joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800127e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x90
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e3169]
call fcn.180031cb0
mov qword [rbp], 0
mov byte [rbp + 8], 0
mov qword [rbp + 0x10], 0
mov qword [rbp + 0x18], 0
mov rax, qword [rbp + 0x80]
mov ecx, dword [rax + 4]
call fcn.1800125f0
mov qword [rbp], rax
cmp qword [rbp], 0
je 0x180012920
mov byte [rbp + 8], 1
lea rdx, [0x1800386dc]
mov rcx, qword [rbp]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
mov qword [rbp + 0x10], rax
cmp qword [rbp + 0x10], 0
je 0x1800128fb
xor r8d, r8d
mov rax, qword [rbp + 0x80]
mov edx, dword [rax + 0xc]
mov rcx, qword [rbp + 0x10]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
mov rax, qword [rbp + 0x80]
mov eax, dword [rax + 0x10]
mov qword [rbp + 0x60], rax
mov rcx, qword [rbp + 0x80]
add rcx, 0x18
call fcn.180017de0
mov r9, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x60]
mov r8, rcx
mov edx, 1
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
mov qword [rbp + 0x18], rax
mov rax, qword [rbp + 0x80]
mov eax, dword [rax + 0x10]
cmp qword [rbp + 0x18], rax
jae 0x1800128cb
mov rax, qword [rbp + 0x80]
mov byte [rax + 0x5e0], 1
jmp 0x1800128d9
mov rax, qword [rbp + 0x80]
mov byte [rax + 0x5e0], 0
mov rax, qword [rbp + 0x80]
add rax, 0x18
mov rdx, qword [rbp + 0x18]
mov rcx, rax
call fcn.180017d90
mov rcx, qword [rbp + 0x10]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
jmp 0x18001291e
mov rax, qword [rbp + 0x80]
add rax, 0x18
xor edx, edx
mov rcx, rax
call fcn.180017d90
mov rax, qword [rbp + 0x80]
mov byte [rax + 0x5e0], 1
jmp 0x180012943
mov rax, qword [rbp + 0x80]
add rax, 0x18
xor edx, edx
mov rcx, rax
call fcn.180017d90
mov rax, qword [rbp + 0x80]
mov byte [rax + 0x5e0], 1
movzx eax, byte [rbp + 8]
lea rsp, [rbp + 0x70]
pop rbp
ret
Function at 0x180013080
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x80
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e3169]
call fcn.180031cb0
mov qword [rbp], 0
mov byte [rbp + 8], 0
mov qword [rbp + 0x10], 0
mov rax, qword [rbp + 0x70]
mov ecx, dword [rax + 4]
call fcn.1800125f0
mov qword [rbp], rax
cmp qword [rbp], 0
je 0x18001318c
mov byte [rbp + 8], 1
mov rax, qword [rbp + 0x70]
cmp dword [rax + 0xc], 0
jne 0x1800130f1
lea rdx, [0x1800386f4]
mov rcx, qword [rbp]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
mov qword [rbp + 0x10], rax
jmp 0x180013125
mov rax, qword [rbp + 0x70]
cmp dword [rax + 0xc], 0xffffffff
jne 0x180013111
lea rdx, [0x1800386f8]
mov rcx, qword [rbp]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
mov qword [rbp + 0x10], rax
jmp 0x180013125
lea rdx, [0x1800386fc]
mov rcx, qword [rbp]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
mov qword [rbp + 0x10], rax
cmp qword [rbp + 0x10], 0
je 0x18001318c
mov rax, qword [rbp + 0x70]
cmp dword [rax + 0xc], 0xffffffff
je 0x180013149
xor r8d, r8d
mov rax, qword [rbp + 0x70]
mov edx, dword [rax + 0xc]
mov rcx, qword [rbp + 0x10]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
mov rax, qword [rbp + 0x70]
add rax, 0x18
mov rcx, rax
call fcn.180017d50
mov qword [rbp + 0x58], rax
mov rcx, qword [rbp + 0x70]
add rcx, 0x18
call fcn.180017de0
mov r9, qword [rbp + 0x10]
mov r8d, 1
mov rcx, qword [rbp + 0x58]
mov rdx, rcx
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rcx, qword [rbp + 0x10]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
movzx eax, byte [rbp + 8]
lea rsp, [rbp + 0x60]
pop rbp
ret

Function at 0x18001fde0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x70
lea rbp, [rsp + 0x20]
lea rcx, [0x1800e32d9]
call fcn.180031cb0
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x18001fe14
xor eax, eax
jmp 0x18001fe2b
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rax + rcx]
mov eax, dword [rax]
lea rsp, [rbp + 0x50]
pop rbp
ret
Function at 0x180020450
Capabilities:
Get hostname
Resolve dns

Disassembly:
push rbp
sub rsp, 0x190
lea rbp, [rsp + 0x30]
mov rax, qword [0x180046f28]
xor rax, rbp
mov qword [rbp + 0x150], rax
lea rcx, [0x1800e32d9]
call fcn.180031cb0
mov edx, 0xff
lea rcx, [rbp + 0x10]
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
je 0x180020498
mov eax, 0xffffffff
jmp 0x180020587
lea rcx, [rbp + 0x10]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x1800204b7
mov eax, 0xffffffff
jmp 0x180020587
movzx eax, byte [0x18004bec8]
test eax, eax
je 0x180020570
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp]
mov rcx, qword [rcx + 0x18]
mov edx, 1
imul rdx, rdx, 3
mov rax, qword [rcx + rax]
movzx eax, byte [rax + rdx]
mov ecx, 8
imul rcx, rcx, 0
mov rdx, qword [rbp]
mov rdx, qword [rdx + 0x18]
mov r8d, 1
imul r8, r8, 2
mov rcx, qword [rdx + rcx]
movzx ecx, byte [rcx + r8]
mov edx, 8
imul rdx, rdx, 0
mov r8, qword [rbp]
mov r8, qword [r8 + 0x18]
mov r9d, 1
imul r9, r9, 1
mov rdx, qword [r8 + rdx]
movzx edx, byte [rdx + r9]
mov r8d, 8
imul r8, r8, 0
mov r9, qword [rbp]
mov r9, qword [r9 + 0x18]
mov r10d, 1
imul r10, r10, 0
mov r8, qword [r9 + r8]
movzx r8d, byte [r8 + r10]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
mov r9d, edx
lea rdx, [rbp + 0x10]
lea rcx, str.host:__s_at__u._u._u._u_n
call fcn.180001060
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rbp]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rax + rcx]
mov eax, dword [rax]
mov rcx, qword [rbp + 0x150]
xor rcx, rbp
call fcn.180031560
lea rsp, [rbp + 0x160]
pop rbp
ret
Function at 0x180023370
Capabilities:
Send data
Send data on socket

Disassembly:
mov word [rsp + 0x18], r8w
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x98
lea rbp, [rsp + 0x30]
mov rax, qword [0x180046f28]
xor rax, rbp
mov qword [rbp + 0x58], rax
lea rcx, [0x1800e3364]
call fcn.180031cb0
lea rax, [rbp]
mov rdi, rax
xor eax, eax
mov ecx, select
rep stosb byte [rdi], al
call fcn.180025640
test eax, eax
jge 0x1800233c5
xor eax, eax
jmp 0x180023436
mov eax, 2
mov word [rbp], ax
mov rax, qword [rbp + 0x80]
mov eax, dword [rax + 4]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x80]
movzx eax, word [rax + 2]
mov word [rbp + 2], ax
mov r8d, 8
xor edx, edx
lea rcx, [rbp + 8]
call sub.VCRUNTIME140.dll_memset
movzx eax, word [rbp + 0x90]
mov dword [rbp + 0x50], eax
call fcn.180025640
cdqe
mov dword [rsp + 0x28], setsockopt
lea rcx, [rbp]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov ecx, dword [rbp + 0x50]
mov r8d, ecx
mov rdx, qword [rbp + 0x88]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_sendto]
mov rcx, qword [rbp + 0x58]
xor rcx, rbp
call fcn.180031560
lea rsp, [rbp + 0x68]
pop rdi
pop rbp
ret
Function at 0x1400029c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Whatever_tqs_twaves_tccount_tanleitung_tjsky_tsametime_tuniversity_tparks_tblogsearchfeeds_tguide_toscommerce_textimages_tabusereports_tdbadmin_tbask_twadbsearch_tapidoc_tmailout_tdead_ttopsites_tsociable_timagemagick_tchallenges_tcccommon_tcontulmeu_tcontrollers_tcrawl_tkalk_tdisclaimers_tmygallery_tknicks_tvsc_treacties_tuserplane_tcandidatelists_tafw_tmoo_tawstatsicon_tstrangle_thhdocs_tespanolingles_tbaramej_tcl_tchange_tkuvat_tporta_taltersvorsorge_tactivities_thitbox
mov r10, rax
sub rbx, rax
movabs rdi, 0x4c61dd63a7aed805
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 8]
movsx eax, al
mov word [r9 + 8], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 0xa]
movsx eax, al
mov word [r9 + 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 0xc]
movsx eax, al
mov word [r9 + 0xc], ax
lea rcx, [r8 + 8]
mov rax, rdi
mul rcx
add r11d, 0xc
lea r9, [r9 + 0x18]
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 0xa]
movsx eax, al
mov word [r9 - 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xb]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 0xc
jb 0x140002a10
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140002f40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Whatever_tqs_twaves_tccount_tanleitung_tjsky_tsametime_tuniversity_tparks_tblogsearchfeeds_tguide_toscommerce_textimages_tabusereports_tdbadmin_tbask_twadbsearch_tapidoc_tmailout_tdead_ttopsites_tsociable_timagemagick_tchallenges_tcccommon_tcontulmeu_tcontrollers_tcrawl_tkalk_tdisclaimers_tmygallery_tknicks_tvsc_treacties_tuserplane_tcandidatelists_tafw_tmoo_tawstatsicon_tstrangle_thhdocs_tespanolingles_tbaramej_tcl_tchange_tkuvat_tporta_taltersvorsorge_tactivities_thitbox
mov r10, rax
sub rbx, rax
movabs rdi, 0x4c61dd63a7aed805
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xa]
mul rcx
add r11d, 0xa
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xa
jb 0x140002f90
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140003f90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Whatever_tqs_twaves_tccount_tanleitung_tjsky_tsametime_tuniversity_tparks_tblogsearchfeeds_tguide_toscommerce_textimages_tabusereports_tdbadmin_tbask_twadbsearch_tapidoc_tmailout_tdead_ttopsites_tsociable_timagemagick_tchallenges_tcccommon_tcontulmeu_tcontrollers_tcrawl_tkalk_tdisclaimers_tmygallery_tknicks_tvsc_treacties_tuserplane_tcandidatelists_tafw_tmoo_tawstatsicon_tstrangle_thhdocs_tespanolingles_tbaramej_tcl_tchange_tkuvat_tporta_taltersvorsorge_tactivities_thitbox
mov r10, rax
sub rbx, rax
movabs rdi, 0x4c61dd63a7aed805
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xc]
mul rcx
add r11d, 0xc
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xb]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xc
jb 0x140003fe0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400041d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Whatever_tqs_twaves_tccount_tanleitung_tjsky_tsametime_tuniversity_tparks_tblogsearchfeeds_tguide_toscommerce_textimages_tabusereports_tdbadmin_tbask_twadbsearch_tapidoc_tmailout_tdead_ttopsites_tsociable_timagemagick_tchallenges_tcccommon_tcontulmeu_tcontrollers_tcrawl_tkalk_tdisclaimers_tmygallery_tknicks_tvsc_treacties_tuserplane_tcandidatelists_tafw_tmoo_tawstatsicon_tstrangle_thhdocs_tespanolingles_tbaramej_tcl_tchange_tkuvat_tporta_taltersvorsorge_tactivities_thitbox
mov r10, rax
sub rbx, rax
movabs rdi, 0x4c61dd63a7aed805
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 6]
mov rax, rdi
mov rcx, r8
mul r8
add r11d, 6
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 7]
mov byte [r9 - 7], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 6]
mov byte [r9 - 6], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 6
jb 0x140004220
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004960
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Whatever_tqs_twaves_tccount_tanleitung_tjsky_tsametime_tuniversity_tparks_tblogsearchfeeds_tguide_toscommerce_textimages_tabusereports_tdbadmin_tbask_twadbsearch_tapidoc_tmailout_tdead_ttopsites_tsociable_timagemagick_tchallenges_tcccommon_tcontulmeu_tcontrollers_tcrawl_tkalk_tdisclaimers_tmygallery_tknicks_tvsc_treacties_tuserplane_tcandidatelists_tafw_tmoo_tawstatsicon_tstrangle_thhdocs_tespanolingles_tbaramej_tcl_tchange_tkuvat_tporta_taltersvorsorge_tactivities_thitbox
mov r10, rax
sub rbx, rax
movabs rdi, 0x4c61dd63a7aed805
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xd]
mul rcx
add r11d, 0xd
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xb]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xc]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xd
jb 0x1400049b0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004e60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Whatever_tqs_twaves_tccount_tanleitung_tjsky_tsametime_tuniversity_tparks_tblogsearchfeeds_tguide_toscommerce_textimages_tabusereports_tdbadmin_tbask_twadbsearch_tapidoc_tmailout_tdead_ttopsites_tsociable_timagemagick_tchallenges_tcccommon_tcontulmeu_tcontrollers_tcrawl_tkalk_tdisclaimers_tmygallery_tknicks_tvsc_treacties_tuserplane_tcandidatelists_tafw_tmoo_tawstatsicon_tstrangle_thhdocs_tespanolingles_tbaramej_tcl_tchange_tkuvat_tporta_taltersvorsorge_tactivities_thitbox
mov r10, rax
sub rbx, rax
movabs rdi, 0x4c61dd63a7aed805
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 0xc]
mov rax, rdi
mov rcx, r8
mul r8
add r11d, 6
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 0xe]
movsx eax, al
mov word [r9 - 0xe], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 0xc]
movsx eax, al
mov word [r9 - 0xc], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 - 0xa]
movsx eax, al
mov word [r9 - 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1ad
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 6
jb 0x140004eb0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret