joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140174a60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
xchg rbx, r11
mov r11, rcx
xchg r11, rbx
je 0x140174c1d
cmp byte [rcx + 0x72], 0
je 0x140174c1d
mov rax, qword [rcx]
mov qword [rsp + 0x68], rdi
mov edi, 0x5d51b1b
xor edi, 0x72780dd1
xor edi, 0x6cdde3b9
add edi, 0x12757c65
xor edi, 0x53d7bd76
sub edi, 0x4bea1b63
xor edi, 0x3edda32a
add edi, 0xb9d189d
xor edi, 0x1837d501
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140174bff
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
xchg r13, rax
mov qword [rsp + 0x20], r13
xchg r13, rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140174b59
sub eax, 1
je 0x140174b75
cmp eax, 2
jne 0x140174bff
xchg rdi, rbx
mov rbx, qword [rsp + 0x68]
xchg rdi, rbx
mov al, 0x18
xor al, 0x13
xor al, 0x7e
xor al, 0x2d
sub al, 0x4a
xor al, 0xf
mov byte [rbx + 0x72], 0x2d
xor byte [rbx + 0x72], 0x3e
sub byte [rbx + 0x72], 0x13
add byte [rbx + 0x72], 0x39
sub byte [rbx + 0x72], 0x16
add byte [rbx + 0x72], 0xb
sub byte [rbx + 0x72], 0x2e
add rsp, 0x50
nop
add rsp, 8
mov rbx, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
mov byte [rbx + 0x72], 0x53
sub byte [rbx + 0x72], 0xd
add byte [rbx + 0x72], 2
sub byte [rbx + 0x72], 0x47
xor byte [rbx + 0x72], 0x3c
xor byte [rbx + 0x72], 0x29
sub byte [rbx + 0x72], 0x14
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x140174bdb
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
xchg rdi, r8
mov rdi, r8
xchg rdi, r8
mov edx, 0x7b16525e
xor edx, 0x5660133
xor edx, 0x9490c24
sub edx, 0x232e93a1
sub edx, 0x3eb1583e
add edx, 0x52c43a14
xor edx, 0x4eb7615a
sub edx, 0x26aacc23
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140174bff
cmp byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
push rax
push rdx
push rax
push rcx
push rcx
xchg qword [rsp + 0x28], rbx
pop rcx
pop rcx
pop rax
pop rdx
pop rax
add rsp, 8
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
nop
add rsp, 8
xchg qword [rsp - 8], rbx
nop
add rsp, 8
jmp qword [rsp - 8]
mov al, 0x2c
add al, 0x32
xor al, 0x69
sub al, 0x31
xor al, 0x52
sub al, 0x33
add al, 0x32
sub al, 0x52
add rsp, 0x50
nop
add rsp, 8
xchg qword [rsp - 8], rbx
ret
Function at 0x140194380
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
xchg r10, r11
mov r11, rdx
xchg r10, r11
mov r11, rcx
mov word [rsp + 0x30], 0x1ae1
add word [rsp + 0x30], 0x6202
sub word [rsp + 0x30], 0x7c32
xor word [rsp + 0x30], 0x1153
xor word [rsp + 0x30], 0x3550
xor word [rsp + 0x30], 0x22a8
add word [rsp + 0x30], 0xf0dc
mov dword [rsp + 0x34], 0x44479472
sub dword [rsp + 0x34], 0x424e2e14
add dword [rsp + 0x34], 0x11c662f1
sub dword [rsp + 0x34], 0xe5625ce
add dword [rsp + 0x34], 0x2ce08bb5
sub dword [rsp + 0x34], 0x6020e01
add dword [rsp + 0x34], 0x1917a1eb
sub dword [rsp + 0x34], 0x277af5c7
xor dword [rsp + 0x34], 0xe2ab3208
mov byte [rsp + 0x32], 0x21
add byte [rsp + 0x32], 0x43
sub byte [rsp + 0x32], 0x34
xor byte [rsp + 0x32], 0x50
sub byte [rsp + 0x32], 0x4f
add byte [rsp + 0x32], 0x67
add byte [rsp + 0x32], 0x7e
mov dword [rsp + 0x38], 0x585d34e0
sub dword [rsp + 0x38], 0x199c1148
sub dword [rsp + 0x38], 0x3b4d373f
add dword [rsp + 0x38], 0x2749e85c
xor dword [rsp + 0x38], 0x6e3f745c
sub dword [rsp + 0x38], 0x4481a18b
xor ebx, ebx
mov edx, ebx
nop dword [rax]
movzx eax, word [rsp + rdx*2 + 0x34]
movzx ecx, byte [rsp + rdx + 0x30]
add cx, ax
mov word [rsp + rdx*2 + 0x34], cx
mov byte [rsp + rdx + 0x30], bl
inc rdx
cmp rdx, 3
jb 0x140194466
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0x34]
xchg r10, rdx
mov r10, rdx
xchg rdx, r10
xchg rbx, r11
mov rcx, rbx
xchg rbx, r11
call fcn.140194880
nop
nop dword [rax]
mov byte [rsp + rbx + 0x34], 0x19
add byte [rsp + rbx + 0x34], 0x55
xor byte [rsp + rbx + 0x34], 0x3d
sub byte [rsp + rbx + 0x34], 0x2f
add byte [rsp + rbx + 0x34], 0xd
xor byte [rsp + rbx + 0x34], 0x17
xor byte [rsp + rbx + 0x34], 0x7c
xor byte [rsp + rbx + 0x34], 0x2b
sub byte [rsp + rbx + 0x34], 0x71
inc rbx
cmp rbx, 6
jb 0x1401944b6
add rsp, 0x40
push rdx
xchg qword [rsp + 8], rbx
add rsp, 0x10
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401ab470
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r11, rdx
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
test rdx, rdx
je 0x1401ab4e8
mov qword [rsp], rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1401ab4d5
movzx eax, byte [r10]
test bl, bl
je 0x1401ab4b7
lea rcx, [r9 - 1]
mov rdx, r9
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1401ab4a6
jmp 0x1401ab4d5
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1401ab4c6
inc r10
sub r11, 1
jne 0x1401ab48e
xchg r9, rbx
mov r9, qword [rsp]
xchg r9, rbx
add rsp, 8
ret
Function at 0x1401b0400
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
xchg r11, rbx
mov qword [rsp + 8], r11
xchg rbx, r11
xchg r14, rbp
mov qword [rsp + 0x10], r14
xchg r14, rbp
mov qword [rsp + 0x20], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
mov eax, 0x1b0c8645
add eax, 0x5db60dbb
sub eax, 0x227f5e37
add eax, 0x19eb7cfd
sub eax, 0x45e74627
xor eax, 0x57223f8
sub eax, 0x2f353bb7
call fcn.1401fd610
sub rsp, rax
mov ebx, edx
mov edi, ecx
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rsp + 0x24], eax
mov r9d, 0x2a1ab022
add r9d, 0x30143e2
add r9d, 0x1fb4da98
xor r9d, 0x7c7bdc8f
sub r9d, 0x1a9574c3
xor r9d, 0x7f7136e5
xor r9d, 0x2252e2fb
xor r9d, 0x4b36494f
mov dword [rsp + 0x13a4], 0x40e8538
xor dword [rsp + 0x13a4], 0x4497dd3e
add dword [rsp + 0x13a4], 0x3e8775f1
sub dword [rsp + 0x13a4], 0xabc0b04
sub dword [rsp + 0x13a4], 0x6520c73b
add dword [rsp + 0x13a4], 0x4f0bc706
xor dword [rsp + 0x13a4], 0xd998efd
xor dword [rsp + 0x13a4], 0x25ca61af
add dword [rsp + 0x13a4], 0x89e3d213
nop dword [rax + rax]
mov r8d, eax
shr r8d, 7
shr r8d, 0xf
shr r8d, 5
shr r8d, 2
shr r8d, 1
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, 0x270
jb 0x1401b04fc
mov ebp, 0x3e1601cc
xor ebp, 0x614644f8
sub ebp, 0x53a08501
xor ebp, 0x965e39b
add ebp, 0x6a9575f6
xor ebp, 0x426e0c4e
sub ebp, 0x1eb7d447
add ebp, 0x52448c1c
add ebp, 0x1d41b25b
mov dword [rsp + 0x20], 0x619e387b
xor dword [rsp + 0x20], 0x229f52fc
add dword [rsp + 0x20], 0x31171be2
xor dword [rsp + 0x20], 0x953f732
sub dword [rsp + 0x20], 0x2d8142be
xor dword [rsp + 0x20], 0x3629f51e
sub dword [rsp + 0x20], 0x767f6ee8
xor dword [rsp + 0x20], 0x707cb15d
xor dword [rsp + 0x20], 0x7318dfb6
cmp edi, ebp
lea rax, [rsp + 0x20]
mov qword [rsp + 0x13d0], rax
lea rcx, [rsp + 0x13d0]
lea eax, [rdi - 0x80000000]
lea esi, [rdi + rbp]
cmovae esi, eax
lea edi, [rbx + rbp]
cmp ebx, ebp
lea eax, [rbx - 0x80000000]
cmovae edi, eax
sub edi, esi
cmp edi, 0xffffffff
jne 0x1401b05f9
call fcn.1401b08c0
mov ecx, eax
jmp 0x1401b0657
inc edi
mov ebx, edi
call fcn.1401b08c0
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jae 0x1401b0649
mov eax, edi
xor edx, edx
neg eax
div edi
mov edi, edx
cmp ecx, edx
jae 0x1401b0649
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x13d0]
call fcn.1401b08c0
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jb 0x1401b062e
shr rcx, 0x1c
shr rcx, 2
shr rcx, 1
shr rcx, 1
lea edx, [rsi + rcx]
lea r11, [rsp + 0x13b0]
cmp edx, ebp
xchg rcx, rbx
mov rcx, qword [r11 + 0x10]
xchg rcx, rbx
lea eax, [rdx + rbp]
xchg r8, rbp
mov r8, qword [r11 + 0x18]
xchg r8, rbp
lea ecx, [rdx - 0x80000000]
mov rsi, qword [r11 + 0x28]
cmovae eax, ecx
mov rsp, r11
push rdx
xchg qword [rsp + 8], rdi
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401b08c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, qword [rcx]
mov r9d, 0x7a49c5e0
sub r9d, 0x6672e390
xor r9d, 0x6cdfe21e
sub r9d, 0x5759d3cc
sub r9d, 0xa6734dd
add r9d, 0x5c5e3098
xor r9d, 0x411a4ea
xor r9d, 0x7db78ea7
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x1401b095a
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1401b0915
mov ecx, dword [r10]
jmp 0x1401b0aa5
cmp ecx, 0x4e0
jb 0x1401b0aa5
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0x69f72522
sub ebx, 0x633a1a13
add ebx, 0xc923707
add ebx, 0x5ad31513
sub ebx, 0x68bbbdeb
add ebx, 0x4898ef51
sub ebx, 0xc6c8064
sub ebx, 0x293020e5
sub ebx, 0x1862e663
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b09a9
lea r11, [r10 + 0xd50]
mov ebx, 0x263d5cc
add ebx, 0x3ad71b5d
add ebx, 0x30527a73
sub ebx, 0x362d437c
add ebx, 0x1fedd0a1
add ebx, 0x1ee34845
add ebx, 0x3b6c00c
sub ebx, 0x79e7ff86
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b0a27
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 7
shr ecx, 3
shr ecx, 1
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 5
shl eax, 1
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 9
shl eax, 4
shl eax, 1
shl eax, 1
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401ba890
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
xchg rbx, rcx
mov rcx, rbx
xchg rcx, rbx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b9e77
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b9e64
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b9e8e
mov rcx, r8
call fcn.1401fd29c
xor eax, eax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
lea rcx, [rbx + 8]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rbx
jmp 0x1401ba890
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xchg rbx, r10
mov qword [rsp + 0x10], r10
xchg rbx, r10
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
xchg rdi, rbx
mov rdi, qword [rcx]
xchg rdi, rbx
xchg rcx, rbp
mov rsi, rbp
xchg rbp, rcx
mov rax, qword [rbx + 8]
mov qword [rax], 0x30aa7646
xor qword [rax], 0x3dbc5b89
add qword [rax], 0x61103ad3
add qword [rax], 0xac9ad3d
sub qword [rax], 0x2f86561b
xor qword [rax], 0x4969bfc4
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401ba977
xchg rdi, r15
mov qword [rsp + 0x30], r15
xchg r15, rdi
nop dword [rax + rax]
xchg rcx, rdi
mov rcx, qword [rbx]
xchg rcx, rdi
lea rdx, [rbx + 0x10]
xchg rdx, rcx
mov rdx, rsi
xchg rcx, rdx
call fcn.1401b38b0
mov edx, 0x16ca9f3b
xor edx, 0x7dabc837
sub edx, 0x1bdaa420
add edx, 0xdb56b6e
sub edx, 0x21e9c107
sub edx, 0x1a8af2ef
add edx, 0x406e7d05
xor edx, 0x6135e739
mov rcx, rbx
call fcn.1401fd29c
xchg rdi, rbx
mov rdi, rbx
xchg rbx, rdi
test rdi, rdi
jne 0x1401ba908
xchg rdi, rdx
mov rdx, qword [rsp + 0x30]
xchg rdx, rdi
mov rcx, qword [rsi]
mov edx, 0x2f570243
add edx, 0x15eb1c71
xor edx, 0x1fecadad
sub edx, 0x55a1101e
add edx, 0x228cbc68
sub edx, 0x1374304f
sub edx, 0x3539843
sub edx, 0x10d29681
xchg rbx, r12
mov r12, qword [rsp + 0x38]
xchg rbx, r12
add rsp, 0x20
nop
xchg qword [rsp], rsi
add rsp, 8
jmp fcn.1401fd29c
Function at 0x1401ba9d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp - 8], rbx
sub rsp, 8
sub rsp, 0x20
xchg rdi, rbx
mov rdi, rcx
xchg rbx, rdi
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b9f0f
xchg rdi, rdx
mov rdi, qword [rbx + 0x28]
xchg rdx, rdi
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b9ef8
mov r8, qword [rcx - 8]
sub rdx, 0xffffffffffffffd9
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b9f2d
xchg rcx, r8
mov r8, rcx
xchg rcx, r8
call fcn.1401fd29c
xor eax, eax
xchg rdx, rax
mov qword [rbx + 0x18], rdx
xchg rdx, rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
lea rcx, [rbx + 8]
add rsp, 0x20
push rdx
push rcx
push rdx
push rax
push rcx
push rcx
push rdx
push rdx
xchg qword [rsp + 0x40], rbx
add rsp, 0x48
jmp 0x1401ba9d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx]
mov rsi, rcx
mov rax, qword [rbx + 8]
mov qword [rax], 0xf261747
xor qword [rax], 0x62d098a5
xor qword [rax], 0x1d2d75f4
xor qword [rax], 0x330957db
xor qword [rax], 0x18fc9db6
sub qword [rax], 0x4f1e626a
xor qword [rax], 0xc0fce11
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401baa88
xchg r9, rdi
mov qword [rsp + 0x30], r9
xchg rdi, r9
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rcx, [rbx + 0x10]
call fcn.1401baae0
mov edx, 0x3d14da7e
xor edx, 0x2e238cf7
xor edx, 0x4abed10d
xor edx, 0x18edc5e7
sub edx, 0x966c321
sub edx, 0x37fd7f02
xchg rdx, rbx
mov rcx, rdx
xchg rbx, rdx
call fcn.1401fd29c
xchg rbx, rsi
mov rsi, rdi
xchg rsi, rbx
test rdi, rdi
jne 0x1401baa34
mov rdi, qword [rsp + 0x30]
xchg r8, rcx
mov r8, qword [rsi]
xchg r8, rcx
mov edx, 0x18835bc7
add edx, 0x4648daaa
sub edx, 0x4ea382f1
sub edx, 0x5bb487d
add edx, 0x3069f51
sub edx, 0xd740a14
xchg r10, rbx
mov r10, qword [rsp + 0x38]
xchg rbx, r10
add rsp, 0x20
nop
add rsp, 8
mov rsi, qword [rsp - 8]
jmp fcn.1401fd29c
Function at 0x1401fdc6c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401fdcb6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401fdcb6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401fdcb6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401fdcb6
cmp dword [rcx + 0x84], 0xe
jbe 0x1401fdcb6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401fdcb8
xor al, al
add rsp, 0x28
ret

Function at 0x14022c570
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14022c59d
xor al, al
jmp 0x14022c6ff
mov rax, qword [0x14024b6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14024b6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14024b6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14024b6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14024b6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14024b6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14024b6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14024b6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14024b700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14022c6f1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14022c649
mov r11d, 2
jmp 0x14022c66d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14022c663
mov r11d, 1
jmp 0x14022c66d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14022c715
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14022c6b2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14022c6ca
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14022c6da
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14022c6e8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14022c630
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14022c6fa
Function at 0x1402684aa
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
jmp 0x140914703
syscall
ret

Function at 0x1408f2e23
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
jmp 0x140c93d38
syscall
ret

Function at 0x140da77eb
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
syscall
ret
Function at 0x14315b5f8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x14315b602
push rax
push rcx
push rdx
push rbx
push rbp
push rsi
push rdi
push r8
push r9
push r10
push r11
push r12
push r13
push r14
push r15
pushfq
sub rsp, 8
stmxcsr dword [rsp]
call 0x14315b62b
pop rbp
sub rbp, 0x33
sub rbp, 0x315b5f8
sub rsp, 0x20
jmp 0x14315b64a
mov rax, 0x315b5f8
add rax, rbp
add rax, 0x84
mov rcx, 0x60b
mov rdx, 0x13850497
xor byte [rax], dl
inc rax
dec rcx
jne 0x14315b669
jmp 0x14315b680
fistp word [rsi]
jle 0x14315b6a0
invalid
xchg edi, eax
fbld tbyte [rax + 0x75]
fist word [rsi - 0x64e9e3aa]
xchg edi, eax
xchg edi, eax
xchg edi, eax
fist word [rsi - 0x20383881]
invalid
Function at 0x411b80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x411d0b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042d800
xorps xmm15, xmm15
mov r14, qword [0x005470e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x411be5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x411bf4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x411c13
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x411c23
cmp rbx, 0x1000
jae 0x411beb
jmp 0x411c8d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x411c35
xor edx, edx
jmp 0x411c84
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042d800
xorps xmm15, xmm15
mov r14, qword [0x005470e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x411c19
jmp 0x411c08
call fcn.0045aba0
xorps xmm15, xmm15
mov r14, qword [0x005470e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00431b60
lea rax, [0x004802fa]
mov ebx, 0x18
nop dword [rax]
call fcn.004323e0
mov rax, qword [rsp + 0x38]
call fcn.00432120
lea rax, [0x004805c0]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.004323e0
mov rax, qword [rsp + 0x30]
call fcn.00432120
call fcn.00431da0
call fcn.00431bc0
lea rax, [0x00481dba]
mov ebx, 0x21
call fcn.004301c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00457500
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00411b80
Function at 0x411d40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x411f66
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042d880
xorps xmm15, xmm15
mov r14, qword [0x005470e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x411db3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x411dc2
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x411de5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x411df5
cmp rbx, 0x1000
jae 0x411db9
nop
jmp 0x411e78
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x411e0d
xor esi, esi
jmp 0x411e6a
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042d880
xorps xmm15, xmm15
mov r14, qword [0x005470e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x411deb
jmp 0x411dd6
call fcn.0045aba0
xorps xmm15, xmm15
mov r14, qword [0x005470e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x411f00
nop dword [rax + rax]
call fcn.00431b60
lea rax, [0x004805d9]
mov ebx, 0x19
call fcn.004323e0
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00432120
lea rax, [0x004805c0]
mov ebx, 0x19
call fcn.004323e0
mov eax, dword [rsp + 0x34]
call fcn.00432120
nop
call fcn.00431da0
call fcn.00431bc0
lea rax, [0x0047e100]
mov ebx, 0xd
call fcn.004301c0
nop dword [rax + rax]
cmp eax, 0x5af
je 0x411ea0
call fcn.00431b60
lea rax, [0x004805d9]
mov ebx, 0x19
call fcn.004323e0
mov rax, qword [rsp + 0x38]
call fcn.00432120
lea rax, [0x004805c0]
mov ebx, 0x19
call fcn.004323e0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00432120
call fcn.00431da0
call fcn.00431bc0
lea rax, [0x004817dc]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.004301c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00457500
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00411d40