joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140026340
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 8], r15
xchg r15, rbx
xchg rbp, r15
mov qword [rsp + 0x10], r15
xchg r15, rbp
xchg r15, rsi
mov qword [rsp + 0x18], r15
xchg rsi, r15
mov qword [rsp + 0x20], rdi
nop
mov qword [rsp - 8], r14
sub rsp, 8
sub rsp, 0x20
mov rsi, rdx
xchg rbx, rcx
mov rcx, rbx
xchg rcx, rbx
sub rsi, rcx
xchg rcx, rbp
mov r8, rbp
xchg rbp, rcx
mov r9d, 4
nop dword [rax]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rsi + r8 + 0xe0]
xor byte [r8], al
inc r8
sub rcx, 1
jne 0x1400263a6
sub r9, 1
jne 0x140026396
mov bpl, 0xd
lea rdi, [rsi + 0xd0]
lea r14, [0x140001220]
nop dword [rax]
movzx eax, byte [rbx + 9]
xchg rbx, r9
mov rbx, r9
xchg rbx, r9
movzx ecx, byte [rbx + 0xd]
mov r10d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax]
xchg r9, r8
mov rdx, r8
xchg r8, r9
mov r8d, 4
nop dword [rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 4]
movzx ecx, byte [rax + r14]
xor cl, 0xc3
mov byte [rdx - 4], cl
sub r8, 1
jne 0x14002645a
inc r9
sub r10, 1
jne 0x140026444
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
lea r8d, [r10 + 4]
nop dword [rax + rax]
mov edx, 4
nop word [rax + rax]
movzx ecx, byte [rdi + rax]
xor byte [rax], cl
inc rax
sub rdx, 1
jne 0x1400264a6
sub r8, 1
jne 0x140026496
mov rcx, rbx
call fcn.1400265f0
sub rdi, 0x10
add bpl, 0xff
jne 0x1400263de
movzx eax, byte [rbx + 9]
mov r9, rbx
movzx ecx, byte [rbx + 0xd]
mov r10d, 4
mov byte [rbx + 0xd], al
movzx eax, byte [rbx + 5]
mov byte [rbx + 9], al
movzx eax, byte [rbx + 1]
mov byte [rbx + 5], al
movzx eax, byte [rbx + 0xa]
mov byte [rbx + 1], cl
movzx ecx, byte [rbx + 2]
mov byte [rbx + 2], al
movzx eax, byte [rbx + 0xe]
mov byte [rbx + 0xa], cl
movzx ecx, byte [rbx + 6]
mov byte [rbx + 6], al
movzx eax, byte [rbx + 7]
mov byte [rbx + 0xe], cl
movzx ecx, byte [rbx + 3]
mov byte [rbx + 3], al
movzx eax, byte [rbx + 0xb]
mov byte [rbx + 7], al
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xb], al
mov byte [rbx + 0xf], cl
nop dword [rax + rax]
xchg r10, rdx
mov r10, r9
xchg rdx, r10
mov r8d, 4
nop dword [rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 4]
movzx ecx, byte [rax + r14]
xor cl, 0xc3
mov byte [rdx - 4], cl
sub r8, 1
jne 0x140026554
inc r9
sub r10, 1
jne 0x14002653e
lea edx, [r8 + 4]
nop word [rax + rax]
mov ecx, 4
nop word [rax + rax]
movzx eax, byte [rsi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x14002659c
sub rdx, 1
jne 0x14002658c
xchg rbx, r11
mov r11, qword [rsp + 0x30]
xchg r11, rbx
xchg rbp, r11
mov r11, qword [rsp + 0x38]
xchg rbp, r11
xchg r13, rsi
mov r13, qword [rsp + 0x40]
xchg rsi, r13
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
nop
mov r14, qword [rsp]
add rsp, 8
ret
Function at 0x140027200
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov qword [rsp + 8], rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x10
mov rbx, rdx
mov r10, rcx
test r8b, 0xf
je 0x14002723e
xor al, al
xchg rsi, rbx
mov rsi, qword [rsp + 0x20]
xchg rbx, rsi
add rsp, 0x10
nop
xchg qword [rsp], rdi
add rsp, 8
ret
xor edx, edx
test r8d, r8d
je 0x1400272be
movdqa xmm2, xmmword [rsp]
nop
xchg rdx, rsi
movdqu xmm1, xmmword [rsi + rbx]
xchg rsi, rdx
test edx, edx
jne 0x14002726b
movdqu xmm2, xmmword [r10 + 0x200]
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
xorps xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0xd
nop word [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027289
aesdeclast xmm0, xmmword [r10 + 0x1e0]
xorps xmm0, xmm2
movdqa xmm2, xmm1
movups xmmword [rdx + r9], xmm0
add edx, 0x10
cmp edx, r8d
jb 0x14002724f
xchg rbx, r13
mov r13, qword [rsp + 0x20]
xchg rbx, r13
mov al, 1
add rsp, 0x10
push rbx
push rbx
push rdx
push rdx
xchg qword [rsp + 0x20], rdi
pop rdx
pop rdx
pop rbx
pop rbx
add rsp, 8
ret
Function at 0x14002a720
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rdi, rsi
mov qword [rsp + 0x18], rdi
xchg rdi, rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
xchg rcx, r8
mov rsi, r8
xchg rcx, r8
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x60]
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
mov qword [rsp + 0x40], rbx
add rcx, 0x1df5a16b
sub rcx, 0x1df5a0a3
xchg rbx, r13
mov qword [rsp + 0x28], r13
xchg rbx, r13
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.140029d80
test eax, eax
js 0x14002a7ae
cmp qword [rsp + 0x40], rbx
je 0x14002a7ae
lea eax, [rbx + 1]
jmp 0x14002a841
mov rax, qword gs:[0x60]
xchg rcx, r12
mov r12, qword [rax + 0x30]
xchg r12, rcx
cmp dword [rcx + 0x70], 2
jbe 0x14002a7d5
mov eax, 2
jmp 0x14002a841
cmp dword [rcx + 0x74], ebx
jbe 0x14002a7e8
mov eax, 3
jmp 0x14002a841
cmp byte [rdi + 2], bl
je 0x14002a7fb
mov eax, 4
jmp 0x14002a841
cmp r14d, 0xa
jb 0x14002a824
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002a824
mov eax, 8
jmp 0x14002a841
lea rcx, [rsi + 0xb8]
mov edx, 0x99999999
call fcn.14002a1c0
jmp 0x14002a83f
mov eax, ebx
xchg r13, rbx
mov r13, qword [rsp + 0x48]
xchg r13, rbx
mov rsi, qword [rsp + 0x50]
xchg rsi, rdi
mov rsi, qword [rsp + 0x58]
xchg rsi, rdi
add rsp, 0x30
nop
add rsp, 8
xchg qword [rsp - 8], r14
ret
Function at 0x14002c380
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
nop
sub rsp, 8
mov qword [rsp], rsi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
xchg r9, rsi
mov r9, rcx
xchg r9, rsi
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x14002c5d9
lea rax, [rdx - 1]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
xchg r14, rdi
mov qword [rsp + 0x40], rdi
xchg rdi, r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.14002baf0
xchg rbx, r8
mov qword [rsi + 0x38], r8
xchg rbx, r8
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
xchg r13, rcx
mov r13, qword [rsi + 8]
xchg rcx, r13
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x14002c577
xchg r14, rbp
mov qword [rsp + 0x30], r14
xchg rbp, r14
xchg rcx, rax
mov rcx, rax
xchg rcx, rax
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx r9d, byte [rax + 0x10]
movzx edx, byte [rax + 0x11]
xor r9, rbp
mov r11, qword [rsi + 0x30]
mov rcx, qword [rcx]
imul r9, rbx
xor r9, rdx
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
xchg rdi, r8
mov rdi, qword [r11]
xchg r8, rdi
cmp r8, rdi
jne 0x14002c491
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x14002c560
mov rdx, qword [r11 + 8]
movzx r9d, word [rax + 0x10]
cmp r9w, word [rdx + 0x10]
jne 0x14002c509
xchg r10, rsi
mov rsi, qword [rdx]
xchg r10, rsi
cmp r10, rax
je 0x14002c4fc
xchg r8, r9
mov r8, qword [rax + 8]
xchg r8, r9
xchg r12, rcx
mov qword [r9], r12
xchg rcx, r12
mov r8, qword [rcx + 8]
xchg r10, r12
mov qword [r8], r12
xchg r12, r10
xchg rdx, rdi
mov rdi, qword [r10 + 8]
xchg rdi, rdx
mov qword [rdx], rax
xchg rdi, r8
mov qword [r10 + 8], rdi
xchg r8, rdi
mov qword [rcx + 8], r9
xchg r12, rdx
mov qword [rax + 8], r12
xchg r12, rdx
xchg rsi, rax
mov qword [r11 + 8], rsi
xchg rsi, rax
jmp 0x14002c560
cmp r8, rdx
je 0x14002c52c
nop
mov rdx, qword [rdx + 8]
cmp r9w, word [rdx + 0x10]
je 0x14002c594
cmp r8, rdx
jne 0x14002c514
mov r10, qword [rax + 8]
xchg rbx, rcx
mov qword [r10], rbx
xchg rbx, rcx
mov r9, qword [rcx + 8]
xchg r14, rdx
mov qword [r9], r14
xchg rdx, r14
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
xchg r9, rax
mov qword [r11], r9
xchg r9, rax
xchg rcx, r13
mov rax, r13
xchg r13, rcx
cmp rcx, rdi
jne 0x14002c44a
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
nop
mov rsi, qword [rsp]
add rsp, 8
ret
xchg r10, r9
mov r9, qword [rdx]
xchg r9, r10
mov r9, qword [rax + 8]
xchg r11, rcx
mov qword [r9], r11
xchg rcx, r11
mov r8, qword [rcx + 8]
xchg r10, rdi
mov qword [r8], rdi
xchg r10, rdi
xchg r8, rdx
mov r8, qword [r10 + 8]
xchg rdx, r8
xchg r11, rax
mov qword [rdx], r11
xchg r11, rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x14002c560
lea rcx, [0x140001530]
call fcn.14014fa80
int3
Function at 0x14005cb20
Capabilities:
Encode data using xor

Disassembly:
xchg r9, r12
mov r12, rcx
xchg r12, r9
mov r8d, 0xffffffff
test rcx, rcx
je 0x14005cbbd
cmp byte [rcx], 0
je 0x14005cbbd
test rdx, rdx
jne 0x14005cb68
mov rdx, 0xffffffffffffffff
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x14005cb52
test rdx, rdx
je 0x14005cbba
xor r10d, r10d
lea r11, [0x140002db0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
xor rcx, rax
shr r8d, 3
shr r8d, 2
shr r8d, 1
shr r8d, 1
shr r8d, 1
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x14005cb7a
not r8d
mov eax, r8d
ret

Function at 0x140060020
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg r14, rcx
mov rdx, r14
xchg rcx, r14
test rax, rax
jne 0x140060039
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14006006d
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14006006a
xchg rcx, r10
mov r10, qword [rdx + 0x10]
xchg r10, rcx
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x140060047
xchg r11, rax
mov r11, qword [rdx + 0x10]
xchg r11, rax
mov byte [rdx], 1
ret

Function at 0x140060100
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg rcx, rbp
mov rdx, rbp
xchg rcx, rbp
test rax, rax
jne 0x140060113
ret
cmp byte [rcx], 0
jne 0x140060145
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x140060142
nop dword [rax + rax]
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x140060126
mov rax, qword [rdx + 0x10]
mov byte [rdx], 1
ret
Function at 0x1400d4fa0
Capabilities:
Parse pe header

Disassembly:
xchg rdx, rbx
mov qword [rsp + 8], rdx
xchg rbx, rdx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rbp
nop
push r9
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r13
nop
sub rsp, 8
mov qword [rsp], r14
push rdi
mov qword [rsp], r15
sub rsp, 0x30
xchg r11, r8
mov r14, r11
xchg r8, r11
xchg r12, rdi
mov rdi, rdx
xchg r12, rdi
test rdx, rdx
je 0x1400d51e1
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x1400d51e1
movsxd rdi, dword [rdx + 0x3c]
add rdi, rdx
cmp dword [rdi], 0x4550
jne 0x1400d51e1
mov eax, 0x20b
cmp word [rdi + 0x18], ax
jne 0x1400d51e1
xor r15d, r15d
mov r13d, r15d
mov ebp, r15d
cmp r15w, word [rdi + 6]
jae 0x1400d51d6
nop dword [rax]
mov eax, ebp
lea rbx, [rax + rax*4]
shl rbx, 1
shl rbx, 1
shl rbx, 1
mov eax, dword [rdi + rbx + 0x12c]
and eax, 0xc0000000
cmp eax, 0x40000000
jne 0x1400d51c8
mov ecx, 0x60
call fcn.14014ee1c
xchg r9, rax
mov rsi, r9
xchg r9, rax
mov qword [rsp + 0x20], rax
test rax, rax
lea rax, [rdi + 0x114]
je 0x1400d50df
lea r15, [rdi + 0x118]
add r15, rbx
mov r8d, dword [r15]
add rax, rbx
xchg r14, rax
mov qword [rsp + 0x88], r14
xchg r14, rax
mov edx, dword [rax]
add rdx, r12
xchg rsi, r9
mov rcx, r9
xchg rsi, r9
call fcn.1400d9bb0
lea rax, [0x140003e48]
xchg r11, rax
mov qword [rsi], r11
xchg r11, rax
jmp 0x1400d50fd
xchg r15, r14
mov rsi, r14
xchg r15, r14
lea r15, [rdi + 0x118]
add r15, rbx
add rax, rbx
mov qword [rsp + 0x88], rax
mov r12d, dword [r15]
mov ecx, r12d
call fcn.14014ee60
xchg rbx, rax
mov rax, rbx
xchg rbx, rax
test rax, rax
je 0x1400d5130
mov r8d, r12d
xor edx, edx
xchg rcx, r10
mov r10, rax
xchg rcx, r10
call fcn.14014feb6
jmp 0x1400d5132
xor ebx, ebx
mov r8d, dword [r15]
mov rax, qword [rsp + 0x88]
mov edx, dword [rax]
mov r12, qword [rsp + 0x78]
add rdx, r12
xchg rcx, rbp
mov rbp, rbx
xchg rbp, rcx
call fcn.14014fee0
xchg rbx, rax
mov rbx, qword [rsi]
xchg rbx, rax
xchg rbx, r8
mov rdx, r8
xchg rbx, r8
xchg rsi, r14
mov rcx, r14
xchg rsi, r14
call qword [rax + 0x10]
mov qword [rsp + 0x88], rsi
xchg rbp, rdx
mov rbp, qword [r14 + 8]
xchg rdx, rbp
cmp rdx, qword [r14 + 0x10]
je 0x1400d51ac
xchg rsi, r11
mov qword [rdx], r11
xchg rsi, r11
nop
add qword [r14 + 8], 0x38099901
sub qword [r14 + 8], 0x380998f9
jmp 0x1400d51c2
lea r8, [rsp + 0x88]
xchg rcx, r13
mov r13, r14
xchg rcx, r13
call fcn.1400d4340
inc r13d
xor r15d, r15d
inc ebp
movzx eax, word [rdi + 6]
cmp ebp, eax
jb 0x1400d5051
test r13d, r13d
setne al
jmp 0x1400d51e3
xor al, al
xchg r13, rbx
mov r13, qword [rsp + 0x70]
xchg r13, rbx
add rsp, 0x30
nop
add rsp, 8
xchg qword [rsp - 8], r15
nop
add rsp, 8
xchg qword [rsp - 8], r14
nop
mov r13, qword [rsp]
add rsp, 8
push rax
push rdx
push rcx
push rax
push rdx
push rcx
xchg qword [rsp + 0x30], r12
add rsp, 0x38
nop
mov rdi, qword [rsp]
add rsp, 8
nop
mov rsi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rbp, qword [rsp - 8]
ret
Function at 0x1400d5530
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
xchg rbx, r8
mov qword [rsp + 0x18], rbx
xchg rbx, r8
xchg rcx, rbp
mov qword [rsp + 8], rbp
xchg rcx, rbp
nop
sub rsp, 8
mov qword [rsp], rbx
nop
mov qword [rsp - 8], rbp
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], rsi
push rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x58
xchg rbx, r9
mov r9, rbx
xchg rbx, r9
xchg rdx, rsi
mov rdx, rsi
xchg rdx, rsi
xchg rcx, r8
mov r9, r8
xchg r8, rcx
xor ebp, ebp
test rdx, rdx
jne 0x1400d55be
mov eax, ebp
jmp 0x1400d55e5
mov eax, 0x5a4d
cmp word [rdx], ax
je 0x1400d55d4
mov rax, rbp
jmp 0x1400d55e5
movsxd rax, dword [rdx + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
cmovne rax, rbp
mov ecx, 0x20b
cmp word [rax + 0x18], cx
jne 0x1400d5709
mov r14d, dword [rax + 0x88]
add r14, rsi
je 0x1400d5709
mov r15d, dword [r14 + 0x1c]
add r15, rsi
mov r12d, dword [r14 + 0x24]
add r12, rsi
mov r13d, dword [r14 + 0x20]
add r13, rsi
mov edi, ebp
cmp dword [r14 + 0x18], 0
jbe 0x1400d56db
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
mov ecx, dword [r13 + rax*4]
add rcx, rsi
movzx eax, word [r12 + rax*2]
mov edx, dword [r15 + rax*4]
add rdx, rsi
cmp rcx, 0xffff
jbe 0x1400d56cf
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0x30], rcx
xchg r8, r14
mov qword [rsp + 0x38], r14
xchg r14, r8
xchg r9, rbp
mov qword [rsp + 0x40], rbp
xchg rbp, r9
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400d5793
xchg r10, rax
mov r10, qword [rcx]
xchg r10, rax
lea rdx, [rsp + 0xa8]
xchg r15, rdx
mov qword [rsp + 0x20], r15
xchg r15, rdx
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
test al, al
je 0x1400d56db
xchg r8, r13
mov r13, qword [rsp + 0xb0]
xchg r13, r8
mov r9, qword [rsp + 0xa0]
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x1400d5632
xchg rcx, r13
mov r13, qword [rbx + 0x38]
xchg r13, rcx
test rcx, rcx
je 0x1400d5702
cmp rcx, rbx
xchg rdi, rax
mov rdi, qword [rcx]
xchg rdi, rax
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], rbp
mov al, 1
jmp 0x1400d5732
xchg rcx, rbp
mov rbp, qword [rbx + 0x38]
xchg rbp, rcx
test rcx, rcx
je 0x1400d5730
xchg r12, rax
mov r12, qword [rcx]
xchg r12, rax
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], rbp
xor al, al
add rsp, 0x58
nop
add rsp, 8
xchg qword [rsp - 8], r15
push rcx
push rdx
push rbx
push rdx
push rcx
push rdx
push rax
push rax
xchg qword [rsp + 0x40], r14
add rsp, 0x48
push rbx
xchg qword [rsp + 8], r13
add rsp, 0x10
push rax
push rbx
push rcx
push rdx
push rax
xchg qword [rsp + 0x28], r12
add rsp, 0x30
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rsi
nop
add rsp, 8
xchg qword [rsp - 8], rbp
push rdx
push rcx
push rdx
xchg qword [rsp + 0x18], rbx
add rsp, 0x20
ret
call fcn.14014fc6c
nop
int3
Function at 0x1400d9c90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xchg r8, r11
mov r8, rdx
xchg r8, r11
xchg r10, r11
mov r11, rcx
xchg r11, r10
test rdx, rdx
je 0x1400d9d14
xchg rdi, rbx
mov qword [rsp], rdi
xchg rbx, rdi
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1400d9d01
movzx eax, byte [r10]
test bl, bl
je 0x1400d9ce3
lea rcx, [r9 - 1]
mov rdx, r9
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1400d9cd2
jmp 0x1400d9d01
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1400d9cf2
inc r10
sub r11, 1
jne 0x1400d9cba
xchg r9, rbx
mov r9, qword [rsp]
xchg r9, rbx
add rsp, 8
ret

Function at 0x1400dbd80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
xchg rsi, r15
mov qword [rsp + 0x10], r15
xchg rsi, r15
xchg rdi, rbp
mov qword [rsp + 0x18], rbp
xchg rdi, rbp
nop
sub rsp, 8
mov qword [rsp], rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
xchg rdi, rdx
mov rdx, r8
xchg rdi, rdx
mov rbx, rdx
xchg rcx, r15
mov rsi, r15
xchg rcx, r15
test r8, r8
je 0x1400dbf2d
nop
mov dword [rbp - 0x29], 0xf6f6f6f6
mov dword [rbp + 0x16], 0x3d3c3b3a
mov dword [rbp - 0x25], 0xf6f6f6f6
mov dword [rbp + 0x1a], 0x41403f3e
mov dword [rbp - 0x21], 0xf6f6f6f6
mov dword [rbp + 0x1e], 0x4c4b4342
mov dword [rbp - 0x1d], 0xf6f6f6f6
mov dword [rbp + 0x22], 0x504f4e4d
mov dword [rbp - 0x19], 0xf6f6f6f6
mov dword [rbp + 0x26], 0x54535251
mov dword [rbp - 0x15], 0xf6f6f6f6
mov dword [rbp + 0x2a], 0x58575655
mov dword [rbp - 0x11], 0xf6f6f6f6
mov dword [rbp + 0x2e], 0x5c5b5a59
mov dword [rbp - 0xd], 0xf6f6f6f6
mov dword [rbp + 0x32], 0x605f5e5d
mov dword [rbp - 9], 0xf6f6f6f6
mov dword [rbp + 0x36], 0x64636261
mov dword [rbp - 5], 0xf6f6f6f6
mov dword [rbp + 0x3a], 0x6e6d6c6b
mov dword [rbp - 1], 0xf6f6f6f6
mov dword [rbp + 0x3e], 0x7271706f
mov dword [rbp + 3], 0xf6f6f6f6
mov dword [rbp + 0x42], 0x76757473
mov dword [rbp + 7], 0xf6f6f6f6
mov dword [rbp + 0x46], 0x7a797877
mov dword [rbp + 0xb], 0xf6f6f6f6
mov dword [rbp + 0x4a], 0x7e7d7c7b
mov dword [rbp + 0xf], 0xf6f6f6f6
mov dword [rbp + 0x4e], 0x8281807f
mov word [rbp + 0x13], 0xf6f6
mov word [rbp + 0x52], 0x8483
xor eax, eax
mov byte [rbp + 0x54], al
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rbp + rax + 0x16]
movzx edx, byte [rbp + rax - 0x29]
add dl, cl
mov byte [rbp + rax + 0x16], dl
mov byte [rbp + rax - 0x29], 0
inc rax
cmp rax, 0x3e
jb 0x1400dbec0
mov edx, 0x3e
xor ecx, ecx
call fcn.1400dc620
movsxd rcx, eax
movzx edx, byte [rbp + rcx + 0x16]
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbp + rax + 0x16], 0
inc rax
cmp rax, 0x3e
jb 0x1400dbf04
mov byte [rbx], dl
inc rbx
sub rdi, 1
jne 0x1400dbdd0
mov qword [rsi], rbx
jmp 0x1400dbf36
xchg rdx, r11
mov qword [rcx], r11
xchg rdx, r11
xchg rsi, rax
mov rsi, rax
xchg rsi, rax
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
xchg rdi, r9
mov r9, qword [r11 + 0x20]
xchg r9, rdi
mov rsp, r11
nop
xchg qword [rsp], rbp
add rsp, 8
ret
Function at 0x1400dc620
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rdi, rbx
xchg rbp, r12
mov qword [rsp + 0x10], r12
xchg rbp, r12
xchg r14, rsi
mov qword [rsp + 0x20], r14
xchg r14, rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
mov eax, 0x13b0
call fcn.14014f1d0
sub rsp, rax
mov ebx, edx
mov edi, ecx
call fcn.14014fcfe
mov dword [rsp + 0x24], eax
mov r9d, 1
mov dword [rsp + 0x13a4], 0xffffffff
nop dword [rax + rax]
mov r8d, eax
shr r8d, 4
shr r8d, 0x16
shr r8d, 1
shr r8d, 1
shr r8d, 1
shr r8d, 1
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, 0x270
jb 0x1400dc67b
mov ebp, 0x80000000
mov dword [rsp + 0x20], 0x270
cmp edi, ebp
lea rax, [rsp + 0x20]
mov qword [rsp + 0x13d0], rax
lea rcx, [rsp + 0x13d0]
lea eax, [rdi - 0x80000000]
lea esi, [rdi + rbp]
cmovae esi, eax
lea edi, [rbx + rbp]
cmp ebx, ebp
lea eax, [rbx - 0x80000000]
cmovae edi, eax
sub edi, esi
cmp edi, 0xffffffff
jne 0x1400dc709
call fcn.1400dc8d0
mov ecx, eax
jmp 0x1400dc767
inc edi
mov ebx, edi
call fcn.1400dc8d0
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jae 0x1400dc759
mov eax, edi
xor edx, edx
neg eax
div edi
mov edi, edx
cmp ecx, edx
jae 0x1400dc759
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x13d0]
call fcn.1400dc8d0
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jb 0x1400dc73e
shr rcx, 0x16
shr rcx, 8
shr rcx, 1
shr rcx, 1
lea edx, [rsi + rcx]
lea r11, [rsp + 0x13b0]
cmp edx, ebp
xchg rbx, rdi
mov rdi, qword [r11 + 0x10]
xchg rdi, rbx
lea eax, [rdx + rbp]
mov rbp, qword [r11 + 0x18]
lea ecx, [rdx - 0x80000000]
xchg r10, rsi
mov r10, qword [r11 + 0x28]
xchg r10, rsi
cmovae eax, ecx
mov rsp, r11
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x1400dc8d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
xchg r9, r13
mov r13, qword [rcx]
xchg r9, r13
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x1400dc93f
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1400dc8fa
mov ecx, dword [r9]
jmp 0x1400dca34
cmp ecx, 0x4e0
jb 0x1400dca34
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400dc95e
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x1400dc9b2
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
xchg rbx, r9
mov r9, qword [rsp]
xchg r9, rbx
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 5
shl eax, 1
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xe
shl eax, 1
xor edx, eax
mov eax, edx
shr eax, 0xa
shr eax, 5
shr eax, 1
shr eax, 1
shr eax, 1
xor eax, edx
add rsp, 8
ret