joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140036844
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x2a0
movsxd rsi, r8d
mov rbx, rdx
cmp esi, 2
jl 0x14003690c
cmp byte [rdx], 0x81
jne 0x14003690c
lea rax, [rsp + 0x30]
xor ebp, ebp
lea r9, [r11 - 0x208]
mov qword [rsp + 0x20], rax
lea r8, [r11 - 0x108]
xor edi, edi
lea rdx, [rsp + 0x68]
call fcn.1400bdfb8
mov al, byte [rsp + 0xa0]
xor r8d, r8d
test al, al
je 0x1400368c9
lea rdx, [rsp + 0xa0]
movsx eax, al
inc rdx
and eax, 0xf
lea ecx, [rax + r8]
mov al, byte [rdx]
add ebp, ecx
xor edi, ecx
inc r8d
cmp al, 0
jne 0x1400368af
movsx eax, byte [rbx + 1]
lea edx, [rbp + 0x1d]
xor edx, edi
add edi, 3
xor eax, edx
cmp al, 0x81
je 0x1400368df
xor eax, eax
jmp 0x140036911
cmp rsi, 2
jle 0x140036906
mov r8, rbx
lea r9, [rsi - 2]
mov cl, byte [r8 + 2]
add edx, 0x1d
xor edx, edi
add edi, 3
xor cl, dl
mov byte [r8], cl
inc r8
sub r9, 1
jne 0x1400368ec
and word [rsi + rbx - 2], 0
mov eax, 1
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140038660
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov rbx, rcx
cmp qword [rcx], 0xffffffffffffffff
je 0x1400387df
add rcx, 0x1038
call fcn.1405893df
nop
nop
mov eax, dword [rbx + 0x1458]
test eax, eax
je 0x1400386b5
cmp dword [rbx + 0x145c], eax
lea rax, [0x14014f0bc]
ja 0x1400386bc
lea rax, [0x14014f0bf]
mov qword [rsp + 0xa8], rax
movzx edi, word [rbx + 0x1046]
movzx esi, word [rbx + 0x1044]
movzx ebp, word [rbx + 0x1042]
movzx r14d, word [rbx + 0x1040]
movzx r15d, word [rbx + 0x103e]
movzx r12d, word [rbx + 0x103a]
movzx r13d, word [rbx + 0x1038]
lea rcx, [0x14014f0c0]
call fcn.140045880
nop
mov rdx, rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r15d
mov r9d, r12d
mov r8d, r13d
lea rcx, [rbx + 0x38]
call fcn.140033efc
nop
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi + 0x38], 0
jne 0x140038740
cmp dword [rbx + 0x1454], 0
je 0x14003877f
movsxd rdx, edi
test edi, edi
jle 0x140038796
lea rcx, [rbx + 0x38]
nop
mov eax, dword [rbx + 0x1454]
add eax, 2
mov dword [rbx + 0x1454], eax
add al, 0x43
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140038760
jmp 0x140038796
lea rcx, [rbx + 0x104c]
lea r9, [rbx + 0x38]
lea r8, [rbx + 0x38]
mov edx, edi
call fcn.14004a1f0
nop
cmp dword [rbx + 0x1458], 0x3e7
je 0x1400387c4
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xa0]
mov r8d, edi
lea rdx, [rbx + 0x38]
mov rcx, qword [rbx]
call fcn.1405946e3
nop
nop
mov rcx, qword [rbx]
call fcn.14058b850
nop
nop
mov rcx, qword [rbx]
call qword [fcn.14010b500]
nop
mov qword [rbx], 0xffffffffffffffff
lea rcx, [rbx + 8]
call fcn.140590248
nop
nop
mov dword [rbx + 0x30], 0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140042d70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
mov eax, 0x1098
call fcn.14008f990
sub rsp, rax
mov rax, qword [0x140157a58]
xor rax, rsp
mov qword [rsp + 0x1050], rax
cmp qword [rcx], 0xffffffffffffffff
mov rdi, rdx
mov rbx, rcx
jne 0x140042db3
xor al, al
jmp 0x140042f6f
mov eax, dword [rcx + 0x1458]
test eax, eax
je 0x140042dd5
cmp byte [rdx], 0x21
je 0x140042dd5
mov ecx, dword [rcx + 0x145c]
cmp ecx, eax
ja 0x140042dac
lea eax, [rcx + 1]
mov dword [rbx + 0x145c], eax
cmp dword [rbx + 0x30], 0
mov qword [rsp + 0x1090], rbp
mov qword [rsp + 0x1088], rsi
mov qword [rsp + 0x1080], r12
mov qword [rsp + 0x1078], r13
mov qword [rsp + 0x1070], r14
mov qword [rsp + 0x1068], r15
je 0x140042e1d
lea rcx, [rbx + 8]
call qword [fcn.14010b150]
mov rdi, qword [rsp + 0x10b8]
lea rsi, [rsp + 0x10c0]
call fcn.140008ecc
or r15, 0xffffffffffffffff
mov qword [rsp + 0x28], rsi
mov r9, rdi
mov qword [rsp + 0x20], 0
mov r8, r15
lea rdx, [rsp + 0x50]
mov rcx, qword [rax]
or rcx, 1
call fcn.1400b92d8
lea rcx, [rbx + 0x1038]
call fcn.1405893df
nop
movzx edi, word [rbx + 0x1046]
lea rcx, [0x14014f118]
movzx esi, word [rbx + 0x1044]
movzx ebp, word [rbx + 0x1042]
movzx r14d, word [rbx + 0x1040]
call fcn.140045880
mov rdx, rax
lea rcx, [rbx + 0x38]
lea rax, [rsp + 0x50]
mov r9d, ebp
mov qword [rsp + 0x30], rax
mov r8d, r14d
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call fcn.140033efc
mov r14, qword [rsp + 0x1070]
mov rsi, qword [rsp + 0x1088]
mov rbp, qword [rsp + 0x1090]
inc r15
cmp byte [rbx + r15 + 0x38], 0
jne 0x140042ec5
cmp dword [rbx + 0x1454], 0
je 0x140042f10
movsxd rdx, r15d
test r15d, r15d
jle 0x140042f27
lea rcx, [rbx + 0x38]
nop word [rax + rax]
mov eax, dword [rbx + 0x1454]
lea rcx, [rcx + 1]
add eax, 2
mov dword [rbx + 0x1454], eax
add al, 0x43
xor byte [rcx - 1], al
sub rdx, 1
jne 0x140042ef0
jmp 0x140042f27
lea rcx, [rbx + 0x104c]
mov edx, r15d
lea r9, [rbx + 0x38]
lea r8, [rbx + 0x38]
call fcn.14004a1f0
mov rcx, qword [rbx]
lea r9, [rsp + 0x40]
mov r8d, r15d
mov qword [rsp + 0x20], 0
lea rdx, [rbx + 0x38]
call fcn.1405946e3
nop
cmp dword [rbx + 0x30], 0
mov r15, qword [rsp + 0x1068]
mov r12, qword [rsp + 0x1080]
je 0x140042f65
lea rcx, [rbx + 8]
call qword [fcn.14010b158]
mov r13, qword [rsp + 0x1078]
mov al, 1
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.140090220
add rsp, 0x1098
pop rdi
pop rbx
ret
Function at 0x140045460
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x830
mov rax, qword [0x140157a58]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov qword [rsp + 0x848], rbx
mov rbx, rcx
call fcn.1400461a0
mov rsi, rax
cmp dword [rax + 0x28], 0
je 0x14004549d
mov rcx, rax
call qword [fcn.14010b150]
mov qword [rsp + 0x858], rdi
test rbx, rbx
jne 0x1400454b1
xor edi, edi
jmp 0x140045661
cmp byte [rbx], 1
jne 0x14004565e
movsx edx, byte [rbx + 1]
movzx eax, dl
add al, al
lea ecx, [rdx + 0x65]
add cl, al
xor byte [rbx + 2], cl
lea ecx, [rdx + rdx*8]
movzx r9d, byte [rbx + 2]
lea eax, [rcx + 0x68]
xor byte [rbx + 3], al
lea edx, [rcx + 4]
movzx eax, byte [rbx + 3]
shl r9d, 8
or r9, rax
jbe 0x140045511
mov r8, rbx
nop dword [rax]
movzx eax, byte [r8 + 4]
lea edx, [rdx + rdx*2]
lea ecx, [rdx + 0x65]
xor al, cl
lea edx, [rdx + 1]
mov byte [r8], al
inc r8
mov rax, r8
sub rax, rbx
cmp rax, r9
jl 0x1400454f0
xor edi, edi
mov byte [r9 + rbx], 0
call fcn.14058f443
nop
mov r8d, eax
lea edx, [rdi + 1]
lea rax, [0x1401632d0]
lea rcx, [0x140163284]
lea r9, [0x140000000]
cmp dword [rcx], r8d
je 0x14004554b
inc edx
add rcx, 4
cmp rcx, rax
jl 0x140045532
jmp 0x140045551
mov edi, edx
test edx, edx
jne 0x14004556e
mov ecx, dword [0x140163270]
cmp ecx, 0x13
jae 0x14004556e
inc ecx
mov dword [0x140163270], ecx
mov edi, ecx
mov dword [r9 + rcx*4 + 0x163280], r8d
mov eax, edi
mov rdi, qword [r9 + rax*8 + 0x1631d0]
mov qword [r9 + rax*8 + 0x1631d0], rbx
test rdi, rdi
je 0x14004565e
cmp rdi, rbx
je 0x14004565e
cmp byte [rbx], 1
je 0x14004565e
cmp byte [rdi], 1
je 0x14004565e
mov r8d, 0x800
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.140597209
nop
lea rcx, [rsp + 0x20]
call fcn.1405922b1
nop
mov r8d, eax
test eax, eax
je 0x14004565e
lea rax, [rsp + 0x20]
mov qword [rsp + 0x850], rbp
movzx ecx, al
mov r11d, 4
mov byte [rdi + 1], cl
mov byte [rdi], 1
lea ecx, [rcx + rcx*2]
lea ebp, [rcx + 0x65]
lea ecx, [rcx + 1]
lea edx, [rcx + rcx*2]
lea r10d, [rdx + 0x65]
inc edx
test r8d, r8d
jle 0x140045639
lea r9, [rsp + 0x20]
mov rax, rdi
sub rax, r9
lea rcx, [rsp + 0x20]
lea r11d, [r8 + 4]
lea r9, [rax + 4]
nop dword [rax]
lea edx, [rdx + rdx*2]
lea eax, [rdx + 0x65]
xor al, byte [rcx]
lea edx, [rdx + 1]
mov byte [r9 + rcx], al
lea rcx, [rcx + 1]
sub r8, 1
jne 0x140045620
movsxd rax, r11d
lea ecx, [r11 - 4]
mov byte [rax + rdi], 0
mov eax, ecx
sar eax, 8
xor al, bpl
mov rbp, qword [rsp + 0x850]
xor r10b, cl
mov byte [rdi + 2], al
mov byte [rdi + 3], r10b
mov rdi, rbx
cmp dword [rsi + 0x28], 0
mov rbx, qword [rsp + 0x848]
je 0x140045678
mov rcx, rsi
call qword [fcn.14010b158]
mov rax, rdi
mov rdi, qword [rsp + 0x858]
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.140090220
add rsp, 0x830
pop rsi
ret
Function at 0x1400456a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x830
mov rax, qword [0x140157a58]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov qword [rsp + 0x858], rdi
mov rdi, rcx
call fcn.1400461a0
mov rsi, rax
cmp dword [rax + 0x28], 0
je 0x1400456dd
mov rcx, rax
call qword [fcn.14010b150]
mov qword [rsp + 0x848], rbx
test rdi, rdi
jne 0x1400456f1
xor ebx, ebx
jmp 0x140045841
cmp byte [rdi], 1
jne 0x14004583e
movsx edx, byte [rdi + 1]
movzx eax, dl
add al, al
lea ecx, [rdx + 0x65]
add cl, al
xor byte [rdi + 2], cl
lea ecx, [rdx + rdx*8]
movzx r9d, byte [rdi + 2]
lea eax, [rcx + 0x68]
xor byte [rdi + 3], al
lea edx, [rcx + 4]
movzx eax, byte [rdi + 3]
shl r9d, 8
or r9, rax
jbe 0x14004574b
xor ebx, ebx
nop dword [rax + rax]
movzx eax, byte [rdi + rbx + 4]
lea edx, [rdx + rdx*2]
lea ecx, [rdx + 0x65]
xor al, cl
lea edx, [rdx + 1]
mov byte [rbx + rdi], al
inc rbx
cmp rbx, r9
jl 0x140045730
mov rbx, qword [0x1401632d0]
mov byte [r9 + rdi], 0
mov qword [0x1401632d0], rdi
test rbx, rbx
je 0x14004583e
cmp rbx, rdi
je 0x14004583e
cmp byte [rdi], 1
je 0x14004583e
cmp byte [rbx], 1
je 0x14004583e
mov r8d, 0x800
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.140597209
nop
lea rcx, [rsp + 0x20]
call fcn.1405922b1
nop
mov r8d, eax
test eax, eax
je 0x14004583e
lea rax, [rsp + 0x20]
mov qword [rsp + 0x850], rbp
movzx ecx, al
mov r11d, 4
mov byte [rbx + 1], cl
mov byte [rbx], 1
lea ecx, [rcx + rcx*2]
lea ebp, [rcx + 0x65]
lea ecx, [rcx + 1]
lea edx, [rcx + rcx*2]
lea r10d, [rdx + 0x65]
inc edx
test r8d, r8d
jle 0x140045819
lea r9, [rsp + 0x20]
mov rax, rbx
sub rax, r9
lea rcx, [rsp + 0x20]
lea r11d, [r8 + 4]
lea r9, [rax + 4]
nop word [rax + rax]
lea edx, [rdx + rdx*2]
lea eax, [rdx + 0x65]
xor al, byte [rcx]
lea edx, [rdx + 1]
mov byte [r9 + rcx], al
lea rcx, [rcx + 1]
sub r8, 1
jne 0x140045800
movsxd rax, r11d
lea ecx, [r11 - 4]
mov byte [rax + rbx], 0
mov eax, ecx
sar eax, 8
xor al, bpl
mov rbp, qword [rsp + 0x850]
xor r10b, cl
mov byte [rbx + 2], al
mov byte [rbx + 3], r10b
mov rbx, rdi
cmp dword [rsi + 0x28], 0
mov rdi, qword [rsp + 0x858]
je 0x140045858
mov rcx, rsi
call qword [fcn.14010b158]
mov rax, rbx
mov rbx, qword [rsp + 0x848]
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.140090220
add rsp, 0x830
pop rsi
ret
Function at 0x140045880
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.1400461a0
mov rdi, rax
cmp dword [rax + 0x28], 0
je 0x1400458a4
mov rcx, rax
call qword [fcn.14010b150]
test rbx, rbx
je 0x140045906
cmp byte [rbx], 1
jne 0x140045906
movsx edx, byte [rbx + 1]
movzx eax, dl
add al, al
lea ecx, [rdx + 0x65]
add cl, al
xor byte [rbx + 2], cl
lea ecx, [rdx + rdx*8]
movzx r9d, byte [rbx + 2]
lea eax, [rcx + 0x68]
xor byte [rbx + 3], al
lea eax, [rcx + 4]
movzx edx, byte [rbx + 3]
shl r9d, 8
or r9, rdx
jbe 0x140045901
mov r8, rbx
movzx ecx, byte [r8 + 4]
lea eax, [rax + rax*2]
lea edx, [rax + 0x65]
xor cl, dl
lea eax, [rax + 1]
mov byte [r8], cl
inc r8
mov rcx, r8
sub rcx, rbx
cmp rcx, r9
jl 0x1400458e0
mov byte [r9 + rbx], 0
cmp dword [rdi + 0x28], 0
je 0x140045915
mov rcx, rdi
call qword [fcn.14010b158]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140045da0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov eax, 0x1040
call fcn.14008f990
sub rsp, rax
mov rax, qword [0x140157a58]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov qword [rsp + 0x1058], rbx
mov rbx, rcx
call fcn.1400461a0
mov rbp, rax
cmp dword [rax + 0x28], 0
je 0x140045de3
mov rcx, rax
call qword [fcn.14010b150]
mov qword [rsp + 0x1060], rsi
test rbx, rbx
jne 0x140045df7
xor esi, esi
jmp 0x140045f6f
cmp word [rbx], 1
jne 0x140045f6c
movzx edx, word [rbx + 2]
xor esi, esi
movzx eax, dx
mov qword [rsp + 0x1038], rdi
add ax, ax
lea ecx, [rdx + 0x65]
add cx, ax
xor word [rbx + 4], cx
lea ecx, [rdx + rdx*8]
movzx r9d, byte [rbx + 4]
lea eax, [rcx + 0x68]
xor word [rbx + 6], ax
lea edx, [rcx + 4]
movzx eax, byte [rbx + 6]
shl r9d, 8
or r9, rax
jbe 0x140045e60
mov r8d, esi
movzx eax, word [rbx + r8*2 + 8]
lea edx, [rdx + rdx*2]
lea ecx, [rdx + 0x65]
xor ax, cx
lea edx, [rdx + 1]
mov word [rbx + r8*2], ax
inc r8
cmp r8, r9
jl 0x140045e41
mov rdi, qword [0x1401632d8]
mov word [rbx + r9*2], si
mov qword [0x1401632d8], rbx
test rdi, rdi
je 0x140045f64
cmp rdi, rbx
je 0x140045f64
cmp word [rbx], 1
je 0x140045f64
cmp word [rdi], 1
je 0x140045f64
mov r8d, 0x800
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.140595907
nop
lea rcx, [rsp + 0x20]
call fcn.1405954fe
nop
mov r8d, eax
test eax, eax
je 0x140045f64
mov eax, 1
mov qword [rsp + 0x1030], r14
mov word [rdi], ax
mov r11d, 4
lea rax, [rsp + 0x20]
movzx ecx, al
mov word [rdi + 2], cx
lea ecx, [rcx + rcx*2]
lea r14d, [rcx + 0x65]
lea ecx, [rcx + 1]
lea edx, [rcx + rcx*2]
lea r10d, [rdx + 0x65]
inc edx
test r8d, r8d
jle 0x140045f3b
lea r9, [rsp + 0x20]
mov rax, rdi
sub rax, r9
lea rcx, [rsp + 0x20]
lea r11d, [r8 + 4]
lea r9, [rax + 8]
nop word [rax + rax]
lea edx, [rdx + rdx*2]
lea eax, [rdx + 0x65]
xor ax, word [rcx]
lea edx, [rdx + 1]
mov word [r9 + rcx], ax
lea rcx, [rcx + 2]
sub r8, 1
jne 0x140045f20
movsxd rax, r11d
lea ecx, [r11 - 4]
mov word [rdi + rax*2], si
mov eax, ecx
sar eax, 8
xor ax, r14w
mov r14, qword [rsp + 0x1030]
xor r10w, cx
mov word [rdi + 4], ax
mov word [rdi + 6], r10w
mov rdi, qword [rsp + 0x1038]
mov rsi, rbx
cmp dword [rbp + 0x28], 0
mov rbx, qword [rsp + 0x1058]
je 0x140045f86
mov rcx, rbp
call qword [fcn.14010b158]
mov rax, rsi
mov rsi, qword [rsp + 0x1060]
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.140090220
add rsp, 0x1040
pop rbp
ret
Function at 0x140048c90
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov r11, rcx
mov r8d, edx
mov ebx, edx
mov rdx, rcx
shr r8d, 1
xor ecx, ecx
mov rdi, r9
call fcn.1400482a0
mov r8, qword [rsp + 0x30]
movzx r10d, ax
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x140048cde
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
cmove r8, rax
test r8, r8
jne 0x140048cf5
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [r8 + 0x58]
cmp r10w, cx
jb 0x140048d07
movzx eax, cx
sub r10d, eax
jmp 0x140048d11
sub r10d, ecx
movzx r10d, r10w
dec r10d
shr ecx, 0x10
cmp r10w, cx
jb 0x140048d1f
sub r10d, ecx
jmp 0x140048d29
sub r10d, ecx
movzx r10d, r10w
dec r10d
test bl, 1
je 0x140048d39
lea ecx, [rbx - 1]
movzx ecx, byte [rcx + r11]
add r10d, ecx
lea ecx, [r10 + rbx]
mov rax, r8
mov rbx, qword [rsp + 0x38]
mov dword [rdi], ecx
mov ecx, dword [r8 + 0x58]
mov dword [rsi], ecx
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140048db0
Capabilities:
Hash data with crc32

Disassembly:
xor r8d, r8d
mov r9, rcx
nop word [rax + rax]
mov edx, r8d
mov eax, r8d
shr edx, 1
xor edx, 0xedb88320
shr eax, 1
test r8b, 1
cmovne eax, edx
test al, 1
je 0x140048de4
shr eax, 1
xor eax, 0xedb88320
jmp 0x140048de6
shr eax, 1
test al, 1
je 0x140048df3
shr eax, 1
xor eax, 0xedb88320
jmp 0x140048df5
shr eax, 1
test al, 1
je 0x140048e02
shr eax, 1
xor eax, 0xedb88320
jmp 0x140048e04
shr eax, 1
test al, 1
je 0x140048e11
shr eax, 1
xor eax, 0xedb88320
jmp 0x140048e13
shr eax, 1
test al, 1
je 0x140048e20
shr eax, 1
xor eax, 0xedb88320
jmp 0x140048e22
shr eax, 1
test al, 1
je 0x140048e2f
shr eax, 1
xor eax, 0xedb88320
jmp 0x140048e31
shr eax, 1
test al, 1
je 0x140048e3e
shr eax, 1
xor eax, 0xedb88320
jmp 0x140048e40
shr eax, 1
mov dword [r9], eax
inc r8d
add r9, 4
cmp r8d, 0x100
jl 0x140048dc0
mov rax, rcx
ret

Function at 0x140049400
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r11, rcx
test rdx, rdx
jne 0x14004941d
mov dword [rcx + 0x400], 1
xor al, al
add rsp, 8
ret
mov qword [rsp], rbx
xor r10d, r10d
mov eax, r8d
add rax, rdx
mov rbx, rax
sub rbx, rdx
cmp rdx, rax
cmova rbx, r10
test rbx, rbx
je 0x140049466
nop dword [rax]
movzx r8d, byte [rdx]
lea rdx, [rdx + 1]
movzx eax, byte [r9]
inc r10
mov ecx, dword [r9]
xor r8, rax
shr ecx, 8
mov eax, dword [r11 + r8*4]
xor eax, ecx
mov dword [r9], eax
cmp r10, rbx
jb 0x140049440
mov al, 1
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x140059cc0
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x440
mov rax, qword [0x140157a58]
xor rax, rsp
mov qword [rsp + 0x430], rax
mov rdi, rdx
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdx + rcx], 0
jne 0x140059ce2
mov qword [rsp + 0x450], rbx
mov qword [rsp + 0x460], rbp
mov qword [rsp + 0x468], rsi
test ecx, ecx
je 0x140059de2
movzx eax, r8b
mov r11d, 4
mov byte [rsp + 0x31], al
imul eax, eax, 7
mov byte [rsp + 0x30], 2
lea ebp, [rax + 0x46]
inc eax
imul edx, eax, 7
lea ebx, [rdx + 0x46]
inc edx
test ecx, ecx
jle 0x140059d6d
mov r9d, ecx
lea rax, [rsp + 0x34]
mov r10, rdi
lea r8, [rsp + 0x34]
sub r10, rax
lea r11d, [r9 + 4]
nop dword [rax]
movzx eax, byte [r10 + r8]
lea r8, [r8 + 1]
imul edx, edx, 7
lea ecx, [rdx + 0x46]
inc edx
xor al, cl
mov byte [r8 - 1], al
sub r9, 1
jne 0x140059d50
movsxd rsi, r11d
cmp rsi, 0x400
jae 0x140059e16
lea ecx, [r11 - 4]
mov byte [rsp + rsi + 0x30], 0
mov eax, ecx
movsxd r8, ecx
xor bl, cl
sar eax, 8
xor al, bpl
mov byte [rsp + 0x33], bl
xor edx, edx
mov byte [rsp + 0x32], al
mov rcx, rdi
call fcn.140092da0
test rsi, rsi
jle 0x140059de2
xor ebx, ebx
nop dword [rax]
movzx r8d, byte [rsp + rbx + 0x30]
lea rdx, [0x140151670]
lea rcx, [rsp + 0x20]
call fcn.140033efc
mov r8d, 2
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400d8400
inc rbx
cmp rbx, rsi
jl 0x140059db0
mov rsi, qword [rsp + 0x468]
mov rax, rdi
mov rbp, qword [rsp + 0x460]
mov rbx, qword [rsp + 0x450]
mov rcx, qword [rsp + 0x430]
xor rcx, rsp
call fcn.140090220
add rsp, 0x440
pop rdi
ret
call fcn.14008fddc
int3

Function at 0x14005cd00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x10a0
call fcn.14008f990
sub rsp, rax
mov rax, qword [0x140157a58]
xor rax, rsp
mov qword [rsp + 0x1090], rax
mov rsi, rdx
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x90]
mov r8d, 0x1000
call fcn.140092da0
cmp qword [rdi], 0
jne 0x14005cd4d
xor al, al
jmp 0x14005ce05
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14005d090
test al, al
je 0x14005cd46
mov rcx, qword [rdi]
xor r8d, r8d
xor edx, edx
call fcn.1400a0ed8
test eax, eax
jne 0x14005cd46
mov qword [rsp + 0x10c0], rbx
lea rcx, [rsp + 0x30]
xor ebx, ebx
call fcn.14005cab0
lea rcx, [rsp + 0x30]
call fcn.14005d1c0
mov r9, qword [rdi]
lea edx, [rbx + 1]
mov r8d, 0x1000
lea rcx, [rsp + 0x90]
call fcn.1400a0b08
test eax, eax
je 0x14005cdee
nop word [rax + rax]
add ebx, eax
cmp ebx, 0x6400000
ja 0x14005cdee
mov r8d, eax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.14005caf0
mov r9, qword [rdi]
lea rcx, [rsp + 0x90]
mov edx, 1
mov r8d, 0x1000
call fcn.1400a0b08
test eax, eax
jne 0x14005cdb0
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.14005cc20
mov rbx, qword [rsp + 0x10c0]
mov al, 1
mov rcx, qword [rsp + 0x1090]
xor rcx, rsp
call fcn.140090220
mov rsi, qword [rsp + 0x10c8]
add rsp, 0x10a0
pop rdi
ret
Function at 0x14005ce30
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push r14
mov eax, 0x20d0
call fcn.14008f990
sub rsp, rax
mov rax, qword [0x140157a58]
xor rax, rsp
mov qword [rsp + 0x2090], rax
mov qword [rsp + 0x20], rdx
mov r14, rcx
xor edx, edx
lea rcx, [rsp + 0x90]
mov r8d, 0x1000
call fcn.140092da0
xor edx, edx
lea rcx, [rsp + 0x1090]
mov r8d, 0x1000
call fcn.140092da0
mov rcx, qword [r14]
test rcx, rcx
jne 0x14005ce92
xor al, al
jmp 0x14005d068
xor r8d, r8d
xor edx, edx
call fcn.1400a0ed8
test eax, eax
jne 0x14005ce8b
mov r9, qword [r14]
lea edx, [rax + 1]
mov r8d, 0x1000
lea rcx, [rsp + 0x90]
call fcn.1400a0b08
test eax, eax
je 0x14005ce8b
mov eax, 0x5a4d
cmp word [rsp + 0x90], ax
jne 0x14005ce8b
movsxd rax, dword [rsp + 0xcc]
mov qword [rsp + 0x20a0], r15
lea r15, [rsp + 0x90]
add r15, rax
cmp dword [r15], 0x4550
je 0x14005cef7
xor al, al
jmp 0x14005d060
mov qword [rsp + 0x20f0], rbx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20c8], rbp
xor ebx, ebx
mov qword [rsp + 0x20c0], rsi
movzx esi, word [r15 + 0x14]
mov qword [rsp + 0x20b8], rdi
add rsi, 0x20
mov qword [rsp + 0x20b0], r12
mov r12d, dword [r15 + 0x28]
mov qword [rsp + 0x20a8], r13
mov r13d, ebx
call fcn.14005cab0
lea rcx, [rsp + 0x30]
call fcn.14005d1c0
mov ebp, ebx
cmp bx, word [r15 + 6]
jae 0x14005d02e
add rsi, r15
nop dword [rax]
cmp dword [rsi + 4], r12d
ja 0x14005cf70
mov eax, 1
cmp r12d, dword [rsi]
jb 0x14005cf72
mov eax, ebx
test dword [rsi + 0x1c], 0x20000000
jne 0x14005cf83
test eax, eax
je 0x14005d003
movsxd rdx, dword [rsi + 0xc]
xor r8d, r8d
mov rcx, qword [r14]
inc r13d
mov edi, dword [rsi + 8]
call fcn.1400a0ed8
test eax, eax
jne 0x14005d02e
mov r9, qword [r14]
lea edx, [rax + 1]
mov r8d, 0x1000
lea rcx, [rsp + 0x1090]
call fcn.1400a0b08
mov rbx, rax
test eax, eax
je 0x14005d001
cmp ebx, edi
cmovg ebx, edi
test ebx, ebx
jle 0x14005d001
mov r8d, ebx
lea rdx, [rsp + 0x1090]
lea rcx, [rsp + 0x30]
call fcn.14005caf0
mov r9, qword [r14]
lea rcx, [rsp + 0x1090]
mov edx, 1
mov r8d, 0x1000
sub edi, ebx
call fcn.1400a0b08
mov ebx, eax
test eax, eax
jne 0x14005cfc0
xor ebx, ebx
movzx eax, word [r15 + 6]
inc ebp
add rsi, 0x28
cmp ebp, eax
jl 0x14005cf60
test r13d, r13d
je 0x14005d02e
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.14005cc20
mov al, 1
jmp 0x14005d030
xor al, al
mov r13, qword [rsp + 0x20a8]
mov r12, qword [rsp + 0x20b0]
mov rdi, qword [rsp + 0x20b8]
mov rsi, qword [rsp + 0x20c0]
mov rbp, qword [rsp + 0x20c8]
mov rbx, qword [rsp + 0x20f0]
mov r15, qword [rsp + 0x20a0]
mov rcx, qword [rsp + 0x2090]
xor rcx, rsp
call fcn.140090220
add rsp, 0x20d0
pop r14
ret