joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140032b20
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x1400c1060]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor eax, eax
mov dword [rsp + 0x2c], edx
mov edx, 0x1000
mov dword [rsp + 0x28], ecx
xor ecx, ecx
mov dword [rsp + 0x20], eax
mov r8d, edx
mov dword [rsp + 0x30], eax
lea r9d, [rax + 0x40]
mov qword [rsp + 0x34], 1
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x140032b7f
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140092b30
add rsp, 0x50
pop rdi
ret
movups xmm0, xmmword [0x1401a7ed0]
mov r8d, Ordinal_45
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x20]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x1401a7ee0]
lea ecx, [r8 - 0x27]
movsd qword [rax + 0x10], xmm1
mov eax, dword [0x1401a7ee8]
mov dword [rdi + 0x18], eax
movzx eax, word [0x1401a7eec]
mov word [rdi + 0x1c], ax
call rdi
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test ebx, ebx
mov rbx, qword [rsp + 0x70]
setg al
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140092b30
add rsp, 0x50
pop rdi
ret

Function at 0x140032c00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13c0
call fcn.140093770
sub rsp, rax
mov rax, qword [0x1400c1060]
xor rax, rsp
mov qword [rsp + 0x13b0], rax
mov edi, edx
mov ebx, ecx
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rsp + 0x13a4], 0xffffffff
mov r8d, 1
mov dword [rsp + 0x24], eax
nop
mov r9d, eax
shr r9d, 0x1e
xor r9d, eax
imul eax, r9d, 0x6c078965
add eax, r8d
mov dword [rsp + r8*4 + 0x24], eax
inc r8
cmp r8, 0x270
jb 0x140032c50
lea eax, [rbx - 0x80000000]
mov dword [rsp + 0x20], 0x270
mov ebp, 0x80000000
cmp ebx, ebp
lea esi, [rbx + rbp]
cmovae esi, eax
lea ebx, [rdi + rbp]
cmp edi, ebp
lea eax, [rdi - 0x80000000]
cmovae ebx, eax
sub ebx, esi
cmp ebx, 0xffffffff
jne 0x140032cb3
lea rcx, [rsp + 0x20]
call fcn.140043bd0
mov edx, eax
jmp 0x140032cf1
lea edi, [rbx + 1]
xor r8d, r8d
xor eax, eax
test ebx, ebx
je 0x140032cd1
lea rcx, [rsp + 0x20]
call fcn.140043bd0
mov r8d, eax
mov eax, 0xffffffff
xor edx, edx
div edi
mov ecx, eax
mov r9d, edx
xor edx, edx
mov eax, r8d
div edi
cmp eax, ecx
jb 0x140032cea
cmp r9d, ebx
jne 0x140032cb6
xor edx, edx
mov eax, r8d
div edi
add edx, esi
cmp edx, ebp
lea ecx, [rdx - 0x80000000]
lea eax, [rdx + rbp]
cmovae eax, ecx
mov rcx, qword [rsp + 0x13b0]
xor rcx, rsp
call fcn.140092b30
lea r11, [rsp + 0x13c0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140032d30
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1340]
mov eax, 0x1440
call fcn.140093770
sub rsp, rax
mov rax, qword [0x1400c1060]
xor rax, rsp
mov qword [rbp + 0x1330], rax
mov r15d, edx
mov rbx, rcx
mov qword [rsp + 0x70], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
movdqa xmm0, xmmword [str.6::__::66]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm1, xmmword [0x1400b2fa0]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm0, xmmword [0x1400b2ef0]
movdqa xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0xd0d0d0d0
mov dword [rsp + 0x64], 0x9d9f9d9b
mov dword [rsp + 0x68], 0x8587859b
mov dword [rsp + 0x6c], 0x1008d8b
mov eax, edi
nop word [rax + rax]
lea ecx, [rax + 0x77]
xor byte [rsp + rax + 0x30], cl
inc rax
cmp rax, 0x3e
jb 0x140032dd0
mov byte [rsp + 0x6f], dil
mov qword [rsp + 0x78], rdi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x78], dil
lea rax, [rsp + 0x30]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], dil
jne 0x140032e07
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x78]
call fcn.14003fdd0
nop
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov edi, 1
mov dword [rsp + 0x20], edi
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov ecx, eax
mov dword [rbp + 0x1324], 0xffffffff
mov dword [rbp - 0x5c], eax
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edi
mov dword [rbp + rdi*4 - 0x5c], ecx
inc rdi
cmp rdi, 0x270
jb 0x140032e50
mov dword [rbp - 0x60], 0x270
mov r14, qword [rbp - 0x70]
mov rsi, qword [rsp + 0x78]
test r15d, r15d
jle 0x140032f24
mov rdi, r15
nop dword [rax + rax]
lea rcx, [rbp - 0x60]
call fcn.140043bd0
mov r8d, eax
mov eax, 0x8421085
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
cmp eax, 0x8421084
jae 0x140032e90
mov eax, 0x8421085
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
imul eax, eax, 0x1f
sub r8d, eax
lea rcx, [rsp + 0x78]
cmp r14, 0x10
cmovae rcx, rsi
movsxd rax, r8d
movzx r9d, byte [rax + rcx]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x140032f12
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x140032f07
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140032f1a
mov rcx, rbx
call fcn.140042ea0
sub rdi, 1
jne 0x140032e90
cmp r14, 0x10
jb 0x140032f5e
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140032f56
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140032f56
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400930d8
mov rax, rbx
mov rcx, qword [rbp + 0x1330]
xor rcx, rsp
call fcn.140092b30
lea r11, [rsp + 0x1440]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140037130
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x140037153
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x140037140
mov byte [rcx + 0xc], 0
mov rax, rcx
ret
Function at 0x140038680
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4a], 0
je 0x1400386a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x49
jb 0x140038690
mov byte [rcx + 0x4a], 0
mov rax, rcx
ret

Function at 0x1400386b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6f], 0
je 0x1400386d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x6e
jb 0x1400386c0
mov byte [rcx + 0x6f], 0
mov rax, rcx
ret
Function at 0x140038cb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3b], 0
je 0x140038cd3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3a
jb 0x140038cc0
mov byte [rcx + 0x3b], 0
mov rax, rcx
ret
Function at 0x140039bf0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x40], 0
je 0x140039c13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3f
jb 0x140039c00
mov byte [rcx + 0x40], 0
mov rax, rcx
ret

Function at 0x140039c20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5d], 0
je 0x140039c43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5c
jb 0x140039c30
mov byte [rcx + 0x5d], 0
mov rax, rcx
ret

Function at 0x140039c50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x58], 0
je 0x140039c73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x57
jb 0x140039c60
mov byte [rcx + 0x58], 0
mov rax, rcx
ret

Function at 0x140039c80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xaf], 0
je 0x140039ca8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xae
jb 0x140039c90
mov byte [rcx + 0xaf], 0
mov rax, rcx
ret

Function at 0x140039cb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x76], 0
je 0x140039cd3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x75
jb 0x140039cc0
mov byte [rcx + 0x76], 0
mov rax, rcx
ret

Function at 0x140039ce0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x60], 0
je 0x140039d03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5f
jb 0x140039cf0
mov byte [rcx + 0x60], 0
mov rax, rcx
ret
Function at 0x14003d720
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3d], 0
je 0x14003d743
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3c
jb 0x14003d730
mov byte [rcx + 0x3d], 0
ret

Function at 0x14003d750
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x28], 0
je 0x14003d773
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x27
jb 0x14003d760
mov byte [rcx + 0x28], 0
ret

Function at 0x14003d780
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x14003d7a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x14003d790
mov byte [rcx + 0x12], 0
ret

Function at 0x14003d7b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x22], 0
je 0x14003d7d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x21
jb 0x14003d7c0
mov byte [rcx + 0x22], 0
ret

Function at 0x14003d7e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x8f], 0
je 0x14003d808
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x8e
jb 0x14003d7f0
mov byte [rcx + 0x8f], 0
ret

Function at 0x14003d810
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2c], 0
je 0x14003d833
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2b
jb 0x14003d820
mov byte [rcx + 0x2c], 0
ret

Function at 0x14003d840
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2e], 0
je 0x14003d863
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2d
jb 0x14003d850
mov byte [rcx + 0x2e], 0
ret

Function at 0x14003d870
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x46], 0
je 0x14003d893
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x45
jb 0x14003d880
mov byte [rcx + 0x46], 0
ret

Function at 0x14003d8a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x34], 0
je 0x14003d8c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x33
jb 0x14003d8b0
mov byte [rcx + 0x34], 0
ret

Function at 0x14003d8d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2b], 0
je 0x14003d8f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2a
jb 0x14003d8e0
mov byte [rcx + 0x2b], 0
ret

Function at 0x14003d900
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1f], 0
je 0x14003d923
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1e
jb 0x14003d910
mov byte [rcx + 0x1f], 0
ret

Function at 0x14003d930
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x5f], 0
je 0x14003d953
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x5e
jb 0x14003d940
mov byte [rcx + 0x5f], 0
ret
Function at 0x14003d960
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x14003d983
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x14003d970
mov byte [rcx + 9], 0
ret

Function at 0x14003d990
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x14003d9b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x14003d9a0
mov byte [rcx + 0xd], 0
ret

Function at 0x14003d9c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x40], 0
je 0x14003d9e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x3f
jb 0x14003d9d0
mov byte [rcx + 0x40], 0
ret

Function at 0x14003d9f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x14003da13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x14003da00
mov byte [rcx + 5], 0
ret

Function at 0x14003da20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x14003da43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xe
jb 0x14003da30
mov byte [rcx + 0xf], 0
ret

Function at 0x14003da50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x68], 0
je 0x14003da75
xor eax, eax
mov r8d, 0x5077
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x33
jb 0x14003da60
mov byte [rcx + 0x68], 0
ret

Function at 0x14003da80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x22], 0
je 0x14003daa5
xor eax, eax
mov r8d, 0x5077
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x10
jb 0x14003da90
mov byte [rcx + 0x22], 0
ret

Function at 0x14003dab0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x14003dad3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x14003dac0
mov byte [rcx + 4], 0
ret

Function at 0x14003dae0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x16], 0
je 0x14003db05
xor eax, eax
mov r8d, 0x5077
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0xa
jb 0x14003daf0
mov byte [rcx + 0x16], 0
ret

Function at 0x14003db10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x25], 0
je 0x14003db33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x24
jb 0x14003db20
mov byte [rcx + 0x25], 0
ret

Function at 0x14003db40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x14003db63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x14003db50
mov byte [rcx + 3], 0
ret

Function at 0x14003dbd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
je 0x14003dbf3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x18
jb 0x14003dbe0
mov byte [rcx + 0x19], 0
ret
Function at 0x14003dc00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x37], 0
je 0x14003dc23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x36
jb 0x14003dc10
mov byte [rcx + 0x37], 0
ret

Function at 0x14003dc30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2a], 0
je 0x14003dc53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x29
jb 0x14003dc40
mov byte [rcx + 0x2a], 0
ret

Function at 0x14003dc60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
je 0x14003dc83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1b
jb 0x14003dc70
mov byte [rcx + 0x1c], 0
ret

Function at 0x14003dc90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x14003dcb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x14003dca0
mov byte [rcx + 0xc], 0
ret

Function at 0x14003dcc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1b], 0
je 0x14003dce3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1a
jb 0x14003dcd0
mov byte [rcx + 0x1b], 0
ret

Function at 0x14003dcf0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x14003dd13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x14
jb 0x14003dd00
mov byte [rcx + 0x15], 0
ret

Function at 0x14003dd20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x14003dd43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x14003dd30
mov byte [rcx + 0xa], 0
ret

Function at 0x14003e320
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x14003e343
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x77]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x17
jb 0x14003e330
mov byte [rcx + 0x18], 0
ret

Function at 0x14003e350
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x14003e375
xor eax, eax
mov r8d, 0x5077
nop
lea edx, [r8 + rax]
xor word [rcx + rax*2], dx
inc rax
cmp rax, 4
jb 0x14003e360
mov byte [rcx + 0xa], 0
ret
Function at 0x140043bd0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140043c31
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140043bf0
mov ecx, dword [r10]
jmp 0x140043d1a
cmp ecx, 0x4e0
jb 0x140043d1a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140043c50
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140043ca0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x140044ea0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call fcn.140044f30
mov r11, rax
cmp byte [rax + 0xc], 0
jne 0x140044f12
lea rcx, [rax + 0x10]
xor r8d, r8d
nop dword [rax]
mov eax, dword [r11 + 4]
mov edx, dword [r11]
lea r9d, [rax + 1]
cmp edx, r9d
je 0x140044ef7
lea r9d, [rax + 2]
cmp edx, r9d
je 0x140044ef7
cmp edx, eax
je 0x140044eff
lea r9d, [rax + 4]
cmp edx, r9d
jne 0x140044ef0
add eax, 3
xor dword [rcx], eax
inc dword [r11]
jmp 0x140044ec0
add eax, 5
cmp edx, eax
jne 0x140044f05
xor dword [rcx], r9d
inc dword [r11]
jmp 0x140044ec0
lea eax, [r8 + 0x79]
xor dword [rcx], eax
inc r8d
add rcx, 4
cmp r8d, 1
jb 0x140044ec0
mov ecx, dword [r11 + 0x10]
mov byte [r11 + 0xc], 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x14004a060
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rax, qword [0x1400c1060]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov r14, rcx
mov byte [rsp + 0x20], 0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x14004a1f6
mov ebp, 0x5a4d
cmp word [rax], bp
jne 0x14004a1f6
movsxd rbx, dword [rax + 0x3c]
add rbx, rax
cmp dword [rbx], 0x4550
jne 0x14004a1f6
movzx eax, word [rbx + 0x14]
lea rdi, [rbx + 0x18]
mov r8, rsi
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x20]
add rdi, rax
call fcn.14004a220
mov r11, qword [rsp + 0x30]
test r11, r11
je 0x14004a1f6
mov rax, qword [rsp + 0x28]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14004a1f6
cmp word [r11], bp
jne 0x14004a1e2
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
cmp dword [rcx], 0x4550
jne 0x14004a1e2
mov eax, dword [rbx + 8]
cmp dword [rcx + 8], eax
jne 0x14004a1e2
movzx edx, word [rcx + 6]
cmp dx, word [rbx + 6]
jne 0x14004a1e2
movzx eax, word [rcx + 0x14]
lea r10, [rcx + 0x18]
add r10, rax
xor bl, bl
xor r9d, r9d
mov ebp, edx
test edx, edx
je 0x14004a1c9
mov r8, r14
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14004a173
inc rax
test ecx, ecx
jne 0x14004a160
test edx, edx
jne 0x14004a180
test dword [rdi + 0x24], 0x20000000
jne 0x14004a192
inc r9d
add rdi, 0x28
add r10, 0x28
cmp r9d, ebp
jl 0x14004a150
jmp 0x14004a1c9
mov eax, dword [rdi + 0x10]
test eax, eax
je 0x14004a1c9
mov edx, dword [rdi + 0xc]
mov r9d, eax
mov r8d, dword [r10 + 0x14]
add rdx, rsi
add r8, r11
mov eax, 1
nop
movzx ecx, byte [r8]
lea r8, [r8 + 1]
cmp byte [rdx], cl
lea rdx, [rdx + 1]
movzx ebx, bl
cmovne ebx, eax
sub r9, rax
jne 0x14004a1b0
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
jmp 0x14004a1f8
mov rcx, r11
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140092b30
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret