joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009c8d0
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, r11
mov rcx, rsp
xchg r11, rcx
mov qword [r11 + 0x20], rbx
push rdi
add rsp, 0xffffffffffffffa0
mov dword [rsp - 0x44], 0x5d669730
xchg r15, rbx
mov r15, qword [rcx]
xchg r15, rbx
lea rax, [r11 - 0x40]
mov qword [r11 + 8], rbp
mov dword [rsp - 0x40], 0x2a1b0a89
xorps xmm0, xmm0
mov qword [r11 - 0x48], rax
mov ebp, r8d
mov rbp, rbp
mov qword [r11 + 0x10], rsi
xchg rdx, rsi
mov rdx, qword [rcx + 0x38]
xchg rdx, rsi
lea rcx, [r11 - 0x48]
mov dword [rsp - 0x14], ebp
mov qword [r11 + 0x18], r14
xchg rdx, r14
mov rdx, r14
xchg r14, rdx
xchg rbx, rsp
movups xmmword [rbx + 0x28], xmm0
xchg rbx, rsp
lea rdx, [rsi + 1]
xchg r14, r14
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
call fcn.140018ab0
xchg rbx, rbx
mov edx, 0x62864455
xor edx, 0x4b3c037a
add edx, 0x4d0c20
add edx, 0x230c02a3
test rsi, rsi
je 0x14009c9f8
mov dword [rsp - 0x38], 0x2d673e41
xchg rdi, r15
mov r15, rax
xchg rdi, r15
sub rbx, rax
xchg r8, rsi
mov rsi, r8
xchg r8, rsi
mov r9d, 0x6197f1f2
sub r9d, 0x37e5905
xor r9d, 0x7b66afea
sub r9d, 0x18ca9e0b
sub r9d, 0xcb497fd
nop word [rax + rax]
mov dword [rsp - 0x3c], ebx
movzx ecx, dx
lea rdi, [rdi + 2]
and cx, r9w
mov dword [rsp - 0x10], 0xe4bbb0e
ror edx, 6
ror edx, 1
ror edx, 1
xor cx, word [rbx + rdi - 2]
xchg r14, r14
mov word [rdi - 2], cx
sub r8, 1
jne 0x14009c9c4
mov dword [rsp - 0x1c], ebp
xor ecx, ecx
mov r8d, ebp
mov word [rax + rsi*2], cx
mov rdx, r14
mov dword [rsp - 0x18], 0x6bcf3bca
mov rcx, qword [rsp + 0x20]
call fcn.14009cad0
mov rcx, qword [rsp + 0x20]
mov ebx, eax
mov r13, r13
xchg r14, rsi
mov rsi, qword [rsp + 0x80]
xchg rsi, r14
lea rax, [rsp + 0x28]
mov rsi, qword [rsp + 0x78]
mov dword [rsp - 0x28], ebx
xchg rbp, r13
mov r13, qword [rsp + 0x70]
xchg rbp, r13
cmp rcx, rax
mov rcx, rcx
jne 0x14009caa5
xor eax, eax
lea rdi, [rsp + 0x28]
xchg r15, r15
mov ecx, 0x1a090d98
add ecx, 0x4ec4b97d
sub ecx, 0x1f8e9b73
xor ecx, 0x5724306b
sub ecx, 0x1e1b1b99
rep stosb byte [rdi], al
mov eax, ebx
xchg rbx, r9
mov r9, qword [rsp + 0x88]
xchg rbx, r9
nop
add rsp, 0x55a46264
sub rsp, 0x55a46204
nop
mov rdi, qword [rsp]
add rsp, 8
ret
call fcn.1400bc0d0
mov rcx, rcx
mov eax, ebx
xchg rbx, r9
mov r9, qword [rsp + 0x88]
xchg r9, rbx
nop
sub rsp, 0x3085b586
add rsp, 0x3085b5e6
pop rdi
ret
Function at 0x14009cad0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp - 0x38], esi
nop
push 0x21ee9554
mov qword [rsp], rdi
add rsp, 0xfffffffffffffdc0
xchg r9, r9
xchg rbx, rdx
mov rdx, rbx
xchg rdx, rbx
xchg r9, rdi
mov r9, rcx
xchg rdi, r9
xor edx, edx
mov dword [rsp - 0x28], ecx
lea rcx, [rsp + 0x30]
mov r8d, 0x6ae8f41f
sub r8d, 0x1adbadd
xor r8d, 0x4ee052c
sub r8d, 0x8ae0df8
xor r8d, 0x65272c7e
call fcn.1400bc6c0
mov rax, qword gs:[0x60]
mov rdx, rdx
mov r8, qword [rax + 0x18]
xchg rbx, rax
mov rbx, qword [r8 + 0x10]
xchg rbx, rax
xchg rsp, r8
mov rsp, qword [rax]
xchg rsp, r8
test r8, r8
je 0x14009cd8a
mov rdi, rdi
mov r8, qword [r8 + 0x50]
test r8, r8
je 0x14009cd8a
mov dword [rsp - 0x2c], 0x18e5be47
mov edx, 0x39b56b94
add edx, 0x85ea9da
add edx, 0x9460832
xor edx, 0x4b5a1ca4
lea rcx, [rsp + 0x30]
mov rsi, rsi
lea r9d, [rdx - 1]
call fcn.1400bd2b0
mov edx, 0x5563f91f
xor edx, 0x347798e9
sub edx, 0x496c9b70
sub edx, 0x17a7c62a
lea rcx, [rsp + 0x30]
call fcn.1400bd3d0
mov dword [rsp - 0x14], edx
test rax, rax
je 0x14009cd53
xor ecx, ecx
xchg rdx, r14
mov r14, rdi
xchg r14, rdx
mov word [rax], cx
xchg rdx, rdx
movabs rax, 0x456daa194c828ee5
sub rax, 0x13d50515
add rax, 0x325d4fbb
sub rax, 0x461008c6
movabs rcx, 0xc9a95e97c38ea6b
sub rcx, 0x5875fbeb
add rcx, 0x32138d11
xor rcx, 0x7ab85dbe
sub rcx, 0x36fd60f
add rcx, qword [0x1404e06b0]
xor rcx, rax
mov dword [rsp - 0x44], 0x1a1101d9
movabs rax, 0x22e6710e1c33ba3a
sub rax, 0x266a964
xor rax, 0x196e989d
xor rax, 0x697e9699
ror rcx, 0x15
add rax, rcx
mov dword [rsp - 0x20], edx
lea rcx, [rsp + 0x20]
call rax
mov rax, qword [0x1404e06a0]
lea r8, [rsp + 0x20]
xchg rbp, rbp
not rax
lea rdx, [rsp + 0x260]
ror rax, 3
ror rax, 3
ror rax, 1
movabs rcx, 0x22840f425a2495f9
sub rcx, 0x29a063a0
add rcx, 0x14b29c1a
add rcx, 0x7fffffff
add rcx, 0x3bb49aa
xor rax, rcx
mov dword [rsp - 0x28], 0x3951e7d8
xchg r9, r15
mov r15, rbx
xchg r9, r15
movabs rcx, 0x44010a280ab6bc61
add rcx, 0x72947a84
sub rcx, 0x35419e94
add rcx, 0x2837b634
add rax, rcx
xchg rsi, rsi
movabs rcx, 0x340d5a166dcf1a51
sub rcx, 0x4d025378
add rcx, 0x4441cfd8
sub rcx, 0x1f9e4854
rol rax, 0x15
rol rax, 0xc
rol rax, 0xc
rol rax, 1
sub rax, rcx
lea rcx, [rsp + 0x30]
mov rcx, rcx
ror rax, 3
ror rax, 2
ror rax, 7
ror rax, 3
ror rax, 1
call rax
xchg rbx, rcx
mov rcx, qword [rsp + 0x250]
xchg rbx, rcx
add rsp, 0x240
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
mov eax, 0x1364710
xor eax, 0x4f922655
sub eax, 0x1eb004b4
add eax, 0x900ba370
mov rbx, qword [rsp + 0x250]
mov dword [rsp - 0x14], 0x17f7d312
sub rsp, 0x697b88cb
add rsp, 0x697b8b0b
pop rdi
mov r15, r15
ret
mov rbx, qword [rsp + 0x250]
mov eax, 0x93b1aef
add eax, 0x12caee67
xor eax, 0x3193a76f
sub eax, 0xbd745c6
add eax, 0x9e4198c2
sub rsp, 0x6a686deb
add rsp, 0x6a68702b
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1400a0b30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x1404e10b4], 0
mov dword [rsp - 0x20], ebx
jne 0x1400a0c39
xor edx, edx
lea r8, [0x1404e10b0]
nop word [rax + rax]
xchg r8, r8
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
mov dword [rsp - 0x18], 0x15f67199
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xchg r11, r11
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
xchg r13, r13
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
mov r9, r9
shr eax, 1
and ecx, 1
neg ecx
mov dword [rsp - 0x38], ebx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x14], ebx
and eax, 1
neg eax
and eax, 0xedb88320
xchg rsi, rsi
xor eax, ecx
mov ecx, eax
shr eax, 1
mov rdx, rdx
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov dword [rsp - 0x30], 0x87cd73b
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
mov dword [rsp - 0x1c], ecx
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
xchg rcx, rcx
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov dword [rsp - 0x14], 0x3b99d9c5
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x1c], 0x2ab4e9e9
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rsp - 0x40], 0x1ca21d4d
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x1400a0b57
ret
Function at 0x1400a69c2
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rcx
mov qword [rsp + 8], r15
xchg rcx, r15
nop
push 0x22ec338f
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
push r12
push r13
mov r15, r15
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
nop
sub rsp, 0xd742c6b
add rsp, 0xd742c43
xchg r14, rdx
mov rdx, r14
xchg r14, rdx
mov r13d, r8d
mov dword [rsp - 0x44], edi
mov edx, 0x3696b013
xor edx, 0x515c5825
sub edx, 0x2e603101
sub edx, 0x3966b735
cmp r8d, edx
mov dword [rsp - 0x40], 0x7762c4a9
jae 0x1400a6961
mov edx, r13d
nop
movabs rcx, 0xffffffff0f7fb4b9
add rcx, 0x2c508a93
xor rcx, 0x7ecf7663
sub rcx, 0x28e41b38
add rcx, 0x7fffffff
add rcx, 0x63c4d209
mov eax, 0x7958c209
sub eax, 0x5315071c
add eax, 0x65285c
xor eax, 0x26a8e34d
mul rdx
cmovo rax, rcx
mov dword [rsp - 0x44], 0x6d13b0fa
xchg rbx, rcx
mov rbx, rax
xchg rcx, rbx
call fcn.1400bbf80
mov dword [rsp - 0x1c], ebp
xchg r15, rax
mov rax, r15
xchg r15, rax
mov byte [rsp + 0x70], 0x52
add byte [rsp + 0x70], 0x20
sub byte [rsp + 0x70], 0x37
sub byte [rsp + 0x70], 0x2c
sub byte [rsp + 0x70], 0xe
xchg r9, rax
mov r9, qword [rsp + 0x60]
xchg r9, rax
lea r12d, [r13 + 0xfffff]
mov r14, r14
xor esi, esi
shr r12d, 0x10
shr r12d, 3
shr r12d, 1
mov ebp, dword [rax + 0x18]
xchg rbx, rbx
test r12d, r12d
je 0x1400a6b18
xchg rbx, rdx
mov qword [rsp + 0x68], rdx
xchg rbx, rdx
mov ecx, 0x403eef3c
sub ecx, 0x143a2a94
xor ecx, 0x44a2e55
sub ecx, 0x283eeafd
xchg rdx, rdi
mov qword [rsp + 0x20], rdx
xchg rdi, rdx
mov edi, esi
mov ebx, r13d
shl edi, 0x12
shl edi, 1
shl edi, 1
xchg rdx, r15
mov r15, rdx
xchg r15, rdx
sub ebx, edi
xchg r10, r10
cmp ebx, ecx
cmova ebx, ecx
xchg r8, rcx
mov r8, rax
xchg r8, rcx
mov r8d, ebx
call fcn.1400a3310
test al, al
mov dword [rsp - 0x14], ebp
je 0x1400a6af2
shr ebx, 1
shr ebx, 1
xor eax, eax
xchg rsp, rsp
shr edi, 2
test ebx, ebx
je 0x1400a6abe
mov r9, r15
xchg rbp, rbp
lea ecx, [rdi + rax]
mov r8d, ebp
xor r8d, dword [r9]
lea r9, [r9 + 4]
xchg r14, r14
xor r8d, 0x734237da
inc eax
mov dword [r14 + rcx*4], r8d
cmp eax, ebx
xchg r10, r10
jb 0x1400a6a96
mov rax, qword [rsp + 0x60]
inc esi
mov dword [rsp - 0x14], 0x249c7321
mov ecx, 0x3b62eab7
xor ecx, 0x556a8086
xor ecx, 0x58c2e6c2
xor ecx, 0x36da8cf3
cmp esi, r12d
jb 0x1400a6a40
jmp 0x1400a6b06
mov byte [rsp + 0x70], 0x2f
xor byte [rsp + 0x70], 0x5c
sub byte [rsp + 0x70], 0x70
xor byte [rsp + 0x70], 3
mov rbx, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x20]
mov dword [rsp - 0x14], 0xbc02eca
xchg r10, rcx
mov r10, r15
xchg r10, rcx
call fcn.1400bbf90
movzx eax, byte [rsp + 0x70]
nop
add rsp, 0x19b11f31
sub rsp, 0x19b11f09
pop r15
pop r14
mov dword [rsp - 0x3c], 0x34dc66ab
pop r13
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
mov rbp, qword [rsp]
add rsp, 8
ret
Function at 0x1400a6b80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rsi, rbp
mov qword [rsp + 0x10], rsi
xchg rbp, rsi
xchg rsi, rdi
mov qword [rsp + 0x20], rdi
xchg rsi, rdi
push rdi
nop
sub rsp, 8
mov qword [rsp], r12
push r13
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
mov qword [rsp - 8], r15
sub rsp, 8
add rsp, 0xffffffffffffffe0
mov r14d, r8d
xchg rdx, r10
mov rdi, r10
xchg r10, rdx
mov r9d, r14d
xchg r13, rcx
mov rcx, r13
xchg r13, rcx
cmp r8d, 0x40000
jb 0x1400a6c09
xchg rdi, rdi
mov r9d, 0x5571cbb1
add r9d, 0x1365d599
sub r9d, 0x2fef6ceb
xor r9d, 0x4871b431
sub r9d, 0x7095806e
nop
movabs rcx, 0xffffffff6428e09e
xor rcx, 0x2f213956
add rcx, 0x243ff07f
add rcx, 0x7fffffff
add rcx, 0x10b635b9
mov eax, 0x17b95c29
add eax, 0x552d91ff
sub eax, 0x340b8da2
sub eax, 0x2f594334
xor eax, 0x9821d56
mul r9
cmovo rax, rcx
mov rcx, rcx
xchg rbx, rax
mov rcx, rbx
xchg rbx, rax
call fcn.1400bbf80
mov esi, dword [r13 + 0x18]
mov rsi, rsi
lea r15d, [r14 + 0xfffff]
shr r15d, 0xa
shr r15d, 5
shr r15d, 1
shr r15d, 2
shr r15d, 1
shr r15d, 1
xor ebx, ebx
xchg rbx, rbx
xchg rbp, rax
mov rax, rbp
xchg rbp, rax
mov r12b, 0x54
xor r12b, 0
xor r12b, 0x29
sub r12b, 0x7c
test r15d, r15d
je 0x1400a6db3
nop
mov dword [rsp - 0x38], 0x67ae7235
mov r8d, ebx
mov r10d, r14d
shl r8d, 0x14
xchg rbp, rbp
xor eax, eax
sub r10d, r8d
shr r8d, 1
shr r8d, 1
cmp r10d, 0x100000
mov dword [rsp - 0xc], edi
jbe 0x1400a6d1b
mov r10d, 0x7adb8b7f
xor r10d, 0x4cb6fc6d
xor r10d, 0x3fd1a49
add r10d, 0x34580bce
sub r10d, 0x69d87929
mov r11d, 0x74f0ee39
sub r11d, 0x1a17edc3
sub r11d, 0x38ca7829
sub r11d, 0x220a884d
jmp 0x1400a6d2e
mov r11d, r10d
mov r13, r13
shr r11d, 2
test r11d, r11d
je 0x1400a6d70
xchg r13, r9
mov r13, rbp
xchg r9, r13
nop dword [rax]
mov dword [rsp - 0x30], ecx
lea edx, [r8 + rax]
mov ecx, esi
xor ecx, dword [rdi + rdx*4]
mov dword [rsp - 0x20], 0x4cd0f9df
lea r9, [r9 + 4]
xor ecx, 0x734237da
inc eax
mov dword [r9 - 4], ecx
mov dword [rsp - 0x14], edx
cmp eax, r11d
jb 0x1400a6d42
mov r8d, r10d
mov dword [rsp - 0x18], 0x267674c7
xchg rbp, r10
mov rdx, r10
xchg r10, rbp
xchg r12, r13
mov rcx, r12
xchg r12, r13
call fcn.1400a3900
xchg rbp, rbp
test al, al
je 0x1400a6db0
inc ebx
cmp ebx, r15d
xchg rdi, rdi
jb 0x1400a6cb0
jmp 0x1400a6db3
xor r12b, r12b
xchg rbp, rdi
mov rcx, rdi
xchg rdi, rbp
call fcn.1400bbf90
mov dword [rsp - 0x1c], 0x1dac0230
xchg r14, rbx
mov r14, qword [rsp + 0x50]
xchg r14, rbx
movzx eax, r12b
xchg r8, r8
mov rbp, qword [rsp + 0x58]
xchg rsi, r13
mov r13, qword [rsp + 0x68]
xchg r13, rsi
add rsp, 0x20
mov dword [rsp - 0x2c], 0x6cef9a76
nop
mov r15, qword [rsp]
add rsp, 8
pop r14
mov dword [rsp - 0x1c], ebx
pop r13
nop
add rsp, 8
mov r12, qword [rsp - 8]
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x1400a6e20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rbp, r11
mov qword [rsp + 0x18], r11
xchg r11, rbp
push rsi
xchg r10, r10
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r12
push r14
nop
sub rsp, 8
mov qword [rsp], r15
mov eax, 0x7160bfe9
sub eax, 0x57ce169b
xor eax, 0x56489d82
xor eax, 0x4fda24ec
call fcn.1400bc840
mov dword [rsp - 0x3c], 0xa6a295e
sub rsp, rax
xchg r13, rcx
mov r15, r13
xchg rcx, r13
call fcn.1400bdc40
mov dword [rsp - 0x34], 0x5ee724fc
mov ebp, eax
and ebp, 0x3fc
jbe 0x1400a6edf
mov rsi, rsi
lea rdi, [rsp + 0x20]
mov esi, ebp
call fcn.1400bdc40
mov dword [rsp - 0x20], 0x69b04844
movzx ebx, ax
shl ebx, 0xc
shl ebx, 2
shl ebx, 1
shl ebx, 1
call fcn.1400bdc40
movzx ecx, ax
xchg r13, r13
lea rdi, [rdi + 4]
or ecx, ebx
mov dword [rdi - 4], ecx
xchg r8, r8
sub rsi, 1
jne 0x1400a6ea4
lea r14d, [rbp*4]
mov eax, 0xd041dda
xor eax, 0x5208e60d
add eax, 0x1d3e8ba1
sub eax, 0x5976878b
sub eax, 0x22d4ffe9
mov ecx, r14d
mul rcx
mov dword [rsp - 0x28], 0x69cc9afd
pushf
movabs rcx, 0xffffffff533f75fd
sub rcx, 0x726b465
add rcx, 0x18405d8c
add rcx, 0x7fffffff
xor rcx, 0x1ba6e0dc
popf
cmovo rax, rcx
xchg r10, r10
xchg r15, rax
mov rcx, r15
xchg r15, rax
call fcn.1400bbf80
xchg r14, r14
mov edi, dword [r15 + 0x18]
lea ebp, [r14 + 0xfffff]
shr ebp, 9
shr ebp, 5
shr ebp, 3
shr ebp, 1
shr ebp, 1
shr ebp, 1
xor ebx, ebx
xchg r8, rax
mov rsi, r8
xchg r8, rax
mov r12b, 0x76
xor r12b, 0x5f
add r12b, 5
xor r12b, 0x4b
sub r12b, 0x64
test ebp, ebp
mov dword [rsp - 0xc], 0x29af90f
je 0x1400a70aa
nop
mov r8d, ebx
mov r10d, r14d
mov dword [rsp - 0x38], 0x3700f622
shl r8d, 0x13
shl r8d, 1
xor eax, eax
mov r15, r15
sub r10d, r8d
shr r8d, 2
cmp r10d, 0x100000
jbe 0x1400a7009
mov r11, r11
mov r10d, 0x3a8990ba
sub r10d, 0x8f0d906
add r10d, 0x2092bdae
add r10d, 0x14e281e9
sub r10d, 0x66fdf74b
mov r11d, 0x799a92ec
sub r11d, 0xf2e8c00
add r11d, 0x1308c0b5
sub r11d, 0x7d70c7a1
jmp 0x1400a7027
mov r11d, r10d
mov dword [rsp - 0x10], ecx
shr r11d, 1
shr r11d, 1
test r11d, r11d
je 0x1400a7068
mov dword [rsp - 0x14], 0x7f0e3e69
xchg rsi, r9
mov rsi, r9
xchg rsi, r9
nop dword [rax]
mov rbp, rbp
lea edx, [r8 + rax]
mov ecx, edi
xor ecx, dword [rsp + rdx*4 + 0x20]
mov dword [rsp - 0x28], 0x6fcb4a6d
lea r9, [r9 + 4]
xor ecx, 0x734237da
inc eax
xchg r12, r12
mov dword [r9 - 4], ecx
cmp eax, r11d
jb 0x1400a703a
mov r8d, r10d
mov dword [rsp - 0x34], ecx
xchg rcx, rsi
mov rdx, rcx
xchg rcx, rsi
xchg rcx, rbx
mov rbx, r15
xchg rbx, rcx
call fcn.1400a3900
test al, al
je 0x1400a70a4
mov dword [rsp - 0x10], ecx
inc ebx
cmp ebx, ebp
jb 0x1400a6f96
mov r12, r12
jmp 0x1400a70aa
xor r12b, r12b
xchg rdx, rdx
xchg rcx, r15
mov r15, rsi
xchg r15, rcx
call fcn.1400bbf90
lea r11, [rsp + 0x1020]
mov r8, r8
movzx eax, r12b
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov dword [rsp - 0x38], 0x2f10fe92
xchg rsp, r11
mov r11, rsp
xchg rsp, r11
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
nop
mov rsi, qword [rsp]
add rsp, 8
ret
Function at 0x1400ac700
Capabilities:
Execute syscall

Disassembly:
jmp 0x1400ae960
xchg rcx, r13
mov r10, r13
xchg rcx, r13
mov eax, dword [0x1404e1064]
xchg rsp, rsp
cmp qword [0x1404e1078], 0
jne 0x1400ade00
syscall
mov dword [rsp - 0x3c], 0x6b2e2a03
ret
Function at 0x1400af900
Capabilities:
Encode data using xor

Disassembly:
xchg rsi, rbx
mov qword [rsp + 8], rsi
xchg rbx, rsi
mov ebx, edx
mov r8d, ecx
xchg rdx, rdx
test ecx, ecx
jne 0x1400af92b
xor eax, eax
mov dword [rsp - 0x10], 0xbcf9cf1
mov rbx, qword [rsp + 8]
ret
xor r10d, r10d
mov r11d, r8d
mov edx, r10d
xchg r8, r8
mov r9d, r8d
nop dword [rax]
nop word [rax + rax]
lea eax, [r9 + r9]
mov dword [rsp - 0xc], ebx
mov ecx, edx
xor ecx, r9d
mov r9d, eax
mov r9, r9
test r11b, 1
cmove ecx, edx
xor r9d, ebx
mov r14, r14
cmp eax, 0x100
mov edx, ecx
cmovb r9d, eax
shr r11d, 1
xchg r10, r10
jne 0x1400af948
mov r11d, r8d
mov r9d, r10d
test ecx, ecx
mov dword [rsp - 0x24], edx
je 0x1400af9ce
lea eax, [r11 + r11]
mov ecx, r9d
xchg r9, r9
xor ecx, r11d
mov r11d, eax
test dl, 1
xchg rdx, rdx
cmove ecx, r9d
xor r11d, ebx
cmp eax, 0x100
mov dword [rsp - 0x40], 0x2d50eedb
mov r9d, ecx
cmovb r11d, eax
shr edx, 1
jne 0x1400af991
mov dword [rsp - 0x20], esi
mov r11d, r9d
mov edx, r10d
test r9d, r9d
je 0x1400afa38
mov dword [rsp - 0x28], 0x634cc54a
nop dword [rax]
nop word [rax + rax]
lea eax, [r11 + r11]
mov ecx, edx
mov dword [rsp - 0x1c], 0x45422303
xor ecx, r11d
mov r11d, eax
test r9b, 1
mov dword [rsp - 0x14], 0x62357b4
cmove ecx, edx
xor r11d, ebx
cmp eax, 0x100
mov dword [rsp - 0x18], 0x4508a8ec
mov edx, ecx
cmovb r11d, eax
shr r9d, 1
xchg r8, r8
jne 0x1400af9f3
test edx, edx
je 0x1400afa7e
nop word [rax + rax]
xchg r12, r12
mov ecx, r10d
xor ecx, r8d
test dl, 1
mov rbp, rbp
cmove ecx, r10d
mov r10d, ecx
lea ecx, [r8 + r8]
mov r8d, ecx
xchg r12, r12
xor r8d, ebx
cmp ecx, 0x100
cmovb r8d, ecx
shr edx, 1
mov rdi, rdi
jne 0x1400afa49
mov rbx, qword [rsp + 8]
mov eax, r10d
ret
Function at 0x1404909e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
xchg rsi, rdi
mov qword [rsp + 0x20], rdi
xchg rsi, rdi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
add rsp, 0x58713295
sub rsp, 0x587132d5
mov rax, qword [0x1404e04e8]
lea rdx, [rsp + 0x58]
mov dword [rsp - 0x18], 0x6acfd468
xchg rcx, rdx
mov rdi, rdx
xchg rdx, rcx
ror rax, 0x24
ror rax, 5
ror rax, 2
ror rax, 1
ror rax, 1
movabs rcx, 0xb4cea1673b1ffaa7
add rcx, 0x40a7ffe3
sub rcx, 0x33675b98
xor rcx, 0xd0b8328
mov dword [rsp + 0x58], 0x3be4b3dc
add dword [rsp + 0x58], 0x240e3190
xor dword [rsp + 0x58], 0x645ea72d
xor dword [rsp + 0x58], 0x3bac4251
xor rax, rcx
mov dword [rsp - 0x44], ebp
lea rcx, [rsp + 0x20]
rol rax, 0x18
rol rax, 0xb
rol rax, 2
rol rax, 1
call rax
lea rbp, [rdi + 8]
xchg r10, r10
xorps xmm0, xmm0
mov qword [rdi], rbp
movups xmmword [rbp], xmm0
xchg rbp, r9
movups xmmword [r9 + 0x10], xmm0
xchg r9, rbp
xchg r10, rbp
movups xmmword [r10 + 0x20], xmm0
xchg rbp, r10
test eax, eax
jne 0x140490afa
mov dword [rsp - 0x30], 0x7961ff2a
xor esi, esi
xchg rbp, rax
mov rbp, rdi
xchg rbp, rax
mov qword [rdi + 0x38], rsi
mov dword [rsp - 0x40], edi
xchg rbp, r14
mov r14, qword [rsp + 0x60]
xchg r14, rbp
mov rsi, qword [rsp + 0x68]
mov rdi, rdi
neg rsp
add rsp, 0xffffffffffffffc0
neg rsp
pop rdi
ret
xchg rbx, r12
mov qword [rsp + 0x50], r12
xchg r12, rbx
lea rax, [rsp + 0x20]
nop
movabs rbx, 0xffffffff35d533e7
xor rbx, 0x4ac774b5
xor rbx, 0xd3999ab
add rbx, 0x7fffffff
xor rbx, 0xdd42107
inc rbx
cmp word [rax + rbx*2], 0
xchg r11, r11
jne 0x140490b31
mov qword [rdi + 0x38], rbx
xchg rcx, rbp
mov rbp, qword [rdi]
xchg rbp, rcx
cmp rcx, rbp
mov dword [rsp - 0x28], 0x64db67d5
je 0x140490b65
call fcn.1400bc0d0
xor esi, esi
cmp rbx, 0x18
xchg r11, r11
jbe 0x140490b9a
lea rcx, [rbx + rbx]
call fcn.1400bc380
xchg rbx, rax
mov qword [rdi], rbx
xchg rbx, rax
test rax, rax
xchg rcx, rcx
jne 0x140490bac
mov qword [rdi], rbp
mov edx, esi
jmp 0x140490bc5
xchg rbp, r8
mov qword [rdi], r8
xchg r8, rbp
xchg rbp, r12
mov rax, r12
xchg rbp, r12
xorps xmm0, xmm0
mov r13, r13
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
xchg r9, rax
movups xmmword [r9 + 0x20], xmm0
xchg r9, rax
mov rdx, qword [rdi]
mov ecx, 0x32836553
add ecx, 0x7d987d1
sub ecx, 0x3a31aaff
add ecx, 0x4ce813cd
xchg r11, rbx
mov r11, qword [rsp + 0x50]
xchg rbx, r11
cmp qword [rdi + 0x38], rsi
jbe 0x140490c5d
lea r8, [rsp + 0x20]
xchg r8, r8
mov r9d, 0x5fd31850
sub r9d, 0x3f6ddd2d
add r9d, 0x460c7202
sub r9d, 0x6671ac26
sub r8, rdx
nop word [rax + rax]
mov r9, r9
movzx eax, cx
lea rdx, [rdx + 2]
and ax, r9w
mov dword [rsp - 0x28], ebx
ror ecx, 3
ror ecx, 4
ror ecx, 1
xor ax, word [r8 + rdx - 2]
mov dword [rsp - 0x28], 0x4c4ec898
inc rsi
mov word [rdx - 2], ax
cmp rsi, qword [rdi + 0x38]
mov r9, r9
jb 0x140490c24
xchg rbp, rcx
mov rcx, qword [rsp + 0x60]
xchg rcx, rbp
mov rax, rdi
mov dword [rsp - 0x44], esp
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
mov dword [rsp - 0xc], esp
ret
Function at 0x1400254d0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x460
mov rax, qword [0x140068050]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x38], rcx
xor edi, edi
mov dword [rsp + 0x34], edi
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 0xf
mov byte [rcx], dil
mov dword [rsp + 0x34], 1
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi + 1]
lea rcx, str.HTTPGET
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r15, rax
test rax, rax
je 0x14002563f
cmp qword [rbx + 0x18], 0x10
jb 0x140025553
mov rbx, qword [rbx]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbp, rax
test rax, rax
je 0x140025636
mov dword [rsp + 0x40], edi
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14002562d
movzx ebx, byte [rsp + 0x30]
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x14002562d
mov edi, eax
mov rcx, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x1400255f3
lea rax, [rcx + rdi]
mov qword [r14 + 0x10], rax
mov rax, r14
cmp rdx, 0x10
jb 0x1400255d9
mov rax, qword [r14]
lea rsi, [rax + rcx]
mov r8, rdi
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14002a3a0
mov byte [rsi + rdi], 0
jmp 0x14002560c
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
movzx r8d, bl
mov rdx, rdi
mov rcx, r14
call fcn.140013f80
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rsp + 0x50]
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400255a8
mov rcx, rbp
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rax, r14
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140028480
mov rbx, qword [rsp + 0x4a0]
add rsp, 0x460
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140027328
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rdi, rcx
test r8, r8
jg 0x140027356
xor eax, eax
jmp 0x14002743c
cmp qword [rcx + 0x68], 0
je 0x140027367
call fcn.14000ef70
jmp 0x14002743c
mov rax, qword [rcx + 0x38]
mov rsi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14002737e
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140027380
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400273b2
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.14002a3a0
mov rax, qword [rdi + 0x50]
add r14, rbx
sub rsi, rbx
sub dword [rax], ebx
mov rcx, qword [rdi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rdi + 0x80], 0
je 0x140027436
mov r8, qword [rdi + 0x18]
lea rax, [rdi + 0x70]
cmp qword [r8], rax
jne 0x1400273e9
mov rcx, qword [rdi + 0x88]
mov rdx, qword [rdi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rdi + 0x38]
mov qword [rax], rcx
mov rax, qword [rdi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x140027412
mov r9, qword [rdi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.1400383d4
add r14, rax
sub rsi, rax
cmp rax, rbx
jne 0x140027436
cmp rsi, rbx
ja 0x1400273f0
test rsi, rsi
je 0x140027436
mov r9, qword [rdi + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1400383d4
sub rsi, rax
sub rbp, rsi
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x14002917c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400291c6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400291c6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400291c6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400291c6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400291c6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400291c8
xor al, al
add rsp, 0x28
ret