joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180062cc0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x48
movzx edx, byte [rcx]
mov r11, rcx
cmp dl, 0x25
jne 0x180062cf1
cmp byte [rcx + 1], 0x2e
jne 0x180062cf1
cmp byte [rcx + 2], 0x30
jne 0x180062cf1
cmp byte [rcx + 3], 0x66
jne 0x180062cf1
cmp byte [rcx + 4], 0
jne 0x180062cf1
lea rax, [rsp + 0x50]
add rsp, 0x48
ret
mov r8, r11
test dl, dl
je 0x180062d1f
nop dword [rax + rax]
lea rax, [r8 + 1]
cmp dl, 0x25
jne 0x180062d0f
cmp byte [rax], dl
jne 0x180062d1f
cmp dl, dl
cmovne rax, r8
movzx edx, byte [rax + 1]
lea r8, [rax + 1]
test dl, dl
jne 0x180062d00
cmp byte [r8], 0x25
mov r9, r8
jne 0x180062e4e
mov al, 0x25
nop
lea ecx, [rax - 0x41]
movsx r10d, al
cmp cl, 0x19
ja 0x180062d4f
lea ecx, [r10 - 0x41]
mov edx, 1
shl edx, cl
test edx, 0x900
je 0x180062d75
sub al, 0x61
cmp al, 0x19
ja 0x180062d67
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x180062d75
movzx eax, byte [r9 + 1]
inc r9
test al, al
jne 0x180062d30
jmp 0x180062d78
inc r9
cmp r9, r8
jbe 0x180062e4e
cmp byte [r9 - 1], 0x66
jne 0x180062e4e
cmp r8, r11
jne 0x180062d9b
cmp byte [r9], 0
je 0x180062ce7
cmp byte [0x1800789f9], 0
movsd xmm0, qword [0x1800789f0]
movzx eax, word [0x1800789f8]
mov qword [rsp + 0x58], rbx
mov rbx, qword [0x1800821d8]
movsd qword [rsp + 0x30], xmm0
mov word [rsp + 0x38], ax
je 0x180062e17
mov qword [rsp + 0x40], rdi
xor r10d, r10d
movabs rdi, 0x47ae147ae147ae15
nop dword [rax]
mov rax, rdi
mul r10
mov rax, r10
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x32
movzx eax, r10b
sub al, cl
add al, 0x32
xor byte [rsp + r10 + 0x30], al
inc r10
cmp r10, 0xa
jb 0x180062de0
mov rdi, qword [rsp + 0x40]
sub r8d, r11d
mov qword [rsp + 0x28], r9
mov r9d, r8d
mov qword [rsp + 0x20], r11
lea r8, [rsp + 0x30]
mov edx, 0xc01
lea rcx, [rbx + 0x31f8]
call fcn.180035660
lea rax, [rbx + 0x31f8]
mov rbx, qword [rsp + 0x58]
add rsp, 0x48
ret
mov rax, r11
add rsp, 0x48
ret
Function at 0x180067db0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push r14
sub rsp, 0x68
lea rax, [0x18007f568]
movabs r14, 0x2b992ddfa232
mov qword [rcx], rax
mov rsi, rcx
lea rax, [0x18007f570]
mov qword [rcx + 8], rax
mov qword [0x18007f568], r14
mov rax, qword [rcx + 8]
movabs rcx, 0xffffd466d2205dcd
mov qword [rax], rcx
mov rax, qword [rsi]
mov rdx, qword [rax]
cmp rdx, r14
je 0x180067e11
mov rax, qword [rsi + 8]
not rdx
mov qword [rax], rdx
mov al, 1
add rsp, 0x68
pop r14
pop rsi
ret
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x58], rbp
xor ebp, ebp
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x50], rdi
call fcn.18006d0f0
mov rbx, qword [rsp + 0x90]
call fcn.18006a470
mov eax, eax
xor rbx, rax
call fcn.18006a4a0
mov edi, eax
xor rdi, rbx
call fcn.18006d150
call fcn.18006d150
mov rbx, rax
mov qword [rsp + 0x88], rbp
mov rax, qword [0x180082220]
xor rbx, rdi
mov rdi, qword [0x18007f5b8]
movabs rdx, 0x7ffffffdfffe
lea rcx, [rax - 0x10000]
cmp rcx, rdx
jbe 0x180067f13
mov ecx, dword [0x180078f20]
mov r8d, ebp
mov dword [rsp + 0x80], ecx
movabs r9, 0x4e5e0a72f0539783
movzx ecx, word [0x180078f24]
mov word [rsp + 0x84], cx
nop dword [rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [rsp + r8 + 0x80], al
inc r8
cmp r8, 6
jb 0x180067ec0
lea rdx, [rsp + 0x80]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov qword [0x180082220], rax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x88]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rbp
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x38], rdi
xor edx, edx
mov qword [rsp + 0x40], rbp
call fcn.18002be40
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
test al, al
jne 0x180067f59
call fcn.18006a3d0
movsxd rax, dword [rsp + 0x8c]
mov ecx, dword [rsp + 0x88]
shl rcx, 0x20
xor rcx, rax
movabs rax, 0xffffffffffff
xor rcx, rbx
mov rbx, qword [rsp + 0x60]
and rcx, rax
movabs rax, 0x2b992ddfa233
cmp rcx, r14
cmove rcx, rax
mov rax, qword [rsi]
mov qword [rax], rcx
not rcx
mov rax, qword [rsi + 8]
mov qword [rax], rcx
mov al, 1
add rsp, 0x68
pop r14
pop rsi
ret
Function at 0x18006a4d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.18006a400
mov r8, rbx
xor edx, edx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x18006a4d0
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rdi, r8
mov esi, edx
mov rbx, rcx
test rcx, rcx
jne 0x18006a4fe
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov rcx, qword [0x180082238]
movabs rdx, 0x7ffffffdfffe
mov qword [rsp + 0x68], rbp
mov rbp, qword [0x18007f5a8]
lea rax, [rcx - 0x10000]
cmp rax, rdx
jbe 0x18006a5a0
mov eax, dword [0x18007954c]
xor r8d, r8d
mov dword [rsp + 0x60], eax
movabs r9, 0x4e5e0a72f0539783
movzx eax, word [0x180079550]
mov word [rsp + 0x64], ax
nop word [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [rsp + r8 + 0x60], al
inc r8
cmp r8, 6
jb 0x18006a550
lea rdx, [rsp + 0x60]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov rcx, rax
mov qword [0x180082238], rax
test rdi, rdi
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], 0
mov r8d, 1
mov qword [rsp + 0x38], rbp
cmovne r8, rdi
mov qword [rsp + 0x40], 0
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov edx, esi
mov rcx, rbx
call fcn.18002be40
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret

Function at 0x18006a600
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.18006a400
mov r8, rbx
xor edx, edx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp 0x18006a600
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rbx, r8
mov esi, edx
mov rdi, rcx
test rcx, rcx
je 0x18006a720
test rbx, rbx
je 0x18006a720
mov r9, qword [0x180082230]
movabs rcx, 0x7ffffffdfffe
mov qword [rsp + 0x68], rbp
mov rbp, qword [0x18007f5b0]
lea rax, [r9 - 0x10000]
cmp rax, rcx
jbe 0x18006a6d0
mov eax, dword [0x180079544]
xor r8d, r8d
mov dword [rsp + 0x60], eax
movabs r9, 0x4e5e0a72f0539783
movzx eax, word [0x180079548]
mov word [rsp + 0x64], ax
nop word [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [rsp + r8 + 0x60], al
inc r8
cmp r8, 6
jb 0x18006a680
lea rdx, [rsp + 0x60]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov r9, rax
mov qword [0x180082230], rax
mov qword [rsp + 0x30], r9
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], 0
mov r8, rbx
mov qword [rsp + 0x20], rax
mov edx, esi
mov qword [rsp + 0x38], rbp
mov rcx, rdi
mov qword [rsp + 0x40], 0
call fcn.18002be40
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
mov rbx, qword [rsp + 0x70]
xor al, al
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x18006a740
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x70
xor esi, esi
mov rbx, rcx
mov qword [rcx], rsi
add rcx, 8
mov qword [rcx], rsi
mov rdi, qword [0x18007f5f8]
test rdi, rdi
je 0x18006a866
cmp qword [0x18007f600], rsi
je 0x18006a866
cmp qword [0x18007f608], rsi
je 0x18006a866
cmp qword [0x18007f610], rsi
je 0x18006a866
mov rcx, qword [0x180082248]
movabs rdx, 0x7ffffffdfffe
lea rax, [rcx - 0x10000]
cmp rax, rdx
jbe 0x18006a836
mov eax, dword [0x18007955c]
mov r8d, esi
mov dword [r11 + 8], eax
movabs r9, 0x4e5e0a72f0539783
movzx eax, word [0x180079560]
mov word [r11 + 0xc], ax
nop word [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [rsp + r8 + 0x80], al
inc r8
cmp r8, 6
jb 0x18006a7e0
lea rdx, [rsp + 0x80]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov rcx, rax
mov qword [0x180082248], rax
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x40]
mov rcx, rbx
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x48], rdi
xor edx, edx
mov qword [rsp + 0x50], rsi
call fcn.18002be40
jmp 0x18006a8a9
mov eax, dword [0x18007f714]
lea r8, [rsp + 0x40]
xorps xmm0, xmm0
mov byte [rsp + 0x30], 1
mov qword [rsp + 0x28], rsi
xor r9d, r9d
mov edx, 0x1f0003
mov dword [rsp + 0x20], eax
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x40], 0x30
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x58], rsi
call fcn.18002be80
lea r11, [rsp + 0x70]
mov rax, rbx
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x18006a8c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
xor ebp, ebp
mov rbx, rcx
mov qword [rcx], rbp
mov edi, edx
mov qword [rcx + 8], rbp
movabs rdx, 0x7ffffffdfffe
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], rbp
mov qword [rcx + 0x20], rbp
mov rcx, qword [0x180082250]
mov rsi, qword [0x18007f5d0]
lea rax, [rcx - 0x10000]
cmp rax, rdx
jbe 0x18006a990
mov eax, dword [0x180079564]
mov r8d, ebp
mov dword [rsp + 0x60], eax
movabs r9, 0x4e5e0a72f0539783
movzx eax, word [0x180079568]
mov word [rsp + 0x64], ax
nop word [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [rsp + r8 + 0x60], al
inc r8
cmp r8, 6
jb 0x18006a940
lea rdx, [rsp + 0x60]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov rcx, rax
mov qword [0x180082250], rax
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x28], rbp
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x38], rsi
mov edx, edi
mov qword [rsp + 0x40], rbp
call fcn.18002be40
mov rbp, qword [rsp + 0x70]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x18006aa60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rdx, qword [0x180082258]
mov rbx, rcx
mov rdi, qword [0x18007f5f0]
movabs rcx, 0x7ffffffdfffe
lea rax, [rdx - 0x10000]
cmp rax, rcx
jbe 0x18006ab10
mov eax, dword [0x18007956c]
xor r8d, r8d
mov dword [rsp + 0x60], eax
movabs r9, 0x4e5e0a72f0539783
movzx eax, word [0x180079570]
mov word [rsp + 0x64], ax
nop dword [rax]
nop dword [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [rsp + r8 + 0x60], al
inc r8
cmp r8, 6
jb 0x18006aac0
lea rdx, [rsp + 0x60]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov rdx, rax
mov qword [0x180082258], rax
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x38], rdi
mov rcx, rbx
mov qword [rsp + 0x40], 0
call fcn.18002be40
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x18006ab70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rdx, qword [0x180082258]
mov rbx, rcx
mov rdi, qword [0x18007f5d8]
movabs rcx, 0x7ffffffdfffe
lea rax, [rdx - 0x10000]
cmp rax, rcx
jbe 0x18006ac20
mov eax, dword [0x18007956c]
xor r8d, r8d
mov dword [rsp + 0x60], eax
movabs r9, 0x4e5e0a72f0539783
movzx eax, word [0x180079570]
mov word [rsp + 0x64], ax
nop dword [rax]
nop dword [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [rsp + r8 + 0x60], al
inc r8
cmp r8, 6
jb 0x18006abd0
lea rdx, [rsp + 0x60]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov rdx, rax
mov qword [0x180082258], rax
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x38], rdi
mov rcx, rbx
mov qword [rsp + 0x40], 0
call fcn.18002be40
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x18006ac70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rsi
push rdi
sub rsp, 0x50
cmp qword [0x18007f5f8], 0
mov rdi, rcx
je 0x18006ad91
cmp qword [0x18007f600], 0
je 0x18006ad91
cmp qword [0x18007f608], 0
je 0x18006ad91
mov rsi, qword [0x18007f610]
test rsi, rsi
je 0x18006ad91
mov rcx, qword [0x180082248]
movabs rdx, 0x7ffffffdfffe
lea rax, [rcx - 0x10000]
cmp rax, rdx
jbe 0x18006ad50
mov eax, dword [0x18007955c]
xor r8d, r8d
mov dword [rsp + 0x68], eax
movabs r9, 0x4e5e0a72f0539783
movzx eax, word [0x180079560]
mov word [rsp + 0x6c], ax
nop word [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [rsp + r8 + 0x68], al
inc r8
cmp r8, 6
jb 0x18006ad00
lea rdx, [rsp + 0x68]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov rcx, rax
mov qword [0x180082248], rax
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x30]
mov rcx, rdi
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x38], rsi
xor edx, edx
mov qword [rsp + 0x40], 0
call fcn.18002be40
mov rsi, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x18006ade2
mov eax, dword [0x18007f724]
xor r9d, r9d
mov qword [rsp + 0x28], 0
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], eax
call fcn.18002be80
test eax, eax
js 0x18006ade2
mov eax, dword [0x18007f720]
xor r9d, r9d
mov rcx, qword [rdi + 8]
xor r8d, r8d
mov qword [rsp + 0x28], 0
xor edx, edx
mov dword [rsp + 0x20], eax
call fcn.18002be80
mov rsi, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x18006adf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rdx, qword [0x180082258]
mov rbx, rcx
mov rdi, qword [0x18007f5e8]
movabs rcx, 0x7ffffffdfffe
lea rax, [rdx - 0x10000]
cmp rax, rcx
jbe 0x18006aea0
mov eax, dword [0x18007956c]
xor r8d, r8d
mov dword [rsp + 0x60], eax
movabs r9, 0x4e5e0a72f0539783
movzx eax, word [0x180079570]
mov word [rsp + 0x64], ax
nop dword [rax]
nop dword [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [rsp + r8 + 0x60], al
inc r8
cmp r8, 6
jb 0x18006ae50
lea rdx, [rsp + 0x60]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov rdx, rax
mov qword [0x180082258], rax
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x38], rdi
mov rcx, rbx
mov qword [rsp + 0x40], 0
call fcn.18002be40
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x18006aef0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
sub rsp, 0x50
mov eax, r8d
mov rbx, rdx
imul r8, rax, 0xffffffffffffd8f0
cmp qword [0x18007f5f8], 0
mov rbp, rcx
mov qword [rsp + 0x30], r8
je 0x18006b02f
mov rsi, qword [0x18007f600]
test rsi, rsi
je 0x18006b02f
cmp qword [0x18007f608], 0
je 0x18006b02f
cmp qword [0x18007f610], 0
je 0x18006b02f
mov rcx, qword [0x180082240]
movabs rdx, 0x7ffffffdfffe
lea rax, [rcx - 0x10000]
cmp rax, rdx
jbe 0x18006afe0
mov eax, dword [0x180079554]
xor r8d, r8d
mov dword [rsp + 0x78], eax
movabs r9, 0x4e5e0a72f0539783
movzx eax, word [0x180079558]
mov word [rsp + 0x7c], ax
nop
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [rsp + r8 + 0x78], al
inc r8
cmp r8, 6
jb 0x18006af90
lea rdx, [rsp + 0x78]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov rcx, rax
mov qword [0x180082240], rax
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x38]
mov rcx, rbp
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x30]
mov qword [rsp + 0x40], rsi
mov rdx, rbx
mov qword [rsp + 0x48], 0
call fcn.18002be40
test eax, eax
jns 0x18006b080
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
mov rcx, rbx
call fcn.18006adf0
mov eax, dword [0x18007f70c]
lea r8, [rsp + 0x30]
mov rcx, qword [rbp + 8]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], eax
call fcn.18002be80
mov rcx, rbx
test eax, eax
jns 0x18006b07b
call fcn.18006adf0
xor al, al
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
call fcn.18006ab70
mov rbx, qword [rsp + 0x60]
mov al, 1
mov rbp, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret
Function at 0x18006b3a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
call fcn.180034f70
mov rdi, qword [0x18007f5b8]
mov rbx, rax
mov rax, qword [0x180082220]
movabs rdx, 0x7ffffffdfffe
mov qword [rsp + 0x68], 0
lea rcx, [rax - 0x10000]
cmp rcx, rdx
jbe 0x18006b45d
mov ecx, dword [0x18007958c]
xor r8d, r8d
mov dword [rsp + 0x60], ecx
movabs r9, 0x4e5e0a72f0539783
movzx ecx, word [0x180079590]
mov word [rsp + 0x64], cx
nop dword [rax]
nop word [rax + rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [rsp + r8 + 0x60], al
inc r8
cmp r8, 6
jb 0x18006b410
lea rdx, [rsp + 0x60]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov qword [0x180082220], rax
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x68]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x38], rdi
xor edx, edx
mov qword [rsp + 0x40], 0
call fcn.18002be40
mov rax, qword [rsp + 0x68]
xorps xmm0, xmm0
sub rax, qword [0x180082268]
mov ecx, 0x11
cqo
idiv qword [0x180082270]
cvtsi2ss xmm0, rax
movss dword [rbx + 0x10], xmm0
call fcn.18006d0c0
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rbx + 0x140], al
call fcn.18006d0c0
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rbx + 0x141], al
call fcn.18006d0c0
shr eax, 0xf
and al, 1
mov byte [rbx + 0x143], 0
mov byte [rbx + 0x142], al
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x18006c2a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x60
call fcn.180034f70
mov rcx, qword [0x180082280]
lea r8, [rsp + 0x30]
mov rbx, rax
mov dword [rsp + 0x70], 1
xorps xmm0, xmm0
lea rdx, [rsp + 0x70]
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rax
mov r9, qword [rcx]
call qword [r9 + 0x2f8]
movss xmm1, dword [rsp + 0x3c]
movabs rdx, 0x7ffffffdfffe
movss xmm0, dword [rsp + 0x38]
movss dword [rbx + 8], xmm0
movss dword [rbx + 0xc], xmm1
mov rcx, qword [0x180082220]
mov rdi, qword [0x18007f5b8]
mov qword [rsp + 0x80], 0
lea rax, [rcx - 0x10000]
cmp rax, rdx
jbe 0x18006c3a0
mov eax, dword [0x18007958c]
xor r8d, r8d
mov dword [rsp + 0x78], eax
movabs r9, 0x4e5e0a72f0539783
movzx eax, word [0x180079590]
mov word [rsp + 0x7c], ax
nop dword [rax]
mov rax, r9
mul r8
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
movsx eax, al
imul ecx, eax, 0x31
movzx eax, r8b
sub al, cl
add al, 0x31
xor byte [rsp + r8 + 0x78], al
inc r8
cmp r8, 6
jb 0x18006c350
lea rdx, [rsp + 0x78]
movabs rcx, 0x11837e716e5fd5ec
call fcn.18002b600
mov rcx, rax
mov qword [0x180082220], rax
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0x48]
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x28], 0
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x50], rdi
xor edx, edx
mov qword [rsp + 0x58], 0
call fcn.18002be40
mov rax, qword [rsp + 0x80]
xorps xmm0, xmm0
sub rax, qword [0x1800822f8]
cqo
idiv qword [0x180082300]
cvtsi2ss xmm0, rax
movss dword [rbx + 0x10], xmm0
cmp qword [0x1800822d0], 0
mov rax, qword [rsp + 0x80]
mov qword [0x1800822f8], rax
jne 0x18006c41e
call fcn.18006b520
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
Function at 0x140001010
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
test rcx, rcx
je 0x140001046
mov word [rcx], bx
mov rdx, rcx
lea rcx, str._JAVA_VM_OPTIONS
mov r8d, 0x400
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140001046
cmp eax, 0x400
jae 0x140001046
lea eax, [rbx + 1]
jmp 0x140001048
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400057f9
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rax, rax
sub rcx, 0xd55f
add rax, rcx
add rax, 0xd55f
add rcx, 0xd55f
sub rsp, 0x3f0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
and rcx, 0
add rcx, rsi
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x5aa1
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x441e
lea r9, [0x1400015d8]
add byte [rax - 0x7d], cl
invalid
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x1400058b6
je 0x1400058cd
insb byte [rdi], dx
cld
add byte [rax], al
je 0x1400058d7
jne 0x1400058a1
lea rax, [0x140004dca]
add rax, 0xb32
call rax
je 0x140005872
push rsp
ror byte [rax - 0x39], cl
shl dword [rsi], 0x3e
add byte [rax], al
mov rcx, 0x3e26
mov r9d, 0x8d68
mov r10d, 0x92819200
lea eax, [rax]
add byte [rcx - 0x46], al
add byte [rdx - 0xb76d7f], dl
leave
dec rcx
xor byte [rax + rcx], r9b
add r9d, r10d
rol r9d, 1
test rcx, rcx
jne 0x1400058e0
add rax, 0x1ebd
mov rsp, rbp
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x140002880
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov esi, ecx
movabs rdi, 0x5aca5bfdcf2fce59
mov qword [rsp + 0x38], rdi
mov rax, qword [rsp + 0x38]
movabs rcx, 0x7065656c53
xor rcx, rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x28], 1
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x1400028e7
xor eax, eax
nop dword [rax]
mov rcx, qword [rsp + 0x38]
xor qword [rsp + 0x48], rcx
inc rax
mov rcx, qword [rsp + 0x28]
cmp rax, rcx
jb 0x1400028d0
movabs rbx, 0x32336c656e72656b
mov qword [rsp + 0x38], rdi
mov rax, qword [rsp + 0x38]
xor rax, rbx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rdi
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 2
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x140002947
xor eax, eax
nop dword [rax]
mov rcx, qword [rsp + 0x28]
xor qword [rsp + rax*8 + 0x38], rcx
inc rax
mov rcx, qword [rsp + 0x20]
cmp rax, rcx
jb 0x140002930
lea rcx, [rsp + 0x38]
call entry0
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.140001090
imul ecx, esi, 0x3e8
call rax
mov qword [rsp + 0x38], rdi
mov rax, qword [rsp + 0x38]
movabs rcx, 0x636f725074697845
xor rcx, rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x28], rdi
mov rax, qword [rsp + 0x28]
xor rax, 0x737365
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 2
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x1400029d7
xor eax, eax
nop word cs:[rax + rax]
mov rcx, qword [rsp + 0x28]
xor qword [rsp + rax*8 + 0x38], rcx
inc rax
mov rcx, qword [rsp + 0x20]
cmp rax, rcx
jb 0x1400029c0
mov qword [rsp + 0x28], rdi
mov rax, qword [rsp + 0x28]
xor rax, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x48], 2
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x140002a37
xor eax, eax
nop word cs:[rax + rax]
mov rcx, qword [rsp + 0x20]
xor qword [rsp + rax*8 + 0x28], rcx
inc rax
mov rcx, qword [rsp + 0x48]
cmp rax, rcx
jb 0x140002a20
lea rcx, [rsp + 0x28]
call entry0
lea rdx, [rsp + 0x38]
mov rcx, rax
call fcn.140001090
xor ecx, ecx
call rax
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret