joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14042607b
Capabilities:
Encode data using xor

Disassembly:
setns r10b
mov r15, qword [rsp + 0xb0]
add qword [rsp + 0x80], 0x4d291ce9
sub word [rsp + 0xb8], 0x685c
call fcn.1400ecc46
mov ecx, 0x84775e2
fistp word [rax]
cmp ebp, edi
mov eax, 0x6f32ef68
push rsp
fcmovnb st(0), st(0)
adc byte [rax + 0x10], dl
adc byte [rax], bh
outsd dx, dword [rsi]
imul edx, dword [rcx - 0x75], 0x34
out dx, eax
and byte [rsi], dl
cmp byte [rdi + 0x3a], bpl
and eax, 0x33ef383b
invalid

Function at 0x14045a330
Capabilities:
Encode data using xor

Disassembly:
setg r10b
add r10, r10
push rsi
push r13
movabs r13, 0x700d35335c3f3a50
mov r10, qword [rsp + 0x30]
mov qword [rsp + 0x30], rax
call fcn.1403e97a2

Function at 0x140496ac1
Capabilities:
Query environment variable

Disassembly:
push r9
mov rbp, qword [rsp + 0x30]
mov rbp, qword [rbp + riz]
mov r9, qword [rsp + 0x18]
lea r9, [r9*4 + 0x7d9518ec]
jns 0x1402f6cde
setg byte [rsp + 0x18]
lea rbp, [rbp + 0x6e4645ad]
mov qword [rsp + 0x30], r9
call fcn.14058a9de

Function at 0x140496af6
Capabilities:
Query environment variable

Disassembly:
mov r10, qword [rsp + 0x20]
call fcn.1401ef915

Function at 0x140496b00
Capabilities:
Query environment variable

Disassembly:
call fcn.1403781b8
add qword [rsp + 0x30], 0xffffffffbfc89b7a
test qword [rsp + 0x50], r15
setne byte [rsp + 0x50]
neg word [rsp + 0x50]
sub qword [rsp + 0x50], 0x703a3676
mov rdi, qword [rsp + 0x40]
call fcn.1400f23b9

Function at 0x140496b30
Capabilities:
Query environment variable

Disassembly:
push r10
call fcn.1402e34ec
adc cl, dl
and al, 0xb8
cmp byte [rax - 0x26], 0x7b
mov ebx, 0x8e5484dd
fldcw word [rbp - 0x13]
shr byte [rsi + 0x71a14b84], 1
invalid
mov rbx, rcx
jbe 0x140165db2
setns bl
mov rbx, qword [rsp + 0x18]
lea rbx, [rbx + 1]
lea rcx, [rcx + rcx*2 + 0x47b26007]
lea rcx, [rcx*4 + 0x28e37590]
seto cl
jge 0x1405bce64
xor cl, 0x55
call fcn.140390e6a
push rbx
mov rsi, qword [rsp + rbx - 0x6954238a]
sets bl
jne 0x1403e26e7
mov ebp, 0x829e7d89
outsd dx, dword [rsi]
pop rbp
nop
lahf
pushfq
scasd eax, dword [rdi]
invalid

Function at 0x1404aed80
Capabilities:
Encode data using xor

Disassembly:
and r10w, 0x4db6
lea rdx, [rdx + r14*2 - 0x409b1ff7]

Function at 0x1404b321b
Capabilities:
Encode data using xor

Disassembly:
jbe 0x1403117f9
add qword [rsp + 0x18], 0xe212e
movabs rdx, 0x50872245427434a1
movabs rbx, 0x6f3b604568a915e7
mov rdx, qword [rsp]
lea rsp, [rsp + 0x18]
ret
invalid
add qword [rsp], 0xffffffffbfa879ca
call fcn.1402985f5
div word [rbx + 0x31]
xor r13d, dword [rsi]
push rdi
xor dword [rbx], esp
sbb sp, 0xffc9
push rbp
jae 0x1403117e3
jrcxz 0x14031184b
cld
std
pop rdi
xor dword [rcx + 0x31afad51], edx
sub eax, 0xce1d41a5
or ch, cl
add dword [rdx + 0x11965ce], eax
test dword [rcx], esi
loop 0x1403118a3
std
cmp dh, cl
lodsd eax, dword [rsi]
invalid
adc eax, 0xce1dea57
enter 0x1fb9, 0xffffffffffffffa1
invalid
invalid
mov qword [rsp + 0x48], rbx
jb 0x1402b3a81
Function at 0x1404bcdf6
Capabilities:
Encode data using xor

Disassembly:
push rdx
mov rcx, qword [rsp + 0x38]
mov rcx, qword [rcx]
and r9d, r9d
movabs r8, 0x1d152edb58340a1d
lea rcx, [rcx + 0x4eb46dc7]
movabs rdi, 0x51b764c0123503d9
sub r8w, 0x10b4
setle dil
cmp r15, 0x75462fb6
xchg qword [rsp + 0x68], rcx
movabs rdx, 0x61ba5c6322dd5f7e
not r9
mov qword [rsp + 0x38], r9
jle 0x1404fb670
mov word [rsp + 0x38], 0x82b
xor r15w, word [rsp + 0x38]
mov rdi, qword [rsp + 0x10]
neg r9
call fcn.140587288

Function at 0x1404fa5b4
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rsp + 0x18]
mov qword [rsp + 0x18], 0x17f4ac85
push rsi
call fcn.1404c2b6d
Function at 0x14054a005
Capabilities:
Encode data using xor

Disassembly:
mov rsi, qword [rsp + 0x18]
cmp dword [rsp + 0x48], 0x54c6656f
call fcn.14033bff3

Function at 0x14055045d
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rsp + 0x18]
pushfq
add qword [rsp + 8], 0xffffffffbfb4888e
lea rdx, [rdx + 1]
push r13
movabs r13, 0x55500cb5afb4e22
add qword [rsp + 0x18], 0xffffffffbfb4323c
call fcn.14034fc41

Function at 0x140565db6
Capabilities:
Encode data using xor

Disassembly:
and r10, 0x48c041fd
lea rbp, [rbp + r10*2 + 0x12ce9f31]
and r10w, 0x1281
mov qword [rsp + 0x18], r10
cmp byte [rsp + 0x18], 0x3a
xchg qword [rsp + r10*4 - 0x1ffffe0], rbp
call fcn.140495f6a
cwde
invalid

Function at 0x140566b45
Capabilities:
Encode data using xor

Disassembly:
neg r8
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx]
sub qword [rsp], 0x29f31aa6
lea r8, [r8 + r8*4 + 0x20cc439d]
sub r8w, 0x518c
pop rbp
call fcn.14024b96b
xchg qword [rsp + 0x18], rdx
push r8
movabs r8, 0x749d57950d6a6460
pushfq
sub r8d, 0x22ef3463
add qword [rsp + 0x20], 0xffffffffbfc1e2ec
mov qword [rsp + 0x20], rdx
xor r8b, 0x64
jge 0x140188432
cmp r8w, 0x67a1
push rbp
push 0x39161c6d
add qword [rsp + 0x28], 0x2880f
movabs rdx, 0x16d436e172e72a02
add dl, byte [rsp + 7]
jge 0x140412bac

Function at 0x1405a7e5b
Capabilities:
Encode data using xor

Disassembly:
bswap r8
mov r8, qword [rsp + 0x48]
jno 0x1402261bb
push qword [rsp + 0x50]
popfq
lea rsp, [rsp + 0x60]
ret

Function at 0x1405c660a
Capabilities:
Packed with generic packer

Disassembly:
call fcn.140235fbe
jle 0x14027e35c

Function at 0x1407cfba3
Capabilities:
Encode data using xor

Disassembly:
push qword [rsp + 0x38]
popfq
lea rsp, [rsp + 0x40]
call fcn.140f332a2
je 0x1407cfbca
cmp byte [rbp + 0x24648d48], bl
call fcn.140f332a2
xchg ecx, eax
xchg edx, eax
mov edi, 0x8825f233
mov dl, 0xfe
mov edi, 0xbac1496a
movabs eax, dword [0xbeb6319c1c3eb5c4]
xor dword [rbx - 0x643eb44e], edx
jl 0x1407cfba4
add dword [rbp - 0x7eb80499], r11d
sub cl, byte [rsi + rbp*8 - 0x47]
add cl, byte ds:[rax + rsi + 0xcfdc141]
add byte [rdx + 1], dh
xchg esp, eax
movabs al, byte [0xfeb64cab237eb872]
xor ah, cl
scasb al, byte [rdi]
rol qword [r15 + rdx*4], 0xb1
xor al, 0x32
cmc
mov dl, 0xbe
inc byte [rbp + 0x76]
shr qword [r10 + r14*4 - 0x53febfea], 0x49
invalid
Function at 0x140001550
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r14d, r9d
mov r15, r8
mov rbp, rdx
mov rdi, rcx
mov ecx, dword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rsp + 0x20], 0x40
xor ebx, ebx
mov rcx, 0xffffffffffffffff
xor edx, edx
mov r8, rbp
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
test rax, rax
je 0x140001623
mov rsi, rax
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffffffffffff
mov rdx, rsi
mov r8, rdi
mov r9, rbp
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140001621
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
lea r9, [0x140001540]
xor ebx, ebx
mov rcx, 0xffffffffffffffff
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [r15], rax
test rax, rax
je 0x140001623
test r14d, r14d
je 0x14000161c
mov rcx, rax
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rbx, rsi
jmp 0x140001623
xor ebx, ebx
mov rax, rbx
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140001640
Capabilities:
Check for outputdebugstring error
Print debug messages

Disassembly:
sub rsp, 0x38
mov ecx, 0x457
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, section..rdata
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x457
jne 0x1400016ce
call fcn.140dd0e30
cmp byte [rax + 2], 0
jne 0x1400016ce
test byte [rax + 0xbc], 0x70
jne 0x1400016ce
mov qword [rsp + 0x30], 0xffffffffffffffff
mov rax, qword [0x140dd4488]
mov edx, dword [rax]
mov rax, qword [0x140dd44e0]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov rcx, qword [0x140dd4480]
lea r8, [rsp + 0x30]
mov r9d, 1
call fcn.140001550
test rax, rax
sete al
cmp qword [rsp + 0x30], 0xffffffffffffffff
sete cl
or cl, al
movzx eax, cl
neg eax
add rsp, 0x38
ret
xor ecx, ecx
call sub.msvcrt.dll_exit
int3
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
call fcn.140dd1550
nop
add rsp, 0x20
pop rbp
jmp 0x140001640

Function at 0x1400016e0
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x38
mov ecx, 0x457
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, section..rdata
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x457
jne 0x1400016ce
call fcn.140dd0e30
cmp byte [rax + 2], 0
jne 0x1400016ce
test byte [rax + 0xbc], 0x70
jne 0x1400016ce
mov qword [rsp + 0x30], 0xffffffffffffffff
mov rax, qword [0x140dd4488]
mov edx, dword [rax]
mov rax, qword [0x140dd44e0]
mov eax, dword [rax]
mov dword [rsp + 0x20], eax
mov rcx, qword [0x140dd4480]
lea r8, [rsp + 0x30]
mov r9d, 1
call fcn.140001550
test rax, rax
sete al
cmp qword [rsp + 0x30], 0xffffffffffffffff
sete cl
or cl, al
movzx eax, cl
neg eax
add rsp, 0x38
ret
xor ecx, ecx
call sub.msvcrt.dll_exit
int3
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
call fcn.140dd1550
nop
add rsp, 0x20
pop rbp
jmp 0x140001640
Function at 0x140dd1770
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.140dd2630
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.140dd2630
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]
Function at 0x140dd17e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x140dd70a4]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x140dd1990
mov rax, qword [0x140dd70a8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x140dd182c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x140dd18b7
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x140dd1810
mov rcx, r12
call fcn.140dd2290
mov rbp, rax
test rax, rax
je 0x140dd19ed
mov rax, qword [0x140dd70a8]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call fcn.140dd23c0
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x140dd70a8]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140dd19d2
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x140dd18b0
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x140dd1940
add dword [0x140dd70a4], 1
cmp ebx, 8
jae 0x140dd18e8
test bl, 4
jne 0x140dd19a0
test ebx, ebx
je 0x140dd18d9
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x140dd19c0
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x140dd18d9
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x140dd191a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rdi, qword [0x140dd70a8]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140dd18b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.140dd1770
xor edi, edi
jmp 0x140dd1837
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x140dd18d9
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x140dd18d9
mov rax, qword [0x140dd70a8]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call fcn.140dd1770
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.140dd1770
nop
nop dword [rax]
Function at 0x140dd1f00
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x140dd7100]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140dd70e0]
test rbx, rbx
je 0x140dd1f54
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x140dd1f4b
test r12, r12
je 0x140dd1f4b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x140dd1f30
lea rcx, [0x140dd7100]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x140dd2290
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x140dd4360]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x140dd2309
mov rcx, r10
call fcn.140dd2160
test eax, eax
je 0x140dd2309
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x140dd2306
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x140dd22fd
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x140dd2309
add r8, 0x28
cmp r8, r9
jne 0x140dd22e8
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret
Function at 0x140094d60
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp byte [r8 + 0x19], 0
jne 0x140094dfb
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
movzx ebp, byte [0x140531318]
mov r14d, ebp
not r14d
nop dword [rax]
mov r8, qword [rbx + 0x10]
mov eax, dword [0x1404c7764]
sub eax, ebp
add eax, 0xffff28c2
cdqe
add rax, qword [0x1404c7778]
mov rcx, rdi
mov rdx, rsi
call qword [case.0x1401138cb.0]
mov r15, qword [rbx]
mov eax, dword [0x1404c7760]
not eax
mov ecx, r14d
xor ecx, eax
and eax, ebp
and ecx, r14d
or ecx, eax
mov eax, dword [0x1404c5e68]
add eax, ecx
add eax, 0xba6d587e
cdqe
add rax, qword [0x1404c7770]
mov edx, 0x70
mov rcx, rbx
call qword [case.0x1401138cb.0]
cmp byte [r15 + 0x19], 0
mov rbx, r15
je 0x140094d90
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400a79b0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400a79fc
mov eax, 0xba6e2fbc
add eax, dword [0x1404c5e68]
cmp edx, eax
jne 0x1400a7a89
movzx eax, byte [0x1404c51e0]
movzx ecx, byte [0x1404c5e7c]
add cl, 0xb2
cmp al, cl
je 0x1400a79f4
mov cl, 0xd7
nop
mov al, 0xf
lock cmpxchg byte [0x1404c51e0], cl
je 0x1400a7aec
cmp al, 0xce
jne 0x1400a79e0
lea rax, [0x1404c51d0]
ret
test edx, edx
je 0x1400a7ab8
movzx eax, byte [0x1404c536f]
nop dword [rax + rax]
cmp al, 0x8f
je 0x1400a7b87
movzx ecx, byte [0x1404c5e7c]
lea eax, [rcx - 0x1e]
mov edx, ecx
xor dl, 0x17
and dl, cl
xor cl, 0x68
add dl, dl
add dl, cl
lock cmpxchg byte [0x1404c536f], dl
jne 0x1400a7a10
xor eax, eax
lea rcx, [0x1404c5360]
lea rdx, [0x1403fe950]
nop word [rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
mov r11d, r9d
xor r11b, r10b
and r10b, r9b
not r11b
and r11b, r8b
or r11b, r10b
mov byte [rax + rcx], r11b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1400a7b7f
inc rax
jmp 0x1400a7a50
movzx eax, byte [0x1404c5263]
cmp al, 0x8c
je 0x1400a7ab0
mov cl, 0x4f
nop word cs:[rax + rax]
mov al, 0xfa
lock cmpxchg byte [0x1404c5263], cl
je 0x1400a7b28
cmp al, 0x8c
jne 0x1400a7aa0
lea rax, [0x1404c5240]
ret
movzx eax, byte [0x1404c5289]
cmp al, 0x5e
je 0x1400a7ae4
mov cl, 0x52
nop word cs:[rax + rax]
mov al, 0x6e
lock cmpxchg byte [0x1404c5289], cl
je 0x1400a7b8f
cmp al, 0x5e
jne 0x1400a7ad0
lea rax, [0x1404c5280]
ret
xor eax, eax
lea rcx, [0x1404c51d0]
lea rdx, [0x1403fe7d0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1400a7b6f
inc rax
jmp 0x1400a7b00
xor edx, edx
lea rax, [0x1404c5240]
lea rcx, [0x1403fe830]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x23
jl 0x1400a7b40
mov al, 0x8c
xchg byte [0x1404c5263], al
lea rax, [0x1404c5240]
ret
mov al, 0xce
xchg byte [0x1404c51e0], al
lea rax, [0x1404c51d0]
ret
mov al, 0x8f
xchg byte [0x1404c536f], al
lea rax, [0x1404c5360]
ret
xor eax, eax
lea rcx, [0x1404c5280]
lea rdx, [0x1403fe870]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1400a7bb8
inc rax
jmp 0x1400a7ba0
mov al, 0x5e
xchg byte [0x1404c5289], al
lea rax, [0x1404c5280]
ret
Function at 0x1400a7c90
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400a7ccc
test edx, edx
je 0x1400a7cfc
movzx eax, byte [0x1404c5120]
cmp al, 0x6e
je 0x1400a7cc4
mov cl, 0xaf
nop word cs:[rax + rax]
mov al, 0xb8
lock cmpxchg byte [0x1404c5120], cl
je 0x1400a7d76
cmp al, 0x6e
jne 0x1400a7cb0
lea rax, [0x1404c5110]
ret
test edx, edx
je 0x1400a7d36
movzx eax, byte [0x1404c50e2]
cmp al, 0xd6
je 0x1400a7cf4
mov cl, 0x15
nop dword [rax]
mov al, 0x70
lock cmpxchg byte [0x1404c50e2], cl
je 0x1400a7dcf
cmp al, 0xd6
jne 0x1400a7ce0
lea rax, [0x1404c50d0]
ret
movzx eax, byte [0x1404c52bb]
cmp al, 0xd1
je 0x1400a7d2e
mov cl, 0x50
nop dword [rax]
mov al, 6
lock cmpxchg byte [0x1404c52bb], cl
je 0x1400a7e11
movzx edx, byte [0x1404c5e7c]
add dl, 0xb5
cmp al, dl
jne 0x1400a7d10
lea rax, [0x1404c52b0]
ret
movzx eax, byte [0x1404c5096]
cmp al, 0xc8
je 0x1400a7d6e
mov cl, 0x53
nop word cs:[rax + rax]
mov al, 0xee
lock cmpxchg byte [0x1404c5096], cl
je 0x1400a7e92
movzx edx, byte [0x1404c5e7c]
add dl, 0xac
cmp al, dl
jne 0x1400a7d50
lea rax, [0x1404c5090]
ret
xor edx, edx
lea rax, [0x1404c5110]
lea rcx, [0x1403fe720]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rdx + rax]
xor r9b, r8b
mov byte [rdx + rax], r9b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x10
jl 0x1400a7d90
mov al, 0x6e
xchg byte [0x1404c5120], al
lea rax, [0x1404c5110]
ret
xor eax, eax
lea rcx, [0x1404c50d0]
lea rdx, [0x1403fe6e0]
mov r8d, 0xba6e2fce
nop word cs:[rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1404c5e68]
add r10d, r8d
cmp r9d, r10d
jge 0x1400a7e7b
inc rax
jmp 0x1400a7df0
xor edx, edx
lea rax, [0x1404c52b0]
lea rcx, [0x1403fe8a0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
mov r8d, dword [0x1404c5e68]
mov r9d, r8d
xor r9d, 0xba6e2fc7
and r8d, 0x3a6e2fc7
lea r8d, [r9 + r8*2]
cmp edx, r8d
jl 0x1400a7e30
mov al, 0xd1
xchg byte [0x1404c52bb], al
lea rax, [0x1404c52b0]
ret
movzx eax, byte [0x1404c5e7c]
add al, 0xba
xchg byte [0x1404c50e2], al
lea rax, [0x1404c50d0]
ret
xor edx, edx
lea rax, [0x1404c5090]
lea rcx, [0x1403fe6a0]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, dword [0x1404c5e68]
add edx, r8d
add edx, 0xba6e2fbd
cmp edx, 6
jl 0x1400a7eb0
mov al, 0xc8
xchg byte [0x1404c5096], al
lea rax, [0x1404c5090]
ret
Function at 0x1400a9320
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1400a937c
test edx, edx
je 0x1400a93bc
movzx eax, byte [0x1404c5166]
movzx ecx, byte [0x1404c5e7c]
xor r8b, 0xe2
mov edx, r8d
xor dl, cl
and r8b, cl
add r8b, r8b
add r8b, dl
cmp al, r8b
je 0x1400a9374
mov cl, 0x21
nop dword [rax + rax]
mov al, 0x59
lock cmpxchg byte [0x1404c5166], cl
je 0x1400a946d
cmp al, 0x9c
jne 0x1400a9360
lea rax, [0x1404c5150]
ret
test edx, edx
je 0x1400a93ec
movzx eax, byte [0x1404c51f9]
mov ecx, r8d
xor cl, 0xf4
add cl, byte [0x1404c5e7c]
cmp al, cl
je 0x1400a93b4
mov cl, 0xdd
nop dword [rax]
mov al, 0xe4
lock cmpxchg byte [0x1404c51f9], cl
je 0x1400a94b8
cmp al, 0xb2
jne 0x1400a93a0
lea rax, [0x1404c51f0]
ret
movzx eax, byte [0x1404c534f]
cmp al, 0xa6
je 0x1400a93e4
mov cl, 0xce
nop dword [rax]
mov al, 0x31
lock cmpxchg byte [0x1404c534f], cl
je 0x1400a94fb
cmp al, 0xa6
jne 0x1400a93d0
lea rax, [0x1404c5340]
ret
movzx eax, byte [0x1404c5108]
nop word cs:[rax + rax]
cmp al, 0x72
je 0x1400a9465
movzx ecx, byte [0x1404c5e7c]
mov eax, r8d
xor al, 0xee
add al, cl
mov edx, r8d
xor dl, 0x2f
add dl, cl
lock cmpxchg byte [0x1404c5108], dl
jne 0x1400a9400
xor eax, eax
lea rcx, [0x1404c50f0]
lea rdx, [0x1403fe700]
xor r8d, 0x712cf4df
nop dword [rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
mov r9d, dword [0x1404c5e68]
add r9d, r8d
add eax, r9d
cmp eax, 0x18
jl 0x1400a9440
mov al, 0x72
xchg byte [0x1404c5108], al
lea rax, [0x1404c50f0]
ret
xor eax, eax
lea rcx, [0x1404c5150]
lea rdx, [0x1403fe750]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x15
jg 0x1400a94a8
inc rax
jmp 0x1400a9480
mov al, 0x9c
xchg byte [0x1404c5166], al
lea rax, [0x1404c5150]
ret
xor eax, eax
lea rcx, [0x1404c51f0]
lea rdx, [0x1403fe7e0]
xor r8d, 0x712cf4a7
nop
movzx r9d, byte [rax + rdx]
xor byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x1404c5e68]
mov r11d, r8d
xor r11d, r10d
and r10d, r8d
lea r10d, [r11 + r10*2]
cmp r9d, r10d
jge 0x1400a9528
inc rax
jmp 0x1400a94d0
xor eax, eax
lea rcx, [0x1404c5340]
lea rdx, [0x1403fe930]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1400a9538
inc rax
jmp 0x1400a9510
mov al, 0xb2
xchg byte [0x1404c51f9], al
lea rax, [0x1404c51f0]
ret
mov al, 0xa6
xchg byte [0x1404c534f], al
lea rax, [0x1404c5340]
ret
Function at 0x1400aa880
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call fcn.1403a1560
nop
add rsp, 0x28
ret

Function at 0x1400aae30
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rax, qword [0x140521398]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov ebx, dword [0x1405315b8]
mov dword [rcx], edx
cmp dword [rcx + 4], edx
ja 0x1400aaf76
mov esi, edx
mov rdi, rcx
add rdi, 4
mov eax, dword [0x1404c8910]
add eax, ebx
add eax, 0xf983
cdqe
add rax, qword [0x1404c8928]
mov ecx, 0x4bd17701
call qword [case.0x1401138cb.0]
mov ecx, dword [0x140531588]
mov edx, dword [0x1404d3e94]
mov eax, ecx
sub eax, edx
add eax, 0x634c645b
imul eax, ecx
mov ecx, edx
xor ecx, 0x9cb39ba6
and edx, 0x1cb39ba6
lea ecx, [rcx + rdx*2]
xor edx, edx
div ecx
test edx, edx
jne 0x1400aaf30
mov eax, dword [0x1404c8908]
xor eax, ebx
add eax, 0xf983
cdqe
add rax, qword [0x1404c8938]
lea r8, [rsp + 0x24]
mov ecx, esi
mov rdx, rdi
mov r9d, 0xb062456b
call qword [case.0x1401138cb.0]
mov ecx, dword [rsp + 0x24]
mov eax, ebx
xor eax, ebx
not eax
and eax, dword [0x1404c8900]
xor eax, ebx
mov edx, dword [0x1404d3e94]
mov r8d, edx
xor r8d, 0x9cb2a221
and edx, 0x1cb2a221
lea edx, [r8 + rdx*2]
sub eax, edx
cdqe
add rax, qword [0x1404c8930]
mov edx, 0x7c5973a7
call qword [case.0x1401138cb.0]
test al, 1
jne 0x1400aaf76
nop word cs:[rax + rax]
mov dword [rdi], esi
mov eax, dword [0x1404c8904]
sub eax, ebx
add eax, 0xf983
cdqe
add rax, qword [0x1404c8940]
mov ecx, dword [0x1404d3e94]
mov edx, ecx
xor edx, 0x660f9b69
and ecx, 0x660f9b69
lea edx, [rdx + rcx*2]
add edx, 0x9eb069d6
xor ecx, ecx
call qword [case.0x1401138cb.0]
test al, 1
je 0x1400aaf30
jmp 0x1400aaeb2
xor esi, esi
nop dword [rax + rax]
test sil, sil
jne 0x1400aafb0
mov ecx, dword [0x14053158c]
mov eax, dword [0x1404c890c]
xor eax, ebx
add eax, 0xf983
cdqe
add rax, qword [0x1404c8920]
mov edx, 0xbde8c9df
call qword [case.0x1401138cb.0]
test al, 1
jne 0x1400aafbd
mov eax, dword [0x14053158c]
cmp eax, 0x60
jge 0x1400aaf80
jmp 0x1400aaf85
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1403bbdf0
nop
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret