joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b5ab0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x1403985c0]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor ecx, ecx
lea r8d, [rcx + 0xa]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov rbx, rax
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x70]
call fcn.1402ba800
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400b5b38
mov rdx, qword [rdi]
lea rcx, [rsp + 0x70]
call fcn.1400c8680
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea r14, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x70], r14
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x6c], edx
mov r8, rsi
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.1400c6290
lea rcx, [rsp + 0x78]
call fcn.1400c8580
test rax, rax
jne 0x1400b5bbc
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
mov eax, 6
mov edx, 2
cmp qword [rbp + rcx - 0x48], 0
cmovne eax, edx
or eax, dword [rbp + rcx - 0x80]
and eax, 0x17
mov dword [rbp + rcx - 0x80], eax
mov edx, dword [rbp + rcx - 0x7c]
and edx, eax
jne 0x1400b5c95
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x70], r14
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x6c], edx
lea rcx, [rsp + 0x78]
call fcn.1400c5bc0
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x70], rax
mov rax, qword [rsp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x6c], edx
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x18], rax
lea rcx, [rbp + 0x18]
call fcn.140276878
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x1400b5c5b
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x1400b5c56
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400b5ce9
mov rcx, r8
call fcn.140274b00
mov qword [rdi + 0x10], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140274850
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
test dl, 4
je 0x1400b5ca3
lea rbx, str.ios_base::badbit_set
jmp 0x1400b5cb8
test dl, 2
lea rbx, str.ios_base::failbit_set
lea rax, str.ios_base::eofbit_set
cmove rbx, rax
mov edx, 1
lea rcx, [rsp + 0x30]
call fcn.1400aa450
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400aac40
lea rdx, [0x14038fea0]
lea rcx, [rsp + 0x40]
call fcn.140278944
nop
call fcn.14028bbb4
int3
Function at 0x1400b6230
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x1403985c0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rdx
mov ebx, ecx
mov qword [rsp + 0x30], rdx
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x38]
call fcn.1400b5fe0
nop
mov rax, qword [rsp + 0x40]
sub rax, qword [rsp + 0x38]
sar rax, 3
movsxd rbp, eax
mov rcx, rbp
call fcn.140275004
mov rsi, rax
xor r14d, r14d
mov ecx, r14d
test rbp, rbp
jle 0x1400b62b6
nop dword [rax]
mov rdx, qword [rsp + 0x38]
movzx r8d, byte [rdx + rcx*8]
mov byte [rcx + rax], r8b
inc rcx
cmp rcx, rbp
jl 0x1400b62a0
mov eax, dword [0x1403a4054]
cmp eax, 0x1000
jle 0x1400b6323
add eax, ebx
movsxd rbx, eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x40
mov r8, rbp
mov rdx, rbx
mov rcx, qword [0x1403a4058]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov qword [rsp + 0x20], r14
mov r9, rbp
mov r8, rsi
mov rdx, rbx
mov rcx, qword [0x1403a4058]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x20], r14
mov r9d, dword [rsp + 0x30]
mov r8, rbp
mov rdx, rbx
mov rcx, qword [0x1403a4058]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, rsi
call fcn.140274b00
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400b637e
mov rax, qword [rsp + 0x48]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b636b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b63e5
call fcn.140274b00
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r14
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x1400b63b4
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x1400b63af
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400b63eb
mov rcx, r8
call fcn.140274b00
mov qword [rdi + 0x10], r14
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140274850
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.14028bbb4
nop
call fcn.14028bbb4
int3
Function at 0x1400bdfc0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x1403985c0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, rcx
mov qword [rsp + 0x90], rcx
mov r9d, 3
lea r8, [0x140363d50]
xor edx, edx
call fcn.1400c99e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x20], reloc.WS2_32.dll_WSASetLastError
mov dword [rsp + 0x24], 0x40
xor esi, esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rsi
lea rax, str.cmd.exe
mov qword [rsp + 0x38], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400be061
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x58], rsi
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x1400be0c4
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400be0bd
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400be0b8
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400be16e
mov rcx, r8
call fcn.140274b00
mov eax, 0xffffffff
jmp 0x1400be13a
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rsp + 0x98]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400be138
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400be133
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400be16e
mov rcx, r8
call fcn.140274b00
mov eax, edi
mov byte [rbx], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbx + 0x10], rsi
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140274850
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14028bbb4
int3
Function at 0x1400c0320
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x1403985c0]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edi, edi
xor edx, edx
mov ebx, edi
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1400c03b5
nop
lea rdx, [0x140363f58]
lea rcx, [rsp + 0x4c]
call fcn.140297a70
test eax, eax
jne 0x1400c03a3
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jle 0x1400c03a3
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400c0380
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140274850
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400c0750
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x45], 0
je 0x1400c0773
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x44
jb 0x1400c0760
mov byte [rcx + 0x45], 0
mov rax, rcx
ret
Function at 0x1400c4880
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x27], 0
je 0x1400c48a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x26
jb 0x1400c4890
mov byte [rcx + 0x27], 0
mov rax, rcx
ret

Function at 0x1400c48b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3e], 0
je 0x1400c48d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3d
jb 0x1400c48c0
mov byte [rcx + 0x3e], 0
mov rax, rcx
ret

Function at 0x1400c48e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3f], 0
je 0x1400c4903
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3e
jb 0x1400c48f0
mov byte [rcx + 0x3f], 0
mov rax, rcx
ret

Function at 0x1400c4910
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3b], 0
je 0x1400c4933
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3a
jb 0x1400c4920
mov byte [rcx + 0x3b], 0
mov rax, rcx
ret

Function at 0x1400c4940
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x38], 0
je 0x1400c4963
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x37
jb 0x1400c4950
mov byte [rcx + 0x38], 0
mov rax, rcx
ret

Function at 0x1400c4970
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x1400c4993
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x1400c4980
mov byte [rcx + 0x10], 0
mov rax, rcx
ret

Function at 0x1400c49a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5d], 0
je 0x1400c49c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5c
jb 0x1400c49b0
mov byte [rcx + 0x5d], 0
mov rax, rcx
ret

Function at 0x1400c49d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5e], 0
je 0x1400c49f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5d
jb 0x1400c49e0
mov byte [rcx + 0x5e], 0
mov rax, rcx
ret

Function at 0x1400c4a00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x46], 0
je 0x1400c4a23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x45
jb 0x1400c4a10
mov byte [rcx + 0x46], 0
mov rax, rcx
ret

Function at 0x1400c4a30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x35], 0
je 0x1400c4a53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x34
jb 0x1400c4a40
mov byte [rcx + 0x35], 0
mov rax, rcx
ret

Function at 0x1400c4a60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x37], 0
je 0x1400c4a83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x36
jb 0x1400c4a70
mov byte [rcx + 0x37], 0
mov rax, rcx
ret
Function at 0x1400c4a90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x41], 0
je 0x1400c4ab3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x40
jb 0x1400c4aa0
mov byte [rcx + 0x41], 0
mov rax, rcx
ret

Function at 0x1400c4ac0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x42], 0
je 0x1400c4ae3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x41
jb 0x1400c4ad0
mov byte [rcx + 0x42], 0
mov rax, rcx
ret

Function at 0x1400c4af0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5b], 0
je 0x1400c4b13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5a
jb 0x1400c4b00
mov byte [rcx + 0x5b], 0
mov rax, rcx
ret

Function at 0x1400c4b20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5c], 0
je 0x1400c4b43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5b
jb 0x1400c4b30
mov byte [rcx + 0x5c], 0
mov rax, rcx
ret

Function at 0x1400c4b50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x9c], 0
je 0x1400c4b78
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x9b
jb 0x1400c4b60
mov byte [rcx + 0x9c], 0
mov rax, rcx
ret

Function at 0x1400c4b80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa6], 0
je 0x1400c4ba8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa5
jb 0x1400c4b90
mov byte [rcx + 0xa6], 0
mov rax, rcx
ret

Function at 0x1400c4bb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3a], 0
je 0x1400c4bd3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x39
jb 0x1400c4bc0
mov byte [rcx + 0x3a], 0
mov rax, rcx
ret

Function at 0x1400c4be0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x49], 0
je 0x1400c4c03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x48
jb 0x1400c4bf0
mov byte [rcx + 0x49], 0
mov rax, rcx
ret

Function at 0x1400c4c10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3c], 0
je 0x1400c4c33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3b
jb 0x1400c4c20
mov byte [rcx + 0x3c], 0
mov rax, rcx
ret

Function at 0x1400c4c40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x43], 0
je 0x1400c4c63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x42
jb 0x1400c4c50
mov byte [rcx + 0x43], 0
mov rax, rcx
ret

Function at 0x1400c4c70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x39], 0
je 0x1400c4c93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x38
jb 0x1400c4c80
mov byte [rcx + 0x39], 0
mov rax, rcx
ret
Function at 0x1400c4ca0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4a], 0
je 0x1400c4cc3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x49
jb 0x1400c4cb0
mov byte [rcx + 0x4a], 0
mov rax, rcx
ret

Function at 0x1400c4cd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x23], 0
je 0x1400c4cf3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x22
jb 0x1400c4ce0
mov byte [rcx + 0x23], 0
mov rax, rcx
ret

Function at 0x1400c4d00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x40], 0
je 0x1400c4d23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3f
jb 0x1400c4d10
mov byte [rcx + 0x40], 0
mov rax, rcx
ret

Function at 0x1400c4d30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x59], 0
je 0x1400c4d53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x58
jb 0x1400c4d40
mov byte [rcx + 0x59], 0
mov rax, rcx
ret

Function at 0x1400c4d60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5a], 0
je 0x1400c4d83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x59
jb 0x1400c4d70
mov byte [rcx + 0x5a], 0
mov rax, rcx
ret

Function at 0x1400c4d90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x36], 0
je 0x1400c4db3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x35
jb 0x1400c4da0
mov byte [rcx + 0x36], 0
mov rax, rcx
ret

Function at 0x1400c4dc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x1400c4de3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x1400c4dd0
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x1400c4df0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x24], 0
je 0x1400c4e13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x23
jb 0x1400c4e00
mov byte [rcx + 0x24], 0
mov rax, rcx
ret

Function at 0x1400c4e20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x1400c4e43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x1400c4e30
mov byte [rcx + 0x12], 0
mov rax, rcx
ret

Function at 0x1400c4e50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3d], 0
je 0x1400c4e73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3c
jb 0x1400c4e60
mov byte [rcx + 0x3d], 0
mov rax, rcx
ret
Function at 0x1400c5400
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1400c5422
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x1400c549c
mov rdi, r14
mov rcx, rbx
call fcn.1400c9760
test rax, rax
jle 0x1400c5474
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.1402ba160
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400c548c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x1400c5494
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1400c5436
sub r14, rdi
jmp 0x1400c557f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x1400c54b3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400c54b5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400c54e7
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1402ba160
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400c557c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400c5522
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x1400c555d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14028dcd4
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x1400c557c
cmp rbp, rax
ja 0x1400c5530
test rbp, rbp
je 0x1400c557c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14028dcd4
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret

Function at 0x1400c5cc0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0xc], al
je 0x1400c5ce3
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x1400c5cd0
mov byte [rcx + 0xc], 0
lea r8, [rcx + 0xb]
mov rdx, rcx
mov rcx, rbx
call fcn.1400cc310
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400c5d00
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 7], al
je 0x1400c5d23
lea edx, [rax - 0xa]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x1400c5d10
mov byte [rcx + 7], 0
lea r8, [rcx + 6]
mov rdx, rcx
mov rcx, rbx
call fcn.1400cc310
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1400ca920
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x30
mov rax, qword [0x1403985c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r14, rcx
lea r8, [0x14035e4e8]
xor ebx, ebx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rbx
call fcn.14028da1c
mov rbp, qword [rsp + 0x20]
test rbp, rbp
jne 0x1400ca965
lea eax, [rbx - 3]
jmp 0x1400caa27
xor edx, edx
mov rcx, rbp
lea r8d, [rdx + 2]
call fcn.14028cd9c
test eax, eax
je 0x1400ca981
mov ebx, 0xfffffffd
jmp 0x1400caa1b
mov rcx, rbp
mov qword [rsp + 0x60], rsi
call fcn.14028c254
movsxd rsi, eax
test eax, eax
jns 0x1400ca99c
mov ebx, 0xfffffffd
jmp 0x1400caa16
je 0x1400caa16
lea eax, [rsi + 1]
mov qword [rsp + 0x68], rdi
movsxd rcx, eax
lea rdx, [0x14034cba0]
call fcn.14027500c
mov rdi, rax
test rax, rax
jne 0x1400ca9c2
lea ebx, [rax - 2]
jmp 0x1400caa11
xor r8d, r8d
mov byte [rsi + rax], bl
xor edx, edx
mov rcx, rbp
call fcn.14028cd9c
mov r9, rbp
mov r8, rsi
mov edx, 1
mov rcx, rdi
call fcn.14028dcd4
cmp rax, rsi
je 0x1400ca9f9
mov rcx, rdi
call fcn.140274b00
mov ebx, 0xfffffffd
jmp 0x1400caa11
mov r8, rax
mov rdx, rdi
mov rcx, r14
call fcn.1400d65b0
mov rcx, rdi
mov ebx, eax
call fcn.140274b00
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x20]
call fcn.14028c9fc
mov eax, ebx
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140274850
add rsp, 0x30
pop r14
pop rbp
pop rbx
ret