joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002a10
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180002fa0
mov qword [rsp + 0x28], 0
cmp qword [0x180031da8], 0
jne 0x180002a58
cmp qword [0x180031da0], 0
je 0x180002a58
mov rax, qword [0x180031da0]
mov qword [0x180031da8], rax
cmp qword [0x180031da8], 0
je 0x180002afe
mov rax, qword [0x180031da8]
cmp qword [rax + 0x10], 0
je 0x180002afe
mov rax, qword [0x180031da8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180002afe
mov rax, qword [0x180031da8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180002afe
mov rax, qword [0x180031da8]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x180002ac4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x180002acb
xor eax, eax
jmp 0x180002c79
mov rax, qword [0x180031da8]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call fcn.180008350
mov rax, qword [rsp + 0x28]
jmp 0x180002c79
mov rax, qword [0x180031da0]
mov qword [0x180031da8], rax
jmp 0x180002b20
mov rax, qword [0x180031da8]
mov rax, qword [rax + 8]
mov qword [0x180031da8], rax
cmp qword [0x180031da8], 0
je 0x180002b6d
cmp qword [0x180031da8], 0
je 0x180002b6b
mov rax, qword [0x180031da8]
cmp qword [rax + 0x10], 0
je 0x180002b6b
mov rax, qword [0x180031da8]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180002b6b
mov rax, qword [0x180031da8]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180002b6b
jmp 0x180002a9c
jmp 0x180002b0e
mov rcx, qword [rsp + 0x60]
call fcn.180004bf0
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180002c80
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180002c77
mov rax, qword [rsp + 0x48]
mov qword [0x180031da8], rax
mov rax, qword [0x180031da8]
mov dword [rax], 0x52727464
mov rax, qword [0x180031da8]
mov qword [rax + 0x10], 0
mov rax, qword [0x180031da8]
mov rcx, qword [0x180031da0]
mov qword [rax + 8], rcx
mov rax, qword [0x180031da8]
mov qword [0x180031da0], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x180031da8]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x180002c28
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x180002c62
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x180002c1e
mov rax, qword [0x180031da8]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x180002a9c
xor eax, eax
add rsp, 0x58
ret
Function at 0x180003990
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call sub.KERNEL32.dll_VirtualQuery
nop
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1800039d7
xor al, al
jmp 0x180003a79
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x180003a01
xor al, al
jmp 0x180003a79
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x88], rax
jb 0x180003a71
mov eax, 8
imul rax, rax, 0xc
mov rcx, qword [rsp + 0x30]
mov eax, dword [rcx + rax + 0x88]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov ecx, 8
imul rcx, rcx, 0xc
mov rdx, qword [rsp + 0x30]
mov ecx, dword [rdx + rcx + 0x8c]
add rax, rcx
cmp qword [rsp + 0x88], rax
jae 0x180003a71
mov al, 1
jmp 0x180003a79
jmp 0x180003a77
xor al, al
add rsp, 0x78
ret

Function at 0x180003d80
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x180031da0]
mov qword [rsp + 0x28], rax
jmp 0x180003da0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180003dcf
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x28]
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
jne 0x180003dcd
call sub.KERNEL32.dll_GetLastError
jmp 0x180003dd1
jmp 0x180003d92
xor eax, eax
add rsp, 0x38
ret
Function at 0x180004490
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [0x180031db8], eax
je 0x1800044ab
mov eax, 0x10dd
jmp 0x1800045d0
mov rax, qword [0x180031dd0]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180004555
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call sub.KERNEL32.dll_VirtualProtect
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x180004520
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x180004520
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.1800030e0
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.1800065b0
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x1800044b7
mov qword [0x180031dd0], 0
call fcn.180003b40
mov rax, qword [0x180031dc8]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1800045b9
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call sub.KERNEL32.dll_ResumeThread
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x48]
call fcn.1800065b0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x180004571
mov qword [0x180031dc8], 0
mov dword [0x180031db8], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x180004b00
Capabilities:
Suspend thread

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
cmp dword [0x180031dbc], 0
je 0x180004b1d
mov eax, dword [0x180031dbc]
jmp 0x180004be3
call sub.KERNEL32.dll_GetCurrentThread
cmp qword [rsp + 0x50], rax
jne 0x180004b30
xor eax, eax
jmp 0x180004be3
mov ecx, 0x10
call fcn.1800065b8
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x180004b9e
mov dword [rsp + 0x20], 8
cmp qword [rsp + 0x28], 0
je 0x180004b83
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x38]
call fcn.1800065b0
mov qword [rsp + 0x28], 0
mov eax, dword [rsp + 0x20]
mov dword [0x180031dbc], eax
mov qword [0x180031dc0], 0
mov eax, dword [rsp + 0x20]
jmp 0x180004be3
mov rcx, qword [rsp + 0x50]
call sub.KERNEL32.dll_SuspendThread
cmp eax, 0xffffffff
jne 0x180004bb8
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
jmp 0x180004b59
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
mov qword [rax + 8], rcx
mov rax, qword [rsp + 0x28]
mov rcx, qword [0x180031dc8]
mov qword [rax], rcx
mov rax, qword [rsp + 0x28]
mov qword [0x180031dc8], rax
xor eax, eax
add rsp, 0x48
ret
Function at 0x140003b70
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003ba4
cmp word [rcx], 0x5a4d
jne 0x140003ba4
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003ba4
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003ba4
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003ab0
test eax, eax
jne 0x140003bc0
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.140003b20
test rax, rax
je 0x140003bb5
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.140004369
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004270
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.140004210
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140004e10
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140004e33
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140004e33
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140004ee1
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x14055b630]
mov r8, rcx
mov rcx, r9
call fcn.140004e10
test eax, eax
je 0x140004f0d
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140004e34
xor eax, eax
add rsp, 0x28
ret
Function at 0x1400097f0
Capabilities:
Access peb ldr_data

Disassembly:
push r12
push r14
push r15
sub r12, r12
add r12, 0x60
mov r14, qword gs:[r12]
push r11
mov r11, qword [r14 + 0x10]
add r14, 0x18
mov r15, qword [r14]
mov r12, r15
add r12, 0x10
mov r14, qword [r12]
push rax
mov r12, qword [r14 + 0x30]
cmp r12, 0
je 0x14000984a
mov r15, qword [r14 + 0x60]
mov rax, qword [r15]
and eax, 0xdf00df
mov r15, qword [r15 + 0xb]
add r15d, eax
shr r15d, 2
sub r15d, 0xc914cd2
cmp r15, 0
je 0x140009852
mov r14, qword [r14]
jmp 0x14000981b
mov r14d, dword [r12 + 0x3c]
add r14, r12
add r14, 0x10
mov r15d, dword [r14 + 0x78]
add r15, r12
push r10
mov eax, dword [r15 + 0x20]
add rax, r12
mov r10d, dword [rax]
add r10, r12
mov r14d, dword [r10 + 0xb]
sub r14d, 0x746365
cmp r14d, 0
jne 0x140009887
jmp 0x140009895
inc rax
inc rax
inc rax
inc rax
jmp 0x14000986e
mov r14d, dword [r15 + 0x20]
sub rax, r14
sub rax, r12
shr eax, 1
mov r14d, dword [r15 + 0x24]
add r14, rax
add r14, r12
mov eax, dword [r14]
mov r14d, dword [r15 + 0x1c]
shl eax, 0x10
shr eax, 0xe
add r14, r12
add r14, rax
mov eax, dword [r14]
add rax, r12
mov r14d, 0x7a000
add r14, r11
push r12
push r11
push r14
push r10
push r10
push rax
mov rcx, r14
mov r9, rsp
mov r8d, 0x40
mov edx, 0xb8000
call rax
pop r15
pop r10
pop r10
pop r14
pop r11
mov r12d, 0x6f6d
push rax
movabs r15, 0x3ae00
mov eax, 3
imul r12, rax
movabs rax, 0x19ca
add rax, r11
add r12, rax
call fcn.14000994c
mov r12d, 0x52611
movabs r14, 0xba000
add r12, r11
mov r15d, 0x3b30
add r14, r11
call fcn.14000994c
pop rax
jmp 0x140009972
nop
ret
mov r12d, 0x8000000
mov r15d, 0xe1
movabs r14, 0x7a000
mov eax, 0x12
imul r15d, eax
add r15d, 0x2e
add r14, r11
sub r14, r15
mov r15, r14
sub r15, r12
mov r12d, 0x57211
add r12, r11
mov eax, dword [r12]
xor eax, 0xde3d1b5f
dec eax
cmp eax, 0
je 0x1400099cf
add rax, r14
mov r10, qword [rax]
add r10, r15
mov qword [rax], r10
add r12, 4
jmp 0x1400099ad
sub rsp, 0x28
movabs r14, 0x6c8f
mov r12d, 0x2eea
add r12, 0x94213
add r12, r14
add r12, r11
push r12
dec r10
lea r15d, [eax]
jmp 0x140009970

Function at 0x140009efc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140009f48
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140009f40
cmp dword [rcx + 0x3c], edx
jl 0x140009f40
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140009f40
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140009f48
mov rax, rdx
add rsp, 0x18
ret
Function at 0x180025c93
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xea067fa4
pushf
not eax
add eax, 0xf08be3ab
xor eax, 0xb07fcf3d
rol eax, 0x1e
popf
pushf
not eax
add eax, 0xa034a45e
xor eax, 0xb275f98f
rol eax, 0x82
popf
cmp eax, 2
jne 0x180025cd0
popf
pop rax
jmp 0x180025dc1
cmp eax, 0
jne 0x180025cdf
popf
pop rax
jmp 0x180025cee
cmp eax, 1
jne 0x180025cee
popf
pop rax
jmp 0x180025da5
lea rax, [rcx + 4]
mov r11d, 0xedadfae
pushf
not r11d
add r11d, 0x9be2a29e
xor r11d, 0xc6a191e8
rol r11d, 0xc8
popf
pushf
not r11d
add r11d, 0xaed88dca
xor r11d, 0xf80ebd29
rol r11d, 0x62
popf
pushf
not r11d
add r11d, 0xc36f4926
xor r11d, 0x9d120b2a
rol r11d, 0xb1
popf
pushf
not r11d
add r11d, 0x80710060
xor r11d, 0xf297c7bf
rol r11d, 0xe6
popf
mov r10, rax
push rax
pushf
mov eax, 0x6f05d399
pushf
not eax
add eax, 0xd3270ecf
xor eax, 0xb4763ce0
rol eax, 0xf9
popf
pushf
not eax
add eax, 0x8890701c
xor eax, 0x84786a25
rol eax, 0x78
popf
pushf
not eax
add eax, 0xc62be6ea
xor eax, 0x9cd30f41
rol eax, 0xd2
popf
jmp 0x180025cc1
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x180025da5
mov byte [rcx + 0xf], r11b
ret
Function at 0x180027014
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x4f8bc295
pushf
not eax
add eax, 0x9bdb8af2
xor eax, 0x847104d2
rol eax, 0x28
popf
pushf
not eax
add eax, 0xda608eec
xor eax, 0x8a23bdf6
rol eax, 0x10
popf
pushf
not eax
add eax, 0x88e91a80
xor eax, 0xaf0a7d8b
rol eax, 0x93
popf
pushf
not eax
add eax, 0x86876134
xor eax, 0xdc6c4040
rol eax, 0x58
popf
cmp eax, 2
jne 0x180027077
popf
pop rax
jmp 0x180027162
cmp eax, 0
jne 0x180027086
popf
pop rax
jmp 0x180027095
cmp eax, 1
jne 0x180027095
popf
pop rax
jmp 0x180027146
lea rax, [rcx + 4]
mov r11d, 0x30d98014
pushf
not r11d
add r11d, 0x952c959b
xor r11d, 0xd27e888f
rol r11d, 0xe4
popf
pushf
not r11d
add r11d, 0xdc5e9d77
xor r11d, 0xe42769a0
rol r11d, 0xd7
popf
pushf
not r11d
add r11d, 0xee380a93
xor r11d, 0xb06938c3
rol r11d, 0x84
popf
mov r10, rax
push rax
pushf
mov eax, 0xdff7d274
pushf
not eax
add eax, 0xae38e8cc
xor eax, 0xe57720ec
rol eax, 0x1b
popf
pushf
not eax
add eax, 0xbdc0dcb2
xor eax, 0xb3ff50ec
rol eax, 0x7e
popf
pushf
not eax
add eax, 0xf4c298bf
xor eax, 0xce428d4b
rol eax, 0xbe
popf
pushf
not eax
add eax, 0xfb626acf
xor eax, 0xb73aacf0
rol eax, 0xdf
popf
jmp 0x180027068
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x180027146
mov byte [rcx + 0x3c], r11b
ret

Function at 0x180027167
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xd9c24eb2
pushf
not eax
add eax, 0xb9f2544b
xor eax, 0xf277afa7
rol eax, 1
popf
pushf
not eax
add eax, 0xb9d60630
xor eax, 0xb4d36644
rol eax, 0x9a
popf
pushf
not eax
add eax, 0xcfeeaaaf
xor eax, 0xfb68534f
rol eax, 0x1d
popf
cmp eax, 2
jne 0x1800271b6
popf
pop rax
jmp 0x180027229
cmp eax, 0
jne 0x1800271c5
popf
pop rax
jmp 0x1800271d4
cmp eax, 1
jne 0x1800271d4
popf
pop rax
jmp 0x18002720e
xor r9d, r9d
lea rax, [rcx + 4]
push rax
pushf
mov eax, 0x70c747b0
pushf
not eax
add eax, 0xdc2a3bd1
xor eax, 0xc1763a04
rol eax, 0x88
popf
pushf
not eax
add eax, 0xc25999ee
xor eax, 0xad8bf543
rol eax, 0x31
popf
jmp 0x1800271a7
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x38
jb 0x18002720e
mov byte [rcx + 0x3c], 0
ret
Function at 0x180027ef4
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xe92468f
pushf
not eax
add eax, 0xf706e60b
xor eax, 0xfa477607
rol eax, 0x63
popf
pushf
not eax
add eax, 0xfa9b35e9
xor eax, 0x86f3b72a
rol eax, 0xc6
popf
pushf
not eax
add eax, 0xa192f828
xor eax, 0x9917bcb4
rol eax, 0xb2
popf
pushf
not eax
add eax, 0xfc8b5a16
xor eax, 0xad294065
rol eax, 0x7c
popf
cmp eax, 2
jne 0x180027f57
popf
pop rax
jmp 0x180028035
cmp eax, 0
jne 0x180027f66
popf
pop rax
jmp 0x180027f75
cmp eax, 1
jne 0x180027f75
popf
pop rax
jmp 0x180028019
lea rax, [rcx + 4]
mov r11d, 0x97f67bd4
pushf
not r11d
add r11d, 0x96ae67f8
xor r11d, 0xe97a1675
rol r11d, 0xa2
popf
pushf
not r11d
add r11d, 0xdfc634a2
xor r11d, 0xee9a9d75
rol r11d, 0xe
popf
pushf
not r11d
add r11d, 0x854b889c
xor r11d, 0xc8341c6c
rol r11d, 0x4a
popf
pushf
not r11d
add r11d, 0xc789e4b3
xor r11d, 0xa5c3fa85
rol r11d, 0x40
popf
mov r10, rax
push rax
pushf
mov eax, 0x3b3117d2
pushf
not eax
add eax, 0xe75dfa78
xor eax, 0xba5c9657
rol eax, 0xe5
popf
pushf
not eax
add eax, 0xcd02a714
xor eax, 0xfef008d1
rol eax, 0xce
popf
jmp 0x180027f48
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x180028019
mov byte [rcx + 0x15], r11b
ret
Function at 0x180030592
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x3f1ea88c
pushf
not eax
add eax, 0xb24db49c
xor eax, 0xecdd6c2f
rol eax, 0x8a
popf
pushf
not eax
add eax, 0xa6d63112
xor eax, 0xde5f8de3
rol eax, 0x7c
popf
pushf
not eax
add eax, 0xe9bedca8
xor eax, 0xd98e3a70
rol eax, 0x72
popf
cmp eax, 2
jne 0x1800305e2
popf
pop rax
jmp 0x18003067b
cmp eax, 0
jne 0x1800305f1
popf
pop rax
jmp 0x180030600
cmp eax, 1
jne 0x180030600
popf
pop rax
jmp 0x180030660
xor r9d, r9d
lea rax, [rcx + 4]
push rax
pushf
mov eax, 0xe33c1860
pushf
not eax
add eax, 0xc893ea20
xor eax, 0xae007f12
rol eax, 0xa7
popf
pushf
not eax
add eax, 0xddb9a636
xor eax, 0xaf23d62f
rol eax, 0x9e
popf
pushf
not eax
add eax, 0x8ec16add
xor eax, 0xf90975d5
rol eax, 0xed
popf
pushf
not eax
add eax, 0xdf39db86
xor eax, 0xd102cfc6
rol eax, 0x3e
popf
jmp 0x1800305d3
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 8
jb 0x180030660
mov byte [rcx + 0xc], 0
ret

Function at 0x180030840
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rax
pushf
mov eax, 0xad544d55
pushf
not eax
add eax, 0xef2d50f9
xor eax, 0x9217b1f4
rol eax, 0x60
popf
pushf
not eax
add eax, 0xc6c6e65f
xor eax, 0xae831112
rol eax, 0xca
popf
pushf
not eax
add eax, 0xb099f837
xor eax, 0xc405a2c5
rol eax, 0xad
popf

Function at 0x18003296e
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xa3b99d04
pushf
not eax
add eax, 0xea7aeacf
xor eax, 0xe7ef2a52
rol eax, 0xdc
popf
pushf
not eax
add eax, 0xaa66c494
xor eax, 0xa56cab5f
rol eax, 0x9f
popf
pushf
not eax
add eax, 0xac5e5370
xor eax, 0xe9be98cd
rol eax, 0x2e
popf
cmp eax, 2
jne 0x1800329be
popf
pop rax
jmp 0x180032aaf
cmp eax, 0
jne 0x1800329cd
popf
pop rax
jmp 0x1800329dc
cmp eax, 1
jne 0x1800329dc
popf
pop rax
jmp 0x180032a93
lea rax, [rcx + 4]
mov r11d, 0x32152e8c
pushf
not r11d
add r11d, 0x99cb4a4d
xor r11d, 0x9bf807c2
rol r11d, 0x17
popf
pushf
not r11d
add r11d, 0xb5d5963b
xor r11d, 0xff6d5830
rol r11d, 0x88
popf
pushf
not r11d
add r11d, 0xe00a2761
xor r11d, 0x93ceb783
rol r11d, 0x45
popf
pushf
not r11d
add r11d, 0x877754e7
xor r11d, 0xc3bf6220
rol r11d, 0x34
popf
mov r10, rax
push rax
pushf
mov eax, 0x63ee8213
pushf
not eax
add eax, 0xbbe62fce
xor eax, 0x8ff5e85f
rol eax, 0xd6
popf
pushf
not eax
add eax, 0xd6630655
xor eax, 0x8ac01252
rol eax, 0x3c
popf
pushf
not eax
add eax, 0xcf0d7629
xor eax, 0xb1a2a4af
rol eax, 0xd
popf
jmp 0x1800329af
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x180032a93
mov byte [rcx + 0xe], r11b
ret
Function at 0x1800351a1
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xdac7d231
pushf
not eax
add eax, 0xc2a7bd1a
xor eax, 0xdb5c0111
rol eax, 0x4c
popf
pushf
not eax
add eax, 0xf1597080
xor eax, 0xdf40ab34
rol eax, 0x76
popf
pushf
not eax
add eax, 0xb3342ca7
xor eax, 0xd258b649
rol eax, 0x11
popf
cmp eax, 2
jne 0x1800351f1
popf
pop rax
jmp 0x180035264
cmp eax, 0
jne 0x180035200
popf
pop rax
jmp 0x18003520f
cmp eax, 1
jne 0x18003520f
popf
pop rax
jmp 0x180035249
xor r9d, r9d
lea rax, [rcx + 4]
push rax
pushf
mov eax, 0x13744509
pushf
not eax
add eax, 0xf582f54e
xor eax, 0xed2ca1cf
rol eax, 0x5e
popf
pushf
not eax
add eax, 0xbd07e643
xor eax, 0xf92f61e0
rol eax, 0x4c
popf
jmp 0x1800351e2
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x2e
jb 0x180035249
mov byte [rcx + 0x32], 0
ret
Function at 0x180036705
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x7042ec40
pushf
not eax
add eax, 0xd83a42f8
xor eax, 0xa505598f
rol eax, 0x93
popf
pushf
not eax
add eax, 0xa13d2a3f
xor eax, 0xe55c276e
rol eax, 0x12
popf
pushf
not eax
add eax, 0xc7422126
xor eax, 0xe20e4235
rol eax, 0x25
popf
pushf
not eax
add eax, 0xedfde03d
xor eax, 0xa7d296ba
rol eax, 0x4f
popf
cmp eax, 2
jne 0x180036768
popf
pop rax
jmp 0x1800367ee
cmp eax, 0
jne 0x180036777
popf
pop rax
jmp 0x180036786
cmp eax, 1
jne 0x180036786
popf
pop rax
jmp 0x1800367d3
xor r9d, r9d
lea rax, [rcx + 4]
push rax
pushf
mov eax, 0x799d2626
pushf
not eax
add eax, 0xd9a583fd
xor eax, 0xe55472ed
rol eax, 0xda
popf
pushf
not eax
add eax, 0xeccff2ca
xor eax, 0xca475030
rol eax, 0xa6
popf
pushf
not eax
add eax, 0xf25b6d52
xor eax, 0xb2e6de84
rol eax, 0xd9
popf
jmp 0x180036759
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x26
jb 0x1800367d3
mov byte [rcx + 0x2a], 0
ret
Function at 0x18003ca47
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x6a96fc1a
pushf
not eax
add eax, 0xadc12b57
xor eax, 0x9f5a2c57
rol eax, 0x21
popf
pushf
not eax
add eax, 0xc056adc7
xor eax, 0xfafae536
rol eax, 0xc8
popf
pushf
not eax
add eax, 0xf73ba714
xor eax, 0x9c699b93
rol eax, 0xeb
popf
pushf
not eax
add eax, 0xa74fa46c
xor eax, 0xb49b74b7
rol eax, 0xf0
popf
cmp eax, 2
jne 0x18003caaa
popf
pop rax
jmp 0x18003cb1d
cmp eax, 0
jne 0x18003cab9
popf
pop rax
jmp 0x18003cac8
cmp eax, 1
jne 0x18003cac8
popf
pop rax
jmp 0x18003cb02
xor r9d, r9d
lea rax, [rcx + 4]
push rax
pushf
mov eax, 0x4cff0e19
pushf
not eax
add eax, 0x829f59cd
xor eax, 0xf38d44cf
rol eax, 0x30
popf
pushf
not eax
add eax, 0x9c3c9376
xor eax, 0x8cbfcd49
rol eax, 0xe0
popf
jmp 0x18003ca9b
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xb
jb 0x18003cb02
mov byte [rcx + 0xf], 0
ret

Function at 0x18003d767
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x1ea6813a
pushf
not eax
add eax, 0xdf4df63d
xor eax, 0xdf4c7f57
rol eax, 0xf6
popf
pushf
not eax
add eax, 0x8d1d4ea8
xor eax, 0xf7d553e5
rol eax, 0x6f
popf
cmp eax, 2
jne 0x18003d7a4
popf
pop rax
jmp 0x18003d8a8
cmp eax, 0
jne 0x18003d7b3
popf
pop rax
jmp 0x18003d7c2
cmp eax, 1
jne 0x18003d7c2
popf
pop rax
jmp 0x18003d88c
lea rax, [rcx + 4]
mov r11d, 0x2bb61c0
pushf
not r11d
add r11d, 0xd64a40ad
xor r11d, 0x8d8a0b25
rol r11d, 0xb
popf
pushf
not r11d
add r11d, 0xd690d9ac
xor r11d, 0xb79816ea
rol r11d, 0x10
popf
pushf
not r11d
add r11d, 0xe163bebd
xor r11d, 0xec4f8935
rol r11d, 0x69
popf
pushf
not r11d
add r11d, 0x84e263cf
xor r11d, 0xca836a44
rol r11d, 0x3a
popf
mov r10, rax
push rax
pushf
mov eax, 0x22069e35
pushf
not eax
add eax, 0x8432a2ff
xor eax, 0xc178cd35
rol eax, 0x3d
popf
pushf
not eax
add eax, 0xc87b1329
xor eax, 0xf9a7ea8e
rol eax, 0xaf
popf
pushf
not eax
add eax, 0xf5704b25
xor eax, 0xcca2c192
rol eax, 0xe3
popf
pushf
not eax
add eax, 0xc3b04429
xor eax, 0x8abb154b
rol eax, 0x5f
popf
jmp 0x18003d795
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x18003d88c
mov byte [rcx + 0x7f], r11b
ret