joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff754b4efa0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x250
mov rax, qword [0x7ff754c14088]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, dword [rcx + 0x58]
lea rbx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov ebp, r9d
mov eax, dword [rcx + 0x5c]
mov rsi, rcx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], r8d
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x278], rdi
nop dword [rax]
mov r10d, dword [rbx + 0x14]
mov eax, r10d
mov r14d, dword [rbx + 4]
cmp r10d, r14d
mov r9d, dword [rbx + 0xc]
cmovg eax, r14d
cmp r9d, eax
jl 0x7ff754b4f13c
cmp r10d, r14d
mov eax, r14d
cmovg eax, r10d
cmp r9d, eax
jg 0x7ff754b4f13c
cmp r10d, r14d
jne 0x7ff754b4f040
sub rbx, 0x10
jmp 0x7ff754b4f184
mov edx, dword [rsi + 0x88]
xor r9d, r9d
cmp r10d, r14d
setge r9b
inc r9d
cmp edx, r9d
je 0x7ff754b4f0b2
mov eax, dword [rsi + 4]
mov ecx, eax
mov r8d, dword [rsi + 8]
neg ecx
cmp r10d, r14d
jge 0x7ff754b4f074
dec eax
add eax, r10d
and eax, ecx
sub eax, r10d
jmp 0x7ff754b4f07c
and ecx, r10d
mov eax, r10d
sub eax, ecx
cmp eax, r8d
setge r11b
test edx, edx
je 0x7ff754b4f09b
movzx edx, r11b
mov rcx, rsi
call fcn.7ff754b50150
test al, al
jne 0x7ff754b4f195
movzx r8d, r11b
mov edx, r9d
mov rcx, rsi
call fcn.7ff754b507c0
test al, al
jne 0x7ff754b4f195
mov edx, dword [rsi + 0x64]
lea r9, [0x7ff754b50b20]
mov ecx, dword [rsi + 0x60]
mov r8, rbx
cmp r10d, r14d
jge 0x7ff754b4f0de
mov dword [rsp + 0x28], edx
mov edx, 2
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call fcn.7ff754b4ee20
jmp 0x7ff754b4f132
mov eax, dword [rbx + 4]
neg ecx
movzx edi, byte [rsi + 0x6a]
neg eax
mov dword [rbx + 4], eax
neg edx
mov eax, dword [rbx + 0xc]
neg eax
mov dword [rsp + 0x28], ecx
mov dword [rbx + 0xc], eax
mov rcx, rsi
mov eax, dword [rbx + 0x14]
neg eax
mov dword [rsp + 0x20], edx
mov edx, 2
mov dword [rbx + 0x14], eax
call fcn.7ff754b4ee20
test dil, dil
je 0x7ff754b4f12a
cmp byte [rsi + 0x6a], 0
jne 0x7ff754b4f12a
mov rdx, qword [rsi + 0x70]
mov ecx, dword [rdx + 0x20]
neg ecx
mov dword [rdx + 0x20], ecx
mov ecx, dword [rbx + 4]
neg ecx
mov dword [rbx + 4], ecx
test al, al
jne 0x7ff754b4f195
sub rbx, 0x10
jmp 0x7ff754b4f184
mov eax, dword [rbx + 8]
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x20], ecx
add ecx, eax
mov dword [rbx + 0x24], r10d
lea edx, [rax + rbp]
mov eax, ecx
sar eax, 1
mov dword [rbx + 0x18], eax
lea eax, [rcx + rdx]
sar eax, 2
lea ecx, [r10 + r9]
mov dword [rbx + 0x10], eax
mov eax, ecx
sar edx, 1
sar eax, 1
mov dword [rbx + 8], edx
lea edx, [r14 + r9]
mov dword [rbx + 0x1c], eax
lea eax, [rcx + rdx]
sar eax, 2
sar edx, 1
mov dword [rbx + 0x14], eax
mov dword [rbx + 0xc], edx
add rbx, 0x10
lea rax, [rsp + 0x30]
cmp rbx, rax
jb 0x7ff754b4f199
mov ebp, dword [rbx]
jmp 0x7ff754b4f000
mov al, 1
jmp 0x7ff754b4f1a2
mov dword [rsi + 0x58], ebp
xor al, al
mov dword [rsi + 0x5c], r14d
mov rdi, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.7ff754bbb850
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rsi
pop rbp
ret
Function at 0x7ff754b554f0
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push rbx
push rbp
sub rsp, 0x48
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
jne 0x7ff754b5550c
lea eax, [rcx + 0x28]
add rsp, 0x48
pop rbp
pop rbx
ret
mov qword [rsp + 0x68], rsi
xor r9d, r9d
mov qword [rsp + 0x40], r14
mov edx, 0x80000000
xor r14d, r14d
mov rcx, rbp
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r14 + 1]
call qword [sym.imp.kernel32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x7ff754b55560
mov r14, qword [rsp + 0x40]
lea eax, [rsi + 2]
mov rsi, qword [rsp + 0x68]
add rsp, 0x48
pop rbp
pop rbx
ret
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x78], rdi
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetFileSizeEx]
test eax, eax
je 0x7ff754b55685
mov rax, qword [rsp + 0x70]
cmp rax, 0x7fffffff
jg 0x7ff754b55685
test rax, rax
je 0x7ff754b55685
xor r9d, r9d
mov qword [rsp + 0x28], r14
xor edx, edx
mov dword [rsp + 0x20], r14d
mov rcx, rsi
lea r8d, [r9 + 2]
call qword [sym.imp.kernel32.dll_CreateFileMappingA]
mov rdi, rax
test rax, rax
je 0x7ff754b55685
mov ecx, dword [rsp + 0x70]
xor r9d, r9d
mov dword [rbx + 8], ecx
xor r8d, r8d
mov rcx, rax
mov dword [rbx + 0xc], r14d
mov qword [rsp + 0x20], r14
lea edx, [r9 + 4]
call qword [sym.imp.kernel32.dll_MapViewOfFile]
mov rcx, rdi
mov qword [rbx], rax
call qword [sym.imp.kernel32.dll_CloseHandle]
cmp qword [rbx], r14
je 0x7ff754b555fa
lea rax, [0x7ff754b556e0]
jmp 0x7ff754b55653
mov rcx, qword [rbx + 0x30]
xor edx, edx
movsxd r8, dword [rbx + 8]
mov rcx, qword [rcx]
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x7ff754b55685
mov edi, r14d
nop dword [rax + rax]
mov r8d, dword [rbx + 8]
lea r9, [rsp + 0x60]
mov edx, edi
sub r8d, edi
add rdx, qword [rbx]
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x7ff754b55673
add edi, dword [rsp + 0x60]
cmp edi, dword [rbx + 8]
jne 0x7ff754b55620
lea rax, [0x7ff754b556b0]
mov rcx, rsi
mov qword [rbx + 0x28], rax
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rax, qword [rbx]
mov qword [rbx + 0x10], rax
xor eax, eax
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], r14
jmp 0x7ff754b5569a
mov rcx, qword [rbx + 0x30]
xor edx, edx
mov r8, qword [rbx]
mov rcx, qword [rcx]
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.kernel32.dll_CloseHandle]
mov eax, 0x51
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
pop rbx
ret
Function at 0x7ff754b56c70
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rdx
test rdx, rdx
jne 0x7ff754b56c7b
xor eax, eax
ret
lea r11, [0x7ff754bdc9d0]
not ecx
cmp r8d, 8
jb 0x7ff754b56d51
mov r10d, r8d
shr r10, 3
nop word [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
add r8d, 0xfffffff8
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 4]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 5]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 6]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 7]
add r9, 8
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x7ff754b56ca0
test r8d, r8d
je 0x7ff754b56d7d
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
add r8d, 0xffffffff
jne 0x7ff754b56d60
not ecx
mov eax, ecx
ret
Function at 0x7ff754b5af40
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x7ff754b5af74
mov ecx, r9d
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x7ff754b5af60
mov byte [r8 + 6], r9b
mov qword [rsp + 0x20], r9
lea rax, [r8 + 5]
cmp r8, rax
jne 0x7ff754b5af97
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
jmp 0x7ff754b5afc0
mov qword [rsp + 0x30], 5
mov qword [rsp + 0x38], 0xf
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, byte [r8 + 4]
mov byte [rsp + 0x24], al
mov byte [rsp + 0x25], r9b
nop
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.7ff754b5aed0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x7ff754b5b00e
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff754b5b009
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff754b5b009
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff754bbb050
mov rax, rbx
add rsp, 0x50
pop rbx
ret

Function at 0x7ff754b5b020
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor r9d, r9d
cmp byte [r8 + 7], r9b
je 0x7ff754b5b054
mov ecx, r9d
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x7ff754b5b040
mov byte [r8 + 7], r9b
mov qword [rsp + 0x20], r9
lea rax, [r8 + 6]
cmp r8, rax
jne 0x7ff754b5b077
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
jmp 0x7ff754b5b0a0
mov qword [rsp + 0x30], 6
mov qword [rsp + 0x38], 0xf
mov eax, dword [r8]
mov dword [rsp + 0x20], eax
movzx eax, word [r8 + 4]
mov word [rsp + 0x24], ax
mov byte [rsp + 0x26], r9b
nop
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.7ff754b5aed0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x7ff754b5b0ee
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff754b5b0e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff754b5b0e9
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff754bbb050
mov rax, rbx
add rsp, 0x50
pop rbx
ret
Function at 0x7ff754b5b100
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor r9d, r9d
cmp byte [r8 + 9], r9b
je 0x7ff754b5b134
mov ecx, r9d
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x7ff754b5b120
mov byte [r8 + 9], r9b
mov qword [rsp + 0x20], r9
lea rax, [r8 + 8]
cmp r8, rax
jne 0x7ff754b5b157
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
jmp 0x7ff754b5b180
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], 0xf
mov rax, qword [r8]
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x28], r9b
nop word [rax + rax]
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.7ff754b5aed0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x7ff754b5b1ce
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff754b5b1c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff754b5b1c9
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff754bbb050
mov rax, rbx
add rsp, 0x50
pop rbx
ret
Function at 0x7ff754b5b1e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 6], r9b
je 0x7ff754b5b224
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x7ff754b5b210
mov byte [r8 + 6], r9b
mov qword [rbp - 0x38], r9
lea rax, [r8 + 5]
cmp r8, rax
jne 0x7ff754b5b243
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
jmp 0x7ff754b5b265
mov qword [rbp - 0x28], 5
mov qword [rbp - 0x20], 0xf
mov eax, dword [r8]
mov dword [rbp - 0x38], eax
movzx eax, byte [r8 + 4]
mov byte [rbp - 0x34], al
mov byte [rbp - 0x33], r9b
cmp byte [rdx + 0xa], 0
je 0x7ff754b5b283
mov rcx, r9
nop
lea eax, [rcx - 0x75]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x7ff754b5b270
mov byte [rdx + 0xa], 0
mov qword [rbp - 0x58], r9
lea rax, [rdx + 9]
cmp rdx, rax
jne 0x7ff754b5b2a2
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
jmp 0x7ff754b5b2d0
mov qword [rbp - 0x48], 9
mov qword [rbp - 0x40], 0xf
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, byte [rdx + 8]
mov byte [rbp - 0x50], al
mov byte [rbp - 0x4f], 0
nop word [rax + rax]
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.7ff754b60d00
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x7ff754b5b324
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff754b5b31e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff754b5b31e
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff754bbb050
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x7ff754b5b362
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff754b5b35d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff754b5b35d
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff754bbb050
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x7ff754b5b380
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor r9d, r9d
cmp byte [r8 + 0xa], r9b
je 0x7ff754b5b3b4
mov ecx, r9d
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x7ff754b5b3a0
mov byte [r8 + 0xa], r9b
mov qword [rsp + 0x20], r9
lea rax, [r8 + 9]
cmp r8, rax
jne 0x7ff754b5b3d7
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
jmp 0x7ff754b5b402
mov qword [rsp + 0x30], 9
mov qword [rsp + 0x38], 0xf
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, byte [r8 + 8]
mov byte [rsp + 0x28], al
mov byte [rsp + 0x29], r9b
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.7ff754b5aed0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x7ff754b5b450
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff754b5b44b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff754b5b44b
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff754bbb050
mov rax, rbx
add rsp, 0x50
pop rbx
ret
Function at 0x7ff754b5b460
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 0xb], r9b
je 0x7ff754b5b4a4
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x7ff754b5b490
mov byte [r8 + 0xb], r9b
mov qword [rbp - 0x38], r9
lea rax, [r8 + 0xa]
cmp r8, rax
jne 0x7ff754b5b4c3
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
jmp 0x7ff754b5b4f0
mov qword [rbp - 0x28], 0xa
mov qword [rbp - 0x20], 0xf
movsd xmm0, qword [r8]
movsd qword [rbp - 0x38], xmm0
movzx eax, word [r8 + 8]
mov word [rbp - 0x30], ax
mov byte [rbp - 0x2e], r9b
nop word [rax + rax]
cmp byte [rdx + 0xb], 0
je 0x7ff754b5b513
mov rcx, r9
nop dword [rax]
lea eax, [rcx - 0x75]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x7ff754b5b500
mov byte [rdx + 0xb], 0
mov qword [rbp - 0x58], r9
lea rax, [rdx + 0xa]
cmp rdx, rax
jne 0x7ff754b5b532
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
jmp 0x7ff754b5b560
mov qword [rbp - 0x48], 0xa
mov qword [rbp - 0x40], 0xf
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
movzx eax, word [rdx + 8]
mov word [rbp - 0x50], ax
mov byte [rbp - 0x4e], 0
nop word [rax + rax]
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.7ff754b60d00
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x7ff754b5b5b4
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff754b5b5ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff754b5b5ae
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff754bbb050
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x7ff754b5b5f2
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff754b5b5ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff754b5b5ed
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff754bbb050
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret
Function at 0x7ff754b5b610
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor r9d, r9d
cmp byte [r8 + 0xc], r9b
je 0x7ff754b5b644
mov ecx, r9d
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x7ff754b5b630
mov byte [r8 + 0xc], r9b
mov qword [rsp + 0x20], r9
lea rax, [r8 + 0xb]
cmp r8, rax
jne 0x7ff754b5b667
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
jmp 0x7ff754b5b6a0
mov qword [rsp + 0x30], 0xb
mov qword [rsp + 0x38], 0xf
movsd xmm0, qword [r8]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [r8 + 8]
mov word [rsp + 0x28], ax
movzx eax, byte [r8 + 0xa]
mov byte [rsp + 0x2a], al
mov byte [rsp + 0x2b], r9b
nop dword [rax]
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.7ff754b5aed0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x7ff754b5b6ee
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff754b5b6e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff754b5b6e9
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff754bbb050
mov rax, rbx
add rsp, 0x50
pop rbx
ret
Function at 0x7ff754b5b700
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rbx, rcx
mov qword [rbp - 0x10], rcx
xor r9d, r9d
cmp byte [r8 + 0xb], r9b
je 0x7ff754b5b744
mov ecx, r9d
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x75]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x7ff754b5b730
mov byte [r8 + 0xb], r9b
mov qword [rbp - 0x38], r9
lea rax, [r8 + 0xa]
cmp r8, rax
jne 0x7ff754b5b763
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
jmp 0x7ff754b5b790
mov qword [rbp - 0x28], 0xa
mov qword [rbp - 0x20], 0xf
movsd xmm0, qword [r8]
movsd qword [rbp - 0x38], xmm0
movzx eax, word [r8 + 8]
mov word [rbp - 0x30], ax
mov byte [rbp - 0x2e], r9b
nop word [rax + rax]
cmp byte [rdx + 0xe], 0
je 0x7ff754b5b7b3
mov rcx, r9
nop dword [rax]
lea eax, [rcx - 0x75]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xd
jb 0x7ff754b5b7a0
mov byte [rdx + 0xe], 0
mov qword [rbp - 0x58], r9
lea rax, [rdx + 0xd]
cmp rdx, rax
jne 0x7ff754b5b7d2
mov qword [rbp - 0x48], r9
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
jmp 0x7ff754b5b800
mov qword [rbp - 0x48], 0xd
mov qword [rbp - 0x40], 0xf
movsd xmm0, qword [rdx]
movsd qword [rbp - 0x58], xmm0
mov eax, dword [rdx + 8]
mov dword [rbp - 0x50], eax
movzx eax, byte [rdx + 0xc]
mov byte [rbp - 0x4c], al
mov byte [rbp - 0x4b], 0
nop dword [rax]
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x58]
movzx edx, byte [rbp - 0x60]
mov rcx, rbx
call fcn.7ff754b60d00
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x7ff754b5b854
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff754b5b84e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff754b5b84e
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff754bbb050
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x7ff754b5b892
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff754b5b88d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff754b5b88d
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff754bbb050
mov rax, rbx
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rbp
ret

Function at 0x7ff754b62e10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x44], 0
je 0x7ff754b62e33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x75]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x43
jb 0x7ff754b62e20
mov byte [rcx + 0x44], 0
mov rax, rcx
ret

Function at 0x7ff754b62e40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x7ff754b62e63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x75]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x7ff754b62e50
mov byte [rcx + 0x47], 0
mov rax, rcx
ret
Function at 0x7ff754b81ca0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x7ff754b81cfe
mov dl, 1
call fcn.7ff754b726f0
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.7ff754b726f0
mov eax, ebx
jmp 0x7ff754b81d42
cmp ebx, 2
ja 0x7ff754b81d40
mov r9, qword [rdi + 0x668]
lea rdx, [0x7ff754be1608]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.ucrtbase.dll_fwrite]
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.ucrtbase.dll_fwrite]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x7ff754b81d60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x7ff754c14088]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
jne 0x7ff754b81da3
cmp qword [rcx + 0x678], 0
je 0x7ff754b81e80
mov r8, rdx
mov qword [rsp + 0x158], rbx
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.7ff754b707f0
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x7ff754b81dd1
mov rcx, qword [rdi + 0x678]
test rcx, rcx
je 0x7ff754b81e18
cmp byte [rdi + 0x1597], 0
jne 0x7ff754b81e18
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x7ff754b81e00
mov byte [rdi + 0x1597], 1
cmp byte [rdi + 0xf1e], 0
je 0x7ff754b81e78
mov byte [rsp + rbx + 0x30], 0xa
inc rbx
cmp rbx, 0x102
jae 0x7ff754b81ed3
cmp qword [rdi + 0x718], 0
mov byte [rsp + rbx + 0x30], 0
je 0x7ff754b81e99
mov dl, 1
mov rcx, rdi
call fcn.7ff754b726f0
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.7ff754b726f0
mov rbx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.7ff754bbb850
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x668]
lea rcx, [0x7ff754be1608]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.ucrtbase.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.ucrtbase.dll_fwrite]
jmp 0x7ff754b81e78
call fcn.7ff754bbb624
int3