joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140179150
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
mov r8d, edx
lea r9, [rsp + 0x52]
mov rbx, rcx
xor r10d, r10d
nop dword [rax]
nop dword [rax + rax]
nop
add r9, 0x571b4c34
sub r9, 0x571b4c36
mov eax, 0x11bba81d
xor eax, 0x1212ccb4
add eax, 0x35f4d6ab
sub eax, 0x27df9263
xor eax, 0x270d82a5
add eax, 0xb59a85c
add eax, 0x6b4fe08
add eax, 0x840afc15
mul r8d
shr edx, 1
shr edx, 1
shr edx, 1
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
nop
add r8w, 0x6988
sub r8w, 0x6958
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x140179170
xorps xmm0, xmm0
lea rax, [rsp + 0x52]
xchg r11, rbx
movups xmmword [r11], xmm0
xchg rbx, r11
xchg rbp, r10
mov qword [rbx + 0x10], rbp
xchg r10, rbp
mov qword [rbx + 0x18], r10
cmp r9, rax
jne 0x140179263
mov qword [rbx + 0x10], r10
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
mov qword [rbx + 0x18], 0x4060391d
add qword [rbx + 0x18], 0xa617c39
xor qword [rbx + 0x18], 0x73cf81ba
xor qword [rbx + 0x18], 0xa8a032c
xor qword [rbx + 0x18], 0x578f9de1
xor qword [rbx + 0x18], 0x2e60e688
xor qword [rbx + 0x18], 0x4a6b4cae
mov word [rbx], r10w
add rsp, 0x60
nop
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
lea r8, [rsp + 0x52]
xchg rdx, r9
mov r9, rdx
xchg rdx, r9
sub r8, r9
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
sar r8, 1
call fcn.14007eb60
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
add rsp, 0x60
push rax
push rax
xchg qword [rsp + 0x10], rbx
pop rax
pop rax
add rsp, 8
ret
Function at 0x1401940f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
xchg r13, r10
mov r13, rdx
xchg r13, r10
mov r11, rcx
mov dword [rsp + 0x30], 0x4aebf53d
xor dword [rsp + 0x30], 0x59532bc2
add dword [rsp + 0x30], 0x4190a646
add dword [rsp + 0x30], 0x1d8cd832
sub dword [rsp + 0x30], 0x71e4e5d5
add dword [rsp + 0x30], 0x6c1d382b
sub dword [rsp + 0x30], 0x27163ef4
add dword [rsp + 0x30], 0xb0fe861d
mov dword [rsp + 0x36], 0x552908e1
sub dword [rsp + 0x36], 0x860b6f4
add dword [rsp + 0x36], 0x32f97028
sub dword [rsp + 0x36], 0x786d42e9
xor dword [rsp + 0x36], 0x59262390
xor dword [rsp + 0x36], 0xa12ba3e6
mov dword [rsp + 0x3a], 0xeeccdca
xor dword [rsp + 0x3a], 0x87d0587
add dword [rsp + 0x3a], 0x2c706845
xor dword [rsp + 0x3a], 0x24ddabbe
add dword [rsp + 0x3a], 0x6642014a
xor dword [rsp + 0x3a], 0x817f632b
xor eax, eax
mov word [rsp + 0x3e], ax
xor ebx, ebx
mov edx, ebx
nop
movzx eax, word [rsp + rdx*2 + 0x36]
movzx ecx, byte [rsp + rdx + 0x30]
add cx, ax
mov word [rsp + rdx*2 + 0x36], cx
mov byte [rsp + rdx + 0x30], bl
inc rdx
cmp rdx, 4
jb 0x1401941ae
mov rax, qword [rsp + 0x70]
xchg rdi, rax
mov qword [rsp + 0x28], rdi
xchg rdi, rax
mov qword [rsp + 0x20], r9
xchg r12, r9
mov r12, r8
xchg r9, r12
lea r8, [rsp + 0x36]
mov rdx, r10
xchg r8, rcx
mov r8, r11
xchg r8, rcx
call fcn.140194260
nop
mov byte [rsp + rbx + 0x36], 0x41
xor byte [rsp + rbx + 0x36], 0x57
add byte [rsp + rbx + 0x36], 0x5f
sub byte [rsp + rbx + 0x36], 0x6d
xor byte [rsp + rbx + 0x36], 0x31
sub byte [rsp + rbx + 0x36], 0x22
xor byte [rsp + rbx + 0x36], 0x13
sub byte [rsp + rbx + 0x36], 4
inc rbx
cmp rbx, 8
jb 0x140194204
add rsp, 0x40
push rax
push rdx
push rdx
push rax
push rdx
push rcx
push rdx
xchg qword [rsp + 0x38], rbx
pop rdx
pop rcx
pop rdx
pop rax
pop rdx
pop rdx
pop rax
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401985f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
nop
mov qword [rsp - 8], rbx
sub rsp, 8
push rbp
nop
sub rsp, 8
mov qword [rsp], rsi
push rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
push r14
push r15
sub rsp, 0x58
mov rbx, r9
xchg rsi, rdx
mov rdx, rsi
xchg rsi, rdx
xchg r11, r9
mov r11, rcx
xchg r11, r9
xor ebp, ebp
test rdx, rdx
jne 0x140198657
mov eax, ebp
jmp 0x1401986a2
mov eax, 0x4cdbeafb
xor eax, 0xc46ab28
sub eax, 0x1672edd7
sub eax, 0x2815f0ef
add eax, 0x74f2e33c
sub eax, 0x71371669
sub eax, 0x5cfd593
cmp word [rdx], ax
je 0x140198691
xchg rsi, rbp
mov rax, rsi
xchg rbp, rsi
jmp 0x1401986a2
movsxd rax, dword [rdx + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
cmovne rax, rbp
mov ecx, 0x5c7801b7
sub ecx, 0x688d67c
xor ecx, 0x7bb30948
add ecx, 0x4381dc07
sub ecx, 0x3ee5caf3
xor ecx, 0x32f8318c
cmp word [rax + 0x18], cx
jne 0x1401987e8
mov r14d, dword [rax + 0x88]
add r14, rsi
je 0x1401987e8
mov r15d, dword [r14 + 0x1c]
add r15, rsi
mov r12d, dword [r14 + 0x24]
add r12, rsi
mov r13d, dword [r14 + 0x20]
add r13, rsi
mov edi, ebp
cmp dword [r14 + 0x18], 0
jbe 0x1401987ac
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
mov ecx, dword [r13 + rax*4]
add rcx, rsi
movzx eax, word [r12 + rax*2]
mov edx, dword [r15 + rax*4]
add rdx, rsi
cmp rcx, 0xffff
jbe 0x1401987a0
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r9
xchg rcx, rsi
mov rsi, qword [rbx + 0x38]
xchg rcx, rsi
test rcx, rcx
je 0x14019886e
mov rax, qword [rcx]
lea rdx, [rsp + 0xa8]
mov qword [rsp + 0x20], rdx
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
test al, al
je 0x1401987ac
xchg r8, r15
mov r15, qword [rsp + 0xb0]
xchg r8, r15
xchg r9, r8
mov r8, qword [rsp + 0xa0]
xchg r8, r9
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x14019870d
xchg rdi, rcx
mov rdi, qword [rbx + 0x38]
xchg rcx, rdi
test rcx, rcx
je 0x1401987d5
cmp rcx, rbx
mov rax, qword [rcx]
setne dl
call qword [rax + 0x20]
xchg r14, rbp
mov qword [rbx + 0x38], r14
xchg r14, rbp
mov al, 0x51
add al, 1
sub al, 0x46
add al, 0x21
add al, 0x26
xor al, 0xe
sub al, 0x5c
jmp 0x140198811
xchg r9, rcx
mov r9, qword [rbx + 0x38]
xchg rcx, r9
test rcx, rcx
je 0x14019880f
xchg r15, rax
mov r15, qword [rcx]
xchg r15, rax
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], rbp
xor al, al
add rsp, 0x58
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
mov r14, qword [rsp - 8]
nop
add rsp, 8
xchg qword [rsp - 8], r13
push rcx
push rdx
push rdx
push rcx
xchg qword [rsp + 0x20], r12
add rsp, 0x28
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
mov rbp, qword [rsp - 8]
push rdx
push rcx
push rdx
xchg qword [rsp + 0x18], rbx
pop rdx
pop rcx
pop rdx
add rsp, 8
ret
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
nop
int3
Function at 0x1401990a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
nop
sub rsp, 8
mov qword [rsp], rdi
nop
push 0x67c08798
mov qword [rsp], r13
sub rsp, 0x30
xor ebx, ebx
mov r13d, r8d
xchg r13, rdi
mov r13, rdx
xchg r13, rdi
test rdx, rdx
jne 0x1401990d7
mov eax, ebx
jmp 0x14019911c
mov eax, 0x440e47ef
xor eax, 0x71bf39de
sub eax, 0x9c8a789
add eax, 0x18e0f19d
add eax, 0xbcdc8da
xor eax, 0x6df870dc
sub eax, 0x3d6f8776
cmp word [rdx], ax
je 0x14019910b
mov rax, rbx
jmp 0x14019911c
movsxd rax, dword [rdx + 0x3c]
add rax, rdi
cmp dword [rax], 0x4550
cmovne rax, rbx
xchg rcx, rbp
mov qword [rsp + 0x50], rcx
xchg rbp, rcx
mov ecx, 0x35d3de3e
add ecx, 0x2cd0f8e9
xor ecx, 0x72db3007
add ecx, 0x2e19d674
xor ecx, 0x4eb3a662
add ecx, 0xb6fadfa
xor ecx, 0x7b99cbfb
xchg rsi, r8
mov qword [rsp + 0x58], r8
xchg r8, rsi
mov qword [rsp + 0x60], r12
xchg r14, r12
mov qword [rsp + 0x28], r12
xchg r14, r12
xchg r12, r15
mov qword [rsp + 0x20], r12
xchg r15, r12
cmp word [rax + 0x18], cx
jne 0x1401991ea
mov esi, dword [rax + 0x88]
add rsi, rdi
je 0x1401991ea
mov r14d, dword [rsi + 0x1c]
mov r15d, dword [rsi + 0x24]
add r14, rdi
mov r12d, dword [rsi + 0x20]
add r15, rdi
add r12, rdi
cmp dword [rsi + 0x18], 0
jbe 0x1401991ea
nop dword [rax]
nop dword [rax + rax]
mov eax, ebx
xor edx, edx
mov ecx, dword [r12 + rax*4]
movzx eax, word [r15 + rax*2]
add rcx, rdi
mov ebp, dword [r14 + rax*4]
add rbp, rdi
call fcn.1400761d0
cmp eax, r13d
je 0x14019923a
inc ebx
cmp ebx, dword [rsi + 0x18]
jb 0x1401991ba
xor eax, eax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
push rbx
push rax
push rax
push rcx
xchg qword [rsp + 0x20], r13
add rsp, 0x28
push rbx
xchg qword [rsp + 8], rdi
pop rbx
add rsp, 8
push rdx
push rcx
push rdx
push rdx
push rcx
push rax
push rcx
xchg qword [rsp + 0x38], rbx
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]
xchg rbp, rax
mov rbp, rax
xchg rbp, rax
jmp 0x1401991ec
Function at 0x1401aaf20
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xchg r11, r13
mov r13, rdx
xchg r11, r13
xchg r11, r10
mov r11, rcx
xchg r10, r11
test rdx, rdx
je 0x1401aafa4
mov qword [rsp], rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1401aaf91
movzx eax, byte [r10]
test bl, bl
je 0x1401aaf73
lea rcx, [r9 - 1]
xchg r9, r8
mov rdx, r8
xchg r9, r8
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1401aaf62
jmp 0x1401aaf91
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1401aaf82
inc r10
sub r11, 1
jne 0x1401aaf44
xchg rbx, r15
mov r15, qword [rsp]
xchg r15, rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x1401ae140
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rcx
mov qword [rsp + 8], rcx
xchg rbx, rcx
xchg r13, rsi
mov qword [rsp + 0x10], r13
xchg r13, rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
xchg rdi, r8
mov r8, rdi
xchg r8, rdi
xchg rsi, rdx
mov rbx, rsi
xchg rdx, rsi
xchg rcx, rdx
mov rsi, rdx
xchg rdx, rcx
test r8, r8
je 0x1401ae8e1
nop
mov qword [rcx], rdx
Function at 0x1401aff20
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
xchg r14, rbx
mov qword [rsp + 8], r14
xchg r14, rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1e31172c
add eax, 0x4de1b55e
sub eax, 0x681dc43a
xor eax, 0x144a8974
xor eax, 0x29354312
add eax, 0x2a66d470
xor eax, 0x5eb71b88
xor eax, 0x36469e9e
call fcn.1401fce70
sub rsp, rax
mov ebx, edx
mov edi, ecx
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rsp + 0x24], eax
mov r9d, 0x6e4588b9
sub r9d, 0x68b0ec0f
add r9d, 0x351a1b2b
add r9d, 0x28a8545b
sub r9d, 0x2008f2f8
xor r9d, 0x24c65151
xor r9d, 0x4f0088c0
sub r9d, 0x2888c0a8
mov dword [rsp + 0x13a4], 0x618d4ea1
sub dword [rsp + 0x13a4], 0x3be76c90
add dword [rsp + 0x13a4], 0x52158cd
sub dword [rsp + 0x13a4], 0x28fe4621
add dword [rsp + 0x13a4], 0x715fda5e
sub dword [rsp + 0x13a4], 0x64d7831c
sub dword [rsp + 0x13a4], 0x927a291
add dword [rsp + 0x13a4], 0xfad65691
nop dword [rax + rax]
mov r8d, eax
shr r8d, 3
shr r8d, 0x1a
shr r8d, 1
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, 0x270
jb 0x1401b0007
mov ebp, 0x453a00d6
xor ebp, 0x43bd86cf
xor ebp, 0x1263b9c8
add ebp, 0x17bfe48b
xor ebp, 0x787efaea
xor ebp, 0x36212a89
sub ebp, 0x54ec09d9
add ebp, 0x71f0159a
mov dword [rsp + 0x20], 0x6e6cc355
sub dword [rsp + 0x20], 0x63c10663
add dword [rsp + 0x20], 0x501912ea
sub dword [rsp + 0x20], 0x34e29969
add dword [rsp + 0x20], 0x1177278c
xor dword [rsp + 0x20], 0x497fa89c
sub dword [rsp + 0x20], 0x7e26f2f3
cmp edi, ebp
lea rax, [rsp + 0x20]
xchg r8, rax
mov qword [rsp + 0x13d0], r8
xchg r8, rax
lea rcx, [rsp + 0x13d0]
lea eax, [rdi - 0x80000000]
lea esi, [rdi + rbp]
cmovae esi, eax
lea edi, [rbx + rbp]
cmp ebx, ebp
lea eax, [rbx - 0x80000000]
cmovae edi, eax
sub edi, esi
cmp edi, 0xffffffff
jne 0x1401b00ea
call fcn.1401b0390
mov ecx, eax
jmp 0x1401b0142
inc edi
mov ebx, edi
call fcn.1401b0390
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jae 0x1401b013a
mov eax, edi
xor edx, edx
neg eax
div edi
mov edi, edx
cmp ecx, edx
jae 0x1401b013a
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x13d0]
call fcn.1401b0390
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jb 0x1401b011f
shr rcx, 0x12
shr rcx, 0xe
lea edx, [rsi + rcx]
lea r11, [rsp + 0x13b0]
cmp edx, ebp
xchg r13, rbx
mov r13, qword [r11 + 0x10]
xchg r13, rbx
lea eax, [rdx + rbp]
xchg rbp, r8
mov r8, qword [r11 + 0x18]
xchg rbp, r8
lea ecx, [rdx - 0x80000000]
xchg r9, rsi
mov r9, qword [r11 + 0x28]
xchg r9, rsi
cmovae eax, ecx
mov rsp, r11
push rcx
push rcx
push rbx
push rbx
xchg qword [rsp + 0x20], rdi
pop rbx
pop rbx
pop rcx
pop rcx
add rsp, 8
ret
Function at 0x1401b0390
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
xchg r10, r9
mov r9, qword [rcx]
xchg r9, r10
mov r9d, 0xfd54d4
xor r9d, 0x13373bb6
xor r9d, 0x175814e6
xor r9d, 0x826dcd9
xor r9d, 0x7f3b05ad
xor r9d, 0x83894da
xor r9d, 0x7bb7345a
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x1401b0429
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1401b03e4
mov ecx, dword [r10]
jmp 0x1401b0580
cmp ecx, 0x4e0
jb 0x1401b0580
lea r11, [r10 + 0x9c4]
xchg rbx, rdx
mov qword [rsp], rdx
xchg rbx, rdx
mov eax, dword [r11]
mov ebx, 0x64a8f8b8
add ebx, 0xbf6034
sub ebx, 0x4ded35c9
xor ebx, 0x8d078db
add ebx, 0x5a2cc0ef
xor ebx, 0x4b30ad81
add ebx, 0x461f2c24
sub ebx, 0x7907dca7
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b0478
lea r11, [r10 + 0xd50]
mov ebx, 0x1caa6fa5
xor ebx, 0x7864818f
xor ebx, 0x22918901
sub ebx, 0x1031f9db
add ebx, 0x46695c81
sub ebx, 0x231b9e7b
sub ebx, 0x22eb54f1
sub ebx, 0x288bce97
xor ebx, 0xe040642
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401b04fc
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
xchg rcx, rbx
mov rcx, qword [rsp]
xchg rbx, rcx
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 2
shr ecx, 5
shr ecx, 3
shr ecx, 1
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 3
shl eax, 1
shl eax, 1
shl eax, 1
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xe
shl eax, 1
xor edx, eax
mov eax, edx
shr eax, 2
shr eax, 1
shr eax, 0xa
shr eax, 1
shr eax, 1
shr eax, 3
xor eax, edx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401ba250
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b9850
xchg rdx, rdi
mov rdi, qword [rbx + 0x28]
xchg rdi, rdx
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b9835
mov r8, qword [rcx - 8]
nop
sub rdx, 0xfbb41fb
add rdx, 0xfbb4222
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b9866
xchg rbp, rcx
mov rbp, r8
xchg rbp, rcx
call fcn.1401fcb00
xor eax, eax
mov qword [rbx + 0x18], rax
xchg rdx, rax
mov qword [rbx + 0x20], rdx
xchg rdx, rax
xchg rsi, rax
mov qword [rbx + 0x28], rsi
xchg rsi, rax
lea rcx, [rbx + 8]
add rsp, 0x20
nop
xchg qword [rsp], rbx
add rsp, 8
jmp 0x1401ba250
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xchg rbx, r11
mov qword [rsp + 0x10], r11
xchg rbx, r11
push rsi
sub rsp, 0x20
xchg rdx, rbx
mov rdx, qword [rcx]
xchg rbx, rdx
mov rsi, rcx
xchg rdi, rax
mov rdi, qword [rbx + 8]
xchg rdi, rax
mov qword [rax], 0x5364d3e4
sub qword [rax], 0x2e6862b3
add qword [rax], 0x349a629c
sub qword [rax], 0x17ef9db0
add qword [rax], 0x18f11909
xor qword [rax], 0x5a984f26
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401ba326
mov qword [rsp + 0x30], rdi
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rdx, [rbx + 0x10]
mov rcx, rsi
call fcn.1401b3350
mov edx, 0x5476e3ca
sub edx, 0x1346505
sub edx, 0x32b5552c
add edx, 0x377ac87d
xor edx, 0x11b261b2
sub edx, 0xc82c9d1
add edx, 0x13f465fa
add edx, 0xaef299b
sub edx, 0x5c165918
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.1401fcb00
xchg rdi, r13
mov rbx, r13
xchg rdi, r13
test rdi, rdi
jne 0x1401ba2b7
xchg r12, rdi
mov r12, qword [rsp + 0x30]
xchg r12, rdi
xchg r13, rcx
mov r13, qword [rsi]
xchg rcx, r13
mov edx, 0x5576c660
xor edx, 0x3d11dc48
sub edx, 0x57d4068b
add edx, 0x27e61793
sub edx, 0x10aaa7ab
xor edx, 0x27ce83d5
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
push rdx
push rdx
push rbx
push rdx
push rcx
push rax
push rbx
xchg qword [rsp + 0x38], rsi
add rsp, 0x40
jmp fcn.1401fcb00
Function at 0x1401ba370
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
xchg r12, rcx
mov rbx, r12
xchg r12, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b98cf
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b98b4
mov r8, qword [rcx - 8]
sub rdx, 0xffffffffffffffd9
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b98e6
mov rcx, r8
call fcn.1401fcb00
xor eax, eax
mov qword [rbx + 0x18], rax
xchg r11, rax
mov qword [rbx + 0x20], r11
xchg r11, rax
xchg r15, rax
mov qword [rbx + 0x28], r15
xchg r15, rax
lea rcx, [rbx + 8]
add rsp, 0x20
nop
add rsp, 8
mov rbx, qword [rsp - 8]
jmp 0x1401ba370
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xchg rbx, r11
mov qword [rsp + 0x10], r11
xchg rbx, r11
push rsi
sub rsp, 0x20
mov rbx, qword [rcx]
xchg rsi, r9
mov r9, rcx
xchg rsi, r9
mov rax, qword [rbx + 8]
mov qword [rax], 0x500d2cfb
xor qword [rax], 0x322fe8fb
xor qword [rax], 0x3bdfbe4
sub qword [rax], 0x3616c663
xor qword [rax], 0x76674029
add qword [rax], 0x20e018f2
xor qword [rax], 0x41aadfd2
sub qword [rax], 0x51ec583
sub qword [rax], 0x3a46c7c5
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401ba448
mov qword [rsp + 0x30], rdi
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rcx, [rbx + 0x10]
call fcn.1401ba4a0
mov edx, 0x191a2f81
add edx, 0x60d61549
xor edx, 0x2ab2b9c1
xor edx, 0xeb8a76a
add edx, 0xc01e529
sub edx, 0x3e87c1fa
sub edx, 0x21bfc767
sub edx, 0x9b4b5e9
xchg rcx, rbx
mov rbx, rcx
xchg rcx, rbx
call fcn.1401fcb00
mov rbx, rdi
test rdi, rdi
jne 0x1401ba3e8
xchg rbp, rdi
mov rbp, qword [rsp + 0x30]
xchg rdi, rbp
xchg r14, rcx
mov r14, qword [rsi]
xchg rcx, r14
mov edx, 0x2daadf4e
xor edx, 0x2c327e61
xor edx, 0x5a3f5398
sub edx, 0xfce6648
sub edx, 0x1271ec4a
sub edx, 0x2a6e248a
xor edx, 0xef97bdb
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
nop
mov rsi, qword [rsp]
add rsp, 8
jmp fcn.1401fcb00
Function at 0x1401bcdf0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
xchg r12, rbx
mov r12, rcx
xchg rbx, r12
je 0x1401bcf9d
cmp byte [rcx + 0x71], 0
je 0x1401bcf9d
mov rax, qword [rcx]
mov edx, 0x611efabe
sub edx, 0x3a4d16be
sub edx, 0x1b19b2a5
add edx, 0x136df721
sub edx, 0x1c0e8db0
add edx, 0x2014376
add edx, 0x13cdf4f9
add edx, 0xe7192cc4
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1401bcf7f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1401bceda
sub eax, 1
je 0x1401bcef6
cmp eax, 2
jne 0x1401bcf7f
xchg r12, rdi
mov r12, qword [rsp + 0x68]
xchg rdi, r12
mov al, 0x25
add al, 0x27
xor al, 0x1d
add al, 0x23
xor al, 0x20
add al, 0x25
sub al, 0x78
mov byte [rbx + 0x71], 7
add byte [rbx + 0x71], 9
xor byte [rbx + 0x71], 0x2b
xor byte [rbx + 0x71], 0x16
add byte [rbx + 0x71], 0x4c
sub byte [rbx + 0x71], 0x70
xor byte [rbx + 0x71], 0x7d
sub byte [rbx + 0x71], 0x74
add rsp, 0x50
nop
xchg qword [rsp], rbx
add rsp, 8
ret
mov byte [rbx + 0x71], 0x47
sub byte [rbx + 0x71], 0xd
xor byte [rbx + 0x71], 0x6a
xor byte [rbx + 0x71], 0x53
add byte [rbx + 0x71], 0x79
sub byte [rbx + 0x71], 0x76
sub byte [rbx + 0x71], 6
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x1401bcf5c
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 0x4b31f8bd
add edx, 0x2c1f1fad
sub edx, 0x3a830ddd
add edx, 0x40311b64
xor edx, 0x52ba7747
sub edx, 0x2c13b3aa
add edx, 0x4146971d
xor edx, 0x5a9afbaf
sub edx, 0x19e2cd85
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1401bcf7f
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
nop
add rsp, 8
mov rbx, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
nop
add rsp, 8
xchg qword [rsp - 8], rbx
nop
add rsp, 8
jmp qword [rsp - 8]
mov al, 0x1f
xor al, 0
xor al, 0x39
add al, 0x16
add al, 8
sub al, 0x43
add rsp, 0x50
nop
xchg qword [rsp], rbx
add rsp, 8
ret
Function at 0x1401c2b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push r12
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov esi, r9d
mov r15, r8
mov r14d, edx
mov r12, rcx
cmp edx, 0x1002
je 0x1401c2c43
movdqa xmm0, xmmword [0x140004680]
lea rax, [rbp + 0x98]
mov dword [rsp + 0x28], 4
lea r8, [rbp - 0x60]
mov r9d, 0x78
movq qword [rbp + 0x10], xmm0
mov edx, 0x1002
mov qword [rsp + 0x20], rax
movups xmmword [rbp - 0x60], xmm0
mov dword [rbp + 0x98], 0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
call fcn.1401c2b80
mov ecx, dword [rbp + 0x98]
test ecx, ecx
jne 0x1401c2c2a
cmp eax, 0xc00000c2
jne 0x1401c2c43
mov ecx, 0xffffff
mov dword [r12], ecx
mov eax, 0xc00000c2
add rsp, 0x160
pop r15
pop r14
pop r12
pop rsi
pop rbp
ret
mov qword [rsp + 0x1a0], rbx
lea rcx, [0x140004640]
mov qword [rsp + 0x158], rdi
mov qword [rsp + 0x150], r13
jmp loc.1403d174e