joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff77f2ee840
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
xor r14b, r14b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
mov qword [rsp + 0x30], r10
movsxd rcx, dword [r10 + 0x3c]
mov rdx, qword [rcx + r10 + 0x88]
mov qword [rsp + 0x60], rdx
mov r11d, edx
add r11, r10
mov qword [rsp + 0x38], r11
shr rdx, 0x20
mov dword [rsp + 0x40], edx
cmp r11, r10
je 0x7ff77f2ee93e
mov edi, dword [r11 + 0x18]
mov dword [rsp + 0x20], edi
nop
mov ecx, edi
dec edi
mov dword [rsp + 0x20], edi
test ecx, ecx
je 0x7ff77f2ee93e
mov edx, dword [r11 + 0x20]
add rdx, r10
mov ecx, dword [rdx + rdi*4]
add rcx, r10
mov qword [rsp + 0x28], rcx
mov ebx, 0x261b3b43
nop word [rax + rax]
movsx r9d, byte [rcx]
inc rcx
mov qword [rsp + 0x28], rcx
test r9b, r9b
jne 0x7ff77f2ee91c
cmp ebx, 0xbc31fd97
jne 0x7ff77f2ee91a
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [r11 + 0x24]
add rax, r10
movzx eax, word [rax + rdi*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 0xdeadbeef
call rdx
jmp 0x7ff77f2ee949
jmp 0x7ff77f2ee8b0
mov edx, r9d
sub r9b, 0x41
mov r8d, edx
or r8d, 0x20
cmp r9b, 0x19
cmova r8d, edx
xor r8d, ebx
imul ebx, r8d, 0x1000193
jmp 0x7ff77f2ee8e0
mov rax, qword [rax]
jmp 0x7ff77f2ee870
cmp r14b, 1
je 0x7ff77f2ee965
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
call fcn.7ff77f2ee300
nop
int3
Function at 0x7ff77f2f1b40
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov r15d, ecx
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov rbx, qword [rax + 0x30]
movsxd rcx, dword [rbx + 0x3c]
mov esi, dword [rcx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x7ff77f2f1bf9
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x7ff77f2f1bf9
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0xa68b5591
lea rcx, [r14 + r11*4]
mov r9d, dword [rcx + rbx]
add r9, rbx
movzx ecx, byte [r9]
inc r9
test cl, cl
je 0x7ff77f2f1bf4
nop
movsx edx, cl
lea r9, [r9 + 1]
sub cl, 0x41
mov r8d, edx
or r8d, 0x20
cmp cl, 0x19
movzx ecx, byte [r9 - 1]
cmova r8d, edx
xor r8d, r10d
imul r10d, r8d, 0x1000193
test cl, cl
jne 0x7ff77f2f1bc0
cmp r10d, 0xaedf198e
je 0x7ff77f2f1c01
test r11d, r11d
jne 0x7ff77f2f1ba0
mov rax, qword [rax]
jmp 0x7ff77f2f1b70
mov ecx, dword [rsi + 0x24]
add rcx, rbx
movzx edx, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + rdx*4]
mov ecx, 0xfffffff5
add rax, rbx
call rax
mov rcx, qword gs:[0x60]
mov rbp, rax
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rcx + 0x30]
movsxd rdx, dword [rbx + 0x3c]
mov esi, dword [rdx + rbx + 0x88]
add rsi, rbx
cmp rsi, rbx
je 0x7ff77f2f1cca
mov r11d, dword [rsi + 0x18]
test r11d, r11d
je 0x7ff77f2f1cca
mov r14d, dword [rsi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r11d
mov r10d, 0x1b5b61bd
lea rax, [r14 + r11*4]
mov r8d, dword [rax + rbx]
add r8, rbx
movzx r9d, byte [r8]
inc r8
test r9b, r9b
je 0x7ff77f2f1cc5
movsx eax, r9b
lea r8, [r8 + 1]
sub r9b, 0x41
mov edx, eax
or edx, 0x20
cmp r9b, 0x19
movzx r9d, byte [r8 - 1]
cmova edx, eax
xor edx, r10d
imul r10d, edx, 0x1000193
test r9b, r9b
jne 0x7ff77f2f1c90
cmp r10d, 0x50b3aa7d
je 0x7ff77f2f1cd2
test r11d, r11d
jne 0x7ff77f2f1c70
mov rcx, qword [rcx]
jmp 0x7ff77f2f1c40
mov ecx, dword [rsi + 0x24]
movzx edx, r15w
add rcx, rbx
movzx r8d, word [rcx + r11*2]
mov ecx, dword [rsi + 0x1c]
add rcx, rbx
mov eax, dword [rcx + r8*4]
mov rcx, rbp
add rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
jmp rax
Function at 0x7ff77f2f34b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 7], dil
je 0x7ff77f2f34e4
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x7ff77f2f34d0
mov byte [r8 + 7], dil
lea rax, [r8 + 6]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], 0xf
cmp r8, rax
jne 0x7ff77f2f3511
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x7ff77f2f3530
mov qword [rsp + 0x30], 6
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x26], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x7ff77f2f353e
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.7ff77f3010c0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x7ff77f2f35b5
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff77f2f35b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff77f2f35b0
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff77f355420
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x7ff77f2f35d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 9], dil
je 0x7ff77f2f3604
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x7ff77f2f35f0
mov byte [r8 + 9], dil
lea rax, [r8 + 8]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], 0xf
cmp r8, rax
jne 0x7ff77f2f3631
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x7ff77f2f3647
mov qword [rsp + 0x30], 8
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x28], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x7ff77f2f3655
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.7ff77f3010c0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x7ff77f2f36cc
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff77f2f36c7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff77f2f36c7
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff77f355420
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x7ff77f2f36e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x7ff77f2f3724
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x7ff77f2f3710
mov byte [r8 + 6], r9b
lea rax, [r8 + 5]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], 0xf
cmp r8, rax
jne 0x7ff77f2f374b
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x7ff77f2f3765
mov qword [rbp - 0x28], 5
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
mov byte [rbp - 0x33], r9b
cmp byte [rdx + 0xa], 0
je 0x7ff77f2f3783
mov rcx, r9
nop
lea eax, [rcx + 0x7d]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x7ff77f2f3770
mov byte [rdx + 0xa], 0
lea rax, [rdx + 9]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], 0xf
cmp rdx, rax
jne 0x7ff77f2f37aa
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x7ff77f2f37c6
mov qword [rbp - 0x48], 9
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
mov byte [rbp - 0x4f], 0
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.7ff77f2f9b10
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x7ff77f2f381a
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff77f2f3814
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff77f2f3814
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff77f355420
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x7ff77f2f3858
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff77f2f3853
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff77f2f3853
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff77f355420
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x7ff77f2f3870
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 9], r9b
je 0x7ff77f2f38b4
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x7ff77f2f38a0
mov byte [r8 + 9], r9b
lea rax, [r8 + 8]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], 0xf
cmp r8, rax
jne 0x7ff77f2f38db
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x7ff77f2f38ee
mov qword [rbp - 0x28], 8
mov rax, qword [r8]
mov qword [rbp - 0x38], rax
mov byte [rbp - 0x30], r9b
cmp byte [rdx + 0xa], 0
je 0x7ff77f2f3913
mov rcx, r9
nop word [rax + rax]
lea eax, [rcx + 0x7d]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x7ff77f2f3900
mov byte [rdx + 0xa], 0
lea rax, [rdx + 9]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], 0xf
cmp rdx, rax
jne 0x7ff77f2f393a
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x7ff77f2f3956
mov qword [rbp - 0x48], 9
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
mov byte [rbp - 0x4f], 0
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.7ff77f2f9b10
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x7ff77f2f39aa
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff77f2f39a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff77f2f39a4
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff77f355420
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x7ff77f2f39e8
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff77f2f39e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff77f2f39e3
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff77f355420
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x7ff77f2f3a00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xa], dil
je 0x7ff77f2f3a34
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x7ff77f2f3a20
mov byte [r8 + 0xa], dil
lea rax, [r8 + 9]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], 0xf
cmp r8, rax
jne 0x7ff77f2f3a61
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x7ff77f2f3a83
mov qword [rsp + 0x30], 9
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 8]
mov byte [rsp + 0x28], al
mov byte [rsp + 0x29], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x7ff77f2f3a91
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.7ff77f3010c0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x7ff77f2f3b08
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff77f2f3b03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff77f2f3b03
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff77f355420
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x7ff77f2f3b20
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rbx, rdx
mov rdi, rcx
mov qword [rbp - 0x10], rcx
xor edx, edx
cmp byte [r8 + 7], dl
je 0x7ff77f2f3b64
mov ecx, edx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x7ff77f2f3b50
mov byte [r8 + 7], dl
lea rax, [r8 + 6]
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x48], rdx
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x40], 0xf
cmp r8, rax
jne 0x7ff77f2f3b8a
mov qword [rbp - 0x48], rdx
mov byte [rbp - 0x58], dl
jmp 0x7ff77f2f3ba4
mov qword [rbp - 0x48], 6
mov eax, dword [r8]
mov dword [rbp - 0x58], eax
movzx eax, word [r8 + 4]
mov word [rbp - 0x54], ax
mov byte [rbp - 0x52], dl
cmp byte [rbx + 0x14], 0
je 0x7ff77f2f3bc3
mov rcx, rdx
nop dword [rax]
lea eax, [rcx + 0x7d]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 0x13
jb 0x7ff77f2f3bb0
mov byte [rbx + 0x14], 0
lea rax, [rbx + 0x13]
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], rdx
cmp rbx, rax
jne 0x7ff77f2f3bea
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
jmp 0x7ff77f2f3c28
mov edx, 0x20
lea rcx, [rbp - 0x38]
call fcn.7ff77f2e7540
mov rcx, rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], 0x13
mov qword [rbp - 0x20], 0x1f
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movzx eax, word [rbx + 0x10]
mov word [rcx + 0x10], ax
movzx eax, byte [rbx + 0x12]
mov byte [rcx + 0x12], al
mov byte [rcx + 0x13], 0
lea r9, [rbp - 0x58]
lea r8, [rbp - 0x38]
movzx edx, byte [rbp - 0x60]
mov rcx, rdi
call fcn.7ff77f2f9b10
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x7ff77f2f3c7c
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff77f2f3c76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff77f2f3c76
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff77f355420
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x7ff77f2f3cba
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff77f2f3cb5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff77f2f3cb5
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff77f355420
mov rax, rdi
add rsp, 0x80
pop rdi
pop rbx
pop rbp
ret
Function at 0x7ff77f2f3cd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
cmp byte [r8 + 0xc], dil
je 0x7ff77f2f3d04
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x7ff77f2f3cf0
mov byte [r8 + 0xc], dil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x38], 0xf
cmp r8, rax
jne 0x7ff77f2f3d31
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x20], dil
jmp 0x7ff77f2f3d5d
mov qword [rsp + 0x30], 0xb
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [r8 + 8]
mov word [rsp + 0x28], ax
movzx eax, byte [r8 + 0xa]
mov byte [rsp + 0x2a], al
mov byte [rsp + 0x2b], dil
mov r9, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x7ff77f2f3d6b
mov rdx, qword [rdx]
mov r8, rdx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.7ff77f3010c0
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x7ff77f2f3de2
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff77f2f3ddd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff77f2f3ddd
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff77f355420
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x7ff77f2f3df0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x7ff77f2f3e34
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x7d]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x7ff77f2f3e20
mov byte [r8 + 6], r9b
lea rax, [r8 + 5]
mov qword [rbp - 0x38], r9
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r9
mov qword [rbp - 0x20], 0xf
cmp r8, rax
jne 0x7ff77f2f3e5b
mov qword [rbp - 0x28], r9
mov byte [rbp - 0x38], r9b
jmp 0x7ff77f2f3e75
mov qword [rbp - 0x28], 5
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
mov byte [rbp - 0x33], r9b
cmp byte [rdx + 0xd], 0
je 0x7ff77f2f3e93
mov rcx, r9
nop
lea eax, [rcx + 0x7d]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xc
jb 0x7ff77f2f3e80
mov byte [rdx + 0xd], 0
lea rax, [rdx + 0xc]
mov qword [rbp - 0x58], r9
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], r9
mov qword [rbp - 0x40], 0xf
cmp rdx, rax
jne 0x7ff77f2f3eba
mov qword [rbp - 0x48], r9
mov byte [rbp - 0x58], 0
jmp 0x7ff77f2f3ed5
mov qword [rbp - 0x48], 0xc
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
mov eax, dword [rdx + 8]
mov dword [rbp - 0x50], eax
mov byte [rbp - 0x4c], 0
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.7ff77f2f9b10
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x7ff77f2f3f29
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff77f2f3f23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff77f2f3f23
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff77f355420
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x7ff77f2f3f67
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff77f2f3f62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff77f2f3f62
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff77f355420
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret

Function at 0x7ff77f2fbe80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x7ff77f2fbea8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x7ff77f2fbe90
mov byte [rcx + 0x136], 0
mov rax, rcx
ret

Function at 0x7ff77f2fbeb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x7ff77f2fbed3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x7ff77f2fbec0
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x7ff77f2fbee0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x7ff77f2fbf03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x7d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x7ff77f2fbef0
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x7ff77f31c400
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x7ff77f31c45e
mov dl, 1
call fcn.7ff77f30cde0
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.7ff77f30cde0
mov eax, ebx
jmp 0x7ff77f31c4a2
cmp ebx, 2
ja 0x7ff77f31c4a0
mov r9, qword [rdi + 0x668]
lea rdx, [0x7ff77f35d368]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.ucrtbase.dll_fwrite]
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ucrtbase.dll_fwrite]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x7ff77f31c4c0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x7ff77f37b080]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
jne 0x7ff77f31c503
cmp qword [rcx + 0x678], 0
je 0x7ff77f31c5e0
mov r8, rdx
mov qword [rsp + 0x158], rbx
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.7ff77f30ae80
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x7ff77f31c531
mov rcx, qword [rdi + 0x678]
test rcx, rcx
je 0x7ff77f31c578
cmp byte [rdi + 0x1597], 0
jne 0x7ff77f31c578
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x7ff77f31c560
mov byte [rdi + 0x1597], 1
cmp byte [rdi + 0xf1e], 0
je 0x7ff77f31c5d8
mov byte [rsp + rbx + 0x30], 0xa
inc rbx
cmp rbx, 0x102
jae 0x7ff77f31c633
cmp qword [rdi + 0x718], 0
mov byte [rsp + rbx + 0x30], 0
je 0x7ff77f31c5f9
mov dl, 1
mov rcx, rdi
call fcn.7ff77f30cde0
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.7ff77f30cde0
mov rbx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.7ff77f355090
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x668]
lea rcx, [0x7ff77f35d368]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.ucrtbase.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.ucrtbase.dll_fwrite]
jmp 0x7ff77f31c5d8
call fcn.7ff77f355564
int3