joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400189e0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140018a67
mov rsi, rbx
cmp word [rax], bp
je 0x140018a26
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140018a10
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140018a0c
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140016220
mov rdi, rax
test rax, rax
je 0x140018a54
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14000d310
mov rbp, rdi
xor ecx, ecx
call fcn.140015254
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
mov rax, qword [0x004044b0]
xor ecx, ecx
mov dword [rax], 1
mov rax, qword [0x004044c0]
mov dword [rax], 1
mov rax, qword [0x004044d0]
mov dword [rax], 1
mov rax, qword [0x004044a0]
mov dword [rax], 1
mov rax, qword [0x00404390]
cmp word [rax], 0x5a4d
jne 0x401067
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x4010c0
mov rax, qword [0x00404490]
mov dword [0x0040700c], ecx
mov eax, dword [rax]
test eax, eax
jne 0x4010b0
mov ecx, 1
call sym.__set_app_type
call dbg.__p__fmode
mov rdx, qword [0x00404450]
mov edx, dword [rdx]
mov dword [rax], edx
call dbg._setargv
mov rax, qword [0x00404340]
cmp dword [rax], 1
je 0x4010f0
xor eax, eax
add rsp, 0x28
ret
mov ecx, 2
call sym.__set_app_type
jmp 0x401084
movzx edx, word [rax + 0x18]
cmp dx, 0x10b
je 0x401108
cmp dx, 0x20b
jne 0x401067
cmp dword [rax + 0x84], 0xe
jbe 0x401067
mov edx, dword [rax + 0xf8]
xor ecx, ecx
test edx, edx
setne cl
jmp 0x401067
lea rcx, [dbg._matherr]
call dbg.__mingw_setusermatherr
xor eax, eax
add rsp, 0x28
ret
cmp dword [rax + 0x74], 0xe
jbe 0x401067
mov r8d, dword [rax + 0xe8]
xor ecx, ecx
test r8d, r8d
setne cl
jmp 0x401067

Function at 0x401a30
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]
Function at 0x402470
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00407900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004078e0]
test rbx, rbx
je 0x4024c4
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x4024bb
test r12, r12
je 0x4024bb
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x4024a0
lea rcx, [0x00407900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x4026f0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x402700
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x402710
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402755
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x40274c
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x402757
add rax, 0x28
cmp rax, r9
jne 0x402738
xor eax, eax
ret

Function at 0x402800
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x00404390]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x402879
mov rcx, r10
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402879
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x402876
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x40286d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x402879
add r8, 0x28
cmp r8, r9
jne 0x402858
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x402960
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x00404390]
xor eax, eax
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x4029cf
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x4029cf
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
movzx edx, word [r9 + 6]
lea rax, [r9 + rax + 0x18]
test edx, edx
je 0x4029cd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x4029c4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x4029d8
add rax, 0x28
cmp rax, r9
jne 0x4029b0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x4029f0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x00404390]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x402a68
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x402a68
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x402a68
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x402a68
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x402a5c
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x402a70
add rdx, 0x28
cmp rdx, r10
jne 0x402a48
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jmp 0x402a80
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x402a8e
mov edx, dword [rax + 0xc]
test edx, edx
je 0x402a65
test r8d, r8d
jg 0x402a78
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x140026050
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x14002614a
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
nop
push r12
mov qword [rsp], rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
mov rbx, rdx
xchg rdi, rsi
mov rsi, rcx
xchg rsi, rdi
mov esi, r8d
sub rdi, rdx
xchg rbp, rdi
mov rdi, rcx
xchg rbp, rdi
add rdi, 0x7067d070
sub rdi, 0x7067cf80
dec rsi
shr rsi, 4
inc rsi
nop dword [rax]
xchg r15, rbx
movups xmm0, xmmword [r15]
xchg r15, rbx
mov rdx, rbp
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.1400267d0
mov ecx, 0x5da1844
add ecx, 0x6b26332d
sub ecx, 0x55ecf758
xor ecx, 0x40f9146
add ecx, 0x2e0bcc67
xor ecx, 0x4d2891d6
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1400260f4
add rdi, 0xfffffffffffffff0
xchg rsi, rbp
movups xmmword [rsi + 0xf0], xmm0
xchg rsi, rbp
sub rsi, 1
jne 0x1400260a9
xchg rcx, rdi
mov rcx, qword [rsp + 0x30]
xchg rcx, rdi
mov rbx, qword [rsp + 0x38]
xchg rbp, r13
mov r13, qword [rsp + 0x40]
xchg rbp, r13
add rsp, 0x20
nop
mov rsi, qword [rsp]
add rsp, 8
ret

Function at 0x140026150
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
xchg rsi, rdx
mov qword [rsp + 0x18], rdx
xchg rdx, rsi
push rdi
sub rsp, 0x20
mov edi, r8d
xchg r14, rdx
mov rbx, r14
xchg rdx, r14
lea r9, [rcx + 0xf0]
xchg rcx, r15
mov rsi, r15
xchg rcx, r15
test r8d, r8d
je 0x14002621d
dec rdi
shr rdi, 2
shr rdi, 1
shr rdi, 1
inc rdi
nop dword [rax]
nop word [rax + rax]
mov rax, rbx
sub r9, rbx
mov edx, 0x22a4db63
xor edx, 0x40daccc
add edx, 0x4677e9ed
xor edx, 0x751ea539
add edx, 0x2f12b35f
sub edx, 0x475277f4
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400261da
xchg rdx, r12
mov r12, rsi
xchg r12, rdx
xchg rcx, rbx
mov rbx, rcx
xchg rcx, rbx
call fcn.1400262c0
xchg r9, r11
mov r11, rbx
xchg r9, r11
add rbx, 0x10
sub rdi, 1
jne 0x1400261ac
movups xmm0, xmmword [r9]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
movups xmmword [rsi + 0xf0], xmm0
xchg rcx, rsi
mov rcx, qword [rsp + 0x40]
xchg rcx, rsi
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140027960
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
xchg rbx, rdx
mov qword [rsp + 8], rdx
xchg rdx, rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x10
mov rbx, rdx
mov r10, rcx
test r8b, 0xf
je 0x1400279a4
xor al, al
xchg rbx, r11
mov r11, qword [rsp + 0x20]
xchg r11, rbx
add rsp, 0x10
nop
xchg qword [rsp], rdi
add rsp, 8
ret
xor edx, edx
test r8d, r8d
je 0x140027a66
movdqa xmm2, xmmword [rsp]
nop
xchg rdx, r13
movdqu xmm1, xmmword [r13 + rbx]
xchg rdx, r13
test edx, edx
jne 0x1400279d8
xchg r10, rbp
movdqu xmm2, xmmword [rbp + 0x200]
xchg rbp, r10
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
pxor xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0x3d8bd49
xor ecx, 0x25f1bf36
add ecx, 0x2f06de08
add ecx, 0x15032082
xor ecx, 0x63a949d3
xor ecx, 0x30f3a2
add ecx, 0x66df3d4e
sub ecx, 0x5658e821
sub ecx, 0x1a311098
nop dword [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027a26
aesdeclast xmm0, xmmword [r10 + 0x1e0]
pxor xmm0, xmm2
movdqa xmm2, xmm1
movups xmmword [rdx + r9], xmm0
nop
sub edx, 0x7564395
add edx, 0x75643a5
cmp edx, r8d
jb 0x1400279b5
mov rbx, qword [rsp + 0x20]
mov al, reloc.SHLWAPI.dll_SHCreateMemStream
add al, 0x47
xor al, 0
xor al, 0x45
add al, 5
add al, 0x35
sub al, 0x4f
add rsp, 0x10
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14002ca80
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rsi, r8
mov qword [rsp + 0x18], r8
xchg rsi, r8
xchg rdi, r14
mov qword [rsp + 0x20], r14
xchg rdi, r14
nop
mov qword [rsp - 8], r14
sub rsp, 8
sub rsp, 0x30
xchg rsi, r15
mov r15, rcx
xchg rsi, r15
mov rax, qword gs:[0x30]
xchg rdi, r8
mov r8, qword [rax + 0x60]
xchg r8, rdi
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
xchg rbx, rbp
mov qword [rsp + 0x40], rbp
xchg rbp, rbx
add rcx, 0x38177230
sub rcx, 0x38177168
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x3df46425
xor dword [rsp + 0x20], 0x3d01c618
xor dword [rsp + 0x20], 0x64d7028e
sub dword [rsp + 0x20], 0x12e63b50
sub dword [rsp + 0x20], 0x11877bdb
sub dword [rsp + 0x20], 0x3fb4e980
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b6f0
test eax, eax
js 0x14002cb4a
cmp qword [rsp + 0x40], rbx
je 0x14002cb4a
lea eax, [rbx + 1]
jmp 0x14002cc98
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0x70], 2
jbe 0x14002cb93
mov eax, 0x7f6a6cce
sub eax, 0x1c122f06
add eax, 0x138b19e1
sub eax, 0x3ba7fa3f
sub eax, 0x13abed1b
add eax, 0x53ae995b
xor eax, 0x48e2bba0
sub eax, 0xc7617e4
sub eax, 0x27669a24
jmp 0x14002cc98
cmp dword [rcx + 0x74], ebx
jbe 0x14002cbbf
mov eax, 0x76062715
xor eax, 0x15086c8f
add eax, 0x130f243e
sub eax, 0x3d9052e5
add eax, 0x4206937e
sub eax, 0x7a93b06e
jmp 0x14002cc98
cmp byte [rdi + 2], bl
je 0x14002cbfa
mov eax, 0x4eed0110
add eax, 0x28188ed3
sub eax, 0x622596f0
add eax, 0x2282e2e5
xor eax, 0x4c87079a
xor eax, 0x6b6cbb94
xor eax, 0x3ff1271b
sub eax, 0x73057d5
sub eax, 0x2847e8f4
jmp 0x14002cc98
cmp r14d, 0xa
jb 0x14002cc4b
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002cc4b
mov eax, 0x72da0944
sub eax, 0x3581f013
add eax, 0x1bd42b43
sub eax, 0x3a23d36a
add eax, 0x5c6cbcb
add eax, 0x55384314
add eax, 0x66a7b6
sub eax, 0x4bf3d40b
sub eax, 0x2e7a538c
jmp 0x14002cc98
lea rcx, [rsi + 0xb8]
mov edx, 0x6aa72d1f
sub edx, 0x207f989b
add edx, 0x34e44a9c
sub edx, 0xb906c5a
sub edx, 0x43a255df
add edx, 0x2fce34cb
sub edx, 0x348b7296
add edx, 0x24e5deb0
xor edx, 0xc9982455
call fcn.14002c030
jmp 0x14002cc96
mov eax, ebx
xchg rbx, r14
mov r14, qword [rsp + 0x48]
xchg r14, rbx
mov rsi, qword [rsp + 0x50]
xchg rdi, r9
mov r9, qword [rsp + 0x58]
xchg rdi, r9
add rsp, 0x30
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140035ae0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbx
nop
sub rsp, 8
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
push r13
nop
sub rsp, 8
mov qword [rsp], r14
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x30
xchg rdx, r15
mov rdx, r15
xchg r15, rdx
mov r14, rcx
movabs rsi, 0xfffffff7978f911
xor rsi, 0x7eefb197
add rsi, 0x21b74fcf
sub rsi, 0x89f46cc
add rsi, 0x2725fcb1
xor rsi, 0x2d91e434
sub rsi, 0x61eb7547
xor rsi, 0x6ab3ba4a
add rsi, 0x7fffffff
add rsi, 0x1d157173
cmp rdx, rsi
ja 0x140035d3e
xchg r12, r8
mov r8, qword [rcx + 8]
xchg r8, r12
sub r12, qword [rcx]
sar r12, 3
sar r12, 1
mov rcx, qword [rcx + 0x10]
sub rcx, qword [r14]
sar rcx, 4
xchg rdx, rsi
mov rsi, rcx
xchg rsi, rdx
shr rdx, 1
xchg r10, rax
mov r10, rsi
xchg r10, rax
sub rax, rdx
cmp rcx, rax
ja 0x140035bc1
lea rsi, [rdx + rcx]
cmp rsi, r15
cmovb rsi, r15
mov qword [rsp + 0x88], rsi
xchg r12, rdx
mov r12, rsi
xchg r12, rdx
xchg rcx, r9
mov r9, r14
xchg r9, rcx
call fcn.1400537e0
xchg rcx, rax
mov r13, rcx
xchg rcx, rax
xchg r8, rax
mov qword [rsp + 0x28], r8
xchg r8, rax
xchg r14, r12
mov rbx, r14
xchg r12, r14
shl rbx, 1
shl rbx, 1
shl rbx, 1
shl rbx, 1
add rbx, rax
xchg r12, rbx
mov qword [rsp + 0x20], r12
xchg rbx, r12
xchg rdi, r13
mov r13, r15
xchg r13, rdi
sub rdi, r12
xchg rbx, rcx
mov qword [rsp + 0x78], rcx
xchg rcx, rbx
je 0x140035c77
nop word [rax + rax]
mov byte [rbx], 0x2d
sub byte [rbx], 0x1a
add byte [rbx], 0x5e
sub byte [rbx], 0x26
sub byte [rbx], 0x16
sub byte [rbx], 0x11
xor byte [rbx], 0x76
sub byte [rbx], 0x52
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004baa0
nop
sub rbx, 0xfffffffffffffff0
xchg r15, rbx
mov qword [rsp + 0x78], r15
xchg rbx, r15
sub rdi, 1
jne 0x140035c3a
mov r8, qword [r14 + 8]
mov rdx, r13
xchg r8, rcx
mov r8, qword [r14]
xchg r8, rcx
cmp rcx, r8
je 0x140035cc6
xor r9d, r9d
movzx eax, byte [rcx]
mov byte [rdx], al
xchg r14, rax
mov r14, qword [rcx + 8]
xchg r14, rax
xchg rbx, rax
mov qword [rdx + 8], rbx
xchg rbx, rax
mov byte [rcx], r9b
xchg r9, rsi
mov qword [rcx + 8], rsi
xchg rsi, r9
lea rdx, [rdx + 0x10]
add rcx, 0x10
cmp rcx, r8
jne 0x140035c93
mov r9, rsi
xchg r13, r15
mov r8, r13
xchg r13, r15
xchg r14, rdx
mov r14, r13
xchg r14, rdx
xchg rdx, r14
mov rcx, rdx
xchg rdx, r14
add rsp, 0x30
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
add rsp, 8
mov r14, qword [rsp - 8]
push rcx
push rax
push rbx
push rax
push rax
push rbx
push rdx
xchg qword [rsp + 0x38], r13
pop rdx
pop rbx
pop rax
pop rax
pop rbx
pop rax
pop rcx
add rsp, 8
nop
xchg qword [rsp], r12
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
xchg qword [rsp], rsi
add rsp, 8
nop
add rsp, 8
mov rbx, qword [rsp - 8]
jmp fcn.140052970
call fcn.14002f9b0
int3
Function at 0x140035dc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
nop
push r11
mov qword [rsp], rdi
sub rsp, 0x20
xchg r10, rdi
mov r10, rdx
xchg rdi, r10
xchg rcx, r14
mov rbx, r14
xchg r14, rcx
test rdx, rdx
je 0x140035e23
nop word [rax + rax]
mov byte [rbx], 0x4e
xor byte [rbx], 0x38
sub byte [rbx], 0x4a
add byte [rbx], 0x4d
sub byte [rbx], 0x3e
add byte [rbx], 0x2d
sub byte [rbx], 0x68
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004baa0
nop
neg rbx
add rbx, 0xfffffffffffffff0
neg rbx
sub rdi, 1
jne 0x140035df2
xchg r11, rax
mov r11, rbx
xchg r11, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14004c2b0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x4a
xor byte [rcx + rax + 6], 0x7a
sub byte [rcx + rax + 6], 0x1d
add byte [rcx + rax + 6], 0x10
sub byte [rcx + rax + 6], 0xf
add byte [rcx + rax + 6], 0x59
xor byte [rcx + rax + 6], 0x6d
inc rax
cmp rax, 8
jb 0x14004c2b2
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14004c2f0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 6
xor byte [rcx + rax + 6], 0x11
xor byte [rcx + rax + 6], 0x15
add byte [rcx + rax + 6], 0x33
add byte [rcx + rax + 6], 3
add byte [rcx + rax + 6], 0x2d
sub byte [rcx + rax + 6], 0x25
sub byte [rcx + rax + 6], 0x40
inc rax
cmp rax, 0xa
jb 0x14004c2f2
ret
Function at 0x140070f80
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
lea r10, [rsp + 0x3d]
mov r8d, edx
xchg r15, rbx
mov r15, rcx
xchg r15, rbx
test edx, edx
jns 0x140071022
neg r8d
nop dword [rax + rax]
dec r10
mov eax, 0x5b0fabcc
xor eax, 0x48c02a0a
xor eax, 0x699a5357
xor eax, 0x3078acf3
add eax, 0x201283e7
add eax, 0x628cca84
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x56
sub r8b, 0x26
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140070faa
dec r10
mov byte [r10], 0x70
sub byte [r10], 0x44
sub byte [r10], 0x1f
add byte [r10], 0x6e
sub byte [r10], 0x54
add byte [r10], 6
jmp 0x140071073
dec r10
mov eax, 0x1460ee18
xor eax, 0x956d66d
sub eax, 0xaa0d571
add eax, 0x4dafebd2
add eax, 0x15b61e14
xor eax, 0x7ac1dfe6
add eax, 0xbd9219c1
mul r8d
shr edx, 3
movzx eax, dl
shl al, 1
shl al, 1
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x67
sub r8b, 0x37
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140071022
lea r9, [rsp + 0x58]
mov rdx, r10
lea r8, [rsp + 0x3d]
mov rcx, rbx
call fcn.1400300c0
xchg rbx, rsi
mov rax, rsi
xchg rsi, rbx
add rsp, 0x40
push rdx
push rcx
push rcx
push rax
push rcx
push rax
push rax
xchg qword [rsp + 0x38], rbx
pop rax
pop rax
pop rcx
pop rax
pop rcx
pop rcx
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140076200
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, r9
mov rcx, r9
xchg rcx, r9
mov r8d, 0x2e97245d
add r8d, 0x35dc24df
sub r8d, 0x3e3b0228
add r8d, 0x1d20efaf
add r8d, 0x15075324
add r8d, 0x9b9d24a
sub r8d, 0x374be78c
xor r8d, 0xc5163eb
xor r8d, 0xd960e8b1
test rcx, rcx
je 0x14007632b
cmp byte [rcx], 0
je 0x14007632b
test rdx, rdx
jne 0x1400762c3
nop
movabs rdx, 0xffffffff588cd760
sub rdx, 0x17332b01
sub rdx, 0x9327c29
xor rdx, 0x2273c96d
sub rdx, 0x8531516
xor rdx, 0x11c94bfd
add rdx, 0x3a0b8236
add rdx, 0x39a56363
add rdx, 0x7fffffff
add rdx, 0x8866aaf
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x1400762ad
test rdx, rdx
je 0x140076328
xor r10d, r10d
lea r11, [0x140002dd0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
xor rcx, qword [rsp]
add rsp, 0x10
shr r8d, 8
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x1400762d5
not r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b0a0
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rax
mov r9, qword [rcx + 0x10]
xchg r9, rax
xchg r11, rdx
mov r11, rcx
xchg rdx, r11
test rax, rax
jne 0x14007b0bd
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14007b100
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b0eb
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b0cb
xchg rdi, rax
mov rdi, qword [rdx + 0x10]
xchg rdi, rax
mov byte [rdx], 0x50
sub byte [rdx], 0x1f
add byte [rdx], 7
add byte [rdx], 0x28
sub byte [rdx], 0x13
sub byte [rdx], 0x12
sub byte [rdx], 0x3a
ret
Function at 0x14007b110
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg rdi, rcx
mov rdx, rdi
xchg rdi, rcx
test rax, rax
jne 0x14007b129
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14007b16c
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b154
mov rcx, qword [rdx + 0x10]
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b137
xchg r11, rax
mov r11, qword [rdx + 0x10]
xchg r11, rax
mov byte [rdx], 0x3b
add byte [rdx], 0x1f
sub byte [rdx], 0x55
add byte [rdx], 0x26
sub byte [rdx], 8
sub byte [rdx], 0x1f
xor byte [rdx], 0x5a
sub byte [rdx], 0x5d
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b4c0
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rax
mov r8, qword [rcx + 0x10]
xchg r8, rax
xchg rcx, rdx
mov rcx, rdx
xchg rdx, rcx
test rax, rax
jne 0x14007b4d7
ret
cmp byte [rcx], 0
jne 0x14007b521
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b506
nop dword [rax + rax]
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b4ea
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x63
sub byte [rdx], 0x3c
add byte [rdx], 0x3f
xor byte [rdx], 0x43
sub byte [rdx], 0x18
add byte [rdx], 0x10
xor byte [rdx], 0x1e
add byte [rdx], 0x15
sub byte [rdx], 0x17
ret

Function at 0x14007bd70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg r11, rcx
mov rdi, r11
xchg rcx, r11
lea rbx, [rdx + 4]
xchg rbx, rdi
mov rdx, rdi
xchg rdi, rbx
call fcn.14007a920
nop
xor eax, eax
mov byte [rbx + rax], 0x57
sub byte [rbx + rax], 0xf
add byte [rbx + rax], 0x26
sub byte [rbx + rax], 0x42
xor byte [rbx + rax], 0x76
sub byte [rbx + rax], 0x26
add byte [rbx + rax], 0x38
sub byte [rbx + rax], 0x6c
inc rax
cmp rax, 6
jb 0x14007bd9d
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rcx, rbx
mov rcx, qword [rsp + 0x30]
xchg rcx, rbx
add rsp, 0x20
push rdx
push rcx
push rdx
push rbx
push rbx
push rbx
xchg qword [rsp + 0x30], rdi
pop rbx
pop rbx
pop rbx
pop rdx
pop rcx
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007be00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 6]
xchg rbx, rdx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007a920
nop
xor eax, eax
mov byte [rbx + rax], 0x2d
add byte [rbx + rax], 0x10
sub byte [rbx + rax], 0xb
add byte [rbx + rax], 0x39
sub byte [rbx + rax], 0x44
xor byte [rbx + rax], 0x27
inc rax
cmp rax, 8
jb 0x14007be31
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg r14, rbx
mov r14, qword [rsp + 0x30]
xchg rbx, r14
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret