joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002d58
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov dil, byte [rsp + 0x57]
sub dil, sil
mov qword [rsp + 0x118], r9
sbb byte [rcx], al
add byte [rax], al
cmp al, dil
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], rcx
mov byte [rsp + 0x3f], bl

Function at 0x140003184
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov dword [rsp + 0xec], r8d
mov r8d, dword [rsp + 0x2c]

Function at 0x1400031a0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
mov r8d, dword [rsp + 0xfc]
invalid
invalid
invalid
invalid

Function at 0x140003510
Capabilities:
Send icmp echo request

Disassembly:
add byte [rax], al
add byte [rsi - 0x48], ah
invalid
sal byte [rcx + 0x48], cl

Function at 0x140003518
Capabilities:
Send icmp echo request

Disassembly:
mov edx, dword [rsp + 0xb0]
mov qword [rsp + 0xb0], 0xffffffff86b26999
invalid
invalid
test byte [rsi + rbp*4], ah
add byte [rax], al
invalid
invalid

Function at 0x140003534
Capabilities:
Send icmp echo request

Disassembly:
mov eax, 0x8b4871d2
xchg esp, eax
and al, 0xb0
add byte [rax], al
add byte [rax - 0x39], cl
test byte [rax + rsi*4], ah
add byte [rax], al
add byte [rcx + 0x6686b269], bl
mov dword [rsp + 0xae], 0x84c7758b
jne 0x1400034fd
test byte [rax + riz*4], ah
add byte [rax], al
add byte [rax + 0x7b], dh
jo 0x1400035b9

Function at 0x140003540
Capabilities:
Send icmp echo request

Disassembly:
mov r8w, word [rsp + 0xae]
sub ax, r8w
shl byte [rsi - 0x77], 0x84
and al, 0x9e
add byte [rax], al
add byte [rbx + rcx*4 - 0x74], al

Function at 0x140003560
Capabilities:
Send icmp echo request

Disassembly:
xor r10d, 0x7af6c9f1
mov dword [rsp + 0xa8], r10d
mov dword [rsp + 0xa8], edx

Function at 0x140003568
Capabilities:
Send icmp echo request

Disassembly:
mov dword [rsp + 0xa8], edx
mov ax, word [rsp + 0xae]
mov r11b, byte [rsp + 0xad]
mov bl, byte [rsp + 0xad]

Function at 0x140003588
Capabilities:
Send icmp echo request

Disassembly:
mov edi, ecx
add rdi, 0x3c
mov byte [rsp + 0xad], 1
xor ax, 0x6787
mov byte [rsp + 0xad], 0xae
add byte [rsi + 0x48c63966], ch
mov dword [rsp + 0x90], ecx
and al, 0x90
add byte [rax], al
invalid
mov word [rsp + 0x8e], r8w
mov qword [rsp + 0x80], rdx
mov dword [rsp + 0x7c], r9d

Function at 0x1400035a0
Capabilities:
Send icmp echo request

Disassembly:
mov edi, ecx
add rdi, 0x3c
mov byte [rsp + 0xad], 1
xor ax, 0x6787
mov byte [rsp + 0xad], 0xae
add byte [rsi + 0x48c63966], ch
mov dword [rsp + 0x90], ecx
and al, 0x90
add byte [rax], al
invalid
mov word [rsp + 0x8e], r8w
mov qword [rsp + 0x80], rdx
mov dword [rsp + 0x7c], r9d

Function at 0x1400035a4
Capabilities:
Send icmp echo request

Disassembly:
mov edi, ecx
add rdi, 0x3c
mov byte [rsp + 0xad], 1
xor ax, 0x6787
mov byte [rsp + 0xad], 0xae
add byte [rsi + 0x48c63966], ch
mov dword [rsp + 0x90], ecx
and al, 0x90
add byte [rax], al
invalid
mov word [rsp + 0x8e], r8w
mov qword [rsp + 0x80], rdx
mov dword [rsp + 0x7c], r9d
Function at 0x1400035a8
Capabilities:
Send icmp echo request

Disassembly:
mov edi, ecx
add rdi, 0x3c
mov byte [rsp + 0xad], 1
xor ax, 0x6787
mov byte [rsp + 0xad], 0xae
add byte [rsi + 0x48c63966], ch
mov dword [rsp + 0x90], ecx
and al, 0x90
add byte [rax], al
invalid
mov word [rsp + 0x8e], r8w
mov qword [rsp + 0x80], rdx
mov dword [rsp + 0x7c], r9d

Function at 0x1400035b8
Capabilities:
Send icmp echo request

Disassembly:
xchg esp, eax
and al, 0x80
add byte [rax], al
add byte [rax], al
mov dword [rsp + 0x7c], r9d
mov qword [rsp + 0x70], rdi
mov byte [rsp + 0x6f], r11b
jae 0x1400036b9
xor eax, eax
mov ecx, eax
invalid

Function at 0x1400035bc
Capabilities:
Send icmp echo request

Disassembly:
xchg esp, eax
and al, 0x80
add byte [rax], al
add byte [rax], al
mov dword [rsp + 0x7c], r9d
mov qword [rsp + 0x70], rdi
mov byte [rsp + 0x6f], r11b
jae 0x1400036b9
xor eax, eax
mov ecx, eax
invalid

Function at 0x1400035c0
Capabilities:
Send icmp echo request

Disassembly:
xchg esp, eax
and al, 0x80
add byte [rax], al
add byte [rax], al
mov dword [rsp + 0x7c], r9d
mov qword [rsp + 0x70], rdi
mov byte [rsp + 0x6f], r11b
jae 0x1400036b9
xor eax, eax
mov ecx, eax
invalid

Function at 0x1400035d8
Capabilities:
Send icmp echo request

Disassembly:
mov edx, 0x2b667824
xchg esp, eax
and al, 0xae
add byte [rax], al
invalid
invalid

Function at 0x1400035ec
Capabilities:
Send icmp echo request

Disassembly:
add r8w, 0xdd5c
mov word [rsp + 0xa6], r8w

Function at 0x1400035f0
Capabilities:
Send icmp echo request

Disassembly:
pop rsp
frstor dword [rsi + 0x44]
mov dword [rsp + 0xa6], eax
mov eax, dword [rsp + 0xa0]
mov dword [rsp + 0xa8], 0x6ef8dfca
add eax, 0xc79c7c9a
mov r9, qword [rsp + 0x80]
invalid
invalid
mov word [rax + rsi*4], fs
invalid

Function at 0x140003648
Capabilities:
Send icmp echo request

Disassembly:
add byte [rcx - 0x7f], al
ret

Function at 0x14000366c
Capabilities:
Send icmp echo request

Disassembly:
mov qword [rsp + 0x28], 0
mov di, word [rsp + 0x5e]
movzx eax, di
mov dword [rsp + 0x30], eax
invalid
invalid
invalid

Function at 0x14000408c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov al, 0x20
mov dx, word [rsp + 0xf6]
add byte [rax], al

Function at 0x1400040b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [rax], al
add dh, al
test byte [rsi + rdx*8], ah
add byte [rax], al
add bh, ch
mov dword [rsp + 0xd0], 0xecd86bf
int 0xe

Function at 0x140004110
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ch, 0x30
test eax, 0x41d18944
mov edx, 0x7eb7eb7
mov bh, 0x7e
jmp 0x140004123
mov r11d, 0x4d79df24
mov esi, r11d

Function at 0x1400065a4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x60], 0xd24614a
mov eax, dword [rsp + 0x1c]
Function at 0x100003134
Capabilities:
Delete service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x30
mov rbp, rcx
xor edx, edx
mov r8d, 0xf003f
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
xor ebx, ebx
mov rdi, rax
cmp rax, rbx
jne 0x10000316e
xor eax, eax
jmp 0x1000031de
lea rdx, [rbp + 8]
mov r8d, 0x10000
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rsi, rax
cmp rax, rbx
je 0x1000031d3
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov qword [rsp + 0x28], rbx
lea r9, [rbp + 8]
mov rcx, rbp
mov qword [rsp + 0x20], rbx
cmp eax, ebx
je 0x1000031bc
mov edx, 4
lea r8d, [rdx + 0x61]
call fcn.100003200
mov ebx, 1
jmp 0x1000031ca
mov edx, 1
lea r8d, [rdx + 0x65]
call fcn.100003200
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r12
ret

Function at 0x100003200
Capabilities:
Access the windows event log

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x70
and qword [rax - 0x20], 0
and qword [rax - 0x18], 0
mov qword [rax - 0x28], r9
xor edi, edi
mov esi, r8d
movzx ebp, dx
xor eax, eax
mov rbx, rcx
cmp qword [rsp + rax*8 + 0x50], 0
je 0x100003239
inc edi
inc rax
cmp rax, 3
jl 0x10000322f
cmp qword [rcx + 0x2c0], 0
jne 0x10000325f
lea rdx, [rcx + 8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov qword [rbx + 0x2c0], rax
mov rcx, qword [rbx + 0x2c0]
test rcx, rcx
je 0x100003298
xor r8d, r8d
lea rax, [rsp + 0x50]
mov r9d, esi
and qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rax
and dword [rsp + 0x30], r8d
movzx edx, bp
mov word [rsp + 0x28], di
and qword [rsp + 0x20], r8
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x100003878
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x848
mov rax, qword [0x100006110]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ebx, 0x400
lea r9, [rdi + 8]
lea r8, [0x100001e88]
lea rcx, [rsp + 0x30]
mov rdx, rbx
mov dword [rsp + 0x20], eax
call sub.msvcrt.dll_swprintf_s
mov r8, qword [rsp + 0x868]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
mov rdx, rbx
repne scasw ax, word [rdi]
lea r9, [rsp + 0x870]
not rcx
dec rcx
sub rdx, rcx
lea rcx, [rsp + rcx*2 + 0x30]
call sub.msvcrt.dll_vswprintf_s
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
lea r8, [0x100001ea4]
repne scasw ax, word [rdi]
not rcx
dec rcx
sub rbx, rcx
lea rcx, [rsp + 0x30]
mov rdx, rbx
call sub.msvcrt.dll_wcscat_s
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.100004440
add rsp, 0x848
pop rdi
pop rbx
ret

Function at 0x100003958
Capabilities:
Accept command line arguments

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x350
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x100006110]
xor rax, rsp
mov qword [rsp + 0x340], rax
mov rsi, rdx
mov edi, ecx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rbx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
xor r9d, r9d
mov r8, rbx
xor edx, edx
call sub.MFC42u.dll_COleSafeArray::AllocData
test eax, eax
jne 0x1000039c7
lea rcx, [0x100001f30]
call qword [sym.imp.msvcrt.dll_wprintf]
mov ebx, 1
jmp 0x100003a81
lea rcx, [rsp + 0x50]
call fcn.100003ab0
nop
mov ebx, 1
cmp edi, ebx
jle 0x100003a02
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.100002bd0
test eax, eax
je 0x100003a02
cmp dword [rsp + 0x308], 0
je 0x100003a51
lea rcx, [rsp + 0x50]
call fcn.1000032f8
jmp 0x100003a51
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea rax, [fcn.100003398]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x30], 0
and qword [rsp + 0x38], 0
lea rdx, [0x100001710]
lea rcx, [rsp + 0x50]
call fcn.100003878
lea rcx, [rsp + 0x20]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
lea rdx, [0x100001760]
lea rcx, [rsp + 0x50]
call fcn.100003878
mov ebx, dword [rsp + 0x2f4]
lea rax, [0x100002968]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x330]
test rcx, rcx
je 0x100003a77
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x50]
call fcn.100002b90
mov eax, ebx
mov rcx, qword [rsp + 0x340]
xor rcx, rsp
call fcn.100004440
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x100004190
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor r12d, r12d
xor eax, eax
lock cmpxchg qword [0x1000068d0], rdi
je 0x1000041de
cmp rax, rdi
jne 0x1000041d1
mov edi, 1
mov r12d, edi
jmp 0x1000041e3
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000041b5
mov edi, 1
mov eax, dword [0x1000068c8]
cmp eax, edi
jne 0x1000041f9
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x100004256
mov eax, dword [0x1000068c8]
test eax, eax
jne 0x100004250
mov dword [0x1000068c8], edi
lea r13, [0x100001300]
lea rsi, [0x1000012e8]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
cmp rsi, r13
jae 0x100004242
test eax, eax
jne 0x100004242
mov rcx, qword [rsi]
test rcx, rcx
je 0x100004237
call rcx
mov dword [rsp + 0x20], eax
add rsi, 8
mov qword [rsp + 0x28], rsi
jmp 0x100004220
test eax, eax
je 0x100004256
mov eax, 0xff
jmp 0x100004328
mov dword [0x1000061bc], edi
mov eax, dword [0x1000068c8]
cmp eax, edi
jne 0x10000427d
lea rdx, [0x1000012e0]
lea rcx, [0x1000012c8]
call sub.msvcrt.dll__initterm
mov dword [0x1000068c8], 2
test r12d, r12d
jne 0x10000428b
xor eax, eax
xchg qword [0x1000068d0], rax
cmp qword [0x1000068e8], 0
je 0x1000042b4
lea rcx, [0x1000068e8]
call fcn.10000469c
test eax, eax
je 0x1000042b4
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x1000068e8]
mov r8, qword [0x1000061a0]
mov rdx, qword [0x1000061a8]
mov ecx, dword [0x100006198]
call fcn.100003958
mov dword [0x1000061b8], eax
cmp dword [0x10000619c], 0
jne 0x1000042e4
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1000061bc], 0
jne 0x1000042f9
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1000061b8]
jmp 0x100004328
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret
sub rsp, 0x28
call fcn.100096000
add rsp, 0x28
jmp 0x100004190
Function at 0x100004440
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100006110]
jne 0x10000445b
rol rcx, 0x10
test cx, 0xffff
jne 0x100004457
ret 0
ror rcx, 0x10
jmp 0x10000486c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x100006270]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x100006368]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1000048f1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x100006270]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x100004913
mov rax, qword [rsp + 0x88]
mov qword [0x100006368], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x100006308], rax
mov rax, qword [0x100006368]
mov qword [0x1000061e0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1000062f0], rax
mov dword [0x1000061d0], 0xc0000409
mov dword [0x1000061d4], 1
mov rax, qword [0x100006110]
mov qword [rsp + 0x68], rax
mov rax, qword [0x100006118]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100001338]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x100004708
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
cmp rcx, rdx
je 0x100004755
cmp rcx, 0xffffffffffffffff
je 0x100004755
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10000474d
cmp dword [rcx + 0x3c], edx
jl 0x10000474d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10000474d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x100004755
mov rax, rdx
add rsp, 0x18
ret
Function at 0x1400014b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x72]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x140010040]
mov r10, rax
sub rbx, rax
movabs rdi, 0x301c82ac40260391
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 2]
mov rax, rdi
mov rcx, r8
mul r8
mov rax, r8
add r11d, 2
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0x7a
jb 0x140001500
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001590
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x140010040]
mov r10, rax
sub rbx, rax
movabs rdi, 0x301c82ac40260391
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
mov rax, rcx
lea r9, [r9 + 0xb]
sub rax, rdx
add r11d, 0xb
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 - 6]
mov byte [r9 - 6], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xb
jb 0x1400015e0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400018c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 6]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x1400101f0]
mov r10, rax
sub rbx, rax
movabs rdi, 0x301c82ac40260391
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 2]
mov rax, rdi
mov rcx, r8
mul r8
mov rax, r8
add r11d, 2
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 2
jb 0x140001910
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140002000
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x140010550]
mov r10, rax
sub rbx, rax
movabs rdi, 0x301c82ac40260391
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [r9 + rbx - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [r9 + rbx + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [r9 + rbx + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [r9 + rbx + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [r9 + rbx + 8]
lea r9, [r9 + 0xe]
movsx eax, al
add r11d, 7
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [r9 + rbx - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 7
jb 0x140002050
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400021f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x140010550]
mov r10, rax
sub rbx, rax
movabs rdi, 0x301c82ac40260391
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rax, r8
mov rcx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 8]
lea r9, [r9 + 0x10]
movsx eax, al
add r11d, 8
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 8
imul rax, rax, 0x1af
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 8
jb 0x140002240
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret