joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003aa60
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
jbe 0x14003aa91
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x14007ef68]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x14007ef78]
lea rdx, [rdi + rdi]
call fcn.14003a620
mov rax, qword [0x14007ef68]
lea r9, [rdi - 1]
mov qword [0x14007ef90], r9
mov qword [0x14007ef98], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x14003ac04
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x14007ef78]
mov r9, qword [r11]
cmp r9, rbx
jne 0x14003ab50
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14003abc5
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x14003ab8d
mov r10, qword [rdx]
cmp r10, rax
je 0x14003ab87
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x14003abc5
cmp r9, rdx
je 0x14003aba1
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x14003abd9
cmp r9, rdx
jne 0x14003ab92
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x14003abff
mov r9, qword [0x14007ef90]
jmp 0x14003ab01
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14003abc5
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14003ef6c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003efb6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003efb6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003efb6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003efb6
cmp dword [rcx + 0x84], 0xe
jbe 0x14003efb6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14003efb8
xor al, al
add rsp, 0x28
ret
Function at 0x14003b60c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140048cc8], rbx
je 0x14003b673
cmp rax, rbx
jne 0x14003b666
mov ebx, 1
mov esi, ebx
jmp 0x14003b678
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14003b64b
mov ebx, 1
mov eax, dword [0x140048cd0]
cmp eax, ebx
jne 0x14003b690
mov edi, 0x1f
mov ecx, edi
call fcn.14017c000
jmp 0x14003b6fc
mov eax, dword [0x140048cd0]
test eax, eax
jne 0x14003b6f1
mov dword [0x140048cd0], ebx
lea r15, [0x14003e288]
lea rdi, [0x14003e270]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14003b6e3
test eax, eax
jne 0x14003b6e7
cmp qword [rdi], r14
je 0x14003b6d8
mov rax, qword [rdi]
mov rcx, qword [0x14003e230]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14003b6ba
test eax, eax
je 0x14003b6f7
mov eax, 0xff
jmp 0x14003b852
mov dword [0x140048284], ebx
mov edi, 0x1f
mov eax, dword [0x140048cd0]
cmp eax, ebx
jne 0x14003b723
lea rdx, [0x14003e268]
lea rcx, [0x14003e238]
call sub.msvcrt.dll__initterm
mov dword [0x140048cd0], 2
test esi, esi
jne 0x14003b731
mov rax, r14
xchg qword [0x140048cc8], rax
cmp qword [0x140048ce8], r14
je 0x14003b764
lea rcx, [0x140048ce8]
call fcn.14003bbf0
test eax, eax
je 0x14003b764
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140048ce8]
mov r9, qword [0x14003e230]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14003b77d
mov eax, 0xff
jmp 0x14003b852
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14003b803
test ax, ax
je 0x14003b798
test edx, edx
jne 0x14003b803
sub ax, bx
cmp ax, di
ja 0x14003b7ae
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14003b798
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140001fc0
mov dword [0x140048280], eax
cmp dword [0x1400482a0], r14d
jne 0x14003b7ec
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140048284], r14d
jne 0x14003b801
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140048280]
jmp 0x14003b852
cmp ax, 0x22
jne 0x14003b817
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14003b786
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14003bc70
add rsp, 0x28
jmp 0x14003b60c
Function at 0x140011519
Capabilities:
Terminate process

Disassembly:
jmp 0x14001e890
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x14001169a
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001fbe0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001fc00
xor al, al
jmp 0x14001fc81
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001fc13
xor al, al
jmp 0x14001fc81
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001fc3d
xor al, al
jmp 0x14001fc81
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001fc51
xor al, al
jmp 0x14001fc81
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001fc63
xor al, al
jmp 0x14001fc81
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001fc7f
xor al, al
jmp 0x14001fc81
mov al, 1
add rsp, 0x38
ret
Function at 0x140003460
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
movdqa xmm0, xmmword [0x1400764f0]
xor ebx, ebx
movdqa xmm1, xmmword [0x140076590]
mov ecx, ebx
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x30], 0x9288dbc4
movdqa xmm0, xmmword [0x140076570]
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x2c], 0xd5d8c984
movdqu xmmword [rbp - 0x50], xmm1
mov dword [rbp - 0x28], 0x100dcca
lea eax, [rcx - 0x4c]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0x3a
jb 0x1400034b0
lea rcx, [rbp - 0x60]
mov byte [rbp - 0x25], bl
call qword [0x1400678e8]
movdqa xmm0, xmmword [0x1400764f0]
mov rcx, rbx
movdqa xmm1, xmmword [0x140076520]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x30], 0xd9c6b1cb
movdqa xmm0, xmmword [0x1400765a0]
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x2c], 0xcb869c86
movdqu xmmword [rbp - 0x50], xmm1
mov dword [rbp - 0x28], 0xdec8d3de
mov word [rbp - 0x24], 0x100
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x4c]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0x3c
jb 0x140003520
lea rcx, [rbp - 0x60]
mov byte [rbp - 0x23], bl
call qword [0x1400678e8]
movdqa xmm0, xmmword [0x1400764f0]
mov rcx, rbx
movdqa xmm1, xmmword [0x140076560]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x1400765b0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x1400764a0]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov byte [rbp - 0x20], 1
nop dword [rax + rax]
lea eax, [rcx - 0x4c]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0x3f
jb 0x140003580
lea rcx, [rbp - 0x60]
mov byte [rbp - 0x20], bl
call qword [0x1400678e8]
movdqa xmm0, xmmword [0x140076550]
mov rcx, rbx
movdqa xmm1, xmmword [0x1400765e0]
movdqu xmmword [rbp - 0x60], xmm0
mov word [rbp - 0x40], 0xe5
movdqu xmmword [rbp - 0x50], xmm1
mov byte [rbp - 0x3e], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x4c]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0x21
jb 0x1400035d0
lea rcx, [rbp - 0x60]
mov byte [rbp - 0x3e], bl
call qword [0x1400678e8]
movdqa xmm0, xmmword [0x140076550]
mov rcx, rbx
movdqa xmm1, xmmword [0x1400765d0]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x40], 0xe6f0ebe6
movdqu xmmword [rbp - 0x50], xmm1
mov word [rbp - 0x3c], 0x100
nop word [rax + rax]
lea eax, [rcx - 0x4c]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0x24
jb 0x140003620
lea rcx, [rbp - 0x60]
mov byte [rbp - 0x3b], bl
call qword [0x1400678e8]
movdqa xmm0, xmmword [0x140076540]
movdqa xmm1, xmmword [0x140076500]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x1400764c0]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x1400764b0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x140076580]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x10], 0x39342568
mov dword [rbp - 0xc], 0x100382e
nop dword [rax]
lea eax, [rbx - 0x4c]
xor byte [rbp + rbx - 0x60], al
inc rbx
cmp rbx, 0x56
jb 0x140003690
lea rcx, [rbp - 0x60]
mov byte [rbp - 9], 0
call qword [0x1400678e8]
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x140003d40
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rdx + 0x4a], 0
mov rbx, rcx
je 0x140003d66
xor eax, eax
lea r8d, [rax - 0x4c]
xor byte [rdx + rax], r8b
inc rax
cmp rax, 0x49
jb 0x140003d51
mov byte [rdx + 0x4a], 0
call fcn.1400060a0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140003d80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x140003db4
mov ecx, esi
lea eax, [rcx - 0x4c]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140003da0
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140003de9
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.1400059a0
nop
cmp byte [rbx + 0xa], 0
je 0x140003e13
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x4c]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 9
jb 0x140003e00
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140003e48
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1400059a0
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.1400074a0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140003e9c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e96
call qword [0x1400678b8]
int3
call fcn.1400647e8
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140003edc
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ed7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003ed7
call qword [0x1400678b8]
int3
call fcn.1400647e8
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140003ef0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140003f24
mov ecx, esi
lea eax, [rcx - 0x4c]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x140003f10
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140003f59
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.1400059a0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140003f67
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.1400085c0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140003fdc
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003fd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003fd7
call qword [0x1400678b8]
int3
call fcn.1400647e8
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140003ff0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x140004024
mov ecx, esi
lea eax, [rcx - 0x4c]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x140004010
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x140004059
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.1400059a0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140004067
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.1400085c0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1400040dc
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400040d7
call qword [0x1400678b8]
int3
call fcn.1400647e8
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004170
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1400041a4
mov ecx, esi
lea eax, [rcx - 0x4c]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x140004190
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x1400041d9
mov r8d, 0xb
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.1400059a0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400041e7
mov rbx, qword [rbx]
mov r8, rbx
lea rcx, [rsp + 0x28]
call fcn.1400085c0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14000425c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004257
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004257
call qword [0x1400678b8]
int3
call fcn.1400647e8
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140004a40
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x140004a74
mov ecx, esi
lea eax, [rcx - 0x4c]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x140004a60
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x140004aa9
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.1400059a0
nop
cmp byte [rbx + 0xd], 0
je 0x140004ad3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x4c]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 0xc
jb 0x140004ac0
mov byte [rbx + 0xd], 0
lea rax, [rbx + 0xc]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x140004b08
mov r8d, 0xc
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.1400059a0
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
mov rcx, rdi
call fcn.1400074a0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x140004b5c
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b56
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004b56
call qword [0x1400678b8]
int3
call fcn.1400647e8
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x140004b9c
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004b97
call qword [0x1400678b8]
int3
call fcn.1400647e8
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x140004bb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400fc280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x38], rdx
xor r14d, r14d
call fcn.140003460
call fcn.140016f30
mov rsi, rax
test rax, rax
jne 0x140004c92
mov qword [rdi], r14
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], 0xf
mov byte [rdi], al
lea r8d, [r14 + 4]
lea rdx, [0x140075498]
mov rcx, rdi
call fcn.1400059a0
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140004c5c
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140004c57
add rdx, 0x27
mov rax, qword [rcx - 8]
sub rcx, rax
add rcx, 0xfffffffffffffff8
cmp rcx, 0x1f
ja 0x140004dea
mov rcx, rax
call fcn.1400647e8
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 0xf
mov rax, rdi
mov byte [rbx], 0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140064b40
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 0xf
movdqa xmm0, xmmword [0x1400765c0]
movdqu xmmword [rbp - 0x60], xmm0
mov dword [rbp - 0x50], 0xe8a8acb3
mov dword [rbp - 0x4c], 0xe4a3b9a9
mov dword [rbp - 0x48], 0xe0ffe3fd
mov word [rbp - 0x44], 0x100
mov rcx, r14
nop dword [rax]
lea eax, [rcx - 0x4c]
xor byte [rbp + rcx - 0x60], al
inc rcx
cmp rcx, 0x1c
jb 0x140004cd0
mov byte [rbp - 0x43], 0
lea r8, [rbp - 0x60]
mov edx, 0x2712
mov rcx, rsi
call fcn.14001aa50
xor r8d, r8d
lea edx, [r8 + 0x40]
mov rcx, rsi
call fcn.14001aa50
xor r8d, r8d
lea edx, [r8 + 0x51]
mov rcx, rsi
call fcn.14001aa50
lea r8, [0x1400754a0]
mov edx, 0x27c1
mov rcx, rsi
call fcn.14001aa50
mov r8, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140004d34
mov r8, qword [rbx]
mov edx, 0x271f
mov rcx, rsi
call fcn.14001aa50
lea r8, [0x1400040f0]
mov edx, 0x4e2b
mov rcx, rsi
call fcn.14001aa50
lea r8, [rbp - 0x30]
mov edx, 0x2711
mov rcx, rsi
call fcn.14001aa50
mov rcx, rsi
call fcn.140016ff0
test eax, eax
je 0x140004d8d
mov ecx, eax
call fcn.140017ba0
mov rdx, rax
mov r9d, 0x10
xor r8d, r8d
xor ecx, ecx
call qword [0x140067588]
movups xmm0, xmmword [rbp - 0x30]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp - 0x20]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140004c5c
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140004c57
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004dea
mov rcx, r8
jmp 0x140004c57
call qword [0x1400678b8]
int3

Function at 0x140012ce0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rdx + 3], 0
mov rbx, rcx
je 0x140012d06
xor eax, eax
lea r8d, [rax - 0x35]
xor byte [rdx + rax], r8b
inc rax
cmp rax, 2
jb 0x140012cf1
mov byte [rdx + 3], 0
call fcn.1400060a0
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x140012d20
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rdx + 8], 0
mov rbx, rcx
je 0x140012d46
xor eax, eax
lea r8d, [rax - 0x35]
xor byte [rdx + rax], r8b
inc rax
cmp rax, 7
jb 0x140012d31
mov byte [rdx + 8], 0
call fcn.1400060a0
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x140012d60
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [rdx + 0x1f], 0
mov rbx, rcx
je 0x140012d86
xor eax, eax
lea r8d, [rax - 0x35]
xor byte [rdx + rax], r8b
inc rax
cmp rax, 0x1e
jb 0x140012d71
mov byte [rdx + 0x1f], 0
call fcn.1400060a0
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1400152e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x140015303
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x35]
xor byte [rcx + rax], dl
inc rax
cmp rax, 3
jb 0x1400152f0
mov byte [rcx + 4], 0
mov rax, rcx
ret
Function at 0x140065550
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x1400671a8]
test rax, rax
je 0x14006559a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006559a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006559a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006559a
cmp dword [rcx + 0x84], 0xe
jbe 0x14006559a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006559c
xor al, al
add rsp, 0x28
ret