joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff7f96165b4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x7ff7f96645e8]
mov rbx, rdx
test rax, rax
jne 0x7ff7f96166af
mov dword [rbp - 0x50], 0x74
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x7ff7f961665b
lea rcx, [0x7ff7f962fd98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.kernel32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x7ff7f96645e8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.vcruntime140.dll_memset]
mov rax, qword [0x7ff7f96645e8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x7ff7f96166d8
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x7ff7f9616704
cmp dword [rbp - 0x18], 0x10000
je 0x7ff7f9616704
cmp qword [rbp - 0x20], 0x1000
jb 0x7ff7f9616704
cmp dword [rbp - 0x10], 0x1000000
je 0x7ff7f9616700
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x7ff7f9616706
mov al, 1
jmp 0x7ff7f9616706
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x7ff7f9616ccc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x7ff7f9664630]
mov rbx, rdx
test rax, rax
jne 0x7ff7f9616dc7
mov dword [rbp - 0x50], 0x74
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x7ff7f9616d73
lea rcx, [0x7ff7f962fd98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.kernel32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x7ff7f9664630], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.vcruntime140.dll_memset]
mov rax, qword [0x7ff7f9664630]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x7ff7f9616df0
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x7ff7f9616e1c
cmp dword [rbp - 0x18], 0x10000
je 0x7ff7f9616e1c
cmp qword [rbp - 0x20], 0x1000
jb 0x7ff7f9616e1c
cmp dword [rbp - 0x10], 0x1000000
je 0x7ff7f9616e18
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x7ff7f9616e1e
mov al, 1
jmp 0x7ff7f9616e1e
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x7ff7f9618728
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x7ff7f96644d0]
mov rbx, rdx
test rax, rax
jne 0x7ff7f9618823
mov dword [rbp - 0x50], 0x74
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x7ff7f96187cf
lea rcx, [0x7ff7f962fd98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.kernel32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x7ff7f96644d0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.vcruntime140.dll_memset]
mov rax, qword [0x7ff7f96644d0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x7ff7f961884c
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x7ff7f9618878
cmp dword [rbp - 0x18], 0x10000
je 0x7ff7f9618878
cmp qword [rbp - 0x20], 0x1000
jb 0x7ff7f9618878
cmp dword [rbp - 0x10], 0x1000000
je 0x7ff7f9618874
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x7ff7f961887a
mov al, 1
jmp 0x7ff7f961887a
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x7ff7f961a0a4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x7ff7f9664648]
mov rbx, rdx
test rax, rax
jne 0x7ff7f961a19f
mov dword [rbp - 0x50], 0x74
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x7ff7f961a14b
lea rcx, [0x7ff7f962fd98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.kernel32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x7ff7f9664648], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.vcruntime140.dll_memset]
mov rax, qword [0x7ff7f9664648]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x7ff7f961a1c8
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x7ff7f961a1f4
cmp dword [rbp - 0x18], 0x10000
je 0x7ff7f961a1f4
cmp qword [rbp - 0x20], 0x1000
jb 0x7ff7f961a1f4
cmp dword [rbp - 0x10], 0x1000000
je 0x7ff7f961a1f0
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x7ff7f961a1f6
mov al, 1
jmp 0x7ff7f961a1f6
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x7ff7f961ba20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x7ff7f96645a8]
mov rbx, rdx
test rax, rax
jne 0x7ff7f961bb1b
mov dword [rbp - 0x50], 0x74
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x7ff7f961bac7
lea rcx, [0x7ff7f962fd98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.kernel32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x7ff7f96645a8], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.vcruntime140.dll_memset]
mov rax, qword [0x7ff7f96645a8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x7ff7f961bb44
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x7ff7f961bb70
cmp dword [rbp - 0x18], 0x10000
je 0x7ff7f961bb70
cmp qword [rbp - 0x20], 0x1000
jb 0x7ff7f961bb70
cmp dword [rbp - 0x10], 0x1000000
je 0x7ff7f961bb6c
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x7ff7f961bb72
mov al, 1
jmp 0x7ff7f961bb72
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x7ff7f961d39c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x7ff7f9664590]
mov rbx, rdx
test rax, rax
jne 0x7ff7f961d497
mov dword [rbp - 0x50], 0x74
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x7ff7f961d443
lea rcx, [0x7ff7f962fd98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.kernel32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x7ff7f9664590], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.vcruntime140.dll_memset]
mov rax, qword [0x7ff7f9664590]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x7ff7f961d4c0
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x7ff7f961d4ec
cmp dword [rbp - 0x18], 0x10000
je 0x7ff7f961d4ec
cmp qword [rbp - 0x20], 0x1000
jb 0x7ff7f961d4ec
cmp dword [rbp - 0x10], 0x1000000
je 0x7ff7f961d4e8
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x7ff7f961d4ee
mov al, 1
jmp 0x7ff7f961d4ee
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x7ff7f961dab4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x7ff7f9664500]
mov rbx, rdx
test rax, rax
jne 0x7ff7f961dbaf
mov dword [rbp - 0x50], 0x74
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x7ff7f961db5b
lea rcx, [0x7ff7f962fd98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.kernel32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x7ff7f9664500], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.vcruntime140.dll_memset]
mov rax, qword [0x7ff7f9664500]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x7ff7f961dbd8
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x7ff7f961dc04
cmp dword [rbp - 0x18], 0x10000
je 0x7ff7f961dc04
cmp qword [rbp - 0x20], 0x1000
jb 0x7ff7f961dc04
cmp dword [rbp - 0x10], 0x1000000
je 0x7ff7f961dc00
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x7ff7f961dc06
mov al, 1
jmp 0x7ff7f961dc06
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x7ff7f961e1cc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x7ff7f96645f0]
mov rbx, rdx
test rax, rax
jne 0x7ff7f961e2c7
mov dword [rbp - 0x50], 0x74
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x7ff7f961e273
lea rcx, [0x7ff7f962fd98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.kernel32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x7ff7f96645f0], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.vcruntime140.dll_memset]
mov rax, qword [0x7ff7f96645f0]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x7ff7f961e2f0
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x7ff7f961e31c
cmp dword [rbp - 0x18], 0x10000
je 0x7ff7f961e31c
cmp qword [rbp - 0x20], 0x1000
jb 0x7ff7f961e31c
cmp dword [rbp - 0x10], 0x1000000
je 0x7ff7f961e318
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x7ff7f961e31e
mov al, 1
jmp 0x7ff7f961e31e
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x7ff7f961fb48
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x7ff7f9664628]
mov rbx, rdx
test rax, rax
jne 0x7ff7f961fc43
mov dword [rbp - 0x50], 0x74
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x7ff7f961fbef
lea rcx, [0x7ff7f962fd98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.kernel32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x7ff7f9664628], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.vcruntime140.dll_memset]
mov rax, qword [0x7ff7f9664628]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x7ff7f961fc6c
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x7ff7f961fc98
cmp dword [rbp - 0x18], 0x10000
je 0x7ff7f961fc98
cmp qword [rbp - 0x20], 0x1000
jb 0x7ff7f961fc98
cmp dword [rbp - 0x10], 0x1000000
je 0x7ff7f961fc94
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x7ff7f961fc9a
mov al, 1
jmp 0x7ff7f961fc9a
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x7ff7f96214c4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x7ff7f9664528]
mov rbx, rdx
test rax, rax
jne 0x7ff7f96215bf
mov dword [rbp - 0x50], 0x74
mov eax, dword [rbp - 0x50]
xor al, 0x56
mov byte [rbp - 0x4c], al
mov eax, dword [rbp - 0x50]
inc al
xor al, 0x69
mov byte [rbp - 0x4b], al
mov eax, dword [rbp - 0x50]
add al, 2
xor al, 0x72
mov byte [rbp - 0x4a], al
mov eax, dword [rbp - 0x50]
add al, 3
xor al, 0x74
mov byte [rbp - 0x49], al
mov eax, dword [rbp - 0x50]
add al, 4
xor al, 0x75
mov byte [rbp - 0x48], al
mov eax, dword [rbp - 0x50]
add al, 5
xor al, 0x61
mov byte [rbp - 0x47], al
mov eax, dword [rbp - 0x50]
add al, 6
xor al, 0x6c
mov byte [rbp - 0x46], al
mov eax, dword [rbp - 0x50]
add al, 7
xor al, 0x51
mov byte [rbp - 0x45], al
mov eax, dword [rbp - 0x50]
add al, 8
xor al, 0x75
mov byte [rbp - 0x44], al
mov eax, dword [rbp - 0x50]
add al, 9
xor al, 0x65
mov byte [rbp - 0x43], al
mov eax, dword [rbp - 0x50]
add al, 0xa
xor al, 0x72
mov byte [rbp - 0x42], al
mov eax, dword [rbp - 0x50]
add al, 0xb
xor al, 0x79
mov byte [rbp - 0x41], al
xor eax, eax
mov byte [rbp - 0x40], al
xor edx, edx
mov al, byte [rbp - 0x4c]
mov al, byte [rbp + rdx - 0x4c]
mov ecx, dword [rbp - 0x50]
add cl, dl
xor cl, al
mov byte [rbp + rdx - 0x4c], cl
inc rdx
cmp rdx, 0xc
jb 0x7ff7f962156b
lea rcx, [0x7ff7f962fd98]
mov byte [rbp - 0x40], 0
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [rbp - 0x4c]
call qword [sym.imp.kernel32.dll_GetProcAddress]
xor edx, edx
lea rcx, [rbp - 0x4c]
mov qword [0x7ff7f9664528], rax
lea r8d, [rdx + 0xd]
call qword [sym.imp.vcruntime140.dll_memset]
mov rax, qword [0x7ff7f9664528]
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
test rax, rax
je 0x7ff7f96215e8
mov r8d, 0x30
lea rdx, [rbp - 0x38]
mov rcx, rbx
call rax
cmp rax, 0x30
jne 0x7ff7f9621614
cmp dword [rbp - 0x18], 0x10000
je 0x7ff7f9621614
cmp qword [rbp - 0x20], 0x1000
jb 0x7ff7f9621614
cmp dword [rbp - 0x10], 0x1000000
je 0x7ff7f9621610
cmp dword [rbp - 0x10], 0x40000
sete al
jmp 0x7ff7f9621616
mov al, 1
jmp 0x7ff7f9621616
xor al, al
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x7ff7f9622b60
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x7ff7f9622baa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x7ff7f9622baa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x7ff7f9622baa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x7ff7f9622baa
cmp dword [rcx + 0x84], 0xe
jbe 0x7ff7f9622baa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x7ff7f9622bac
xor al, al
add rsp, 0x28
ret