joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005edf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx]
mov rbp, rdx
mov rbx, rcx
call qword [rax + 0x28]
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x50]
sub rcx, 0x10
mov qword [rsp + 0x50], rax
lea r8, [rsp + 0x40]
cmp rcx, rax
mov qword [rsp + 0x40], rcx
mov rcx, qword [rbx + 0x10]
cmovae r8, rdx
add rcx, 0x10
mov rdx, rbp
mov r8, qword [r8]
call fcn.1402b7460
mov rax, qword [rbx]
mov rdi, qword [rbx + 0x10]
mov rcx, rbx
call qword [rax + 0x28]
lea r8, [rdi + 0x10]
lea rcx, [rdi + 0x20]
mov r9, rax
mov rdx, rdi
call fcn.14001b140
xor dl, dl
xor edi, edi
mov r10d, edi
lea r14, [0x140345220]
nop dword [rax]
nop word [rax + rax]
mov r9, rdi
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbx + 0x10]
movzx eax, dl
movzx eax, byte [rax + r14]
xor byte [rcx + r9], al
movzx eax, byte [rcx + r9]
mov rdx, qword [rbx + 0x10]
movzx eax, byte [rax + r14]
xor byte [rdx + r9 + 1], al
movzx eax, byte [rdx + r9 + 1]
mov rcx, qword [rbx + 0x10]
movzx eax, byte [rax + r14]
xor byte [rcx + r9 + 2], al
movzx eax, byte [rcx + r9 + 2]
mov rdx, qword [rbx + 0x10]
movzx eax, byte [rax + r14]
xor byte [rdx + r9 + 3], al
movzx eax, byte [rdx + r9 + 3]
mov rcx, qword [rbx + 0x10]
movzx eax, byte [rax + r14]
xor byte [rcx + r9 + 4], al
movzx eax, byte [rcx + r9 + 4]
mov rdx, qword [rbx + 0x10]
movzx eax, byte [rax + r14]
add rdx, 5
add rdx, r9
add r9, 8
xor byte [rdx], al
movzx eax, byte [rdx]
mov r8, qword [rbx + 0x10]
movzx eax, byte [rax + r14]
xor byte [r8 + r9 - 2], al
movzx eax, byte [r8 + r9 - 2]
mov rcx, qword [rbx + 0x10]
movzx eax, byte [rax + r14]
xor byte [rcx + r9 - 1], al
movzx edx, byte [rcx + r9 - 1]
cmp r9, 0x30
jne 0x14005ee90
add dl, r10b
inc r10
cmp r10, 0x12
jne 0x14005ee80
mov rax, qword [rbx + 0x30]
mov rcx, rbx
movzx esi, byte [rax + 0xf]
mov rax, qword [rbx]
call qword [rax + 0x28]
test rax, rax
je 0x14005ef9e
nop word [rax + rax]
movzx ecx, byte [rdi + rbp]
mov rdx, qword [rbx + 0x30]
movzx eax, sil
xor rcx, rax
inc rdi
movzx eax, byte [rcx + r14]
mov rcx, rbx
xor byte [rdx + rdi - 1], al
movzx esi, byte [rdx + rdi - 1]
mov rax, qword [rbx]
call qword [rax + 0x28]
cmp rdi, rax
jne 0x14005ef70
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14005f0e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx]
mov rsi, qword [rcx + 0x70]
mov r14, rdx
mov rbx, rcx
call qword [rax + 0x28]
cmp rsi, rax
je 0x14005f135
nop word [rax + rax]
mov rax, qword [rbx]
mov rdi, qword [rbx + 0x50]
mov rcx, rbx
call qword [rax + 0x28]
mov rcx, rbx
inc rsi
sub al, byte [rbx + 0x70]
mov byte [rdi + rsi - 1], al
mov rax, qword [rbx]
call qword [rax + 0x28]
cmp rsi, rax
jne 0x14005f110
mov rax, qword [rbx]
mov rbp, qword [rbx + 0x50]
mov rcx, rbx
call qword [rax + 0x28]
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x60]
sub rcx, 0x10
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x50]
cmp rcx, rax
mov qword [rsp + 0x50], rcx
mov rcx, qword [rbx + 0x10]
cmovae r8, rdx
add rcx, 0x10
mov rdx, rbp
mov r8, qword [r8]
call fcn.1402b7460
mov rax, qword [rbx]
mov rdi, qword [rbx + 0x10]
mov rcx, rbx
call qword [rax + 0x28]
lea r8, [rdi + 0x10]
lea rcx, [rdi + 0x20]
mov r9, rax
mov rdx, rdi
call fcn.14001b140
xor dl, dl
xor edi, edi
mov r10d, edi
lea r15, [0x140345220]
nop word [rax + rax]
mov r9, rdi
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbx + 0x10]
movzx eax, dl
movzx eax, byte [rax + r15]
xor byte [rcx + r9], al
movzx eax, byte [rcx + r9]
mov rdx, qword [rbx + 0x10]
movzx eax, byte [rax + r15]
xor byte [rdx + r9 + 1], al
movzx eax, byte [rdx + r9 + 1]
mov rcx, qword [rbx + 0x10]
movzx eax, byte [rax + r15]
xor byte [rcx + r9 + 2], al
movzx eax, byte [rcx + r9 + 2]
mov rdx, qword [rbx + 0x10]
movzx eax, byte [rax + r15]
xor byte [rdx + r9 + 3], al
movzx eax, byte [rdx + r9 + 3]
mov rcx, qword [rbx + 0x10]
movzx eax, byte [rax + r15]
xor byte [rcx + r9 + 4], al
movzx eax, byte [rcx + r9 + 4]
mov rdx, qword [rbx + 0x10]
movzx eax, byte [rax + r15]
add rdx, 5
add rdx, r9
add r9, 8
xor byte [rdx], al
movzx eax, byte [rdx]
mov r8, qword [rbx + 0x10]
movzx eax, byte [rax + r15]
xor byte [r8 + r9 - 2], al
movzx eax, byte [r8 + r9 - 2]
mov rcx, qword [rbx + 0x10]
movzx eax, byte [rax + r15]
xor byte [rcx + r9 - 1], al
movzx edx, byte [rcx + r9 - 1]
cmp r9, 0x30
jne 0x14005f1c0
add dl, r10b
inc r10
cmp r10, 0x12
jne 0x14005f1b0
mov rax, qword [rbx + 0x30]
mov rcx, rbx
movzx esi, byte [rax + 0xf]
mov rax, qword [rbx]
call qword [rax + 0x28]
test rax, rax
je 0x14005f2ce
nop word [rax + rax]
movzx ecx, byte [rdi + rbp]
mov rdx, qword [rbx + 0x30]
movzx eax, sil
xor rcx, rax
inc rdi
movzx eax, byte [rcx + r15]
mov rcx, rbx
xor byte [rdx + rdi - 1], al
movzx esi, byte [rdx + rdi - 1]
mov rax, qword [rbx]
call qword [rax + 0x28]
cmp rdi, rax
jne 0x14005f2a0
mov rdx, qword [rbx + 0x30]
mov rcx, rbx
call fcn.14005edf0
mov rax, qword [rbx]
mov rdi, qword [rbx + 0x10]
mov rcx, rbx
call qword [rax]
mov rdx, rdi
mov rcx, r14
mov r8, rax
call fcn.1402b7460
mov rax, qword [rbx + 8]
lea rcx, [rbx + 8]
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
jmp qword [rax]
Function at 0x14005f9d0
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx + 0x10]
mov rbx, rcx
test r8, r8
je 0x14005f9ed
mov rcx, qword [rcx + 8]
xor edx, edx
call fcn.1402bfa30
xor eax, eax
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x28], rax
mov r8, qword [rbx + 0x50]
test r8, r8
je 0x14005fa13
mov rcx, qword [rbx + 0x48]
lea r8, [r8*4]
xor edx, edx
call fcn.1402bfa30
mov rax, qword [rbx + 0x68]
mov dword [rax], 0x67452301
mov rax, qword [rbx + 0x68]
mov dword [rax + 4], 0xefcdab89
mov rax, qword [rbx + 0x68]
mov dword [rax + 8], 0x98badcfe
mov rax, qword [rbx + 0x68]
mov dword [rax + 0xc], 0x10325476
add rsp, 0x20
pop rbx
ret

Function at 0x14005fa50
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x140060292
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push r14
push r15
sub rsp, 0x60
mov rax, qword [rcx + 0x70]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], r12
mov r15d, dword [rax]
mov esi, dword [rax + 4]
mov ebp, dword [rax + 8]
mov r14d, dword [rax + 0xc]
mov rbx, rcx
mov qword [rsp + 0x48], r13
nop word [rax + rax]
Function at 0x140063e20
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx + 0x10]
mov rbx, rcx
test r8, r8
je 0x140063e3d
mov rcx, qword [rcx + 8]
xor edx, edx
call fcn.1402bfa30
xor eax, eax
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x28], rax
mov r8, qword [rbx + 0x70]
test r8, r8
je 0x140063e63
mov rcx, qword [rbx + 0x68]
lea r8, [r8*4]
xor edx, edx
call fcn.1402bfa30
mov rax, qword [rbx + 0x48]
mov dword [rax], 0x67452301
mov rax, qword [rbx + 0x48]
mov dword [rax + 4], 0xefcdab89
mov rax, qword [rbx + 0x48]
mov dword [rax + 8], 0x98badcfe
mov rax, qword [rbx + 0x48]
mov dword [rax + 0xc], 0x10325476
mov rax, qword [rbx + 0x48]
mov dword [rax + 0x10], 0xc3d2e1f0
add rsp, 0x20
pop rbx
ret
Function at 0x140066690
Capabilities:
Hash data using sha224

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx + 0x10]
mov rbx, rcx
test r8, r8
je 0x1400666ad
mov rcx, qword [rcx + 8]
xor edx, edx
call fcn.1402bfa30
xor eax, eax
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x28], rax
mov rax, qword [rbx + 0x48]
mov dword [rax], 0xc1059ed8
mov rax, qword [rbx + 0x48]
mov dword [rax + 4], 0x367cd507
mov rax, qword [rbx + 0x48]
mov dword [rax + 8], 0x3070dd17
mov rax, qword [rbx + 0x48]
mov dword [rax + 0xc], 0xf70e5939
mov rax, qword [rbx + 0x48]
mov dword [rax + 0x10], 0xffc00b31
mov rax, qword [rbx + 0x48]
mov dword [rax + 0x14], 0x68581511
mov rax, qword [rbx + 0x48]
mov dword [rax + 0x18], 0x64f98fa7
mov rax, qword [rbx + 0x48]
mov dword [rax + 0x1c], 0xbefa4fa4
add rsp, 0x20
pop rbx
ret

Function at 0x140066720
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx + 0x10]
mov rbx, rcx
test r8, r8
je 0x14006673d
mov rcx, qword [rcx + 8]
xor edx, edx
call fcn.1402bfa30
xor eax, eax
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x28], rax
mov rax, qword [rbx + 0x48]
mov dword [rax], 0x6a09e667
mov rax, qword [rbx + 0x48]
mov dword [rax + 4], 0xbb67ae85
mov rax, qword [rbx + 0x48]
mov dword [rax + 8], 0x3c6ef372
mov rax, qword [rbx + 0x48]
mov dword [rax + 0xc], 0xa54ff53a
mov rax, qword [rbx + 0x48]
mov dword [rax + 0x10], 0x510e527f
mov rax, qword [rbx + 0x48]
mov dword [rax + 0x14], 0x9b05688c
mov rax, qword [rbx + 0x48]
mov dword [rax + 0x18], 0x1f83d9ab
mov rax, qword [rbx + 0x48]
mov dword [rax + 0x1c], 0x5be0cd19
add rsp, 0x20
pop rbx
ret
Function at 0x14006a700
Capabilities:
Hash data using sha384

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx + 0x10]
mov rbx, rcx
test r8, r8
je 0x14006a71d
mov rcx, qword [rcx + 8]
xor edx, edx
call fcn.1402bfa30
xor eax, eax
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x28], rax
mov rax, qword [rbx + 0x48]
mov qword [rax], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0x629a292a367cd507
mov qword [rax + 8], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0x9159015a3070dd17
mov qword [rax + 0x10], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0x152fecd8f70e5939
mov qword [rax + 0x18], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0x67332667ffc00b31
mov qword [rax + 0x20], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0x8eb44a8768581511
mov qword [rax + 0x28], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0xdb0c2e0d64f98fa7
mov qword [rax + 0x30], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0x47b5481dbefa4fa4
mov qword [rax + 0x38], rcx
add rsp, 0x20
pop rbx
ret

Function at 0x14006a7c0
Capabilities:
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx + 0x10]
mov rbx, rcx
test r8, r8
je 0x14006a7dd
mov rcx, qword [rcx + 8]
xor edx, edx
call fcn.1402bfa30
xor eax, eax
movabs rcx, 0x6a09e667f3bcc908
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x28], rax
mov rax, qword [rbx + 0x48]
mov qword [rax], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0xbb67ae8584caa73b
mov qword [rax + 8], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0x3c6ef372fe94f82b
mov qword [rax + 0x10], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0xa54ff53a5f1d36f1
mov qword [rax + 0x18], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0x510e527fade682d1
mov qword [rax + 0x20], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0x9b05688c2b3e6c1f
mov qword [rax + 0x28], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0x1f83d9abfb41bd6b
mov qword [rax + 0x30], rcx
mov rax, qword [rbx + 0x48]
movabs rcx, 0x5be0cd19137e2179
mov qword [rax + 0x38], rcx
add rsp, 0x20
pop rbx
ret
Function at 0x14007bd00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rbx, rdx
mov rdi, rcx
xor ecx, ecx
mov dword [rsp + 0x20], ecx
mov rax, qword [rdx]
test byte [rax], 0x80
mov esi, ecx
movzx eax, r8b
cmovne esi, eax
mov qword [rdi], rcx
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rcx
mov qword [rdi + 0x18], rcx
mov cl, 1
call fcn.14001d0b0
mov qword [rdi + 0x18], rax
xor edx, edx
mov rcx, rdi
call fcn.1400bf6b0
mov rdx, qword [rbx + 8]
mov rcx, rdi
call fcn.1400bf6b0
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x48], rcx
mov rax, qword [rdi + 8]
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
cmp rax, rcx
cmovae r8, rdx
mov r8, qword [r8]
mov rdx, qword [rbx]
mov rcx, qword [rdi]
call fcn.1402b7460
nop
xor al, al
mov r9, qword [rdi + 8]
test r9, r9
je 0x14007bdd2
nop word [rax + rax]
mov rdx, qword [rdi]
movzx r8d, byte [rdx + r9 - 1]
movzx ecx, r8b
add cl, cl
or cl, al
mov byte [rdx + r9 - 1], cl
movzx eax, r8b
shr al, 7
dec r9
jne 0x14007bdb0
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
xor byte [rcx + rax - 1], sil
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b4eb0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [rcx]
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
call qword [rax]
cmp rsi, 0x10
jne 0x1400b4f52
mov rax, qword [rbx + 8]
mov dword [rax], 0x61707865
mov eax, dword [rdi]
mov rcx, qword [rbx + 8]
mov dword [rcx + 4], eax
mov eax, dword [rdi + 4]
mov rcx, qword [rbx + 8]
mov dword [rcx + 8], eax
mov eax, dword [rdi + 8]
mov rcx, qword [rbx + 8]
mov dword [rcx + 0xc], eax
mov rcx, qword [rbx + 8]
mov eax, dword [rdi + 0xc]
mov dword [rcx + 0x10], eax
mov rax, qword [rbx + 8]
mov dword [rax + 0x14], 0x3120646e
mov rax, qword [rbx + 8]
mov dword [rax + 0x28], 0x79622d36
mov rcx, qword [rbx + 8]
mov eax, dword [rdi]
mov dword [rcx + 0x2c], eax
mov rcx, qword [rbx + 8]
mov eax, dword [rdi + 4]
mov dword [rcx + 0x30], eax
mov rcx, qword [rbx + 8]
mov eax, dword [rdi + 8]
mov dword [rcx + 0x34], eax
mov rcx, qword [rbx + 8]
mov eax, dword [rdi + 0xc]
mov dword [rcx + 0x38], eax
jmp 0x1400b4fc7
cmp rsi, 0x20
jne 0x1400b4fd2
mov rax, qword [rbx + 8]
mov dword [rax], 0x61707865
mov eax, dword [rdi]
mov rcx, qword [rbx + 8]
mov dword [rcx + 4], eax
mov eax, dword [rdi + 4]
mov rcx, qword [rbx + 8]
mov dword [rcx + 8], eax
mov eax, dword [rdi + 8]
mov rcx, qword [rbx + 8]
mov dword [rcx + 0xc], eax
mov rcx, qword [rbx + 8]
mov eax, dword [rdi + 0xc]
mov dword [rcx + 0x10], eax
mov rax, qword [rbx + 8]
mov dword [rax + 0x14], 0x3320646e
mov rax, qword [rbx + 8]
mov dword [rax + 0x28], 0x79622d32
mov rcx, qword [rbx + 8]
mov eax, dword [rdi + 0x10]
mov dword [rcx + 0x2c], eax
mov rcx, qword [rbx + 8]
mov eax, dword [rdi + 0x14]
mov dword [rcx + 0x30], eax
mov eax, dword [rdi + 0x18]
mov rcx, qword [rbx + 8]
mov dword [rcx + 0x34], eax
mov rdx, qword [rbx + 8]
mov eax, dword [rdi + 0x1c]
mov dword [rdx + 0x38], eax
mov rax, qword [rbx + 8]
mov dword [rax + 0x3c], 0x6b206574
xor eax, eax
lea rdx, [rsp + 0x20]
mov r8d, 8
mov dword [rsp + 0x21], eax
mov word [rsp + 0x25], ax
mov byte [rsp + 0x27], al
mov rax, qword [rbx]
mov rcx, rbx
mov byte [rsp + 0x20], 0
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1402b6d40
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400b6290
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor r9d, r9d
nop dword [rax + rax]
mov eax, dword [r9 + rdx]
add r9, 4
mov r8d, eax
rol eax, 8
and eax, 0xff00ff
ror r8d, 8
and r8d, 0xff00ff00
or r8d, eax
mov rax, qword [rcx + 0x48]
mov dword [r9 + rax - 4], r8d
cmp r9, 0x10
jne 0x1400b62b0
xor r8d, r8d
mov rax, qword [rcx + 0x48]
mov rdx, qword [rcx + 8]
add r8, 4
mov eax, dword [r8 + rax - 4]
mov dword [r8 + rdx - 4], eax
cmp r8, 0x10
jne 0x1400b62e3
mov r9, r8
lea r10, [0x140344ce0]
nop dword [rax]
mov rax, qword [rcx + 8]
mov edx, dword [r9 + rax - 0x10]
lea r8, [r9 + rax]
add r9, 4
add edx, dword [r8 - 4]
mov eax, edx
shr edx, 3
and eax, 7
mov eax, dword [r10 + rax*4]
xor eax, edx
mov dword [r8], eax
cmp r9, 0x400
jne 0x1400b6310
xor r8d, r8d
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rcx + 8]
lea rdx, [r8 + rax]
mov eax, dword [r8 + rax + 0x164]
add r8, 4
add dword [rdx], eax
cmp r8, 0x5c
jne 0x1400b6350
mov rax, qword [rcx + 8]
mov r10d, dword [rax + 0xec]
mov r9d, dword [rax + 0x84]
btr r10d, 0x17
or r10d, 0x1000001
xor r8d, r8d
nop dword [rax]
mov rdx, qword [rcx + 8]
btr r9d, 0x17
add r8, 4
mov eax, dword [rdx + r8 - 4]
add r9d, r10d
and eax, 0xffffff
xor eax, r9d
mov dword [rdx + r8 - 4], eax
cmp r8, 0x400
jne 0x1400b6390
mov r8, qword [rcx + 8]
movzx edx, r9b
mov eax, dword [r8 + rdx*4]
mov ebx, dword [r8]
xor eax, r9d
movzx r10d, al
mov r9d, r10d
lea r11, [r10*4]
mov eax, dword [r11 + r8]
mov dword [r8], eax
mov r8d, 1
nop dword [rax]
mov rdx, qword [rcx + 8]
xor r9, r8
inc r8
mov eax, dword [rdx + r8*4 - 4]
mov dword [r11 + rdx], eax
mov rdx, qword [rcx + 8]
mov eax, dword [rdx + r9*4]
xor eax, r10d
movzx r10d, al
mov r9d, r10d
lea r11, [r10*4]
mov eax, dword [r11 + rdx]
mov dword [rdx + r8*4 - 4], eax
cmp r8, 0x100
jne 0x1400b63f0
mov rax, qword [rcx + 8]
lea rdx, [rsp + 0x20]
mov r8d, 8
mov dword [rax + r10*4], ebx
xor eax, eax
mov qword [rcx + 0x88], 0
mov dword [rsp + 0x21], eax
mov word [rsp + 0x25], ax
mov byte [rsp + 0x27], al
mov rax, qword [rcx]
mov byte [rsp + 0x20], 0
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1402b6d40
add rsp, 0x30
pop rbx
ret
Function at 0x1400b6480
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov qword [rax - 0x78], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov rax, qword [rcx]
mov rdx, r8
call qword [rax + 0x38]
test al, al
jne 0x1400b64f5
mov rax, qword [rbx]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [rax + 8]
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14000e820
lea rdx, [0x14040cc30]
lea rcx, [rsp + 0x28]
call fcn.1402bece8
nop
xor edx, edx
nop word [rax + rax]
mov rax, qword [rbx + 0x48]
mov rcx, qword [rbx + 0x28]
mov eax, dword [rdx + rax]
mov dword [rdx + rcx], eax
add rdx, 4
cmp rdx, 0x10
jne 0x1400b6500
mov eax, dword [rsi]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov rax, qword [rbx + 0x28]
mov dword [rax + 0x10], ecx
mov rcx, qword [rbx + 0x28]
mov eax, dword [rcx + 0x10]
xor dword [rcx], eax
mov rdx, qword [rbx + 0x28]
mov eax, dword [rsi + 4]
mov ecx, eax
ror ecx, 8
and ecx, 0xff00ff00
rol eax, 8
and eax, 0xff00ff
or ecx, eax
xor dword [rdx + 8], ecx
mov rax, qword [rbx + 0x28]
mov r15d, dword [rax]
mov esi, dword [rax + 4]
mov ebp, dword [rax + 8]
mov edi, dword [rax + 0xc]
mov r14d, dword [rax + 0x10]
xor r12d, r12d
nop word [rax + rax]
mov ecx, edi
ror ecx, 8
and ecx, 0xff00ff00
mov eax, edi
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov rax, qword [rbx + 0x68]
mov dword [r12 + rax], ecx
lea r8d, [r14 + rdi]
add edi, ebp
add ebp, esi
add esi, r15d
mov rdx, qword [rbx + 8]
movzx ecx, sil
shr esi, 8
mov r9d, dword [rdx + rcx*4]
xor r9d, esi
movzx ecx, bpl
shr ebp, 8
mov r10d, dword [rdx + rcx*4]
xor r10d, ebp
movzx ecx, dil
shr edi, 8
mov r11d, dword [rdx + rcx*4]
xor r11d, edi
movzx ecx, r8b
shr r8d, 8
mov r14d, dword [rdx + rcx*4]
xor r14d, r8d
mov ecx, r11d
ror ecx, 8
and ecx, 0xff00ff00
mov eax, r11d
rol eax, 8
and eax, 0xff00ff
or ecx, eax
mov rax, qword [rbx + 0x68]
mov dword [rax + r12 + 4], ecx
lea r8d, [r15 + r11]
add r11d, r10d
add r10d, r9d
add r9d, r14d
mov rdx, qword [rbx + 8]
movzx ecx, r9b
shr r9d, 8
mov esi, dword [rdx + rcx*4]
xor esi, r9d
movzx ecx, r10b
shr r10d, 8
mov ebp, dword [rdx + rcx*4]
xor ebp, r10d
movzx ecx, r11b
shr r11d, 8
mov edi, dword [rdx + rcx*4]
xor edi, r11d
movzx ecx, r8b
shr r8d, 8
mov r15d, dword [rdx + rcx*4]
xor r15d, r8d
add r12, 8
cmp r12, 0x20
jne 0x1400b6580
mov rax, qword [rbx + 0x28]
mov dword [rax], r15d
mov rax, qword [rbx + 0x28]
mov dword [rax + 4], esi
mov rax, qword [rbx + 0x28]
mov dword [rax + 8], ebp
mov rax, qword [rbx + 0x28]
mov dword [rax + 0xc], edi
mov rax, qword [rbx + 0x28]
mov dword [rax + 0x10], r14d
mov qword [rbx + 0x88], 0
mov rdx, qword [rbx + 0x70]
mov rcx, rbx
call fcn.1400b6120
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1402b6d40
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400b6a90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor eax, eax
xor r8d, r8d
xor ecx, ecx
mov qword [rbp - 0x3c], rax
mov dword [rbp - 0x34], eax
cpuid
mov dword [rbp - 0x40], r8d
mov dword [rbp - 0x38], ecx
mov dword [rbp - 0x34], edx
mov dl, 1
mov ecx, r8d
mov dword [rbp - 0x20], 0x756e6547
mov dword [rbp - 0x1c], 0x6c65746e
mov dword [rbp - 0x18], 0x49656e69
mov dword [rbp - 0x30], 0x68747541
mov dword [rbp - 0x2c], 0x444d4163
mov dword [rbp - 0x28], 0x69746e65
mov dword [rbp - 0x40], eax
mov dword [rbp - 0x3c], ebx
nop word [rax + rax]
mov eax, dword [rbp + rcx - 0x20]
cmp dword [rbp + rcx - 0x3c], eax
sete al
add rcx, 4
and dl, al
cmp rcx, 0xc
jne 0x1400b6b00
test dl, dl
je 0x1400b6b38
xor ecx, ecx
mov eax, 1
cpuid
shr ebx, 8
mov dword [rbp - 0x40], eax
mov dword [rbp - 0x38], ecx
movzx eax, bl
mov dword [rbp - 0x34], edx
shl eax, 3
jmp 0x1400b6b7c
mov cl, 1
nop word [rax + rax]
mov eax, dword [rbp + r8 - 0x30]
cmp dword [rbp + r8 - 0x3c], eax
sete al
add r8, 4
and cl, al
cmp r8, 0xc
jne 0x1400b6b40
test cl, cl
je 0x1400b6b77
mov eax, 0x80000005
xor ecx, ecx
cpuid
mov dword [rbp - 0x40], eax
movzx eax, cl
mov dword [rbp - 0x3c], ebx
mov dword [rbp - 0x38], ecx
mov dword [rbp - 0x34], edx
jmp 0x1400b6b7c
mov eax, 0x20
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1402b6d40
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400cb230
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rcx, qword [rcx + 8]
lea rax, [rsp + 0x68]
mov rdi, r8
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x50], 0
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
test ebx, ebx
je 0x1400cb28e
xor al, al
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov eax, dword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov dword [rdi], eax
mov al, 1
add rsp, 0x40
pop rdi
ret
Function at 0x1400cb6c0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x250
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rsp + 0x240], rax
cmp qword [0x140428ff0], 0
je 0x1400cb822
lea rcx, str.SeBackupPrivilege
call fcn.1400fe3d0
mov edx, 0x104
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
movzx ecx, word [rsp + 0x30]
call fcn.1400cf2d0
mov rsi, rax
test rax, rax
je 0x1400cb824
call fcn.1400cea70
mov rdi, rax
cmp qword [0x140428b18], 0
jne 0x1400cb76d
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtQueryKey
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140428b18], rax
test rax, rax
jne 0x1400cb76d
xor ebx, ebx
jmp 0x1400cb790
mov ecx, 0xa8
call fcn.1402b6dbc
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1400cb78e
mov rcx, rax
call fcn.1400d00a0
mov rbx, rax
jmp 0x1400cb790
xor ebx, ebx
mov rdx, 0xffffffff80000002
mov rcx, rbx
call fcn.1400d05c0
mov rdx, 0xffffffff80000003
mov rcx, rbx
call fcn.1400d05c0
mov rcx, rsi
call fcn.1400cb850
cmp qword [0x140428ff0], 0
jbe 0x1400cb7e2
test rdi, rdi
je 0x1400cb7cd
mov rcx, rdi
call fcn.1400ceba0
mov rcx, rsi
call fcn.1400cf460
mov rcx, rbx
call fcn.1400d0240
call fcn.1400cbd50
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
test rbx, rbx
je 0x1400cb801
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
test rdi, rdi
je 0x1400cb813
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
cmp qword [0x140428ff0], 0
jbe 0x1400cb822
call fcn.1400cc000
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1402b6d40
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret