joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000db20
Capabilities:
Create process on windows
Terminate process

Disassembly:
sub rsp, 0x88
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x70], rax
lea rdx, str.https:__raw.githubusercontent.com_atlashaha_kss_refs_heads_main_ks2
lea rcx, [rsp + 0x50]
call fcn.140007ae0
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.14000d960
lea rdx, str.KS_ON_n
lea rcx, [rsp + 0x30]
call fcn.140008a80
test al, al
jne 0x14000dbbf
mov r9d, 0x30
lea r8, [0x140012630]
lea rdx, str.Program_is_outdated__please_join_the_discord_server_for_updates.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x14000dbb3
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.https:__discord.gg_N9NJfuP3
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rsp + 0x30]
call fcn.140001870
nop
lea rcx, [rsp + 0x50]
call fcn.140001870
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14000f430
add rsp, 0x88
ret

Function at 0x14000dc30
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x38
call fcn.14000db20
mov r9d, 0x24
lea r8, str.Archive_V1.01
lea rdx, str.This_program_is_a_PC_Checking_Tool._This_program_does_not_collect_nor_store_any_type_of_data__and_only_checks_things_that_are_necessary_in_a_PC_Check._Do_you_agree_to_run_this_program_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
lea r8, [0x140012630]
cmp eax, 6
jne 0x14000dcf6
mov r9d, 0x40
lea rdx, str.Checks_will_now_start_executing.
call qword [sym.imp.USER32.dll_MessageBoxW]
mov r9d, 0x44
lea r8, str.Discord_server
lea rdx, str.Click_Yes_to_join_my_Discord_server_for_updates_and_information._Click_No_to_skip.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x14000dcc5
mov dword [rsp + 0x28], 1
lea r8, str.https:__discord.gg_N9NJfuP3
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0xb
call fcn.140003130
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str._n_n_n________________________.______.___________________________________________________n________________________________________________________________________n__________________________________________Y______________________n_____________________Y___________________________________________n_____________________________________________________________________n_____________________________________________________________________________n_n_n__________________________________________________________________________________________________________n
call fcn.140001d90
mov rcx, rax
call fcn.14000dd20
call fcn.14000dbf0
xor eax, eax
add rsp, 0x38
ret
mov r9d, 0x30
lea rdx, str.Exiting_the_program._Nothing_was_executed.
call qword [sym.imp.USER32.dll_MessageBoxW]
mov eax, 1
add rsp, 0x38
ret
Function at 0x14000e3d0
Capabilities:
Query service status

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor edx, edx
xor ecx, ecx
mov r8d, 1
xor esi, esi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
test rax, rax
jne 0x14000e41e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenSCManager_failed__Error:__u_n
call fcn.14000e390
xor eax, eax
jmp 0x14000e4bf
mov r8d, 4
mov qword [rsp + 0x80], rdi
lea rdx, str.dnscache
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x14000e465
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.OpenService_failed__Error:__u_n
call fcn.14000e390
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x14000e4b7
lea rax, [rsp + 0x30]
mov r9d, 0x24
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
je 0x14000e48f
mov esi, dword [rsp + 0x54]
jmp 0x14000e4a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.QueryServiceStatusEx_failed__Error:__u_n
call fcn.14000e390
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, esi
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14000f430
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rsi
ret

Function at 0x14000ea34
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14000ea6e
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14000ea73
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14000eabc
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140011820]
cmp byte [rcx + rax], 0
je 0x14000eabc
dec r8
sub rdx, 1
jne 0x14000eaa2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x1400101b4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400101fe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400101fe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400101fe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400101fe
cmp dword [rcx + 0x84], 0xe
jbe 0x1400101fe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140010200
xor al, al
add rsp, 0x28
ret
Function at 0x14002f640
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14002f64d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14002f65d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14002f645
lea eax, [rcx + 1]
call r11
adc eax, eax
add ebx, ebx
jne 0x14002f675
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14002f662
sub eax, 3
jb 0x14002f68f
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14002f6c6
movsxd rbp, eax
lea eax, [rcx + 1]
call r11
adc ecx, ecx
call r11
adc ecx, ecx
jne 0x14002f6b6
mov ecx, eax
add eax, 2
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14002f6b4
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14002f6a3
cmp rbp, 0xfffffffffffff300
adc ecx, eax
call fcn.14002f602
jmp 0x14002f64d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xb600
mov dl, 6
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14002f712
cmp rsi, rcx
jae 0x14002f71a
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14002f6f9
cmp al, 0x8f
ja 0x14002f6f9
cmp byte [rsi - 2], 0xf
je 0x14002f6ff
sub al, 0xe8
cmp al, 1
ja 0x14002f6e3
cmp rsi, rcx
jae 0x14002f71a
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14002f6e9
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14002f71a
lodsb al, byte [rsi]
jmp 0x14002f6f9
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x2d000]
mov eax, dword [rdi]
or eax, eax
je 0x14002f777
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x2f4ec]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14002f727
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14002f771
mov qword [rbx], rax
add rbx, 8
jmp 0x14002f747
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14002f7b1
cmp al, 0xef
ja 0x14002f7a3
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14002f783
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14002f792
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14002f830], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14002f830
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14002f820
sub rsp, 0xffffffffffffff80
jmp 0x1400014e0
Function at 0x11640
Capabilities:
Set registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x1a0
mov rax, qword [0x00013100]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov r12d, r8d
mov rbp, rdx
mov rsi, rcx
mov rax, cr8
xor ebx, ebx
cmp al, bl
je 0x1167b
lea eax, [rbx + 1]
jmp 0x11738
lea r8, str.RegistryMACHINESystemCurrentControlSetMultiKeyDumps
lea rdx, [0x00012270]
lea rcx, [rsp + 0x90]
add r9, 0x1244
call qword [sym.imp.ntoskrnl.exe_swprintf]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rax, [rsp + 0x78]
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov edx, 0x20006
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], 0x30
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x50], 0x40
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
cmp eax, ebx
mov edi, eax
jl 0x11731
lea rcx, [rsp + 0x68]
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x68]
mov r9d, 3
xor r8d, r8d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
cmp edi, ebx
setl bl
mov eax, ebx
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.00011d10
add rsp, 0x1a0
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x117a4
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x000132f0], 0
mov rsi, rcx
je 0x117fe
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
mov r8d, dword [0x000132f0]
lea rcx, [0x00012280]
mov rdx, rax
mov rbx, rax
call sub.ntoskrnl.exe_DbgPrint
mov edi, dword [0x000132f0]
lea rcx, [0x000122a0]
add rdi, rbx
mov rdx, rdi
call sub.ntoskrnl.exe_DbgPrint
movdqu xmm5, xmmword [rdi]
movdqu xmmword [rsi], xmm5
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x11818
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbp, rcx
lea rcx, [rax - 0x20]
mov edi, r9d
mov rsi, r8
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
and dword [rsp + 0x30], 0
xor r9d, r9d
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
lea r8d, [r9 + 2]
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov ecx, dword [rsp + 0x30]
cmp eax, 0xc0000034
jne 0x11886
cmp ecx, edi
jae 0x11886
cmp ecx, 0x1000
ja 0x11886
mov eax, 0xc000000d
jmp 0x118ed
mov rdx, rcx
mov r8d, 0x656e6f4e
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
test rax, rax
mov rbx, rax
jne 0x118a6
mov eax, 0xc000009a
jmp 0x118ed
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov r9, rbx
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0x30]
mov r8d, 2
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
test eax, eax
js 0x1187f
lea rdx, [rbx + 0xc]
mov r8, rdi
mov rcx, rsi
call fcn.00011d80
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ExFreePool]
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1595c
Capabilities:
Create device object
Print debug messages

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov eax, 0x1300
call sub.ntoskrnl.exe___chkstk
sub rsp, rax
mov rax, qword [0x00013100]
xor rax, rsp
mov qword [rsp + 0x12f0], rax
cmp dword [0x000132d4], 0x10
mov rsi, r8
mov edi, edx
mov rbx, rcx
jae 0x15b2e
lea rcx, [0x00019e70]
call sub.ntoskrnl.exe_DbgPrint
lea rcx, [rsp + 0x48]
mov rdx, rbx
mov r8d, 0x34
call fcn.00011d80
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x48]
call fcn.00019030
test eax, eax
js 0x15b33
lea rcx, [0x00019e90]
call sub.ntoskrnl.exe_DbgPrint
mov edx, dword [0x000132d4]
mov eax, dword [rbx + 4]
lea r8, [0x00010000]
lea r12, [rdi - 0x34]
mov ebp, 1
mov dword [r8 + rdx*4 + 0x31e0], eax
mov eax, dword [rbx + 8]
shr r12, 1
mov dword [r8 + rdx*4 + 0x3220], eax
add edx, ebp
lea eax, [r12 - 1]
cmp word [rbx + rax*2 + 0x34], 0
mov dword [0x000132d4], edx
jne 0x15b2e
lea eax, [r12 - 2]
cmp word [rbx + rax*2 + 0x34], 0
jne 0x15b2e
call qword [sym.imp.ntoskrnl.exe_KeEnterCriticalRegion]
lea rcx, [rsi + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExAcquireFastMutex]
lea r11, [rsi + 0x30]
mov rax, qword [r11]
cmp rax, r11
je 0x15a66
mov ecx, dword [rbx + 4]
cmp ecx, dword [rax - 8]
je 0x15a63
mov rax, qword [rax]
cmp rax, r11
jne 0x15a54
jmp 0x15a66
xor bpl, bpl
lea rcx, [rsi + 0x48]
call qword [sym.imp.ntoskrnl.exe_ExReleaseFastMutex]
call qword [sym.imp.ntoskrnl.exe_KeLeaveCriticalRegion]
test bpl, bpl
je 0x15b2e
mov rcx, qword [rsi]
lea rax, [rsp + 0x40]
mov r9d, 0x2a
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov edx, 0x12c0
mov byte [rsp + 0x28], 0
add r12d, r12d
mov dword [rsp + 0x20], 0x180
call qword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
mov edi, eax
js 0x15b33
mov rax, qword [rsp + 0x40]
mov r8d, 0x62735556
mov rdx, r12
mov rbp, qword [rax + 0x40]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
test rax, rax
mov qword [rbp + 0x28], rax
jne 0x15aef
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, 0xc000009a
jmp 0x15b33
lea rdx, [rbx + 0x34]
mov r8, r12
mov rcx, rax
call fcn.00011d80
mov r11d, dword [rbx + 4]
mov rdx, rsi
mov dword [rbp + 0x30], r11d
mov rcx, qword [rsp + 0x40]
call fcn.000158a8
lea rcx, [rbp + 0x50]
lea rdx, [rsp + 0x80]
mov r8d, 0x126c
call fcn.00011d80
mov eax, edi
jmp 0x15b33
mov eax, 0xc000000d
mov rcx, qword [rsp + 0x12f0]
xor rcx, rsp
call fcn.00011d10
add rsp, 0x1300
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x195d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r9b, byte [rcx + 1]
mov dil, byte [rcx + 2]
mov r11b, byte [rcx]
shr dil, 7
mov al, r9b
mov rbx, rcx
shr al, 5
not dil
and al, 1
and dil, 1
mov byte [rcx + 0xa], al
jne 0x19615
not r11b
and dword [rsp + 0x50], 0
mov esi, 0x1f
mov r10b, byte [rsp + 0x50]
lea edx, [rsi - 0x1b]
and r9b, sil
mov al, r10b
mov cl, r9b
shl al, 2
add cl, cl
not cl
and cl, 2
mov r10b, cl
or r10b, al
mov al, r9b
shr r9b, 1
and al, 1
or r10b, al
sub rdx, 1
jne 0x1962a
mov bpl, r10b
xor r12d, r12d
mov byte [rsp + 0x50], r10b
not bpl
or r13d, 0xffffffff
lea r14d, [rdx + 0x18]
mov byte [rsp + 0x52], bpl
mov r15d, 0xfe
lea rax, [r14 - 0x10]
mov r8d, r13d
sub r13d, 1
sar rax, 2
and r8d, 7
and rax, r15
mov cl, r8b
mov dl, byte [rax + rbx + 2]
mov rax, r14
add r14, 1
shr dl, cl
mov ecx, r12d
sar rax, 2
and dl, 1
and rax, r15
xor dl, r9b
shl dl, cl
mov cl, r8b
xor r10b, dl
mov dl, byte [rax + rbx + 2]
shr dl, cl
mov ecx, r12d
add r12d, 1
and dl, 1
xor dl, r9b
shl dl, cl
xor bpl, dl
cmp r13d, 0xfffffff7
jg 0x19672
and dword [rbx + 0xb], 0
movzx r12d, r11b
xor r13d, r13d
mov r14d, r12d
mov byte [rsp + 0x51], r10b
mov byte [rsp + 0x53], bpl
shl r14d, 3
mov r15, rsi
mov dword [rbx + 0xf], r14d
mov ebp, 0xc
mov rdx, rbx
mov ecx, esi
call fcn.00019514
sub rbp, 1
mov r11d, eax
jne 0x196f6
mov eax, dword [rsp + 0x50]
mov rcx, r15
sub r15, 1
sar rcx, 2
and ecx, 0xfe
movzx edx, byte [rcx + rbx + 2]
mov ecx, 0xff
sub cl, sil
and ecx, 7
shr edx, cl
mov ecx, esi
shr eax, cl
xor edx, eax
movzx eax, r11b
xor edx, esi
and edx, 1
xor edx, eax
lea eax, [r13 + r13]
mov r13d, edx
or r13d, eax
sub esi, 1
jns 0x196ed
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
movzx eax, dil
lea ecx, [r12 + r12]
mov dword [rbx + 0xb], r13d
or ecx, eax
add ecx, ecx
or ecx, eax
add ecx, ecx
or ecx, eax
mov dword [rbx + 0xf], ecx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x19820
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0xa0
mov rax, qword [0x00013100]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rdx
lea rdx, [rsp + 0x20]
mov rbp, rcx
call fcn.00019924
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x38]
call fcn.000120d0
mov r11, qword [rbp + 0x93]
lea rdi, [rsp + 0x40]
mov qword [rsp + 0x68], r11
mov esi, 6
sub rdi, 4
mov eax, dword [rsp + 0x6c]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x64]
lea rcx, [rsp + 0x6c]
mov r9, rbp
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
call fcn.00011af4
add rdi, 4
movzx r11d, al
mov eax, dword [rsp + 0x68]
sub esi, 1
xor dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x60]
add word [rsp + 0x5c], r11w
test esi, esi
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x64]
mov dword [rdi], eax
jg 0x1987b
mov eax, dword [rsp + 0x44]
mov dword [rbx], eax
mov eax, dword [rsp + 0x40]
mov dword [rbx + 4], eax
mov eax, dword [rsp + 0x4c]
mov dword [rbx + 8], eax
mov eax, dword [rsp + 0x48]
mov dword [rbx + 0xc], eax
mov eax, dword [rsp + 0x54]
mov dword [rbx + 0x10], eax
mov eax, dword [rsp + 0x50]
mov dword [rbx + 0x14], eax
movzx eax, word [rsp + 0x5c]
mov word [rbx + 0x18], ax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.00011d10
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret

Function at 0x19a40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x00013100]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rdx
lea rdx, [rsp + 0x28]
mov rbp, rcx
call fcn.00019924
movzx r12d, word [rbx]
movzx r13d, word [rbx + 2]
movzx esi, word [rbx + 4]
movzx edi, word [rbx + 6]
mov r14d, 5
and word [rsp + 0x2a], 0
lea r8, [rsp + 0x28]
mov r9, rbp
xor edx, edx
movzx ecx, si
mov word [rsp + 0x28], 0xf
call fcn.000199a8
lea r8, [rsp + 0x28]
mov r9, rbp
movzx edx, ax
movzx ecx, di
call fcn.000199a8
xor ax, di
movzx ecx, ax
add ax, ax
shr cx, 0xf
add cx, ax
mov word [rsp + 0x20], cx
shr cx, 8
add byte [rsp + 0x20], cl
movzx r8d, word [rsp + 0x20]
xor r8w, di
xor r8w, si
movzx eax, r8w
shr ax, 8
add al, r8b
mov cl, al
add al, al
shr cl, 7
add cl, al
add cl, 1
mov dl, cl
add cl, cl
shr dl, 7
add dl, cl
add r8b, dl
mov cl, r8b
add r8b, r8b
shr cl, 7
add cl, r8b
mov al, cl
add cl, cl
shr al, 7
add al, cl
movzx r8d, al
movzx eax, dl
shl ax, 8
add r8w, ax
lea edx, [rdi + r8]
xor r8w, r12w
mov r12w, si
lea eax, [rdx + 1]
xor si, r8w
xor al, dl
movzx eax, al
xor dx, ax
movzx ecx, dx
add dx, dx
shr cx, 0xf
add cx, dx
movzx eax, cx
add cx, cx
shr ax, 0xf
add ax, cx
xor ax, r13w
mov r13w, di
xor di, ax
sub r14, 1
jne 0x19a8c
mov word [rbx], si
mov word [rbx + 2], di
mov word [rbx + 4], r12w
mov word [rbx + 6], r13w
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.00011d10
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1b008
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call fcn.00011238
mov dword [0x000132f0], eax
call fcn.00011238
lea rcx, [0x0001b160]
mov edx, eax
call sub.ntoskrnl.exe_DbgPrint
movzx r11d, word [rdi]
mov ecx, 1
add r11w, 2
mov r8d, 0x62735556
mov word [0x000132e2], r11w
movzx eax, word [rdi]
movzx edx, r11w
mov word [0x000132e0], ax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
test rax, rax
mov qword [0x000132e8], rax
jne 0x1b079
mov eax, 0xc000009a
jmp 0x1b0ef
lea rcx, [0x000132e0]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rax, [0x00015358]
lea r11, [0x00015008]
mov qword [rbx + 0x148], rax
lea rax, [0x00011404]
lea rcx, [0x000151f0]
mov qword [rbx + 0x120], rax
lea rax, [0x000150a4]
mov qword [rbx + 0x80], r11
mov qword [rbx + 0xe0], rax
lea rax, [0x00018840]
mov qword [rbx + 0x70], r11
mov qword [rbx + 0xe8], rax
lea rax, [0x000151cc]
mov qword [rbx + 0x68], rax
mov rax, qword [rbx + 0x30]
mov qword [rax + 8], rcx
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x00013100]
movabs r9, 0x2b992ddfa232
test rax, rax
je 0x1b11b
cmp rax, r9
jne 0x1b14a
lea r8, [0x00013100]
movabs rax, 0xfffff78000000320
mov rax, qword [rax]
xor rax, r8
movabs r8, 0xffffffffffff
and rax, r8
cmove rax, r9
mov qword [0x00013100], rax
not rax
mov qword [0x00013108], rax
jmp 0x1b008

Function at 0x1b100
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call fcn.00011238
mov dword [0x000132f0], eax
call fcn.00011238
lea rcx, [0x0001b160]
mov edx, eax
call sub.ntoskrnl.exe_DbgPrint
movzx r11d, word [rdi]
mov ecx, 1
add r11w, 2
mov r8d, 0x62735556
mov word [0x000132e2], r11w
movzx eax, word [rdi]
movzx edx, r11w
mov word [0x000132e0], ax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
test rax, rax
mov qword [0x000132e8], rax
jne 0x1b079
mov eax, 0xc000009a
jmp 0x1b0ef
lea rcx, [0x000132e0]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rax, [0x00015358]
lea r11, [0x00015008]
mov qword [rbx + 0x148], rax
lea rax, [0x00011404]
lea rcx, [0x000151f0]
mov qword [rbx + 0x120], rax
lea rax, [0x000150a4]
mov qword [rbx + 0x80], r11
mov qword [rbx + 0xe0], rax
lea rax, [0x00018840]
mov qword [rbx + 0x70], r11
mov qword [rbx + 0xe8], rax
lea rax, [0x000151cc]
mov qword [rbx + 0x68], rax
mov rax, qword [rbx + 0x30]
mov qword [rax + 8], rcx
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x00013100]
movabs r9, 0x2b992ddfa232
test rax, rax
je 0x1b11b
cmp rax, r9
jne 0x1b14a
lea r8, [0x00013100]
movabs rax, 0xfffff78000000320
mov rax, qword [rax]
xor rax, r8
movabs r8, 0xffffffffffff
and rax, r8
cmove rax, r9
mov qword [0x00013100], rax
not rax
mov qword [0x00013108], rax
jmp 0x1b008
Function at 0x1b11b
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call fcn.00011238
mov dword [0x000132f0], eax
call fcn.00011238
lea rcx, [0x0001b160]
mov edx, eax
call sub.ntoskrnl.exe_DbgPrint
movzx r11d, word [rdi]
mov ecx, 1
add r11w, 2
mov r8d, 0x62735556
mov word [0x000132e2], r11w
movzx eax, word [rdi]
movzx edx, r11w
mov word [0x000132e0], ax
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
test rax, rax
mov qword [0x000132e8], rax
jne 0x1b079
mov eax, 0xc000009a
jmp 0x1b0ef
lea rcx, [0x000132e0]
mov rdx, rdi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
lea rax, [0x00015358]
lea r11, [0x00015008]
mov qword [rbx + 0x148], rax
lea rax, [0x00011404]
lea rcx, [0x000151f0]
mov qword [rbx + 0x120], rax
lea rax, [0x000150a4]
mov qword [rbx + 0x80], r11
mov qword [rbx + 0xe0], rax
lea rax, [0x00018840]
mov qword [rbx + 0x70], r11
mov qword [rbx + 0xe8], rax
lea rax, [0x000151cc]
mov qword [rbx + 0x68], rax
mov rax, qword [rbx + 0x30]
mov qword [rax + 8], rcx
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x00013100]
movabs r9, 0x2b992ddfa232
test rax, rax
je 0x1b11b
cmp rax, r9
jne 0x1b14a
lea r8, [0x00013100]
movabs rax, 0xfffff78000000320
mov rax, qword [rax]
xor rax, r8
movabs r8, 0xffffffffffff
and rax, r8
cmove rax, r9
mov qword [0x00013100], rax
not rax
mov qword [0x00013108], rax
jmp 0x1b008