joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005060
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140005091
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je case.default.0x1400050a8
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400050cb
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400050cd
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140005109
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000519e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140005144
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000517e
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000519e
cmp rbx, rax
ja 0x140005150
test rbx, rbx
je 0x14000519e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x140005600
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140010040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000562d
xor eax, eax
jmp 0x140005799
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140005667
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140005667
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140005799
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000578c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400056aa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400056d5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140005791
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140005744
sub eax, 1
je 0x140005744
cmp eax, 2
jne 0x14000578c
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140005791
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140005772
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000578c
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140005791
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140008020
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400062b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140010040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140006383
cmp byte [rcx + 0x71], 0
je 0x140006383
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000637f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140006344
sub eax, 1
je 0x140006348
cmp eax, 2
jne 0x14000637f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140008020
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140006376
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000637f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000632c
xor al, al
jmp 0x14000632c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140008020
add rsp, 0x60
pop rbx
ret

Function at 0x14000794c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x140007986
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14000798b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400079d4
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, reloc.WS2_32.dll_accept
cmp byte [rcx + rax], 0
je 0x1400079d4
dec r8
sub rdx, 1
jne 0x1400079ba
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140008ac4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140008b0e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140008b0e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140008b0e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140008b0e
cmp dword [rcx + 0x84], 0xe
jbe 0x140008b0e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140008b10
xor al, al
add rsp, 0x28
ret
Function at 0x14000b080
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002fdd8]
test rcx, rcx
je 0x14000b0bb
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000b0ae
mov rcx, qword [0x14002fdd8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002fdd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14002fde8], 0
je 0x14000b1ae
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140029970]
mov qword [rsp + 0x80], rsi
lea rsi, [0x140030610]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b18f
test al, 0x10
je 0x14000b18f
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000b135
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x140002bec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002c36
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002c36
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002c36
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002c36
cmp dword [rcx + 0x84], 0xe
jbe 0x140002c36
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002c38
xor al, al
add rsp, 0x28
ret
Function at 0x18002ccf3
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xcbb80f32
pushf
not eax
add eax, 0x91fcc976
xor eax, 0xe52d87d9
rol eax, 0x20
popf
pushf
not eax
add eax, 0xec83139a
xor eax, 0xc919d5ff
rol eax, 0xb
popf
cmp eax, 2
jne 0x18002cd30
popf
pop rax
jmp 0x18002ce08
cmp eax, 0
jne 0x18002cd3f
popf
pop rax
jmp 0x18002cd4e
cmp eax, 1
jne 0x18002cd4e
popf
pop rax
jmp 0x18002cde9
lea rax, [rcx + 4]
mov r11d, 0x2d99be2d
pushf
not r11d
add r11d, 0xaf68107f
xor r11d, 0xfb946f8b
rol r11d, 0xe7
popf
pushf
not r11d
add r11d, 0xce064a8f
xor r11d, 0xa0e75d56
rol r11d, 0xe0
popf
mov rdx, rax
nop dword [rax]
push rax
pushf
mov eax, 0x29f71d
pushf
not eax
add eax, 0xbf45e664
xor eax, 0x8e8b9cbb
rol eax, 0x6b
popf
pushf
not eax
add eax, 0xaa92a0f7
xor eax, 0x92c64bb9
rol eax, 0x52
popf
pushf
not eax
add eax, 0x9397d2e3
xor eax, 0xc1c9c231
rol eax, 0xe4
popf
pushf
not eax
add eax, 0xae2f8f60
xor eax, 0x96230b79
rol eax, 0xb1
popf
jmp 0x18002cd21
movsx r10d, byte [rdx]
lea rdx, [rdx + 1]
mov r8d, dword [rcx]
movsx r9d, r8b
mov r8d, r10d
xor r8d, r9d
mov byte [rdx - 1], r8b
sub r11, 1
jne 0x18002cde9
mov byte [rcx + 0xb], r11b
ret

Function at 0x18002dfb5
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x9ee8e54f
pushf
not eax
add eax, 0x87defd98
xor eax, 0xe9b117ce
rol eax, 0xce
popf
pushf
not eax
add eax, 0xb27d21e2
xor eax, 0xee9ba190
rol eax, 0x8d
popf
cmp eax, 2
jne 0x18002dff2
popf
pop rax
jmp 0x18002e0ca
cmp eax, 0
jne 0x18002e001
popf
pop rax
jmp 0x18002e010
cmp eax, 1
jne 0x18002e010
popf
pop rax
jmp 0x18002e0ab
lea rax, [rcx + 4]
mov r11d, 0x590e734e
pushf
not r11d
add r11d, 0xaea03465
xor r11d, 0xdc8c5b28
rol r11d, 0x62
popf
pushf
not r11d
add r11d, 0xef37145b
xor r11d, 0xcac0a900
rol r11d, 0xfb
popf
mov rdx, rax
nop dword [rax]
push rax
pushf
mov eax, 0x3e13373f
pushf
not eax
add eax, 0x8611c0b4
xor eax, 0xae025e92
rol eax, 4
popf
pushf
not eax
add eax, 0xde3cf6ae
xor eax, 0xcb667eff
rol eax, 0x6d
popf
pushf
not eax
add eax, 0xcccdef0e
xor eax, 0x8f8389f8
rol eax, 0xaf
popf
pushf
not eax
add eax, 0xdff066b7
xor eax, 0xbb26547b
rol eax, 0x85
popf
jmp 0x18002dfe3
movsx r10d, byte [rdx]
lea rdx, [rdx + 1]
mov r8d, dword [rcx]
movsx r9d, r8b
mov r8d, r10d
xor r8d, r9d
mov byte [rdx - 1], r8b
sub r11, 1
jne 0x18002e0ab
mov byte [rcx + 0x17], r11b
ret
Function at 0x18002ec88
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xd7149ddb
pushf
not eax
add eax, 0xfa532831
xor eax, 0x86fb1466
rol eax, 0x6f
popf
pushf
not eax
add eax, 0xfcf8fbf9
xor eax, 0xef31171c
rol eax, 0x6f
popf
pushf
not eax
add eax, 0xd1bce82c
xor eax, 0xb2b786b4
rol eax, 0xcc
popf
cmp eax, 2
jne 0x18002ecd8
popf
pop rax
jmp 0x18002edcf
cmp eax, 0
jne 0x18002ece7
popf
pop rax
jmp 0x18002ecf6
cmp eax, 1
jne 0x18002ecf6
popf
pop rax
jmp 0x18002edb0
lea rax, [rcx + 4]
mov r11d, 0x9ab12781
pushf
not r11d
add r11d, 0xe99d417a
xor r11d, 0xcdbabd21
rol r11d, 0xf8
popf
pushf
not r11d
add r11d, 0xe66e2429
xor r11d, 0x9be2bdd2
rol r11d, 0x1a
popf
pushf
not r11d
add r11d, 0xebdc910b
xor r11d, 0xbe5ddee8
rol r11d, 0x78
popf
pushf
not r11d
add r11d, 0x876b34ac
xor r11d, 0xe66356fa
rol r11d, 0xad
popf
mov rdx, rax
nop dword [rax]
push rax
pushf
mov eax, 0x7196dded
pushf
not eax
add eax, 0x833e6ac2
xor eax, 0xfb4e664e
rol eax, 0xa2
popf
pushf
not eax
add eax, 0xd555ef64
xor eax, 0xc2ac881e
rol eax, 0x60
popf
pushf
not eax
add eax, 0xda664478
xor eax, 0xef637795
rol eax, 0xbe
popf
jmp 0x18002ecc9
movsx r10d, byte [rdx]
lea rdx, [rdx + 1]
mov r8d, dword [rcx]
movsx r9d, r8b
mov r8d, r10d
xor r8d, r9d
mov byte [rdx - 1], r8b
sub r11, 1
jne 0x18002edb0
mov byte [rcx + 0xf], r11b
ret
Function at 0x18002f9f8
Capabilities:
Create process on windows

Disassembly:
push rax
pushf
mov eax, 0x786fa632
pushf
not eax
add eax, 0xb53e71b6
xor eax, 0xe7f1d8f7
rol eax, 0xd3
popf
pushf
not eax
add eax, 0x985477d1
xor eax, 0xe9cb23e4
rol eax, 0x1f
popf
pushf
not eax
add eax, 0xa9267032
xor eax, 0xfe44a112
rol eax, 0x38
popf
pushf
not eax
add eax, 0xba87afda
xor eax, 0xb9277829
rol eax, 0x25
popf
cmp eax, 2
jne 0x18002fa5b
popf
pop rax
jmp 0x18002fbd3
cmp eax, 0
jne 0x18002fa6a
popf
pop rax
jmp 0x18002fa79
cmp eax, 1
jne 0x18002fa79
popf
pop rax
jmp 0x18002fb52
push rbx
sub rsp, 0xe0
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call sub.VCRUNTIME140.dll_memset
xor ecx, ecx
mov dword [rsp + 0x70], 0x68
lea rax, [rsp + 0x50]
mov dword [rsp + 0xac], 1
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
mov word [rsp + 0xb0], cx
mov qword [rsp + 0x40], rax
xor r8d, r8d
mov qword [rsp + 0x38], rcx
mov rdx, rbx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
jmp 0x18002fae2
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x18002fb1f
push rax
pushf
mov eax, 0x6cbc8ec5
pushf
not eax
add eax, 0x8fd290a1
xor eax, 0xf2180941
rol eax, 0xaf
popf
pushf
not eax
add eax, 0xc6da8783
xor eax, 0xd28d1efb
rol eax, 0xa4
popf
jmp 0x18002fa4c
push rax
pushf
mov eax, 0x27d301b0
pushf
not eax
add eax, 0xc27450ab
xor eax, 0x836f5517
rol eax, 0xb6
popf
pushf
not eax
add eax, 0x832b4486
xor eax, 0xc7e4d0ff
rol eax, 0x23
popf
jmp 0x18002fa4c
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
lea rdx, [0x1db591bb7]
pushf
sub rdx, 0x5b575d77
popf
call fcn.1800458dc
mov rcx, rax
lea rdx, [0x1c6e04d4c]
pushf
sub rdx, 0x46df2edc
popf
jmp 0x18002fb86
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 0x42b39805
pushf
not eax
add eax, 0xe044f33f
xor eax, 0xad5c62c9
rol eax, 0xa3
popf
pushf
not eax
add eax, 0xace00c3a
xor eax, 0xccb8ee4d
rol eax, 0x2d
popf
pushf
not eax
add eax, 0x8729a250
xor eax, 0xaecae4f6
rol eax, 0x67
popf
add rsp, 0xe0
pop rbx
ret
mov rcx, qword [rsp + 0x50]
mov edx, 0xf440a22f
pushf
not edx
add edx, 0xf9c22a2a
xor edx, 0xa6f0ebaf
rol edx, 0x68
popf
pushf
not edx
add edx, 0xb101caac
xor edx, 0xb2147d70
rol edx, 0xe1
popf
pushf
not edx
add edx, 0xdfe768c4
xor edx, 0xc09ca6b2
rol edx, 0xaa
popf
pushf
not edx
add edx, 0xe87c7313
xor edx, 0xff490cfe
rol edx, 0xb6
popf
jmp 0x18002fc32
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
jmp 0x18002fc3e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
jmp 0x18002fc4a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0xe0
pop rbx
ret
Function at 0x18003bcc9
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x20939597
pushf
not eax
add eax, 0x9ef2b829
xor eax, 0xa0b25f25
rol eax, 0xc4
popf
pushf
not eax
add eax, 0xad791963
xor eax, 0x8cc45ac5
rol eax, 0x91
popf
pushf
not eax
add eax, 0xb1ca5f7e
xor eax, 0xe829fab3
rol eax, 0x4f
popf
cmp eax, 2
jne 0x18003bd19
popf
pop rax
jmp 0x18003bdbb
cmp eax, 0
jne 0x18003bd28
popf
pop rax
jmp 0x18003bd37
cmp eax, 1
jne 0x18003bd37
popf
pop rax
jmp 0x18003bda0
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
push rax
pushf
mov eax, 0xc46f23d
pushf
not eax
add eax, 0xca15b54c
xor eax, 0xc4eba6ca
rol eax, 0x96
popf
pushf
not eax
add eax, 0xee187cd0
xor eax, 0xa6bc4e7d
rol eax, 0x44
popf
pushf
not eax
add eax, 0x99ad4e1f
xor eax, 0xecc02420
rol eax, 0x1a
popf
pushf
not eax
add eax, 0xe130ccc0
xor eax, 0x9ccab75a
rol eax, 0xc2
popf
jmp 0x18003bd0a
movsx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9d, r8d
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0xb
jb 0x18003bda0
mov byte [rcx + 0xf], 0
ret
Function at 0x180047f41
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x86474220
pushf
not eax
add eax, 0xa9dff221
xor eax, 0x9b1287c9
rol eax, 0x6c
popf
pushf
not eax
add eax, 0xae16debc
xor eax, 0xbacf8b2e
rol eax, 0x46
popf
pushf
not eax
add eax, 0xe22b7dfc
xor eax, 0xccb9768f
rol eax, 0x2d
popf
cmp eax, 2
jne 0x180047f91
popf
pop rax
jmp 0x18004805c
cmp eax, 0
jne 0x180047fa0
popf
pop rax
jmp 0x180047faf
cmp eax, 1
jne 0x180047faf
popf
pop rax
jmp 0x18004803d
lea rax, [rcx + 4]
mov r11d, 0xd2868f21
pushf
not r11d
add r11d, 0x8844d4d1
xor r11d, 0x94ecab72
rol r11d, 0x5c
popf
pushf
not r11d
add r11d, 0xf779f6ce
xor r11d, 0xf7342341
rol r11d, 0x88
popf
pushf
not r11d
add r11d, 0xdae372ee
xor r11d, 0x89fed05b
rol r11d, 0xfa
popf
mov rdx, rax
nop dword [rax]
push rax
pushf
mov eax, 0xffede3a
pushf
not eax
add eax, 0xc437d455
xor eax, 0x8a04ea72
rol eax, 0x6e
popf
pushf
not eax
add eax, 0xb65b5ec2
xor eax, 0xaf514f32
rol eax, 0x6c
popf
jmp 0x180047f82
movsx r10d, byte [rdx]
lea rdx, [rdx + 1]
mov r8d, dword [rcx]
movsx r9d, r8b
mov r8d, r10d
xor r8d, r9d
mov byte [rdx - 1], r8b
sub r11, 1
jne 0x18004803d
mov byte [rcx + 9], r11b
ret

Function at 0x18004876a
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x1adfb71d
pushf
not eax
add eax, 0xbae66a38
xor eax, 0xaa359dfa
rol eax, 0xda
popf
pushf
not eax
add eax, 0xf9ed8af1
xor eax, 0xd819081b
rol eax, 0x88
popf
pushf
not eax
add eax, 0x8cbb5db3
xor eax, 0xcccd92d4
rol eax, 0xa6
popf
pushf
not eax
add eax, 0x8da16a73
xor eax, 0x9b71f91a
rol eax, 0x4c
popf
cmp eax, 2
jne 0x1800487cd
popf
pop rax
jmp 0x18004886f
cmp eax, 0
jne 0x1800487dc
popf
pop rax
jmp 0x1800487eb
cmp eax, 1
jne 0x1800487eb
popf
pop rax
jmp 0x180048854
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
push rax
pushf
mov eax, 0xac308b86
pushf
not eax
add eax, 0xec861226
xor eax, 0x9afff7ab
rol eax, 0x84
popf
pushf
not eax
add eax, 0x9abde614
xor eax, 0xf0254edc
rol eax, 0xb2
popf
pushf
not eax
add eax, 0x9244e45e
xor eax, 0x900442da
rol eax, 0x74
popf
pushf
not eax
add eax, 0xcb01e5d0
xor eax, 0xb526c845
rol eax, 0x69
popf
jmp 0x1800487be
movsx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9d, r8d
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x14
jb 0x180048854
mov byte [rcx + 0x18], 0
ret
Function at 0x180048b2a
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x87d0620c
pushf
not eax
add eax, 0x9366096a
xor eax, 0xa09f6095
rol eax, 0x29
popf
pushf
not eax
add eax, 0xc2078c73
xor eax, 0xf3dfa55b
rol eax, 0x13
popf
pushf
not eax
add eax, 0xec0f647f
xor eax, 0xf9d4673c
rol eax, 0xb
popf
cmp eax, 2
jne 0x180048b7a
popf
pop rax
jmp 0x180048bf6
cmp eax, 0
jne 0x180048b89
popf
pop rax
jmp 0x180048b98
cmp eax, 1
jne 0x180048b98
popf
pop rax
jmp 0x180048bdb
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
push rax
pushf
mov eax, 0x8bb66d90
pushf
not eax
add eax, 0xd08dfd76
xor eax, 0x80ee94d7
rol eax, 0x1a
popf
pushf
not eax
add eax, 0xca983f6d
xor eax, 0xff875b40
rol eax, 0x5a
popf
jmp 0x180048b6b
movsx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9d, r8d
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x39
jb 0x180048bdb
mov byte [rcx + 0x3d], 0
ret

Function at 0x18004e562
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0x50940148
pushf
not eax
add eax, 0xdba5b040
xor eax, 0xbd1ba443
rol eax, 0xb
popf
pushf
not eax
add eax, 0xdb232c95
xor eax, 0x8acd8ae4
rol eax, 0xa7
popf
cmp eax, 2
jne 0x18004e59f
popf
pop rax
jmp 0x18004e67d
cmp eax, 0
jne 0x18004e5ae
popf
pop rax
jmp 0x18004e5bd
cmp eax, 1
jne 0x18004e5bd
popf
pop rax
jmp 0x18004e65e
lea rax, [rcx + 4]
mov r11d, 0xa8fa0514
pushf
not r11d
add r11d, 0xb60b2416
xor r11d, 0xb1e1ab65
rol r11d, 0x66
popf
pushf
not r11d
add r11d, 0xd1b90be8
xor r11d, 0x89ecb0e4
rol r11d, 0x78
popf
pushf
not r11d
add r11d, 0xf6986f99
xor r11d, 0x9abc0856
rol r11d, 0xc
popf
mov rdx, rax
nop dword [rax]
push rax
pushf
mov eax, 0xabfe3533
pushf
not eax
add eax, 0xa5cc13ce
xor eax, 0xf4ac5d3a
rol eax, 0x4f
popf
pushf
not eax
add eax, 0xea72e1b2
xor eax, 0xdbc793b9
rol eax, 0x87
popf
pushf
not eax
add eax, 0x9a28c481
xor eax, 0xe7846a07
rol eax, 0x57
popf
jmp 0x18004e590
movsx r10d, byte [rdx]
lea rdx, [rdx + 1]
mov r8d, dword [rcx]
movsx r9d, r8b
mov r8d, r10d
xor r8d, r9d
mov byte [rdx - 1], r8b
sub r11, 1
jne 0x18004e65e
mov byte [rcx + 0x10], r11b
ret

Function at 0x18004fbb3
Capabilities:
Encode data using xor

Disassembly:
push rax
pushf
mov eax, 0xab7a7fda
pushf
not eax
add eax, 0xfeee4934
xor eax, 0xe93b0637
rol eax, 0x48
popf
pushf
not eax
add eax, 0xd6e2c82a
xor eax, 0x8e13596f
rol eax, 0xf3
popf
cmp eax, 2
jne 0x18004fbf0
popf
pop rax
jmp 0x18004fc6c
cmp eax, 0
jne 0x18004fbff
popf
pop rax
jmp 0x18004fc0e
cmp eax, 1
jne 0x18004fc0e
popf
pop rax
jmp 0x18004fc51
xor edx, edx
lea rax, [rcx + 4]
nop word [rax + rax]
push rax
pushf
mov eax, 0x84583bba
pushf
not eax
add eax, 0xd40adb1b
xor eax, 0xae9318fb
rol eax, 0x1c
popf
pushf
not eax
add eax, 0x94b2e838
xor eax, 0xd6a0cebe
rol eax, 0x98
popf
jmp 0x18004fbe1
movsx r8d, byte [rax + rdx]
mov r9d, dword [rcx]
add r9b, dl
xor r9d, r8d
mov byte [rax + rdx], r9b
inc rdx
cmp rdx, 0x29
jb 0x18004fc51
mov byte [rcx + 0x2d], 0
ret