joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002aff0
Capabilities:
Encode data using xor

Disassembly:
xchg rdx, rax
mov rdx, qword [rcx + 0x10]
xchg rdx, rax
xchg rcx, rdx
mov rcx, rdx
xchg rcx, rdx
test rax, rax
jne 0x14002b007
ret
cmp byte [rcx], 0
jne 0x14002b044
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14002b03e
nop dword [rax + rax]
xchg r13, rax
mov r13, qword [rdx + 0x10]
xchg r13, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14002b01a
xchg rbp, rax
mov rbp, qword [rdx + 0x10]
xchg rbp, rax
mov byte [rdx], 0x43
xor byte [rdx], 0x42
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14002bdb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
xchg rsi, rdi
mov qword [rsp + 0x20], rdi
xchg rdi, rsi
nop
sub rsp, 8
mov qword [rsp], r14
sub rsp, 0x20
xor eax, eax
mov rbp, r8
sub rbp, rdx
xchg rbp, rax
mov qword [rcx], rbp
xchg rbp, rax
sar rbp, 2
sar rbp, 1
xchg r8, rbx
mov r8, rbx
xchg r8, rbx
xchg rdx, rax
mov qword [rcx + 8], rdx
xchg rdx, rax
xchg rdx, rsi
mov rdx, rsi
xchg rdx, rsi
mov qword [rcx + 0x10], rax
mov r14, rcx
test rbp, rbp
je 0x14002bee2
movabs rax, 0xfffffff309d8b0a
add rax, 0x7fffffff
xor rax, 0x4f6274f6
cmp rbp, rax
ja 0x14002bf11
xchg rbx, rbp
mov rdx, rbx
xchg rbx, rbp
xchg rdi, r14
mov qword [rsp + 0x30], r14
xchg rdi, r14
call fcn.14001d710
shl rbp, 2
shl rbp, 2
xchg rdi, rax
mov rax, rdi
xchg rdi, rax
add rbp, rax
mov qword [r14], rax
xchg r10, rax
mov qword [r14 + 8], r10
xchg r10, rax
xchg r13, rbp
mov qword [r14 + 0x10], r13
xchg r13, rbp
cmp rsi, rbx
je 0x14002becd
mov byte [rdi], 0x4d
xor byte [rdi], 0x4d
xor eax, eax
xchg rbx, rax
mov qword [rdi + 8], rbx
xchg rbx, rax
mov rcx, rdi
mov rax, qword [rsi]
mov byte [rdi], 0x78
xor byte [rdi], 0x7e
xchg rsi, rax
mov qword [rdi + 8], rsi
xchg rsi, rax
call fcn.14001d970
xchg rdi, rbx
mov rcx, rbx
xchg rbx, rdi
call fcn.14001d970
add rdi, 0x10
nop
add rsi, 0x25e1854b
sub rsi, 0x25e18543
cmp rsi, rbx
jne 0x14002be7a
xchg r15, rdi
mov qword [r14 + 8], r15
xchg rdi, r15
xchg r13, rdi
mov r13, qword [rsp + 0x30]
xchg rdi, r13
mov rbx, qword [rsp + 0x38]
xchg r14, r13
mov rax, r13
xchg r13, r14
xchg rbx, rbp
mov rbx, qword [rsp + 0x40]
xchg rbp, rbx
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
push rcx
push rcx
push rbx
xchg qword [rsp + 0x18], r14
add rsp, 0x20
ret
call fcn.14000f3f0
int3

Function at 0x14002bf20
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 8], r13
xchg r13, rbx
mov qword [rsp + 0x10], rdx
nop
push r9
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, r14
mov rdi, r14
xchg rcx, r14
lea rbx, [rdx + 4]
xchg r8, rbx
mov rdx, r8
xchg r8, rbx
call fcn.14002a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x6d
xor byte [rbx + rax], 0x6d
inc rax
cmp rax, 6
jb 0x14002bf59
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret
Function at 0x14002bf90
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r9
mov qword [rsp + 8], r9
xchg rbx, r9
xchg rdx, r8
mov qword [rsp + 0x10], r8
xchg rdx, r8
push rdi
sub rsp, 0x20
xchg rcx, r10
mov rdi, r10
xchg r10, rcx
lea rbx, [rdx + 6]
mov rdx, rbx
call fcn.14002a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x1e
xor byte [rbx + rax], 0x1e
inc rax
cmp rax, 8
jb 0x14002bfc3
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbp, rbx
mov rbp, qword [rsp + 0x30]
xchg rbx, rbp
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x14002c070
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rdx, rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 8]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14002a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x3d
xor byte [rbx + rax], 0x3d
inc rax
cmp rax, 0xe
jb 0x14002c0a3
xchg rbp, rdi
mov rax, rbp
xchg rdi, rbp
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rbx
push rdx
xchg qword [rsp + 0x18], rdi
add rsp, 0x20
ret

Function at 0x14002c0e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0xa]
xchg rbx, r9
mov rdx, r9
xchg r9, rbx
call fcn.14002a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x4d
xor byte [rbx + rax], 0x4d
inc rax
cmp rax, 0x10
jb 0x14002c10f
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rdi
mov rdi, qword [rsp + 0x30]
xchg rdi, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14002c150
Capabilities:
Encode data using xor

Disassembly:
xchg r10, rbx
mov qword [rsp + 8], r10
xchg rbx, r10
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rdx, rdi
mov rdx, rcx
xchg rdx, rdi
lea rbx, [rdx + 0xa]
xchg r9, rbx
mov rdx, r9
xchg r9, rbx
call fcn.14002a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x33
xor byte [rbx + rax], 0x33
inc rax
cmp rax, 0x12
jb 0x14002c18c
xchg rdi, r15
mov rax, r15
xchg r15, rdi
xchg rbx, r10
mov r10, qword [rsp + 0x30]
xchg rbx, r10
add rsp, 0x20
push rcx
push rcx
push rax
push rcx
push rbx
push rdx
push rbx
push rdx
xchg qword [rsp + 0x40], rdi
pop rdx
pop rbx
pop rdx
pop rbx
pop rcx
pop rax
pop rcx
pop rcx
add rsp, 8
ret

Function at 0x14002c1d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rsi
mov qword [rsp + 0x10], rsi
xchg rdx, rsi
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdx, rdi
mov rdx, rcx
xchg rdi, rdx
lea rbx, [rdx + 0x10]
mov rdx, rbx
call fcn.14002a8d0
nop
xor eax, eax
mov byte [rbx + rax], 5
xor byte [rbx + rax], 5
inc rax
cmp rax, 0x1e
jb 0x14002c205
xchg rbx, rax
mov rbx, rdi
xchg rbx, rax
xchg rdx, rbx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
add rsp, 0x20
push rbx
push rcx
push rcx
push rcx
push rcx
push rcx
push rdx
push rdx
xchg qword [rsp + 0x40], rdi
pop rdx
pop rdx
pop rcx
pop rcx
pop rcx
pop rcx
pop rcx
pop rbx
add rsp, 8
ret
Function at 0x14002c330
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, r10
mov rdi, r10
xchg rcx, r10
lea rbx, [rdx + 0x14]
xchg rsi, rdx
mov rsi, rbx
xchg rdx, rsi
call fcn.14002a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x6d
xor byte [rbx + rax], 0x6d
inc rax
cmp rax, 0x24
jb 0x14002c365
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14002c4a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, r13
mov rdi, r13
xchg r13, rcx
lea rbx, [rdx + 0x16]
xchg r14, rbx
mov rdx, r14
xchg r14, rbx
call fcn.14002a8d0
nop
xor eax, eax
mov byte [rbx + rax], SHCreateMemStream
xor byte [rbx + rax], 0xb
inc rax
cmp rax, 0x2a
jb 0x14002c4cd
xchg r14, rax
mov r14, rdi
xchg r14, rax
xchg r8, rbx
mov r8, qword [rsp + 0x30]
xchg rbx, r8
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14002c830
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rbx
mov qword [rsp + 0x10], rbx
xchg rdx, rbx
push rdi
sub rsp, 0x20
xchg rdx, rcx
mov rdi, rdx
xchg rcx, rdx
lea rbx, [rdx + 0x22]
xchg rdx, r13
mov r13, rbx
xchg r13, rdx
call fcn.14002a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x3f
xor byte [rbx + rax], 0x3f
inc rax
cmp rax, 0x42
jb 0x14002c863
xchg rbx, rax
mov rbx, rdi
xchg rbx, rax
xchg rbx, rcx
mov rcx, qword [rsp + 0x30]
xchg rbx, rcx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14002c900
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r11, rdi
mov r11, rcx
xchg rdi, r11
lea rbx, [rdx + 0x26]
xchg rbx, r8
mov rdx, r8
xchg rbx, r8
call fcn.14002a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x2b
xor byte [rbx + rax], 0x2b
inc rax
cmp rax, 0x4a
jb 0x14002c936
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14002c9d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r9
mov qword [rsp + 0x10], r9
xchg rdx, r9
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg r12, rcx
mov rdi, r12
xchg rcx, r12
lea rbx, [rdx + 0x2a]
mov rdx, rbx
call fcn.14002a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x48
xor byte [rbx + rax], 0x48
inc rax
cmp rax, 0x50
jb 0x14002ca06
xchg r8, rax
mov r8, rdi
xchg r8, rax
xchg rbx, rbp
mov rbp, qword [rsp + 0x30]
xchg rbp, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x14002cb80
Capabilities:
Encode data using xor

Disassembly:
xchg r15, rbx
mov qword [rsp + 8], r15
xchg r15, rbx
xchg rdx, r15
mov qword [rsp + 0x10], r15
xchg r15, rdx
push rdi
sub rsp, 0x20
xchg r12, rcx
mov rdi, r12
xchg r12, rcx
lea rbx, [rdx + 0x30]
mov rdx, rbx
call fcn.14002a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x7c
xor byte [rbx + rax], 0x7c
inc rax
cmp rax, 0x5c
jb 0x14002cbb3
xchg rdx, rdi
mov rax, rdx
xchg rdx, rdi
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14002d080
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rdi
mov qword [rsp + 8], rdi
xchg rdi, rbx
xchg r13, rdx
mov qword [rsp + 0x10], r13
xchg r13, rdx
push rdi
sub rsp, 0x20
xchg rcx, r10
mov rdi, r10
xchg rcx, r10
lea rbx, [rdx + 0xc]
xchg r13, rbx
mov rdx, r13
xchg r13, rbx
call fcn.14002a8d0
nop
xor eax, eax
mov byte [rbx + rax], 0x4e
xor byte [rbx + rax], 0x4e
inc rax
cmp rax, 0x14
jb 0x14002d0b9
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg r8, rbx
mov r8, qword [rsp + 0x30]
xchg r8, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140062840
Capabilities:
Terminate process

Disassembly:
xchg rcx, rbx
mov qword [rsp + 8], rcx
xchg rbx, rcx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
nop
mov qword [rsp - 8], rbp
sub rsp, 8
lea rbp, [rsp - 0x980]
sub rsp, 0xa80
xchg rcx, r12
mov rbx, r12
xchg rcx, r12
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x551b3afe
sub r8d, 0x551b30f6
call sub.VCRUNTIME140.dll_memset
xchg rcx, r9
mov r9, qword [rbx]
xchg r9, rcx
sub rcx, 0xfffffffffffffa28
call fcn.14002aff0
xor ebx, ebx
mov dword [rsp + 0x32], 0x57ec1bbd
xor dword [rsp + 0x32], 0xe952a503
mov edx, ebx
mov dword [rsp + 0x42], 0x5bdcfb81
add dword [rsp + 0x42], 0xa3d903e6
mov r8, rax
mov dword [rsp + 0x46], 0x6cc58f1a
xor dword [rsp + 0x46], 0x936e7078
mov dword [rsp + 0x36], 0xfffee46
xor dword [rsp + 0x36], 0xb14150f8
mov dword [rsp + 0x4a], 0x4aa583b3
xor dword [rsp + 0x4a], 0xb5c77c06
mov dword [rsp + 0x4e], 0x584abaf6
add dword [rsp + 0x4e], 0xa76744af
mov dword [rsp + 0x3a], 0x38f58de0
add dword [rsp + 0x3a], 0x85c930de
mov dword [rsp + 0x52], 0x6c43f69a
add dword [rsp + 0x52], 0x9371091a
mov dword [rsp + 0x56], 0x38b37266
xor dword [rsp + 0x56], 0xc7018dd1
mov word [rsp + 0x3e], 0x320a
xor word [rsp + 0x3e], 0x8cb4
mov dword [rsp + 0x5a], 0x6e591b61
add dword [rsp + 0x5a], 0x914ee455
mov byte [rsp + 0x40], 0x2b
xor byte [rsp + 0x40], 0x95
mov dword [rsp + 0x5e], 0x7413a583
sub dword [rsp + 0x5e], 0x7412a5dd
nop
movzx ecx, word [rsp + rdx*2 + 0x42]
movzx eax, byte [rsp + rdx + 0x32]
add ax, cx
mov word [rsp + rdx*2 + 0x42], ax
mov byte [rsp + rdx + 0x32], bl
inc rdx
cmp rdx, 0xf
jb 0x140062976
lea rdx, [rsp + 0x42]
lea rcx, [rsp + 0x70]
call fcn.140034a40
mov rax, rbx
mov byte [rsp + rax + 0x42], bl
inc rax
cmp rax, 0x1e
jb 0x1400629ab
mov dword [rsp + 0x20], 0x52c82190
xor dword [rsp + 0x20], 0xec769f2e
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
mov dword [rsp + 0x26], 0x725a1e55
add dword [rsp + 0x26], 0x8d5ae132
mov dword [rsp + 0x2a], 0x2652a5de
add dword [rsp + 0x2a], 0xd95f59d6
mov byte [rsp + 0x24], 0x5f
add byte [rsp + 0x24], 0x5f
mov dword [rsp + 0x2e], 0x10e79724
sub dword [rsp + 0x2e], 0x10e69770
nop word [rax + rax]
movzx edx, word [rsp + rax*2 + 0x26]
movzx ecx, byte [rsp + rax + 0x20]
add cx, dx
mov word [rsp + rax*2 + 0x26], cx
mov byte [rsp + rax + 0x20], bl
inc rax
cmp rax, 5
jb 0x140062a17
mov r9d, 0x3582653d
xor r9d, 0x3582652d
lea r8, [rsp + 0x26]
lea rdx, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop word [rax + rax]
mov byte [rsp + rbx + 0x26], 0x2a
sub byte [rsp + rbx + 0x26], 0x2a
inc rbx
cmp rbx, 0xa
jb 0x140062a62
mov ecx, 0x7de73de1
xor ecx, 0x8218c21e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140098aa0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x80
mov rbx, rcx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jle 0x140098b84
mov edi, 0x50004
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov eax, dword [rsp + 0x58]
cmp eax, 0x12
ja 0x140098afc
bt edi, eax
jb 0x140098b84
cmp byte [rbx + 0x5f0], 0
jne 0x140098b84
cmp dword [rbx + 0xe8], 0
je 0x140098b69
cmp eax, 0x101
je 0x140098b2c
cmp eax, 0x202
jne 0x140098b69
mov edx, 0x64
xor ecx, ecx
call fcn.1400c6ab0
cmp eax, 0xf
jge 0x140098b69
mov rcx, qword [0x140128e90]
call fcn.14000c9b0
mov cl, 1
call fcn.140ea9fcb
nop
test al, al
jne 0x140098be3
mov rcx, qword [0x140128e90]
call fcn.14000cad0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jg 0x140098ad0
mov rcx, qword [rbx + 0x5b8]
xor edi, edi
test rcx, rcx
je 0x140098bb6
xor r8d, r8d
lea edx, [rdi - 4]
call qword [sym.imp.USER32.dll_SetWindowLongPtrW]
mov rcx, qword [rbx + 0x5b8]
call qword [sym.imp.USER32.dll_DestroyWindow]
mov qword [rbx + 0x5b8], rdi
mov rcx, qword [rbx + 0x5b0]
test rcx, rcx
je 0x140098bd2
call sub.gdiplus.dll_GdiplusShutdown
mov qword [rbx + 0x5b0], rdi
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rdi
ret
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.140015af0
nop
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140015af0
nop
lea rdi, [rbx + 0x308]
mov rcx, rdi
call fcn.14002dd70
lea r8, [rsp + 0x20]
mov edx, 5
mov rcx, rax
call fcn.14001a890
test al, al
je 0x140098c8a
lea rax, [rsp + 0x30]
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x98], 0x2718
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x30]
call fcn.14002b370
mov rbx, rax
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.140019850
mov rcx, rax
mov rdx, rbx
call fcn.140019190
mov rcx, rdi
call fcn.14002dd70
mov r9b, 1
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.14001af90
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1400a2720
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, r9
cmp rdx, r8
je 0x1400a27bd
lea rcx, [rdx + 0x18]
sub rax, rdx
xor r10d, r10d
nop dword [rax]
nop word [rax + rax]
mov qword [r9], r10
xchg rdi, r10
mov qword [rax + rcx - 8], rdi
xchg rdi, r10
mov qword [rax + rcx], r10
xchg rcx, rdi
movups xmm0, xmmword [rdi - 0x18]
xchg rdi, rcx
movups xmmword [r9], xmm0
xchg rcx, r10
movups xmm1, xmmword [r10 - 8]
xchg rcx, r10
xchg r9, rdi
movups xmmword [rdi + 0x10], xmm1
xchg r9, rdi
xchg r15, r10
mov qword [rcx - 8], r15
xchg r10, r15
mov qword [rcx], 0x1f3b8dd
xor qword [rcx], 0x1f3b8da
mov word [rcx - 0x18], r10w
nop
add r9, 0x31c23f1f
sub r9, 0x31c23eff
lea rcx, [rcx + 0x20]
lea rdx, [rcx - 0x18]
cmp rdx, r8
jne 0x1400a2744
xchg r9, rax
mov r9, rax
xchg r9, rax
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x1400a9b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp qword [rdx + 0x18], 8
xchg r9, r13
mov r13, rcx
xchg r13, r9
xchg r11, r10
mov r10, qword [rdx + 0x10]
xchg r10, r11
jb 0x1400a9b81
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
mov r10, qword [rcx + 0x10]
jb 0x1400a9b99
xchg r15, r9
mov r15, qword [rcx]
xchg r15, r9
cmp r11, r10
xchg r10, r15
mov rax, r15
xchg r10, r15
cmovb rax, r11
test rax, rax
je 0x1400a9c24
movzx ecx, word [r9]
movzx r8d, word [rdx]
cmp cx, r8w
jb 0x1400a9bf6
sub r9, rdx
cmp cx, r8w
ja 0x1400a9c15
cmp rax, 1
je 0x1400a9c24
movzx ecx, word [r9 + rdx + 2]
add rdx, 2
dec rax
movzx r8d, word [rdx]
cmp cx, r8w
jae 0x1400a9bcb
mov eax, 0x985f349
add eax, 0xf67a0cb6
test eax, eax
jns 0x1400a9c38
mov al, 0x70
add al, 0x8f
nop
add rsp, 8
jmp qword [rsp - 8]
mov eax, 0x17f9bb56
xor eax, 0x17f9bb57
jmp 0x1400a9c00
cmp r10, r11
jae 0x1400a9c32
mov al, 0x53
xor al, 0xac
ret
jbe 0x1400a9c3d
mov al, 0x6a
sub al, 0x69
ret
xor al, al
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400be260
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg rsi, r9
mov qword [rsp + 0x20], rsi
xchg rsi, r9
mov qword [rsp + 0x18], r8
xchg rcx, r8
mov qword [rsp + 8], r8
xchg rcx, r8
push rbx
nop
sub rsp, 8
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
push r13
nop
sub rsp, 8
mov qword [rsp], r14
push r15
sub rsp, 0x58
xchg rdi, r9
mov rbx, rdi
xchg r9, rdi
xchg rdx, rbx
mov rsi, rbx
xchg rbx, rdx
xchg rcx, r11
mov r9, r11
xchg rcx, r11
xor ebp, ebp
test rdx, rdx
jne 0x1400be2de
mov eax, ebp
jmp 0x1400be30a
mov eax, 0x7ba0df94
xor eax, 0x7ba085d9
cmp word [rdx], ax
je 0x1400be2f9
mov rax, rbp
jmp 0x1400be30a
movsxd rax, dword [rdx + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
cmovne rax, rbp
mov ecx, 0x1ac4758d
sub ecx, 0x1ac47382
cmp word [rax + 0x18], cx
jne 0x1400be432
mov r14d, dword [rax + 0x88]
add r14, rsi
je 0x1400be432
mov r15d, dword [r14 + 0x1c]
add r15, rsi
mov r12d, dword [r14 + 0x24]
add r12, rsi
mov r13d, dword [r14 + 0x20]
add r13, rsi
mov edi, ebp
cmp dword [r14 + 0x18], 0
jbe 0x1400be40c
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
mov ecx, dword [r13 + rax*4]
add rcx, rsi
movzx eax, word [r12 + rax*2]
mov edx, dword [r15 + rax*4]
add rdx, rsi
cmp rcx, 0xffff
jbe 0x1400be400
mov qword [rsp + 0xa8], rdx
xchg rcx, r10
mov qword [rsp + 0x30], r10
xchg r10, rcx
xchg r12, r8
mov qword [rsp + 0x38], r12
xchg r8, r12
xchg r9, r10
mov qword [rsp + 0x40], r10
xchg r9, r10
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400be4bb
xchg rdi, rax
mov rdi, qword [rcx]
xchg rdi, rax
lea rdx, [rsp + 0xa8]
xchg r11, rdx
mov qword [rsp + 0x20], r11
xchg rdx, r11
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
test al, al
je 0x1400be40c
xchg r8, r11
mov r11, qword [rsp + 0xb0]
xchg r8, r11
mov r9, qword [rsp + 0xa0]
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x1400be35d
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400be429
cmp rcx, rbx
mov rax, qword [rcx]
setne dl
call qword [rax + 0x20]
mov qword [rbx + 0x38], rbp
mov al, 0x2b
xor al, 0x2a
jmp 0x1400be45b
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1400be459
xchg rdi, rax
mov rdi, qword [rcx]
xchg rdi, rax
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
xchg r11, rbp
mov qword [rbx + 0x38], r11
xchg r11, rbp
xor al, al
add rsp, 0x58
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
xchg qword [rsp - 8], r14
nop
mov r13, qword [rsp]
add rsp, 8
nop
mov r12, qword [rsp]
add rsp, 8
nop
xchg qword [rsp], rdi
add rsp, 8
push rbx
push rcx
push rcx
push rbx
xchg qword [rsp + 0x20], rsi
add rsp, 0x28
push rbx
push rax
push rbx
push rax
push rdx
xchg qword [rsp + 0x28], rbp
add rsp, 0x30
nop
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
nop
int3
Function at 0x1400beb30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r13
sub rsp, 0x30
xor ebx, ebx
mov r13d, r8d
mov rdi, rdx
test rdx, rdx
jne 0x1400beb61
mov eax, ebx
jmp 0x1400beb91
mov eax, 0xc9a7aa3
sub eax, 0xc9a2056
cmp word [rdx], ax
je 0x1400beb80
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
jmp 0x1400beb91
movsxd rax, dword [rdx + 0x3c]
add rax, rdi
cmp dword [rax], 0x4550
cmovne rax, rbx
xchg rbp, rbx
mov qword [rsp + 0x50], rbx
xchg rbx, rbp
mov ecx, 0x3408d58f
sub ecx, 0x3408d384
xchg r13, rsi
mov qword [rsp + 0x58], r13
xchg rsi, r13
xchg rdi, r12
mov qword [rsp + 0x60], rdi
xchg r12, rdi
mov qword [rsp + 0x28], r14
xchg r15, rdi
mov qword [rsp + 0x20], rdi
xchg rdi, r15
cmp word [rax + 0x18], cx
jne 0x1400bec41
mov esi, dword [rax + 0x88]
add rsi, rdi
je 0x1400bec41
mov r14d, dword [rsi + 0x1c]
mov r15d, dword [rsi + 0x24]
add r14, rdi
mov r12d, dword [rsi + 0x20]
add r15, rdi
add r12, rdi
cmp dword [rsi + 0x18], 0
jbe 0x1400bec41
nop dword [rax]
nop dword [rax + rax]
mov eax, ebx
xor edx, edx
mov ecx, dword [r12 + rax*4]
movzx eax, word [r15 + rax*2]
add rcx, rdi
mov ebp, dword [r14 + rax*4]
add rbp, rdi
call fcn.140027350
cmp eax, r13d
je 0x1400bec8f
inc ebx
cmp ebx, dword [rsi + 0x18]
jb 0x1400bec11
xor eax, eax
mov r15, qword [rsp + 0x20]
xchg rsi, r14
mov rsi, qword [rsp + 0x28]
xchg rsi, r14
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
nop
add rsp, 8
mov r13, qword [rsp - 8]
push rcx
push rcx
push rcx
xchg qword [rsp + 0x18], rdi
add rsp, 0x20
nop
add rsp, 8
mov rbx, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
xchg rbp, r11
mov rax, r11
xchg r11, rbp
jmp 0x1400bec43

Function at 0x1400c35c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xchg r11, rdx
mov rdx, r11
xchg rdx, r11
xchg r10, rcx
mov rcx, r10
xchg r10, rcx
test rdx, rdx
je 0x1400c3644
xchg rdi, rbx
mov qword [rsp], rdi
xchg rbx, rdi
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1400c3637
movzx eax, byte [r10]
test bl, bl
je 0x1400c3619
lea rcx, [r9 - 1]
xchg r9, rdi
mov rdx, rdi
xchg rdi, r9
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1400c3608
jmp 0x1400c3637
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1400c3628
inc r10
sub r11, 1
jne 0x1400c35ea
mov rbx, qword [rsp]
add rsp, 8
ret

Function at 0x1400c5280
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov qword [rsp], rbx
sub rsp, 0x20
xchg r13, rax
mov r13, qword [rcx + 0x38]
xchg r13, rax
lea rbx, [rcx + 0x30]
cmp rax, qword [rcx + 0x40]
je 0x1400c52ca
xchg r11, rax
mov rcx, r11
xchg r11, rax
call fcn.1400168d0
nop
add qword [rbx + 8], 0x5f7dd7b9
sub qword [rbx + 8], 0x5f7dd799
add rsp, 0x20
push rcx
push rcx
xchg qword [rsp + 0x10], rbx
pop rcx
pop rcx
add rsp, 8
ret
xchg rsi, r8
mov rsi, rdx
xchg rsi, r8
xchg rcx, rbx
mov rbx, rcx
xchg rcx, rbx
mov rdx, rax
add rsp, 0x20
nop
add rsp, 8
mov rbx, qword [rsp - 8]
jmp fcn.14002e210