joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011410
Capabilities:
Execute command

Disassembly:
jmp 0x140011b20
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400230a4]
call fcn.14001138e
lea rcx, [0x14001af68]
call qword [sym.imp.ucrtbased.dll_system]
mov rax, qword [rbp + 0x128]
mov r9d, dword [rax + 0x10]
mov rax, qword [rbp + 0x128]
mov r8d, dword [rax + 0xc]
mov rax, qword [rbp + 0x128]
mov edx, dword [rax + 8]
lea rcx, [0x14001af70]
call fcn.1400111ae
lea rcx, str._____________________n
call fcn.1400111ae
mov dword [rbp + 4], 0
jmp 0x140011b9a
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
cmp dword [rbp + 4], 0xa
jge 0x140011c29
mov dword [rbp + 0x24], 0
jmp 0x140011bb5
mov eax, dword [rbp + 0x24]
inc eax
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0x14
jge 0x140011c18
mov rax, qword [rbp + 0x128]
mov eax, dword [rax + 4]
cmp dword [rbp + 4], eax
jne 0x140011beb
mov rax, qword [rbp + 0x128]
mov eax, dword [rax]
cmp dword [rbp + 0x24], eax
jne 0x140011beb
mov edx, 0x43
lea rcx, [0x14001afbc]
call fcn.1400111ae
jmp 0x140011c16
movsxd rax, dword [rbp + 4]
imul rax, rax, 0x14
mov rcx, qword [rbp + 0x120]
add rcx, rax
mov rax, rcx
movsxd rcx, dword [rbp + 0x24]
movsx eax, byte [rax + rcx]
mov edx, eax
lea rcx, [0x14001afbc]
call fcn.1400111ae
jmp 0x140011bad
lea rcx, [0x14001afc0]
call fcn.1400111ae
jmp 0x140011b92
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140011415
Capabilities:
Execute command

Disassembly:
jmp 0x1400121e0
push rbp
push rsi
push rdi
sub rsp, 0x260
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x60
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x238], rax
lea rcx, [0x1400230a4]
call fcn.14001138e
mov dword [rbp + 0xf8], 1
mov dword [rbp + 0xfc], 1
mov dword [rbp + 0x100], 0
mov dword [rbp + 0x104], 3
mov dword [rbp + 0x108], 0
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0x10]
call fcn.140011406
cmp dword [rbp + 0x104], 0
jle 0x1400122ed
cmp dword [rbp + 0x108], 0
jle 0x1400122ed
lea rax, [rbp + 0x210]
lea rcx, [rbp + 0xf8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x14
rep movsb byte [rdi], byte [rsi]
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x10]
call fcn.140011410
call qword [sym.imp.ucrtbased.dll__kbhit]
test eax, eax
je 0x1400122dd
call qword [sym.imp.ucrtbased.dll__getch]
mov byte [rbp + 0x124], al
movsx eax, byte [rbp + 0x124]
cmp eax, 0x71
jne 0x1400122c5
jmp 0x1400122ed
movzx r8d, byte [rbp + 0x124]
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0x10]
call fcn.140011401
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140012260
lea rcx, [0x14001af68]
call qword [sym.imp.ucrtbased.dll_system]
cmp dword [rbp + 0x108], 0
jne 0x140012323
lea rcx, [0x14001afc8]
call fcn.1400111ae
mov edx, dword [rbp + 0x100]
lea rcx, [0x14001aff8]
call fcn.1400111ae
jmp 0x140012341
lea rcx, [0x14001b010]
call fcn.1400111ae
mov edx, dword [rbp + 0x100]
lea rcx, [0x14001aff8]
call fcn.1400111ae
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ad40]
call fcn.140011325
mov rcx, qword [rbp + 0x238]
xor rcx, rbp
call fcn.1400111c7
lea rsp, [rbp + 0x240]
pop rdi
pop rsi
pop rbp
ret
Function at 0x180003f6c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov r10, qword [rsp + 0x80]
mov qword [rax - 0x38], r10
call fcn.18000e888
mov ebp, dword [r10]
mov dword [rsp + 0x40], 0x8e04a
xor eax, eax
lea rsi, [r10 + 4]
mov edi, dword [rsi]
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x80], 0x940ade
or dword [rsp + 0x80], 0x5966d92e
xor edi, ebp
add rsi, 4
shl dword [rsp + 0x80], 0xe
imul eax, dword [rsp + 0x80], 0x42
mov dword [rsp + 0x80], eax
xor dword [rsp + 0x80], 0x2ddf0001
mov dword [rsp + 0x30], 0xb682f8
add dword [rsp + 0x30], 0xcd9f
xor dword [rsp + 0x30], 0xb75093
mov ecx, dword [rsp + 0x80]
mov eax, dword [rsp + 0x30]
mov ebx, dword [rsp + 0x80]
add ecx, edi
dec eax
add ebx, edi
test eax, ecx
je 0x18000402f
mov eax, dword [rsp + 0x30]
dec eax
not eax
and ebx, eax
mov eax, dword [rsp + 0x30]
add ebx, eax
mov dword [rsp + 0x38], 0xcb2fdd
or dword [rsp + 0x38], 0x68e0d4ef
xor dword [rsp + 0x38], 0x68ee872f
mov dword [rsp + 0x34], 0xf61f69
shl dword [rsp + 0x34], 0xd
xor dword [rsp + 0x34], 0xc3ed5e99
mov dword [rsp + 0x30], 0x4d16bc
shr dword [rsp + 0x30], 4
xor dword [rsp + 0x30], 0x8de18
mov dword [rsp + 0x80], 0xe73c61
shr dword [rsp + 0x80], 4
xor dword [rsp + 0x80], 0xe87de
mov eax, dword [rsp + 0x80]
mov eax, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
mov eax, dword [rsp + 0x38]
lea eax, [rbx + rbx]
mov dword [rsp + 0x20], eax
call fcn.180014458
xor r14d, r14d
mov r9, rax
test rax, rax
je 0x180004123
mov ecx, ebx
mov r8, rax
mov r11d, r14d
shr rcx, 2
lea rdx, [rsi + rcx*4]
mov r10, rdx
sub r10, rsi
add r10, 3
shr r10, 2
cmp rsi, rdx
cmova r10, r14
test r10, r10
je 0x18000411e
mov ecx, dword [rsi]
inc r11
lea rsi, [rsi + 4]
xor ecx, ebp
movzx eax, cl
mov word [r8], ax
movzx eax, cx
shr ecx, 0x10
shr ax, 8
lea r8, [r8 + 8]
mov word [r8 - 6], ax
movzx eax, cl
shr cx, 8
mov word [r8 - 4], ax
mov word [r8 - 2], cx
cmp r11, r10
jb 0x1800040e3
mov word [r9 + rdi*2], r14w
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rax, r9
add rsp, 0x50
pop r14
ret
Function at 0x180007ab0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 8], ecx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rbp, qword [rsp + 0xa8]
mov qword [rax - 0x50], rbp
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0x20], eax
call fcn.18000e888
mov r14d, dword [rbp + 0x3c]
mov dword [rsp + 0x38], 0x1763a
mov dword [rsp + 0x3c], 0x313fd
mov dword [rsp + 0x40], 0x9604a
mov dword [rsp + 0xa8], 0x791361
add r14, rbp
mov eax, 0x4ec4ec4f
xor dword [rsp + 0xa8], 0xf89ce210
xor ebx, ebx
mov ecx, dword [rsp + 0xa8]
mul ecx
shr edx, 5
mov dword [rsp + 0xa8], edx
imul eax, dword [rsp + 0xa8], 0x17
mov dword [rsp + 0xa8], eax
xor dword [rsp + 0xa8], 0x370b77c6
mov r15d, dword [rsp + 0xa8]
mov esi, dword [r14 + r15*8 + 0x88]
add rsi, rbp
mov ecx, dword [rsi + 0x20]
mov r12d, dword [rsi + 0x1c]
mov r13d, dword [rsi + 0x24]
mov dword [rsp + 0xa8], 0xa9c2b6
add rcx, rbp
add r12, rbp
add r13, rbp
mov qword [rsp + 0x38], rcx
imul eax, dword [rsp + 0xa8], 0x3d
mov dword [rsp + 0xa8], eax
xor dword [rsp + 0xa8], 0x2873655e
mov edi, dword [rsp + 0xa8]
jmp 0x180007c55
mov eax, edi
mov ecx, dword [rcx + rax*4]
mov dword [rsp + 0x30], 0xdda92f
mov eax, 0x2f684bdb
xor dword [rsp + 0x30], 0x2c4c6090
add rcx, rbp
mov r8d, dword [rsp + 0x30]
mul r8d
sub r8d, edx
shr r8d, 1
add r8d, edx
shr r8d, 5
mov dword [rsp + 0x30], r8d
or dword [rsp + 0x30], 0xfab22acd
xor dword [rsp + 0x30], 0xfaf97e1d
mov dword [rsp + 0xa8], 0xf03ae8
add dword [rsp + 0xa8], 0xffffc11a
add dword [rsp + 0xa8], 0xd855
xor dword [rsp + 0xa8], 0xe16e0b02
xor dword [rsp + 0xa8], 0xe1972521
mov r8d, dword [rsp + 0xa8]
mov edx, dword [rsp + 0x30]
call fcn.18000328c
xor eax, 0x1ceef7b2
cmp eax, dword [rsp + 0x80]
je 0x180007c60
mov rcx, qword [rsp + 0x38]
inc edi
cmp edi, dword [rsi + 0x18]
jb 0x180007bb1
jmp 0x180007c8f
mov eax, edi
movzx ecx, word [r13 + rax*2]
mov ebx, dword [r12 + rcx*4]
add rbx, rbp
cmp rbx, rsi
jb 0x180007c8f
mov eax, dword [r14 + r15*8 + 0x8c]
add rax, rsi
cmp rbx, rax
jae 0x180007c8f
mov rcx, rbx
call fcn.180010ed0
mov rbx, rax
lea r11, [rsp + 0x50]
mov rax, rbx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18000846c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
call fcn.18000e888
mov r14d, dword [r8]
mov dword [rbp - 0x18], 0x1a2b0
xor eax, eax
lea rdi, [r8 + 4]
mov esi, dword [rdi]
mov qword [rbp - 0x14], rax
mov dword [rbp - 0xc], eax
mov dword [rbp + 0x48], 0xf25805
xor esi, r14d
add rdi, 4
add dword [rbp + 0x48], 0x9056
imul eax, dword [rbp + 0x48], 0x6e
mov dword [rbp + 0x48], eax
mov eax, 0xd41d41d5
mov ecx, dword [rbp + 0x48]
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
mov dword [rbp + 0x48], ecx
xor dword [rbp + 0x48], 0x2fb6c8a
mov dword [rbp + 0x40], 0x6f75b8
add dword [rbp + 0x40], 0xb366
imul eax, dword [rbp + 0x40], 0x5f
mov dword [rbp + 0x40], eax
shl dword [rbp + 0x40], 0xd
xor dword [rbp + 0x40], 0xe8444004
mov ecx, dword [rbp + 0x48]
mov eax, dword [rbp + 0x40]
mov ebx, dword [rbp + 0x48]
add ecx, esi
dec eax
add ebx, esi
test eax, ecx
je 0x180008517
mov eax, dword [rbp + 0x40]
dec eax
not eax
and ebx, eax
mov eax, dword [rbp + 0x40]
add ebx, eax
mov dword [rbp - 0x1c], 0xd79dca
mov dword [rsp + 0x20], ebx
add dword [rbp - 0x1c], 0xffff1e60
xor dword [rbp - 0x1c], 0xd237ba
mov dword [rbp + 0x40], 0xcac936
add dword [rbp + 0x40], 0xffff1aaf
shr dword [rbp + 0x40], 9
add dword [rbp + 0x40], 0x6559
xor dword [rbp + 0x40], 0xb6ea4
mov dword [rbp - 0x20], 0x936f08
shr dword [rbp - 0x20], 0xf
shl dword [rbp - 0x20], 0xb
xor dword [rbp - 0x20], 0xfb3b8
mov dword [rbp + 0x48], 0x706527
add dword [rbp + 0x48], 0x2a8b
shl dword [rbp + 0x48], 0x10
xor dword [rbp + 0x48], 0x8fb6180f
mov eax, dword [rbp + 0x48]
mov eax, dword [rbp - 0x20]
mov eax, dword [rbp + 0x40]
mov eax, dword [rbp - 0x1c]
call fcn.180014458
xor r15d, r15d
mov r10, rax
test rax, rax
je 0x1800085fb
mov ecx, ebx
mov r8, rax
mov r11d, r15d
shr rcx, 2
lea rdx, [rdi + rcx*4]
mov r9, rdx
sub r9, rdi
add r9, 3
shr r9, 2
cmp rdi, rdx
cmova r9, r15
test r9, r9
je 0x1800085f7
mov ecx, dword [rdi]
inc r11
lea rdi, [rdi + 4]
xor ecx, r14d
mov byte [r8], cl
movzx eax, cx
shr ecx, 0x10
shr ax, 8
lea r8, [r8 + 4]
mov byte [r8 - 3], al
mov byte [r8 - 2], cl
shr cx, 8
mov byte [r8 - 1], cl
cmp r11, r9
jb 0x1800085c5
mov byte [rsi + r10], r15b
mov rax, r10
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18000b15c
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov r10d, dword [rsp + 0x60]
mov r11, r8
mov dword [rsp + 0x20], r10d
call fcn.18000e888
mov dword [rsp + 0x60], 0x94bff
mov dword [rsp + 0x60], 0xf4b218
xor edx, edx
imul eax, dword [rsp + 0x60], 0x13
mov dword [rsp + 0x60], eax
xor dword [rsp + 0x60], 0x3135df52
imul eax, dword [rsp + 0x60], 0x59
mov dword [rsp + 0x60], eax
mov eax, r10d
xor dword [rsp + 0x60], 0x350cdd8e
mov ecx, dword [rsp + 0x60]
mov dword [rsp + 0x60], 0xa944d
div ecx
imul ecx, dword [rsp + 0x60], 0x31
mov dword [rsp + 0x60], ecx
mov r9d, eax
mov eax, 0x2040811
mov ecx, dword [rsp + 0x60]
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 6
mov dword [rsp + 0x60], ecx
xor dword [rsp + 0x60], 0x414ef
mov ecx, dword [rsp + 0x60]
cmp ecx, r9d
jae 0x18000b229
mov r8d, r9d
sub r8d, ecx
mov dword [rsp + 0x60], 0x1db9f8
xor dword [rsp + 0x60], 0xa88e7864
shl dword [rsp + 0x60], 9
shr dword [rsp + 0x60], 6
xor dword [rsp + 0x60], 0x9808a4
mov eax, dword [rsp + 0x60]
call fcn.1800087d8
mov dword [r11], eax
add r11, 4
dec r8
jne 0x18000b1f2
mov dword [rsp + 0x60], 0x9a359f
add dword [rsp + 0x60], 0x3067
or dword [rsp + 0x60], 0x67611685
xor dword [rsp + 0x60], 0x67fb7683
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x60], 0x4f8505
xor dword [rsp + 0x60], 0xead8ff88
xor dword [rsp + 0x60], 0xea977a8d
imul eax, r9d
sub r10d, eax
mov eax, dword [rsp + 0x60]
cmp r10d, eax
jbe 0x18000b32d
mov dword [rsp + 0x60], 0x9df005
mov eax, 0x24924925
or dword [rsp + 0x60], 0xb6d8eaee
mov ecx, dword [rsp + 0x60]
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 4
mov dword [rsp + 0x60], ecx
xor dword [rsp + 0x60], 0x6852653
mov eax, dword [rsp + 0x60]
call fcn.1800087d8
lea rdx, [r11 + 1]
mov r8d, eax
shr eax, 0x10
movzx ecx, ax
shr cx, 8
mov byte [r11], cl
mov dword [rsp + 0x60], 0x953841
shl dword [rsp + 0x60], 3
xor dword [rsp + 0x60], 0xcec4a5af
add dword [rsp + 0x60], 0xffffe705
xor dword [rsp + 0x60], 0xca6d4ead
mov ecx, dword [rsp + 0x60]
cmp r10d, ecx
jbe 0x18000b2f9
mov byte [rdx], al
inc rdx
mov dword [rsp + 0x60], 0x77f7a9
add dword [rsp + 0x60], 0xc67
mov eax, dword [rsp + 0x60]
shl eax, 6
mov dword [rsp + 0x60], eax
xor dword [rsp + 0x60], 0x1e010402
mov eax, dword [rsp + 0x60]
cmp r10d, eax
jbe 0x18000b32d
shr r8w, 8
mov byte [rdx], r8b
add rsp, 0x38
ret
Function at 0x18000d4c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x4f]
sub rsp, 0xc0
mov eax, dword [rbp + 0x7f]
mov r11d, dword [rbp + 0x77]
mov r10d, r8d
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r11d
mov rbx, rcx
call fcn.18000e888
mov dword [rbp - 0x49], 0xa3b14
mov dword [rbp - 0x45], 0x25b22
xor eax, eax
mov esi, 1
mov dword [rbp - 0x41], eax
mov dword [rbp + 0x77], 0x9d89c5
xor dword [rbp + 0x77], 0xb38c0c72
imul eax, dword [rbp + 0x77], 0x53
mov dword [rbp + 0x77], eax
shr dword [rbp + 0x77], 4
xor dword [rbp + 0x77], 0xeae5a5
mov r8d, dword [rbp + 0x77]
mov dword [rbp + 0x77], 0xef7761
add dword [rbp + 0x77], 0xffff4f55
add dword [rbp + 0x77], 0x38ec
add dword [rbp + 0x77], 0xe2b
xor dword [rbp + 0x77], 0xef0dcc
mov eax, dword [rbp + 0x77]
test r10d, eax
je 0x18000d574
lea ecx, [rsi + 0x60]
mov eax, r8d
add r8d, esi
mov word [rbp + rax*2 - 0x39], cx
add cx, si
cmp cx, 0x7a
jbe 0x18000d560
mov dword [rbp + 0x77], 0x9ae467
mov eax, 0xb21642c9
shl dword [rbp + 0x77], 1
mov ecx, dword [rbp + 0x77]
mul ecx
shr edx, 6
mov dword [rbp + 0x77], edx
xor dword [rbp + 0x77], 0xc15d6f0b
xor dword [rbp + 0x77], 0xc15e310b
mov eax, dword [rbp + 0x77]
test r10d, eax
je 0x18000d5bd
mov ecx, 0x41
mov eax, r8d
add r8d, esi
mov word [rbp + rax*2 - 0x39], cx
add cx, si
cmp cx, 0x5a
jbe 0x18000d5a9
mov dword [rbp + 0x77], 0x54fd64
xor dword [rbp + 0x77], 0x806ef325
xor dword [rbp + 0x77], 0x803a0e45
mov eax, dword [rbp + 0x77]
test r10d, eax
je 0x18000d5f3
mov ecx, 0x30
mov eax, r8d
add r8d, esi
mov word [rbp + rax*2 - 0x39], cx
add cx, si
cmp cx, 0x39
jbe 0x18000d5df
mov dword [rbp + 0x77], 0xb56945
mov eax, dword [rbp + 0x77]
lea ecx, [rax + rax*2]
shl ecx, 2
mov dword [rbp + 0x77], ecx
xor dword [rbp + 0x77], 0x880ef3c
mov ecx, dword [rbp + 0x77]
cmp ecx, r11d
jae 0x18000d666
mov edi, r11d
lea r9, [rbx + rcx*2]
sub edi, ecx
mov dword [rbp + 0x77], 0x2c41c1
mov eax, 0xaaaaaaab
mov ecx, dword [rbp + 0x77]
mul ecx
shr edx, 3
mov dword [rbp + 0x77], edx
add dword [rbp + 0x77], 0x31d5
shr dword [rbp + 0x77], 0xb
xor dword [rbp + 0x77], 0xd21cd
mov eax, dword [rbp + 0x77]
call fcn.1800087d8
xor edx, edx
div r8d
movzx eax, word [rbp + rdx*2 - 0x39]
mov word [r9], ax
lea r9, [r9 + 2]
sub rdi, rsi
jne 0x18000d61e
mov dword [rbp + 0x77], 0xc8406c
shr dword [rbp + 0x77], 4
xor dword [rbp + 0x77], 0x2a3c7f29
xor dword [rbp + 0x77], 0x2a30fb27
mov eax, dword [rbp + 0x77]
test r10d, eax
je 0x18000d68e
xor ecx, ecx
mov word [rbx + r11*2], cx
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18000ec80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov eax, dword [rsp + 0x90]
mov r14, r9
mov dword [rsp + 0x20], eax
call fcn.18000e888
mov ebp, dword [rcx]
mov dword [rsp + 0x40], 0xe541e
mov dword [rsp + 0x44], 0xd760
xor eax, eax
mov qword [rsp + 0x48], rax
lea rdi, [rcx + 4]
mov esi, dword [rdi]
mov dword [rsp + 0x70], 0x11c49d
add rdi, 4
shr dword [rsp + 0x70], 0xd
xor esi, ebp
add dword [rsp + 0x70], 0x1a8e
imul eax, dword [rsp + 0x70], 0x39
mov dword [rsp + 0x70], eax
xor dword [rsp + 0x70], 0x60938
mov eax, dword [rsp + 0x70]
dec eax
test esi, eax
je 0x18000ed0c
mov ebx, dword [rsp + 0x70]
mov eax, dword [rsp + 0x70]
dec ebx
not ebx
and ebx, esi
add ebx, eax
jmp 0x18000ed0e
mov ebx, esi
mov dword [rsp + 0x70], 0xeeee5c
mov eax, 0xa57eb503
mov dword [rsp + 0x20], ebx
xor dword [rsp + 0x70], 0xa4e0c37f
or dword [rsp + 0x70], 0x3352e15b
xor dword [rsp + 0x70], 0xb75b9ded
mov dword [rsp + 0x38], 0x1e1cdd
mov ecx, dword [rsp + 0x38]
mul ecx
shr edx, 6
mov dword [rsp + 0x38], edx
xor dword [rsp + 0x38], 0xe2230
mov dword [rsp + 0x34], 0x8e4c83
shl dword [rsp + 0x34], 1
xor dword [rsp + 0x34], 0x11943c6
mov dword [rsp + 0x30], 0xe8d1c9
shr dword [rsp + 0x30], 7
xor dword [rsp + 0x30], 0xc22f3
mov eax, dword [rsp + 0x30]
mov eax, dword [rsp + 0x34]
mov eax, dword [rsp + 0x38]
mov eax, dword [rsp + 0x70]
call fcn.180014458
xor r10d, r10d
mov r8, rax
test rax, rax
je 0x18000ede5
mov ecx, ebx
mov r9d, r10d
shr rcx, 2
lea rdx, [rdi + rcx*4]
mov rcx, rdx
sub rcx, rdi
add rcx, 3
shr rcx, 2
cmp rdi, rdx
cmova rcx, r10
test rcx, rcx
je 0x18000eddd
mov rdx, rax
sub rdx, rdi
mov eax, dword [rdi]
inc r9
xor eax, ebp
mov dword [rdx + rdi], eax
lea rdi, [rdi + 4]
cmp r9, rcx
jb 0x18000edca
test r14, r14
je 0x18000ede5
mov dword [r14], esi
lea r11, [rsp + 0x50]
mov rax, r8
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x18000f1d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x180019070]
mov dword [rsp + 0x40], 0x4a5b4
mov dword [rsp + 0x44], 0xa1c27
mov r10, qword [rax + 0x18]
test r10, r10
je 0x18000f2bc
mov rbx, qword [r10]
mov dword [rsp + 0x50], 0x51903e
mov eax, 0x1b4e81b5
add dword [rsp + 0x50], 0xe748
shr dword [rsp + 0x50], 1
shl dword [rsp + 0x50], 8
xor dword [rsp + 0x50], 0x29327802
mov dword [rsp + 0x48], 0xff6043
shl dword [rsp + 0x48], 0xc
shl dword [rsp + 0x48], 9
mov ecx, dword [rsp + 0x48]
mul ecx
mov rcx, r10
shr edx, 3
mov dword [rsp + 0x48], edx
xor dword [rsp + 0x48], 0x1eb7d3
mov dword [rsp + 0x58], 0xb13d4b
add dword [rsp + 0x58], 0xbf6d
add dword [rsp + 0x58], 0xb86c
xor dword [rsp + 0x58], 0xb275ff
mov dword [rsp + 0x40], 0xa74a93
add dword [rsp + 0x40], 0x1549
add dword [rsp + 0x40], 0xffffc0c8
add dword [rsp + 0x40], 0xffffe3f1
xor dword [rsp + 0x40], 0xae3288
mov eax, dword [rsp + 0x40]
mov r9d, dword [rsp + 0x58]
mov r8d, dword [rsp + 0x48]
mov edx, dword [rsp + 0x50]
mov dword [rsp + 0x20], eax
call fcn.1800088d4
mov r10, rbx
test rbx, rbx
jne 0x18000f1fa
add rsp, 0x30
pop rbx
ret
Function at 0x18001137c
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x40
mov dword [rbp - 0x10], 0x690f1
xor eax, eax
mov qword [rbp - 0xc], rax
mov dword [rbp + 0x28], 0x2b7923
add dword [rbp + 0x28], 0xfffff466
xor dword [rbp + 0x28], 0x2b6d89
mov edx, dword [rbp + 0x28]
lea ecx, [rax + 9]
cmp edx, ecx
jae 0x18001148d
sub ecx, edx
lea rbx, [rdx*8 + 0x50]
mov edi, ecx
mov dword [rbp + 0x20], 0xe78983
or dword [rbp + 0x20], 0x81dcf61f
add dword [rbp + 0x20], 0xffff2a5b
shl dword [rbp + 0x20], 3
xor dword [rbp + 0x20], 0xff89b7a
mov dword [rbp + 0x38], 0x5343c0
xor dword [rbp + 0x38], 0x54cf4b8e
mov eax, 0xcccccccd
xor dword [rbp + 0x38], 0x549bda1d
mov dword [rbp + 0x28], 0x751856
mov ecx, dword [rbp + 0x28]
mul ecx
shr edx, 6
mov eax, 0xaaaaaaab
mov dword [rbp + 0x28], edx
mov ecx, dword [rbp + 0x28]
mul ecx
shr edx, 5
mov eax, 0x8421085
mov dword [rbp + 0x28], edx
mov ecx, dword [rbp + 0x28]
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 4
mov dword [rbp + 0x28], ecx
xor dword [rbp + 0x28], 0xd9ad
mov dword [rbp + 0x30], 0xeecaff
or dword [rbp + 0x30], 0x2e71b69f
add dword [rbp + 0x30], 0xd94e
xor dword [rbp + 0x30], 0x2f050222
mov eax, dword [rbp + 0x30]
mov r9d, dword [rbp + 0x28]
mov r8, qword [0x180019068]
mov edx, dword [rbp + 0x38]
mov r8, qword [rbx + r8]
mov ecx, dword [rbp + 0x20]
mov dword [rsp + 0x20], eax
call fcn.1800015bc
lea rbx, [rbx + 8]
dec rdi
jne 0x1800113ca
mov dword [rbp + 0x38], 0x74988d
mov eax, 0x3521cfb3
mov ecx, dword [rbp + 0x38]
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
mov dword [rbp + 0x38], ecx
add dword [rbp + 0x38], 0xffffce14
xor dword [rbp + 0x38], 0xd76b3
mov dword [rbp + 0x20], 0x6b8973
add dword [rbp + 0x20], 0x891f
imul eax, dword [rbp + 0x20], 0x1c
mov dword [rbp + 0x20], eax
or dword [rbp + 0x20], 0x4003e32b
xor dword [rbp + 0x20], 0x4bddeeb7
mov dword [rbp + 0x28], 0x14272c
xor dword [rbp + 0x28], 0x62c10950
shr dword [rbp + 0x28], 0xa
mov ecx, dword [rbp + 0x28]
mov eax, 0xa57eb503
mul ecx
mov eax, 0x8421085
shr edx, 6
mov dword [rbp + 0x28], edx
xor dword [rbp + 0x28], 0xf6309
mov dword [rbp + 0x30], 0xd877b8
shl dword [rbp + 0x30], 9
mov ecx, dword [rbp + 0x30]
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
mov dword [rbp + 0x30], ecx
xor dword [rbp + 0x30], 0x2de8981
mov eax, dword [rbp + 0x30]
mov r9d, dword [rbp + 0x28]
mov r8d, dword [rbp + 0x20]
mov edx, dword [rbp + 0x38]
mov rcx, qword [0x180019068]
mov dword [rsp + 0x20], eax
call fcn.1800088d4
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret
Function at 0x140003034
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000307e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000307e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000307e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000307e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000307e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003080
xor al, al
add rsp, 0x28
ret
Function at 0x1400027b8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002802
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002802
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002802
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002802
cmp dword [rcx + 0x84], 0xe
jbe 0x140002802
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002804
xor al, al
add rsp, 0x28
ret

Function at 0x140005a24
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x140005a93
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005a93
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005a93
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005a93
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005a93
cmp dword [rcx + 0x84], 0xe
jbe 0x140005a93
cmp dword [rcx + 0xf8], 0
je 0x140005a93
mov ecx, ebx
call fcn.140005b44
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.140005920
nop
cmp dword [rbp + 0x20], 0
je 0x140005ae1
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.140005aec
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x140005a24

Function at 0x140005c28
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140005a24