joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007f144
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1400d1090]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdi, rcx
mov qword [rbp - 0x21], rcx
xor r12d, r12d
mov dword [rcx + 0x14], r12d
mov qword [rcx + 0x18], r12
add rcx, 0x28
call fcn.14008f488
nop
lea rdx, [rdi + 0x28]
lea rcx, [rbp - 0x31]
call fcn.14008005c
nop
lea rcx, [rbp - 0x19]
call fcn.14007fa70
nop
mov ebx, 0x12bc
mov ecx, ebx
call fcn.14009f1e0
mov qword [rdi + 0x20], rax
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.1400a2620
mov dword [rbp - 0x39], r12d
mov dword [rbp - 0x35], 0x1400000
lea r8, [rbp - 0x35]
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x19]
call fcn.14009ccf8
mov rsi, rax
test rax, rax
je 0x14007f205
cmp dword [rbp - 0x39], 0x12c0
jne 0x14007f205
mov edx, ebx
lea rcx, [rax + 4]
call fcn.140080694
cmp dword [rsi], eax
lea rdx, [rsi + 4]
je 0x14007f20c
lea rdx, [0x1400d24f0]
mov r8, rbx
mov rcx, qword [rdi + 0x20]
call fcn.14009e430
test rsi, rsi
je 0x14007f227
xor edx, edx
mov rcx, rsi
call fcn.14008f520
mov rcx, r12
mov rax, qword [rdi + 0x20]
xor byte [rax + rcx], 0x63
mov rax, qword [rdi + 0x20]
add byte [rax + rcx], 0xfa
inc rcx
dec rbx
jne 0x14007f22a
cmp qword [rbp - 1], 8
jb 0x14007f252
mov rcx, qword [rbp - 0x19]
call fcn.14009f17c
mov qword [rbp - 1], 7
mov qword [rbp - 9], r12
mov word [rbp - 0x19], r12w
lea rcx, [rbp - 0x31]
call fcn.140080094
lea rcx, [rbp + 0xf]
call fcn.14007fa70
nop
lea rbx, [rbp + 0xf]
cmp qword [rbp + 0x27], 8
cmovae rbx, qword [rbp + 0xf]
mov edx, 0x63c1f97
mov ecx, 0x61dfabc
call fcn.14009de44
mov rcx, rbx
call rax
test eax, eax
jne 0x14007f2e9
lea rcx, [rbp - 0x19]
call fcn.14009c250
nop
mov dword [rdi + 0x14], 1
lea rdx, [rbp - 0x19]
cmp qword [rbp - 1], 0x10
cmovae rdx, qword [rbp - 0x19]
mov r8, qword [rbp - 9]
inc r8
mov rcx, qword [rdi + 0x20]
add rcx, 0x74
call fcn.14009e430
mov rcx, rdi
call fcn.14007f8ec
nop
cmp qword [rbp - 1], 0x10
jb 0x14007f2e9
mov rcx, qword [rbp - 0x19]
call fcn.14009f17c
nop
cmp qword [rbp + 0x27], 8
jb 0x14007f2fa
mov rcx, qword [rbp + 0xf]
call fcn.14009f17c
nop
mov rax, rdi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.14009e400
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rbp
ret
Function at 0x14007f5bc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x1400d1090]
xor rax, rsp
mov qword [rsp + 0x50], rax
xor edi, edi
mov rbx, rcx
lea rdx, [0x1400c2c70]
lea r8d, [rdi + 0x25]
lea rcx, [rsp + 0x28]
mov dword [rsp + 0x20], edi
call fcn.14009e430
lea edx, [rdi + 0x23]
mov al, byte [rsp + rdx + 0x27]
dec rdx
xor byte [rsp + rdx + 0x29], al
test rdx, rdx
jg 0x14007f5f6
xor byte [rsp + 0x28], 0xc8
mov qword [rbx + 0x10], rdi
or rcx, 0xffffffffffffffff
mov qword [rbx + 0x18], 0xf
mov byte [rbx], dil
xor eax, eax
lea rdi, [rsp + 0x28]
lea rdx, [rsp + 0x28]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.14007df84
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14009e400
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret

Function at 0x14007f798
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x188]
sub rsp, 0x280
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400d1090]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rdi, rcx
xor esi, esi
mov dword [rsp + 0x50], esi
mov edx, 0x8a1017
mov ecx, 0xb9f5b9c
call fcn.14009de44
lea rdx, [rsp + 0x60]
mov ecx, 0x104
call rax
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rsi
mov word [rsp + 0x28], si
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x28]
call fcn.14007dd94
nop
movabs rax, 0x34c634b634db
mov qword [rsp + 0x50], rax
lea ecx, [rsi + 2]
movzx eax, word [rsp + rcx*2 + 0x4e]
xor word [rsp + rcx*2 + 0x50], ax
dec rcx
test rcx, rcx
jg 0x14007f829
mov eax, 0x34af
xor word [rsp + 0x50], ax
lea rbx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rbx, qword [rsp + 0x28]
mov edx, 0x864f3d7
mov ecx, 0xb9f5b9c
call fcn.14009de44
lea r9, [rsp + 0x60]
mov r8d, 1
lea rdx, [rsp + 0x50]
mov rcx, rbx
call rax
mov edx, 0xad64067
mov ecx, 0xb9f5b9c
call fcn.14009de44
lea rcx, [rsp + 0x60]
call rax
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rsi
mov word [rdi], si
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.14007dd94
nop
cmp qword [rsp + 0x40], 8
jb 0x14007f8bf
mov rcx, qword [rsp + 0x28]
call fcn.14009f17c
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14009e400
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14007f8ec
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0x17], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400d1090]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
mov ecx, 0x12c0
mov dword [rbp + 7], ecx
call fcn.14009f2a8
mov rdi, rax
lea rdx, [rbx + 0x28]
lea rcx, [rbp + 0xf]
call fcn.14008005c
mov r8d, 0x12bc
mov rdx, qword [rbx + 0x20]
lea rcx, [rdi + 4]
call fcn.14009e430
lea r11, [rdi + 4]
mov r8d, 0x12bc
mov al, byte [r11]
add al, 6
xor al, 0x63
mov byte [r11], al
inc r11
dec r8
jne 0x14007f95a
mov edx, 0x12bc
lea rcx, [rdi + 4]
call fcn.140080694
mov dword [rdi], eax
lea rcx, [rbp + 0xf]
call fcn.140080094
lea rcx, [rbp + 0x1f]
call fcn.14007fa70
nop
lea rbx, [rbp + 0x1f]
cmp qword [rbp + 0x37], 8
cmovae rbx, qword [rbp + 0x1f]
mov edx, 0xad68927
mov esi, 0xb9f5b9c
mov ecx, esi
call fcn.14009de44
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x10000000
mov rcx, rbx
call rax
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14007f9fa
mov rcx, rdi
call fcn.14009f2b0
nop
cmp qword [rbp + 0x37], 8
jb 0x14007f9f6
mov rcx, qword [rbp + 0x1f]
call fcn.14009f17c
xor eax, eax
jmp 0x14007fa4b
mov edx, 0xa992b5
mov ecx, esi
call fcn.14009de44
and qword [rsp + 0x20], 0
lea r9, [rbp + 7]
mov r8d, dword [rbp + 7]
mov rdx, rdi
mov rcx, rbx
call rax
mov edx, 0x9ae7db5
mov ecx, esi
call fcn.14009de44
mov rcx, rbx
call rax
mov rcx, rdi
call fcn.14009f2b0
nop
cmp qword [rbp + 0x37], 8
jb 0x14007fa46
mov rcx, qword [rbp + 0x1f]
call fcn.14009f17c
mov eax, 1
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.14009e400
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14007fa70
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x1e8]
sub rsp, 0x2e0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x1400d1090]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x20], edi
lea rcx, [rsp + 0x70]
lea rdx, [0x1400c2ca0]
lea r8d, [rdi + 0x4e]
call fcn.14009e430
lea r11d, [rdi + 0x25]
movzx eax, word [rsp + r11*2 + 0x6e]
xor word [rsp + r11*2 + 0x70], ax
dec r11
test r11, r11
jg 0x14007fac6
mov eax, 0x15de
xor word [rsp + 0x70], ax
mov edx, 0x61f9a87
mov ecx, 0xb9f5b9c
call fcn.14009de44
mov r8d, 0x104
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x70]
call rax
mov edx, 0x71ea57
mov ecx, 0xf34e30c
call fcn.14009de44
xor r8d, r8d
lea rdx, [rbp - 0x40]
xor ecx, ecx
call rax
mov rax, qword [0x1400c2cf0]
mov qword [rsp + 0x58], rax
mov rax, qword [0x1400c2cf8]
mov qword [rsp + 0x60], rax
mov rax, qword [0x1400c2d00]
mov qword [rsp + 0x68], rax
mov ecx, 0xa
movzx eax, word [rsp + rcx*2 + 0x56]
xor word [rsp + rcx*2 + 0x58], ax
dec rcx
test rcx, rcx
jg 0x14007fb47
mov eax, 0x59ca
xor word [rsp + 0x58], ax
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x30], di
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x30]
call fcn.14007dd94
nop
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400800e8
nop
cmp qword [rsp + 0x48], 8
jb 0x14007fbaa
mov rcx, qword [rsp + 0x30]
call fcn.14009f17c
mov rax, rbx
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14009e400
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140080694
Capabilities:
Encode data using xor

Disassembly:
or r8d, 0xffffffff
mov r9, rcx
test edx, edx
je 0x1400806c9
mov r10d, edx
movzx eax, byte [r9]
movzx edx, r8b
mov ecx, r8d
xor rdx, rax
shr ecx, 8
lea rax, [0x1400b76a0]
mov r8d, dword [rax + rdx*4]
inc r9
xor r8d, ecx
dec r10
jne 0x1400806a2
not r8d
mov eax, r8d
ret
Function at 0x14008d678
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x98
mov qword [rbp - 0x59], 0xfffffffffffffffe
mov rax, qword [0x1400d1090]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov r12, r9
mov rbx, r8
mov r13, rdx
mov rsi, rcx
movzx eax, word [0x1400c3550]
mov word [rbp - 1], ax
mov al, byte [0x1400c3552]
mov byte [rbp + 1], al
mov al, byte [rbp - 1]
xor byte [rbp], al
xor al, 0xd3
mov byte [rbp - 1], al
mov r15d, 0xf
mov qword [rbp - 0x39], r15
xor r14d, r14d
mov qword [rbp - 0x41], r14
mov byte [rbp - 0x51], r14b
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 1]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x51]
call fcn.14007df84
nop
lea r8, [rbp - 0x51]
mov rdx, rsi
lea rcx, [rbp - 0x29]
call fcn.140099274
nop
mov rdx, rax
mov rcx, rbx
call fcn.140080dac
nop
cmp qword [rbp - 0x11], 0x10
jb 0x14008d735
mov rcx, qword [rbp - 0x29]
call fcn.14009f17c
mov qword [rbp - 0x11], r15
mov qword [rbp - 0x19], r14
mov byte [rbp - 0x29], r14b
cmp qword [rbp - 0x39], 0x10
jb 0x14008d751
mov rcx, qword [rbp - 0x51]
call fcn.14009f17c
mov eax, dword [0x1400c3554]
mov dword [rbp - 1], eax
mov al, byte [0x1400c3558]
mov byte [rbp + 3], al
mov ecx, 3
mov al, byte [rbp + rcx - 2]
xor byte [rbp + rcx - 1], al
dec rcx
test rcx, rcx
jg 0x14008d768
xor byte [rbp - 1], 3
mov qword [rbp - 0x39], r15
mov qword [rbp - 0x41], r14
mov byte [rbp - 0x51], r14b
xor eax, eax
or rbx, 0xffffffffffffffff
mov rcx, rbx
lea rdi, [rbp - 1]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x51]
call fcn.14007df84
nop
lea r8, [rbp - 0x51]
mov rdx, rsi
lea rcx, [rbp - 0x29]
call fcn.140099274
nop
mov rdx, rax
mov rcx, r12
call fcn.140080dac
nop
cmp qword [rbp - 0x11], 0x10
jb 0x14008d7d9
mov rcx, qword [rbp - 0x29]
call fcn.14009f17c
mov qword [rbp - 0x11], r15
mov qword [rbp - 0x19], r14
mov byte [rbp - 0x29], r14b
cmp qword [rbp - 0x39], 0x10
jb 0x14008d7f5
mov rcx, qword [rbp - 0x51]
call fcn.14009f17c
mov rax, qword [0x1400c3560]
mov qword [rbp - 1], rax
mov al, byte [0x1400c3568]
mov byte [rbp + 7], al
mov edx, 7
mov al, byte [rbp + rdx - 2]
xor byte [rbp + rdx - 1], al
dec rdx
test rdx, rdx
jg 0x14008d80e
xor byte [rbp - 1], 0x1c
mov qword [rbp - 0x39], r15
mov qword [rbp - 0x41], r14
mov byte [rbp - 0x51], r14b
xor eax, eax
mov rcx, rbx
lea rdi, [rbp - 1]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 1]
lea rcx, [rbp - 0x51]
call fcn.14007df84
nop
lea r8, [rbp - 0x51]
mov rdx, rsi
lea rcx, [rbp - 0x29]
call fcn.140099274
nop
mov rdx, rax
mov rcx, r13
call fcn.140080dac
nop
cmp qword [rbp - 0x11], 0x10
jb 0x14008d87b
mov rcx, qword [rbp - 0x29]
call fcn.14009f17c
mov qword [rbp - 0x11], r15
mov qword [rbp - 0x19], r14
mov byte [rbp - 0x29], r14b
cmp qword [rbp - 0x39], 0x10
jb 0x14008d897
mov rcx, qword [rbp - 0x51]
call fcn.14009f17c
mov eax, 1
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.14009e400
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140096210
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1400d1090]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, rdx
mov rbx, rcx
xor edx, edx
mov dword [rbp - 0x50], edx
mov dword [rbp - 0x18], 0x5a3f5c3f
mov dword [rbp - 0x14], 0x71055a29
mov dword [rbp - 0x10], 0x7e10751e
mov byte [rbp - 0xc], 0x7e
lea ecx, [rdx + 0xc]
mov al, byte [rbp + rcx - 0x19]
xor byte [rbp + rcx - 0x18], al
dec rcx
test rcx, rcx
jg 0x14009625e
xor byte [rbp - 0x18], 0x5e
mov qword [rbp - 0x28], 0xf
mov qword [rbp - 0x30], rdx
mov byte [rbp - 0x40], dl
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp - 0x18]
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x40]
call fcn.14007df84
nop
lea r8, [rbp - 0x40]
mov rdx, rsi
mov rcx, rbx
call fcn.140099274
nop
cmp qword [rbp - 0x28], 0x10
jb 0x1400962c2
mov rcx, qword [rbp - 0x40]
call fcn.14009f17c
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14009e400
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400967a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push rdi
push r13
lea rbp, [rax - 0x28]
sub rsp, 0x110
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1400d1090]
xor rax, rsp
mov qword [rbp], rax
mov rsi, rdx
mov rdi, rcx
lea rcx, [rsp + 0x60]
call fcn.1400969d8
nop
xor ebx, ebx
mov qword [rsi], rbx
cmp qword [rdi + 0x18], 0x10
jb 0x1400967f1
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.140096b08
cmp dword [rbp - 0x50], ebx
jne 0x1400969a8
mov rax, qword [0x1400c4468]
mov qword [rbp - 0x18], rax
mov rax, qword [0x1400c4470]
mov qword [rbp - 0x10], rax
movzx eax, word [0x1400c4478]
mov word [rbp - 8], ax
mov al, byte [0x1400c447a]
mov byte [rbp - 6], al
mov ecx, 0x11
mov al, byte [rbp + rcx - 0x19]
xor byte [rbp + rcx - 0x18], al
dec rcx
test rcx, rcx
jg 0x140096836
xor byte [rbp - 0x18], 9
mov edi, dword [rsp + 0x60]
shl rdi, 5
mov rax, qword [rsp + 0x68]
movabs r13, 0xffffffffffff
and rax, r13
add rdi, rax
lea r8, [rbp - 0x18]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x60]
call fcn.140096c20
cmp qword [rax], rdi
je 0x1400969a3
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x60]
call fcn.140096cac
cmp word [rax + 0xe], 4
jne 0x140096998
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x60]
call fcn.140096cac
cmp dword [rax], ebx
jbe 0x140096998
lea rdx, [rbp - 0x18]
lea rcx, [rsp + 0x60]
call fcn.140096cac
mov rdx, qword [rax + 8]
and rdx, r13
mov eax, 0x1000
test word [rdx + 0xe], ax
jne 0x1400968d9
mov rdx, qword [rdx + 8]
and rdx, r13
mov r13d, 0xf
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rbx
mov byte [rsp + 0x30], bl
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x30]
call fcn.14007df84
nop
lea r9d, [r13 - 0xe]
xor r8d, r8d
lea rdx, [0x1400be760]
lea rcx, [rsp + 0x30]
call fcn.140082774
cmp rax, 0xffffffffffffffff
jne 0x14009694a
cmp qword [rsp + 0x48], 0x10
jb 0x14009693a
mov rcx, qword [rsp + 0x30]
call fcn.14009f17c
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], rbx
mov byte [rsp + 0x30], bl
jmp 0x1400969a8
mov r9, rax
xor r8d, r8d
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x30]
call fcn.14008c0c0
cmp qword [rax + 0x18], 0x10
jb 0x140096968
mov rax, qword [rax]
mov rcx, rax
call fcn.14009f4a8
mov qword [rsi], rax
cmp qword [rbp - 0x28], 0x10
jb 0x140096984
mov rcx, qword [rbp - 0x40]
call fcn.14009f17c
nop
cmp qword [rsp + 0x48], 0x10
jb 0x14009699c
mov rcx, qword [rsp + 0x30]
call fcn.14009f17c
jmp 0x14009699c
or qword [rsi], 0xffffffffffffffff
mov ebx, 1
jmp 0x1400969a8
mov qword [rsi], rbx
jmp 0x14009699c
lea rcx, [rsp + 0x60]
call fcn.140096a74
mov eax, ebx
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.14009e400
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop rdi
pop rbp
ret
Function at 0x14009bbf4
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov ebx, 0x64
mov esi, r9d
lea r8, [0x1400d7ca0]
lea edx, [rbx + 3]
mov r9d, ebx
mov rdi, rcx
call qword [sym.imp.USER32.dll_LoadStringW]
lea r12, [0x1400d7d70]
lea edx, [rbx + 9]
mov r8, r12
mov r9d, ebx
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
and dword [rbp + 0x17], 0
and dword [rbp + 0x1b], 0
lea rax, [0x14009bdd8]
mov ebx, 0x7f00
xor ecx, ecx
mov edx, ebx
mov dword [rbp + 7], 0x50
mov dword [rbp + 0xb], 3
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x1f], rdi
call qword [sym.imp.USER32.dll_LoadIconW]
mov edx, ebx
xor ecx, ecx
mov qword [rbp + 0x27], rax
call qword [sym.imp.USER32.dll_LoadCursorW]
xor ecx, ecx
mov qword [rbp + 0x2f], rax
call qword [sym.imp.GDI32.dll_GetStockObject]
mov rcx, qword [rbp + 0x1f]
and qword [rbp + 0x3f], 0
mov edx, 0x6c
mov qword [rbp + 0x37], rax
mov qword [rbp + 0x47], r12
call qword [sym.imp.USER32.dll_LoadIconW]
lea rcx, [rbp + 7]
mov qword [rbp + 0x4f], rax
call qword [sym.imp.USER32.dll_RegisterClassExW]
and qword [rsp + 0x58], 0
mov qword [rsp + 0x50], rdi
and qword [rsp + 0x48], 0
and qword [rsp + 0x40], 0
mov eax, 2
lea r8, [0x1400d7ca0]
mov r9d, 0xc0000000
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
lea ecx, [rax + 0x7e]
mov rdx, r12
mov dword [rsp + 0x28], 0x1770
mov qword [0x1400d78f8], rdi
mov dword [rsp + 0x20], 0x80000000
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rbx, rax
test rax, rax
je 0x14009bdbb
mov edx, esi
mov rcx, rax
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_UpdateWindow]
mov edx, 0x6d
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadAcceleratorsW]
lea rcx, [0x14009de74]
xor r8d, r8d
xor edx, edx
mov rbx, rax
call fcn.14009f908
mov rdi, rax
jmp 0x14009bd86
mov rcx, qword [rbp - 0x29]
lea r8, [rbp - 0x29]
mov rdx, rbx
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x14009bd86
lea rcx, [rbp - 0x29]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x29]
call qword [sym.imp.USER32.dll_DispatchMessageW]
lea rcx, [rbp - 0x29]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x14009bd5d
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 6]
xor ecx, ecx
call fcn.14007b434
mov eax, dword [rbp - 0x19]
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14009d25c
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov rax, qword gs:[0x60]
mov rbx, rcx
xor edi, edi
mov rdx, qword [rax + 0x18]
mov r8, qword [rdx + 0x20]
mov r11, r8
test r8, r8
je 0x14009d2f6
mov rdx, qword [r8 + 0x50]
cmp di, word [r8 + 0x48]
je 0x14009d2f6
cmp di, word [r8 + 0x4a]
je 0x14009d2f6
test rdx, rdx
je 0x14009d2f6
cmp rdx, 0x1024
jb 0x14009d2f6
movzx r9d, word [r8 + 0x48]
mov ecx, edi
jmp 0x14009d2e5
test r9d, r9d
je 0x14009d2ea
mov al, byte [rdx]
cmp al, 0x61
jb 0x14009d2ba
sub al, 0x20
shl ecx, 4
movzx eax, al
add rdx, 2
add ecx, eax
mov r10d, ecx
and r10d, 0xf0000000
je 0x14009d2e2
mov eax, r10d
not r10d
shr eax, 0x18
xor eax, ecx
mov ecx, eax
and ecx, r10d
dec r9d
cmp word [rdx], di
jne 0x14009d2ad
cmp ecx, dword [rbx]
je 0x14009d303
mov r8, qword [r8]
cmp r8, r11
jne 0x14009d27f
xor eax, eax
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
mov rax, qword [r8 + 0x20]
jmp 0x14009d2f8
Function at 0x14009d30c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1400d1090]
xor rax, rsp
mov qword [rbp - 0x10], rax
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x50], 0xb9f5b9c
call fcn.14009d25c
mov qword [rbp - 0x48], rax
test rax, rax
jne 0x14009d434
lea rcx, [rbp - 0x50]
mov dword [rbp - 0x50], 0x90f7c8c
call fcn.14009d25c
mov rbx, rax
test rax, rax
je 0x14009d4a4
lea rdx, [rbp - 0x50]
mov rcx, rax
mov dword [rbp - 0x50], 0xbf460e7
call fcn.14009dc30
lea rdx, [rbp - 0x50]
mov rcx, rbx
mov rdi, rax
mov dword [rbp - 0x50], 0x352a25c
call fcn.14009dc30
mov rbx, rax
mov eax, 0x5963
mov dword [rbp - 0x20], 0x5958593c
mov word [rbp - 0x30], ax
mov eax, 0x5906
mov dword [rbp - 0x1c], 0x59585934
mov word [rbp - 0x2e], ax
mov eax, 0x5974
mov word [rbp - 0x2c], ax
mov eax, 0x591a
mov word [rbp - 0x2a], ax
mov eax, 0x597f
mov word [rbp - 0x28], ax
mov eax, 0x5913
mov word [rbp - 0x26], ax
mov eax, 0x5920
mov word [rbp - 0x24], ax
mov eax, 0x5912
lea ecx, [rax + 0x46]
mov word [rbp - 0x22], ax
mov word [rbp - 0x18], cx
mov ecx, 0xc
movzx eax, word [rbp + rcx*2 - 0x32]
dec rcx
xor word [rbp + rcx*2 - 0x2e], ax
test rcx, rcx
jg 0x14009d3f3
mov eax, 0x5928
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x40]
xor word [rbp - 0x30], ax
call rdi
and qword [rbp - 0x48], 0
lea r9, [rbp - 0x48]
lea r8, [rbp - 0x40]
xor edx, edx
xor ecx, ecx
call rbx
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x14009d4a4
lea rdx, [rbp - 0x50]
mov rcx, rax
mov dword [rbp - 0x50], 0xaadf0c7
call fcn.14009dc30
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x50]
mov qword [0x1400d7fc8], rax
mov dword [rbp - 0x50], 0xaadf0f1
call fcn.14009dc30
mov rcx, qword [rbp - 0x48]
lea rdx, [rbp - 0x50]
mov dword [rbp - 0x50], 0xb3c1d03
mov qword [0x1400d7fd0], rax
call fcn.14009dc30
cmp qword [0x1400d7fc8], 0
mov qword [0x1400d7fd8], rax
je 0x14009d4a4
cmp qword [0x1400d7fd0], 0
je 0x14009d4a4
test rax, rax
je 0x14009d4a4
mov eax, 1
jmp 0x14009d4a6
xor eax, eax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14009e400
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret