x1d0], xmm0
movdqa xmmword [rsp + 0x1c0], xmm0
movdqa xmmword [rsp + 0x1b0], xmm0
movdqa xmmword [rsp + 0x1a0], xmm0
movdqa xmmword [rsp + 0x190], xmm0
movdqa xmmword [rsp + 0x180], xmm0
movdqa xmmword [rsp + 0x170], xmm0
movdqa xmmword [rsp + 0x160], xmm0
movdqa xmmword [rsp + 0x150], xmm0
movdqa xmmword [rsp + 0x140], xmm0
movdqa xmmword [rsp + 0x130], xmm0
movdqa xmmword [rsp + 0x120], xmm0
mov byte [rsp + 0x210], 0
lea rdi, [rsp + 0x120]
mov edx, 0x10
mov rcx, r15
mov r8w, pe_nt_image_headers64
mov r9, rdi
call sym.libaes::aes_set_decrypt_key::h2a1025c61198c5cb
lea rdx, [rsp + 0x20]
mov r8d, 0xf4
mov rcx, rsi
call sym.memcpy
lea rcx, [rsi + 0xf4]
mov r8d, 0xf4
mov rdx, rdi
call sym.memcpy
mov byte [rsi + 0x1e8], 1
mov rax, rsi
add rsp, 0x218
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret