joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000d210
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x18000d246
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x18000d293
test rsi, rsi
jle 0x18000d293
mov rax, qword [rbx + 0x58]
mov r15d, dword [rax]
test r15d, r15d
jle 0x18000d293
cmp r15, rsi
cmovae r15, rsi
mov rdx, rdi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x58]
sub dword [rax], r15d
mov rax, qword [rbx + 0x40]
add qword [rax], r15
test r14, r14
jg 0x18000d29b
jmp 0x18000d2bb
mov r14, rsi
test r14, r14
jle 0x18000d2bb
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x18000d2bb
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub r14, rax
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x18000d6b0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rax, qword [0x180047700]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov dil, 1
cmp qword [rcx + 0x68], 0
je 0x18000d75a
mov rsi, rcx
cmp byte [rcx + 0x71], 0
je 0x18000d75a
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18000d758
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x18000d771
cmp eax, 1
je 0x18000d727
test eax, eax
jne 0x18000d758
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x18000d74e
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x18000d758
cmp byte [rsi + 0x71], 0
sete dil
jmp 0x18000d75a
xor edi, edi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180035d50
mov eax, edi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
ret
mov byte [rsi + 0x71], 0
mov dil, 1
jmp 0x18000d75a

Function at 0x180010210
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov eax, 0x84222325
sub r8, rdx
je 0x180010267
xor ecx, ecx
nop dword [rax]
movzx r9d, byte [rdx + rcx]
mov r10d, r9d
not r10d
mov r11d, r10d
and r11d, 0x56
mov esi, r9d
and esi, 0xffffffa9
or esi, r11d
xor esi, eax
xor esi, 0xa9
or esi, r10d
not eax
or eax, r9d
and esi, 0x80026ff
xor esi, eax
xor esi, 0xf7ffd900
imul eax, esi, 0x1b3
inc rcx
cmp r8, rcx
jne 0x180010220
pop rsi
ret
Function at 0x180013660
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov ebp, edx
mov rsi, rcx
mov edi, 1
cmp edx, 0x3a
je 0x18001368f
xor edi, edi
cmp ebp, 0x3d
je 0x18001368f
xor eax, eax
cmp ebp, 0x2e
mov edi, 0xe
cmove edi, eax
mov rbx, qword [rsi]
xor r14d, r14d
movabs r15, 0x4800800000000001
jmp 0x1800136c1
mov rax, rcx
nop word cs:[rax + rax]
inc rax
mov qword [rsi], rax
mov rcx, rsi
call fcn.180010850
inc r14
mov eax, dword [rsi + 0x7c]
lea ecx, [rax + 1]
cmp ecx, 0x3e
ja 0x1800136d2
bt r15, rcx
jb 0x180013719
mov rax, qword [rsi]
mov rdx, qword [rsi + 0x10]
cmp rax, rdx
je 0x1800136b6
cmp byte [rax], 0x5c
jne 0x1800136b0
lea rcx, [rax + 1]
cmp rcx, rdx
je 0x1800136b0
mov edx, dword [rsi + 0x80]
test dl, 8
jne 0x180013705
movzx r8d, byte [rcx]
and r8b, 0xfe
cmp r8b, 0x28
je 0x1800136a1
test dl, 0x10
jne 0x1800136b0
movzx edx, byte [rcx]
cmp edx, 0x7d
je 0x1800136a1
cmp edx, 0x7b
je 0x1800136a1
jmp 0x1800136b0
cmp eax, ebp
jne 0x180013892
cmp ebp, 0x3a
jne 0x180013785
mov r8, qword [rsi]
mov rcx, qword [rsi + 0x68]
mov eax, dword [rsi + 0x70]
mov edx, eax
and edx, 0x577c7dcc
mov r9d, eax
and r9d, 0xa8838233
or r9d, 0x512c74c0
xor r9d, edx
or eax, 0x100
xor r9d, 0xaed38a3f
test r9d, eax
setne r9b
mov rdx, rbx
call fcn.180012830
test ax, ax
je 0x180013899
lea rcx, [rsi + 0x40]
mov rdx, qword [rsi + 0x48]
mov r8d, eax
xor r9d, r9d
call fcn.180012af0
jmp 0x1800137d4
cmp ebp, 0x2e
je 0x1800137ac
cmp ebp, 0x3d
jne 0x1800137d4
mov r8, qword [rsi]
cmp rbx, r8
je 0x1800138a3
lea rcx, [rsi + 0x40]
mov rdx, rbx
mov r9, r14
call fcn.1800138b0
jmp 0x1800137d4
mov r8, qword [rsi]
cmp rbx, r8
je 0x1800138a3
lea rcx, [rsi + 0x40]
mov rax, qword [rsi + 0x48]
add rax, 0x20
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov r9, r14
call fcn.180013d70
mov rax, qword [rsi]
mov rdx, qword [rsi + 0x10]
cmp rax, rdx
je 0x180013822
cmp byte [rax], 0x5c
jne 0x18001381c
lea rcx, [rax + 1]
cmp rcx, rdx
je 0x18001381c
mov edx, dword [rsi + 0x80]
test dl, 8
jne 0x180013807
movzx r8d, byte [rcx]
and r8b, 0xfe
cmp r8b, 0x28
je 0x180013819
test dl, 0x10
jne 0x18001381c
movzx edx, byte [rcx]
cmp edx, 0x7d
je 0x180013819
cmp edx, 0x7b
jne 0x18001381c
mov rax, rcx
inc rax
mov qword [rsi], rax
mov rcx, rsi
call fcn.180010850
cmp dword [rsi + 0x7c], 0x5d
jne 0x180013892
mov rax, qword [rsi]
mov rdx, qword [rsi + 0x10]
cmp rax, rdx
je 0x18001387e
cmp byte [rax], 0x5c
jne 0x180013878
lea rcx, [rax + 1]
cmp rcx, rdx
je 0x180013878
mov edx, dword [rsi + 0x80]
test dl, 8
jne 0x180013863
movzx r8d, byte [rcx]
and r8b, 0xfe
cmp r8b, 0x28
je 0x180013875
test dl, 0x10
jne 0x180013878
movzx edx, byte [rcx]
cmp edx, 0x7d
je 0x180013875
cmp edx, 0x7b
jne 0x180013878
mov rax, rcx
inc rax
mov qword [rsi], rax
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp fcn.180010850
mov ecx, edi
call sub.MSVCP140.dll_void___cdecl_std::_Xregex_error_enum_std::regex_constants::error_type_
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Xregex_error_enum_std::regex_constants::error_type_
xor ecx, ecx
call sub.MSVCP140.dll_void___cdecl_std::_Xregex_error_enum_std::regex_constants::error_type_
int3
Function at 0x180019650
Capabilities:
Encode data using xor

Disassembly:
add rcx, 0x20
jmp method.std::runtime_error.virtual_8
Function at 0x18001a8f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, rcx
mov rax, qword [0x180047700]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp qword [rcx + 0x20], 0
jne 0x18001a920
mov rcx, rsi
call fcn.18001ab30
test al, al
je 0x18001a97e
nop dword [rax]
mov rcx, rsi
call fcn.18001ad10
cmp byte [rsi + 0x10], 0
mov eax, dword [rsi + 0x14]
je 0x18001a947
cmp eax, 0x2f
jne 0x18001a947
mov rcx, rsi
call fcn.18001adf0
test al, al
jne 0x18001a920
jmp 0x18001aa2f
inc eax
cmp eax, 0x7e
ja case.0x18001a960.1
lea rcx, [0x18003c02c]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180035d50
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.18001c930
cmp byte [0x180047c62], 0
jne 0x18001aa1a
mov rax, qword [0x180046810]
movabs r8, 0xed7f1445207d573a
add r8, rax
movabs r9, 0xed7f1445207d571c
add r9, rax
xor ecx, ecx
movabs r10, 0x8888888888888889
lea r11, [0x180047c35]
nop
mov rax, rcx
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe2
add rax, r9
movzx edx, byte [r8 + rcx]
movzx eax, byte [rcx + rax]
not al
mov ebx, edx
or bl, al
and al, dl
mov edx, ebx
and dl, 0xac
or dl, 0x13
and bl, 0x53
xor bl, dl
mov edx, ebx
xor dl, 0x40
mov edi, eax
xor dil, 0xac
xor bl, 0xbf
and bl, dil
xor al, 0x53
and al, dl
or al, bl
mov byte [rcx + r11], al
inc rcx
cmp rcx, 0x2d
jne 0x18001a9c0
mov byte [0x180047c62], 1
movabs rax, 0xed7f1445207d4654
add rax, qword [0x180046818]
mov qword [rsi + 0x70], rax
mov esi, 0xe
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180035d50
mov eax, esi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
mov esi, 0xf
jmp 0x18001aa34
movabs rcx, 0xed7f1445207d577d
add rcx, qword [0x180046810]
call fcn.180031e10
movabs rax, 0xed7f1445207d4654
add rax, qword [0x180046838]
jmp 0x18001aa2b
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180035d50
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
jmp fcn.18001b410
mov esi, 0xd
jmp 0x18001aa34
mov esi, 0xc
jmp 0x18001aa34
mov esi, 8
jmp 0x18001aa34
mov esi, 0xa
jmp 0x18001aa34
mov byte [rsp + 0x24], 0x65
mov dword [rsp + 0x20], 0x736c6166
lea rdx, [rsp + 0x20]
mov r8d, 5
mov rcx, rsi
mov r9d, 2
jmp 0x18001ab10
mov dword [rsp + 0x20], 0x6c6c756e
lea rdx, [rsp + 0x20]
mov r8d, 4
mov rcx, rsi
mov r9d, 3
jmp 0x18001ab10
mov dword [rsp + 0x20], 0x65757274
lea rdx, [rsp + 0x20]
mov r8d, 4
mov rcx, rsi
mov r9d, 1
call fcn.18001b2d0
mov esi, eax
jmp 0x18001aa34
mov esi, 9
jmp 0x18001aa34
mov esi, 0xb
jmp 0x18001aa34
Function at 0x1800316e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
cmp byte [0x180047ad9], 0
jne 0x18003175c
xor r8d, r8d
movabs r9, 0xe38e38e38e38e38f
lea r10, [0x180047ac1]
nop
mov rax, r8
mul r9
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
lea rdx, [rcx + r8]
sub rdx, rax
movzx eax, byte [rcx + r8 + 0x12]
movzx edx, byte [rdx]
mov r11d, eax
not r11b
and r11b, dl
not dl
and dl, al
mov eax, r11d
xor al, 0xca
mov ebx, edx
xor bl, 0xca
xor r11b, 0x35
and r11b, bl
xor dl, 0x35
and dl, al
or dl, r11b
mov byte [r8 + r10], dl
inc r8
cmp r8, 0x18
jne 0x180031700
mov byte [0x180047ad9], 1
pop rbx
ret

Function at 0x180031760
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x180047b01], 0
jne 0x18003187f
lea rdx, [rcx + 0x29]
lea rax, [0x180047af0]
cmp rdx, rax
jbe 0x180031790
lea rdx, [0x180047b01]
cmp rcx, rdx
jae 0x180031790
xor edx, edx
jmp 0x180031820
movdqu xmm0, xmmword [rcx]
movdqu xmm2, xmmword [rcx + 0x18]
pcmpeqd xmm3, xmm3
movdqa xmm1, xmm2
pxor xmm1, xmm3
por xmm1, xmm0
pxor xmm0, xmm3
por xmm0, xmm2
movdqa xmm2, xmmword [str.UUUUUUUUUUUUUUUU]
movdqa xmm3, xmm0
pxor xmm3, xmm2
movdqa xmm4, xmmword [0x18003a800]
movdqa xmm5, xmm1
pand xmm1, xmm2
por xmm1, xmmword [0x18003a810]
pand xmm5, xmm4
pxor xmm1, xmm5
movdqa xmm2, xmmword [0x18003a820]
pxor xmm2, xmm1
pxor xmm0, xmm4
pand xmm0, xmm2
pxor xmm1, xmmword [0x18003a830]
pand xmm1, xmm3
por xmm1, xmm0
movdqa xmmword [0x180047af0], xmm1
mov edx, 0x10
nop word cs:[rax + rax]
movzx r8d, byte [rcx + rdx]
movzx r9d, byte [rcx + rdx + 0x18]
mov r10d, r9d
not r10b
or r10b, r8b
not r8b
or r8b, r9b
mov r9d, r8d
xor r9b, 0x55
mov r11d, r10d
and r11b, 0xaa
and r10b, 0x55
or r10b, 0x2a
xor r10b, r11b
mov r11d, r10d
xor r11b, 0x7f
xor r8b, 0xaa
and r8b, r11b
add r10b, 0x80
and r10b, r9b
or r10b, r8b
mov byte [rdx + rax], r10b
inc rdx
cmp rdx, 0x11
jne 0x180031820
mov byte [0x180047b01], 1
ret
Function at 0x180031e10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x180047c80], 0
jne 0x180031edc
lea rdx, [rcx + 0x25]
lea rax, [0x180047c70]
cmp rdx, rax
jbe 0x180031e87
lea rdx, [0x180047c80]
cmp rcx, rdx
jae 0x180031e87
xor edx, edx
nop dword [rax + rax]
movzx r8d, byte [rcx + rdx + 0x15]
mov r9d, r8d
and r9b, 0xc0
or r9b, 0x25
mov r10d, r8d
and r10b, 0x3f
xor r10b, r9b
mov r9d, r8d
xor r9b, 0xc0
xor r8b, 0x3f
or r8b, r9b
xor r10b, 0xe5
and r10b, r8b
xor r10b, byte [rcx + rdx]
xor r10b, 0xc0
mov byte [rdx + rax], r10b
inc rdx
cmp rdx, 0x10
jne 0x180031e40
jmp 0x180031ed5
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x15]
movaps xmm2, xmmword [0x18003a6e0]
movaps xmm3, xmm1
andps xmm3, xmm2
orps xmm3, xmmword [str.________________________________]
movaps xmm4, xmmword [0x18003a910]
movaps xmm5, xmm1
andps xmm5, xmm4
xorps xmm5, xmm3
movaps xmm3, xmm1
xorps xmm3, xmm2
xorps xmm1, xmm4
orps xmm1, xmm3
xorps xmm5, xmmword [0x18003a920]
andps xmm5, xmm1
xorps xmm0, xmm2
xorps xmm0, xmm5
movaps xmmword [0x180047c70], xmm0
mov byte [0x180047c80], 1
ret

Function at 0x180031ee0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp byte [0x180047cff], 0
jne 0x180031f9e
xor r8d, r8d
movabs r9, 0x47ae147ae147ae15
lea r10, [0x180047cd9]
nop word cs:[rax + rax]
mov rax, r8
mul r9
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffe7
lea rdx, [rcx + r8]
movzx eax, byte [rax + rdx]
mov edx, eax
and dl, 0x95
or dl, 0x40
mov r11d, eax
and r11b, 0x6a
xor r11b, dl
mov edx, r11d
xor dl, 0xa
and r11b, 0x4a
xor r11b, 0x40
or r11b, dl
and al, 0x4a
mov edx, eax
not dl
xor al, dl
and al, r11b
xor al, dl
or dl, r11b
and dl, 0x5b
xor dl, al
mov eax, edx
xor al, 0x5b
mov r11d, edx
xor r11b, 0xa4
or r11b, al
xor dl, 0x1c
and dl, r11b
xor dl, byte [rcx + r8 + 0x19]
xor dl, 0xf2
mov byte [r8 + r10], dl
inc r8
cmp r8, 0x26
jne 0x180031f10
mov byte [0x180047cff], 1
ret

Function at 0x180032820
Capabilities:
Encode data using xor

Disassembly:
push rbx
cmp byte [0x18004813a], 0
jne 0x18003289a
xor r8d, r8d
movabs r9, 0x4924924924924925
lea r10, [0x1800480ec]
nop
mov rax, r8
shr rax, 2
mul r9
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
lea rdx, [rcx + r8]
movzx r11d, byte [rcx + r8 + 0x1c]
movzx eax, byte [rax + rdx]
mov edx, r11d
and dl, 0x42
and r11b, 0xbd
or dl, 0x85
xor dl, r11b
mov r11d, eax
xor r11b, 0xbd
mov ebx, eax
xor bl, 0x42
or bl, r11b
xor al, 0xd6
and al, bl
xor al, dl
xor al, 0x53
mov byte [r8 + r10], al
inc r8
cmp r8, 0x4e
jne 0x180032840
mov byte [0x18004813a], 1
pop rbx
ret
Function at 0x180033300
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rbx
cmp byte [0x180048775], 0
jne 0x18003337e
xor r8d, r8d
movabs r9, 0x642c8590b21642c9
lea r10, [0x18004874f]
nop
mov rax, r8
mul r9
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffe9
lea rdx, [rcx + r8]
movzx r11d, byte [rcx + r8 + 0x17]
movzx eax, byte [rax + rdx]
not al
mov edx, r11d
and dl, al
or al, r11b
mov r11d, eax
xor r11b, 0xaf
mov ebx, edx
xor bl, 0x50
xor al, 0x50
and al, bl
xor dl, 0xaf
and dl, r11b
or dl, al
mov byte [r8 + r10], dl
inc r8
cmp r8, 0x26
jne 0x180033320
mov byte [0x180048775], 1
pop rbx
ret

Function at 0x180033380
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x18004879f], 0
jne 0x1800333d8
xor eax, eax
lea rdx, [0x180048776]
nop word cs:[rax + rax]
movzx r8d, byte [rcx + rax + 0x10]
mov r9d, eax
and r9d, 0xf
movzx r9d, byte [rcx + r9]
mov r10d, r9d
not r10b
or r10b, r8b
not r8b
or r8b, r9b
xor r8b, r10b
mov byte [rax + rdx], r8b
inc rax
cmp rax, 0x29
jne 0x1800333a0
mov byte [0x18004879f], 1
ret

Function at 0x1800333e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
cmp byte [0x180048840], 0
jne 0x180033482
xor eax, eax
lea rdx, [0x18004883a]
nop dword [rax + rax]
movzx r9d, byte [rcx + rax + 0x19]
mov r8d, r9d
not r8b
mov r10d, r9d
or r10b, 0x2f
and r8b, 0xd0
mov r11d, r9d
xor r11b, 0x2f
or r8b, r11b
mov ebx, r8d
and bl, 0xb5
mov esi, r8d
and sil, 0x48
and r11b, 2
or r11b, 0xb4
xor r11b, bl
or r11b, sil
mov ebx, r9d
or bl, 0x24
and bl, 0xf4
xor bl, r11b
xor bl, 0xbf
or r9b, 0xd
and r9b, 0xdd
xor r9b, r8b
xor r9b, 0x22
and r8b, r10b
or r8b, r9b
not r8b
or r8b, bl
xor r8b, byte [rcx + rax]
xor r8b, 0xd0
mov byte [rax + rdx], r8b
inc rax
cmp rax, 6
jne 0x180033400
mov byte [0x180048840], 1
pop rbx
pop rsi
ret

Function at 0x180033880
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
cmp byte [0x1800488f2], 0
jne 0x180033973
xor eax, eax
lea rdx, [0x1800488eb]
nop dword [rax]
movzx r11d, byte [rcx + rax]
movzx r8d, byte [rcx + rax + 0x1b]
mov r9d, r11d
not r9b
mov ebx, r11d
or bl, 0xe5
and r9b, 0x1a
mov edi, r11d
xor dil, 0xe5
or r9b, dil
mov r10d, r8d
xor r10b, 0x1a
mov r14d, r11d
or r14b, 0xa0
and r14b, 0xba
lea esi, [r14 + 0x45]
xor r14b, 0x7a
and r14b, sil
mov ebp, r9d
xor bpl, 0x3f
and bpl, dil
mov edi, r14d
xor dil, bl
and dil, 0x1b
xor dil, 0xdb
not bl
and bl, r14b
or bl, dil
mov edi, r9d
and dil, 0x3f
xor dil, bpl
mov ebp, edi
not bpl
xor dil, 0xc0
and dil, bl
not bl
and bl, bpl
and r11b, 2
mov ebp, esi
and bpl, 0x5d
or bpl, r11b
xor bpl, r9b
xor bpl, 0xa0
and r9b, sil
or r9b, bpl
not r9b
or r9b, dil
or r9b, bl
mov r11d, r8d
xor r11b, 0xa0
and r11b, r10b
and r10b, 0x9a
and r8b, 0x20
or r8b, r10b
xor r8b, r11b
xor r8b, r9b
mov byte [rax + rdx], r8b
inc rax
cmp rax, 7
jne 0x1800338a0
mov byte [0x1800488f2], 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x180033980
Capabilities:
Encode data using xor

Disassembly:
push rbx
cmp byte [0x18004890b], 0
jne 0x180033a1f
xor r8d, r8d
movabs r9, 0xe38e38e38e38e38f
lea r10, [0x1800488f3]
nop word cs:[rax + rax]
mov rax, r8
mul r9
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
lea rdx, [rcx + r8]
sub rdx, rax
movzx eax, byte [rdx]
mov edx, eax
not dl
mov r11d, eax
or r11b, 0x6d
or dl, 0x92
mov ebx, eax
and bl, 0x61
xor r11b, dl
and dl, 0x1e
or dl, bl
mov ebx, eax
or bl, 0x60
and bl, 0xf2
xor bl, dl
xor al, 0x6d
or al, r11b
xor bl, 0x13
mov edx, ebx
xor dl, al
or bl, al
not bl
or bl, dl
xor bl, byte [rcx + r8 + 0x12]
xor bl, 0x92
mov byte [r8 + r10], bl
inc r8
cmp r8, 0x18
jne 0x1800339b0
mov byte [0x18004890b], 1
pop rbx
ret

Function at 0x180033a30
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
cmp byte [0x18004894b], 0
jne 0x180033b1f
xor r8d, r8d
movabs r9, 0x8618618618618619
lea r10, [0x18004891a]
nop dword [rax]
mov rax, r8
mul r9
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffeb
lea rdx, [rcx + r8]
movzx eax, byte [rax + rdx]
mov edx, eax
or dl, 0x97
mov ebx, edx
not bl
mov r11d, eax
and r11b, 0x97
mov edi, ebx
and dil, 8
mov esi, eax
xor sil, 4
and sil, r11b
mov ebp, eax
and bpl, 4
mov r14d, esi
not r14b
mov r15d, eax
or r15b, r14b
and r14b, 0xa6
and sil, 0x11
or sil, r14b
or bpl, 0xc2
xor bpl, sil
not r15b
and r15b, 4
or r15b, bpl
mov esi, eax
and sil, 0x60
or sil, dil
xor sil, r15b
and bl, 0x28
and dl, 0xc0
or dl, bl
xor dl, r11b
xor dl, 0xc0
xor al, 0x97
or al, dl
xor sil, 0xfb
mov edx, esi
xor dl, al
or sil, al
not sil
or sil, dl
xor sil, byte [rcx + r8 + 0x15]
xor sil, 0x68
mov byte [r8 + r10], sil
inc r8
cmp r8, 0x31
jne 0x180033a60
mov byte [0x18004894b], 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x180033b30
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x10
movaps xmmword [rsp], xmm6
cmp byte [0x180048981], 0
jne 0x180033c10
lea rdx, [rcx + 0x25]
lea rax, [0x180048970]
cmp rdx, rax
jbe 0x180033b66
lea rdx, [0x180048981]
cmp rcx, rdx
jae 0x180033b66
xor edx, edx
jmp 0x180033bc0
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x14]
movaps xmm2, xmmword [0x18003a950]
movaps xmm3, xmm1
xorps xmm3, xmm2
xorps xmm2, xmm0
movaps xmm4, xmmword [str.________________cccccccccccccccc]
xorps xmm1, xmm4
andps xmm3, xmm1
movaps xmm5, xmmword [0x18003a970]
movaps xmm6, xmm0
andps xmm6, xmm5
xorps xmm0, xmm4
andps xmm0, xmm2
andps xmm3, xmm5
orps xmm3, xmm1
xorps xmm6, xmm4
orps xmm6, xmm0
xorps xmm6, xmm3
movaps xmmword [0x180048970], xmm6
mov edx, 0x10
nop dword [rax + rax]
movzx r8d, byte [rcx + rdx]
movzx r9d, byte [rcx + rdx + 0x14]
mov r10d, r9d
xor r10b, 3
mov r11d, r8d
xor r11b, 3
xor r9b, 0x60
and r10b, r9b
mov ebx, r8d
and bl, 0x63
xor r8b, 0x60
and r8b, r11b
and r10b, 0x63
or r10b, r9b
xor bl, 0x60
or bl, r8b
xor bl, r10b
mov byte [rdx + rax], bl
inc rdx
cmp rdx, 0x11
jne 0x180033bc0
mov byte [0x180048981], 1
movaps xmm6, xmmword [rsp]
add rsp, 0x10
pop rbx
ret
Function at 0x180033c70
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rbx
cmp byte [0x1800489e0], 0
jne 0x180033d0f
xor r8d, r8d
movabs r9, 0x642c8590b21642c9
lea r10, [0x1800489c7]
nop word cs:[rax + rax]
mov rax, r8
mul r9
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rax, rax, 0xffffffffffffffe9
lea rdx, [rcx + r8]
movzx r11d, byte [rcx + r8 + 0x17]
movzx eax, byte [rax + rdx]
not al
mov edx, r11d
or dl, al
and al, r11b
mov r11d, edx
and r11b, 0x81
or r11b, 0x2a
and dl, 0x7e
xor dl, r11b
mov r11d, edx
xor r11b, 0xab
mov ebx, eax
xor bl, 0x7e
xor dl, 0x54
and dl, bl
xor al, 0x81
and al, r11b
or al, dl
mov byte [r8 + r10], al
inc r8
cmp r8, 0x19
jne 0x180033ca0
mov byte [0x1800489e0], 1
pop rbx
ret

Function at 0x180033d20
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
cmp byte [0x180048bbb], 0
jne 0x180033deb
xor r8d, r8d
movabs r9, 0x47ae147ae147ae15
lea r10, [0x180048b88]
nop word [rax + rax]
mov rax, r8
mul r9
mov rax, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul rdx, rax, 0xffffffffffffffe7
lea r11, [rcx + r8]
movzx eax, byte [rcx + r8 + 0x19]
movzx edx, byte [rdx + r11]
mov ebx, eax
not bl
and bl, dl
mov esi, edx
not sil
and sil, al
mov r11d, esi
not r11b
mov edi, r11d
mov ebp, ebx
xor r11b, bl
xor bl, 0xf4
and dil, 2
mov r14d, esi
and r14b, 9
or r14b, dil
and sil, 0xf4
or r14b, 0xd0
xor r14b, sil
mov esi, r14d
xor sil, 0x26
xor bpl, 0xb
and bpl, sil
xor r14b, 0xd9
and r14b, bl
xor al, dl
or al, r11b
not al
or al, r14b
or al, bpl
mov byte [r8 + r10], al
inc r8
cmp r8, 0x33
jne 0x180033d50
mov byte [0x180048bbb], 1
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14020e840
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14020e84d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14020e85d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14020e845
lea eax, [rcx + 1]
jmp 0x14020e86b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14020e87e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14020e864
sub eax, 3
jb 0x14020e89e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14020e8ed
sar eax, 1
movsxd rbp, eax
jb 0x14020e8d4
jmp 0x14020e8ac
add ebx, ebx
jne 0x14020e8aa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14020e8d4
inc ecx
add ebx, ebx
jne 0x14020e8ba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14020e8d4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14020e8cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14020e8bc
add ecx, 2
jmp 0x14020e8d9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14020e802
jmp 0x14020e84d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x94600
mov dl, 0x16
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14020e939
cmp rsi, rcx
jae 0x14020e941
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14020e920
cmp al, 0x8f
ja 0x14020e920
cmp byte [rsi - 2], 0xf
je 0x14020e926
sub al, 0xe8
cmp al, 1
ja 0x14020e90a
cmp rsi, rcx
jae 0x14020e941
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14020e910
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14020e941
lodsb al, byte [rsi]
jmp 0x14020e920
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x20b000]
mov eax, dword [rdi]
or eax, eax
je 0x14020e99e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x20e000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14020e94e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14020e998
mov qword [rbx], rax
add rbx, 8
jmp 0x14020e96e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14020e9d8
cmp al, 0xef
ja 0x14020e9ca
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14020e9aa
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14020e9b9
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1a7]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14020ea57], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14020ea57
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14020ea47
sub rsp, 0xffffffffffffff80
jmp 0x14000fac0