joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a9604
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rdi, r8
mov rbx, rdx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x48], rcx
mov rax, qword [rsp + 0x48]
movups xmmword [rax], xmm0
mov rax, qword [rdx]
sub rax, qword [r8]
mov qword [rsp + 0x50], rax
seto byte [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov al, byte [rsp + 0x58]
mov byte [rsp + 0x2f], al
xor eax, eax
lea rcx, [0x1400ffa10]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x78c104ba
add rax, 4
cmp rax, 0x14
jne 0x1400a9666
mov eax, 0x23b3651a
mov r12b, 1
xor r14d, r14d
lea rbp, [0x1400ffa00]
lea rsi, [0x1400ffa24]
mov r15d, dword [rsp + 0x40]
mov ecx, 0x7449e904
xor r15d, ecx
mov r13d, dword [rsp + 0x38]
mov ecx, 0x3f77d4dc
xor r13d, ecx
cmp eax, 0x3d971518
jle 0x1400a96d9
cmp eax, 0x3d971519
je 0x1400a96f1
cmp eax, 0x47c49478
je 0x1400a9783
cmp eax, 0x4ae4c48a
jne 0x1400a96af
call fcn.140011264
mov eax, r13d
jmp 0x1400a96af
cmp eax, 0x23b3651a
je 0x1400a9739
cmp eax, 0x2f7d4ef2
jne 0x1400a96af
call fcn.140011264
mov eax, r15d
jmp 0x1400a96af
mov rcx, qword [rbx + 8]
sub rcx, qword [rdi + 8]
seto al
mov qword [rsp + 0x70], rcx
test r14b, r14b
jne 0x1400a971e
xor ecx, ecx
movsxd rdx, dword [rcx + rsi]
xor dword [rsp + rdx*4 + 0x30], 0x316dbcb9
add rcx, 4
cmp rcx, 8
jne 0x1400a9708
test al, al
mov eax, 0x452455bd
mov ecx, 0x2d9d8f37
cmovne eax, ecx
xor eax, dword [rsp + 0x3c]
mov r14b, 1
jmp 0x1400a9695
mov al, byte [rsp + 0x58]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x68], rax
test r12b, 1
je 0x1400a9765
xor eax, eax
movsxd rcx, dword [rax + rbp]
xor dword [rsp + rcx*4 + 0x30], 0x7a21c57f
add rax, 4
cmp rax, 0x10
jne 0x1400a974f
cmp byte [rsp + 0x2f], 0
mov eax, 0x455611a3
mov ecx, 0x3225c030
cmovne eax, ecx
xor eax, dword [rsp + 0x30]
xor r12d, r12d
jmp 0x1400a9695
mov rdx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
lea rdi, [rsp + 0x78]
mov rcx, rdi
call fcn.1400a02f6
mov rax, qword [rsp + 0x48]
movups xmm0, xmmword [rdi]
movups xmmword [rax], xmm0
mov rax, qword [rsp + 0x60]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400a97be
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
mov rax, qword [rcx + 0x28]
mov qword [rsp + 0x38], rax
xor eax, eax
lea rcx, [0x1400ffc5c]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x20], 0x78c104ba
add rax, 4
cmp rax, 0xc
jne 0x1400a97e9
mov eax, 0x59f86fa6
mov bpl, 1
mov r12d, 0xc77b0d8
lea r14, [0x1400fd5f8]
lea rdi, [0x1400ffc54]
mov r15d, 0x5b7261a0
mov ebx, dword [rsp + 0x28]
xor ebx, r12d
cmp eax, 0xe97711d
je 0x1400a9882
cmp eax, 0x23b3651a
je 0x1400a983f
cmp eax, 0x59f86fa6
jne 0x1400a9828
jmp 0x1400a984b
mov rcx, r14
call fcn.140003721
mov eax, ebx
jmp 0x1400a9828
mov rax, qword [rsp + 0x38]
test bpl, 1
je 0x1400a986e
xor ecx, ecx
movsxd rdx, dword [rcx + rdi]
xor dword [rsp + rdx*4 + 0x20], 0x7a21c57f
add rcx, 4
cmp rcx, 8
jne 0x1400a9858
test rax, rax
mov eax, 0x765675a7
cmove eax, r15d
xor eax, dword [rsp + 0x20]
xor ebp, ebp
jmp 0x1400a9821
mov al, byte [rsi + 0x30]
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400aa7dc
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x40], rdx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movabs rax, 0x8000000000000000
mov qword [rsp + 0x48], rcx
cmp rcx, rax
sete byte [rsp + 0xf]
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x10], xmm0
xor eax, eax
lea rcx, [0x1400ffbf0]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x10], 0x78c104ba
add rax, 4
cmp rax, 0x2c
jne 0x1400aa828
cmp qword [rsp + 0x40], 0xffffffffffffffff
sete r13b
mov eax, 0x775b11f8
xor ebp, ebp
lea rdi, [0x1400ffc40]
mov ebx, 0x28158bd0
lea r14, [0x1400ffc20]
lea r12, [0x1400ffbc0]
xor r8d, r8d
xor r10d, r10d
xor r9d, r9d
cmp eax, 0x5fcc2876
jle 0x1400aa8de
cmp eax, 0x771e161a
jle 0x1400aa916
cmp eax, 0x771e161b
je 0x1400aa98e
cmp eax, 0x7cbfe930
je 0x1400aa9b7
cmp eax, 0x775b11f8
jne 0x1400aa872
mov r11b, byte [rsp + 0xf]
test bpl, bpl
jne 0x1400aa8c3
xor eax, eax
movsxd rdx, dword [rax + r12]
xor dword [rsp + rdx*4 + 0x10], 0x7a21c57f
add rax, 4
cmp rax, 0x28
jne 0x1400aa8ad
cmp byte [rsp + 0xf], 0
mov eax, 0x47eed8a
mov edx, 0x6b0c795f
cmovne eax, edx
xor eax, dword [rsp + 0x10]
mov bpl, 1
jmp 0x1400aa872
cmp eax, 0x23b1fc5e
jle 0x1400aa93f
cmp eax, 0x23b1fc5f
je 0x1400aa9f1
cmp eax, 0x2529ff56
je 0x1400aaa07
cmp eax, 0x5c59b6c3
jne 0x1400aa872
mov eax, dword [rsp + 0x24]
xor eax, ebx
mov r15b, 1
xor esi, esi
jmp 0x1400aa872
cmp eax, 0x5fcc2877
je 0x1400aaa2b
cmp eax, 0x69603052
jne 0x1400aaa56
mov eax, dword [rsp + 0x20]
xor eax, ebx
mov esi, 3
xor r15d, r15d
jmp 0x1400aa872
cmp eax, 0x13cd7de5
je 0x1400aaa43
cmp eax, 0x1b98f6ac
jne 0x1400aa872
test r10b, r10b
jne 0x1400aa972
xor eax, eax
movsxd rdx, dword [rax + rdi]
xor dword [rsp + rdx*4 + 0x10], 0x23b3651a
add rax, 4
cmp rax, 0x14
jne 0x1400aa95c
cmp esi, 3
mov eax, 0x44936b67
mov edx, 0x6c41550b
cmovl eax, edx
xor eax, dword [rsp + 0x28]
mov r10b, 1
jmp 0x1400aa872
test r9b, r9b
jne 0x1400aa99b
xor dword [rsp + 0x34], 0xe97711d
cmp esi, 3
mov eax, 0x727e4714
mov ecx, 0x3517e730
cmove eax, ecx
xor eax, dword [rsp + 0x2c]
mov r9b, 1
jmp 0x1400aa872
test r8b, r8b
jne 0x1400aa9d4
xor eax, eax
movsxd rdx, dword [rax + r14]
xor dword [rsp + rdx*4 + 0x10], 0x316dbcb9
add rax, 4
cmp rax, 0x20
jne 0x1400aa9be
test r11b, 1
mov eax, 0x5eb97706
mov edx, 0x6b80f197
cmove eax, edx
xor eax, dword [rsp + 0x1c]
mov r8b, 1
jmp 0x1400aa872
mov ecx, r15d
and cl, 1
mov eax, dword [rsp + 0x38]
mov edx, 0x727e4714
xor eax, edx
jmp 0x1400aa872
mov rax, qword [rsp + 0x48]
cqo
idiv qword [rsp + 0x40]
mov rdx, qword [rsp + 0x50]
mov qword [rdx], rax
mov eax, dword [rsp + 0x34]
mov edx, 0x3d189524
xor eax, edx
jmp 0x1400aa872
test esi, esi
mov eax, 0x727e4714
mov ecx, 0x338fe439
cmove eax, ecx
xor eax, dword [rsp + 0x30]
jmp 0x1400aa872
mov eax, dword [rsp + 0x18]
mov edx, 0x7e5f28f5
xor eax, edx
mov r11d, r13d
jmp 0x1400aa872
cmp eax, 0x62405f72
jne 0x1400aa872
and cl, 1
mov eax, ecx
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400aaa78
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rsi, rcx
cmp rcx, 0xffffffff80000000
setl byte [rsp + 0x2e]
cmp rcx, 0x7fffffff
setg byte [rsp + 0x2f]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
xor eax, eax
lea rcx, [0x140103a18]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x78c104ba
add rax, 4
cmp rax, 0xc
jne 0x1400aaab0
mov eax, 0x59f86fa6
mov bpl, 1
mov r15d, 0xc77b0d8
lea rbx, [0x140103a10]
mov r14d, 0x5b7261a0
mov edi, dword [rsp + 0x38]
xor edi, r15d
cmp eax, 0xe97711d
je 0x1400aab51
cmp eax, 0x23b3651a
je 0x1400aaaff
cmp eax, 0x59f86fa6
jne 0x1400aaae8
jmp 0x1400aab18
mov r8d, 0x7fffffff
mov rcx, rsi
mov rdx, 0xffffffff80000000
call fcn.14001c234
mov eax, edi
jmp 0x1400aaae8
mov al, byte [rsp + 0x2e]
or al, byte [rsp + 0x2f]
test bpl, 1
je 0x1400aab3e
xor ecx, ecx
movsxd rdx, dword [rcx + rbx]
xor dword [rsp + rdx*4 + 0x30], 0x7a21c57f
add rcx, 4
cmp rcx, 8
jne 0x1400aab28
test al, 1
mov eax, 0x765675a7
cmovne eax, r14d
xor eax, dword [rsp + 0x30]
xor ebp, ebp
jmp 0x1400aaae1
mov rax, qword [0x1401adc20]
mov ecx, esi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [rax]
Function at 0x1400c0488
Capabilities:
Encode data using xor

Disassembly:
lea rcx, [0x1400c0494]
jmp fcn.140021056

Function at 0x1400c0704
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
imul rax, rcx, 3
mov qword [rsp + 0x48], rax
seto byte [rsp + 0x50]
mov rax, qword [rsp + 0x48]
mov al, byte [rsp + 0x50]
mov byte [rsp + 0x2f], al
xor eax, eax
lea rcx, [0x14010a2b0]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x78c104ba
add rax, 4
cmp rax, 0x14
jne 0x1400c0749
mov eax, 0x23b3651a
mov dil, 1
xor esi, esi
mov r12d, 0x7449e904
mov r13d, 0x3f77d4dc
lea rbx, [0x14010a29c]
lea rbp, [0x14010a2c4]
mov r14d, dword [rsp + 0x40]
xor r14d, r12d
mov r15d, dword [rsp + 0x38]
xor r15d, r13d
cmp eax, 0x3d971518
jle 0x1400c07bd
cmp eax, 0x3d971519
je 0x1400c07d5
cmp eax, 0x47c49478
je 0x1400c086b
cmp eax, 0x4ae4c48a
jne 0x1400c0793
call fcn.140011264
mov eax, r15d
jmp 0x1400c0793
cmp eax, 0x23b3651a
je 0x1400c0822
cmp eax, 0x2f7d4ef2
jne 0x1400c0793
call fcn.140011264
mov eax, r14d
jmp 0x1400c0793
mov rax, qword [rsp + 0x58]
lea rcx, [rax + 3]
test rax, rax
cmovns rcx, rax
sar rcx, 2
add rcx, 6
mov qword [rsp + 0x60], rcx
test sil, sil
jne 0x1400c080f
xor eax, eax
movsxd rcx, dword [rax + rbp]
xor dword [rsp + rcx*4 + 0x30], 0x316dbcb9
add rax, 4
cmp rax, 8
jne 0x1400c07f9
mov eax, dword [rsp + 0x3c]
mov ecx, 0x452455bd
xor eax, ecx
mov sil, 1
jmp 0x1400c0783
mov al, byte [rsp + 0x50]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x58], rax
test dil, 1
je 0x1400c084e
xor eax, eax
movsxd rcx, dword [rax + rbx]
xor dword [rsp + rcx*4 + 0x30], 0x7a21c57f
add rax, 4
cmp rax, 0x10
jne 0x1400c0838
cmp byte [rsp + 0x2f], 0
mov eax, 0x455611a3
mov ecx, 0x3225c030
cmovne eax, ecx
xor eax, dword [rsp + 0x30]
xor edi, edi
jmp 0x1400c0783
mov rax, qword [rsp + 0x60]
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400ce88e
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov rsi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
imul rax, rdx, 4
mov qword [rsp + 0x30], rax
seto byte [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov al, byte [rsp + 0x38]
mov byte [rsp + 0x2f], al
xor eax, eax
lea rcx, [0x140117dec]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x40], 0x78c104ba
add rax, 4
cmp rax, 0xc
jne 0x1400ce7df
mov eax, 0x59f86fa6
mov bpl, 1
mov r15d, 0xc77b0d8
lea rbx, [0x140117de4]
mov r14d, 0x5b7261a0
mov edi, dword [rsp + 0x48]
xor edi, r15d
cmp eax, 0xe97711d
je 0x1400ce879
cmp eax, 0x23b3651a
je 0x1400ce82e
cmp eax, 0x59f86fa6
jne 0x1400ce817
jmp 0x1400ce837
call fcn.140011264
mov eax, edi
jmp 0x1400ce817
mov al, byte [rsp + 0x38]
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x50], rax
test bpl, 1
je 0x1400ce863
xor eax, eax
movsxd rcx, dword [rax + rbx]
xor dword [rsp + rcx*4 + 0x40], 0x7a21c57f
add rax, 4
cmp rax, 8
jne 0x1400ce84d
cmp byte [rsp + 0x2f], 0
mov eax, 0x765675a7
cmovne eax, r14d
xor eax, dword [rsp + 0x40]
xor ebp, ebp
jmp 0x1400ce810
add rsi, qword [rsp + 0x50]
mov rax, rsi
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
jmp 0x1400ce7a4
Function at 0x1400ceb71
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
lea rcx, [0x140117e00]
call fcn.14002159e
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [0x1401c8268], rax
xor eax, eax
lea rcx, [0x140117eac]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x78c104ba
add rax, 4
cmp rax, 0xc
jne 0x1400cebab
mov eax, 0x59f86fa6
mov sil, 1
mov edi, 0xc77b0d8
lea r14, [0x140117e20]
lea rbx, [0x140117ea4]
mov r15d, 0x5b7261a0
mov ebp, dword [rsp + 0x38]
xor ebp, edi
cmp eax, 0xe97711d
je 0x1400cec42
cmp eax, 0x23b3651a
je 0x1400cebff
cmp eax, 0x59f86fa6
jne 0x1400cebe8
jmp 0x1400cec0b
mov rcx, r14
call fcn.1400215b5
mov eax, ebp
jmp 0x1400cebe8
mov rax, qword [rsp + 0x28]
test sil, 1
je 0x1400cec2e
xor ecx, ecx
movsxd rdx, dword [rcx + rbx]
xor dword [rsp + rdx*4 + 0x30], 0x7a21c57f
add rcx, 4
cmp rcx, 8
jne 0x1400cec18
test rax, rax
mov eax, 0x765675a7
cmove eax, r15d
xor eax, dword [rsp + 0x30]
xor esi, esi
jmp 0x1400cebe2
mov rcx, qword [0x1401c8268]
lea rdx, str.BCryptGenRandom
call fcn.140021921
mov qword [0x1401c8270], rax
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1400cfd85
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov r12, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0
mov qword [rsp + 0x48], rcx
mov rax, qword [rsp + 0x48]
movups xmmword [rax], xmm0
cmp qword [0x1401c8278], 0
sete byte [rsp + 0x2f]
mov rax, qword [0x1401c8280]
movaps xmmword [rsp + 0x30], xmm0
xor ecx, ecx
lea rdx, [0x1401183dc]
movsxd rbp, dword [rcx + rdx]
xor dword [rsp + rbp*4 + 0x30], 0x78c104ba
add rcx, 4
cmp rcx, 0xc
jne 0x1400cfdd5
test rax, rax
sete bl
mov edi, 0x59f86fa6
mov bpl, 1
mov ecx, 0xc77b0d8
lea rdx, [0x1401183d4]
mov r8d, 0x5b7261a0
mov esi, dword [rsp + 0x38]
xor esi, ecx
cmp edi, 0xe97711d
je 0x1400cfe6a
cmp edi, 0x23b3651a
je 0x1400cfe2b
cmp edi, 0x59f86fa6
jne 0x1400cfe11
jmp 0x1400cfe31
mov eax, ebx
mov edi, esi
jmp 0x1400cfe11
mov al, byte [rsp + 0x2f]
test bpl, 1
je 0x1400cfe54
xor ebp, ebp
movsxd rdi, dword [rbp + rdx]
xor dword [rsp + rdi*4 + 0x30], 0x7a21c57f
add rbp, 4
cmp rbp, 8
jne 0x1400cfe3d
cmp byte [rsp + 0x2f], 0
mov edi, 0x765675a7
cmovne edi, r8d
xor edi, dword [rsp + 0x30]
xor ebp, ebp
jmp 0x1400cfe0b
test al, 1
sete byte [rsp + 0x2e]
xor eax, eax
lea rcx, [0x140118340]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x50], 0x78c104ba
add rax, 4
cmp rax, 0x10
jne 0x1400cfe7a
mov eax, 0x28a16966
mov bpl, 1
lea rbx, [0x140118334]
mov r14d, 0x765675a7
lea r15, [rsp + 0x30]
mov edi, dword [rsp + 0x58]
mov esi, dword [rsp + 0x5c]
cmp eax, 0x3d971518
jg 0x1400cfec9
cmp eax, 0xe97711d
je 0x1400cfeef
cmp eax, 0x28a16966
jne 0x1400cfeb2
jmp 0x1400cfef8
cmp eax, 0x3d971519
je 0x1400cff33
cmp eax, 0x4ae4c48a
jne 0x1400cfeb2
mov rcx, r15
call fcn.1400cec6c
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [0x1401c8278], xmm0
mov eax, esi
jmp 0x1400cfef1
mov eax, edi
xor eax, 0x3f77d4dc
jmp 0x1400cfeb2
mov al, byte [rsp + 0x2e]
test bpl, 1
je 0x1400cff1a
xor eax, eax
movsxd rcx, dword [rax + rbx]
xor dword [rsp + rcx*4 + 0x50], 0x7a21c57f
add rax, 4
cmp rax, 0xc
jne 0x1400cff04
cmp byte [rsp + 0x2e], 0
mov eax, 0x3225c030
cmovne eax, r14d
xor eax, dword [rsp + 0x50]
xor ebp, ebp
jmp 0x1400cfeaa
mov rax, qword [rsp + 0x48]
movups xmm0, xmmword [0x1401c8278]
movups xmmword [rax], xmm0
lea rcx, [0x1401c8278]
call fcn.1400cf699
mov rax, r12
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400d029d
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov r12, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x20], rdx
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
add rdx, 8
mov qword [rsp + 0x28], rdx
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
xor eax, eax
lea rcx, [0x1401183dc]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x78c104ba
add rax, 4
cmp rax, 0xc
jne 0x1400d02e7
mov eax, 0x59f86fa6
mov bpl, 1
mov ebx, 0xc77b0d8
lea r14, [0x140117f48]
lea rdi, [0x1401183d4]
mov r15d, 0x5b7261a0
mov esi, dword [rsp + 0x38]
xor esi, ebx
cmp eax, 0xe97711d
je 0x1400d0383
cmp eax, 0x23b3651a
je 0x1400d033b
cmp eax, 0x59f86fa6
jne 0x1400d0324
jmp 0x1400d0347
mov rcx, r14
call fcn.140003721
mov eax, esi
jmp 0x1400d0324
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
test bpl, 1
je 0x1400d036f
xor edx, edx
movsxd rbp, dword [rdx + rdi]
xor dword [rsp + rbp*4 + 0x30], 0x7a21c57f
add rdx, 4
cmp rdx, 8
jne 0x1400d0359
cmp rax, rcx
mov eax, 0x765675a7
cmovg eax, r15d
xor eax, dword [rsp + 0x30]
xor ebp, ebp
jmp 0x1400d031e
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x20]
sub rdx, qword [rax]
mov rcx, r12
call fcn.1400cff82
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx]
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400d082d
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, rdx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 0
movsxd rax, dword [rdx + 0xc]
sub rcx, rax
mov qword [rsp + 0x48], rcx
seto byte [rsp + 0x50]
mov rax, qword [rsp + 0x48]
mov al, byte [rsp + 0x50]
mov byte [rsp + 0x2f], al
xor eax, eax
lea rcx, [0x1401aa330]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x78c104ba
add rax, 4
cmp rax, 0x14
jne 0x1400d0878
mov eax, 0x23b3651a
mov bl, 1
xor r14d, r14d
mov r13d, 0x3f77d4dc
lea rdi, [0x1401aa320]
lea rbp, [0x1401aa344]
mov r12d, dword [rsp + 0x40]
mov ecx, 0x7449e904
xor r12d, ecx
mov r15d, dword [rsp + 0x38]
xor r15d, r13d
cmp eax, 0x3d971518
jle 0x1400d08eb
cmp eax, 0x3d971519
je 0x1400d0903
cmp eax, 0x47c49478
je 0x1400d0994
cmp eax, 0x4ae4c48a
jne 0x1400d08c1
call fcn.140011264
mov eax, r15d
jmp 0x1400d08c1
cmp eax, 0x23b3651a
je 0x1400d094c
cmp eax, 0x2f7d4ef2
jne 0x1400d08c1
call fcn.140011264
mov eax, r12d
jmp 0x1400d08c1
movsxd rcx, dword [rsi + 0x14]
add rcx, qword [rsp + 0x58]
seto al
mov qword [rsp + 0x60], rcx
test r14b, r14b
jne 0x1400d0931
xor ecx, ecx
movsxd rdx, dword [rcx + rbp]
xor dword [rsp + rdx*4 + 0x30], 0x316dbcb9
add rcx, 4
cmp rcx, 8
jne 0x1400d091b
test al, al
mov eax, 0x452455bd
mov ecx, 0x2d9d8f37
cmovne eax, ecx
xor eax, dword [rsp + 0x3c]
mov r14b, 1
jmp 0x1400d08ac
mov al, byte [rsp + 0x50]
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x58], rax
test bl, 1
je 0x1400d0977
xor eax, eax
movsxd rcx, dword [rax + rdi]
xor dword [rsp + rcx*4 + 0x30], 0x7a21c57f
add rax, 4
cmp rax, 0x10
jne 0x1400d0961
cmp byte [rsp + 0x2f], 0
mov eax, 0x455611a3
mov ecx, 0x3225c030
cmovne eax, ecx
xor eax, dword [rsp + 0x30]
xor ebx, ebx
jmp 0x1400d08ac
mov rax, qword [rsp + 0x60]
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400d231f
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
xor esi, esi
mov dword [rsp + 0x40], esi
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov rax, qword [0x1401adb88]
call qword [rax]
mov r10, qword [0x1401adb98]
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 0x20
mov r8d, 0x1000
mov rcx, rax
xor edx, edx
mov r9d, 0x3000
call qword [r10]
mov qword [rsp + 0x48], rax
lea rax, [0x1401ad228]
movsxd rcx, dword [rsi + rax]
xor dword [rsp + rcx*4 + 0x30], 0x78c104ba
add rsi, 4
cmp rsi, 0x10
jne 0x1400d236e
mov edx, 0x28a16966
mov r9b, 1
lea rcx, [0x1401ad21c]
mov r8d, 0x765675a7
mov r10d, dword [rsp + 0x38]
mov r11d, dword [rsp + 0x3c]
cmp edx, 0x3d971518
jg 0x1400d23bd
cmp edx, 0xe97711d
je 0x1400d23d4
cmp edx, 0x28a16966
jne 0x1400d23a3
jmp 0x1400d23e1
cmp edx, 0x3d971519
je 0x1400d2419
cmp edx, 0x4ae4c48a
jne 0x1400d23a3
xor eax, eax
mov edx, r11d
jmp 0x1400d23d9
mov al, 1
mov edx, r10d
xor edx, 0x3f77d4dc
jmp 0x1400d23a3
mov r10, qword [rsp + 0x48]
test r9b, 1
je 0x1400d2404
xor esi, esi
movsxd rdx, dword [rsi + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x7a21c57f
add rsi, 4
cmp rsi, 0xc
jne 0x1400d23ee
test r10, r10
mov edx, 0x3225c030
cmove edx, r8d
xor edx, dword [rsp + 0x30]
xor r9d, r9d
jmp 0x1400d2399
and al, 1
add rsp, 0x50
pop rsi
ret
Function at 0x1400d9660
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400df380
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400df380
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop word [rax + rax]

Function at 0x1400d96d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x1401c89b4]
mov r12, rcx
test ebx, ebx
jle 0x1400d9800
mov rax, qword [0x1401c89b8]
xor r9d, r9d
add rax, 0x18
nop dword [rax + rax]
mov r8, qword [rax]
cmp r8, r12
ja 0x1400d971b
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp r12, r8
jb 0x1400d97a5
add r9d, 1
add rax, 0x28
cmp r9d, ebx
jne 0x1400d9700
mov rcx, r12
call fcn.1400da150
mov rsi, rax
test rax, rax
je 0x1400d9822
mov rax, qword [0x1401c89b8]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call fcn.1400da280
mov edx, dword [rsi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x1401c89b8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400d9807
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x1400d979e
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x1400d97b0
add dword [0x1401c89b4], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x1401c89b8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400d979e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400d9660
nop dword [rax]
xor ebx, ebx
jmp 0x1400d9728
mov rax, qword [0x1401c89b8]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400d9660
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call fcn.1400d9660
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400d9da0
Capabilities:
Get thread local storage value

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r13, [0x1401c8a20]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1401c8a00]
test rbx, rbx
je 0x1400d9dfc
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x1400d9df3
test r12, r12
je 0x1400d9df3
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400d9dd8
mov rcx, r13
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400da150
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1401addd0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400da170
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400da178
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400da170
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x1400da1c5
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400da1bc
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400da170
add rax, 0x28
cmp rax, r9
jne 0x1400da1a8
xor eax, eax
ret

Function at 0x1400da1d0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1401addd0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1400da1f0
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400da1f8
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400da1f0
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x1400da280
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1401addd0]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x1400da2a0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x1400da2a8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret