joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400019a4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9b, byte [rcx]
mov eax, r8d
mov r11, rcx
xor r9b, dl
lea r10, [rcx + 2]
xor r9b, 0xf8
cmp r9b, 2
jne 0x1400019c8
mov rax, r10
jmp 0x140001a13
test r9b, r9b
jne 0x140001a11
mov r8d, edx
mov r9, r10
xor r8d, 0xc0e2bdf8
test eax, eax
jle 0x140001a09
mov rbx, rax
movzx eax, byte [r9]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r9], cl
inc r9
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec rbx
jne 0x1400019e1
xor dl, 0xfa
mov byte [r11], dl
jmp 0x1400019c3
xor eax, eax
mov rbx, qword [rsp + 8]
ret

Function at 0x140001a1c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9b, byte [rcx]
mov eax, r8d
mov r11, rcx
xor r9b, dl
lea r10, [rcx + 2]
xor r9b, 0x91
cmp r9b, 2
jne 0x140001a40
mov rax, r10
jmp 0x140001a8b
test r9b, r9b
jne 0x140001a89
mov r8d, edx
mov r9, r10
xor r8d, 0x8aab7791
test eax, eax
jle 0x140001a81
mov rbx, rax
movzx eax, byte [r9]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r9], cl
inc r9
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec rbx
jne 0x140001a59
xor dl, 0x93
mov byte [r11], dl
jmp 0x140001a3b
xor eax, eax
mov rbx, qword [rsp + 8]
ret

Function at 0x140001a94
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x1401437a0]
xor rbx, r9
mov r11d, edx
mov ecx, 0xd53b0f5d
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x718689ab
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x5d
cmp al, 2
je 0x140001b13
test al, al
jne 0x140001b11
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001b08
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001ae0
xor r9b, 0x5f
mov byte [rbx], r9b
jmp 0x140001b13
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140001b1c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x140143800]
xor rbx, r9
mov r11d, edx
mov ecx, 0x8bfe115b
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x6a97b32a
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x5b
cmp al, 2
je 0x140001b9b
test al, al
jne 0x140001b99
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001b90
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001b68
xor r9b, 0x59
mov byte [rbx], r9b
jmp 0x140001b9b
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret
Function at 0x140001ba4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x140143c90]
xor rbx, r9
mov r11d, edx
mov ecx, 0xaacc8789
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x2059ba3d
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x89
cmp al, 2
je 0x140001c23
test al, al
jne 0x140001c21
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001c18
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001bf0
xor r9b, 0x8b
mov byte [rbx], r9b
jmp 0x140001c23
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140001c2c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x140144470]
xor rbx, r9
mov r11d, edx
mov ecx, 0x4210d312
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x6c5bb76c
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x12
cmp al, 2
je 0x140001cab
test al, al
jne 0x140001ca9
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001ca0
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001c78
xor r9b, 0x10
mov byte [rbx], r9b
jmp 0x140001cab
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140001cb4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x1401447c0]
xor rbx, r9
mov r11d, edx
mov ecx, 0xa3de290b
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0xc7e3e93d
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xb
cmp al, 2
je 0x140001d33
test al, al
jne 0x140001d31
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001d28
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001d00
xor r9b, 9
mov byte [rbx], r9b
jmp 0x140001d33
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140001db4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, ecx
mov r9d, edx
mov eax, edx
xor rcx, rax
xor r9d, r8d
lea rax, str.h_
xor r9d, 0x1d2ec114
xor rcx, 0x70b9ee6c
lea r8d, [r9 + r9]
add rcx, rax
jmp fcn.140001d3c

Function at 0x140001de4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x140144c20]
xor rbx, r9
mov r11d, edx
mov ecx, 0x5b1a3539
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0xb773ad55
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x39
cmp al, 2
je 0x140001e63
test al, al
jne 0x140001e61
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001e58
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001e30
xor r9b, 0x3b
mov byte [rbx], r9b
jmp 0x140001e63
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret
Function at 0x140001e6c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x140144d80]
xor rbx, r9
mov r11d, edx
mov ecx, 0x9b284225
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x34823375
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x25
cmp al, 2
je 0x140001eeb
test al, al
jne 0x140001ee9
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001ee0
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001eb8
xor r9b, 0x27
mov byte [rbx], r9b
jmp 0x140001eeb
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140001ef4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x140154de0]
xor rbx, r9
mov r11d, edx
mov ecx, 0xea92b788
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0xb0e781af
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x88
cmp al, 2
je 0x140001f73
test al, al
jne 0x140001f71
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001f68
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001f40
xor r9b, 0x8a
mov byte [rbx], r9b
jmp 0x140001f73
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140001f7c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9b, byte [rcx]
mov eax, r8d
mov r11, rcx
xor r9b, dl
lea r10, [rcx + 2]
xor r9b, 0x63
cmp r9b, 2
jne 0x140001fa0
mov rax, r10
jmp 0x140001feb
test r9b, r9b
jne 0x140001fe9
mov r8d, edx
mov r9, r10
xor r8d, 0xd040f063
test eax, eax
jle 0x140001fe1
mov rbx, rax
movzx eax, byte [r9]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r9], cl
inc r9
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec rbx
jne 0x140001fb9
xor dl, 0x61
mov byte [r11], dl
jmp 0x140001f9b
xor eax, eax
mov rbx, qword [rsp + 8]
ret

Function at 0x140001ff4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x1401586a0]
xor rbx, r9
mov r11d, edx
mov ecx, 0xe48fa552
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x8c830fac
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x52
cmp al, 2
je 0x140002073
test al, al
jne 0x140002071
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140002068
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140002040
xor r9b, 0x50
mov byte [rbx], r9b
jmp 0x140002073
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret
Function at 0x14000207c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x140158980]
xor rbx, r9
mov r11d, edx
mov ecx, 0xa7cfa70
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x8d904355
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x70
cmp al, 2
je 0x1400020fb
test al, al
jne 0x1400020f9
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x1400020f0
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x1400020c8
xor r9b, 0x72
mov byte [rbx], r9b
jmp 0x1400020fb
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140002104
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9b, byte [rcx]
mov eax, r8d
mov r11, rcx
xor r9b, dl
lea r10, [rcx + 2]
xor r9b, 0x60
cmp r9b, 2
jne 0x140002128
mov rax, r10
jmp 0x140002173
test r9b, r9b
jne 0x140002171
mov r8d, edx
mov r9, r10
xor r8d, 0xce806460
test eax, eax
jle 0x140002169
mov rbx, rax
movzx eax, byte [r9]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r9], cl
inc r9
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec rbx
jne 0x140002141
xor dl, 0x62
mov byte [r11], dl
jmp 0x140002123
xor eax, eax
mov rbx, qword [rsp + 8]
ret

Function at 0x1400021ac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x14015c820]
xor rbx, r9
mov r11d, edx
mov ecx, 0x8a836eae
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0xb8c1c9e7
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xae
cmp al, 2
je 0x14000222b
test al, al
jne 0x140002229
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140002220
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x1400021f8
xor r9b, 0xac
mov byte [rbx], r9b
jmp 0x14000222b
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140002234
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov r10d, ecx
lea rax, [0x14015ca60]
xor r10, r9
mov ecx, 0x7515f3f0
mov r11d, r8d
xor r10, rcx
add r10, rax
mov al, byte [r10]
xor al, dl
lea rdx, [r10 + 2]
xor al, 0xf0
cmp al, 2
je 0x1400022b8
test al, al
jne 0x1400022b6
mov eax, r9d
mov r8d, r9d
xor eax, r11d
xor r8d, ecx
add eax, eax
movsxd r11, eax
xor r11, 0xffffffff9d098fb2
jle 0x1400022ad
mov rbx, rdx
movzx eax, byte [rbx]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [rbx], cl
inc rbx
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140002287
xor r9b, 0xf2
mov byte [r10], r9b
jmp 0x1400022b8
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret
Function at 0x1400022c4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x14015cda8]
xor rbx, r9
mov r11d, edx
mov ecx, 0x7ccf05e3
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0xb2508ec3
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xe3
cmp al, 2
je 0x140002343
test al, al
jne 0x140002341
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140002338
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140002310
xor r9b, 0xe1
mov byte [rbx], r9b
jmp 0x140002343
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x14000234c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x14015cde0]
xor rbx, r9
mov r11d, edx
mov ecx, 0x7788c298
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0xc4a7bbdb
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x98
cmp al, 2
je 0x1400023cb
test al, al
jne 0x1400023c9
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x1400023c0
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140002398
xor r9b, 0x9a
mov byte [rbx], r9b
jmp 0x1400023cb
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x1400023d4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9b, byte [rcx]
mov eax, r8d
mov r11, rcx
xor r9b, dl
lea r10, [rcx + 2]
xor r9b, 0x2a
cmp r9b, 2
jne 0x1400023f8
mov rax, r10
jmp 0x140002443
test r9b, r9b
jne 0x140002441
mov r8d, edx
mov r9, r10
xor r8d, 0x78eb3f2a
test eax, eax
jle 0x140002439
mov rbx, rax
movzx eax, byte [r9]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r9], cl
inc r9
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec rbx
jne 0x140002411
xor dl, 0x28
mov byte [r11], dl
jmp 0x1400023f3
xor eax, eax
mov rbx, qword [rsp + 8]
ret

Function at 0x14000244c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov r11d, ecx
lea rax, [0x14015ce50]
xor r11, r9
mov ecx, 0xfba02bea
mov r10d, r8d
xor r11, rcx
add r11, rax
mov al, byte [r11]
xor al, dl
lea rdx, [r11 + 2]
xor al, 0xea
cmp al, 2
je 0x1400024d0
test al, al
jne 0x1400024ce
mov eax, r9d
mov r8d, r9d
xor eax, r10d
xor r8d, ecx
add eax, eax
movsxd r10, eax
xor r10, 0xffffffffc8bab7a6
jle 0x1400024c5
mov rbx, rdx
movzx eax, byte [rbx]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [rbx], cl
inc rbx
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r10
jne 0x14000249f
xor r9b, 0xe8
mov byte [r11], r9b
jmp 0x1400024d0
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret
Function at 0x1400024dc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x14015d198]
xor rbx, r9
mov r11d, edx
mov ecx, 0xd8e96c5d
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x69eeba49
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x5d
cmp al, 2
je 0x14000255b
test al, al
jne 0x140002559
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140002550
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140002528
xor r9b, 0x5f
mov byte [rbx], r9b
jmp 0x14000255b
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140002564
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x14015d1c0]
xor rbx, r9
mov r11d, edx
mov ecx, 0xb367796a
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0xf1f2c330
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x6a
cmp al, 2
je 0x1400025e3
test al, al
jne 0x1400025e1
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x1400025d8
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x1400025b0
xor r9b, 0x68
mov byte [rbx], r9b
jmp 0x1400025e3
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x1400025ec
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x14015d6b0]
xor rbx, r9
mov r11d, edx
mov ecx, 0x288043a6
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x74dbd4f8
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xa6
cmp al, 2
je 0x14000266b
test al, al
jne 0x140002669
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140002660
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140002638
xor r9b, 0xa4
mov byte [rbx], r9b
jmp 0x14000266b
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140002674
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x14015fc30]
xor rbx, r9
mov r11d, edx
mov ecx, 0xfb9648db
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x55467b4b
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xdb
cmp al, 2
je 0x1400026f3
test al, al
jne 0x1400026f1
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x1400026e8
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x1400026c0
xor r9b, 0xd9
mov byte [rbx], r9b
jmp 0x1400026f3
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret
Function at 0x140004c24
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rcx
mov edx, 0x89d72e82
mov r8d, 0xf88f2444
mov ecx, 0xf8624f6
call fcn.1400010f0
lea r8, [0x140129d88]
lea rcx, [rsp + 0x40]
mov rdx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
xor esi, esi
mov rcx, 0xffffffff80000001
mov word [rdi], si
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x140004cfa
mov edx, 0x82f336cb
mov ecx, 0x4a23c85
mov r8d, 0xf3ab3c04
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x34], InitCommonControls
call fcn.1400010f0
mov rcx, qword [rsp + 0x38]
mov rdx, rax
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140004cf7
cmp dword [rsp + 0x30], 1
je 0x140004cfa
mov word [rdi], si
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140004d20
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rdi, rcx
mov edx, 0xa43e5a93
mov r8d, 0xd5665055
mov ecx, 0x226f50c9
call fcn.1400010f0
lea r8, [0x140129d88]
lea rcx, [rsp + 0x40]
mov rdx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
xor ecx, ecx
test eax, eax
jne 0x140004e07
test rdi, rdi
je 0x140004dd9
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], cx
jne 0x140004d92
mov edx, 0x197e1e23
mov ecx, 0x9f2f1417
mov r8d, 0x682614ec
lea ebx, [rax*2 + 2]
call fcn.1400010f0
mov rcx, qword [rsp + 0x30]
mov rdx, rax
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x140004dfc
mov edx, 0xbd543bf4
mov ecx, 0x3b0531f4
mov r8d, 0xcc0c313b
call fcn.1400010f0
mov rcx, qword [rsp + 0x30]
mov rdx, rax
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400e8bc0
mov rbx, qword [rsp + 0x168]
add rsp, 0x150
pop rdi
ret
Function at 0x140005614
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, ecx
lea rcx, [rsp + 0x50]
xor edx, edx
call fcn.14000d8c0
cmp eax, 1
jne 0x140005677
mov edx, 0x4b1826e9
mov r8d, 0xe5a449ee
mov ecx, 0x3d81ff4a
mov dword [rsp + 0x48], ebx
call fcn.1400014e0
lea rcx, [rsp + 0x48]
mov r9d, 4
xor r8d, r8d
mov rdx, rax
mov dword [rsp + 0x28], r9d
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x30
pop rbx
ret

Function at 0x140005680
Capabilities:
Set registry value

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.14000d8c0
cmp eax, 1
jne 0x1400056e3
mov edx, 0xaac712bd
mov r8d, 0x47b7dbd
mov ecx, 0xdc5ecb4e
call fcn.1400014e0
mov rcx, qword [rsp + 0x40]
mov r9d, 0xb
mov rdx, rax
lea rax, [rsp + 0x48]
xor r8d, r8d
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x38
ret

Function at 0x1400056e8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x28]
sub rsp, 0x120
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov bl, dl
mov rdi, rcx
test dl, dl
jne 0x140005738
mov ecx, 1
call fcn.140025730
test eax, eax
jle 0x14000580d
mov ecx, eax
call fcn.140005614
movabs r8, 0x2000600060000
lea rdx, [0x140129d88]
lea rcx, [rsp + 0x50]
call fcn.1400247e8
nop
test bl, bl
jne 0x1400057d3
and qword [rsp + 0x40], 0
xor edx, edx
lea rcx, [rsp + 0x38]
call fcn.14000d8c0
cmp eax, 1
jne 0x1400057c9
mov dword [rsp + 0x34], InitCommonControls
mov dword [rsp + 0x30], 8
mov edx, 0x30bba901
mov ecx, 0x46227018
mov r8d, 0x9e07c601
call fcn.1400014e0
mov rdx, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x50], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov edx, 1
call qword [sym.imp.USER32.dll_LoadIconW]
mov qword [rsp + 0x58], rax
mov r8, rdi
lea rdx, str.https:__www.xreveal.com_update_xreveal.txt
lea rcx, [rsp + 0x50]
call fcn.1400248b4
nop
lea rcx, [rsp + 0x50]
call fcn.140024864
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1400e8bc0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140008600
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x140163470]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
movzx r14d, dx
mov rsi, rcx
call qword [sym.imp.USER32.dll_GetMessagePos]
xor edx, edx
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x50], 0x50
lea r8d, [rdx + 0x48]
mov ebx, eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x54], 0x43
call fcn.1400ebf40
lea rax, [rbp - 0x60]
mov qword [rbp - 0x78], rax
call qword [sym.imp.USER32.dll_CreatePopupMenu]
mov edx, 0x338f292c
mov ecx, 0x6ae65095
mov r8d, 0xd848f0d0
mov rdi, rax
call fcn.140001288
lea rdx, [rbp - 0x60]
sub rdx, rax
xor r15d, r15d
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14000868f
lea r9, [rsp + 0x50]
mov r8d, 1
or edx, 0xffffffff
mov rcx, rdi
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x5c], r15d
call qword [sym.imp.USER32.dll_InsertMenuItemW]
movsx r9d, word [rsp + 0x42]
mov qword [rsp + 0x30], r15
movsx r8d, bx
mov edx, 0x180
mov rcx, rdi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], r15d
call qword [sym.imp.USER32.dll_TrackPopupMenu]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.USER32.dll_DestroyMenu]
cmp ebx, 1
jne 0x1400087aa
mov edx, 0xc24a0e4
mov ecx, 0x554dd99b
mov r8d, 0xe7e3790d
call fcn.140001288
lea rdx, [rbp - 0x60]
sub rdx, rax
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x14000871a
lea rcx, [rbp - 0x50]
call fcn.14003198c
mov edx, 0xd310cf8d
mov ecx, 0x8a79b6c6
mov r8d, 0x38d71666
movzx ebx, r14w
mov rdi, rax
call fcn.140001288
mov r8d, ebx
mov rcx, rdi
mov rdx, rax
call qword [sym.imp.USER32.dll_wsprintfW]
mov edx, 0x142f90e
mov ecx, 0x582b8029
mov r8d, 0xea8520e7
call fcn.140001288
mov edx, 0x7e6a5abf
mov ecx, 0x270323ec
mov r8d, 0x95ad835a
mov rbx, rax
call fcn.140001288
lea r9, [rbp - 0x60]
mov r8, rbx
xor ecx, ecx
mov rdx, rax
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.1400e8bc0
mov rbx, qword [rsp + 0x310]
add rsp, 0x2d0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret