joyce8/EMBER2024-capa huggingface dataset:
Function at 0x73b520
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x73b69b
sub rsp, 0x80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov rax, qword [0x016365b0]
mov qword [rsp], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 8], rax
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x10], rcx
call fcn.00730ac0
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
jne 0x73b599
mov qword [rsp + 0x98], rax
mov rbp, qword [rsp + 0x78]
add rsp, 0x80
ret
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
movups xmmword [rsp + 0x68], xmm0
lea rax, [0x007df460]
mov qword [rsp], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 8], rcx
call fcn.0040d660
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rcx
lea rax, [0x007df460]
mov qword [rsp], rax
lea rcx, [0x010e3b50]
mov qword [rsp + 8], rcx
call fcn.0040d660
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 0x10]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rax
lea rax, [0x008b14eb]
mov qword [rsp], rax
mov qword [rsp + 8], 0x21
lea rax, [rsp + 0x58]
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], 2
mov qword [rsp + 0x20], 2
call fcn.004d24a0
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rcx
lea rax, [0x007df460]
mov qword [rsp], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 8], rax
call fcn.0040d660
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.0042a320
ud2
call fcn.00451b80
jmp fcn.0073b520
Function at 0x73cba0
Capabilities:
Reference http user-agent string
Reference sql statements
Run powershell expression

Disassembly:
mov rcx, qword gs:[0x28]
mov rcx, qword [rcx]
cmp rsp, qword [rcx + 0x10]
jbe 0x73cc90
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
movzx eax, byte [0x01635e89]
cmp al, 1
jbe 0x73cbdd
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
jne 0x73cbe6
call fcn.00429570
ud2
mov byte [0x01635e89], 1
call fcn.00478de0
call fcn.004dfae0
call fcn.0045ed10
call fcn.00568a00
call fcn.004a0040
call fcn.004bebd0
call fcn.004514e0
call fcn.004acaf0
call fcn.0045cf30
call fcn.0048f3c0
call fcn.006b25a0
call fcn.0071be90
call fcn.00731360
lea rax, [0x008b08a6]
mov qword [rsp], rax
mov qword [rsp + 8], 0x20
call fcn.0045a2a0
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov qword [0x010ef210], rax
mov eax, dword [0x01636820]
test eax, eax
jne 0x73cc7f
mov qword [0x010ef218], rcx
call fcn.0073b890
mov byte [0x01635e89], 2
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rdi, [0x010ef218]
mov rax, rcx
call fcn.004544a0
jmp 0x73cc69
call fcn.00451b80
jmp fcn.0073cba0
Function at 0x100db0d40
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x100db0d4d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x100db0d5d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x100db0d45
lea eax, [rcx + 1]
jmp 0x100db0d6b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x100db0d7e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x100db0d64
sub eax, 3
jb 0x100db0d9e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x100db0ded
sar eax, 1
movsxd rbp, eax
jb 0x100db0dd4
jmp 0x100db0dac
add ebx, ebx
jne 0x100db0daa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x100db0dd4
inc ecx
add ebx, ebx
jne 0x100db0dba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x100db0dd4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x100db0dcd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x100db0dbc
add ecx, 2
jmp 0x100db0dd9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.100db0d02
jmp 0x100db0d4d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x596ed0
mov dl, 0x52
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x100db0e39
cmp rsi, rcx
jae 0x100db0e41
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x100db0e20
cmp al, 0x8f
ja 0x100db0e20
cmp byte [rsi - 2], 0xf
je 0x100db0e26
sub al, 0xe8
cmp al, 1
ja 0x100db0e0a
cmp rsi, rcx
jae 0x100db0e41
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x100db0e10
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x100db0e41
lodsb al, byte [rsi]
jmp 0x100db0e20
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xdac000]
mov eax, dword [rdi]
or eax, eax
je 0x100db0e9e
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xdb80e8]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x100db0e4e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x100db0e98
mov qword [rbx], rax
add rbx, 8
jmp 0x100db0e6e
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.100db0f21], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.100db0f21
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x100db0f11
sub rsp, 0xffffffffffffff80
jmp 0x100003460
Function at 0x100f7a680
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x100f7a68d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x100f7a69d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x100f7a685
lea eax, [rcx + 1]
jmp 0x100f7a6ab
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x100f7a6be
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x100f7a6a4
sub eax, 3
jb 0x100f7a6de
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x100f7a72d
sar eax, 1
movsxd rbp, eax
jb 0x100f7a714
jmp 0x100f7a6ec
add ebx, ebx
jne 0x100f7a6ea
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x100f7a714
inc ecx
add ebx, ebx
jne 0x100f7a6fa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x100f7a714
call r11
adc ecx, ecx
add ebx, ebx
jne 0x100f7a70d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x100f7a6fc
add ecx, 2
jmp 0x100f7a719
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.100f7a642
jmp 0x100f7a68d
pop rsi
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0x59e120
mov dl, 0x6d
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x100f7a779
cmp rsi, rcx
jae 0x100f7a781
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x100f7a760
cmp al, 0x8f
ja 0x100f7a760
cmp byte [rsi - 2], 0xf
je 0x100f7a766
sub al, 0xe8
cmp al, 1
ja 0x100f7a74a
cmp rsi, rcx
jae 0x100f7a781
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x100f7a750
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x100f7a781
lodsb al, byte [rsi]
jmp 0x100f7a760
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0xf76000]
mov eax, dword [rdi]
or eax, eax
je 0x100f7a7de
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xf81bf0]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x100f7a78e
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x100f7a7d8
mov qword [rbx], rax
add rbx, 8
jmp 0x100f7a7ae
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.100f7a861], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.100f7a861
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x100f7a851
sub rsp, 0xffffffffffffff80
jmp 0x100003460
Function at 0x1400281fc
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, 0x138
mov rbx, rcx
cmp dword [rcx], r9d
jne 0x140028259
lea r8, [rcx + 0x10]
mov edx, dword [r8 - 8]
xor edx, dword [r8]
lea r8, [r8 + 8]
btr edx, 0x1f
xor rdx, qword [r8 - 0x10]
mov al, dl
and al, 1
neg al
movabs rax, 0xb5026f5aa96619e9
sbb rcx, rcx
shr rdx, 1
and rcx, rax
xor rcx, qword [r8 + 0x4d0]
xor rcx, rdx
mov qword [r8 + 0x9b0], rcx
sub r9, 1
jne 0x140028214
jmp 0x140028266
cmp dword [rcx], 0x270
jb 0x140028266
call fcn.1400282bc
mov eax, dword [rbx]
mov rdx, qword [rbx + rax*8 + 8]
inc eax
mov dword [rbx], eax
mov rcx, rdx
mov rax, qword [rbx + 0x1388]
shr rcx, 0x1d
and rax, rcx
movabs rcx, 0x38eb3ffff6d3
xor rdx, rax
mov rax, rdx
and rax, rcx
shl rax, 0x11
xor rdx, rax
mov rax, rdx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rdx, rax
mov rax, rdx
shr rax, 0x2b
xor rax, rdx
add rsp, 0x20
pop rbx
ret

Function at 0x1400282bc
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
lea r10, [rcx + 0x9c8]
mov r9, rcx
mov rax, qword [r10]
mov r11d, 0x9c
mov ebx, 0x7fffffff
movabs rdi, 0xb5026f5aa96619e9
lea r8, [r10 + 8]
mov rdx, qword [r8]
xor rdx, rax
and rdx, rbx
xor rdx, rax
mov al, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, rdi
xor rcx, qword [r10 + 0x4e0]
xor rcx, rdx
mov qword [r10 - 0x9c0], rcx
lea r10, [r8]
sub r11, 1
jne 0x1400282e8
lea r10, [r9 + 0xea8]
mov r11d, 0x9b
mov rax, qword [r10]
lea r8, [r10 + 8]
mov rdx, qword [r8]
xor rdx, rax
and rdx, rbx
xor rdx, rax
mov al, dl
and al, 1
neg al
mov rax, qword [r8]
sbb rcx, rcx
shr rdx, 1
and rcx, rdi
xor rcx, qword [r10 - 0xea0]
xor rcx, rdx
mov qword [r10 - 0x9c0], rcx
lea r10, [r8]
sub r11, 1
jne 0x140028334
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 8]
and rdx, rbx
mov rbx, qword [rsp + 8]
xor rdx, qword [r9 + 0x1380]
mov al, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rdi
mov rdi, qword [rsp + 0x10]
xor rcx, qword [r9 + 0x4e0]
xor rcx, rdx
mov qword [r9 + 0x9c0], rcx
and dword [r9], 0
ret
Function at 0x140030f58
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x2a0
movsxd rsi, r8d
mov rbx, rdx
cmp esi, 2
jl 0x140031020
cmp byte [rdx], 0x81
jne 0x140031020
lea rax, [rsp + 0x30]
xor ebp, ebp
lea r9, [r11 - 0x208]
mov qword [rsp + 0x20], rax
lea r8, [r11 - 0x108]
xor edi, edi
lea rdx, [rsp + 0x68]
call fcn.1400b25a4
mov al, byte [rsp + 0xa0]
xor r8d, r8d
test al, al
je 0x140030fdd
lea rdx, [rsp + 0xa0]
movsx eax, al
inc rdx
and eax, 0xf
lea ecx, [rax + r8]
mov al, byte [rdx]
add ebp, ecx
xor edi, ecx
inc r8d
cmp al, 0
jne 0x140030fc3
movsx eax, byte [rbx + 1]
lea edx, [rbp + 0x1d]
xor edx, edi
add edi, 3
xor eax, edx
cmp al, 0x81
je 0x140030ff3
xor eax, eax
jmp 0x140031025
cmp rsi, 2
jle 0x14003101a
mov r8, rbx
lea r9, [rsi - 2]
mov cl, byte [r8 + 2]
add edx, 0x1d
xor edx, edi
add edi, 3
xor cl, dl
mov byte [r8], cl
inc r8
sub r9, 1
jne 0x140031000
and word [rsi + rbx - 2], 0
mov eax, 1
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140032f30
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov rbx, rcx
cmp qword [rcx], 0xffffffffffffffff
je 0x1400330af
add rcx, 0x1038
call fcn.1405b9960
nop
nop
mov eax, dword [rbx + 0x1458]
test eax, eax
je 0x140032f85
cmp dword [rbx + 0x145c], eax
lea rax, [0x1401910bc]
ja 0x140032f8c
lea rax, [0x1401910bf]
mov qword [rsp + 0xa8], rax
movzx edi, word [rbx + 0x1046]
movzx esi, word [rbx + 0x1044]
movzx ebp, word [rbx + 0x1042]
movzx r14d, word [rbx + 0x1040]
movzx r15d, word [rbx + 0x103e]
movzx r12d, word [rbx + 0x103a]
movzx r13d, word [rbx + 0x1038]
lea rcx, [0x1401910c0]
call fcn.140040150
nop
mov rdx, rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r15d
mov r9d, r12d
mov r8d, r13d
lea rcx, [rbx + 0x38]
call fcn.14002e110
nop
or rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi + 0x38], 0
jne 0x140033010
cmp dword [rbx + 0x1454], 0
je 0x14003304f
movsxd rdx, edi
test edi, edi
jle 0x140033066
lea rcx, [rbx + 0x38]
nop
mov eax, dword [rbx + 0x1454]
add eax, 2
mov dword [rbx + 0x1454], eax
add al, 0x43
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x140033030
jmp 0x140033066
lea rcx, [rbx + 0x104c]
lea r9, [rbx + 0x38]
lea r8, [rbx + 0x38]
mov edx, edi
call fcn.140044ac0
nop
cmp dword [rbx + 0x1458], 0x3e7
je 0x140033094
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xa0]
mov r8d, edi
lea rdx, [rbx + 0x38]
mov rcx, qword [rbx]
call fcn.1405b232f
nop
nop
mov rcx, qword [rbx]
call fcn.1405b4340
nop
nop
mov rcx, qword [rbx]
call qword [fcn.140120590]
nop
mov qword [rbx], 0xffffffffffffffff
lea rcx, [rbx + 8]
call fcn.1405bbfa3
nop
nop
mov dword [rbx + 0x30], 0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003d640
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
mov eax, 0x1098
call fcn.14009e480
sub rsp, rax
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rsp + 0x1050], rax
cmp qword [rcx], 0xffffffffffffffff
mov rdi, rdx
mov rbx, rcx
jne 0x14003d683
xor al, al
jmp 0x14003d83f
mov eax, dword [rcx + 0x1458]
test eax, eax
je 0x14003d6a5
cmp byte [rdx], 0x21
je 0x14003d6a5
mov ecx, dword [rcx + 0x145c]
cmp ecx, eax
ja 0x14003d67c
lea eax, [rcx + 1]
mov dword [rbx + 0x145c], eax
cmp dword [rbx + 0x30], 0
mov qword [rsp + 0x1090], rbp
mov qword [rsp + 0x1088], rsi
mov qword [rsp + 0x1080], r12
mov qword [rsp + 0x1078], r13
mov qword [rsp + 0x1070], r14
mov qword [rsp + 0x1068], r15
je 0x14003d6ed
lea rcx, [rbx + 8]
call qword [fcn.140120488]
mov rdi, qword [rsp + 0x10b8]
lea rsi, [rsp + 0x10c0]
call fcn.140026bcc
or r15, 0xffffffffffffffff
mov qword [rsp + 0x28], rsi
mov r9, rdi
mov qword [rsp + 0x20], 0
mov r8, r15
lea rdx, [rsp + 0x50]
mov rcx, qword [rax]
or rcx, 1
call fcn.1400caee8
lea rcx, [rbx + 0x1038]
call fcn.1405b9960
nop
movzx edi, word [rbx + 0x1046]
lea rcx, [0x140191118]
movzx esi, word [rbx + 0x1044]
movzx ebp, word [rbx + 0x1042]
movzx r14d, word [rbx + 0x1040]
call fcn.140040150
mov rdx, rax
lea rcx, [rbx + 0x38]
lea rax, [rsp + 0x50]
mov r9d, ebp
mov qword [rsp + 0x30], rax
mov r8d, r14d
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call fcn.14002e110
mov r14, qword [rsp + 0x1070]
mov rsi, qword [rsp + 0x1088]
mov rbp, qword [rsp + 0x1090]
inc r15
cmp byte [rbx + r15 + 0x38], 0
jne 0x14003d795
cmp dword [rbx + 0x1454], 0
je 0x14003d7e0
movsxd rdx, r15d
test r15d, r15d
jle 0x14003d7f7
lea rcx, [rbx + 0x38]
nop word [rax + rax]
mov eax, dword [rbx + 0x1454]
lea rcx, [rcx + 1]
add eax, 2
mov dword [rbx + 0x1454], eax
add al, 0x43
xor byte [rcx - 1], al
sub rdx, 1
jne 0x14003d7c0
jmp 0x14003d7f7
lea rcx, [rbx + 0x104c]
mov edx, r15d
lea r9, [rbx + 0x38]
lea r8, [rbx + 0x38]
call fcn.140044ac0
mov rcx, qword [rbx]
lea r9, [rsp + 0x40]
mov r8d, r15d
mov qword [rsp + 0x20], 0
lea rdx, [rbx + 0x38]
call fcn.1405b232f
nop
cmp dword [rbx + 0x30], 0
mov r15, qword [rsp + 0x1068]
mov r12, qword [rsp + 0x1080]
je 0x14003d835
lea rcx, [rbx + 8]
call qword [fcn.140120480]
mov r13, qword [rsp + 0x1078]
mov al, 1
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.14009ed10
add rsp, 0x1098
pop rdi
pop rbx
ret
Function at 0x14003fd30
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x830
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov qword [rsp + 0x848], rbx
mov rbx, rcx
call fcn.140040a70
mov rsi, rax
cmp dword [rax + 0x28], 0
je 0x14003fd6d
mov rcx, rax
call qword [fcn.140120488]
mov qword [rsp + 0x858], rdi
test rbx, rbx
jne 0x14003fd81
xor edi, edi
jmp 0x14003ff31
cmp byte [rbx], 1
jne 0x14003ff2e
movsx edx, byte [rbx + 1]
movzx eax, dl
add al, al
lea ecx, [rdx + 0x65]
add cl, al
xor byte [rbx + 2], cl
lea ecx, [rdx + rdx*8]
movzx r9d, byte [rbx + 2]
lea eax, [rcx + 0x68]
xor byte [rbx + 3], al
lea edx, [rcx + 4]
movzx eax, byte [rbx + 3]
shl r9d, 8
or r9, rax
jbe 0x14003fde1
mov r8, rbx
nop dword [rax]
movzx eax, byte [r8 + 4]
lea edx, [rdx + rdx*2]
lea ecx, [rdx + 0x65]
xor al, cl
lea edx, [rdx + 1]
mov byte [r8], al
inc r8
mov rax, r8
sub rax, rbx
cmp rax, r9
jl 0x14003fdc0
xor edi, edi
mov byte [r9 + rbx], 0
call qword [fcn.1401201a8]
mov r8d, eax
lea edx, [rdi + 1]
lea rax, [0x1401a5cf0]
lea rcx, [0x1401a5ca4]
lea r9, [0x140000000]
cmp dword [rcx], r8d
je 0x14003fe1b
inc edx
add rcx, 4
cmp rcx, rax
jl 0x14003fe02
jmp 0x14003fe21
mov edi, edx
test edx, edx
jne 0x14003fe3e
mov ecx, dword [0x1401a5c90]
cmp ecx, 0x13
jae 0x14003fe3e
inc ecx
mov dword [0x1401a5c90], ecx
mov edi, ecx
mov dword [r9 + rcx*4 + 0x1a5ca0], r8d
mov eax, edi
mov rdi, qword [r9 + rax*8 + 0x1a5bf0]
mov qword [r9 + rax*8 + 0x1a5bf0], rbx
test rdi, rdi
je 0x14003ff2e
cmp rdi, rbx
je 0x14003ff2e
cmp byte [rbx], 1
je 0x14003ff2e
cmp byte [rdi], 1
je 0x14003ff2e
mov r8d, 0x800
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.1405b8325
nop
lea rcx, [rsp + 0x20]
call qword [fcn.140120250]
mov r8d, eax
test eax, eax
je 0x14003ff2e
lea rax, [rsp + 0x20]
mov qword [rsp + 0x850], rbp
movzx ecx, al
mov r11d, 4
mov byte [rdi + 1], cl
mov byte [rdi], 1
lea ecx, [rcx + rcx*2]
lea ebp, [rcx + 0x65]
lea ecx, [rcx + 1]
lea edx, [rcx + rcx*2]
lea r10d, [rdx + 0x65]
inc edx
test r8d, r8d
jle 0x14003ff09
lea r9, [rsp + 0x20]
mov rax, rdi
sub rax, r9
lea rcx, [rsp + 0x20]
lea r11d, [r8 + 4]
lea r9, [rax + 4]
nop dword [rax]
lea edx, [rdx + rdx*2]
lea eax, [rdx + 0x65]
xor al, byte [rcx]
lea edx, [rdx + 1]
mov byte [r9 + rcx], al
lea rcx, [rcx + 1]
sub r8, 1
jne 0x14003fef0
movsxd rax, r11d
lea ecx, [r11 - 4]
mov byte [rax + rdi], 0
mov eax, ecx
sar eax, 8
xor al, bpl
mov rbp, qword [rsp + 0x850]
xor r10b, cl
mov byte [rdi + 2], al
mov byte [rdi + 3], r10b
mov rdi, rbx
cmp dword [rsi + 0x28], 0
mov rbx, qword [rsp + 0x848]
je 0x14003ff48
mov rcx, rsi
call qword [fcn.140120480]
mov rax, rdi
mov rdi, qword [rsp + 0x858]
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.14009ed10
add rsp, 0x830
pop rsi
ret
Function at 0x14003ff70
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x830
mov rax, qword [0x1401990d8]
xor rax, rsp
mov qword [rsp + 0x820], rax
mov qword [rsp + 0x858], rdi
mov rdi, rcx
call fcn.140040a70
mov rsi, rax
cmp dword [rax + 0x28], 0
je 0x14003ffad
mov rcx, rax
call qword [fcn.140120488]
mov qword [rsp + 0x848], rbx
test rdi, rdi
jne 0x14003ffc1
xor ebx, ebx
jmp 0x140040111
cmp byte [rdi], 1
jne 0x14004010e
movsx edx, byte [rdi + 1]
movzx eax, dl
add al, al
lea ecx, [rdx + 0x65]
add cl, al
xor byte [rdi + 2], cl
lea ecx, [rdx + rdx*8]
movzx r9d, byte [rdi + 2]
lea eax, [rcx + 0x68]
xor byte [rdi + 3], al
lea edx, [rcx + 4]
movzx eax, byte [rdi + 3]
shl r9d, 8
or r9, rax
jbe 0x14004001b
xor ebx, ebx
nop dword [rax + rax]
movzx eax, byte [rdi + rbx + 4]
lea edx, [rdx + rdx*2]
lea ecx, [rdx + 0x65]
xor al, cl
lea edx, [rdx + 1]
mov byte [rbx + rdi], al
inc rbx
cmp rbx, r9
jl 0x140040000
mov rbx, qword [0x1401a5cf0]
mov byte [r9 + rdi], 0
mov qword [0x1401a5cf0], rdi
test rbx, rbx
je 0x14004010e
cmp rbx, rdi
je 0x14004010e
cmp byte [rdi], 1
je 0x14004010e
cmp byte [rbx], 1
je 0x14004010e
mov r8d, 0x800
lea rcx, [rsp + 0x20]
mov rdx, rbx
call fcn.1405b8325
nop
lea rcx, [rsp + 0x20]
call qword [fcn.140120250]
mov r8d, eax
test eax, eax
je 0x14004010e
lea rax, [rsp + 0x20]
mov qword [rsp + 0x850], rbp
movzx ecx, al
mov r11d, 4
mov byte [rbx + 1], cl
mov byte [rbx], 1
lea ecx, [rcx + rcx*2]
lea ebp, [rcx + 0x65]
lea ecx, [rcx + 1]
lea edx, [rcx + rcx*2]
lea r10d, [rdx + 0x65]
inc edx
test r8d, r8d
jle 0x1400400e9
lea r9, [rsp + 0x20]
mov rax, rbx
sub rax, r9
lea rcx, [rsp + 0x20]
lea r11d, [r8 + 4]
lea r9, [rax + 4]
nop word [rax + rax]
lea edx, [rdx + rdx*2]
lea eax, [rdx + 0x65]
xor al, byte [rcx]
lea edx, [rdx + 1]
mov byte [r9 + rcx], al
lea rcx, [rcx + 1]
sub r8, 1
jne 0x1400400d0
movsxd rax, r11d
lea ecx, [r11 - 4]
mov byte [rax + rbx], 0
mov eax, ecx
sar eax, 8
xor al, bpl
mov rbp, qword [rsp + 0x850]
xor r10b, cl
mov byte [rbx + 2], al
mov byte [rbx + 3], r10b
mov rbx, rdi
cmp dword [rsi + 0x28], 0
mov rdi, qword [rsp + 0x858]
je 0x140040128
mov rcx, rsi
call qword [fcn.140120480]
mov rax, rbx
mov rbx, qword [rsp + 0x848]
mov rcx, qword [rsp + 0x820]
xor rcx, rsp
call fcn.14009ed10
add rsp, 0x830
pop rsi
ret
Function at 0x140040150
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.140040a70
mov rdi, rax
cmp dword [rax + 0x28], 0
je 0x140040174
mov rcx, rax
call qword [fcn.140120488]
test rbx, rbx
je 0x1400401d6
cmp byte [rbx], 1
jne 0x1400401d6
movsx edx, byte [rbx + 1]
movzx eax, dl
add al, al
lea ecx, [rdx + 0x65]
add cl, al
xor byte [rbx + 2], cl
lea ecx, [rdx + rdx*8]
movzx r9d, byte [rbx + 2]
lea eax, [rcx + 0x68]
xor byte [rbx + 3], al
lea eax, [rcx + 4]
movzx edx, byte [rbx + 3]
shl r9d, 8
or r9, rdx
jbe 0x1400401d1
mov r8, rbx
movzx ecx, byte [r8 + 4]
lea eax, [rax + rax*2]
lea edx, [rax + 0x65]
xor cl, dl
lea eax, [rax + 1]
mov byte [r8], cl
inc r8
mov rcx, r8
sub rcx, rbx
cmp rcx, r9
jl 0x1400401b0
mov byte [r9 + rbx], 0
cmp dword [rdi + 0x28], 0
je 0x1400401e5
mov rcx, rdi
call qword [fcn.140120480]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140040200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
call fcn.140040a70
mov rbx, rax
cmp dword [rax + 0x28], 0
je 0x14004022f
mov rcx, rax
call qword [fcn.140120488]
mov rcx, rdi
mov qword [rsp + 0x30], rbp
call qword [fcn.140120250]
lea r14, [0x1401a43f0]
xor edx, edx
mov rcx, r14
mov esi, eax
mov r8d, 0x800
call fcn.1400a1af0
test esi, esi
je 0x1400402e9
movzx ecx, dil
mov r10d, 4
mov byte [0x1401a43f0], 1
mov byte [0x1401a43f1], cl
lea eax, [rcx + rcx*2]
lea ebp, [rax + 0x65]
lea eax, [rax + 1]
lea edx, [rax + rax*2]
lea r11d, [rdx + 0x65]
inc edx
test esi, esi
jle 0x1400402bd
lea r8, [0x1401a43f4]
mov r9d, esi
sub rdi, r8
lea r10d, [rsi + 4]
nop dword [rax]
movzx eax, byte [rdi + r8]
lea edx, [rdx + rdx*2]
lea ecx, [rdx + 0x65]
xor al, cl
lea edx, [rdx + 1]
mov byte [r8], al
lea r8, [r8 + 1]
sub r9, 1
jne 0x1400402a0
movsxd rax, r10d
cmp rax, 0x800
jae 0x140040316
mov byte [rax + r14], 0
lea ecx, [r10 - 4]
mov eax, ecx
sar eax, 8
xor al, bpl
xor r11b, cl
mov byte [0x1401a43f2], al
mov byte [0x1401a43f3], r11b
cmp dword [rbx + 0x28], 0
je 0x1400402f8
mov rcx, rbx
call qword [fcn.140120480]
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
call fcn.14009e8cc
int3