joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e1930
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp 0x1400e1980
mov rax, rsp
mov dword [rax + 0x20], r9d
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov r15d, r9d
mov rbx, r8
xor r9d, r9d
mov r8, rdx
lea rdx, [0x1401404d8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x1400e1b60
xor esi, esi
mov dword [rbp - 0x10], esi
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp - 8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x1401404e0]
call fcn.140109e10
mov qword [rbp - 0x30], rax
mov rcx, rax
call fcn.14010ade0
mov qword [rbp - 0x28], rax
lea r8, [0x1400e1940]
lea rdx, [rbp - 0x10]
mov rcx, qword [rbp - 0x30]
call fcn.1401102f0
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
call fcn.14010a580
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
call fcn.140110370
movzx ecx, al
sub ecx, 2
je 0x1400e1a61
dec ecx
jne 0x1400e1a75
mov rcx, qword [rbp - 0x30]
call fcn.14010fcf0
lea r8d, [rsi + 0x10]
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
call fcn.1401103c0
test eax, eax
jne 0x1400e1a75
mov r8d, 1
mov edx, 0xff
mov rcx, qword [rbp - 0x30]
call fcn.140110200
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
call fcn.14010ad40
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
call fcn.1401103b0
mov r13d, eax
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
call fcn.140110390
mov r12d, eax
mov edi, eax
mov eax, 8
mul r12
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400e2f98
mov r14, rax
test r12d, r12d
je 0x1400e1aed
lea r15d, [r13*4]
mov rbx, rax
mov esi, r12d
mov rcx, r15
call fcn.1400e2f98
mov qword [rbx], rax
lea rbx, [rbx + 8]
dec rsi
jne 0x1400e1ad5
mov r15d, dword [rbp + 0x48]
mov rdx, r14
mov rcx, qword [rbp - 0x30]
call fcn.14010a4f0
mov ecx, SafeArrayAllocDescriptor
call fcn.1400e3e80
mov qword [rbp - 0x18], rax
test rax, rax
je 0x1400e1b2c
mov ecx, dword [rbp + 0x50]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], r15d
mov r9d, r12d
mov r8d, r13d
mov rdx, r14
mov rcx, rax
call fcn.1400e2090
mov rsi, rax
test r12d, r12d
je 0x1400e1b45
mov rbx, r14
mov rcx, qword [rbx]
call fcn.1400e64f8
lea rbx, [rbx + 8]
dec rdi
jne 0x1400e1b34
mov rcx, r14
call fcn.1400e64f8
xor r8d, r8d
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14010a090
mov rax, rsi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400e1980
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, dx
jmp 0x1400e1980
mov rax, rsp
mov dword [rax + 0x20], r9d
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov r15d, r9d
mov rbx, r8
xor r9d, r9d
mov r8, rdx
lea rdx, [0x1401404d8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x1400e1b60
xor esi, esi
mov dword [rbp - 0x10], esi
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov qword [rbp - 8], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [0x1401404e0]
call fcn.140109e10
mov qword [rbp - 0x30], rax
mov rcx, rax
call fcn.14010ade0
mov qword [rbp - 0x28], rax
lea r8, [0x1400e1940]
lea rdx, [rbp - 0x10]
mov rcx, qword [rbp - 0x30]
call fcn.1401102f0
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
call fcn.14010a580
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
call fcn.140110370
movzx ecx, al
sub ecx, 2
je 0x1400e1a61
dec ecx
jne 0x1400e1a75
mov rcx, qword [rbp - 0x30]
call fcn.14010fcf0
lea r8d, [rsi + 0x10]
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
call fcn.1401103c0
test eax, eax
jne 0x1400e1a75
mov r8d, 1
mov edx, 0xff
mov rcx, qword [rbp - 0x30]
call fcn.140110200
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
call fcn.14010ad40
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
call fcn.1401103b0
mov r13d, eax
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x30]
call fcn.140110390
mov r12d, eax
mov edi, eax
mov eax, 8
mul r12
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400e2f98
mov r14, rax
test r12d, r12d
je 0x1400e1aed
lea r15d, [r13*4]
mov rbx, rax
mov esi, r12d
mov rcx, r15
call fcn.1400e2f98
mov qword [rbx], rax
lea rbx, [rbx + 8]
dec rsi
jne 0x1400e1ad5
mov r15d, dword [rbp + 0x48]
mov rdx, r14
mov rcx, qword [rbp - 0x30]
call fcn.14010a4f0
mov ecx, SafeArrayAllocDescriptor
call fcn.1400e3e80
mov qword [rbp - 0x18], rax
test rax, rax
je 0x1400e1b2c
mov ecx, dword [rbp + 0x50]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], r15d
mov r9d, r12d
mov r8d, r13d
mov rdx, r14
mov rcx, rax
call fcn.1400e2090
mov rsi, rax
test r12d, r12d
je 0x1400e1b45
mov rbx, r14
mov rcx, qword [rbx]
call fcn.1400e64f8
lea rbx, [rbx + 8]
dec rdi
jne 0x1400e1b34
mov rcx, r14
call fcn.1400e64f8
xor r8d, r8d
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14010a090
mov rax, rsi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret

Function at 0x1400ed714
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400ed72a
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400ed72c
xor eax, eax
test eax, eax
je 0x1400ed73c
mov ecx, eax
call fcn.1400ed4ec
or eax, 0xffffffff
jmp 0x1400ed73e
xor eax, eax
add rsp, 0x28
ret
Function at 0x140115d30
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r10d, r8d
mov r9, rdx
test rdx, rdx
jne 0x140115d46
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rbx
not ecx
lea rbx, [0x14014e1b0]
cmp r10d, 8
jb 0x140115e37
mov r11, r10
shr r11, 3
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
shr ecx, 8
xor rdx, rax
add r9, 8
add r10d, 0xfffffff8
movzx eax, dl
mov edx, dword [rbx + rax*4]
xor edx, ecx
movzx ecx, byte [r9 - 7]
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 6]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 5]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 4]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 3]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 2]
mov r8d, dword [rbx + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r9 - 1]
mov edx, dword [rbx + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [rbx + rax*4]
xor ecx, edx
dec r11
jne 0x140115d70
test r10d, r10d
je 0x140115e5f
nop dword [rax]
movzx edx, byte [r9]
mov eax, ecx
lea r9, [r9 + 1]
xor rdx, rax
shr eax, 8
movzx r8d, dl
mov ecx, dword [rbx + r8*4]
xor ecx, eax
dec r10d
jne 0x140115e40
mov rbx, qword [rsp]
not ecx
mov eax, ecx
add rsp, 8
ret
Function at 0x140fd8058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140fd81df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140fd8089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140fd806f
add dl, dl
jne 0x140fd8096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140fd80f6
xor eax, eax
add dl, dl
jne 0x140fd80a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140fd81ad
add dl, dl
jne 0x140fd80b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140fd80c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140fd80d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140fd80dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140fd80ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140fd807e
mov eax, 1
add dl, dl
jne 0x140fd8106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140fd8113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140fd80fb
sub eax, ebx
mov ebx, 1
jne 0x140fd814c
mov ecx, 1
add dl, dl
jne 0x140fd812e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140fd813b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140fd8123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140fd807e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140fd8168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140fd8175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140fd815d
cmp eax, 0x7d00
jae 0x140fd819b
cmp eax, 0x500
jb 0x140fd8196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140fd807e
cmp eax, 0x7f
ja 0x140fd819e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140fd807e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140fd81d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140fd807e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x151a920
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x151a92d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x151a93d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x151a925
lea eax, [rcx + 1]
jmp 0x151a94b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x151a95e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x151a944
sub eax, 3
jb 0x151a97e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x151a9cd
sar eax, 1
movsxd rbp, eax
jb 0x151a9b4
jmp 0x151a98c
add ebx, ebx
jne 0x151a98a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x151a9b4
inc ecx
add ebx, ebx
jne 0x151a99a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x151a9b4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x151a9ad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x151a99c
add ecx, 2
jmp 0x151a9b9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.0151a8e2
jmp 0x151a92d
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x1103000]
mov eax, dword [rdi]
or eax, eax
je 0x151aa29
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x111a000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x151a9d9
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x151aa23
mov qword [rbx], rax
add rbx, 8
jmp 0x151a9f9
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x151aa6d
cmp al, 0xef
ja 0x151aa55
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x151aa35
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x151aa44
mov eax, dword [rdi]
add rdi, 4
jmp 0x151aa44
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x151aac1
sub rsp, 0xffffffffffffff80
jmp 0x473fa0
Function at 0x1400014b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x72]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x140011040]
mov r10, rax
sub rbx, rax
movabs rdi, 0x83c977ab2bedd28f
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 2]
mov rax, rdi
mov rcx, r8
mul r8
mov rax, r8
add r11d, 2
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0x7a
jb 0x140001500
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001590
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x140011040]
mov r10, rax
sub rbx, rax
movabs rdi, 0x83c977ab2bedd28f
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
mov rax, rcx
lea r9, [r9 + 0xb]
sub rax, rdx
add r11d, 0xb
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 - 6]
mov byte [r9 - 6], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xb
jb 0x1400015e0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400018c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 6]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x1400111a0]
mov r10, rax
sub rbx, rax
movabs rdi, 0x83c977ab2bedd28f
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 2]
mov rax, rdi
mov rcx, r8
mul r8
mov rax, r8
add r11d, 2
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 2
jb 0x140001910
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140002000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x140011460]
mov r10, rax
sub rbx, rax
movabs rdi, 0x83c977ab2bedd28f
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [r9 + rbx - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [r9 + rbx + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [r9 + rbx + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [r9 + rbx + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [r9 + rbx + 8]
lea r9, [r9 + 0xe]
movsx eax, al
add r11d, 7
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [r9 + rbx - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 7
jb 0x140002050
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400021f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x140011460]
mov r10, rax
sub rbx, rax
movabs rdi, 0x83c977ab2bedd28f
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 8]
lea r9, [r9 + 0x10]
movsx eax, al
add r11d, 8
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 8
jb 0x140002240
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140002410
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x140011460]
mov r10, rax
sub rbx, rax
movabs rdi, 0x83c977ab2bedd28f
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 0xa]
mov rax, rdi
mov rcx, r8
mul r8
mov rax, r8
add r11d, 5
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 0xc]
movsx eax, al
mov word [r9 - 0xc], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 0xa]
movsx eax, al
mov word [r9 - 0xa], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x152
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 5
jb 0x140002460
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret