joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140796058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1407961df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140796089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14079606f
add dl, dl
jne 0x140796096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407960f6
xor eax, eax
add dl, dl
jne 0x1407960a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1407961ad
add dl, dl
jne 0x1407960b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407960c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407960d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1407960dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1407960ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14079607e
mov eax, 1
add dl, dl
jne 0x140796106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140796113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1407960fb
sub eax, ebx
mov ebx, 1
jne 0x14079614c
mov ecx, 1
add dl, dl
jne 0x14079612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14079613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140796123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14079607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140796168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140796175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14079615d
cmp eax, 0x7d00
jae 0x14079619b
cmp eax, 0x500
jb 0x140796196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14079607e
cmp eax, 0x7f
ja 0x14079619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14079607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1407961d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14079607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001a90
Capabilities:
Register raw input devices

Disassembly:
push rbp
sub rsp, 0xf0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x68], 0xfffffffffffffffe
mov qword [rbp - 0x20], r8
mov rax, rdx
mov rdx, qword [rbp - 0x20]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x30], rcx
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rdx
mov rcx, rbp
call fcn.140002d50
mov rcx, qword [rbp - 0x28]
mov rdx, qword [rbp - 0x20]
call fcn.140003470
mov qword [rbp - 0x18], rdx
mov qword [rbp - 0x10], rax
jmp 0x140001ae6
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
mov qword [rbp + 0x18], rcx
mov qword [rbp + 0x20], rax
lea rcx, [rbp + 0x18]
call fcn.140001340
mov qword [rbp - 0x38], rax
jmp 0x140001b05
mov rax, qword [rbp - 0x38]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
cmp rax, 0
sete al
test al, 1
jne 0x140001b1e
jmp 0x140001b2c
mov rcx, rbp
call fcn.140002f10
mov qword [rbp - 0x40], rax
jmp 0x140001b66
mov rax, qword [rbp - 0x30]
mov rcx, qword [rbp + 0x28]
mov qword [rbp + 0x60], rcx
mov cx, word [rcx]
mov word [rbp + 0x46], cx
mov cx, word [rbp + 0x46]
mov word [rbp + 0x30], 1
mov word [rbp + 0x32], cx
mov dword [rbp + 0x34], 0x130
mov qword [rbp + 0x38], rax
mov rcx, rbp
lea rdx, [rbp + 0x30]
call fcn.140002e20
jmp 0x140001bd3
mov rcx, rbp
call fcn.140002e10
mov qword [rbp - 0x48], rax
jmp 0x140001b74
mov rcx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x48]
mov edx, eax
mov rax, qword [sym.imp.USER32.dll_RegisterRawInputDevices]
mov r8d, 0x10
call rax
mov dword [rbp - 0x4c], eax
jmp 0x140001b92
mov eax, dword [rbp - 0x4c]
cmp eax, 0
jne 0x140001ba7
call fcn.1400034f0
mov dword [rbp - 0x54], edx
mov dword [rbp - 0x50], eax
jmp 0x140001bb0
mov dword [rbp - 8], 0
jmp 0x140001bbc
mov eax, dword [rbp - 0x54]
mov ecx, dword [rbp - 0x50]
mov dword [rbp - 8], ecx
mov dword [rbp - 4], eax
mov rcx, rbp
call fcn.1400031f0
mov eax, dword [rbp - 8]
mov edx, dword [rbp - 4]
add rsp, 0xf0
pop rbp
ret
jmp 0x140001af6

Function at 0x140004500
Capabilities:
Log keystrokes

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
mov cx, word [rcx + 6]
call fcn.140001240
mov ecx, eax
mov edx, 2
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ecx, eax
call fcn.1400033f0
mov ecx, eax
lea rdx, str.srcwindowsmod.rs
call fcn.140004920
nop
add rsp, 0x28
ret
Function at 0x140007eb0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x140007f40
jmp 0x140007f2f
jae 0x140008000
cmp r8, 0x201
jae 0x140007f40
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140007f98
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x140007f6f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.14001f460
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140007fc1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140008068
mov r8d, r14d
cmp r15, r8
jne 0x140007f20
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000808b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x140007f2f
jmp 0x140007f40
cmp rsi, r8
jb 0x1400080a5
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.14000a850
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x140008051
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.1400054d0
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x140008039
jmp 0x140008051
lea rcx, str.internal_error:_entered_unreachable_code_rustc_79e9716c980570bfd1f666e3b16ac583f0168962library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.1400200a0
jmp 0x1400080ba
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.140020630
ud2
Function at 0x14000f770
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x140023460]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x14000f7b4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000f81a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x14000f851
test eax, eax
js 0x14000f82b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x14000f844
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov byte [rsp + 0x5c], 0
mov dword [rsp + 0x58], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.14000a390
mov rcx, rax
call fcn.140005f60
mov ecx, 7
int 0x29
ud2
Function at 0x14001d090
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14001d10a
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14001d100
cmp r11, r10
ja 0x14001d1a3
cmp r10, rdx
ja 0x14001d1b7
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x14001d102
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14001d0e0
jmp 0x14001d177
ja 0x14001d10a
mov r11, r10
cmp rax, r8
jne 0x14001d0b2
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14001d17b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14001d150
mov r8, r10
sub ecx, r9d
jns 0x14001d16e
jmp 0x14001d17d
cmp r10, rdx
je 0x14001d189
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14001d17d
xor al, 1
cmp r8, rdx
jne 0x14001d130
jmp 0x14001d17d
xor eax, eax
jmp 0x14001d17d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.1400200a0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.1400206b0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140020630
ud2

Function at 0x14001eec8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001ef12
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001ef12
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001ef12
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001ef12
cmp dword [rcx + 0x84], 0xe
jbe 0x14001ef12
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001ef14
xor al, al
add rsp, 0x28
ret
Function at 0x140003530
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Owners_tetravelstore_tphpbb_treportabuse_tdeedee_ttarifas_triver_tregistration_tcommonpages_tical_texec_treceitas_tjscommon_tsgs_tcontrols_twatched_tmailchimp_tguest_tadlogger_ttoledo_talicia_ttable_tdating_tenterchatca_tdoctors_tktml_tpanoramas_tunapprove_tuy_tbakup_torderby_tadverteren_tanli_tenUS_tftp_tmana_tautoban_tfullsearch_tgallery_timode_tultra_tbbpress_tpixels_timprensa_tmyimages_tprocess_teventimages_tcowboys_tadjs_tzp_tservices_tpostforumthread_taupa
mov r10, rax
sub rbx, rax
movabs rdi, 0x3bd60d923295482d
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
mov rax, rcx
lea r9, [r9 + 0xa]
sub rax, rdx
add r11d, 0xa
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19f
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xa
jb 0x140003580
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004cc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Owners_tetravelstore_tphpbb_treportabuse_tdeedee_ttarifas_triver_tregistration_tcommonpages_tical_texec_treceitas_tjscommon_tsgs_tcontrols_twatched_tmailchimp_tguest_tadlogger_ttoledo_talicia_ttable_tdating_tenterchatca_tdoctors_tktml_tpanoramas_tunapprove_tuy_tbakup_torderby_tadverteren_tanli_tenUS_tftp_tmana_tautoban_tfullsearch_tgallery_timode_tultra_tbbpress_tpixels_timprensa_tmyimages_tprocess_teventimages_tcowboys_tadjs_tzp_tservices_tpostforumthread_taupa
mov r10, rax
sub rbx, rax
movabs rdi, 0x3bd60d923295482d
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 6]
mov rax, rdi
mov rcx, r8
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 7]
mov byte [r9 - 7], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 6]
mov byte [r9 - 6], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19f
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
add r11d, 6
cmp r11d, 6
jb 0x140004d10
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140005ca0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Owners_tetravelstore_tphpbb_treportabuse_tdeedee_ttarifas_triver_tregistration_tcommonpages_tical_texec_treceitas_tjscommon_tsgs_tcontrols_twatched_tmailchimp_tguest_tadlogger_ttoledo_talicia_ttable_tdating_tenterchatca_tdoctors_tktml_tpanoramas_tunapprove_tuy_tbakup_torderby_tadverteren_tanli_tenUS_tftp_tmana_tautoban_tfullsearch_tgallery_timode_tultra_tbbpress_tpixels_timprensa_tmyimages_tprocess_teventimages_tcowboys_tadjs_tzp_tservices_tpostforumthread_taupa
mov r10, rax
sub rbx, rax
movabs rdi, 0x3bd60d923295482d
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x19f
sub rcx, rax
movzx eax, byte [rcx + rsi]
add r11d, 6
xor al, byte [rbx + r9 + 8]
lea r9, [r9 + 0xc]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 6
jb 0x140005cf0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140009f40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400161c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x1f001c
mov dword [rbp - 0x1c], 0x9000b
mov dword [rbp - 0x18], 0x40001e
mov dword [rbp - 0x14], 0x4b003b
mov dword [rbp - 0x10], 0x1e0010
mov dword [rbp - 0xc], 0x76000d
call fcn.140002e40
mov rcx, rax
call rbx
mov rbx, qword [0x1400161c0]
lea rcx, [rbp - 0x20]
mov qword [0x1400161a0], rax
mov dword [rbp - 0x20], 0x1e0018
mov dword [rbp - 0x1c], 0xc0000
mov dword [rbp - 0x18], 0x16001c
mov dword [rbp - 0x14], 0x4b007d
mov dword [rbp - 0x10], 0x1e0010
mov dword [rbp - 0xc], 0x76000d
call fcn.140002e40
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x140015590]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400161b0], rax
mov word [rbp - 0x10], 0x2519
mov byte [rbp - 0xe], 0x65
call fcn.140005220
mov rcx, qword [0x1400161a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140016130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x90b1f1c
mov dword [rbp - 0x1c], 0x71361e
mov dword [rbp - 0x18], 0x13150717
mov word [rbp - 0x14], 0x6c32
call fcn.140001180
mov rcx, qword [0x1400161a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140016130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x1a1906
mov dword [rbp - 0x1c], 0x116c1d00
mov dword [rbp - 0x18], 0x1804023b
mov word [rbp - 0x14], 0x6c24
call fcn.140001180
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140015650]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160e8], rax
mov byte [rbp - 0x10], 0x6f
call fcn.140004e60
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400155d0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160f0], rax
mov dword [rbp - 0x10], 0x9001e0b
call fcn.1400029f0
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140015570]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160e0], rax
mov byte [rbp - 0x10], 0x6f
call fcn.140004e60
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140015500]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400160d8], rax
mov dword [rbp - 0x10], 0x480b1d06
mov byte [rbp - 0xc], 0x70
call fcn.140003790
mov rcx, qword [0x1400161b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400155f0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140016130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x3301
mov byte [rbp - 0xe], 0x65
call fcn.140005220
mov rcx, qword [0x1400161b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp rax
Function at 0x14000a1c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x61
mov dword [rbp - 0x20], 0x320004
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x2b003c
mov dword [rbp - 0x18], 0x3f0037
mov dword [rbp - 0x14], 0x24004b
mov dword [rbp - 0x10], 0x370027
call fcn.140005e60
mov rcx, rax
call 0x14000ac50
mov qword [0x1400161b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x74
mov dword [rbp - 0x20], 0x320004
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x2b003c
mov dword [rbp - 0x18], 0x3f0037
mov dword [rbp - 0x14], 0x57003a
call fcn.140002590
mov rcx, rax
call 0x14000ac50
lea rcx, [rbp - 0x20]
mov qword [0x1400161a8], rax
mov dword [rbp - 0x20], 0x30021
mov dword [rbp - 0x1c], 0x9000a
mov dword [rbp - 0x18], 0x73001e
call fcn.140005ca0
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x14000ac50
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000acb2
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000a800
test al, al
jne 0x14000acc4
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000ac80
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret