joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400019a8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9b, byte [rcx]
mov eax, r8d
mov r11, rcx
xor r9b, dl
lea r10, [rcx + 2]
xor r9b, 0x38
cmp r9b, 2
jne 0x1400019cc
mov rax, r10
jmp 0x140001a17
test r9b, r9b
jne 0x140001a15
mov r8d, edx
mov r9, r10
xor r8d, 0xc23aa738
test eax, eax
jle 0x140001a0d
mov rbx, rax
movzx eax, byte [r9]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r9], cl
inc r9
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec rbx
jne 0x1400019e5
xor dl, 0x3a
mov byte [r11], dl
jmp 0x1400019c7
xor eax, eax
mov rbx, qword [rsp + 8]
ret

Function at 0x140001a20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9b, byte [rcx]
mov eax, r8d
mov r11, rcx
xor r9b, dl
lea r10, [rcx + 2]
xor r9b, 0xa0
cmp r9b, 2
jne 0x140001a44
mov rax, r10
jmp 0x140001a8f
test r9b, r9b
jne 0x140001a8d
mov r8d, edx
mov r9, r10
xor r8d, 0x84cdbfa0
test eax, eax
jle 0x140001a85
mov rbx, rax
movzx eax, byte [r9]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r9], cl
inc r9
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec rbx
jne 0x140001a5d
xor dl, 0xa2
mov byte [r11], dl
jmp 0x140001a3f
xor eax, eax
mov rbx, qword [rsp + 8]
ret

Function at 0x140001a98
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x140142890]
xor rbx, r9
mov r11d, edx
mov ecx, 0x12f1bad5
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0xb1509f99
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xd5
cmp al, 2
je 0x140001b17
test al, al
jne 0x140001b15
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001b0c
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001ae4
xor r9b, 0xd7
mov byte [rbx], r9b
jmp 0x140001b17
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140001b20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x140142be0]
xor rbx, r9
mov r11d, edx
mov ecx, 0x38bffc0
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x3c26ffc1
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xc0
cmp al, 2
je 0x140001b9f
test al, al
jne 0x140001b9d
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001b94
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001b6c
xor r9b, 0xc2
mov byte [rbx], r9b
jmp 0x140001b9f
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret
Function at 0x140001ba8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x140142c30]
xor rbx, r9
mov r11d, edx
mov ecx, 0xaa6d58a6
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0xcc052cd7
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xa6
cmp al, 2
je 0x140001c27
test al, al
jne 0x140001c25
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001c1c
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001bf4
xor r9b, 0xa4
mov byte [rbx], r9b
jmp 0x140001c27
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140001c30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x140142dc0]
xor rbx, r9
mov r11d, edx
mov ecx, 0xca6b3217
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0xc1b3d83e
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x17
cmp al, 2
je 0x140001caf
test al, al
jne 0x140001cad
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001ca4
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001c7c
xor r9b, 0x15
mov byte [rbx], r9b
jmp 0x140001caf
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140001cb8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x140152dd0]
xor rbx, r9
mov r11d, edx
mov ecx, 0x220211dc
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x3e199b75
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xdc
cmp al, 2
je 0x140001d37
test al, al
jne 0x140001d35
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001d2c
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001d04
xor r9b, 0xde
mov byte [rbx], r9b
jmp 0x140001d37
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140001d40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x140152e30]
xor rbx, r9
mov r11d, edx
mov ecx, 0x74e74e3a
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x7eff3073
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x3a
cmp al, 2
je 0x140001dbf
test al, al
jne 0x140001dbd
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001db4
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001d8c
xor r9b, 0x38
mov byte [rbx], r9b
jmp 0x140001dbf
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret
Function at 0x140001dc8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x1401532c0]
xor rbx, r9
mov r11d, edx
mov ecx, 0x57f495eb
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x3a7d2de5
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xeb
cmp al, 2
je 0x140001e47
test al, al
jne 0x140001e45
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001e3c
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001e14
xor r9b, 0xe9
mov byte [rbx], r9b
jmp 0x140001e47
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140001ec8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, ecx
mov r9d, edx
mov eax, edx
xor rcx, rax
xor r9d, r8d
lea rax, [0x140153aa0]
xor r9d, 0xe2e5edb2
xor rcx, 0x576f624e
lea r8d, [r9 + r9]
add rcx, rax
jmp fcn.140001e50

Function at 0x140001ef8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x140153dd0]
xor rbx, r9
mov r11d, edx
mov ecx, 0x740978ba
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x7eb386ce
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xba
cmp al, 2
je 0x140001f77
test al, al
jne 0x140001f75
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001f6c
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001f44
xor r9b, 0xb8
mov byte [rbx], r9b
jmp 0x140001f77
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140001f80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9b, byte [rcx]
mov eax, r8d
mov r11, rcx
xor r9b, dl
lea r10, [rcx + 2]
xor r9b, 0x63
cmp r9b, 2
jne 0x140001fa4
mov rax, r10
jmp 0x140001fef
test r9b, r9b
jne 0x140001fed
mov r8d, edx
mov r9, r10
xor r8d, 0xd040f063
test eax, eax
jle 0x140001fe5
mov rbx, rax
movzx eax, byte [r9]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r9], cl
inc r9
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec rbx
jne 0x140001fbd
xor dl, 0x61
mov byte [r11], dl
jmp 0x140001f9f
xor eax, eax
mov rbx, qword [rsp + 8]
ret

Function at 0x140001ff8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x140157690]
xor rbx, r9
mov r11d, edx
mov ecx, 0xe48fa552
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x8c830fac
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x52
cmp al, 2
je 0x140002077
test al, al
jne 0x140002075
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x14000206c
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140002044
xor r9b, 0x50
mov byte [rbx], r9b
jmp 0x140002077
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret
Function at 0x140002080
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x140157970]
xor rbx, r9
mov r11d, edx
mov ecx, 0xa7cfa70
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x8d904355
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x70
cmp al, 2
je 0x1400020ff
test al, al
jne 0x1400020fd
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x1400020f4
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x1400020cc
xor r9b, 0x72
mov byte [rbx], r9b
jmp 0x1400020ff
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140002108
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9b, byte [rcx]
mov eax, r8d
mov r11, rcx
xor r9b, dl
lea r10, [rcx + 2]
xor r9b, 0xd1
cmp r9b, 2
jne 0x14000212c
mov rax, r10
jmp 0x140002177
test r9b, r9b
jne 0x140002175
mov r8d, edx
mov r9, r10
xor r8d, 0x345f63d1
test eax, eax
jle 0x14000216d
mov rbx, rax
movzx eax, byte [r9]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r9], cl
inc r9
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec rbx
jne 0x140002145
xor dl, 0xd3
mov byte [r11], dl
jmp 0x140002127
xor eax, eax
mov rbx, qword [rsp + 8]
ret

Function at 0x1400021b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x14015b810]
xor rbx, r9
mov r11d, edx
mov ecx, 0xb55e5c91
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x86ae065d
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x91
cmp al, 2
je 0x14000222f
test al, al
jne 0x14000222d
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140002224
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x1400021fc
xor r9b, 0x93
mov byte [rbx], r9b
jmp 0x14000222f
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140002238
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov r10d, ecx
lea rax, [0x14015ba50]
xor r10, r9
mov ecx, 0x44bdfe37
mov r11d, r8d
xor r10, rcx
add r10, rax
mov al, byte [r10]
xor al, dl
lea rdx, [r10 + 2]
xor al, 0x37
cmp al, 2
je 0x1400022bc
test al, al
jne 0x1400022ba
mov eax, r9d
mov r8d, r9d
xor eax, r11d
xor r8d, ecx
add eax, eax
movsxd r11, eax
xor r11, 0xfffffffface06378
jle 0x1400022b1
mov rbx, rdx
movzx eax, byte [rbx]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [rbx], cl
inc rbx
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x14000228b
xor r9b, 0x35
mov byte [r10], r9b
jmp 0x1400022bc
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret
Function at 0x1400022c8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x14015bd98]
xor rbx, r9
mov r11d, edx
mov ecx, 0x99d4974d
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x36ffe89e
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x4d
cmp al, 2
je 0x140002347
test al, al
jne 0x140002345
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x14000233c
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140002314
xor r9b, 0x4f
mov byte [rbx], r9b
jmp 0x140002347
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140002350
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x14015bdd0]
xor rbx, r9
mov r11d, edx
mov ecx, 0x409dd7df
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0xd0e4ea85
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xdf
cmp al, 2
je 0x1400023cf
test al, al
jne 0x1400023cd
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x1400023c4
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x14000239c
xor r9b, 0xdd
mov byte [rbx], r9b
jmp 0x1400023cf
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x1400023d8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9b, byte [rcx]
mov eax, r8d
mov r11, rcx
xor r9b, dl
lea r10, [rcx + 2]
xor r9b, 0x7a
cmp r9b, 2
jne 0x1400023fc
mov rax, r10
jmp 0x140002447
test r9b, r9b
jne 0x140002445
mov r8d, edx
mov r9, r10
xor r8d, 0xbf8d5e7a
test eax, eax
jle 0x14000243d
mov rbx, rax
movzx eax, byte [r9]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r9], cl
inc r9
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec rbx
jne 0x140002415
xor dl, 0x78
mov byte [r11], dl
jmp 0x1400023f7
xor eax, eax
mov rbx, qword [rsp + 8]
ret

Function at 0x140002450
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov r10d, ecx
lea rax, [0x14015be40]
xor r10, r9
mov ecx, 0x8fe9858
mov r11d, r8d
xor r10, rcx
add r10, rax
mov al, byte [r10]
xor al, dl
lea rdx, [r10 + 2]
xor al, 0x58
cmp al, 2
je 0x1400024d4
test al, al
jne 0x1400024d2
mov eax, r9d
mov r8d, r9d
xor eax, r11d
xor r8d, ecx
add eax, eax
movsxd r11, eax
xor r11, 0xfffffffff8a38b92
jle 0x1400024c9
mov rbx, rdx
movzx eax, byte [rbx]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [rbx], cl
inc rbx
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x1400024a3
xor r9b, 0x5a
mov byte [r10], r9b
jmp 0x1400024d4
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret
Function at 0x1400024e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x14015c188]
xor rbx, r9
mov r11d, edx
mov ecx, 0xd8e96c5d
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x69eeba49
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x5d
cmp al, 2
je 0x14000255f
test al, al
jne 0x14000255d
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140002554
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x14000252c
xor r9b, 0x5f
mov byte [rbx], r9b
jmp 0x14000255f
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140002568
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x14015c1b0]
xor rbx, r9
mov r11d, edx
mov ecx, 0xb367796a
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0xf1f2c330
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x6a
cmp al, 2
je 0x1400025e7
test al, al
jne 0x1400025e5
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x1400025dc
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x1400025b4
xor r9b, 0x68
mov byte [rbx], r9b
jmp 0x1400025e7
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x1400025f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x14015c6a0]
xor rbx, r9
mov r11d, edx
mov ecx, 0x288043a6
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x74dbd4f8
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xa6
cmp al, 2
je 0x14000266f
test al, al
jne 0x14000266d
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140002664
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x14000263c
xor r9b, 0xa4
mov byte [rbx], r9b
jmp 0x14000266f
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140002678
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x14015ec20]
xor rbx, r9
mov r11d, edx
mov ecx, 0xfb9648db
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x55467b4b
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xdb
cmp al, 2
je 0x1400026f7
test al, al
jne 0x1400026f5
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x1400026ec
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x1400026c4
xor r9b, 0xd9
mov byte [rbx], r9b
jmp 0x1400026f7
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret
Function at 0x1400047cc
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor ebx, ebx
test eax, eax
jne 0x140004804
xor eax, eax
jmp 0x140004863
lea r8, [rsp + 0x3c]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140004800
lea ecx, [rax + 0x12]
xor edx, edx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
setne bl
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400e7da0
add rsp, 0x50
pop rbx
ret

Function at 0x140004878
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x360
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov rbx, rcx
lea rcx, [0x140163efa]
mov edx, 0x62ff41f0
mov r8d, 0x18
call section..text
lea rdx, [rsp + 0x30]
sub rdx, rax
mov cl, byte [rax]
mov byte [rdx + rax], cl
inc rax
test cl, cl
jne 0x1400048b5
or rdx, 0xffffffffffffffff
test rbx, rbx
je 0x1400048f5
lea rcx, [rsp + 0x30]
mov rax, rdx
inc rax
cmp byte [rcx + rax], 0
jne 0x1400048d2
lea rcx, [rsp + 0x30]
add rcx, rax
mov byte [rcx], 0x2f
sub rcx, rbx
mov al, byte [rbx]
inc rbx
mov byte [rcx + rbx], al
test al, al
jne 0x1400048e9
lea rax, [rsp + 0x140]
mov r9d, edx
lea r8, [rsp + 0x30]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [rsp + 0x140]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 5
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.1400e7da0
add rsp, 0x360
pop rbx
ret

Function at 0x140004960
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x28]
xor edx, edx
mov r8d, 0x10c
mov qword [rsp + 0x20], 0x114
xor edi, edi
call fcn.1400ea570
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
jae 0x1400049f1
mov rbx, qword [0x140174658]
mov rax, qword [rbx + 8]
sub rax, qword [rbx]
sar rax, 3
test rax, rax
je 0x1400049e5
mov rcx, qword [rbx]
mov rcx, qword [rcx + rdi*8]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, qword [rbx + 8]
inc rdi
sub rax, qword [rbx]
sar rax, 3
cmp rdi, rax
jb 0x1400049c5
mov rax, qword [rbx]
mov qword [rbx + 8], rax
call fcn.14001acb8
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400e7da0
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
Function at 0x140004a6c
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov qword [0x140174638], rcx
mov ecx, 0x30
call fcn.1400e84d4
test rax, rax
je 0x140004aa7
mov rdx, qword [0x140174660]
and qword [rax + 0x10], 0
and qword [rax + 0x20], 0
mov qword [rax], rdx
mov qword [rax + 8], rbx
mov byte [rax + 0x2a], 0
mov qword [0x140174650], rax
mov rax, qword [0x140174648]
mov edx, dword [rax + 0x24]
shr edx, 6
and dl, 1
call fcn.14000a14c
mov rdx, rbx
call fcn.14000ba64
lea rcx, [0x140166cf2]
mov edx, 0xfd3b52d
mov r8d, 0x14
call fcn.140001198
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x140004b1d
lea rcx, [0x140166d08]
mov edx, 0x28bc0068
mov r8d, 0x1a
call fcn.140001198
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140174790], rax
lea rcx, [fcn.14000963c]
xor edx, edx
call fcn.1400097e8
lea rax, [rsp + 0x40]
lea r8, [0x140008f74]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x140174748], rax
add rsp, 0x30
pop rbx
ret
Function at 0x140005824
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x258
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x240], rax
add cl, 0x41
movzx eax, cl
lea rcx, [0x1401747a0]
mov rcx, qword [rcx + rax*8 - 0x208]
test rcx, rcx
je 0x1400058ae
cmp byte [rcx + 0x9b], 0
je 0x1400058ae
lea rdx, [rsp + 0x30]
call fcn.140029134
lea rcx, [rsp + 0x30]
call fcn.14001fc34
test al, al
je 0x1400058ae
mov edx, 0xe1a383f0
mov ecx, 0x1e773725
mov r8d, 0xa128d807
call fcn.140001078
lea r8, [rsp + 0x30]
xor r9d, r9d
xor ecx, ecx
mov rdx, rax
mov dword [rsp + 0x28], 5
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400e7da0
add rsp, 0x258
ret

Function at 0x1400058c8
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x4f], rax
movzx eax, dl
xor edi, edi
mov rbx, rcx
lea ecx, [rax + 0x41]
and edx, 0xff00
mov dword [rbp + 0x49], 0x5c003a
mov word [rbp + 0x47], cx
mov word [rbp + 0x4d], di
cmp edx, 0x2000
je 0x140005a64
cmp edx, 0x2100
je 0x140005a2e
cmp edx, 0x2200
je 0x140005a21
cmp edx, 0x2300
je 0x140005a14
cmp edx, 0x2400
je 0x140005a0a
cmp edx, 0x2500
je 0x140005a01
cmp edx, 0x2600
je 0x1400059f6
cmp edx, 0x2700
je 0x1400059f2
cmp edx, 0x2800
jne 0x140005a75
lea r8d, [rdi + 0x6c]
lea rcx, [rbp - 0x25]
xor edx, edx
call fcn.1400ea570
mov edx, 0xdad16b54
mov ecx, 0x2505df9d
mov r8d, 0x9a5a30ad
mov dword [rbp - 0x29], 0x70
mov dword [rbp - 0x25], InitCommonControls
mov qword [rbp - 0x21], rbx
call fcn.140001078
mov edx, 0x3c6f23fd
mov qword [rbp - 0x19], rax
lea rax, [rbp + 0x47]
mov ecx, 0xc3bb972c
mov r8d, 0x7ce4780e
mov qword [rbp - 0x11], rax
call fcn.140001078
lea rcx, [rbp - 0x29]
mov qword [rbp - 1], rdi
mov dword [rbp + 7], 5
mov qword [rbp + 0xf], rdi
mov qword [rbp - 9], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x140005a75
xor edx, edx
jmp 0x1400059f8
mov dl, 1
mov ecx, eax
call fcn.140005784
jmp 0x140005a75
mov ecx, eax
call fcn.140005824
jmp 0x140005a75
movzx edx, cx
call fcn.14000b1f8
jmp 0x140005a75
movzx edx, cx
mov rcx, rbx
call fcn.14000ea14
jmp 0x140005a75
movzx edx, cx
mov rcx, rbx
call fcn.14000e970
jmp 0x140005a75
mov edx, 0x8f0ff394
mov ecx, 0x70db4775
mov r8d, 0xcf84a863
call fcn.140001078
lea r8, [rbp + 0x47]
xor r9d, r9d
xor ecx, ecx
mov rdx, rax
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x140005a75
lea r8d, [rax + 0x41]
mov edx, 7
mov rcx, rbx
call fcn.140018798
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400e7da0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret