joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140038ad0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov r9d, 0x6c078965
mov r8d, 0xffffffff
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.140039bd0
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x140040d20
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x270
jne 0x140040d42
mov rcx, qword [rsp + 0x40]
call fcn.140040df0
jmp 0x140040d59
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4e0
jb 0x140040d59
mov rcx, qword [rsp + 0x40]
call fcn.140040ea0
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4 + 4]
mov dword [rsp + 0x24], eax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
inc eax
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov eax, dword [rsp + 0x24]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0xb
mov rcx, qword [rsp + 0x40]
and eax, dword [rcx + 0x1384]
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 7
and eax, 0x9d2c5680
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shl eax, 0xf
and eax, 0xefc60000
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
shr eax, 0x12
mov ecx, dword [rsp + 0x20]
xor ecx, eax
mov eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x140040df0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp + 8], 0x270
jmp 0x140040e11
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x4e0
jae 0x140040e95
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 - 0x9bc]
and eax, 0x80000000
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 - 0x9b8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp], eax
mov eax, dword [rsp]
and eax, 1
test eax, eax
je 0x140040e60
mov dword [rsp + 4], 0x9908b0df
jmp 0x140040e68
mov dword [rsp + 4], 0
mov eax, dword [rsp]
shr eax, 1
xor eax, dword [rsp + 4]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140040e04
add rsp, 0x18
ret
Function at 0x140040ea0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x28], 0x26f
mov qword [rsp + 0x30], 0xe3
mov qword [rsp], 0
jmp 0x140040ed0
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
cmp qword [rsp], 0xe3
jae 0x140040f52
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x10], eax
mov eax, dword [rsp + 0x10]
and eax, 1
test eax, eax
je 0x140040f1e
mov dword [rsp + 0x14], 0x9908b0df
jmp 0x140040f26
mov dword [rsp + 0x14], 0
mov eax, dword [rsp + 0x10]
shr eax, 1
xor eax, dword [rsp + 0x14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
xor eax, dword [rcx + rdx*4 + 0xff8]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140040ec5
mov qword [rsp + 8], 0xe3
jmp 0x140040f6a
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
cmp qword [rsp + 8], 0x26f
jae 0x140040ff1
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 8]
mov eax, dword [rax + rcx*4 + 0x9c4]
and eax, 0x80000000
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov ecx, dword [rcx + rdx*4 + 0x9c8]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x18], eax
mov eax, dword [rsp + 0x18]
and eax, 1
test eax, eax
je 0x140040fbb
mov dword [rsp + 0x1c], 0x9908b0df
jmp 0x140040fc3
mov dword [rsp + 0x1c], 0
mov eax, dword [rsp + 0x18]
shr eax, 1
xor eax, dword [rsp + 0x1c]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
xor eax, dword [rcx + rdx*4 - 0x388]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 8]
mov dword [rcx + rdx*4 + 4], eax
jmp 0x140040f5d
mov qword [rsp + 0x38], 0x26f
mov eax, 4
imul rax, rax, 0x4df
mov rcx, qword [rsp + 0x50]
mov eax, dword [rcx + rax + 4]
and eax, 0x80000000
mov ecx, 4
imul rcx, rcx, 0
mov rdx, qword [rsp + 0x50]
mov ecx, dword [rdx + rcx + 4]
btr ecx, 0x1f
or eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 1
test eax, eax
je 0x140041045
mov dword [rsp + 0x24], 0x9908b0df
jmp 0x14004104d
mov dword [rsp + 0x24], 0
mov eax, dword [rsp + 0x20]
shr eax, 1
xor eax, dword [rsp + 0x24]
mov ecx, 4
imul rcx, rcx, 0x18c
mov rdx, qword [rsp + 0x50]
xor eax, dword [rdx + rcx + 4]
mov ecx, 4
imul rcx, rcx, 0x26f
mov rdx, qword [rsp + 0x50]
mov dword [rdx + rcx + 4], eax
mov rax, qword [rsp + 0x50]
mov dword [rax], 0
add rsp, 0x48
ret
Function at 0x140053910
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x14012e4e0]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x10], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x10], 0
je 0x14005399e
mov eax, dword [rsp]
shr eax, 8
mov ecx, dword [rsp]
and ecx, 0xff
mov rdx, qword [rsp + 8]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x18]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
mov eax, dword [rsp + 4]
mov dword [rsp], eax
jmp 0x140053942
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret

Function at 0x1400539b0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov eax, dword [rsp + 0x40]
not eax
mov dword [rsp + 0x40], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 8], rax
lea rax, [0x14012e4e0]
mov qword [rsp + 0x10], rax
cmp qword [rsp + 0x38], 0
je 0x140053ab4
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x18], rax
mov rax, qword [rsp + 0x38]
dec rax
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x18], 0
je 0x140053aaf
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 2], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 2]
mov byte [rsp + 1], al
movzx eax, byte [rsp + 1]
cmp eax, 0x23
jne 0x140053a84
cmp qword [rsp + 0x38], 2
jb 0x140053a84
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140053a84
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140053a84
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp + 1]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x1400539f7
jmp 0x140053b46
mov rax, qword [rsp + 8]
movzx eax, byte [rax]
mov byte [rsp + 3], al
mov rax, qword [rsp + 8]
inc rax
mov qword [rsp + 8], rax
movzx eax, byte [rsp + 3]
mov byte [rsp], al
movzx eax, byte [rsp]
test eax, eax
je 0x140053b46
movzx eax, byte [rsp]
cmp eax, 0x23
jne 0x140053b1c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140053b1c
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rsp + 8]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x140053b1c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rsp + 4]
shr eax, 8
mov ecx, dword [rsp + 4]
and ecx, 0xff
movzx edx, byte [rsp]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rsp + 0x10]
xor eax, dword [rdx + rcx*4]
mov dword [rsp + 4], eax
jmp 0x140053ab4
mov eax, dword [rsp + 4]
not eax
add rsp, 0x28
ret
Function at 0x1400ad380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov rax, qword [rax + 0x3c18]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x48]
movss xmm0, dword [rax + 0x3c20]
movss dword [rsp + 0x24], xmm0
mov rax, qword [rsp + 0x50]
movss xmm0, dword [rsp + 0x24]
divss xmm0, dword [rax + 0x14]
movss dword [rsp + 0x3c], xmm0
xorps xmm2, xmm2
xorps xmm1, xmm1
mov rcx, qword [rsp + 0x70]
call fcn.14000b990
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x88]
cmp qword [rsp + 0x30], rax
jae 0x1400ad4cf
mov rax, qword [rsp + 0x30]
movzx eax, word [rax]
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x30]
add rax, 2
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x38]
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xa
jne 0x1400ad491
movss xmm1, dword [rsp + 0x20]
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax]
call fcn.14007a950
mov rax, qword [rsp + 0x70]
movss dword [rax], xmm0
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
mov rax, qword [rsp + 0x70]
movss dword [rax + 4], xmm0
xorps xmm0, xmm0
movss dword [rsp + 0x20], xmm0
movzx eax, byte [rsp + 0xa0]
test eax, eax
je 0x1400ad48c
jmp 0x1400ad4cf
jmp 0x1400ad402
cmp dword [rsp + 0x28], 0xd
jne 0x1400ad49d
jmp 0x1400ad402
movzx edx, word [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.1400a4310
mulss xmm0, dword [rsp + 0x3c]
movss dword [rsp + 0x40], xmm0
movss xmm0, dword [rsp + 0x20]
addss xmm0, dword [rsp + 0x40]
movss dword [rsp + 0x20], xmm0
jmp 0x1400ad402
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [rax]
jbe 0x1400ad4ee
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rsp + 0x20]
movss dword [rax], xmm0
cmp qword [rsp + 0x98], 0
je 0x1400ad52a
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
movaps xmm2, xmm0
movss xmm1, dword [rsp + 0x20]
lea rcx, [rsp + 0x58]
call fcn.14000b990
mov rax, qword [rax]
mov rcx, qword [rsp + 0x98]
mov qword [rcx], rax
movss xmm0, dword [rsp + 0x20]
comiss xmm0, dword [0x14013c880]
ja 0x1400ad547
mov rax, qword [rsp + 0x70]
xorps xmm0, xmm0
ucomiss xmm0, dword [rax + 4]
jne 0x1400ad561
mov rax, qword [rsp + 0x70]
movss xmm0, dword [rax + 4]
addss xmm0, dword [rsp + 0x24]
mov rax, qword [rsp + 0x70]
movss dword [rax + 4], xmm0
cmp qword [rsp + 0x90], 0
je 0x1400ad57c
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x30]
mov qword [rax], rcx
mov rax, qword [rsp + 0x70]
add rsp, 0x68
ret
Function at 0x1400da3b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
and eax, 7
test eax, eax
je 0x1400da3e1
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
and eax, 7
mov edx, eax
mov rcx, qword [rsp + 0x50]
call fcn.1400d99c0
mov dword [rsp + 0x20], 0
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
jle 0x1400da43c
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x14]
and eax, 0xff
movsxd rcx, dword [rsp + 0x20]
mov byte [rsp + rcx + 0x28], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x14]
shr eax, 8
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x14], eax
mov rax, qword [rsp + 0x50]
mov eax, dword [rax + 0x10]
sub eax, 8
mov rcx, qword [rsp + 0x50]
mov dword [rcx + 0x10], eax
jmp 0x1400da3e9
mov rax, qword [rsp + 0x50]
cmp dword [rax + 0x10], 0
jge 0x1400da458
lea rcx, str.zlib_corrupt
call fcn.1400ccd20
jmp 0x1400da59c
cmp dword [rsp + 0x20], 4
jge 0x1400da47e
mov rcx, qword [rsp + 0x50]
call fcn.1400d98b0
movsxd rcx, dword [rsp + 0x20]
mov byte [rsp + rcx + 0x28], al
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
jmp 0x1400da458
mov eax, 1
imul rax, rax, 1
movzx eax, byte [rsp + rax + 0x28]
imul eax, eax, 0x100
mov ecx, 1
imul rcx, rcx, 0
movzx ecx, byte [rsp + rcx + 0x28]
add eax, ecx
mov dword [rsp + 0x24], eax
mov eax, 1
imul rax, rax, 3
movzx eax, byte [rsp + rax + 0x28]
imul eax, eax, 0x100
mov ecx, 1
imul rcx, rcx, 2
movzx ecx, byte [rsp + rcx + 0x28]
add eax, ecx
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x24]
xor eax, 0xffff
cmp dword [rsp + 0x2c], eax
je 0x1400da4ee
lea rcx, [0x1401345f8]
call fcn.1400ccd20
jmp 0x1400da59c
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x50]
cmp rax, qword [rcx + 8]
jbe 0x1400da517
lea rcx, str.read_past_buffer
call fcn.1400ccd20
jmp 0x1400da59c
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx + 0x18]
mov rcx, qword [rsp + 0x50]
cmp rax, qword [rcx + 0x28]
jbe 0x1400da550
mov r8d, dword [rsp + 0x24]
mov rax, qword [rsp + 0x50]
mov rdx, qword [rax + 0x18]
mov rcx, qword [rsp + 0x50]
call fcn.1400d9c50
test eax, eax
jne 0x1400da550
xor eax, eax
jmp 0x1400da59c
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x50]
mov rdi, qword [rcx + 0x18]
mov rsi, qword [rdx]
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx]
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x50]
add rax, qword [rcx + 0x18]
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x18], rax
mov eax, 1
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x14011ab08
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
push rbx
call 0x1402c2a14
test rax, rax
je 0x14011ab52
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14011ab52
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14011ab52
mov eax, 0x20b

Function at 0x1401e75a0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1401e75cd
xor al, al
jmp 0x1401e772f
mov rax, qword [0x1402076b0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1402076b8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1402076c0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1402076c8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1402076d0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1402076d8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1402076e0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1402076e8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x1402076f0]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1401e7721
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1401e7679
mov r11d, 2
jmp 0x1401e769d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1401e7693
mov r11d, 1
jmp 0x1401e769d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x1401e7745
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1401e76e2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1401e76fa
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1401e770a
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1401e7718
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x1401e7660
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1401e772a
Function at 0x1801b06f5
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror ax, 0x44
cwde
not bx
mul cx
call fcn.1801cd1d6

Function at 0x1801b0705
Capabilities:
Execute anti-debugging instructions

Disassembly:
movzx eax, dx
lea ecx, [rcx + rbx*2 - 0x21f4dd83]
movsx r11d, al
sar rax, 0x20
mov qword [rsp + rbx - 0x3698eaa0], 0xffffffffbb973b06
ror ecx, 1
sub edx, 0x937d8b3
shr rax, 0x1f
cdq
inc ecx
cwde
btc rbx, r11
setb al
bswap ecx
setb dl
adc ecx, 0x903f7a34
cwd
sal word [rsp + rdx*4 + 6], 0x8c
movzx r9d, dx
rol ecx, 2
not rax
movzx r8d, word [rsp + rdx + 3]
xor ecx, 0x22a551a
dec byte [rsp + rdx*4 + 2]
sal byte [rsp + rdx*4 + 3], 0xc5
bt r8d, eax
mov qword [rsp + rdx], rsi
xor dword [rsp + rdx], ecx
pop rsi
dec bx
movsxd rcx, ecx
shr r11d, 0xe1
rol al, 0x61
add r10, rcx
shr ebx, 0xf6
inc r9
rdtsc
jp 0x1801c321b
lea rbp, [rbp + rbx - 0xe2]
mov dword [rbp + rbx*2 - 0x1b0], eax
mov dword [rbp + rbx*2 - 0x1b4], edx
jae fcn.1801b49bb
mov ebx, 0xa075725
mov r11, qword [rbp + rbx*8 - 0x503ab928]
mov r9, qword [rbp + rbx - 0xa07571d]
movzx edx, bx
xor rdx, rdx
xadd dx, bx
mov cl, byte [rbp + rbx*2 - 0x140dfff0]
js 0x1801d110f
bt bx, 0xa9
lea rbp, [rbx + rbp - 0xa06fff6]
movsx r8d, dx
shld r11, r9, cl
movsx r9d, r8w
bswap rdx
movsx ecx, bl
mov qword [rbp + rbx*2 - 0x140e0000], r11
bt r8w, r9w
sub r8b, 0x83
mov eax, dword [rdi + rbx*2 - 0x140e0000]
cmove rcx, r8
lea rdi, [r8 + rdi - 0x579e]
xor eax, esi
dec r9
shl dl, 0x87
xor eax, 0x84a27606
lea rcx, [r8*4 + 0x113f0eb3]
lea r9, [r9 + rbx*2 - 0x20455854]
dec eax
shl ebx, cl
jns 0x1801cbba8
mov eax, dword [rdi]
add rdi, 4
mov r8d, 0xbb250ebb
movsx ecx, r8w
xor eax, esi
bswap eax
mov edx, r8d
btr edx, r8d
mov r11d, ecx
lea eax, [rax + rcx*2 + 0x32227d1d]
sal r8d, cl
sub r11, rcx
rol eax, 3
neg eax
push rsi
mov r9d, r8d
xor dword [rsp + r11*2], eax
mov esi, r9d
pop rsi
not cx
dec r9d
lea rbx, [rdx + rcx*2 - 0x39e96bfe]
movsxd rax, eax
add r10, rax
mov rbx, qword [rcx + rbp - 0xf144]
shl r9d, 0xfc
or r11b, 0x14
movzx dx, byte [rbx + rcx*2 - 0x1e288]
lea rbp, [rcx + rbp - 0xf13e]
jnp 0x1801b1980
jle 0x1801db8a7
neg r8b
mov word [rcx + rbp - 0xf144], dx
jmp r10
add r10, rax
bswap r8d
xor edx, dword [rbp + r8*2 - 0x20000000]
movzx ecx, r8w
sub cx, r8w
imul r8w, r8w
lea rbp, [r8 + rbp - 0xffffffc]
jae 0x1801e204e
mov dx, word [rbp + rax - 0x513010ae]
mov r11w, word [rbp + rax - 0x513010ac]
lea rbp, [rbp + rax - 0x513010ac]
not dx
movzx ebx, ax
not r11w
rol bl, 0xc7
or dx, r11w
mov r9d, ebx
mov word [rbp + rax - 0x513010ae], dx
cqo
jmp 0x1801a982f
movsx eax, r11w
movzx r8d, byte [r8 + rdi - 0x10000000]
mov ebx, eax
call fcn.1801c49be
Function at 0x14005ab78
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor edx, edx
movdqa xmm0, xmmword [0x140137580]
movdqu xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x140137450]
movdqu xmmword [rbp - 0x50], xmm1
mov dword [rbp - 0x40], 0x303f3e3d
mov word [rbp - 0x3c], 0x31
mov ecx, edx
mov al, byte [rbp - 0x60]
xor byte [rbp + rcx - 0x5f], al
inc rcx
cmp rcx, 0x24
jb 0x14005abba
mov byte [rbp - 0x3b], dl
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
lea rax, [rbp - 0x5f]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dl
jne 0x14005abe4
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x30]
call fcn.140057e48
nop
lea r8, [rbp - 0x30]
mov edx, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.14005a6f4
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x14005ac4b
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005ac46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005ac46
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010a9a0
mov rax, rbx
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rbp
ret
Function at 0x14005af94
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
movdqa xmm0, xmmword [0x140136ec0]
mov rbx, rcx
xor ecx, ecx
mov edx, ecx
movdqu xmmword [rsp + 0x28], xmm0
mov al, byte [rsp + 0x28]
xor byte [rsp + rdx + 0x29], al
inc rdx
cmp rdx, 0xe
jb 0x14005afaf
xorps xmm0, xmm0
mov byte [rsp + 0x37], cl
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rcx
lea rax, [rsp + 0x29]
mov qword [rbx + 0x18], rcx
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], cl
jne 0x14005afdb
lea rdx, [rsp + 0x29]
mov rcx, rbx
call fcn.140057e48
mov rax, rbx
add rsp, 0x40
pop rbx
ret

Function at 0x14005affc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor edx, edx
movdqa xmm0, xmmword [0x140137060]
movdqu xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [0x140137a80]
movdqu xmmword [rbp - 0x50], xmm1
mov dword [rbp - 0x40], 0x7a757477
mov word [rbp - 0x3c], 0x7b
mov ecx, edx
mov al, byte [rbp - 0x60]
xor byte [rbp + rcx - 0x5f], al
inc rcx
cmp rcx, 0x24
jb 0x14005b03e
mov byte [rbp - 0x3b], dl
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
lea rax, [rbp - 0x5f]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dl
jne 0x14005b068
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x30]
call fcn.140057e48
nop
lea r8, [rbp - 0x30]
mov edx, reloc.WS2_32.dll_recv
mov rcx, rbx
call fcn.14005a6f4
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x14005b0cf
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005b0ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005b0ca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010a9a0
mov rax, rbx
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rbp
ret