joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff7879e86b4
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x9d
jl 0x7ff7879e86c0
ret

Function at 0x7ff7879e8764
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0xa
jl 0x7ff7879e8770
ret

Function at 0x7ff7879e87b8
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x12
jl 0x7ff7879e87c4
ret

Function at 0x7ff7879e880c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x18
jl 0x7ff7879e8818
ret

Function at 0x7ff7879e8860
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0xb
jl 0x7ff7879e886c
ret

Function at 0x7ff7879e88bc
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0xc
jl 0x7ff7879e88c8
ret

Function at 0x7ff7879e892c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0xe
jl 0x7ff7879e8938
ret

Function at 0x7ff7879e8988
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0xf
jl 0x7ff7879e8994
ret
Function at 0x7ff7879e8a44
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x15
jl 0x7ff7879e8a50
ret

Function at 0x7ff7879e8b54
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0xd
jl 0x7ff7879e8b60
ret

Function at 0x7ff7879e8c30
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 9
jl 0x7ff7879e8c3c
ret

Function at 0x7ff7879e8cc8
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x11
jl 0x7ff7879e8cd4
ret

Function at 0x7ff7879e8db0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x10
jl 0x7ff7879e8dbc
ret

Function at 0x7ff7879e8e74
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x13
jl 0x7ff7879e8e80
ret

Function at 0x7ff7879e8f4c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 4
jl 0x7ff7879e8f58
ret

Function at 0x7ff7879e9008
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 5
jl 0x7ff7879e9014
ret
Function at 0x7ff7879e9154
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 3
jl 0x7ff7879e9160
ret

Function at 0x7ff7879e921c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x72
jl 0x7ff7879e9228
ret

Function at 0x7ff7879e92b0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x74
jl 0x7ff7879e92bc
ret

Function at 0x7ff7879e9344
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x80
jl 0x7ff7879e9350
ret

Function at 0x7ff7879e93dc
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x83
jl 0x7ff7879e93e8
ret

Function at 0x7ff7879e947c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x82
jl 0x7ff7879e9488
ret

Function at 0x7ff7879e9514
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x49
jl 0x7ff7879e9520
ret

Function at 0x7ff7879e9594
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x4f
jl 0x7ff7879e95a0
ret
Function at 0x7ff7879e9628
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x58
jl 0x7ff7879e9634
ret

Function at 0x7ff7879e96a8
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x84
jl 0x7ff7879e96b4
ret

Function at 0x7ff7879e9854
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x41
jl 0x7ff7879e9860
ret
Function at 0x7ff7879e9c2c
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x38
mov r15d, r8d
mov r12, rdx
mov r14, rcx
xor ebx, ebx
mov dword [rbp - 0x18], ebx
call fcn.7ff7879eab18
mov dword [rbp - 0x18], 1
mov esi, ebx
test r15d, r15d
je 0x7ff7879e9db3
mov ecx, ebx
lea edi, [rbx + 3]
jmp 0x7ff7879e9c74
mov r12, qword [rbp + 0x50]
dec r15d
mov al, byte [r12]
mov byte [rbp + rcx + 0x58], al
inc esi
inc rcx
inc r12
mov qword [rbp + 0x50], r12
mov dl, byte [rbp + 0x5a]
mov r12b, byte [rbp + 0x59]
mov r13b, byte [rbp + 0x58]
cmp rcx, rdi
jne 0x7ff7879e9d01
mov al, r13b
shr al, 2
mov byte [rbp + 0x60], al
mov cl, r13b
and cl, dil
shl cl, 4
mov al, r12b
shr al, 4
add cl, al
mov byte [rbp + 0x61], cl
mov cl, r12b
and cl, 0xf
shl cl, 2
mov al, dl
shr al, 6
add cl, al
mov byte [rbp + 0x62], cl
mov al, dl
and al, 0x3f
mov byte [rbp + 0x63], al
mov rsi, rbx
movzx edx, byte [rbp + rsi + 0x60]
lea rcx, [0x7ff787aa0330]
call fcn.7ff7879ea9c4
mov dl, byte [rax]
mov rcx, r14
call fcn.7ff7879eaa14
inc rsi
cmp rsi, 4
jl 0x7ff7879e9cd5
mov esi, ebx
mov rcx, rbx
mov dl, byte [rbp + 0x5a]
test r15d, r15d
jne 0x7ff7879e9c70
test esi, esi
je 0x7ff7879e9db3
movsxd rax, esi
cmp rax, rdi
jge 0x7ff7879e9d37
jae 0x7ff7879e9dc7
mov byte [rbp + rax + 0x58], bl
inc rax
cmp rax, rdi
jl 0x7ff7879e9d1a
mov dl, byte [rbp + 0x5a]
mov r12b, byte [rbp + 0x59]
mov r13b, byte [rbp + 0x58]
mov al, r13b
shr al, 2
mov byte [rbp + 0x60], al
and r13b, dil
shl r13b, 4
mov al, r12b
shr al, 4
add r13b, al
mov byte [rbp + 0x61], r13b
and r12b, 0xf
shl r12b, 2
mov al, dl
shr al, 6
add r12b, al
mov byte [rbp + 0x62], r12b
and dl, 0x3f
mov byte [rbp + 0x63], dl
lea eax, [rsi + 1]
movsxd r15, eax
test eax, eax
jle 0x7ff7879e9d9b
movzx edx, byte [rbp + rbx + 0x60]
lea rcx, [0x7ff787aa0330]
call fcn.7ff7879ea9c4
mov dl, byte [rax]
mov rcx, r14
call fcn.7ff7879eaa14
inc rbx
cmp rbx, r15
jl 0x7ff7879e9d78
cmp esi, edi
jge 0x7ff7879e9db3
sub edi, esi
mov ebx, edi
mov dl, 0x3d
mov rcx, r14
call fcn.7ff7879eaa14
sub rbx, 1
jne 0x7ff7879e9da3
mov rax, r14
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.7ff787a2eec8
int3

Function at 0x7ff7879ede0c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x3f
jl 0x7ff7879ede18
ret

Function at 0x7ff7879ee014
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x24
jl 0x7ff7879ee020
ret
Function at 0x7ff7879ee1bc
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx + 0x10]
mov eax, dword [rdx + 0x30]
add eax, 0x100000
mov dword [rdx + 0x40], eax
ret

Function at 0x7ff7879ee1dc
Capabilities:
Check for debugger via api

Disassembly:
sub rsp, 0x48
mov rax, qword [0x7ff787a99440]
xor rax, rsp
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x7ff7879ee276
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
test eax, eax
jne 0x7ff7879ee276
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x7ff787a84368]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x20]
lea rdx, [fcn.7ff7879e77c0]
call fcn.7ff787a2bc10
mov rcx, qword [rsp + 0x20]
call fcn.7ff787a2bea0
mov dword [rsp + 0x28], 1
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r9d, 4
lea r8, [rsp + 0x28]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
xor al, al
jmp 0x7ff7879ee278
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.7ff787a2ed90
add rsp, 0x48
ret

Function at 0x7ff7879ee580
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov dword [rcx + 4], edx
lea r9, [rcx + 8]
mov r8d, 1
mov r10d, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, r8d
inc r8
mov dword [r9], edx
lea r9, [r9 + 4]
cmp r8, r10
jb 0x7ff7879ee593
mov dword [rcx], r10d
ret

Function at 0x7ff7879eed74
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
mov rcx, qword [rcx]
jmp 0x7ff7879eed7c
push rbx
sub rsp, 0x20
cmp dword [rcx], 0x270
mov rbx, rcx
jne 0x7ff7879eed94
call fcn.7ff7879eede0
jmp 0x7ff7879eeda1
cmp dword [rcx], 0x4e0
jb 0x7ff7879eeda1
call fcn.7ff7879eee24
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret

Function at 0x7ff7879eede0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
lea r8, [rcx + 8]
mov r9d, 0x270
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x7ff7879eedea
ret
Function at 0x7ff7879eee24
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
lea r10, [rcx + 0x9c4]
mov r9, rcx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov edx, eax
add r10, 4
mov r11d, dword [r10]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x7ff7879eee3b
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
mov eax, r11d
mov r8, r10
mov edx, eax
add r10, 4
mov r11d, dword [r10]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x7ff7879eee88
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and dword [r9], ebx
mov rbx, qword [rsp + 8]
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
shr edx, 1
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
ret

Function at 0x7ff7879f1718
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 2
jl 0x7ff7879f1724
ret

Function at 0x7ff7879f1760
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 8
jl 0x7ff7879f176c
ret

Function at 0x7ff7879f7928
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x21
jl 0x7ff7879f7934
ret
Function at 0x7ff7879fdbec
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x128]
sub rsp, 0x210
mov rax, qword [0x7ff787a99440]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov r14, rcx
mov qword [rsp + 0x28], rcx
and dword [rsp + 0x24], 0
lea rdx, [rsp + 0x20]
call fcn.7ff7879f1710
mov rcx, rax
call fcn.7ff7879f1928
mov rdx, rax
mov rcx, r14
call fcn.7ff7879eaa74
mov dword [rsp + 0x24], 1
movdqa xmm0, xmmword [0x7ff787a867e0]
movdqu xmmword [rbp + 0xb0], xmm0
mov edi, 0x80000000
mov eax, edi
xor ecx, ecx
cpuid
mov esi, eax
mov dword [rbp + 0xb0], eax
mov dword [rbp + 0xb4], ebx
mov dword [rbp + 0xb8], ecx
mov dword [rbp + 0xbc], edx
cmp eax, 0x80000000
jb 0x7ff7879fdcf7
mov r15d, 0x10
mov eax, edi
xor ecx, ecx
cpuid
mov dword [rbp + 0xb0], eax
mov dword [rbp + 0xb4], ebx
mov dword [rbp + 0xb8], ecx
mov dword [rbp + 0xbc], edx
cmp edi, 0x80000002
jne 0x7ff7879fdcc2
lea rcx, [rbp + 0xc0]
jmp 0x7ff7879fdce2
cmp edi, 0x80000003
jne 0x7ff7879fdcd3
lea rcx, [rbp + 0xd0]
jmp 0x7ff7879fdce2
cmp edi, 0x80000004
jne 0x7ff7879fdcf1
lea rcx, [rbp + 0xe0]
mov r8, r15
lea rdx, [rbp + 0xb0]
call fcn.7ff787a66920
inc edi
cmp edi, esi
jbe 0x7ff7879fdc93
lea rcx, [rbp - 0x40]
call fcn.7ff7879fd580
mov edx, 1
lea rcx, [rbp - 0x40]
call fcn.7ff7879fffa0
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rbp - 0x80], 0x40
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rdi, qword [rbp - 0x78]
shr rdi, 0x14
lea rdx, [rsp + 0x20]
call fcn.7ff7879f1750
mov rcx, rax
call fcn.7ff7879f1910
mov rbx, rax
mov edx, dword [rsp + 0x70]
lea rcx, [rbp - 0x40]
call fcn.7ff787a00738
mov rcx, rax
mov rdx, rbx
call fcn.7ff7879f8ee0
mov rcx, rax
mov rdx, rdi
call fcn.7ff787a0060c
lea rdx, [rbp + 0xc0]
mov rcx, r14
call fcn.7ff7879f7a84
lea rdx, [rsp + 0x20]
call fcn.7ff7879f1750
mov rcx, rax
call fcn.7ff7879f1910
mov rdx, rax
mov rcx, r14
call fcn.7ff7879f7a84
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x40]
call fcn.7ff7879fff30
nop
mov rdx, rax
mov rcx, r14
call fcn.7ff7879f2de4
nop
lea rcx, [rsp + 0x30]
call fcn.7ff7879eaa2c
nop
lea rcx, [rbp - 0x40]
call fcn.7ff7879fd55c
mov rax, r14
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.7ff787a2ed90
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x7ff787a11d20
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x1b
jl 0x7ff787a11d2c
ret

Function at 0x7ff787a11d88
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x26
jl 0x7ff787a11d94
ret

Function at 0x7ff787a12118
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0xb2
jl 0x7ff787a12124
ret
Function at 0x7ff787a1332c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x2d
jl 0x7ff787a13338
ret

Function at 0x7ff787a1339c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x2f
jl 0x7ff787a133a8
ret

Function at 0x7ff787a13480
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x3c
jl 0x7ff787a1348c
ret

Function at 0x7ff787a13504
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov r10, rdx
xor r9d, r9d
sub r10, rcx
mov r8, rcx
mov eax, 0x51eb851f
mul r9d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r9b
inc r9d
sub al, cl
add al, 0x36
xor al, byte [r8 + r10]
mov byte [r8], al
inc r8
cmp r9d, 0x19
jl 0x7ff787a13510
ret