joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140028f20
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rbp, r8
mov rsi, rdx
mov edi, 1
test r9d, r9d
je 0x140028f5d
sub r9d, edi
je 0x140028f56
cmp r9d, edi
je 0x140028f52
xor ebx, ebx
jmp 0x140028f62
mov ebx, edi
jmp 0x140028f62
mov ebx, 3
jmp 0x140028f62
mov ebx, 4
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], 0
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x140028fc2
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140028fbe
mov r9, rsi
lea r8, str.WriteRegKey_RegCreateKeyEx_failed_for_pcPath___s.
mov edx, 8
call fcn.140025e80
xor eax, eax
jmp 0x140029021
mov eax, dword [rsp + 0x98]
mov r9d, ebx
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rbp
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140029014
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140029012
mov r9, rbp
lea r8, str.WriteRegKey_RegSetValueEx_failed_for_value___s.
mov edx, 8
call fcn.140025e80
xor edi, edi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x140029040
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x60
mov qword [r11 - 0x28], 0
lea rax, [r11 - 0x18]
mov qword [r11 - 0x30], rax
mov rbp, r9
mov qword [r11 - 0x38], 0
mov rdi, r8
mov dword [rsp + 0x28], 0x20006
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0
mov rsi, rdx
mov ebx, 1
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x1400290bc
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x1400290b8
mov r9, rsi
lea r8, str.WriteRegKey_RegCreateKeyEx_failed_for_pcPath___s.
lea edx, [rbx + 7]
call fcn.140025e80
xor eax, eax
jmp 0x140029113
mov eax, dword [rsp + 0x90]
mov r9d, ebx
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rdi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x140029106
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140029104
mov r9, rdi
lea r8, str.WriteRegKey_RegSetValueEx_failed_for_value___s.
mov edx, 8
call fcn.140025e80
xor ebx, ebx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret

Function at 0x140029210
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov edx, edx
mov rbx, rcx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx], rax
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x140029250
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140026290

Function at 0x140029350
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rax, vtable.InterfaceWin7.0
xor edi, edi
mov qword [rcx], rax
mov rbx, rcx
mov dword [rcx + 8], edi
mov qword [rcx + 0x10], rdi
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x1400293b5
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140029534
lea r8, str.InterfaceWin7::InterfaceWin7_LoadLibrary_for_user32.dll_failed
mov edx, 0x8000
call fcn.1400260c0
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rdx, [0x140087088]
mov qword [rbx + 0x18], rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x140029401
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140029534
lea r8, str.InterfaceWin7::InterfaceWin7_GetProcAddress_for_GetDisplayConfigBufferSizes_failed
mov edx, 0x8000
call fcn.1400260c0
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x10]
lea rdx, [0x140087108]
mov qword [rbx + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x20], rax
test rax, rax
jne 0x14002944e
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140029534
lea r8, str.InterfaceWin7::InterfaceWin7_GetProcAddress_for_QueryDisplayConfig_failed
mov edx, 0x8000
call fcn.1400260c0
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x10]
lea rdx, str.SetDisplayConfig
mov qword [rbx + 0x28], rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x28], rax
test rax, rax
jne 0x14002949b
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140029534
lea r8, str.InterfaceWin7::InterfaceWin7_GetProcAddress_for_SetDisplayConfig_failed
mov edx, 0x8000
call fcn.1400260c0
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1400871d8]
mov qword [rbx + 0x30], rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x1400294e4
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140029534
lea r8, str.InterfaceWin7::InterfaceWin7_GetProcAddress_for_DisplayConfigGetDeviceInfo_failed
mov edx, 0x8000
call fcn.1400260c0
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x10]
lea rdx, str.DisplayConfigSetDeviceInfo
mov qword [rbx + 0x38], rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx + 0x38], rax
test rax, rax
jne 0x14002952d
mov rcx, qword [0x1400a1fb0]
test rcx, rcx
je 0x140029534
lea r8, str.InterfaceWin7::InterfaceWin7_GetProcAddress_for_DisplayConfigSetDeviceInfo_failed
mov edx, 0x8000
call fcn.1400260c0
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov dword [rbx + 8], 1
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14002a500
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov r14d, edx
mov rsi, rcx
xor edi, edi
lea rdx, [rsp + 0x50]
lea rcx, str.HKPreferenceUseCCD
mov dword [rsp + 0x50], edi
mov ebp, r8d
mov ebx, r8d
call fcn.140028ac0
mov ecx, dword [rsp + 0x50]
test eax, eax
cmove ecx, edi
mov dword [rsp + 0x50], ecx
test ebx, ebx
je 0x14002a54f
lea eax, [rbx - 1]
inc edi
and ebx, eax
jne 0x14002a546
cmp ecx, 1
jne 0x14002a565
mov edx, ecx
lea rcx, str.DisplaySwitch
call qword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x14002a596
mov rcx, rsi
call fcn.14002a3b0
cmp eax, 2
ja 0x14002a588
cmp edi, 1
jbe 0x14002a588
cmp dword [rsp + 0x50], 2
jne 0x14002a588
mov rcx, rsi
call fcn.14002a1d0
jmp 0x14002a596
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.140029d90
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140059eec
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140059cd3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140059cd3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140059cd3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140059cd3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140059cd3
cmp dword [rcx + 0x84], 0xe
jbe 0x140059cd3
cmp dword [rcx + 0xf8], 0
je 0x140059cd3
mov ecx, ebx
call fcn.140059e04
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.140059a4c
cmp dword [rbp + 0x20], 0
je 0x140059d20
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140059d28
int3
xor r8d, r8d
xor edx, edx
jmp 0x140059c6c
Function at 0x1400af910
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov dword [rsp + 8], 0xffffffff
mov dword [rsp + 0xc], 0
jmp 0x1400af942
mov eax, dword [rsp + 0xc]
inc eax
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0x38]
cmp dword [rsp + 0xc], eax
jae 0x1400af9ea
mov eax, dword [rsp + 0xc]
mov rcx, qword [rsp]
movzx eax, byte [rcx + rax]
movzx ecx, byte [rsp + 8]
xor eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 8]
shr eax, 8
mov dword [rsp + 8], eax
mov dword [rsp + 0x14], 0
jmp 0x1400af986
mov eax, dword [rsp + 0x14]
inc eax
mov dword [rsp + 0x14], eax
cmp dword [rsp + 0x14], 8
jge 0x1400af9d5
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x1400af9a2
mov dword [rsp + 0x1c], 1
jmp 0x1400af9aa
mov dword [rsp + 0x1c], 0
movzx eax, byte [rsp + 0x1c]
mov byte [rsp + 0x18], al
mov eax, dword [rsp + 0x10]
shr eax, 1
mov dword [rsp + 0x10], eax
movzx eax, byte [rsp + 0x18]
test eax, eax
je 0x1400af9d3
mov eax, dword [rsp + 0x10]
xor eax, 0xedb88320
mov dword [rsp + 0x10], eax
jmp 0x1400af97c
mov eax, dword [rsp + 0x10]
mov ecx, dword [rsp + 8]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 8], eax
jmp 0x1400af938
mov eax, dword [rsp + 8]
not eax
add rsp, 0x28
ret
Function at 0x140026040
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x140026145
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
nop
push 0x17a9d7f3
mov qword [rsp], rsi
sub rsp, 0x20
xchg r9, rdi
mov qword [rsp + 0x30], r9
xchg rdi, r9
xchg rdx, rbp
mov rbx, rbp
xchg rdx, rbp
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
mov esi, r8d
sub rdi, rdx
xchg rbp, rcx
mov rcx, rbp
xchg rcx, rbp
neg rdi
add rdi, 0xffffffffffffff10
neg rdi
dec rsi
shr rsi, 3
shr rsi, 1
inc rsi
nop dword [rax]
xchg r10, rbx
movups xmm0, xmmword [r10]
xchg r10, rbx
xchg r15, rbp
mov rdx, r15
xchg r15, rbp
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.1400267d0
mov ecx, 0x79faed19
sub ecx, 0x785874a3
add ecx, 0x21036c27
xor ecx, 0x4d467ec5
xor ecx, 0x62c758dc
sub ecx, 0xd24c274
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1400260fb
neg rdi
sub rdi, 0xfffffffffffffff0
neg rdi
movups xmmword [rbp + 0xf0], xmm0
sub rsi, 1
jne 0x1400260aa
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
nop
xchg qword [rsp], rsi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140026150
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r12, rbp
mov qword [rsp + 0x10], r12
xchg r12, rbp
xchg rdx, rsi
mov qword [rsp + 0x18], rdx
xchg rdx, rsi
push rdi
sub rsp, 0x20
mov edi, r8d
xchg rbx, r15
mov r15, rdx
xchg r15, rbx
lea r9, [rcx + 0xf0]
xchg r8, rcx
mov rsi, r8
xchg r8, rcx
test r8d, r8d
je 0x140026223
dec rdi
shr rdi, 2
shr rdi, 1
shr rdi, 1
inc rdi
nop dword [rax]
nop word [rax + rax]
mov rax, rbx
sub r9, rbx
mov edx, 0x2ca5c4f4
sub edx, 0x28f610ca
add edx, 0x244b60f
add edx, 0x6a90ad5c
sub edx, 0x4d4f18f2
sub edx, 0x2335fe93
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400261e0
xchg rdx, rsi
mov rsi, rdx
xchg rdx, rsi
xchg rbx, rdx
mov rcx, rdx
xchg rdx, rbx
call fcn.1400262d0
xchg rbx, r9
mov rbx, r9
xchg r9, rbx
sub rbx, 0xfffffffffffffff0
sub rdi, 1
jne 0x1400261b2
xchg r9, r11
movups xmm0, xmmword [r11]
xchg r11, r9
xchg r15, rbx
mov r15, qword [rsp + 0x30]
xchg rbx, r15
xchg rsi, rbp
mov rsi, qword [rsp + 0x38]
xchg rbp, rsi
xchg rsi, r15
movups xmmword [r15 + 0xf0], xmm0
xchg r15, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400279c0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov qword [rsp + 8], rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x10
xchg rbx, rdx
mov rdx, rbx
xchg rbx, rdx
mov r10, rcx
test r8b, 0xf
je 0x140027a04
xor al, al
xchg rbx, r14
mov r14, qword [rsp + 0x20]
xchg r14, rbx
add rsp, 0x10
nop
mov rdi, qword [rsp]
add rsp, 8
ret
xor edx, edx
test r8d, r8d
je 0x140027ab5
movdqa xmm2, xmmword [rsp]
nop
xchg rdx, r15
movdqu xmm1, xmmword [r15 + rbx]
xchg rdx, r15
test edx, edx
jne 0x140027a37
xchg r10, rdi
movdqu xmm2, xmmword [rdi + 0x200]
xchg rdi, r10
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
pxor xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0x5927061b
sub ecx, 0x28e8cda6
sub ecx, 0x4ddd19f
xor ecx, 0x6ca58abf
sub ecx, 0x8dfd292
sub ecx, 0x20651b96
sub ecx, 0x1e80fe34
nop dword [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027a79
aesdeclast xmm0, xmmword [r10 + 0x1e0]
pxor xmm0, xmm2
movdqa xmm2, xmm1
xchg r12, rdx
movups xmmword [r12 + r9], xmm0
xchg rdx, r12
add edx, 0x10
cmp edx, r8d
jb 0x140027a15
xchg rbx, r14
mov r14, qword [rsp + 0x20]
xchg r14, rbx
mov al, 0x24
sub al, 0xf
add al, 0x4c
add al, 0xf
add al, 8
xor al, 0x1a
sub al, 0x55
add al, 0x4f
sub al, 0x5b
add rsp, 0x10
push rbx
xchg qword [rsp + 8], rdi
add rsp, 0x10
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14002cb10
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
xchg r11, rbx
mov qword [rsp + 0x10], r11
xchg rbx, r11
xchg rsi, r8
mov qword [rsp + 0x18], r8
xchg rsi, r8
xchg rdi, rsi
mov qword [rsp + 0x20], rsi
xchg rsi, rdi
push r14
sub rsp, 0x30
mov rsi, rcx
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x60]
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
xchg r10, rbx
mov qword [rsp + 0x40], r10
xchg r10, rbx
neg rcx
add rcx, 0xffffffffffffff38
neg rcx
xchg r13, rbx
mov qword [rsp + 0x28], r13
xchg rbx, r13
mov dword [rsp + 0x20], 0x3ad67843
xor dword [rsp + 0x20], 0x6404da6
xor dword [rsp + 0x20], 0x1275e58a
xor dword [rsp + 0x20], 0x1313fb56
xor dword [rsp + 0x20], 0x7f8795a1
add dword [rsp + 0x20], 0x1e419e91
sub dword [rsp + 0x20], 0x35bf8235
add dword [rsp + 0x20], 0xa129b3e
xor dword [rsp + 0x20], 0x350c763a
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b7c0
test eax, eax
js 0x14002cbe9
cmp qword [rsp + 0x40], rbx
je 0x14002cbe9
lea eax, [rbx + 1]
jmp 0x14002cd36
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0x70], 2
jbe 0x14002cc32
mov eax, 0x3a485dee
add eax, 0x157f2528
sub eax, 0x1dbcac25
sub eax, 0x1e5a3191
add eax, 0x41d12d79
sub eax, 0x47ad18b7
add eax, 0x6f710e82
sub eax, 0x4d771247
sub eax, 0x2fceb65b
jmp 0x14002cd36
cmp dword [rcx + 0x74], ebx
jbe 0x14002cc68
mov eax, 0x167ae1f3
xor eax, 0x1536559c
sub eax, 0x2c19d72
add eax, 0x74c03450
sub eax, 0x5485b23c
xor eax, 0x76d563
add eax, 0x361bfcaf
sub eax, 0x56cf491e
jmp 0x14002cd36
cmp byte [rdi + 2], bl
je 0x14002cca3
mov eax, 0x16544ae3
xor eax, 0x5625f37a
xor eax, 0x2c392c13
sub eax, 0x5ed02658
add eax, 0x5d2331c5
sub eax, 0x58c5ad4c
add eax, 0x583adbd4
sub eax, 0x696d2ca0
xor eax, 0xa3a2db
jmp 0x14002cd36
cmp r14d, 0xa
jb 0x14002ccef
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002ccef
mov eax, 0x68203053
sub eax, 0x2d6f5615
add eax, 0x3517c946
sub eax, 0x8a87d3b
xor eax, 0xa24309
sub eax, 0x26eab070
xor eax, 0x29af1fa8
sub eax, 0x6938ab70
jmp 0x14002cd36
lea rcx, [rsi + 0xb8]
mov edx, 0x6d511ba1
xor edx, 0x403b9b8b
sub edx, 0x11adc792
xor edx, 0x2642161b
add edx, 0x3ec21146
xor edx, 0x7f720fc
sub edx, 0x30b8e2a
add edx, 0x216d888e
call fcn.14002c0e0
jmp 0x14002cd34
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
push rdx
push rdx
push rbx
push rbx
xchg qword [rsp + 0x20], r14
pop rbx
pop rbx
pop rdx
pop rdx
add rsp, 8
ret
Function at 0x1400359d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbx
nop
sub rsp, 8
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
push 0x10c2ce71
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x30
mov r15, rdx
mov r14, rcx
movabs rsi, 0xfffffff58cc3568
sub rsi, 0xf6184b1
add rsi, 0xb71da66
add rsi, 0x170b36e
sub rsi, 0x1c837198
add rsi, 0x118dd78b
xor rsi, 0x42ce4b2f
add rsi, 0x7fffffff
add rsi, 0x766610af
cmp rdx, rsi
ja 0x140035c1c
mov r12, qword [rcx + 8]
sub r12, qword [rcx]
sar r12, 4
mov rcx, qword [rcx + 0x10]
sub rcx, qword [r14]
sar rcx, 4
xchg r11, rdx
mov r11, rcx
xchg r11, rdx
shr rdx, 1
mov rax, rsi
sub rax, rdx
cmp rcx, rax
ja 0x140035aa1
lea rsi, [rdx + rcx]
cmp rsi, r15
cmovb rsi, r15
xchg rsi, rcx
mov qword [rsp + 0x88], rcx
xchg rcx, rsi
xchg rsi, r15
mov rdx, r15
xchg rsi, r15
xchg rbp, rcx
mov rbp, r14
xchg rbp, rcx
call fcn.1400538b0
xchg rbx, r13
mov rbx, rax
xchg rbx, r13
mov qword [rsp + 0x28], rax
xchg r12, r11
mov rbx, r11
xchg r11, r12
shl rbx, 4
add rbx, rax
mov qword [rsp + 0x20], rbx
xchg r8, rdi
mov r8, r15
xchg rdi, r8
sub rdi, r12
mov qword [rsp + 0x78], rbx
je 0x140035b47
nop word [rax + rax]
mov byte [rbx], 0x28
sub byte [rbx], 0x21
add byte [rbx], 0x2f
xor byte [rbx], 0x44
xor byte [rbx], 0x38
xor byte [rbx], 0x24
xor byte [rbx], 0x41
sub byte [rbx], 0x2f
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004bc20
nop
sub rbx, 0xfffffffffffffff0
xchg rbx, r13
mov qword [rsp + 0x78], r13
xchg r13, rbx
sub rdi, 1
jne 0x140035b0a
xchg rbp, r8
mov rbp, qword [r14 + 8]
xchg r8, rbp
xchg r13, r8
mov rdx, r8
xchg r8, r13
mov rcx, qword [r14]
cmp rcx, r8
je 0x140035b99
xor r9d, r9d
movzx eax, byte [rcx]
mov byte [rdx], al
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov byte [rcx], r9b
mov qword [rcx + 8], r9
lea rdx, [rdx + 0x10]
nop
sub rcx, 0x46a2f71a
add rcx, 0x46a2f72a
cmp rcx, r8
jne 0x140035b69
xchg r9, r14
mov r14, rsi
xchg r9, r14
xchg r11, r15
mov r8, r11
xchg r15, r11
xchg rdx, r13
mov r13, rdx
xchg r13, rdx
xchg r14, r12
mov rcx, r12
xchg r12, r14
add rsp, 0x30
push rcx
push rdx
push rcx
push rcx
push rdx
push rax
push rcx
xchg qword [rsp + 0x38], r15
pop rcx
pop rax
pop rdx
pop rcx
pop rcx
pop rdx
pop rcx
add rsp, 8
push rcx
push rcx
push rax
push rax
push rbx
push rcx
xchg qword [rsp + 0x30], r14
add rsp, 0x38
nop
xchg qword [rsp], r13
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], r12
nop
mov rdi, qword [rsp]
add rsp, 8
push rcx
xchg qword [rsp + 8], rsi
add rsp, 0x10
nop
add rsp, 8
xchg qword [rsp - 8], rbx
jmp fcn.140052a50
call fcn.14002f980
int3
Function at 0x140035ca0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
test rdx, rdx
je 0x140035cf9
nop word [rax + rax]
mov byte [rbx], 0x6c
xor byte [rbx], 0x11
xor byte [rbx], 0x39
add byte [rbx], 0x2e
xor byte [rbx], 0x7e
add byte [rbx], 0x1c
xor byte [rbx], 0x28
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004bc20
nop
neg rbx
add rbx, 0xfffffffffffffff0
neg rbx
sub rdi, 1
jne 0x140035cc8
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
xchg rbx, r11
mov r11, qword [rsp + 0x30]
xchg r11, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14004c420
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x38
xor byte [rcx + rax + 6], 0x4c
sub byte [rcx + rax + 6], 0x33
xor byte [rcx + rax + 6], 0x72
add byte [rcx + rax + 6], 0x3c
xor byte [rcx + rax + 6], 0x11
sub byte [rcx + rax + 6], 0x1e
xor byte [rcx + rax + 6], 0x60
inc rax
cmp rax, 8
jb 0x14004c422
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14004c460
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x17
xor byte [rcx + rax + 6], 0x20
add byte [rcx + rax + 6], 0x2a
sub byte [rcx + rax + 6], 7
xor byte [rcx + rax + 6], 0x2c
xor byte [rcx + rax + 6], 0x23
sub byte [rcx + rax + 6], 0x55
inc rax
cmp rax, 0xa
jb 0x14004c462
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140071030
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
lea r10, [rsp + 0x3d]
mov r8d, edx
xchg r14, rbx
mov r14, rcx
xchg rbx, r14
test edx, edx
jns 0x1400710f3
neg r8d
nop dword [rax + rax]
dec r10
mov eax, 0x4cd37d9f
add eax, 0x1fa3fa75
xor eax, 0x710e4efd
add eax, 0x24ced11
xor eax, 0xde80fb9
xor eax, 0x6d4ee5d4
sub eax, 0x473cfdb4
add eax, 0x43fa5f31
add eax, 0x50aea1b9
mul r8d
shr edx, 1
shr edx, 1
shr edx, 1
movzx eax, dl
shl al, 1
shl al, 1
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
neg r8b
add r8b, 0xd0
neg r8b
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x14007105a
dec r10
mov byte [r10], 0x1a
xor byte [r10], 0x6f
xor byte [r10], 1
sub byte [r10], 0x1c
add byte [r10], 8
add byte [r10], 0x1a
xor byte [r10], 9
xor byte [r10], 0x53
xor byte [r10], 0xd
jmp 0x14007114c
dec r10
mov eax, 0x3e10f77f
sub eax, 0x397f6eb
add eax, 0x7184cdf
xor eax, 0x36f210de
sub eax, 0x6ca22143
xor eax, 0x79342aff
sub eax, 0x4396ac0b
add eax, 0x9c6e6243
mul r8d
shr edx, 1
shr edx, 1
shr edx, 1
movzx eax, dl
shl al, 1
shl al, 1
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
sub r8b, 8
add r8b, 0x38
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x1400710f3
lea r9, [rsp + 0x58]
mov rdx, r10
lea r8, [rsp + 0x3d]
mov rcx, rbx
call fcn.140030080
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
add rsp, 0x40
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret