joyce8/EMBER2024-capa huggingface dataset:
Function at 0x62d99260
Capabilities:
Hash data with md5

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
mov rbx, rcx
mov rsi, rdx
je 0x62d99470
test rdx, rdx
je 0x62d99489
mov edx, dword [rcx + 0x18]
mov eax, 0x10
cmp edx, 0x3f
jbe 0x62d99294
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea r8d, [rdx*8]
add r8, qword [rcx]
mov eax, edx
mov qword [rcx], r8
lea ecx, [rdx + 1]
cmp ecx, 0x38
mov dword [rbx + 0x18], ecx
mov byte [rbx + rax + 0x1c], pe_nt_image_headers64
ja 0x62d993f0
cmp ecx, 0x38
lea rdi, [rbx + 0x1c]
je 0x62d993b9
mov edx, ecx
lea r9d, [rcx + 1]
mov eax, ecx
not edx
mov byte [rbx + rax + 0x1c], 0
and edx, 7
cmp r9d, 0x38
je 0x62d993b2
test edx, edx
je 0x62d9935d
cmp edx, 1
je 0x62d9934b
cmp edx, 2
je 0x62d9933f
cmp edx, 3
je 0x62d99333
cmp edx, 4
je 0x62d99326
cmp edx, 5
je 0x62d99319
cmp edx, 6
je 0x62d9930d
mov byte [rbx + r9 + 0x1c], 0
lea r9d, [rcx + 2]
mov ecx, r9d
add r9d, 1
mov byte [rbx + rcx + 0x1c], 0
mov r10d, r9d
add r9d, 1
mov byte [rbx + r10 + 0x1c], 0
mov r11d, r9d
add r9d, 1
mov byte [rbx + r11 + 0x1c], 0
mov edx, r9d
add r9d, 1
mov byte [rbx + rdx + 0x1c], 0
mov eax, r9d
add r9d, 1
mov byte [rbx + rax + 0x1c], 0
mov ecx, r9d
add r9d, 1
cmp r9d, 0x38
mov byte [rbx + rcx + 0x1c], 0
je 0x62d993b2
lea r11d, [r9 + 1]
lea edx, [r9 + 2]
mov r10d, r9d
mov byte [rbx + r10 + 0x1c], 0
lea eax, [r9 + 3]
lea ecx, [r9 + 4]
mov byte [rbx + r11 + 0x1c], 0
lea r10d, [r9 + 5]
mov byte [rbx + rdx + 0x1c], 0
lea r11d, [r9 + 6]
lea edx, [r9 + 7]
add r9d, 8
cmp r9d, 0x38
mov byte [rbx + rax + 0x1c], 0
mov byte [rbx + rcx + 0x1c], 0
mov byte [rbx + r10 + 0x1c], 0
mov byte [rbx + r11 + 0x1c], 0
mov byte [rbx + rdx + 0x1c], 0
jne 0x62d9935d
mov dword [rbx + 0x18], 0x38
mov qword [rbx + 0x54], r8
mov rdx, rdi
mov rcx, rbx
call fcn.62d989c0
mov r9d, dword [rbx + 8]
xor eax, eax
mov dword [rsi], r9d
mov edi, dword [rbx + 0xc]
mov dword [rsi + 4], edi
mov r8d, dword [rbx + 0x10]
mov dword [rsi + 8], r8d
mov ebx, dword [rbx + 0x14]
mov dword [rsi + 0xc], ebx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
cmp ecx, 0x40
je 0x62d99457
lea edi, [rdx + 2]
mov byte [rbx + rcx + 0x1c], 0
cmp edi, 0x40
je 0x62d99450
lea r8d, [rdx + 3]
mov byte [rbx + rdi + 0x1c], 0
cmp r8d, 0x40
je 0x62d99450
lea r9d, [rdx + 4]
mov byte [rbx + r8 + 0x1c], 0
cmp r9d, 0x40
je 0x62d99450
lea r10d, [rdx + 5]
mov byte [rbx + r9 + 0x1c], 0
cmp r10d, 0x40
je 0x62d99450
lea r11d, [rdx + 6]
mov byte [rbx + r10 + 0x1c], 0
cmp r11d, 0x40
je 0x62d99450
cmp edx, 0x38
mov byte [rbx + r11 + 0x1c], 0
jne 0x62d99450
mov byte [rbx + 0x5b], 0
mov dword [rbx + 0x18], 0x40
lea rdi, [rbx + 0x1c]
mov rcx, rbx
mov rdx, rdi
call fcn.62d989c0
mov r8, qword [rbx]
xor ecx, ecx
jmp 0x62d992c5
lea rdx, str.src_hashes_md5.c
lea rcx, [0x62e0e2f1]
mov r8d, 0x106
call fcn.62d9e1a0
lea rdx, str.src_hashes_md5.c
lea rcx, [0x62e0e2fc]
mov r8d, 0x107
call fcn.62d9e1a0
nop
nop dword [rax]
nop word cs:[rax + rax]
Function at 0x62de15e0
Capabilities:
Check for software breakpoints

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
test r8d, r8d
mov rbp, rcx
je 0x62de1620
mov rcx, qword [rdx + 0x10]
cmp dword [rcx + 8], 0xcd
je 0x62de1612
test byte [rcx + 0xd], 0x10
jne 0x62de1612
cmp qword [rdx + 0x28], 0
jne 0x62de1612
cmp qword [rcx + 0x28], rdx
je 0x62de1623
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, rdx
mov rsi, qword [rdx + 0x18]
mov rbx, qword [rcx]
mov rdi, qword [rdx + 0x20]
and esi, 0x7fff
test rbx, rbx
je 0x62de1612
mov edx, dword [rbx + 8]
movsxd r12, esi
cmp edx, 0x5c
je 0x62de16a3
ja 0x62de16c0
lea eax, [rdx - 7]
cmp eax, 1
jbe 0x62de1612
mov rcx, rbp
call fcn.62de11d0
test al, 4
jne 0x62de1612
mov edx, eax
and edx, 3
cmp edx, 3
je 0x62de1740
mov edx, eax
and edx, 0x300
cmp edx, 0x300
je 0x62de1770
and eax, 0x30000
mov rcx, rbx
cmp eax, 0x30000
je 0x62de1796
mov rbx, qword [rcx]
test rbx, rbx
je 0x62de1612
mov edx, dword [rbx + 8]
cmp edx, 0x5c
jne 0x62de1644
mov rax, qword [rbx + 0x10]
and eax, 0x7fff
cmp r12, rax
je 0x62de16d3
mov rcx, rbx
jmp 0x62de168f
cmp edx, 0xcd
jne 0x62de164e
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp word [rbx + 0xc], 0
jne 0x62de1612
cmp qword [rbx + 0x18], rdi
jne 0x62de1612
cmp rcx, rbx
mov rax, qword [rbx]
je 0x62de17d0
mov qword [rcx], rax
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov qword [rbx + 0x20], 0
mov qword [rbx + 0x28], 0
mov rax, qword [rbp + 0x38]
mov rdx, qword [rax + 0x100]
mov qword [rbx], rdx
mov qword [rax + 0x100], rbx
jmp 0x62de168f
test al, 8
je 0x62de17b0
mov edx, dword [rbx + 0x10]
and edx, 0x7fff
cmp edx, esi
je 0x62de1612
mov edx, dword [rbx + 0x14]
and edx, 0x7fff
cmp edx, esi
jne 0x62de1668
jmp 0x62de1612
mov rdx, qword [rbx + 0x18]
and edx, 0x7fff
cmp r12, rdx
je 0x62de1612
and eax, 0x30000
mov rcx, rbx
cmp eax, 0x30000
jne 0x62de168f
mov rax, qword [rbx + 0x20]
and eax, 0x7fff
cmp r12, rax
jne 0x62de168f
jmp 0x62de1612
mov rdx, qword [rbx + 0x10]
and edx, 0x7fff
cmp r12, rdx
jne 0x62de1668
jmp 0x62de1612
mov rdx, qword [rbp + 0x38]
mov qword [rdx], rax
jmp 0x62de16f7
Function at 0x62dffb00
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x20
cmp dword [rcx + 0x244], 0x10
ja 0x62dffb80
mov rbx, rcx
mov ecx, dword [rcx + 0x238]
mov rsi, rdx
mov edi, r8d
call fcn.62d9e1e0
test eax, eax
mov r14d, eax
jne 0x62dffb86
mov eax, dword [rbx + 0x240]
test eax, eax
jne 0x62dffb71
movsxd rcx, dword [rbx + 0x244]
test ecx, ecx
jne 0x62dffba0
cmp qword [rbx + 0x248], 0
je 0x62dffd90
lea r13, [rbx + 0x228]
lea r12, [rbx + 0x1f8]
jmp 0x62dffc1a
cmp eax, 1
je 0x62dffda0
nop word [rax + rax]
mov r14d, 0x10
lea rsp, [rbp - 0x38]
mov eax, r14d
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [rbx + 0x23c]
lea r13, [rbx + 0x228]
test eax, eax
jne 0x62dffbe0
cmp ecx, 0xc
jne 0x62dffbe0
mov rax, qword [rbx + 0x228]
mov qword [rbx + 0x208], rax
mov eax, dword [r13 + 8]
mov dword [rbx + 0x214], 0x1000000
mov dword [rbx + 0x210], eax
jmp 0x62dffc85
lea eax, [rcx - 1]
lea r12, [rbx + 0x1f8]
lea r8, [rbx + rax + 0x1f9]
mov rdx, r12
movzx eax, byte [rdx + 0x30]
xor byte [rdx], al
add rdx, 1
cmp rdx, r8
jne 0x62dffbf5
shl rcx, 3
add qword [rbx + 0x248], rcx
mov rdx, r12
mov rcx, rbx
call fcn.62d98300
mov edx, 8
mov rcx, r13
call fcn.62d9ece0
mov rax, qword [rbx + 0x248]
mov rdx, r12
bswap rax
mov qword [rbx + 0x230], rax
lea rax, [rbx + 0x208]
movzx ecx, byte [rdx + 0x30]
xor byte [rdx], cl
add rdx, 1
cmp rax, rdx
jne 0x62dffc42
mov rdx, r12
mov rcx, rbx
call fcn.62d98300
mov rdx, qword [rbx + 0x200]
mov rax, qword [rbx + 0x1f8]
mov rcx, r12
mov qword [rbx + 0x210], rdx
mov qword [rbx + 0x208], rax
mov edx, 0x10
call fcn.62d9ece0
mov rdx, qword [rbx + 0x210]
mov rax, qword [rbx + 0x208]
mov rcx, r13
mov qword [rbx + 0x220], rdx
mov qword [rbx + 0x218], rax
mov edx, 0x10
call fcn.62d9ece0
mov qword [rbx + 0x240], 1
mov qword [rbx + 0x248], 0
mov r13d, edi
and r13d, 0xfffffff0
je 0x62dffdc0
lea r15, [rbx + 0x1f8]
xor r12d, r12d
nop dword [rax + rax]
mov eax, r12d
mov rdx, r15
mov rcx, rbx
mov rax, qword [rsi + rax]
xor qword [rbx + 0x1f8], rax
lea eax, [r12 + 8]
add r12d, 0x10
mov rax, qword [rsi + rax]
xor qword [rbx + 0x200], rax
call fcn.62d98300
sub qword [rbx + 0x248], 0xffffffffffffff80
cmp r12d, r13d
jb 0x62dffce0
mov eax, r12d
add rsi, rax
cmp edi, r12d
jbe 0x62dffb86
sub edi, 1
sub edi, r12d
lea r12, [rsi + rdi + 1]
lea rdi, [rbx + 0x1f8]
jmp 0x62dffd49
cmp rsi, r12
je 0x62dffb86
movsxd rdx, dword [rbx + 0x244]
add rsi, 1
movzx ecx, byte [rsi - 1]
lea eax, [rdx + 1]
mov dword [rbx + 0x244], eax
xor byte [rbx + rdx + 0x1f8], cl
cmp eax, 0x10
jne 0x62dffd40
mov rdx, rdi
mov rcx, rbx
call fcn.62d98300
mov dword [rbx + 0x244], 0
sub qword [rbx + 0x248], 0xffffffffffffff80
jmp 0x62dffd40
mov r14d, 1
jmp 0x62dffb86
mov eax, dword [rbx + 0x244]
cmp eax, 0xf
jg 0x62dffb80
xor r12d, r12d
test eax, eax
jne 0x62dffd20
jmp 0x62dffcc4
xor r12d, r12d
jmp 0x62dffd20
Function at 0x62e001f0
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push r12
push rbp
mov ebp, 0x10
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x240]
test eax, eax
jne 0x62e00331
cmp dword [rcx + 0x244], 0xf
mov rbx, rcx
ja 0x62e00331
mov ecx, dword [rcx + 0x238]
mov rsi, rdx
mov r12d, r8d
call fcn.62d9e1e0
test eax, eax
mov ebp, eax
jne 0x62e00331
mov eax, dword [rbx + 0x244]
lea edx, [rax + r12]
cmp edx, 0xc
jbe 0x62e00252
or dword [rbx + 0x23c], 1
xor edi, edi
test eax, eax
jne 0x62e002ab
mov r13d, r12d
and r13d, 0xfffffff0
je 0x62e00342
lea r14, [rbx + 0x1f8]
nop dword [rax]
mov eax, edi
mov rdx, r14
mov rcx, rbx
mov rax, qword [rsi + rax]
xor qword [rbx + 0x1f8], rax
lea eax, [rdi + 8]
add edi, 0x10
mov rax, qword [rsi + rax]
xor qword [rbx + 0x200], rax
call fcn.62d98300
sub qword [rbx + 0x248], 0xffffffffffffff80
cmp edi, r13d
jb 0x62e00270
mov eax, edi
add rsi, rax
cmp r12d, edi
jbe 0x62e00331
sub r12d, 1
lea r13, [rbx + 0x1f8]
sub r12d, edi
lea rdi, [rbx + 0x208]
lea r12, [rsi + r12 + 1]
jmp 0x62e002d5
cmp r12, rsi
je 0x62e00331
movsxd rdx, dword [rbx + 0x244]
add rsi, 1
lea ecx, [rdx + 1]
mov dword [rbx + 0x244], ecx
movzx eax, byte [rsi - 1]
cmp ecx, 0x10
mov byte [rbx + rdx + 0x228], al
jne 0x62e002d0
mov rdx, r13
nop dword [rax]
movzx ecx, byte [rdx + 0x30]
xor byte [rdx], cl
add rdx, 1
cmp rdi, rdx
jne 0x62e00300
mov rdx, r13
mov rcx, rbx
call fcn.62d98300
sub qword [rbx + 0x248], 0xffffffffffffff80
cmp r12, rsi
mov dword [rbx + 0x244], 0
jne 0x62e002d5
add rsp, 0x20
mov eax, ebp
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edi, eax
jmp 0x62e002ab
Function at 0x63567058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.635671df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x63567089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x6356706f
add dl, dl
jne 0x63567096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x635670f6
xor eax, eax
add dl, dl
jne 0x635670a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x635671ad
add dl, dl
jne 0x635670b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x635670c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x635670d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x635670dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x635670ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x6356707e
mov eax, 1
add dl, dl
jne 0x63567106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x63567113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x635670fb
sub eax, ebx
mov ebx, 1
jne 0x6356714c
mov ecx, 1
add dl, dl
jne 0x6356712e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x6356713b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x63567123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x6356707e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x63567168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x63567175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x6356715d
cmp eax, 0x7d00
jae 0x6356719b
cmp eax, 0x500
jb 0x63567196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x6356707e
cmp eax, 0x7f
ja 0x6356719e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x6356707e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x635671d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x6356707e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1423400
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x142340d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x142341d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1423405
lea eax, [rcx + 1]
jmp 0x142342b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x142343e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1423424
sub eax, 3
jb 0x142345e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14234ad
sar eax, 1
movsxd rbp, eax
jb 0x1423494
jmp 0x142346c
add ebx, ebx
jne 0x142346a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1423494
inc ecx
add ebx, ebx
jne 0x142347a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1423494
call r11
adc ecx, ecx
add ebx, ebx
jne 0x142348d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x142347c
add ecx, 2
jmp 0x1423499
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.014233c2
jmp 0x142340d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x100f000]
mov eax, dword [rdi]
or eax, eax
je 0x1423509
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x1023000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14234b9
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1423503
mov qword [rbx], rax
add rbx, 8
jmp 0x14234d9
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x142354d
cmp al, 0xef
ja 0x1423535
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1423515
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1423524
mov eax, dword [rdi]
add rdi, 4
jmp 0x1423524
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14235a1
sub rsp, 0xffffffffffffff80
jmp 0x45bb20
Function at 0x14079e058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14079e1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14079e089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14079e06f
add dl, dl
jne 0x14079e096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14079e0f6
xor eax, eax
add dl, dl
jne 0x14079e0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14079e1ad
add dl, dl
jne 0x14079e0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14079e0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14079e0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14079e0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14079e0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14079e07e
mov eax, 1
add dl, dl
jne 0x14079e106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14079e113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14079e0fb
sub eax, ebx
mov ebx, 1
jne 0x14079e14c
mov ecx, 1
add dl, dl
jne 0x14079e12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14079e13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14079e123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14079e07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14079e168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14079e175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14079e15d
cmp eax, 0x7d00
jae 0x14079e19b
cmp eax, 0x500
jb 0x14079e196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14079e07e
cmp eax, 0x7f
ja 0x14079e19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14079e07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14079e1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14079e07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140019490
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x140019634
cmp r9, 4
jb 0x1400194da
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x1400194c0
xor r11d, r11d
test r9, r9
je 0x140019634
cmp r9, 8
jb 0x14001960e
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x14001950c
cmp rdx, r8
jae 0x14001960e
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x140019521
cmp rdx, r10
jae 0x14001960e
mov rdx, r10
mov qword [rsp + 0x10], rbx
sub rdx, r8
mov qword [rsp], rdi
cmp r9, 0x40
jb 0x1400195cb
mov rdi, r9
mov qword [rsp + 0x18], rsi
and edi, 0x3f
mov rsi, r9
sub rsi, rdi
mov rbx, rcx
lea rax, [r8 + 0x10]
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rsi
jb 0x140019560
mov rsi, qword [rsp + 0x18]
cmp rdi, 8
jb 0x140019600
mov rbx, r9
and rbx, 0xfffffffffffffff8
mov rdi, rcx
lea rax, [r11 + r8]
sub rdi, r8
nop dword [rax]
movq xmm1, qword [rax + rdx]
add r11, 8
movq xmm0, qword [rax]
lea rax, [rax + 8]
pxor xmm1, xmm0
movq qword [rax + rdi - 8], xmm1
cmp r11, rbx
jb 0x1400195e0
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r11, r9
jae 0x140019634
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
nop dword [rax + rax]
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x140019620
add rsp, 8
ret

Function at 0x14001f2a4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001f2ee
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001f2ee
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001f2ee
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001f2ee
cmp dword [rcx + 0x84], 0xe
jbe 0x14001f2ee
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001f2f0
xor al, al
add rsp, 0x28
ret
Function at 0x140001c90
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140001cb8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140001cde
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140001ce0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140001d39
test ecx, ecx
jle 0x140001d19
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140001d39
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140001d39
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140001d60
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140001d82
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140001d98
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140001db4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140001db6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140001df2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140001e8e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140001e2d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140001e6e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140001e8e
cmp rbx, rax
ja 0x140001e40
test rbx, rbx
je 0x140001e8e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret