joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180046770
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
cmp byte [0x180060c55], 0
jne 0x18004687f
xor eax, eax
lea rdx, [0x180060c4e]
nop word [rax + rax]
movzx r8d, byte [rcx + rax]
movzx r9d, byte [rcx + rax + 0x1d]
mov r11d, r8d
not r11b
and r11b, 0x10
mov r10d, r8d
and r10b, 0xc4
mov ebx, r8d
and bl, 0x2b
mov esi, r9d
and sil, 0x50
mov edi, r9d
and dil, 0x2b
mov ebp, r9d
and bpl, 0x84
or dil, 0x50
xor dil, sil
or dil, bpl
xor dil, 0x84
mov esi, r9d
xor sil, 0xd4
xor r9b, 0x2b
or r9b, sil
not r9b
or r9b, dil
or r10b, r11b
xor r10b, 0xc4
mov esi, r8d
xor sil, 9
and sil, bl
lea edi, [r10 + 0x22]
or r10b, bl
not bl
mov ebp, ebx
and bpl, 0x49
or sil, bpl
mov ebp, r8d
and bpl, 0x84
or bpl, r11b
xor bpl, 0x8d
and dil, sil
not sil
and sil, bpl
or sil, dil
mov r11d, r8d
and r11b, 0x28
and bl, 0x13
or bl, r11b
and r8b, 0xd4
or r8b, 3
xor r8b, bl
xor r8b, 0x3b
and r8b, r10b
or r8b, sil
mov r10d, r9d
xor r10b, 0x7a
mov r11d, r8d
xor r11b, 0x7a
xor r9b, 0x85
and r9b, r11b
xor r8b, 0x85
and r8b, r10b
or r8b, r9b
mov byte [rax + rdx], r8b
inc rax
cmp rax, 7
jne 0x180046790
mov byte [0x180060c55], 1
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x180046890
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x38
movdqa xmmword [rsp + 0x20], xmm8
movdqa xmmword [rsp + 0x10], xmm7
movdqa xmmword [rsp], xmm6
cmp byte [0x1800611e0], 0
jne 0x180046acf
lea rdx, [rcx + 0x2a]
lea rax, [0x1800611d0]
cmp rdx, rax
jbe 0x1800469a8
lea rdx, [0x1800611e0]
cmp rcx, rdx
jae 0x1800469a8
xor edx, edx
nop dword [rax + rax]
movzx r8d, byte [rcx + rdx]
movzx r10d, byte [rcx + rdx + 0x1a]
mov r11d, r10d
and r11b, 0x12
or r11b, 0x24
mov r9d, r10d
and r9b, 0xed
xor r9b, r11b
mov r11d, r10d
xor r11b, 0xed
xor r10b, 0x12
or r10b, r11b
xor r9b, 0x36
mov r11d, r9d
xor r11b, r10b
or r9b, r10b
not r9b
or r9b, r11b
mov r10d, r8d
and r10b, 0x45
xor r10b, 0x55
mov r11d, r8d
and r11b, 0x12
lea esi, [r11 - 0x58]
mov ebx, r8d
and bl, 0xa8
xor bl, 0xef
and bl, sil
xor r11b, 0x47
and r11b, r10b
mov r10d, r8d
xor r10b, 0x12
xor r8b, 0xed
or r8b, r10b
not r8b
or r8b, r11b
or r8b, bl
mov r10d, r9d
xor r10b, 0x74
mov r11d, r8d
and r11b, 0x74
or r11b, 0x89
and r8b, 0x8b
xor r8b, r11b
mov r11d, r8d
xor r11b, 0xfd
xor r9b, 0x8b
and r9b, r11b
xor r8b, 2
and r8b, r10b
or r8b, r9b
mov byte [rdx + rax], r8b
inc rdx
cmp rdx, 0x10
jne 0x1800468e0
jmp 0x180046ac8
movdqu xmm0, xmmword [rcx]
movdqu xmm4, xmmword [rcx + 0x1a]
movdqa xmm2, xmmword [0x180050730]
movdqa xmm5, xmm4
pand xmm5, xmm2
por xmm5, xmmword [str.________________]
movdqa xmm3, xmmword [0x180050750]
movdqa xmm1, xmm4
pand xmm1, xmm3
pxor xmm1, xmm5
movdqa xmm5, xmm4
pxor xmm5, xmm3
pxor xmm4, xmm2
por xmm4, xmm5
pxor xmm1, xmmword [str.6666666666666666EEEEEEEEEEEEEEEEUUUUUUUUUUUUUUUU]
movdqa xmm5, xmm1
pxor xmm5, xmm4
por xmm1, xmm4
pcmpeqd xmm4, xmm4
pxor xmm1, xmm4
por xmm1, xmm5
movdqa xmm5, xmmword [0x180050770]
pand xmm5, xmm0
pxor xmm5, xmmword [0x180050780]
movdqa xmm6, xmm0
pand xmm6, xmm2
movdqa xmm7, xmmword [0x180050790]
movdqa xmm8, xmm6
por xmm8, xmm7
pand xmm7, xmm0
pxor xmm7, xmmword [0x1800500c0]
pand xmm7, xmm8
pxor xmm6, xmmword [str.GGGGGGGGGGGGGGGGtttttttttttttttt]
pand xmm6, xmm5
pxor xmm2, xmm0
pxor xmm0, xmm3
por xmm0, xmm2
pxor xmm0, xmm4
por xmm0, xmm6
por xmm0, xmm7
movdqa xmm2, xmmword [0x1800507b0]
movdqa xmm3, xmm1
pxor xmm3, xmm2
pand xmm2, xmm0
por xmm2, xmmword [0x1800507c0]
movdqa xmm4, xmmword [0x1800507d0]
pand xmm0, xmm4
pxor xmm0, xmm2
movdqa xmm2, xmmword [0x1800507e0]
pxor xmm2, xmm0
pxor xmm1, xmm4
pxor xmm0, xmmword [0x1800505f0]
pand xmm1, xmm2
pand xmm0, xmm3
por xmm0, xmm1
movdqa xmmword [0x1800611d0], xmm0
mov byte [0x1800611e0], 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rsi
ret
Function at 0x180046c00
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
push rbx
cmp byte [0x1800612be], 0
jne 0x180046ca0
xor r8d, r8d
movabs r9, 0xf0f0f0f0f0f0f0f1
lea r10, [0x1800612a6]
nop word cs:[rax + rax]
mov rax, r8
mul r9
mov rax, rdx
shr rax, 4
and rdx, 0xfffffffffffffff0
add rdx, rax
lea rax, [rcx + r8]
sub rax, rdx
movzx edx, byte [rcx + r8 + 0x11]
movzx eax, byte [rax]
mov r11d, edx
not r11b
mov ebx, r11d
xor bl, al
or r11b, al
not al
and al, dl
or bl, al
mov edx, ebx
xor dl, 0x9b
mov esi, r11d
or al, r11b
xor r11b, 0x9b
xor bl, 0x64
and bl, r11b
xor sil, 0x64
and sil, dl
or sil, bl
not al
or al, sil
mov byte [r8 + r10], al
inc r8
cmp r8, 0x18
jne 0x180046c30
mov byte [0x1800612be], 1
pop rbx
pop rsi
ret

Function at 0x180046cb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
cmp byte [0x180061301], 0
jne 0x180046dd1
lea rdx, [rcx + 0x26]
lea rax, [0x1800612f0]
cmp rdx, rax
setbe dl
lea r8, [0x180061301]
cmp rcx, r8
setae r8b
or r8b, dl
cmp r8b, 1
jne 0x180046d21
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x15]
movaps xmm2, xmmword [0x1800500c0]
movaps xmm3, xmm1
xorps xmm3, xmm2
xorps xmm2, xmm0
movaps xmm4, xmmword [0x180050070]
xorps xmm1, xmm4
andps xmm1, xmm2
xorps xmm0, xmm4
andps xmm0, xmm3
orps xmm0, xmm1
movaps xmmword [0x1800612f0], xmm0
mov edx, 0x10
jmp 0x180046d23
xor edx, edx
movzx r9d, byte [rcx + rdx]
movzx r10d, byte [rcx + rdx + 0x15]
mov r11d, r10d
xor r11b, 0xef
mov ebx, r9d
xor bl, 0xef
xor r10b, 0x10
and r10b, bl
xor r9b, 0x10
and r9b, r11b
or r9b, r10b
mov byte [rdx + rax], r9b
test r8b, r8b
jne 0x180046dca
nop word cs:[rax + rax]
movzx r8d, byte [rcx + rdx + 1]
movzx r9d, byte [rcx + rdx + 0x16]
mov r10d, r9d
xor r10b, 0xef
mov r11d, r8d
xor r11b, 0xef
xor r9b, 0x10
and r9b, r11b
xor r8b, 0x10
and r8b, r10b
or r8b, r9b
mov byte [rdx + rax + 1], r8b
movzx r8d, byte [rcx + rdx + 2]
movzx r9d, byte [rcx + rdx + 0x17]
mov r10d, r9d
xor r10b, 0xef
mov r11d, r8d
xor r11b, 0xef
xor r9b, 0x10
and r9b, r11b
xor r8b, 0x10
and r8b, r10b
or r8b, r9b
mov byte [rdx + rax + 2], r8b
add rdx, 2
cmp rdx, 0x10
jne 0x180046d60
mov byte [0x180061301], 1
pop rbx
ret
Function at 0x180046de0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x18006131a], 0
jne 0x180046f45
lea rdx, [rcx + 0x30]
lea rax, [0x180061304]
cmp rdx, rax
jbe 0x180046e10
lea rdx, [0x18006131a]
cmp rcx, rdx
jae 0x180046e10
xor edx, edx
jmp 0x180046ef0
movd xmm1, dword [rcx + 0x1a]
movd xmm2, dword [rcx]
pcmpeqd xmm0, xmm0
movdqa xmm3, xmm2
pxor xmm3, xmm0
por xmm3, xmm1
pxor xmm1, xmm0
por xmm1, xmm2
pxor xmm1, xmm3
movd dword [0x180061304], xmm1
movd xmm1, dword [rcx + 0x1e]
movd xmm2, dword [rcx + 4]
movdqa xmm3, xmm2
pxor xmm3, xmm0
por xmm3, xmm1
pxor xmm1, xmm0
por xmm1, xmm2
pxor xmm1, xmm3
movd dword [0x180061308], xmm1
movd xmm1, dword [rcx + 0x22]
movd xmm2, dword [rcx + 8]
movdqa xmm3, xmm2
pxor xmm3, xmm0
por xmm3, xmm1
pxor xmm1, xmm0
por xmm1, xmm2
pxor xmm1, xmm3
movd dword [0x18006130c], xmm1
movd xmm1, dword [rcx + 0x26]
movd xmm2, dword [rcx + 0xc]
movdqa xmm3, xmm2
pxor xmm3, xmm0
por xmm3, xmm1
pxor xmm1, xmm0
por xmm1, xmm2
pxor xmm1, xmm3
movd dword [0x180061310], xmm1
movd xmm1, dword [rcx + 0x2a]
movd xmm2, dword [rcx + 0x10]
movdqa xmm3, xmm2
pxor xmm3, xmm0
por xmm3, xmm1
pxor xmm1, xmm0
por xmm1, xmm2
pxor xmm1, xmm3
movd dword [0x180061314], xmm1
mov edx, 0x14
nop word [rax + rax]
movzx r8d, byte [rcx + rdx]
movzx r9d, byte [rcx + rdx + 0x1a]
mov r10d, r8d
not r10b
or r10b, r9b
not r9b
or r9b, r8b
xor r9b, r10b
mov byte [rdx + rax], r9b
movzx r8d, byte [rcx + rdx + 1]
movzx r9d, byte [rcx + rdx + 0x1b]
mov r10d, r8d
not r10b
or r10b, r9b
not r9b
or r9b, r8b
xor r9b, r10b
mov byte [rdx + rax + 1], r9b
add rdx, 2
cmp rdx, 0x16
jne 0x180046ef0
mov byte [0x18006131a], 1
ret

Function at 0x180046f50
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
cmp byte [0x1800613b1], 0
jne 0x180047028
xor eax, eax
lea rdx, [0x180061396]
nop dword [rax]
movzx r8d, byte [rcx + rax + 0x10]
mov r9d, eax
and r9d, 0xf
movzx r11d, byte [rcx + r9]
mov r10d, r8d
and r10b, 2
mov ebx, r11d
or bl, 0x2b
mov esi, ebx
not sil
or r10b, 0x60
mov edi, esi
and dil, 0x84
mov r9d, r11d
and r9b, 0x50
or r9b, dil
or r9b, 1
mov edi, r11d
and dil, 0x2b
xor r9b, dil
and sil, 0x14
and bl, 0xca
or bl, sil
xor bl, dil
xor bl, 0xca
xor r11b, 0x2b
or r11b, bl
xor r9b, 0xae
mov ebx, r9d
xor bl, r11b
or r9b, r11b
not r9b
or r9b, bl
mov r11d, r8d
and r11b, 0xe9
xor r11b, r10b
and r8b, 0x14
or r8b, r11b
mov r10d, r8d
xor r10b, 0x5f
mov r11d, r9d
xor r11b, 0xeb
xor r8b, 0xa0
and r8b, r11b
xor r9b, 0x14
and r9b, r10b
or r9b, r8b
mov byte [rax + rdx], r9b
inc rax
cmp rax, 0x1b
jne 0x180046f70
mov byte [0x1800613b1], 1
pop rbx
pop rdi
pop rsi
ret
Function at 0x180047030
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
cmp byte [0x1800613cc], 0
jne 0x1800470f1
xor r8d, r8d
movabs r9, 0x8618618618618619
lea r10, [0x1800613b2]
nop word cs:[rax + rax]
mov rax, r8
mul r9
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rdx, rax, 0xffffffffffffffeb
lea r11, [rcx + r8]
movzx ebx, byte [rcx + r8 + 0x15]
mov eax, ebx
not al
movzx edx, byte [rdx + r11]
mov r11d, ebx
and r11b, 0x4a
mov esi, ebx
and sil, 0xb5
mov edi, ebx
or dil, 0x4a
xor sil, 0xeb
and sil, dil
and al, sil
and sil, 0xbf
or bl, 0x44
and bl, 0xe5
xor bl, sil
xor bl, 0xa5
and al, 0xa1
or al, bl
xor al, r11b
mov r11d, edx
xor r11b, 0xb5
xor dl, al
xor al, 0xa1
xor dl, 0xeb
and dl, r11b
or al, r11b
not al
or al, dl
mov byte [r8 + r10], al
inc r8
cmp r8, 0x1a
jne 0x180047060
mov byte [0x1800613cc], 1
pop rbx
pop rdi
pop rsi
ret

Function at 0x180047100
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x10], xmm7
movaps xmmword [rsp], xmm6
cmp byte [0x180061460], 0
jne 0x180047280
lea rdx, [rcx + 0x21]
lea rax, [0x180061450]
cmp rdx, rax
jbe 0x1800471d0
lea rdx, [0x180061460]
cmp rcx, rdx
jae 0x1800471d0
xor edx, edx
nop dword [rax + rax]
movzx r11d, byte [rcx + rdx + 0x11]
mov r8d, r11d
and r8b, 0x85
mov r10d, r8d
xor r10b, 0x85
mov r9d, r11d
and r9b, 0xdf
xor r9b, 0x5a
and r11b, 0xa5
xor r11b, 0x85
or r11b, r9b
mov ebx, r11d
xor bl, 0xdf
mov esi, r11d
xor sil, 0x20
xor r11b, 0x44
or sil, bl
and sil, r11b
xor sil, r8b
xor sil, 0x1e
mov r11d, ebx
and r11b, 0xf5
and r9b, 0xa
or r9b, r11b
or bl, r10b
or r8b, 0x70
xor r8b, r9b
and r8b, bl
or r8b, sil
xor r8b, byte [rcx + rdx]
xor r8b, 0x85
mov byte [rdx + rax], r8b
inc rdx
cmp rdx, 0x10
jne 0x180047150
jmp 0x180047279
movups xmm0, xmmword [rcx]
movups xmm7, xmmword [rcx + 0x11]
movaps xmm2, xmmword [0x180050500]
movaps xmm1, xmm7
andps xmm1, xmm2
movaps xmm3, xmmword [0x180050510]
movaps xmm4, xmm7
andps xmm4, xmm3
xorps xmm4, xmmword [str.ZZZZZZZZZZZZZZZZ]
andps xmm7, xmmword [0x180050530]
movaps xmm6, xmm1
xorps xmm7, xmm2
orps xmm7, xmm4
xorps xmm3, xmm7
movaps xmm5, xmmword [str.________________DDDDDDDDDDDDDDDD]
xorps xmm5, xmm7
xorps xmm7, xmmword [0x180050550]
xorps xmm6, xmm2
movaps xmm8, xmmword [0x180050560]
xorps xmm8, xmm1
orps xmm5, xmm3
andps xmm5, xmm7
movaps xmm7, xmmword [0x180050570]
xorps xmm7, xmm1
andps xmm7, xmm5
andnps xmm5, xmm8
orps xmm5, xmm7
movaps xmm7, xmmword [0x180050300]
andps xmm7, xmm3
andps xmm4, xmmword [str._n_n_n_n_n_n_n_n_n_n_n_n_n_n_n_npppppppppppppppp]
orps xmm4, xmm7
orps xmm3, xmm6
orps xmm1, xmmword [0x180050590]
xorps xmm1, xmm4
andps xmm1, xmm3
orps xmm1, xmm5
xorps xmm0, xmm2
xorps xmm0, xmm1
movaps xmmword [0x180061450], xmm0
mov byte [0x180061460], 1
movaps xmm6, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
movaps xmm8, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rsi
ret
Function at 0x180048080
Capabilities:
Encode data using xor

Disassembly:
push rbx
cmp byte [0x180061f55], 0
jne 0x1800480f6
xor r8d, r8d
movabs r9, 0x2e8ba2e8ba2e8ba3
lea r10, [0x180061f2f]
nop
mov rax, r8
mul r9
shr rdx, 2
imul rax, rdx, 0xffffffffffffffea
lea rdx, [rcx + r8]
movzx r11d, byte [rcx + r8 + 0x16]
movzx eax, byte [rax + rdx]
mov edx, eax
not dl
or dl, r11b
not r11b
or r11b, al
mov eax, edx
xor al, 0x56
mov ebx, r11d
xor bl, 0x56
xor dl, 0xa9
and dl, bl
xor r11b, 0xa9
and r11b, al
or r11b, dl
mov byte [r8 + r10], r11b
inc r8
cmp r8, 0x26
jne 0x1800480a0
mov byte [0x180061f55], 1
pop rbx
ret

Function at 0x180048100
Capabilities:
Encode data using xor

Disassembly:
push rbx
cmp byte [0x180061f7f], 0
jne 0x180048184
xor r8d, r8d
movabs r9, 0x842108421084211
lea r10, [0x180061f56]
nop
mov rax, r8
mul r9
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
mov rdx, rax
shl rdx, 5
sub rax, rdx
lea rdx, [rcx + r8]
movzx r11d, byte [rcx + r8 + 0x1f]
movzx eax, byte [rdx + rax]
not al
mov edx, r11d
or dl, al
and al, r11b
mov r11d, edx
xor r11b, 0xdb
mov ebx, eax
xor bl, 0x24
xor dl, 0x24
and dl, bl
xor al, 0xdb
and al, r11b
or al, dl
mov byte [r8 + r10], al
inc r8
cmp r8, 0x29
jne 0x180048120
mov byte [0x180061f7f], 1
pop rbx
ret

Function at 0x180048670
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
cmp byte [0x18006212f], 0
jne 0x180048762
xor r8d, r8d
movabs r9, 0x4924924924924925
lea r10, [0x1800620fe]
nop word cs:[rax + rax]
mov rax, r8
shr rax, 2
mul r9
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
lea rdx, [rcx + r8]
movzx esi, byte [rcx + r8 + 0x1c]
mov r11d, esi
not r11b
movzx eax, byte [rax + rdx]
mov ebx, eax
not bl
mov edi, esi
or dil, 0xce
mov edx, edi
not dl
and r11b, 0x31
xor sil, 0xce
or sil, r11b
mov r11d, eax
xor r11b, 0x21
and r11b, bl
mov ebp, esi
not bpl
and bpl, dl
and dil, 0xe6
and dl, 0x11
or dl, dil
xor dl, sil
xor dl, 0x19
or dl, bpl
mov esi, eax
and sil, 0x20
and bl, 0x11
or bl, sil
mov esi, ebx
xor sil, 0xdf
xor bl, 0xf2
and bl, sil
and r11b, 0x31
mov esi, ebx
and sil, 0x31
xor sil, r11b
and r11b, bl
or r11b, sil
lea esi, [r11 - 0x3e]
and al, 0xce
mov ebx, eax
xor bl, 0xd2
xor r11b, 0x1c
and r11b, bl
xor al, 0x2d
and al, sil
or al, r11b
xor al, dl
mov byte [r8 + r10], al
inc r8
cmp r8, 0x31
jne 0x1800486a0
mov byte [0x18006212f], 1
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x180048770
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x180062161], 0
jne 0x18004884a
lea rdx, [rcx + 0x22]
lea rax, [0x180062150]
cmp rdx, rax
jbe 0x18004879d
lea rdx, [0x180062161]
cmp rcx, rdx
jae 0x18004879d
xor edx, edx
jmp 0x180048800
movdqu xmm0, xmmword [rcx]
movdqu xmm1, xmmword [rcx + 0x11]
pcmpeqd xmm2, xmm2
pxor xmm2, xmm0
por xmm2, xmm1
pandn xmm0, xmm1
movdqa xmm1, xmmword [0x180050020]
movdqa xmm3, xmm2
pxor xmm3, xmm1
movdqa xmm4, xmmword [0x180050030]
movdqa xmm5, xmm0
pxor xmm5, xmm4
pxor xmm2, xmm4
pand xmm2, xmm5
pxor xmm0, xmm1
pand xmm0, xmm3
por xmm0, xmm2
movdqa xmmword [0x180062150], xmm0
mov edx, 0x10
nop word [rax + rax]
movzx r8d, byte [rcx + rdx]
movzx r9d, byte [rcx + rdx + 0x11]
not r8b
mov r10d, r9d
or r10b, r8b
and r8b, r9b
mov r9d, r10d
xor r9b, 0xc2
mov r11d, r8d
xor r11b, 0x3d
xor r10b, 0x3d
and r10b, r11b
xor r8b, 0xc2
and r8b, r9b
or r8b, r10b
mov byte [rdx + rax], r8b
inc rdx
cmp rdx, 0x11
jne 0x180048800
mov byte [0x180062161], 1
ret

Function at 0x1800488a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
cmp byte [0x1800621c0], 0
jne 0x18004899b
xor eax, eax
lea rdx, [0x1800621a7]
nop word [rax + rax]
movzx r8d, byte [rcx + rax + 0x10]
mov r9d, eax
and r9d, 0xf
movzx r9d, byte [rcx + r9]
mov r10d, r8d
and r10b, 0x6c
mov r11d, r10d
xor r11b, 0x6c
mov ebx, r8d
and bl, 0x93
mov esi, r8d
mov edi, r8d
mov ebp, r11d
and bpl, 4
and r8b, 0x68
or r8b, bpl
mov ebp, r9d
xor bpl, 0x90
and bpl, r9b
xor sil, 0x82
and sil, bl
or r8b, 0x12
or r11b, bl
xor r8b, bl
or bl, 0x3d
xor bl, sil
and dil, 4
xor dil, 0x86
and dil, bl
xor bl, 0x55
xor r10b, 0x79
and r10b, bl
or dil, r10b
xor r8b, 0x85
and r8b, r11b
or r8b, dil
and bpl, 0x93
mov r10d, r9d
and r10b, 0xfc
xor r10b, bpl
xor r10b, 0x6c
mov r11d, r8d
xor r11b, 0xa3
and r9b, 8
mov ebx, r10d
and bl, 0x54
or bl, r9b
and r10b, 0xa3
or bl, 0xa0
xor bl, r10b
mov r9d, ebx
xor r9b, 0xb
xor r8b, 0x5c
and r8b, r9b
xor bl, 0xf4
and bl, r11b
or bl, r8b
mov byte [rax + rdx], bl
inc rax
cmp rax, 0x19
jne 0x1800488c0
mov byte [0x1800621c0], 1
pop rbx
pop rbp
pop rdi
pop rsi
ret

Function at 0x1800489a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
cmp byte [0x18006239c], 0
jne 0x180048a71
xor eax, eax
lea rdx, [0x180062369]
nop dword [rax]
movzx r8d, byte [rcx + rax + 0x10]
mov r9d, eax
and r9d, 0xf
movzx r9d, byte [rcx + r9]
mov r10d, r9d
not r10b
or r10b, 0xd2
mov r11d, r8d
and r11b, 8
mov ebx, r8d
and bl, 0xd2
mov esi, ebx
xor sil, 0xf5
mov edi, r8d
and dil, 0x25
or r11b, 2
xor bl, 0xa
and bl, r11b
or dil, 0xd0
and dil, sil
or dil, bl
mov r11d, r8d
xor r11b, 0x2d
xor r8b, 0xd2
or r8b, r11b
not r8b
or r8b, dil
mov r11d, r10d
and r11b, 0xc1
mov ebx, r9d
and bl, 0x20
or bl, r11b
and r10b, 0x1e
or bl, 0xe
and r9b, 0xd2
xor r9b, r10b
xor r9b, bl
mov r10d, r9d
xor r10b, 0xfc
or r10b, r8b
xor r9b, r8b
xor r9b, 3
and r9b, r8b
not r10b
or r10b, r9b
mov byte [rax + rdx], r10b
inc rax
cmp rax, 0x33
jne 0x1800489c0
mov byte [0x18006239c], 1
pop rbx
pop rdi
pop rsi
ret
Function at 0x18004afdc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x18004b016
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x18004b01b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x18004b064
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x180052c90]
cmp byte [rcx + rax], 0
je 0x18004b064
dec r8
sub rdx, 1
jne 0x18004b04a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140021b60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140021b94
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140021b80
ret
Function at 0x140028730
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x1400287fc
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x1400287fc
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x140028815
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx + 0x10]
cmp rax, rcx
je 0x1400287ec
cmp byte [rax], 0x5c
jne 0x1400287e6
lea rdx, [rax + 1]
cmp rdx, rcx
je 0x1400287e6
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x1400287d2
movzx ecx, byte [rdx]
sub cl, 0x28
cmp cl, 1
jbe 0x1400287e3
test r8b, 0x10
jne 0x1400287e6
movzx ecx, byte [rdx]
sub cl, 0x7b
test cl, 0xfd
jne 0x1400287e6
mov rax, rdx
inc rax
mov qword [rbx], rax
mov rcx, rbx
call fcn.140024150
test edi, edi
jne 0x140028750
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.140024140
int3
Function at 0x14002b0b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x14002b0e1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x14002b15b
mov rdi, r14
mov rcx, rbx
call fcn.14001f080
test rax, rax
jle 0x14002b133
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.14009f5a0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14002b14b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x14002b153
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x14002b0f5
sub r14, rdi
jmp 0x14002b23f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14002b172
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14002b174
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14002b1a6
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14009f5a0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14002b23c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14002b1e1
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x14002b21d
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140089f5c
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14002b23c
cmp rbp, rax
ja 0x14002b1f0
test rbp, rbp
je 0x14002b23c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140089f5c
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14002fe10
Capabilities:
Load windows common language runtime

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
cmp qword [0x1400dfc20], 0
jne 0x14002ff02
xor ebx, ebx
lea r8, [rsp + 0x48]
lea rdx, [0x1400c7fb8]
mov qword [rsp + 0x48], rbx
lea rcx, [0x1400c7fa8]
call qword [sym.imp.mscoree.dll_CLRCreateInstance]
lea rdi, [0x1400dfc20]
test eax, eax
js 0x14002fec5
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x40], rbx
lea r8, [0x1400c7f98]
lea rdx, str.v4.0.30319
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov ebx, eax
test eax, eax
js 0x14002feb6
mov rcx, qword [rsp + 0x40]
lea r8, [0x1400c7f88]
mov r9, rdi
lea rdx, [0x1400c7f78]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov ebx, eax
test eax, eax
js 0x14002feab
mov rcx, qword [0x1400dfc20]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
call qword [rax + 0x10]
test ebx, ebx
jns 0x14002ff02
cmp qword [0x1400dfc20], 0
jne 0x14002ff02
lea r9, [0x1400c7f88]
mov qword [rsp + 0x20], rdi
lea r8, [0x1400c7f78]
xor edx, edx
lea rcx, str.v2.0.50727
call qword [sym.imp.mscoree.dll_CorBindToRuntime]
test eax, eax
js 0x14002ff0f
mov rcx, qword [0x1400dfc20]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov al, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor r9d, r9d
lea r8, [0x1400c78c8]
lea rdx, [0x1400c78e0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rbx, qword [rsp + 0x50]
xor al, al
add rsp, 0x30
pop rdi
ret