joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d88ff10
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6d8b15e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d890098
mov rax, qword [0x6d8b15e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d88ff5c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d88ffe5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d88ff40
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d8900cd
mov rax, qword [0x6d8b15e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6d8b15e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d8900b0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d88ffde
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d890040
add dword [0x6d8b15e4], 1
cmp edi, 8
jae 0x6d890013
test dil, 4
jne 0x6d890084
test edi, edi
je 0x6d890008
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d89009f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d890008
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d89002c
jmp 0x6d890008
add rsi, qword [0x6d8b15e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d88ffde
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d890008
xor esi, esi
jmp 0x6d88ff67
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d890008
mov rax, qword [0x6d8b15e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d890820
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6d8b18c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6d8b18a0]
test rbx, rbx
je 0x6d890874
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d89086b
test rsi, rsi
je 0x6d89086b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d890850
lea rcx, [0x6d8b18c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d890ab0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d890ac0
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d890ad0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d890b11
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d890b08
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d890b13
add rax, 0x28
cmp rax, r9
jne 0x6d890af4
xor eax, eax
ret

Function at 0x6d890bb0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8ae1f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d890c1d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d890c1d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d890c1d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d890c14
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d890c1f
add rax, 0x28
cmp rax, r9
jne 0x6d890c00
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d890d20
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6d8ae1f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d890d40
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d890d38
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d890d9d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d890d94
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d890da4
add rax, 0x28
cmp rax, r9
jne 0x6d890d80
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d890dc0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6d8ae1f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d890e2e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d890e2e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d890e2e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d890e2e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d890e25
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d890e35
add rcx, 0x28
cmp rcx, rax
jne 0x6d890e10
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d890e48
jmp 0x6d890e2e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d890e56
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d890e2e
test r9d, r9d
jg 0x6d890e40
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d8911c0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140025ca0
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x140025d6f
mov qword [rsp + 0x10], rbx
xchg rdi, rbp
mov qword [rsp + 0x18], rdi
xchg rbp, rdi
nop
push 0x11aa8673
mov qword [rsp], rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
mov rbx, rdx
xchg rcx, r11
mov rdi, r11
xchg r11, rcx
mov esi, r8d
sub rdi, rdx
mov rbp, rcx
sub rdi, 0xffffffffffffff10
dec rsi
shr rsi, 3
shr rsi, 1
inc rsi
nop dword [rax]
movups xmm0, xmmword [rbx]
xchg rdx, r15
mov r15, rbp
xchg r15, rdx
mov rcx, rbx
call fcn.140026250
mov ecx, 0x10
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140025d1e
sub rdi, 0x10
movups xmmword [rbp + 0xf0], xmm0
sub rsi, 1
jne 0x140025cf8
mov rdi, qword [rsp + 0x30]
xchg r14, rbx
mov r14, qword [rsp + 0x38]
xchg r14, rbx
xchg rbp, r9
mov r9, qword [rsp + 0x40]
xchg rbp, r9
add rsp, 0x20
nop
add rsp, 8
mov rsi, qword [rsp - 8]
ret

Function at 0x140025d70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
xchg rsi, r12
mov qword [rsp + 0x18], r12
xchg rsi, r12
push rdi
sub rsp, 0x20
mov edi, r8d
xchg rbx, rdx
mov rdx, rbx
xchg rdx, rbx
lea r9, [rcx + 0xf0]
xchg rsi, r10
mov r10, rcx
xchg r10, rsi
test r8d, r8d
je 0x140025e1f
dec rdi
shr rdi, 1
shr rdi, 3
inc rdi
nop dword [rax]
nop word [rax + rax]
xchg rdx, rax
mov rdx, rbx
xchg rdx, rax
sub r9, rbx
mov edx, 0x10
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140025ddd
mov rdx, rsi
mov rcx, rbx
call fcn.140025eb0
xchg rbx, r10
mov r9, r10
xchg r10, rbx
nop
add rbx, 0x24555600
sub rbx, 0x245555f0
sub rdi, 1
jne 0x140025dc9
movups xmm0, xmmword [r9]
xchg rbx, r13
mov r13, qword [rsp + 0x30]
xchg rbx, r13
mov rbp, qword [rsp + 0x38]
movups xmmword [rsi + 0xf0], xmm0
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret
Function at 0x140026250
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rbx
mov qword [rsp + 8], rdx
xchg rdx, rbx
mov qword [rsp + 0x10], rbp
xchg rsi, r15
mov qword [rsp + 0x18], r15
xchg rsi, r15
xchg r9, rdi
mov qword [rsp + 0x20], r9
xchg r9, rdi
nop
sub rsp, 8
mov qword [rsp], r14
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
sub rsi, rcx
xchg r8, rcx
mov rcx, r8
xchg rcx, r8
mov r9d, 4
nop dword [rax]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rsi + r8 + 0xe0]
xor byte [r8], al
inc r8
sub rcx, 1
jne 0x1400262af
sub r9, 1
jne 0x14002629f
mov bpl, 0xd
lea rdi, [rsi + 0xd0]
lea r14, [0x140001220]
nop dword [rax]
movzx eax, byte [rbx + 9]
xchg rbx, r14
mov r9, r14
xchg rbx, r14
movzx ecx, byte [rbx + 0xd]
mov r10d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax]
xchg rsi, rdx
mov rsi, r9
xchg rsi, rdx
mov r8d, 4
nop dword [rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 4]
movzx ecx, byte [rax + r14]
xor cl, 0xc3
mov byte [rdx - 4], cl
sub r8, 1
jne 0x140026363
inc r9
sub r10, 1
jne 0x14002634d
xchg rbx, rcx
mov rax, rcx
xchg rbx, rcx
lea r8d, [r10 + 4]
nop dword [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x1400263b1
sub r8, 1
jne 0x1400263a1
mov rcx, rbx
call fcn.140026500
sub rdi, 0x10
add bpl, 0xff
jne 0x1400262e7
movzx eax, byte [rbx + 9]
xchg rbx, r14
mov r9, r14
xchg rbx, r14
movzx ecx, byte [rbx + 0xd]
mov r10d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax + rax]
mov rdx, r9
mov r8d, 4
nop dword [rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 4]
movzx ecx, byte [rax + r14]
xor cl, 0xc3
mov byte [rdx - 4], cl
sub r8, 1
jne 0x14002645f
inc r9
sub r10, 1
jne 0x14002644f
lea edx, [r8 + 4]
nop word [rax + rax]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rsi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1400264a7
sub rdx, 1
jne 0x140026497
xchg rdx, rbx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
mov rbp, qword [rsp + 0x38]
xchg rsi, rcx
mov rcx, qword [rsp + 0x40]
xchg rsi, rcx
xchg rdx, rdi
mov rdx, qword [rsp + 0x48]
xchg rdi, rdx
add rsp, 0x20
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x140027110
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg rbx, r12
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x10
xchg rdx, r15
mov rbx, r15
xchg r15, rdx
mov r10, rcx
test r8b, 0xf
je 0x140027154
xor al, al
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret
xor edx, edx
test r8d, r8d
je 0x1400271e5
movdqa xmm2, xmmword [rsp]
nop
xchg rbp, rdx
movdqu xmm1, xmmword [rbp + rbx]
xchg rbp, rdx
test edx, edx
jne 0x140027187
xchg rbx, r10
movdqu xmm2, xmmword [rbx + 0x200]
xchg rbx, r10
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
xorps xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0xd
nop word [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x1400271a5
aesdeclast xmm0, xmmword [r10 + 0x1e0]
xorps xmm0, xmm2
movdqa xmm2, xmm1
xchg r13, rdx
movups xmmword [r13 + r9], xmm0
xchg r13, rdx
neg edx
add edx, 0xfffffff0
neg edx
cmp edx, r8d
jb 0x140027165
xchg rdi, rbx
mov rdi, qword [rsp + 0x20]
xchg rdi, rbx
mov al, 1
add rsp, 0x10
push rcx
push rax
push rax
push rax
push rdx
push rax
xchg qword [rsp + 0x30], rdi
pop rax
pop rdx
pop rax
pop rax
pop rax
pop rcx
add rsp, 8
ret
Function at 0x14002ac20
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
xchg rdi, r13
mov qword [rsp + 0x20], r13
xchg rdi, r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
sub rsp, 0x30
xchg rcx, rsi
mov rcx, rsi
xchg rsi, rcx
mov rax, qword gs:[0x30]
xchg r15, rdi
mov r15, qword [rax + 0x60]
xchg rdi, r15
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
mov qword [rsp + 0x40], rbx
sub rcx, 0xffffffffffffff38
xchg r10, rbx
mov qword [rsp + 0x28], r10
xchg r10, rbx
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002a010
test eax, eax
js 0x14002acb5
cmp qword [rsp + 0x40], rbx
je 0x14002acb5
lea eax, [rbx + 1]
jmp 0x14002ad42
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0x70], 2
jbe 0x14002acd6
mov eax, 2
jmp 0x14002ad42
cmp dword [rcx + 0x74], ebx
jbe 0x14002ace9
mov eax, 3
jmp 0x14002ad42
cmp byte [rdi + 2], bl
je 0x14002acfc
mov eax, 4
jmp 0x14002ad42
cmp r14d, 0xa
jb 0x14002ad25
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002ad25
mov eax, 8
jmp 0x14002ad42
lea rcx, [rsi + 0xb8]
mov edx, 0x99999999
call fcn.14002a5e0
jmp 0x14002ad40
mov eax, ebx
xchg r9, rbx
mov r9, qword [rsp + 0x48]
xchg rbx, r9
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
nop
xchg qword [rsp], r14
add rsp, 8
ret
Function at 0x14005d520
Capabilities:
Encode data using xor

Disassembly:
xchg r9, r14
mov r14, rcx
xchg r14, r9
mov r8d, 0xffffffff
test rcx, rcx
je 0x14005d5dd
cmp byte [rcx], 0
je 0x14005d5dd
test rdx, rdx
jne 0x14005d568
mov rdx, 0xffffffffffffffff
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x14005d552
test rdx, rdx
je 0x14005d5da
xor r10d, r10d
lea r11, [0x140002db0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
xor rcx, qword [rsp]
add rsp, 0x10
shr r8d, 3
shr r8d, 1
shr r8d, 2
shr r8d, 1
shr r8d, 1
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x14005d57a
not r8d
mov eax, r8d
ret

Function at 0x140060d30
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg r15, rdx
mov r15, rcx
xchg rdx, r15
test rax, rax
jne 0x140060d49
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x140060d77
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x140060d74
mov rcx, qword [rdx + 0x10]
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x140060d57
xchg rcx, rax
mov rcx, qword [rdx + 0x10]
xchg rcx, rax
mov byte [rdx], 1
ret

Function at 0x140060d90
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
xchg r11, rcx
mov rbx, r11
xchg rcx, r11
je 0x140060df1
cmp byte [rcx], 0
je 0x140060df1
push rdi
call 0x14082b8ca
and eax, 0x8000ffff
jge 0x140060dc1
dec eax
or eax, 0xffff0000
inc eax
xor word [rbx + 2], ax
xor edx, edx
cmp qword [rbx + 8], rdx
jbe 0x140060dee
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x140060dd6
mov byte [rbx], 0
add rsp, 0x20
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret

Function at 0x140060e00
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rax
mov r13, qword [rcx + 0x10]
xchg r13, rax
xchg r12, rdx
mov r12, rcx
xchg rdx, r12
test rax, rax
jne 0x140060e17
ret
cmp byte [rcx], 0
jne 0x140060e4d
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x140060e4a
nop dword [rax + rax]
xchg r10, rax
mov r10, qword [rdx + 0x10]
xchg r10, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x140060e2a
mov rax, qword [rdx + 0x10]
mov byte [rdx], 1
ret
Function at 0x1400d67f0
Capabilities:
Parse pe header

Disassembly:
xchg r10, rbx
mov qword [rsp + 8], r10
xchg r10, rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
push 0x374dd9f5
mov qword [rsp], rsi
push rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
nop
sub rsp, 8
mov qword [rsp], r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x30
xchg r14, rdi
mov rdi, r8
xchg r14, rdi
xchg rdx, rcx
mov r12, rcx
xchg rdx, rcx
test rdx, rdx
je 0x1400d6a1c
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x1400d6a1c
movsxd rdi, dword [rdx + 0x3c]
add rdi, rdx
cmp dword [rdi], 0x4550
jne 0x1400d6a1c
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x1400d6a1c
xor r15d, r15d
mov r13d, r15d
mov ebp, r15d
cmp r15w, word [rdi + 6]
jae 0x1400d6a11
nop dword [rax]
mov eax, ebp
lea rbx, [rax + rax*4]
shl rbx, 3
mov eax, dword [rdi + rbx + 0x12c]
and eax, 0xc0000000
cmp eax, 0x40000000
jne 0x1400d6a03
mov ecx, 0x60
call fcn.140153fc0
xchg rbx, rsi
mov rbx, rax
xchg rbx, rsi
mov qword [rsp + 0x20], rax
test rax, rax
lea rax, [rdi + 0x114]
je 0x1400d6926
lea r15, [rdi + 0x118]
add r15, rbx
mov r8d, dword [r15]
add rax, rbx
xchg r11, rax
mov qword [rsp + 0x88], r11
xchg r11, rax
mov edx, dword [rax]
add rdx, r12
xchg rcx, r12
mov r12, rsi
xchg rcx, r12
call fcn.1400dd2a0
lea rax, [0x140003e48]
xchg rdi, rax
mov qword [rsi], rdi
xchg rdi, rax
jmp 0x1400d6948
xchg r12, r15
mov rsi, r12
xchg r15, r12
lea r15, [rdi + 0x118]
add r15, rbx
add rax, rbx
xchg rdx, rax
mov qword [rsp + 0x88], rdx
xchg rdx, rax
mov r12d, dword [r15]
mov ecx, r12d
call fcn.140154004
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
test rax, rax
je 0x1400d6979
mov r8d, r12d
xor edx, edx
xchg rbx, rax
mov rcx, rbx
xchg rbx, rax
call fcn.140155046
jmp 0x1400d697b
xor ebx, ebx
mov r8d, dword [r15]
xchg r13, rax
mov r13, qword [rsp + 0x88]
xchg r13, rax
mov edx, dword [rax]
mov r12, qword [rsp + 0x78]
add rdx, r12
xchg rcx, r15
mov r15, rbx
xchg rcx, r15
call fcn.140155070
xchg r12, rax
mov r12, qword [rsi]
xchg r12, rax
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
xchg rsi, rcx
mov rsi, rcx
xchg rsi, rcx
call qword [rax + 0x10]
xchg rsi, r8
mov qword [rsp + 0x88], r8
xchg r8, rsi
mov rdx, qword [r14 + 8]
cmp rdx, qword [r14 + 0x10]
je 0x1400d69e7
mov qword [rdx], rsi
sub qword [r14 + 8], 0xfffffffffffffff8
jmp 0x1400d69fd
lea r8, [rsp + 0x88]
xchg r11, rcx
mov r11, r14
xchg r11, rcx
call fcn.1400d5990
inc r13d
xor r15d, r15d
inc ebp
movzx eax, word [rdi + 6]
cmp ebp, eax
jb 0x1400d689b
test r13d, r13d
setne al
jmp 0x1400d6a1e
xor al, al
xchg rbx, r11
mov r11, qword [rsp + 0x70]
xchg rbx, r11
add rsp, 0x30
nop
mov r15, qword [rsp]
add rsp, 8
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r13, qword [rsp]
add rsp, 8
push rax
push rcx
push rdx
push rbx
push rax
push rcx
push rax
xchg qword [rsp + 0x38], r12
pop rax
pop rcx
pop rax
pop rbx
pop rdx
pop rcx
pop rax
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x1400d6dd0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
xchg r8, r13
mov qword [rsp + 0x18], r13
xchg r13, r8
xchg rdi, rcx
mov qword [rsp + 8], rdi
xchg rdi, rcx
push rbx
push rbp
push rsi
nop
push 0x356749ae
mov qword [rsp], rdi
push r12
push r13
push r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x58
xchg r9, rbp
mov rbx, rbp
xchg r9, rbp
xchg rbx, rsi
mov rbx, rdx
xchg rbx, rsi
xchg rbx, r9
mov rbx, rcx
xchg r9, rbx
xor ebp, ebp
test rdx, rdx
jne 0x1400d6e39
mov eax, ebp
jmp 0x1400d6e64
mov eax, 0x5a4d
cmp word [rdx], ax
je 0x1400d6e53
xchg rbp, rax
mov rbp, rax
xchg rbp, rax
jmp 0x1400d6e64
movsxd rax, dword [rdx + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
cmovne rax, rbp
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x1400d6f76
mov r14d, dword [rax + 0x88]
add r14, rsi
je 0x1400d6f76
mov r15d, dword [r14 + 0x1c]
add r15, rsi
mov r12d, dword [r14 + 0x24]
add r12, rsi
mov r13d, dword [r14 + 0x20]
add r13, rsi
mov edi, ebp
cmp dword [r14 + 0x18], 0
jbe 0x1400d6f4e
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
mov ecx, dword [r13 + rax*4]
add rcx, rsi
movzx eax, word [r12 + rax*2]
mov edx, dword [r15 + rax*4]
add rdx, rsi
cmp rcx, 0xffff
jbe 0x1400d6f42
xchg rcx, rdx
mov qword [rsp + 0xa8], rcx
xchg rdx, rcx
xchg rsi, rcx
mov qword [rsp + 0x30], rsi
xchg rsi, rcx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r9
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400d7015
xchg rsi, rax
mov rsi, qword [rcx]
xchg rsi, rax
lea rdx, [rsp + 0xa8]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
test al, al
je 0x1400d6f4e
mov r8, qword [rsp + 0xb0]
mov r9, qword [rsp + 0xa0]
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x1400d6eb1
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400d6f6f
cmp rcx, rbx
xchg r13, rax
mov r13, qword [rcx]
xchg r13, rax
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], rbp
mov al, 1
jmp 0x1400d6fa5
xchg rcx, r9
mov r9, qword [rbx + 0x38]
xchg rcx, r9
test rcx, rcx
je 0x1400d6fa3
xchg r12, rax
mov r12, qword [rcx]
xchg r12, rax
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
xchg rsi, rbp
mov qword [rbx + 0x38], rsi
xchg rsi, rbp
xor al, al
add rsp, 0x58
push rbx
push rax
push rax
push rcx
push rax
push rcx
xchg qword [rsp + 0x30], r15
pop rcx
pop rax
pop rcx
pop rax
pop rax
pop rbx
add rsp, 8
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
mov r13, qword [rsp]
add rsp, 8
push rax
xchg qword [rsp + 8], r12
add rsp, 0x10
push rax
push rax
push rdx
push rbx
push rax
push rbx
xchg qword [rsp + 0x30], rdi
pop rbx
pop rax
pop rbx
pop rdx
pop rax
pop rax
add rsp, 8
push rax
push rcx
push rax
push rax
push rdx
push rax
push rcx
push rcx
xchg qword [rsp + 0x40], rsi
add rsp, 0x48
nop
mov rbp, qword [rsp]
add rsp, 8
push rax
xchg qword [rsp + 8], rbx
add rsp, 0x10
ret
call fcn.140154dfc
nop
int3