joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140083c80
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rax
mov r8, rax
xchg r8, rax
cmp rcx, rdx
je 0x140083dc6
xchg r9, rax
mov rax, r9
xchg r9, rax
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
movups xmmword [rax], xmm0
mov qword [r9 + r8 - 0x70], r10
mov qword [r9 + r8 - 0x68], r10
xchg r11, r8
movups xmm0, xmmword [r11 - 0x80]
xchg r11, r8
movups xmmword [rax], xmm0
xchg r10, r8
movups xmm1, xmmword [r10 - 0x70]
xchg r8, r10
xorps xmm0, xmm0
xchg r12, rax
movups xmmword [r12 + 0x10], xmm1
xchg r12, rax
xchg rdx, r10
mov qword [r8 - 0x70], rdx
xchg r10, rdx
sub rax, 0xffffffffffffffb8
mov qword [r8 - 0x68], 0x4b69ce52
add qword [r8 - 0x68], 0x13c2fbb3
xor qword [r8 - 0x68], 0x4bcb6558
add qword [r8 - 0x68], 0xefe6dfa
xor qword [r8 - 0x68], 0x1915b8ed
sub qword [r8 - 0x68], 0xa0cb404
sub qword [r8 - 0x68], 0x30e6f1af
mov word [r8 - 0x80], r10w
movups xmmword [r9 + r8 - 0x60], xmm0
xchg rbx, r10
mov qword [r9 + r8 - 0x50], rbx
xchg r10, rbx
xchg r10, r11
mov qword [r9 + r8 - 0x48], r11
xchg r11, r10
xchg r10, r8
movups xmm0, xmmword [r10 - 0x60]
xchg r10, r8
xchg r15, r9
movups xmmword [r15 + r8 - 0x60], xmm0
xchg r15, r9
xchg r13, r8
movups xmm1, xmmword [r13 - 0x50]
xchg r13, r8
xchg r12, r9
movups xmmword [r12 + r8 - 0x50], xmm1
xchg r12, r9
mov qword [r8 - 0x50], r10
mov qword [r8 - 0x48], 0x29429932
add qword [r8 - 0x48], 0x259c9624
sub qword [r8 - 0x48], 0x15ecf903
add qword [r8 - 0x48], 0x36dfa14
xor qword [r8 - 0x48], 0x4454bf88
sub qword [r8 - 0x48], 0x78348fe8
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x140083ca8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140083ee0
Capabilities:
Encode data using xor

Disassembly:
mov rax, r8
cmp rcx, rdx
je 0x140083f96
mov r9, rax
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg rbx, rax
movups xmmword [rbx], xmm0
xchg rbx, rax
mov qword [r9 + r8 - 0x28], r10
lea rcx, [r8 - 0x18]
xchg r10, rcx
mov qword [r8 + r9 - 0x20], rcx
xchg r10, rcx
movups xmm0, xmmword [r8 - 0x38]
movups xmmword [rax], xmm0
movups xmm1, xmmword [r8 - 0x28]
xchg r10, rax
movups xmmword [r10 + 0x10], xmm1
xchg r10, rax
xchg r10, rdi
mov qword [r8 - 0x28], rdi
xchg r10, rdi
neg rax
add rax, 0xffffffffffffffe0
neg rax
mov qword [r8 - 0x20], 0x4a1ce144
sub qword [r8 - 0x20], 0x5631d20
sub qword [r8 - 0x20], 0x2d2205f4
add qword [r8 - 0x20], 0x22d9e3fc
sub qword [r8 - 0x20], 0x2888ab1d
xor qword [r8 - 0x20], 0x1ea5c86c
xor qword [r8 - 0x20], 0xf4d3f64
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x140083f04
ret

Function at 0x14008e340
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0xa], 0x69
xor byte [rcx + rax + 0xa], 0x3f
add byte [rcx + rax + 0xa], 0xa
sub byte [rcx + rax + 0xa], 0x12
sub byte [rcx + rax + 0xa], 6
sub byte [rcx + rax + 0xa], 0x48
inc rax
cmp rax, 0x10
jb 0x14008e342
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14008e450
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0x14], 0x24
add byte [rcx + rax + 0x14], 0x2a
sub byte [rcx + rax + 0x14], 0x4e
add byte [rcx + rax + 0x14], 0x16
add byte [rcx + rax + 0x14], 0x64
xor byte [rcx + rax + 0x14], 0x11
xor byte [rcx + rax + 0x14], 2
sub byte [rcx + rax + 0x14], 0x69
inc rax
cmp rax, 0x24
jb 0x14008e452
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14015bda0
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
je 0x14015bfab
nop
push 0x231dbf53
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, rcx
mov rdi, qword [rdx + 0x50]
xchg rdi, rcx
xchg rdi, r13
mov r13, rdx
xchg rdi, r13
xchg rbp, rbx
mov qword [rsp + 0x30], rbp
xchg rbp, rbx
xor ebx, ebx
test rcx, rcx
je 0x14015be3c
mov rdx, qword [rdx + 0x60]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x14015be25
mov r8, qword [rcx - 8]
nop
add rdx, 0x39ed9a47
sub rdx, 0x39ed9a20
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14015bfac
xchg rsi, rcx
mov rsi, r8
xchg rcx, rsi
call fcn.1401fc608
xchg rbx, rbp
mov qword [rdi + 0x50], rbp
xchg rbx, rbp
mov qword [rdi + 0x58], rbx
mov qword [rdi + 0x60], rbx
xchg r11, rcx
mov r11, qword [rdi + 0x40]
xchg rcx, r11
mov rax, qword [rcx + 8]
xchg rbx, rsi
mov qword [rax], rsi
xchg rsi, rbx
mov rcx, qword [rcx]
test rcx, rcx
je 0x14015beb9
nop word [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x31216c7
add edx, 0x283a5a1f
add edx, 0x412c8ff9
xor edx, 0x7742dcf9
add edx, 0x882f031
add edx, 0x326ef256
xor edx, 0x2dc901c4
xor edx, 0x79f0795a
sub edx, 0x214c61b
call fcn.1401fc608
xchg rcx, r10
mov r10, rbx
xchg rcx, r10
test rbx, rbx
jne 0x14015be6a
xchg rcx, rbx
mov rbx, qword [rdi + 0x40]
xchg rbx, rcx
mov edx, 0x588c7846
sub edx, 0x35c852a0
add edx, 0x2a08993b
xor edx, 0x3113428e
xor edx, 0x68592540
sub edx, 0x1586d917
call fcn.1401fc608
mov rbx, qword [rdi + 0x28]
test rbx, rbx
je 0x14015bf68
mov qword [rsp + 0x38], rsi
mov esi, 0x4c514208
sub esi, 0x233a6503
xor esi, 0x4e9cd62d
sub esi, 0x6363a53f
add esi, 0x5b07efbb
sub esi, 0x287c4cbe
xor esi, 0xc94df719
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14015bf63
xchg rsi, rax
mov rsi, qword [rbx]
xchg rsi, rax
xchg rbx, rdx
mov rcx, rdx
xchg rdx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], esi
cmp esi, 1
jne 0x14015bf63
xchg r10, rax
mov r10, qword [rbx]
xchg r10, rax
mov rcx, rbx
call qword [rax + 8]
mov rsi, qword [rsp + 0x38]
mov edx, 0x5a5b0cfa
sub edx, 0x40e9da16
xor edx, 0x18083861
add edx, 0x19dca057
xor edx, 0x3a8fc5bc
xor edx, 0x21da6ec8
xchg r11, rcx
mov r11, rdi
xchg rcx, r11
call fcn.1401fc608
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret
push rcx
call 0x1408fb0bb
int3
Function at 0x1401936d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
xchg r10, rbx
mov rbx, rdx
xchg rbx, r10
xchg rcx, rsi
mov r11, rsi
xchg rsi, rcx
mov word [rsp + 0x30], 0xd4a
add word [rsp + 0x30], 0x2495
sub word [rsp + 0x30], 0x2106
add word [rsp + 0x30], 0x371c
add word [rsp + 0x30], 0xfa3
sub word [rsp + 0x30], 0x2ad4
xor word [rsp + 0x30], 0x4091
xor word [rsp + 0x30], 0x9aa3
mov dword [rsp + 0x34], 0x398eac5f
xor dword [rsp + 0x34], 0x66f6e39
add dword [rsp + 0x34], 0x7d4e3a7
xor dword [rsp + 0x34], 0x184ab8ab
xor dword [rsp + 0x34], 0x52e7eadd
add dword [rsp + 0x34], 0x312076a
add dword [rsp + 0x34], 0xef22036c
mov byte [rsp + 0x32], 0xa
xor byte [rsp + 0x32], 0x73
sub byte [rsp + 0x32], 0x6c
add byte [rsp + 0x32], 0x5b
xor byte [rsp + 0x32], 0x74
add byte [rsp + 0x32], 0x44
add byte [rsp + 0x32], 0x96
mov dword [rsp + 0x38], 0x62d469d
add dword [rsp + 0x38], 0x433ef6ce
sub dword [rsp + 0x38], 0x7a02991
xor dword [rsp + 0x38], 0x1964a962
sub dword [rsp + 0x38], 0x45ded83d
add dword [rsp + 0x38], 0x1f876d30
xor dword [rsp + 0x38], 0x7f82eb1a
add dword [rsp + 0x38], 0x1d9e94a5
xor dword [rsp + 0x38], 0x6b72c608
xor ebx, ebx
mov edx, ebx
nop dword [rax]
movzx eax, word [rsp + rdx*2 + 0x34]
movzx ecx, byte [rsp + rdx + 0x30]
add cx, ax
mov word [rsp + rdx*2 + 0x34], cx
mov byte [rsp + rdx + 0x30], bl
inc rdx
cmp rdx, 3
jb 0x1401937cb
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rsp + 0x34]
xchg r10, rdx
mov r10, rdx
xchg r10, rdx
mov rcx, r11
call fcn.140193bd0
nop
nop dword [rax]
mov byte [rsp + rbx + 0x34], 0x4d
xor byte [rsp + rbx + 0x34], 0x1f
sub byte [rsp + rbx + 0x34], 0x1d
add byte [rsp + rbx + 0x34], 0x2e
xor byte [rsp + rbx + 0x34], 0x12
xor byte [rsp + rbx + 0x34], 0x13
xor byte [rsp + rbx + 0x34], 0x2a
xor byte [rsp + rbx + 0x34], 0x6a
sub byte [rsp + rbx + 0x34], 0x22
inc rbx
cmp rbx, 6
jb 0x140193815
add rsp, 0x40
push rdx
push rdx
push rax
push rax
xchg qword [rsp + 0x20], rbx
pop rax
pop rax
pop rdx
pop rdx
add rsp, 8
ret
Function at 0x1401989e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r8
mov qword [rsp], rbx
nop
push 0x2b1cc06c
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r13
sub rsp, 0x30
xor ebx, ebx
mov r13d, r8d
xchg rdx, r14
mov rdi, r14
xchg r14, rdx
test rdx, rdx
jne 0x140198a1b
mov eax, ebx
jmp 0x140198a69
mov eax, 0x149c4057
add eax, 0xd856c9
add eax, 0x582ad53c
sub eax, 0x2d4d81ea
add eax, 0x26b2a9be
xor eax, 0x4ad79883
xor eax, 0xed8e86d
sub eax, 0x230b8a91
cmp word [rdx], ax
je 0x140198a58
xchg rbp, rax
mov rbp, rbx
xchg rbp, rax
jmp 0x140198a69
movsxd rax, dword [rdx + 0x3c]
add rax, rdi
cmp dword [rax], 0x4550
cmovne rax, rbx
xchg rdi, rbp
mov qword [rsp + 0x50], rdi
xchg rdi, rbp
mov ecx, 0x4ea44242
add ecx, 0x2cd47636
sub ecx, 0x106803f5
sub ecx, 0x6294d928
xor ecx, 0x3abcbc1
xor ecx, 0x46dc5925
sub ecx, 0x4d0c47b4
xchg rbp, rsi
mov qword [rsp + 0x58], rbp
xchg rbp, rsi
xchg r12, rbp
mov qword [rsp + 0x60], rbp
xchg r12, rbp
xchg r14, rsi
mov qword [rsp + 0x28], rsi
xchg rsi, r14
mov qword [rsp + 0x20], r15
cmp word [rax + 0x18], cx
jne 0x140198b37
mov esi, dword [rax + 0x88]
add rsi, rdi
je 0x140198b37
mov r14d, dword [rsi + 0x1c]
mov r15d, dword [rsi + 0x24]
add r14, rdi
mov r12d, dword [rsi + 0x20]
add r15, rdi
add r12, rdi
cmp dword [rsi + 0x18], 0
jbe 0x140198b37
nop dword [rax]
nop dword [rax + rax]
mov eax, ebx
xor edx, edx
mov ecx, dword [r12 + rax*4]
movzx eax, word [r15 + rax*2]
add rcx, rdi
mov ebp, dword [r14 + rax*4]
add rbp, rdi
call fcn.140076130
cmp eax, r13d
je 0x140198b8e
inc ebx
cmp ebx, dword [rsi + 0x18]
jb 0x140198b07
xor eax, eax
xchg r11, r15
mov r11, qword [rsp + 0x20]
xchg r15, r11
xchg r13, r14
mov r13, qword [rsp + 0x28]
xchg r13, r14
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
xchg r13, rbp
mov r13, qword [rsp + 0x50]
xchg r13, rbp
add rsp, 0x30
nop
xchg qword [rsp], r13
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
push rax
push rcx
push rax
push rax
push rax
xchg qword [rsp + 0x28], rbx
pop rax
pop rax
pop rax
pop rcx
pop rax
add rsp, 8
ret
xchg rbp, rdi
mov rax, rdi
xchg rdi, rbp
jmp 0x140198b39
Function at 0x1401aa8c0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xchg r11, rdx
mov rdx, r11
xchg rdx, r11
mov r10, rcx
test rdx, rdx
je 0x1401aa938
mov qword [rsp], rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1401aa92b
movzx eax, byte [r10]
test bl, bl
je 0x1401aa90d
lea rcx, [r9 - 1]
xchg rdi, rdx
mov rdi, r9
xchg rdi, rdx
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1401aa8fc
jmp 0x1401aa92b
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1401aa91c
inc r10
sub r11, 1
jne 0x1401aa8de
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401afd10
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, qword [rcx]
mov r9d, 0x66e2c6cd
sub r9d, 0x635df014
add r9d, 0x66fecc9
xor r9d, 0xe7824e9
add r9d, 0x14218373
add r9d, 0x39035598
sub r9d, 0xbad3d1e
sub r9d, 0x490480e8
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x1401afdaa
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1401afd65
mov ecx, dword [r10]
jmp 0x1401afeef
cmp ecx, 0x4e0
jb 0x1401afeef
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0x439cc840
xor ebx, 0x4cbd182d
xor ebx, 0x5df234b2
sub ebx, 0x311ae36d
add ebx, 0x3957672b
sub ebx, 0x27e68628
xor ebx, 0x1d26c72
xor ebx, 0x32fb8ee4
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401afdf3
lea r11, [r10 + 0xd50]
mov ebx, 0x3e882b4a
add ebx, 0xda36544
add ebx, 0x1b33966f
xor ebx, 0x5f73702e
sub ebx, 0x4c8ad7b
xor ebx, 0x3b7d84a2
sub ebx, 0x81e2c6e
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401afe6b
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
xchg rdx, rbx
mov rdx, qword [rsp]
xchg rbx, rdx
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 2
shr ecx, 9
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 4
shl eax, 2
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xe
shl eax, 1
xor edx, eax
mov eax, edx
shr eax, 2
shr eax, 0xe
shr eax, 1
shr eax, 1
xor eax, edx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401b04b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x40]
xchg rdx, rsi
mov rdi, rsi
xchg rsi, rdx
xchg rbx, rcx
mov rcx, rbx
xchg rcx, rbx
mov byte [rax + rcx], 0x5c
sub byte [rax + rcx], 0x24
xor byte [rax + rcx], 0x35
xor byte [rax + rcx], 0x21
xor byte [rax + rcx], 0x42
sub byte [rax + rcx], 0x52
xor byte [rax + rcx], 0x20
sub byte [rax + rcx], 0x15
add byte [rax + rcx], 0x59
lea r8d, [rax + 1]
cmp eax, 0x38
jae 0x1401b054d
cmp r8d, 0x38
jae 0x1401b05d7
mov ecx, r8d
mov eax, 0xc927865
add eax, 0x120e9e1f
add eax, 0xf6273c3
sub eax, 0x190ce2d8
add eax, 0x6958b52
add eax, 0x317b75fa
sub eax, 0x4d07a883
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call fcn.1401fd676
jmp 0x1401b05d7
cmp r8d, 0x40
jae 0x1401b0597
mov ecx, r8d
mov eax, 0x341c139d
add eax, 0x1d1316fe
xor eax, 0x1bfc64e3
sub eax, 0xd8b80ce
add eax, 0xf23ed04
xor eax, 0x3cf8acfc
sub eax, 0x669936a9
add eax, 0x4b1351e1
sub eax, 0x550d314a
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call fcn.1401fd676
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
xchg r9, rcx
mov r9, rbx
xchg rcx, r9
call fcn.1401b0960
xorps xmm0, xmm0
xor eax, eax
xchg rbx, rbp
movups xmmword [rbp], xmm0
xchg rbx, rbp
xchg rbx, rcx
movups xmmword [rcx + 0x10], xmm0
xchg rcx, rbx
xchg rbx, r12
movups xmmword [r12 + 0x20], xmm0
xchg rbx, r12
mov qword [rbx + 0x30], rax
mov edx, dword [rbx + 0x40]
mov rcx, rbx
shl edx, 3
add rdx, qword [rbx + 0x48]
xchg rdx, rax
mov rdx, rax
xchg rdx, rax
xchg rsi, rdx
mov qword [rbx + 0x48], rsi
xchg rsi, rdx
shr rax, 7
shr rax, 1
mov byte [rbx + 0x3e], al
xchg rdx, r8
mov rax, r8
xchg r8, rdx
shr rax, 0xc
shr rax, 3
shr rax, 1
mov byte [rbx + 0x3d], al
xchg r14, rax
mov r14, rdx
xchg r14, rax
shr rax, 0x10
shr rax, 8
mov byte [rbx + 0x3c], al
mov rax, rdx
shr rax, 0x14
shr rax, 1
shr rax, 5
shr rax, 4
shr rax, 1
shr rax, 1
mov byte [rbx + 0x3b], al
mov rax, rdx
shr rax, 7
shr rax, 0x10
shr rax, 8
shr rax, 6
shr rax, 1
shr rax, 1
shr rax, 1
mov byte [rbx + 0x3a], al
xchg rdx, r15
mov rax, r15
xchg r15, rdx
mov byte [rbx + 0x3f], dl
shr rdx, 0x11
shr rdx, 0x10
shr rdx, 0x12
shr rdx, 2
shr rdx, 1
shr rdx, 1
shr rdx, 1
mov byte [rbx + 0x38], dl
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
shr rax, 0x19
shr rax, 0x10
shr rax, 2
shr rax, 3
shr rax, 1
shr rax, 1
mov byte [rbx + 0x39], al
call fcn.1401b0960
xor r8d, r8d
lea rdx, [rdi + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbx + 0x50]
lea rdx, [rdx + 1]
mov ecx, 0x2afd3574
add ecx, 0x40a26473
add ecx, 0x9cc6388
sub ecx, 0x40e64705
sub ecx, 0x2debcaa8
xor ecx, 0x42a0461e
xor ecx, 0x4439adc4
lea rdi, [rdi + 1]
sub ecx, r8d
nop
add r8d, 0x6c8e6afd
sub r8d, 0x6c8e6af5
shr eax, cl
mov byte [rdi - 1], al
mov eax, dword [rbx + 0x54]
shr eax, cl
mov byte [rdx - 5], al
mov eax, dword [rbx + 0x58]
shr eax, cl
mov byte [rdx - 1], al
mov eax, dword [rbx + 0x5c]
shr eax, cl
mov byte [rdx + 3], al
mov eax, dword [rbx + 0x60]
shr eax, cl
mov byte [rdx + 7], al
cmp r8d, 0x20
jb 0x1401b06c5
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret
Function at 0x1401b9b70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp - 8], rbx
sub rsp, 8
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b91a7
xchg rdx, r12
mov r12, qword [rbx + 0x28]
xchg rdx, r12
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b9188
mov r8, qword [rcx - 8]
neg rdx
add rdx, 0xffffffffffffffd9
neg rdx
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b91bd
xchg r11, rcx
mov r11, r8
xchg r11, rcx
call fcn.1401fc608
xor eax, eax
xchg rdx, rax
mov qword [rbx + 0x18], rdx
xchg rdx, rax
xchg r9, rax
mov qword [rbx + 0x20], r9
xchg r9, rax
xchg r11, rax
mov qword [rbx + 0x28], r11
xchg r11, rax
lea rcx, [rbx + 8]
add rsp, 0x20
nop
xchg qword [rsp], rbx
add rsp, 8
jmp 0x1401b9b70
call 0x1404090f2
int3
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
xchg rbx, rdx
mov rdx, qword [rcx]
xchg rdx, rbx
mov rsi, rcx
xchg r15, rax
mov r15, qword [rbx + 8]
xchg r15, rax
mov qword [rax], 0x4935b655
sub qword [rax], 0x21f93f72
add qword [rax], 0xc85e306
xor qword [rax], 0x4d85222a
sub qword [rax], 0x964be6f
xor qword [rax], 0x3267f37d
add qword [rax], 0x283da0e5
xor qword [rax], 0x6ec2ef0e
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401b9c4e
mov qword [rsp + 0x30], rdi
nop dword [rax + rax]
xchg r13, rdi
mov r13, qword [rbx]
xchg rdi, r13
lea rdx, [rbx + 0x10]
xchg rbp, rsi
mov rcx, rbp
xchg rbp, rsi
call fcn.1401b2cf0
mov edx, 0x29211b3a
add edx, 0x516c0d0e
sub edx, 0x527e56d7
xor edx, 0x41d869e7
sub edx, 0x67a36bdf
xor edx, 0x77eb6850
xor edx, 0x9179a7d
sub edx, 0x7ccfbe4a
xchg rdx, rbx
mov rcx, rdx
xchg rdx, rbx
call fcn.1401fc608
xchg rbx, r11
mov r11, rdi
xchg r11, rbx
test rdi, rdi
jne 0x1401b9bdf
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsi]
mov edx, 0x1522f719
add edx, 0x3ac21a9f
sub edx, 0x46a1ea5a
xor edx, 0x2f69e9bc
add edx, 0x15cf415f
sub edx, 0x44a503f
sub edx, 0x37afbfb2
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
push rdx
push rax
push rbx
push rdx
push rdx
xchg qword [rsp + 0x28], rsi
pop rdx
pop rdx
pop rbx
pop rax
pop rdx
add rsp, 8
jmp fcn.1401fc608
Function at 0x1401b9ca0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
xchg r13, rbx
mov r13, rcx
xchg rbx, r13
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b9233
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b9214
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b924a
mov rcx, r8
call fcn.1401fc608
xor eax, eax
xchg r9, rax
mov qword [rbx + 0x18], r9
xchg r9, rax
xchg r15, rax
mov qword [rbx + 0x20], r15
xchg r15, rax
xchg rdi, rax
mov qword [rbx + 0x28], rdi
xchg rdi, rax
lea rcx, [rbx + 8]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rbx
jmp 0x1401b9ca0
push rsi
call 0x140bf219f
int3
xchg r12, rbx
mov qword [rsp + 0x10], r12
xchg r12, rbx
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
mov rbx, qword [rcx]
xchg rsi, rcx
mov rcx, rsi
xchg rsi, rcx
mov rax, qword [rbx + 8]
mov qword [rax], 0xea63bdb
xor qword [rax], 0x4d7b530d
sub qword [rax], 0x420d8199
xor qword [rax], 0x18fccde4
add qword [rax], 0x370a9081
sub qword [rax], 0x3c466184
add qword [rax], 0x2da5d669
sub qword [rax], 0x419d303f
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401b9d7a
xchg rdi, r8
mov qword [rsp + 0x30], r8
xchg r8, rdi
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rcx, [rbx + 0x10]
call fcn.1401b9dd0
mov edx, 0x72d3a779
sub edx, 0x3b7a99
xor edx, 0x56590dc1
add edx, 0x59e7adbd
sub edx, 0x75a5f7fb
add edx, 0x3b4d93c7
sub edx, 0x294b405
xor edx, 0x41bbb6e5
xchg rbp, rcx
mov rbp, rbx
xchg rcx, rbp
call fcn.1401fc608
mov rbx, rdi
test rdi, rdi
jne 0x1401b9d20
mov rdi, qword [rsp + 0x30]
xchg r12, rcx
mov r12, qword [rsi]
xchg r12, rcx
mov edx, 0x11308ec6
add edx, 0x51db38e0
sub edx, 0x478f4770
add edx, 0x23bbd328
xor edx, 0x60d6edf9
sub edx, 0x29a774b2
sub edx, 0x364749b5
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
nop
xchg qword [rsp], rsi
add rsp, 8
jmp fcn.1401fc608
Function at 0x1401fcff0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
push rsi
call 0x1407809ca
test rax, rax
je 0x1401fd03a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401fd03a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401fd03a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401fd03a
cmp dword [rcx + 0x84], 0xe
jbe 0x1401fd03a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401fd03c
xor al, al
add rsp, 0x28
ret

Function at 0x14022c570
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14022c59d
xor al, al
jmp 0x14022c6ff
mov rax, qword [0x14024b6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14024b6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14024b6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14024b6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14024b6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14024b6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14024b6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14024b6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14024b700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14022c6f1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14022c649
mov r11d, 2
jmp 0x14022c66d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14022c663
mov r11d, 1
jmp 0x14022c66d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14022c715
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14022c6b2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14022c6ca
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14022c6da
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14022c6e8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14022c630
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14022c6fa
Function at 0x1402840f7
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
syscall
ret

Function at 0x1403356b7
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
jmp 0x140775caa
syscall
ret

Function at 0x1404179e4
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
syscall
ret

Function at 0x140dabc52
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
jmp 0x140dabc5a
syscall
ret
Function at 0x140001000
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
movdqa xmm0, xmmword [0x140002260]
xor ebx, ebx
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 5
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [rsp + rbx*4 + 0x20]
mov edx, 1
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140001061
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc rbx
cmp rbx, 5
jl 0x140001030
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x40
pop rdi
ret

Function at 0x14000196c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400019b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400019b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400019b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400019b6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400019b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400019b8
xor al, al
add rsp, 0x28
ret