joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180004d20
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x398
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x300], xmm11
movdqa xmmword [rbp + 0x2f0], xmm10
movdqa xmmword [rbp + 0x2e0], xmm9
movdqa xmmword [rbp + 0x2d0], xmm8
movdqa xmmword [rbp + 0x2c0], xmm7
movdqa xmmword [rbp + 0x2b0], xmm6
mov qword [rbp + 0x2a0], 0xfffffffffffffffe
mov rdi, qword [0x18001f420]
cmp byte [0x18001fcd0], 0
jne 0x180004e80
movabs rax, 0xff5ef54f4c4b1d17
add rax, rdi
movabs rcx, 0xff5ef54f4c4b1d30
add rcx, rdi
xor edx, edx
lea r8, [0x18001fcc8]
nop word cs:[rax + rax]
movzx r11d, byte [rcx + rdx]
mov r15d, r11d
not r15b
movzx r9d, byte [rax + rdx]
mov esi, r11d
xor sil, 1
and sil, r15b
mov ebx, r11d
and bl, 0x2a
and r11b, 0x11
mov r10d, r15d
and r10b, 0xc4
or r10b, r11b
mov r11d, r10d
and r11b, 0xd4
and sil, 0xd5
and r15b, 4
mov r14d, r10d
and r14b, 0xd0
or r14b, r15b
or r14b, 9
xor r14b, sil
xor r14b, 0xef
xor r11b, 0xc4
and r11b, sil
or r11b, r14b
mov esi, ebx
xor sil, 0xf6
not r11b
and r11b, sil
mov esi, ebx
lea r15d, [r10 + 0x2a]
xor r15b, bl
not bl
xor sil, 9
and sil, r14b
xor r15b, 0x3b
xor r10b, 0xee
and r10b, bl
or r10b, r15b
not r10b
or r10b, sil
or r10b, r11b
mov r11d, r9d
xor r11b, 0xd5
xor r9b, 0x2a
or r9b, r10b
not r10b
or r10b, r11b
xor r9b, r10b
mov byte [rdx + r8], r9b
inc rdx
cmp rdx, 8
jne 0x180004dc0
mov byte [0x18001fcd0], 1
lea rcx, [0x18001fcc8]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rbx, rax
cmp byte [0x18001fcde], 0
jne 0x180004f3d
movabs rax, 0xff5ef54f4c4b1d48
add rax, rdi
movabs rcx, 0xff5ef54f4c4b1d58
add rcx, rdi
xor edx, edx
lea r8, [0x18001fcd1]
movzx r9d, byte [rcx + rdx]
movzx r10d, byte [rax + rdx]
not r9b
mov r15d, r10d
and r15b, r9b
mov r14d, r10d
or r14b, r9b
mov r11d, r15d
not r11b
mov r12d, r11d
and r12b, 0x10
mov esi, r15d
and sil, 0x84
or sil, r12b
and r15b, 0x6b
or sil, 8
xor sil, r15b
mov r15d, esi
xor r15b, 0x73
mov r12d, r14d
xor r11b, r14b
xor r14b, 0x94
xor sil, 0x8c
and sil, r14b
xor r12b, 0x6b
and r12b, r15b
xor r9b, r10b
or r11b, r9b
not r11b
or r11b, r12b
or r11b, sil
mov byte [rdx + r8], r11b
inc rdx
cmp rdx, 0xd
jne 0x180004ec0
mov byte [0x18001fcde], 1
lea rcx, [0x18001fcd1]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rdx, qword [0x18001f438]
movabs rcx, 0xff5ef54f4c4b1a27
add rcx, rdx
movabs r8, 0xff5ef54f4c4b1a7f
add r8, rdx
test rbx, rbx
cmovne r8, rcx
mov rsi, rax
movabs rdx, 0x7f1fb524e0855348
mov rax, qword [r8]
add rax, rdx
jmp rax
Function at 0x1800098a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 8]
test rax, rax
je 0x1800098aa
ret
cmp byte [0x18001fe62], 0
jne 0x180009a08
mov rdx, qword [0x18001f4e0]
movabs rax, 0x71a648186ef30344
add rax, rdx
movabs r8, 0x71a648186ef30370
add r8, rdx
lea rcx, [0x18001fe50]
cmp r8, rcx
jbe 0x180009963
lea r8, [0x18001fe62]
cmp rax, r8
jae 0x180009963
xor edx, edx
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
movzx r9d, byte [rax + rdx + 0x1a]
mov r10d, r8d
xor r10b, 0x9b
xor r8b, r9b
xor r9b, 0x64
and r8b, r10b
or r9b, r10b
not r9b
or r9b, r8b
mov byte [rdx + rcx], r9b
movzx r8d, byte [rax + rdx + 1]
movzx r9d, byte [rax + rdx + 0x1b]
mov r10d, r8d
xor r10b, 0x9b
xor r8b, r9b
xor r9b, 0x64
and r8b, r10b
or r9b, r10b
not r9b
or r9b, r8b
mov byte [rdx + rcx + 1], r9b
add rdx, 2
cmp rdx, 0x12
jne 0x180009900
jmp 0x180009a01
movabs rcx, 0x71a648186ef3035e
add rcx, rdx
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rax]
movdqa xmm2, xmmword [0x180019fc0]
pxor xmm2, xmm1
pxor xmm1, xmm0
pxor xmm0, xmmword [str.dddddddddddddddd]
pand xmm1, xmm2
por xmm0, xmm2
pcmpeqd xmm2, xmm2
pxor xmm0, xmm2
por xmm0, xmm1
movdqa xmmword [0x18001fe50], xmm0
movabs rax, 0x71a648186ef3036e
movzx eax, word [rdx + rax]
movd xmm0, eax
movabs rcx, 0x71a648186ef30354
movzx ecx, word [rdx + rcx]
movd xmm1, ecx
pxor xmm1, xmmword [0x180019fe0]
pxor xmm0, xmmword [0x180019ff0]
xor ecx, eax
movd xmm3, ecx
pand xmm3, xmm1
por xmm0, xmm1
pxor xmm0, xmm2
por xmm0, xmm3
movd eax, xmm0
mov word [0x18001fe60], ax
mov byte [0x18001fe62], 1
movabs rax, 0x71a648186ef2fb9d
add rax, qword [0x18001f4e8]
ret

Function at 0x18000b720
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov eax, 0x84222325
sub r8, rdx
je 0x18000b7e0
xor ecx, ecx
nop word cs:[rax + rax]
movzx r9d, byte [rdx + rcx]
mov r11d, r9d
not r11d
mov esi, r11d
and esi, 0x90
mov r10d, r9d
and r10d, 0x6f
or r10d, esi
xor r10d, eax
xor r10d, 0x90
and r10d, r9d
and r11d, 0x20108
and r9d, 0xfffffff7
or r9d, r11d
xor eax, r9d
xor eax, 0x20108
xor r9d, 0xfffdfef7
and r9d, eax
mov eax, r9d
mov r11d, r9d
mov esi, r9d
and esi, 0xa6a83c97
xor esi, r10d
xor r9d, r10d
not r10d
not eax
and r11d, 0x41074320
and r10d, eax
and eax, 0x18508048
add eax, r11d
add eax, 0x2881c90
xor esi, eax
xor esi, 0x1ad89cd8
or r9d, r10d
not r9d
or r9d, esi
imul eax, r9d, 0x1b3
inc rcx
cmp r8, rcx
jne 0x18000b740
pop rsi
ret
Function at 0x180014890
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
cmp byte [0x18001fcae], 0
jne 0x1800149af
xor eax, eax
lea rdx, [0x18001fcaa]
nop
movzx r10d, byte [rcx + rax]
movzx ebx, byte [rcx + rax + 0x1b]
mov esi, ebx
not sil
mov r8d, r10d
not r8b
mov r14d, ebx
xor r14b, 0x92
and r14b, sil
mov edi, ebx
and dil, 0xd
mov r11d, r10d
or r11b, 0xd
or r8b, 0xf2
mov r9d, ebx
and r9b, 0x62
and sil, 0x90
or r9b, sil
mov r15d, r9d
xor r15b, 0x9d
mov ebp, r9d
xor bpl, 0xb
and bpl, r15b
and r14b, 0xf2
mov r15d, ebp
and r15b, r14b
and bpl, 0xf2
xor bpl, r14b
or bpl, r15b
or bpl, dil
xor bpl, 0x60
and bl, 0x6f
or bl, sil
xor bl, 0x62
or r9b, dil
xor r9b, 0x9d
or r9b, bl
not r9b
or r9b, bpl
mov esi, r8d
and sil, 0x63
mov ebx, r10d
and bl, 0xc
or bl, sil
mov esi, ebx
mov edi, r11d
and r10b, 8
mov ebp, ebx
and bpl, 0x45
or bpl, r10b
xor bpl, r11b
xor bl, 0x9c
and bl, r11b
xor r11b, 0x4a
and r8b, 0x4a
or r8b, 0x95
and sil, 5
xor sil, r8b
mov r8d, esi
xor r8b, 0x6b
xor dil, 0xb5
and dil, r8b
xor sil, 0x94
and sil, r11b
or sil, dil
xor bpl, 0xbe
or bl, bpl
not bl
or bl, sil
xor bl, r9b
mov byte [rax + rdx], bl
inc rax
cmp rax, 4
jne 0x1800148b0
mov byte [0x18001fcae], 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x180014ae0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
cmp byte [0x18001fd03], 0
jne 0x180014c0a
xor r8d, r8d
movabs r9, 0x642c8590b21642c9
lea r10, [0x18001fcdf]
nop dword [rax + rax]
mov rax, r8
mul r9
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rdx, rax, 0xffffffffffffffe9
lea r11, [rcx + r8]
movzx eax, byte [rcx + r8 + 0x17]
movzx r11d, byte [rdx + r11]
mov esi, r11d
or sil, 0x51
mov r14d, r11d
and r14b, 0xae
mov ebp, r14d
xor bpl, 0xae
mov r15d, r11d
xor r15b, 0x51
or bpl, r15b
mov edi, ebp
not dil
mov ebx, eax
xor bl, 0xae
and r15b, 0x11
mov edx, edi
and dl, 0xee
or dl, r15b
mov r15d, edi
and r15b, 2
mov r12d, ebp
and r12b, 0x2c
or r12b, r15b
mov r15d, ebp
and r15b, 0xd0
and dil, 1
or dil, r15b
or r12b, 0xd0
or dil, 2
xor dil, r12b
xor dil, r14b
add dil, 0x80
mov r14d, edx
and r14b, 0x99
and bpl, 0x66
or bpl, r14b
or r11b, 0x40
and r11b, 0xee
xor r11b, bpl
xor r11b, 0x99
xor dl, 0xee
and dl, sil
or dl, r11b
not dl
or dl, dil
mov r11d, eax
and r11b, 0xeb
xor r11b, 0x41
xor al, 0x45
and al, bl
or al, r11b
mov r11d, edx
and r11b, 0xeb
or r11b, 4
and dl, 0x14
xor dl, r11b
xor dl, al
xor dl, 0xef
mov byte [r8 + r10], dl
inc r8
cmp r8, 0x24
jne 0x180014b10
mov byte [0x18001fd03], 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x180014c20
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
movdqa xmmword [rsp + 0x50], xmm11
movdqa xmmword [rsp + 0x40], xmm10
movdqa xmmword [rsp + 0x30], xmm9
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp byte [0x18001fe80], 0
jne 0x180014ed4
lea rdx, [rcx + 0x26]
lea rax, [0x18001fe70]
cmp rdx, rax
jbe 0x180014d6e
lea rdx, [0x18001fe80]
cmp rcx, rdx
jae 0x180014d6e
xor edx, edx
nop word cs:[rax + rax]
movzx r8d, byte [rcx + rdx]
movzx r10d, byte [rcx + rdx + 0x16]
mov r9d, r10d
not r9b
mov r11d, r10d
xor r11b, 0x20
and r11b, r9b
mov ebx, r11d
not bl
mov esi, r10d
and sil, 0xcc
mov edi, r10d
and dil, 2
and r9b, 0x31
or r9b, dil
mov ebp, r9d
xor bpl, 2
mov edi, ebp
lea r14d, [rsi + 0x13]
and bpl, 0x13
and r10b, 0x20
or r10b, bpl
mov ebp, esi
or r10b, 0xc0
xor r10b, sil
not sil
or dil, bl
or bl, 8
and bl, 0x39
and r11b, 2
or r11b, bl
mov ebx, r9d
or bl, 0x6c
xor bl, r11b
not dil
and dil, 0x13
or dil, bl
xor bpl, 0xa8
and bpl, dil
not dil
and dil, r14b
or bpl, dil
xor r10b, 0xe0
xor r9b, 0xfd
and r9b, sil
or r9b, r10b
not r9b
or r9b, bpl
mov r10d, r8d
xor r10b, 0x33
mov r11d, r10d
and r11b, 0x17
mov ebx, r8d
and bl, 0x48
or bl, r11b
and r10b, 0x20
and r8b, 0x80
or r8b, r10b
or r8b, bl
xor r8b, r9b
mov byte [rdx + rax], r8b
inc rdx
cmp rdx, 0x10
jne 0x180014c90
jmp 0x180014ecd
movdqu xmm0, xmmword [rcx]
movdqu xmm3, xmmword [rcx + 0x16]
movdqa xmm2, xmmword [str.3333333333333333]
movdqa xmm8, xmm3
pandn xmm8, xmm2
movdqa xmm1, xmmword [0x18001a170]
pand xmm1, xmm3
pcmpeqd xmm5, xmm5
movdqa xmm9, xmmword [0x180019e40]
movdqa xmm4, xmm3
pand xmm4, xmm9
movdqa xmm6, xmm3
pandn xmm6, xmmword [str.11111111111111119999999999999999llllllllllllllll]
por xmm6, xmm4
movdqa xmm7, xmm6
pxor xmm7, xmm9
movdqa xmm4, xmmword [0x180019de0]
movdqa xmm10, xmm3
pxor xmm10, xmm4
pand xmm10, xmm8
movdqa xmm8, xmm10
pxor xmm8, xmm5
movdqa xmm11, xmm10
pandn xmm11, xmmword [0x18001a190]
pand xmm10, xmm9
por xmm10, xmm11
movdqa xmm9, xmmword [0x18001a1a0]
por xmm9, xmm6
pxor xmm9, xmm10
por xmm8, xmm7
pandn xmm8, xmmword [0x180019fc0]
por xmm8, xmm9
movdqa xmm9, xmmword [0x18001a1b0]
movdqa xmm10, xmm1
por xmm10, xmm9
movdqa xmm11, xmmword [0x18001a1c0]
pxor xmm11, xmm1
pand xmm11, xmm8
pand xmm7, xmm9
pand xmm3, xmm4
por xmm3, xmm7
por xmm3, xmmword [0x18001a1d0]
pandn xmm8, xmm10
pxor xmm3, xmm1
pxor xmm3, xmmword [0x18001a1e0]
por xmm11, xmm8
pxor xmm6, xmmword [0x18001a1f0]
pandn xmm1, xmm6
por xmm1, xmm3
pxor xmm1, xmm5
por xmm1, xmm11
pxor xmm2, xmm0
movdqa xmm3, xmmword [0x18001a200]
pand xmm3, xmm2
movdqa xmm5, xmmword [str.HHHHHHHHHHHHHHHH]
pand xmm5, xmm0
pand xmm2, xmm4
pand xmm0, xmmword [0x18001a220]
por xmm0, xmm2
por xmm0, xmm5
por xmm0, xmm3
pxor xmm0, xmm1
movdqa xmmword [0x18001fe70], xmm0
mov byte [0x18001fe80], 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
movaps xmm9, xmmword [rsp + 0x30]
movaps xmm10, xmmword [rsp + 0x40]
movaps xmm11, xmmword [rsp + 0x50]
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x180014f00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x18001feb0], 0
jne 0x18001500c
lea rdx, [rcx + 0x22]
lea rax, [0x18001fea0]
cmp rdx, rax
jbe 0x180014f88
lea rdx, [0x18001feb0]
cmp rcx, rdx
jae 0x180014f88
xor edx, edx
nop dword [rax + rax]
movzx r8d, byte [rcx + rdx]
movzx r9d, byte [rcx + rdx + 0x12]
mov r10d, r8d
and r10b, 0x21
mov r11d, r8d
and r11b, 0xc8
or r10b, 0x54
xor r10b, r11b
and r8b, 0x16
or r8b, 8
xor r8b, r10b
xor r8b, 0x4a
mov r10d, r9d
xor r10b, 0xe9
xor r9b, r8b
xor r9b, 0x16
and r9b, r8b
or r10b, r8b
not r10b
or r10b, r9b
mov byte [rdx + rax], r10b
inc rdx
cmp rdx, 0x10
jne 0x180014f30
jmp 0x180015005
movdqu xmm1, xmmword [rcx]
movdqu xmm0, xmmword [rcx + 0x12]
movdqa xmm2, xmmword [str.________________]
pand xmm2, xmm1
movdqa xmm3, xmmword [0x18001a240]
pand xmm3, xmm1
por xmm2, xmmword [str.TTTTTTTTTTTTTTTT]
pxor xmm2, xmm3
movdqa xmm3, xmmword [0x18001a260]
pand xmm1, xmm3
por xmm1, xmmword [str._b_b_b_b_b_b_b_b_b_b_b_b_b_b_b_bJJJJJJJJJJJJJJJJ]
pxor xmm1, xmm2
pxor xmm1, xmmword [0x18001a280]
movdqa xmm2, xmmword [0x18001a290]
pxor xmm2, xmm0
pxor xmm0, xmm3
pxor xmm0, xmm1
pand xmm0, xmm1
por xmm2, xmm1
pcmpeqd xmm1, xmm1
pxor xmm1, xmm2
por xmm1, xmm0
movdqa xmmword [0x18001fea0], xmm1
mov byte [0x18001feb0], 1
ret

Function at 0x180015010
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x18001fed1], 0
jne 0x1800150ea
lea rdx, [rcx + 0x22]
lea rax, [0x18001fec0]
cmp rdx, rax
jbe 0x18001503d
lea rdx, [0x18001fed1]
cmp rcx, rdx
jae 0x18001503d
xor edx, edx
jmp 0x1800150a0
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x11]
pcmpeqd xmm2, xmm2
pxor xmm2, xmm1
pandn xmm1, xmm0
por xmm2, xmm0
movdqa xmm0, xmmword [0x18001a2a0]
movdqa xmm3, xmm1
pxor xmm3, xmm0
movdqa xmm4, xmmword [str.mmmmmmmmmmmmmmmm]
movdqa xmm5, xmm2
pxor xmm5, xmm4
pxor xmm1, xmm4
pand xmm1, xmm5
pxor xmm2, xmm0
pand xmm2, xmm3
por xmm2, xmm1
movdqa xmmword [0x18001fec0], xmm2
mov edx, 0x10
nop word [rax + rax]
movzx r8d, byte [rcx + rdx]
movzx r9d, byte [rcx + rdx + 0x11]
not r9b
mov r10d, r8d
and r10b, r9b
or r9b, r8b
mov r8d, r10d
xor r8b, 0x92
mov r11d, r9d
xor r11b, 0x6d
xor r10b, 0x6d
and r10b, r11b
xor r9b, 0x92
and r9b, r8b
or r9b, r10b
mov byte [rdx + rax], r9b
inc rdx
cmp rdx, 0x11
jne 0x1800150a0
mov byte [0x18001fed1], 1
ret

Function at 0x180015130
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x18001ff19], 0
jne 0x1800151a0
xor r8d, r8d
movabs r9, 0xe38e38e38e38e38f
lea r10, [0x18001ff03]
nop dword [rax]
mov rax, r8
mul r9
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
lea rdx, [rcx + r8]
sub rdx, rax
movzx eax, byte [rcx + r8 + 0x12]
movzx edx, byte [rdx]
not al
mov r11d, edx
and r11b, al
or al, dl
mov edx, eax
and dl, 0x85
xor dl, r11b
and al, 0x7a
or al, 5
xor al, dl
xor al, 0xfa
mov byte [r8 + r10], al
inc r8
cmp r8, 0x16
jne 0x180015150
mov byte [0x18001ff19], 1
ret
Function at 0x1800151b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
cmp byte [0x18001ffb1], 0
jne 0x180015261
xor r8d, r8d
movabs r9, 0xaaaaaaaaaaaaaaab
lea r10, [0x18001ff96]
nop word cs:[rax + rax]
mov rax, r8
mul r9
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
lea rdx, [rcx + r8]
sub rdx, rax
movzx r11d, byte [rcx + r8 + 0x18]
mov ebx, r11d
not bl
movzx eax, byte [rdx]
mov esi, r11d
xor sil, 0x21
mov edi, eax
xor dil, 0x21
mov edx, r11d
xor dl, 0xbf
and dl, sil
mov esi, eax
and sil, 0x9e
xor al, 0xbf
and al, dil
or r11b, 0x21
and r11b, 0xbf
xor r11b, dl
xor r11b, 0xbf
and dl, bl
and dl, 0x9e
or dl, r11b
xor sil, al
and al, 0x9e
xor sil, 0x9e
or sil, al
xor sil, dl
mov byte [r8 + r10], sil
inc r8
cmp r8, 0x1b
jne 0x1800151e0
mov byte [0x18001ffb1], 1
pop rbx
pop rdi
pop rsi
ret

Function at 0x180015270
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
cmp byte [0x18001ffcc], 0
jne 0x180015305
lea r10, [rcx + 1]
mov r8d, 1
xor r9d, r9d
movabs r11, 0xf0f0f0f0f0f0f0f1
lea rsi, [0x18001ffb2]
nop dword [rax]
mov rax, r8
mul r11
mov rax, rdx
shr rax, 4
and rdx, 0xfffffffffffffff0
add rdx, rax
mov rdi, r10
sub rdi, rdx
mov rax, r9
mul r11
mov rax, rdx
shr rax, 4
and rdx, 0xfffffffffffffff0
add rdx, rax
lea rax, [rcx + r9]
sub rax, rdx
movzx eax, byte [rax]
xor al, byte [rcx + r9 + 0x11]
mov byte [r9 + rsi], al
movzx eax, byte [rdi + r9]
xor al, byte [rcx + r9 + 0x12]
mov byte [r9 + rsi + 1], al
add r9, 2
add r8, 2
cmp r9, 0x1a
jne 0x1800152a0
mov byte [0x18001ffcc], 1
pop rdi
pop rsi
ret
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x1401ce880]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x1401ce890]
mov dword [rax], 1
mov rax, qword [0x1401ce8a0]
mov dword [rax], 1
mov rax, qword [0x1401ce7e0]
cmp word [rax], 0x5a4d
jne 0x14000105a
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400010c0
mov rax, qword [0x1401ce870]
mov dword [0x14024800c], ecx
mov eax, dword [rax]
test eax, eax
je 0x1400010b0
mov ecx, 2
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x1401ce970]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg.__p__commode
mov rdx, qword [0x1401ce950]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x1401cd730]
cmp dword [rax], 1
je 0x1400010f8
xor eax, eax
add rsp, 0x28
ret
mov ecx, 1
call sym.__set_app_type
jmp 0x140001077
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x140001110
cmp dx, 0x20b
jne 0x14000105a
cmp dword [rax + 0x84], 0xe
jbe 0x14000105a
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x14000105a
mov rcx, qword [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x14000105a
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x14000105a
Function at 0x14001d9c0
Capabilities:
Encode data using xor

Disassembly:
mov r8, qword [rcx + 0x10]
test r8, r8
je 0x14001da10
mov r9, qword [rcx + 0x18]
xor eax, eax
xor ecx, ecx
xor edx, edx
nop dword [rax + rax]
xor rax, qword [r9 + rdx*8]
lea edx, [rcx + 1]
mov rcx, rdx
cmp rdx, r8
jb 0x14001d9d8
mov edx, 6
mov ecx, 0x20
nop dword [rax]
mov r8, rax
shr r8, cl
shr ecx, 1
xor rax, r8
sub edx, 1
jne 0x14001d9f8
and eax, 1
ret
xor eax, eax
jmp 0x14001d9e7

Function at 0x14001e900
Capabilities:
Encode data using xor

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rax, qword [rdx + 0x10]
mov r12, r8
mov r8, qword [r8 + 0x10]
mov rbx, rcx
mov rbp, rdx
cmp r8, rax
jb 0x14001e998
shl r8, 6
xor edx, edx
call method.CryptoPP::PolynomialMod2.PolynomialMod2_unsigned_long_long__unsigned_long_long_
mov r10, qword [rbp + 0x10]
mov rdx, qword [r12 + 0x18]
mov r8, qword [rbp + 0x18]
mov rcx, qword [rbx + 0x18]
test r10, r10
je 0x14001e961
xor eax, eax
nop dword [rax + rax]
mov r9, qword [rdx + rax*8]
xor r9, qword [r8 + rax*8]
mov qword [rcx + rax*8], r9
add rax, 1
cmp r10, rax
jne 0x14001e948
mov r10, qword [rbp + 0x10]
lea rax, [r10*8]
add rdx, rax
add rcx, rax
cmp rdx, rcx
je 0x14001e985
mov r8, qword [r12 + 0x10]
sub r8, r10
shl r8, 3
call sym.memcpy
mov rax, rbx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
shl rax, 6
lea rdi, [rsp + 0x20]
xor edx, edx
mov r8, rax
mov rcx, rdi
call method.CryptoPP::PolynomialMod2.PolynomialMod2_unsigned_long_long__unsigned_long_long_
mov r9, qword [r12 + 0x10]
mov r8, qword [r12 + 0x18]
mov rdx, qword [rbp + 0x18]
mov rsi, qword [rsp + 0x38]
test r9, r9
je 0x14001e9ea
xor eax, eax
nop dword [rax + rax]
mov rcx, qword [rdx + rax*8]
xor rcx, qword [r8 + rax*8]
mov qword [rsi + rax*8], rcx
add rax, 1
cmp rax, r9
jne 0x14001e9d0
mov r9, qword [r12 + 0x10]
lea rcx, [r9*8]
add rdx, rcx
add rcx, rsi
cmp rdx, rcx
je 0x14001ea0d
mov r8, qword [rbp + 0x10]
sub r8, r9
shl r8, 3
call sym.memcpy
mov rdx, rdi
mov rcx, rbx
call method.CryptoPP::PolynomialMod2.PolynomialMod2_CryptoPP::PolynomialMod2_const_
test rsi, rsi
je 0x14001e985
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
cmp rcx, rax
cmova rcx, rax
lea rdx, [rsi + rcx*8]
lea rax, [rcx - 1]
test rcx, rcx
je 0x14001ea51
nop
sub rdx, 8
mov qword [rdx], 0
sub rax, 1
jae 0x14001ea40
mov rcx, rsi
call method.CryptoPP.UnalignedDeallocate_void_
mov rax, rbx
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x14001eb60
Capabilities:
Encode data using xor

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
movabs r12, 0x1fffffffffffffff
mov rdi, r8
mov rsi, rcx
mov rcx, rdx
mov rbp, rdx
call method.CryptoPP::PolynomialMod2.BitCount___const
mov rcx, rdi
mov r11d, eax
call method.CryptoPP::PolynomialMod2.BitCount___const
xor edx, edx
mov rcx, rsi
lea r8d, [r11 + rax]
call method.CryptoPP::PolynomialMod2.PolynomialMod2_unsigned_long_long__unsigned_long_long_
mov rcx, rdi
call method.CryptoPP::PolynomialMod2.BitCount___const
lea ebx, [rax - 1]
test ebx, ebx
js 0x14001ec17
nop
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x14001ebf3
mov r10, qword [rsi + 0x18]
test eax, eax
je 0x14001ebf3
sub eax, 1
xor r9d, r9d
lea r8, [r10 + rax*8 + 8]
mov rax, r10
nop
mov rcx, qword [rax]
add rax, 8
lea rdx, [rcx + rcx]
shr rcx, 0x3f
or rdx, r9
mov r9, rcx
mov qword [rax - 8], rdx
cmp rax, r8
jne 0x14001ebd0
test rcx, rcx
jne 0x14001ec30
mov rax, rbx
shr rax, 6
cmp rax, qword [rdi + 0x10]
jae 0x14001ec0e
mov rdx, qword [rdi + 0x18]
mov rax, qword [rdx + rax*8]
bt rax, rbx
jb 0x14001ec58
sub rbx, 1
cmp ebx, 0xffffffff
jne 0x14001ebb0
mov rax, rsi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov rdx, qword [rsi + 0x10]
lea r13, [rdx + 1]
cmp rdx, r13
jb 0x14001ec88
mov r13, 0xffffffffffffffff
mov qword [rsi + 8], r12
mov qword [r10 + r13*8 - 8], 1
jmp 0x14001ebf3
mov r8, qword [rbp + 0x10]
mov r9, qword [rbp + 0x18]
mov rdx, qword [rsi + 0x18]
test r8, r8
je 0x14001ec0e
xor eax, eax
nop dword [rax + rax]
mov rcx, qword [r9 + rax*8]
xor qword [rdx + rax*8], rcx
add rax, 1
cmp rax, r8
jne 0x14001ec70
jmp 0x14001ec0e
mov r9d, 1
mov r8, r13
mov rcx, r10
call method.CryptoPP::AllocatorWithCleanup_unsigned_long_long__false_::pointer_CryptoPP::StandardReallocate_unsigned_long_long__CryptoPP.AllocatorWithCleanup_unsigned_long_long__false____CryptoPP::AllocatorWithCleanup_unsigned_long_long__false___unsigned_long
mov qword [rsi + 0x18], rax
mov r10, rax
mov qword [rsi + 0x10], r13
jmp 0x14001ec44
Function at 0x140020970
Capabilities:
Encode data using base64

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov eax, dword [rcx + 0x94]
sub eax, dword [rcx + 0x98]
mov rbx, rcx
cmp eax, 0x3f
ja 0x140020a88
movdqu xmm0, xmmword [0x1401c3430]
lea rsi, [rsp + 0x40]
lea r9, [rcx + 0x70]
mov r8, rdx
lea r12, [rsp + 0x20]
mov rdx, rsi
mov qword [rsp + 0x38], 0
mov rcx, r12
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x58], 0
movups xmmword [rsp + 0x48], xmm0
call method.CryptoPP::PolynomialMod2.Divide_CryptoPP::PolynomialMod2__CryptoPP::PolynomialMod2__CryptoPP::PolynomialMod2_const__CryptoPP::PolynomialMod2_const_
mov r8, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
test r8, r8
je 0x140020a29
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
cmp rcx, rax
cmova rcx, rax
lea rdx, [r8 + rcx*8]
lea rax, [rcx - 1]
test rcx, rcx
je 0x140020a21
nop dword [rax + rax]
sub rdx, 8
mov qword [rdx], 0
sub rax, 1
jae 0x140020a10
mov rcx, r8
call method.CryptoPP.UnalignedDeallocate_void_
mov rdx, qword [rbx + 0x60]
mov rcx, qword [rbx + 0x68]
xor r9d, r9d
mov r8, r13
lea rbp, [rbx + 0x50]
call method.CryptoPP::AllocatorWithCleanup_unsigned_long_long__false_::pointer_CryptoPP::StandardReallocate_unsigned_long_long__CryptoPP.AllocatorWithCleanup_unsigned_long_long__false____CryptoPP::AllocatorWithCleanup_unsigned_long_long__false___unsigned_long
movabs r12, 0x1fffffffffffffff
mov qword [rbx + 0x68], rax
mov qword [rbx + 0x60], r13
mov qword [rbx + 0x58], r12
test rax, rax
je 0x140020aa0
test rdi, rdi
je 0x140020ad9
lea r8, [r13*8]
mov rdx, rdi
mov rcx, rax
call sym.memcpy
cmp rsi, r13
mov r8, r13
mov qword [rbx + 0x58], r12
cmovbe r8, rsi
jmp 0x140020aaf
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp method.CryptoPP::GF2NT.Reduced_CryptoPP::PolynomialMod2_const__const__clone_.part.0_
cmp rsi, r13
mov r8, r13
cmovbe r8, rsi
test rdi, rdi
je 0x140020ad9
lea rdx, [rdi + r8*8]
lea rax, [r8 - 1]
test r8, r8
je 0x140020ad1
nop dword [rax]
sub rdx, 8
mov qword [rdx], 0
sub rax, 1
jae 0x140020ac0
mov rcx, rdi
call method.CryptoPP.UnalignedDeallocate_void_
mov rax, rbp
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret