joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002b908
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x30]
xor r11d, r11d
mov rsi, r9
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov r10, qword [rax + 0x60]
mov rax, qword [r10 + 0x18]
mov rbx, qword [rax + 0x10]
cmp qword [rbx + 0x30], r11
je 0x14002b979
test r11, r11
jne 0x14002b99a
mov rdx, qword [rbx + 0x30]
cmp rdx, rbp
je 0x14002b96a
xor r9d, r9d
mov r8, rsi
mov rcx, rdi
call fcn.14002da9c
mov r11, rax
mov rbx, qword [rbx]
cmp qword [rbx + 0x30], 0
jne 0x14002b94b
test r11, r11
jne 0x14002b99a
mov rdx, r14
mov rcx, rdi
call fcn.14002d9b4
test rax, rax
je 0x14002b997
mov rdx, rsi
mov rcx, rax
call qword [rdi + 0x38]
mov r11, rax
jmp 0x14002b99a
xor r11d, r11d
mov rbx, qword [rsp + 0x30]
mov rax, r11
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14002d9b4
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
or r10d, 0xffffffff
xor r8d, r8d
mov rsi, rcx
cmp byte [rdx], r8b
je 0x14002d9eb
cmp r8d, 0x40
jae 0x14002d9eb
mov al, byte [r8 + rdx]
mov byte [rsp + r8 + 0x20], al
inc r8d
cmp byte [r8 + rdx], 0
jne 0x14002d9d2
lea eax, [r8 - 4]
mov byte [rsp + r8 + 0x20], 0
cmp byte [rsp + rax + 0x20], 0x2e
je 0x14002da26
mov byte [rsp + r8 + 0x20], 0x2e
inc r8d
mov byte [rsp + r8 + 0x20], 0x64
inc r8d
mov byte [rsp + r8 + 0x20], 0x6c
inc r8d
lea eax, [r8 + 1]
mov byte [rsp + r8 + 0x20], 0x6c
mov byte [rsp + rax + 0x20], 0
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov rax, qword [rcx + 0x18]
mov rdi, qword [rax + 0x10]
mov rbx, qword [rdi + 0x30]
test rbx, rbx
je 0x14002da7d
movsxd rax, dword [rbx + 0x3c]
mov ecx, dword [rax + rbx + 0x88]
xor eax, eax
test ecx, ecx
je 0x14002da70
mov edx, dword [rcx + rbx + 0xc]
lea rcx, [rsp + 0x20]
add rdx, rbx
call fcn.14002e220
mov r10d, eax
xor eax, eax
test r10d, r10d
je 0x14002da95
mov rdi, qword [rdi]
test r10d, r10d
jne 0x14002da3b
test rax, rax
jne 0x14002da85
lea rcx, [rsp + 0x20]
call qword [rsi + 0x30]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov rax, rbx
jmp 0x14002da85
Function at 0x14002da9c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
xor r11d, r11d
mov rdi, rdx
mov r10, rcx
mov ebx, r11d
test rdx, rdx
je 0x14002dc24
movsxd r15, dword [rdx + 0x3c]
mov eax, dword [r15 + rdx + 0x88]
test eax, eax
je 0x14002dc24
lea rsi, [rdx + rax]
mov r14d, dword [rsi + 0x1c]
mov r13d, dword [rsi + 0x20]
add r14, rdx
mov r12d, dword [rsi + 0x24]
add r13, rdx
add r12, rdx
test r8, r8
je 0x14002dc14
mov ebp, dword [rsi + 0x18]
test ebp, ebp
je 0x14002dc24
lea eax, [rbp - 1]
mov rdx, r8
mov ecx, dword [r13 + rax*4]
mov ebp, eax
add rcx, rdi
mov qword [rsp + 0xe8], rax
call fcn.14002e200
xor r11d, r11d
test eax, eax
jne 0x14002db4b
mov rax, qword [rsp + 0xe8]
movzx eax, word [r12 + rax*2]
mov ebx, dword [r14 + rax*4]
add rbx, rdi
test ebp, ebp
je 0x14002db5c
mov r8, qword [rsp + 0xf0]
test rbx, rbx
je 0x14002db13
mov r10, qword [rsp + 0xe0]
cmp rbx, rsi
jb 0x14002dc0f
mov eax, dword [r15 + rdi + 0x8c]
add rax, rsi
cmp rbx, rax
jae 0x14002dc0f
mov r8d, r11d
cmp byte [rbx], r11b
je 0x14002dba7
cmp r8d, 0x3c
jae 0x14002dba7
mov eax, r8d
mov cl, byte [rax + rbx]
mov byte [rsp + rax + 0x20], cl
cmp cl, 0x2e
je 0x14002dba7
inc r8d
cmp byte [r8 + rbx], r11b
jne 0x14002db89
lea eax, [r8 + 1]
mov edx, eax
mov byte [rsp + rax + 0x20], 0x64
lea eax, [r8 + 2]
mov byte [rsp + rax + 0x20], 0x6c
lea eax, [r8 + 3]
mov byte [rsp + rax + 0x20], 0x6c
lea eax, [r8 + 4]
lea r8, [rdx + rbx]
mov byte [rsp + rax + 0x20], r11b
mov edx, r11d
cmp byte [r8], r11b
je 0x14002dbf0
cmp edx, 0x3f
jae 0x14002dbf0
mov ecx, edx
inc edx
mov al, byte [rcx + r8]
mov byte [rsp + rcx + 0x60], al
cmp byte [rdx + r8], r11b
jne 0x14002dbd9
mov eax, edx
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x20]
mov rdx, rdi
mov rcx, r10
mov byte [rsp + rax + 0x60], r11b
call fcn.14002b908
mov rbx, rax
mov rax, rbx
jmp 0x14002dc26
sub r9d, dword [rsi + 0x10]
mov ebx, dword [r14 + r9*4]
add rbx, rdi
jmp 0x14002db64
xor eax, eax
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x14002dd84
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x10
movups xmm0, xmmword [rcx]
mov qword [rsp + 0x28], rdx
mov ecx, edx
mov r8d, dword [rsp + 0x2c]
xor r10d, r10d
movups xmmword [rsp], xmm0
mov edx, dword [rsp + 0xc]
mov r11d, dword [rsp + 8]
mov ebx, dword [rsp + 4]
mov r9d, dword [rsp]
mov eax, edx
ror ecx, 8
add ecx, r8d
mov edx, ebx
xor ecx, r9d
ror edx, 8
add edx, r9d
rol r8d, 3
xor edx, r10d
rol r9d, 3
xor r9d, edx
xor r8d, ecx
inc r10d
mov ebx, r11d
mov r11d, eax
cmp r10d, 0x1b
jb 0x14002ddb1
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x2c], r8d
mov rax, qword [rsp + 0x28]
add rsp, 0x10
pop rbx
ret
Function at 0x14002ddf8
Capabilities:
Encode data using xor
Encrypt data using chaskey

Disassembly:
test r9d, r9d
je 0x14002df46
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r14
mov rbp, rsp
sub rsp, 0x10
mov r11, rcx
lea rax, [rbp - 0x10]
sub r11, rax
lea r14, [rdx + 0xf]
mov rdi, r8
mov r12d, 0x10
lea rax, [rbp - 0x10]
cmp rax, r14
ja 0x14002de4f
lea rax, [rbp - 1]
cmp rax, rdx
jb 0x14002de4f
movups xmm0, xmmword [rdx]
movdqu xmmword [rbp - 0x10], xmm0
jmp 0x14002de57
movups xmm0, xmmword [rdx]
movdqu xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x10]
mov r8d, 4
mov eax, dword [r11 + rcx]
xor dword [rcx], eax
lea rcx, [rcx + 4]
sub r8, 1
jne 0x14002de61
mov r8d, dword [rbp - 4]
mov rbx, r12
mov eax, dword [rbp - 8]
mov r10d, dword [rbp - 0xc]
mov ecx, dword [rbp - 0x10]
add ecx, r10d
add eax, r8d
rol r10d, 5
xor r10d, ecx
rol r8d, 8
xor r8d, eax
rol ecx, 0x10
add eax, r10d
add ecx, r8d
rol r10d, 7
rol r8d, 0xd
xor r10d, eax
xor r8d, ecx
rol eax, 0x10
sub rbx, 1
jne 0x14002de82
mov dword [rbp - 4], r8d
lea r8d, [rbx + 4]
mov dword [rbp - 0x10], ecx
lea rcx, [rbp - 0x10]
mov dword [rbp - 0xc], r10d
mov dword [rbp - 8], eax
mov eax, dword [rcx + r11]
xor dword [rcx], eax
lea rcx, [rcx + 4]
sub r8, 1
jne 0x14002decc
cmp r9d, r12d
mov ecx, r9d
cmova ecx, r12d
mov r10d, ecx
test ecx, ecx
je 0x14002df0a
lea rbx, [rbp - 0x10]
mov r8, rdi
sub rbx, rdi
mov esi, r10d
mov al, byte [rbx + r8]
xor byte [r8], al
inc r8
sub rsi, 1
jne 0x14002defa
sub r9d, ecx
mov r8d, r12d
add rdi, r10
lea eax, [r8 - 1]
add byte [rax + rdx], 1
jne 0x14002df25
dec r8d
test r8d, r8d
jg 0x14002df13
test r9d, r9d
jne 0x14002de33
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x10
pop r14
pop r12
pop rbp
ret
Function at 0x140030bd5
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
mov eax, dword [rsp + 0x18]
mov edx, dword [rsp + 0x1c]
push rbx
push rbp
push rsi
mov esi, dword [rsp + 0x20]
xor ebx, ebx
push rdi
lea edi, [rsp + 0x10]
movsd dword [rdi], dword [rsi]
movsd dword [rdi], dword [rsi]
movsd dword [rdi], dword [rsi]
movsd dword [rdi], dword [rsi]
mov ecx, dword [rsp + 0x14]
mov esi, dword [rsp + 0x1c]
mov ebp, dword [rsp + 0x18]
mov edi, dword [rsp + 0x10]
mov dword [rsp + 0x28], ecx
mov ecx, esi
ror eax, 8
mov esi, dword [rsp + 0x28]
add eax, edx
ror esi, 8
xor eax, edi
add esi, edi
rol edx, 3
xor esi, ebx
rol edi, 3
xor edx, eax
mov dword [rsp + 0x28], ebp
xor edi, esi
mov ebp, ecx
cmp r11d, 0x1b
jb 0x140030c06
pop rdi
pop rsi
pop rbp
pop rbx
add esp, 0x10
ret

Function at 0x140030c38
Capabilities:
Encode data using xor
Encrypt data using chaskey

Disassembly:
mov edx, dword [rsp + 0x10]
sub esp, 0x14
push rbx
mov ebx, dword [rsp + 0x20]
push rbp
mov ebp, dword [rsp + 0x28]
test edx, edx
je 0x140030d3d
xor eax, eax
lea ecx, [rbx + 0xf]
mov dword [rsp + 0x2c], ecx
sub eax, ebx
push rsi
mov dword [rsp + 0xc], eax
push rdi
lea eax, [rsp + 0x14]
cmp eax, ecx
ja 0x140030c6f
lea eax, [rsp + 0x23]
mov esi, ebx
lea edi, [rsp + 0x14]
xor ecx, ecx
movsd dword [rdi], dword [rsi]
movsd dword [rdi], dword [rsi]
movsd dword [rdi], dword [rsi]
movsd dword [rdi], dword [rsi]
mov esi, dword [rsp + 0x28]
mov eax, dword [rsi + rcx*4]
xor dword [rsp + rcx*4 + 0x14], eax
cmp r9d, 4
jb 0x140030c7f
mov esi, dword [rsp + 0x20]
mov eax, dword [rsp + 0x1c]
mov edi, dword [rsp + 0x18]
mov ecx, dword [rsp + 0x14]
mov dword [rsp + 0x30], 0x10
add ecx, edi
add eax, esi
rol edi, 5
xor edi, ecx
rol esi, 8
xor esi, eax
rol ecx, 0x10
add eax, edi
add ecx, esi
rol edi, 7
rol esi, 0xd
xor edi, eax
xor esi, ecx
rol eax, 0x10
sub dword [rsp + 0x30], 1
jne 0x140030ca4
mov ebx, dword [rsp + 0x28]
mov dword [rsp + 0x14], ecx
xor ecx, ecx
mov dword [rsp + 0x20], esi
mov dword [rsp + 0x18], edi
mov dword [rsp + 0x1c], eax
mov eax, dword [rbx + rcx*4]
xor dword [rsp + rcx*4 + 0x14], eax
cmp r9d, 4
jb 0x140030ce3
push 0x10
pop rsi
cmp edx, esi
mov ecx, edx
cmova ecx, esi
test ecx, ecx
je 0x140030d13
lea edi, [rsp + 0x14]
mov esi, ebp
sub edi, ebp
mov ebx, ecx
mov al, byte [rdi + rsi]
xor byte [rsi], al
sub ebx, 1
jne 0x140030d08
mov ebx, dword [rsp + 0x10]
sub edx, ecx
add ebp, ecx
mov ecx, dword [rsp + 0x34]
add byte [rcx], 1
jne 0x140030d2c
lea rax, [r11 + rcx]
test eax, eax
jg 0x140030d1f
mov ebx, dword [rsp + 0x2c]
lea ecx, [rbx + 0xf]
test edx, edx
jne 0x140030c63
pop rdi
pop rsi
pop rbp
pop rbx
add esp, 0x14
ret
Function at 0x140070030
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov r9d, edx
cmp edx, 8
jb 0x140070066
mov edx, r9d
shr rdx, 3
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rcx + 4]
add r9d, 0xfffffff8
xor eax, dword [rcx]
add rcx, 8
xor r8d, eax
sub rdx, 1
jne 0x140070050
cmp r9d, 4
jb 0x140070073
xor r8d, dword [rcx]
add rcx, 4
and r9d, 3
cmp r9d, 2
jbe 0x140070089
movzx eax, byte [rcx]
shl eax, 0x10
xor r8d, eax
inc rcx
cmp r9d, 1
jbe 0x14007009b
movzx edx, byte [rcx]
shl edx, 8
xor r8d, edx
inc rcx
test r9d, r9d
je 0x1400700a7
movzx eax, byte [rcx]
xor eax, r8d
ret
mov eax, r8d
ret
Function at 0x140070280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x88], rbx
mov r15, rdx
mov r12, rcx
xor r13d, r13d
mov qword [rcx], r13
mov qword [rcx + 8], r13
mov edi, dword [rdx + 8]
lea r14, [r13 - 1]
test edi, edi
je 0x1400702f6
mov eax, 8
mul rdi
cmovo rax, r14
mov rcx, rax
call fcn.1400c79c4
mov qword [r12], rax
mov dword [r12 + 8], edi
mov dword [r12 + 0xc], edi
lea r8, [rdi*8]
mov rdx, qword [r15]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
lea rsi, [r12 + 0x10]
mov qword [rsp + 0x78], rsi
mov qword [rsi], r13
mov qword [rsi + 8], r13
mov ebx, dword [r15 + 0x18]
mov ebp, ebx
test ebx, ebx
je 0x1400703a7
mov eax, 8
mul rbx
cmovo rax, r14
mov rcx, rax
call fcn.1400c79c4
mov qword [rsi], rax
mov dword [rsi + 0xc], ebx
test ebx, ebx
je 0x1400703a7
mov r14, r13
mov ecx, 0x28
call fcn.1400c7980
mov rbx, rax
mov qword [rsp + 0x80], rax
test rax, rax
je 0x14007038d
mov rax, qword [r15 + 0x10]
mov rdi, qword [r14 + rax]
mov rdx, rdi
mov rcx, rbx
call fcn.140003c90
mov eax, dword [rdi + 0x10]
mov dword [rbx + 0x10], eax
mov eax, dword [rdi + 0x14]
mov dword [rbx + 0x14], eax
mov eax, dword [rdi + 0x18]
mov dword [rbx + 0x18], eax
mov eax, dword [rdi + 0x1c]
mov dword [rbx + 0x1c], eax
movzx eax, word [rdi + 0x20]
mov word [rbx + 0x20], ax
movzx eax, word [rdi + 0x22]
mov word [rbx + 0x22], ax
jmp 0x140070390
mov rbx, r13
mov ecx, dword [rsi + 8]
mov rax, qword [rsi]
mov qword [rax + rcx*8], rbx
inc dword [rsi + 8]
add r14, 8
sub rbp, 1
jne 0x140070336
mov rax, qword [r15 + 0x20]
mov qword [r12 + 0x20], rax
lea rsi, [r12 + 0x28]
mov qword [rsp + 0x78], rsi
movzx eax, byte [r15 + 0x28]
mov byte [rsi], al
movzx eax, byte [r15 + 0x29]
mov byte [rsi + 1], al
mov eax, dword [r15 + 0x2c]
mov dword [rsi + 4], eax
mov eax, dword [r15 + 0x30]
mov dword [rsi + 8], eax
mov eax, dword [r15 + 0x34]
mov dword [rsi + 0xc], eax
mov eax, dword [r15 + 0x38]
mov dword [rsi + 0x10], eax
mov eax, dword [r15 + 0x3c]
mov dword [rsi + 0x14], eax
movzx eax, word [r15 + 0x40]
mov word [rsi + 0x18], ax
movzx eax, byte [r15 + 0x42]
mov byte [rsi + 0x1a], al
movzx eax, byte [r15 + 0x43]
mov byte [rsi + 0x1b], al
lea rdi, [rsi + 0x20]
mov qword [rsp + 0x80], rdi
lea rdx, [r15 + 0x48]
mov rcx, rdi
call fcn.140003c90
nop
lea rdx, [r15 + 0x58]
lea rcx, [rdi + 0x10]
call fcn.140003c90
nop
lea rdi, [rsi + 0x40]
mov qword [rsp + 0x80], rdi
lea rdx, [r15 + 0x68]
mov rcx, rdi
call fcn.140003c90
nop
lea rdx, [r15 + 0x78]
lea rcx, [rdi + 0x10]
call fcn.140003c90
nop
mov eax, dword [r15 + 0x88]
mov dword [rsi + 0x60], eax
mov eax, dword [r15 + 0x8c]
mov dword [rsi + 0x64], eax
mov rax, r12
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140085070
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx eax, word [rcx + 2]
mov r10, rdx
cmp ax, word [rdx + 2]
je 0x140085080
xor al, al
ret
movzx r11d, word [rcx]
cmp r11w, word [rdx]
jne 0x14008508d
mov al, 1
ret
mov r8d, 0xffff
cmp ax, 8
je 0x1400850a7
cmp ax, 6
ja 0x1400850ad
mov r8d, 0x7fff
jmp 0x1400850ad
mov r8d, 0x7ff9
movzx eax, word [rdx]
mov edx, 0x800
xor ax, r11w
test dx, ax
je 0x140085103
mov r9d, dword [rcx + 0x30]
mov rax, qword [rcx + 0x28]
xor ecx, ecx
mov edx, ecx
test r9d, r9d
je 0x1400850df
nop
cmp byte [rax], 0x80
jae 0x140085103
inc edx
inc rax
cmp edx, r9d
jb 0x1400850d0
mov edx, dword [r10 + 0x30]
mov rax, qword [r10 + 0x28]
test edx, edx
je 0x1400850fe
nop dword [rax + rax]
cmp byte [rax], 0x80
jae 0x140085103
inc ecx
inc rax
cmp ecx, edx
jb 0x1400850f0
btr r8d, 0xb
movzx ecx, word [r10]
movzx eax, r11w
and ecx, r8d
and eax, r8d
cmp eax, ecx
sete al
ret
Function at 0x140093960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [rcx + 0x40], 0xa
mov rax, rcx
jae 0x1400939d7
nop dword [rax]
mov r8d, dword [rax]
cmp r8d, 8
jae 0x1400939a9
mov rcx, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
je 0x140093a92
movzx edx, byte [rcx]
lea r9d, [r8 + 8]
inc rcx
mov qword [rax + 8], rcx
mov ecx, 0x18
sub ecx, r8d
mov r8d, edx
shl r8d, cl
or r8d, dword [rax + 4]
jmp 0x1400939b0
mov r9d, r8d
mov r8d, dword [rax + 4]
mov ecx, r8d
shr r8d, 0x18
shl ecx, 8
mov dword [rax + 4], ecx
lea ecx, [r9 - 8]
mov dword [rax], ecx
mov ecx, dword [rax + 0x40]
mov byte [rcx + rax + 0x70de], r8b
inc dword [rax + 0x40]
cmp dword [rax + 0x40], 0xa
jb 0x140093970
mov dword [rax + 0x70e8], 0
movzx ecx, byte [rax + 0x70e4]
shl ecx, 8
mov dword [rax + 0x70e8], ecx
movzx edx, byte [rax + 0x70e5]
or edx, ecx
shl edx, 8
mov dword [rax + 0x70e8], edx
movzx ecx, byte [rax + 0x70e6]
or ecx, edx
shl ecx, 8
mov dword [rax + 0x70e8], ecx
movzx edx, byte [rax + 0x70e7]
or edx, ecx
mov dword [rax + 0x70e8], edx
movzx ecx, byte [rax + 0x70de]
cmp cl, 0x31
jne 0x140093a95
cmp byte [rax + 0x70df], 0x41
jne 0x140093a95
cmp byte [rax + 0x70e0], 0x59
jne 0x140093a95
cmp byte [rax + 0x70e1], 0x26
jne 0x140093a95
cmp byte [rax + 0x70e2], 0x53
jne 0x140093a95
cmp byte [rax + 0x70e3], 0x59
jne 0x140093a95
cmp byte [rax + 0x70f0], 0
jne 0x140093a6d
inc qword [rax + 0x70f8]
inc qword [rax + 0x7100]
mov byte [rax + 0x70f0], 1
mov ecx, dword [rax + 0x70ec]
rol ecx, 1
xor ecx, edx
mov dword [rax + 0x70ec], ecx
mov dword [rax + 0x3c], 2
xor eax, eax
ret
cmp cl, 0x17
jne 0x140093b24
cmp byte [rax + 0x70df], 0x72
jne 0x140093b24
cmp byte [rax + 0x70e0], 0x45
jne 0x140093b24
cmp byte [rax + 0x70e1], 0x38
jne 0x140093b24
cmp byte [rax + 0x70e2], 0x50
jne 0x140093b24
cmp byte [rax + 0x70e3], 0x90
jne 0x140093b24
cmp byte [rax + 0x70f0], 0
jne 0x140093adb
inc qword [rax + 0x70f8]
mov r8d, dword [rax + 4]
mov byte [rax + 0x70f0], 1
test r8d, r8d
je 0x140093af2
mov byte [rax + 0x70f2], 1
mov edx, dword [rax]
mov ecx, edx
and ecx, 7
mov dword [rax + 0x3c], 0xb
sub edx, ecx
shl r8d, cl
mov ecx, dword [rax + 0x70ec]
mov dword [rax], edx
mov dword [rax + 4], r8d
cmp dword [rax + 0x70e8], ecx
je 0x140093a92
mov byte [rax + 0x70f1], 1
mov eax, 1
ret
Function at 0x140094da0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbx
push rdi
push r13
push r14
sub rsp, 0x48
mov rax, qword [rcx + 0x10]
xor r13d, r13d
mov qword [r11 - 0x38], rax
mov r8d, edx
mov rdx, qword [rcx]
lea rax, [r11 - 0x48]
mov qword [rcx + 0x20], rax
mov r14, rcx
mov rax, qword [rcx + 0x8cf8]
mov dword [r11 - 0x48], r13d
mov dword [rsp + 0x24], 8
mov byte [r11 - 0x40], r13b
mov dword [rcx + 0x8ce8], r13d
mov r9d, dword [rax + 0x19c]
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], r12
call fcn.140094b40
mov rdi, qword [r14 + 0x8cf8]
cmp byte [rdi + 0x1e4], r13b
je 0x140094e34
mov eax, dword [r14 + 0x8cec]
mov rcx, qword [rdi + 0x1a8]
imul rdx, rax, 0x8e28
mov rcx, qword [rdx + rcx + 0x8d18]
call fcn.1400bf8a0
mov rdi, qword [r14 + 0x8cf8]
mov r8d, r13d
cmp dword [r14 + 0x8ce8], r13d
jbe 0x140094e73
mov rdx, qword [r14 + 0x8cf8]
mov eax, r8d
inc r8d
mov ecx, dword [rdx + 0x1a0]
rol ecx, 1
xor ecx, dword [r14 + rax*4 + 0x7ce8]
mov dword [rdx + 0x1a0], ecx
cmp r8d, dword [r14 + 0x8ce8]
jb 0x140094e40
mov rdi, qword [r14 + 0x8cf8]
movzx eax, byte [rsp + 0x28]
mov rbp, qword [r14 + 0x10]
mov byte [rsp + 0x70], al
mov eax, dword [rsp + 0x20]
lea r12d, [rax*8 + 8]
sub r12d, dword [rsp + 0x24]
mov eax, r12d
shr eax, 3
test eax, eax
je 0x140094f59
mov ecx, dword [rdi + 0x158]
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x40], r15
mov r15d, eax
nop word [rax + rax]
movzx esi, byte [rbp]
mov ebx, 8
nop dword [rax]
cmp ebx, ecx
jb 0x140094f2d
movzx r8d, byte [rdi + 0x15c]
sub ebx, ecx
mov ecx, ebx
mov edx, esi
shr edx, cl
mov eax, edx
or r8b, dl
shl eax, cl
lea rcx, [rdi + 0x160]
mov r9d, dword [rcx + 8]
sub esi, eax
mov rax, qword [rcx]
mov byte [r9 + rax], r8b
inc r9d
mov dword [rcx + 8], r9d
cmp r9d, dword [rcx + 0xc]
jne 0x140094f11
call fcn.140014bb0
mov dword [rdi + 0x158], 8
mov ecx, 8
mov byte [rdi + 0x15c], r13b
test ebx, ebx
jne 0x140094ed0
jmp 0x140094f3f
sub ecx, ebx
shl sil, cl
or byte [rdi + 0x15c], sil
mov dword [rdi + 0x158], ecx
inc rbp
sub r15, 1
jne 0x140094ec0
mov r15, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x80]
movzx edx, byte [rsp + 0x70]
lea rcx, [rdi + 0x158]
and r12d, 7
mov r8d, r12d
call fcn.140096880
mov rbx, qword [r14 + 0x8cf8]
mov r12, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x78]
cmp byte [rbx + 0x1e4], r13b
je 0x140095023
mov eax, dword [r14 + 0x8cec]
mov edi, r13d
inc eax
cmp eax, dword [rbx + 0x1e0]
cmovne edi, eax
cmp qword [rbx + 0x200], r13
je 0x140095004
lea rcx, [rbx + 0x160]
call fcn.140014ce0
mov edx, 0xf
lea r8, [rsp + 0x70]
sub edx, dword [rbx + 0x158]
shr rdx, 3
add rdx, rax
mov rax, qword [r14 + 0x8cf8]
mov qword [rsp + 0x70], rdx
lea rdx, [r14 + 0x8d20]
mov rcx, qword [rax + 0x200]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140046c11.0]
mov rbx, qword [r14 + 0x8cf8]
mov r13d, eax
mov ecx, edi
imul rdx, rcx, 0x8e28
mov rcx, qword [rbx + 0x1a8]
add rdx, 0x8d18
add rcx, rdx
call fcn.1400bf820
mov eax, r13d
add rsp, 0x48
pop r14
pop r13
pop rdi
pop rbx
ret
Function at 0x14009edb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x14010c598]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbp, rcx
mov esi, r9d
lea rcx, [rsp + 0x20]
mov rbx, r8
mov rdi, rdx
call fcn.1400b34e0
xor r11d, r11d
mov r10d, r11d
test esi, esi
je 0x14009ef9d
lea r9, [rbx + 8]
lea rbx, [0x140000000]
nop word [rax + rax]
mov eax, dword [rdi]
cmp eax, 0xe
je 0x14009ef73
cmp eax, 9
jne 0x14009eedc
cmp word [r9 - 8], 8
jne case.0x14009ef23.2
mov r8, qword [r9]
movzx ecx, word [r8]
lea eax, [rcx - 0x61]
cmp ax, 0x19
lea edx, [rcx - 0x20]
cmova dx, cx
cmp dx, 0x48
jne 0x14009ee7a
movzx edx, word [r8 + 2]
lea eax, [rdx - 0x61]
cmp ax, 0x19
lea ecx, [rdx - 0x20]
cmova cx, dx
cmp cx, 0x43
jne 0x14009eec3
movzx ecx, word [r8 + 4]
sub ecx, 0x30
lea eax, [rcx - 4]
test eax, eax
jne 0x14009eec3
cmp word [r8 + 6], r11w
jne 0x14009eec3
mov dword [rsp + 0x3c], r11d
mov eax, 1
mov dword [rsp + 0x40], ecx
jmp 0x14009eec6
cmp dx, 0x42
jne 0x14009eec3
movzx edx, word [r8 + 2]
lea eax, [rdx - 0x61]
cmp ax, 0x19
lea ecx, [rdx - 0x20]
cmova cx, dx
cmp cx, 0x54
jne 0x14009eec3
movzx ecx, word [r8 + 4]
sub ecx, 0x30
lea eax, [rcx - 2]
cmp eax, 2
ja 0x14009eec3
cmp word [r8 + 6], r11w
jne 0x14009eec3
mov dword [rsp + 0x3c], 1
mov eax, 1
mov dword [rsp + 0x40], ecx
jmp 0x14009eec6
mov eax, r11d
test eax, eax
mov ecx, 0x80070057
cmovne ecx, r11d
je 0x14009efd4
jmp 0x14009ef89
cmp eax, 0x10
ja 0x14009ef89
movzx ecx, word [r9 - 8]
jne 0x14009ef03
cmp cx, 0x15
jne case.0x14009ef23.2
mov rax, qword [r9]
mov qword [rsp + 0x50], rax
jmp 0x14009ef89
cmp cx, 0x13
jne case.0x14009ef23.2
mov edx, dword [r9]
cmp eax, 0xf
ja case.0x14009ef23.2
mov ecx, dword [rbx + rax*4 + 0x9efe0]
add rcx, rbx
jmp rcx
cmp edx, 0x1f
ja case.0x14009ef23.2
mov ecx, edx
mov eax, 1
shl eax, cl
mov dword [rsp + 0x24], eax
jmp 0x14009ef89
mov dword [rsp + 0x20], edx
jmp 0x14009ef89
mov dword [rsp + 0x38], edx
jmp 0x14009ef89
mov dword [rsp + 0x44], edx
jmp 0x14009ef89
mov dword [rsp + 0x34], edx
jmp 0x14009ef89
mov dword [rsp + 0x24], edx
jmp 0x14009ef89
mov dword [rsp + 0x30], edx
jmp 0x14009ef89
mov dword [rsp + 0x2c], edx
jmp 0x14009ef89
mov dword [rsp + 0x28], edx
jmp 0x14009ef89
mov dword [rsp + 0x4c], edx
jmp 0x14009ef89
cmp word [r9 - 8], 0xb
jne 0x14009efd8
mov eax, r11d
cmp word [r9], ax
setne al
mov dword [rsp + 0x48], eax
inc r10d
add r9, 0x18
add rdi, 4
cmp r10d, esi
jb 0x14009ee00
mov rcx, qword [rbp + 0x20]
lea rdx, [rsp + 0x20]
call fcn.1400b5620
mov ecx, eax
call fcn.14000ff50
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400c7aa0
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
mov eax, ecx
jmp 0x14009efb2
mov eax, 0x80070057
jmp 0x14009efb2