joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140026b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x140026bba
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x140026bb0
cmp r11, r10
ja 0x140026c53
cmp r10, rdx
ja 0x140026c67
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x140026bb2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x140026b90
jmp 0x140026c27
ja 0x140026bba
mov r11, r10
cmp rax, r8
jne 0x140026b62
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x140026c2b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140026c00
mov r8, r10
sub ecx, r9d
jns 0x140026c1e
jmp 0x140026c2d
cmp r10, rdx
je 0x140026c39
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x140026c2d
xor al, 1
cmp r8, rdx
jne 0x140026be0
jmp 0x140026c2d
xor eax, eax
jmp 0x140026c2d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuefrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140029180
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140029650
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400295d0
ud2

Function at 0x140028230
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002827a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002827a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002827a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002827a
cmp dword [rcx + 0x84], 0xe
jbe 0x14002827a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002827c
xor al, al
add rsp, 0x28
ret
Function at 0x140002800
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov r15d, r9d
mov r14d, r8d
mov r13, rdx
mov r12, rcx
mov dword [rbp - 8], r9d
sub rsp, 0x200
nop
mov ecx, 0x1000000
mov edx, 0xe6
call fcn.1400027f0
mov dword [rbp + 4], 3
cmp r15d, eax
jae 0x1400028ec
nop
nop
mov ecx, 0xff0000
mov edx, 0xdd
mov r8d, 0x84
call fcn.1400027f0
mov rbx, rax
and ebx, r15d
xor ecx, ecx
call fcn.1400027f0
mov dword [rbp + 4], 2
cmp ebx, eax
jne 0x1400028ec
nop
nop
mov ecx, 0xff00
mov edx, 0xa9
mov r8d, 0x2ad1f2
call fcn.1400027f0
mov rbx, rax
and ebx, r15d
mov edx, 0x46
xor ecx, ecx
mov r8d, ebx
mov r9d, ebx
call fcn.1400027f0
mov dword [rbp + 4], 1
cmp ebx, eax
jne 0x1400028ec
nop
nop
mov ecx, 0xff
mov edx, 0x6f
mov r8d, 0xb3
call fcn.1400027f0
and r15d, eax
xor ecx, ecx
call fcn.1400027f0
mov dword [rbp + 4], 0
cmp r15d, eax
jne 0x1400028ec
nop
mov dword [rbp - 4], 0xffffffff
jmp 0x1400028f3
mov eax, dword [rbp + 4]
nop
mov dword [rbp - 4], eax
mov ebx, dword [rbp - 4]
mov r8d, 0xf3ed33
xor ecx, ecx
mov edx, ebx
call fcn.1400027f0
mov r15, rax
mov edx, 0x6f
mov r8d, 0x15
xor ecx, ecx
mov r9d, ebx
call fcn.1400027f0
cmp ebx, r15d
je 0x14000299a
cmp r14d, eax
je 0x14000299a
mov eax, r14d
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], 0
mov dword [rbp], 0
xor edi, edi
nop
mov esi, dword [rbp]
mov rbx, qword [rbp - 0x10]
mov ecx, 3
mov rdx, rbx
mov r8, rbx
call fcn.1400027f0
cmp esi, eax
cmovg esi, edi
nop
movsxd rsi, esi
movzx eax, byte [rbp + rsi - 8]
xor al, byte [r12 + rbx]
mov byte [r13 + rbx], al
mov ecx, 1
mov rdx, rbx
mov r8, rbx
call fcn.1400027f0
add esi, eax
mov ecx, 1
call fcn.1400027f0
add rax, rbx
cmp rax, qword [rbp - 0x18]
mov qword [rbp - 0x10], rax
mov dword [rbp], esi
jb 0x140002940
add rsp, 0x200
mov rax, r13
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1400da240
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
je 0x1400da2f6
mov rbx, qword [rcx]
cmp qword [rdi], 0
je 0x1400da2c2
lea rcx, [0x14011eb90]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je case.default.0x1400da2da
lea rdx, str.RegDeleteKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je case.default.0x1400da2da
mov qword [rsp + 0x28], 0
mov rdx, qword [rdi]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call rax
nop
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rdi + 8], 0
je case.default.0x1400da2da
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp byte [0x1401a9560], 0
jne 0x1400da341
lea rcx, [0x14011eb90]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400da331
lea rdx, str.RegDeleteKeyExW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401a9558], rax
mov byte [0x1401a9560], 1
jmp 0x1400da348
mov rax, qword [0x1401a9558]
mov byte [0x1401a9560], 1
jmp 0x1400da348
mov rax, qword [0x1401a9558]
mov rdx, rsi
mov rcx, qword [rbx]
test rax, rax
je 0x1400da2cb
xor r9d, r9d
mov r8d, dword [rbx + 8]
call rax
nop
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
or byte [rdx + 0x1d], bl
int3
Function at 0x1400111ef
Capabilities:
Terminate process

Disassembly:
jmp 0x140012de0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011276
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014130
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014150
xor al, al
jmp 0x1400141d1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014163
xor al, al
jmp 0x1400141d1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001418d
xor al, al
jmp 0x1400141d1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400141a1
xor al, al
jmp 0x1400141d1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400141b3
xor al, al
jmp 0x1400141d1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400141cf
xor al, al
jmp 0x1400141d1
mov al, 1
add rsp, 0x38
ret
Function at 0x140095bf0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x10], xmm6
mov qword [rbp + 8], 0xfffffffffffffffe
mov rsi, rcx
lea rax, [0x1404cb9e8]
mov qword [rcx], rax
lea rax, [rcx + 8]
mov qword [rbp - 0x38], rax
mov dword [rcx + 8], 0
mov word [rcx + 0xc], 0
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x30], 0
mov qword [rcx + 0x38], 0xf
mov byte [rcx + 0x20], 0
lea rax, [0x1404ca498]
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x58], 0
mov qword [rcx + 0x60], 0xf
mov byte [rcx + 0x48], 0
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x80], 0
mov qword [rcx + 0x88], 0xf
mov byte [rcx + 0x70], 0
mov qword [rcx + 0x68], rax
mov byte [rcx + 0x90], 0
mov dword [rcx + 0x94], 0
lea rax, [rcx + 0xa8]
mov qword [rbp - 0x30], rax
xorps xmm6, xmm6
movups xmmword [rcx + 0xb0], xmm6
mov qword [rcx + 0xc0], 0
mov byte [rcx + 0xc8], 1
mov dword [rcx + 0xcc], 1
movups xmmword [rcx + 0xd0], xmm6
mov qword [rcx + 0xe0], 0
lea rdi, [0x1404cc348]
mov qword [rcx + 0xa8], rdi
mov qword [rcx + 0xa0], 0
mov byte [rcx + 0x1e0], 0
lea rbx, [rcx + 0x1e4]
mov r8d, 0x150
mov rcx, rbx
xor edx, edx
call fcn.1404ad740
mov qword [rbp - 0x28], rbx
mov rcx, rbx
xor edx, edx
call fcn.140310f00
mov dword [rsi + 0x334], 0
lea rax, [rsi + 0x348]
mov qword [rbp - 0x20], rax
movups xmmword [rsi + 0x348], xmm6
movups xmmword [rsi + 0x358], xmm6
mov qword [rsi + 0x368], 0
mov ecx, 0x70
call fcn.14048512c
lea rcx, [rsi + 0x360]
mov qword [rbp - 0x18], rcx
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsi + 0x360], rax
lea rax, [rsi + 0x370]
mov qword [rbp - 0x10], rax
movups xmmword [rsi + 0x370], xmm6
mov qword [rsi + 0x380], 0
lea rax, [rsi + 0x390]
mov qword [rbp - 8], rax
movups xmmword [rsi + 0x390], xmm6
mov qword [rsi + 0x3a0], 0
mov eax, dword [0x140612560]
mov ecx, dword [0x1406161d0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x26838]
jg 0x140095e4d
lea rax, [0x140612398]
mov qword [rsi + 0x3a8], rax
lea rax, [rsi + 0x3c8]
mov qword [rbp], rax
movups xmmword [rsi + 0x3d0], xmm6
mov qword [rsi + 0x3e0], 0
mov byte [rsi + 0x3e8], 1
mov dword [rsi + 0x3ec], 1
movups xmmword [rsi + 0x3f0], xmm6
mov qword [rsi + 0x400], 0
mov qword [rsi + 0x3c8], rdi
mov rcx, rsi
call fcn.1400962c0
mov rax, rsi
movaps xmm6, xmmword [rbp + 0x10]
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x20], 0x3ded26a2
lea r8, [0x140612560]
mov ecx, 1
xor edx, edx
mov r9d, 0xcc4e2559
call fcn.1400a9430
cmp dword [0x140612560], 0xffffffff
jne 0x140095ddd
lea rcx, [0x140612398]
call fcn.1400969e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x38], 0x37bf6bc9
mov dword [rsp + 0x30], 0xf621b5c3
lea r8, [0x140096da0]
mov ecx, 1
xor edx, edx
xor r9d, r9d
call fcn.1400aa1a0
mov dword [rsp + 0x20], 0x3ded26a2
lea r8, [0x140612560]
xor ecx, ecx
xor edx, edx
mov r9d, 0xcc4e2559
call fcn.1400a9430
jmp 0x140095ddd
Function at 0x1400a9d30
Capabilities:
Encode data using xor

Disassembly:
push rbx
test ecx, ecx
je 0x1400a9d79
test edx, edx
je 0x1400a9dc3
movzx eax, byte [0x140591156]
movzx ecx, byte [0x140591cd0]
add cl, 0x94
cmp al, cl
je 0x1400a9ea4
mov cl, 0xce
nop dword [rax + rax]
mov al, 0x77
lock cmpxchg byte [0x140591156], cl
je 0x1400a9e69
cmp al, 0xa2
jne 0x1400a9d60
jmp 0x1400a9ea4
test edx, edx
je 0x1400a9e3c
movzx eax, byte [0x140591110]
cmp al, 0x33
je 0x1400a9ee0
mov cl, 0x6c
nop word cs:[rax + rax]
mov al, 0xe5
lock cmpxchg byte [0x140591110], cl
je 0x1400a9ead
movzx edx, byte [0x140591cd0]
add dl, 0x25
cmp al, dl
jne 0x1400a9da0
jmp 0x1400a9ee0
movzx eax, byte [0x140591263]
nop word [rax + rax]
cmp al, 0xe3
je 0x1400a9e33
movzx ecx, byte [0x140591cd0]
lea eax, [rcx + 0x1e]
add cl, 3
lock cmpxchg byte [0x140591263], cl
jne 0x1400a9dd0
xor edx, edx
lea rax, [0x140591240]
lea rcx, [0x1404ca300]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 0xdc6dab47
and edx, 0x5c6dab47
lea edx, [r8 + rdx*2]
add edx, 0x239254ba
cmp edx, 0x23
jl 0x1400a9e00
mov al, 0xe3
xchg byte [0x140591263], al
lea rax, [0x140591240]
pop rbx
ret
movzx eax, byte [0x140591175]
cmp al, 0x98
je 0x1400a9f58
mov cl, 0xba
nop dword [rax]
mov al, 0x43
lock cmpxchg byte [0x140591175], cl
je 0x1400a9ee9
cmp al, 0x98
jne 0x1400a9e50
jmp 0x1400a9f58
xor eax, eax
lea rcx, [0x140591140]
lea rdx, [0x1404ca210]
mov r8d, 0x2d49cace
nop
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
inc eax
mov r9d, dword [0x140591cc0]
add r9d, r8d
cmp eax, r9d
jl 0x1400a9e80
mov al, 0xa2
xchg byte [0x140591156], al
lea rax, [0x140591140]
pop rbx
ret
xor eax, eax
lea rcx, [0x140591100]
lea rdx, [0x1404ca1e0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1400a9ed8
inc rax
jmp 0x1400a9ec0
mov al, 0x33
xchg byte [0x140591110], al
lea rax, [0x140591100]
pop rbx
ret
xor eax, eax
lea rcx, [0x140591160]
lea rdx, [0x1404ca230]
nop dword [rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
mov r10d, r8d
not r10b
mov r11d, r9d
not r11b
mov ebx, r10d
xor bl, r9b
xor r8b, r11b
and r9b, r10b
or r9b, r8b
not r9b
or r9b, bl
not r9b
xor r11b, r10b
and r11b, r10b
or r11b, r8b
not r11b
or r11b, r9b
mov byte [rax + rcx], r11b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1400a9f50
inc rax
jmp 0x1400a9f00
mov al, 0x98
xchg byte [0x140591175], al
lea rax, [0x140591160]
pop rbx
ret
Function at 0x1400a9f70
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400a9fac
test edx, edx
je 0x1400a9fdc
movzx eax, byte [0x1405910d2]
movzx ecx, byte [0x140591cd0]
add cl, 0x16
cmp al, cl
je 0x1400a9fa4
mov cl, 0x6c
nop
mov al, 0xe9
lock cmpxchg byte [0x1405910d2], cl
je 0x1400aa06c
cmp al, 0x24
jne 0x1400a9f90
lea rax, [0x1405910c0]
ret
test edx, edx
je 0x1400aa00c
movzx eax, byte [0x1405912cf]
cmp al, 0xc
je 0x1400a9fd4
mov cl, 0xc8
nop dword [rax]
mov al, 0x92
lock cmpxchg byte [0x1405912cf], cl
je 0x1400aa0a8
cmp al, 0xc
jne 0x1400a9fc0
lea rax, [0x1405912c0]
ret
movzx eax, byte [0x1405911f3]
cmp al, 5
je 0x1400aa004
mov cl, 0xbb
nop dword [rax]
mov al, 0x79
lock cmpxchg byte [0x1405911f3], cl
je 0x1400aa0d8
cmp al, 5
jne 0x1400a9ff0
lea rax, [0x1405911f0]
ret
movzx eax, byte [0x140591233]
nop word cs:[rax + rax]
cmp al, 0xeb
je 0x1400aa13e
movzx ecx, byte [0x140591cd0]
lea eax, [rcx + 0x63]
add cl, 0x1c
lock cmpxchg byte [0x140591233], cl
jne 0x1400aa020
xor eax, eax
lea rcx, [0x140591230]
lea rdx, [0x1404ca2f0]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1400aa12f
inc rax
jmp 0x1400aa050
xor eax, eax
lea rcx, [0x1405910c0]
lea rdx, [0x1404ca1a0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x11
jg 0x1400aa098
inc rax
jmp 0x1400aa080
mov al, 0x24
xchg byte [0x1405910d2], al
lea rax, [0x1405910c0]
ret
xor eax, eax
lea rcx, [0x1405912c0]
lea rdx, [0x1404ca380]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1400aa11f
inc rax
jmp 0x1400aa0c0
xor edx, edx
lea rax, [0x1405911f0]
lea rcx, [0x1404ca2b0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 3
jl 0x1400aa0f0
mov al, 5
xchg byte [0x1405911f3], al
lea rax, [0x1405911f0]
ret
mov al, 0xc
xchg byte [0x1405912cf], al
lea rax, [0x1405912c0]
ret
movzx eax, byte [0x140591cd0]
add al, 0xdd
xchg byte [0x140591233], al
lea rax, [0x140591230]
ret
Function at 0x1400aa240
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1400aa27c
test edx, edx
je 0x1400aa2ac
movzx eax, byte [0x140591096]
cmp al, 0x1a
je 0x1400aa274
mov cl, 2
nop word cs:[rax + rax]
mov al, 0x54
lock cmpxchg byte [0x140591096], cl
je 0x1400aa31c
cmp al, 0x1a
jne 0x1400aa260
lea rax, [0x140591090]
ret
test edx, edx
je 0x1400aa2dc
movzx eax, byte [0x140591189]
cmp al, 0x3d
je 0x1400aa2a4
mov cl, 0x48
nop dword [rax]
mov al, 0xdc
lock cmpxchg byte [0x140591189], cl
je 0x1400aa36f
cmp al, 0x3d
jne 0x1400aa290
lea rax, [0x140591180]
ret
movzx eax, byte [0x1405910b5]
cmp al, 0x9d
je 0x1400aa2d4
mov cl, 0x13
nop dword [rax]
mov al, 0x41
lock cmpxchg byte [0x1405910b5], cl
je 0x1400aa398
cmp al, 0x9d
jne 0x1400aa2c0
lea rax, [0x1405910a0]
ret
movzx eax, byte [0x1405911a6]
movzx ecx, byte [0x140591cd0]
add cl, 0x26
cmp al, cl
je 0x1400aa314
mov cl, 0xa5
nop word cs:[rax + rax]
mov al, 0xbd
lock cmpxchg byte [0x1405911a6], cl
je 0x1400aa3f8
cmp al, 0x34
jne 0x1400aa300
lea rax, [0x140591190]
ret
xor eax, eax
lea rcx, [0x140591090]
lea rdx, [0x1404ca170]
nop dword [rax]
cdqe
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
mov r8d, dword [0x140591cc0]
mov r9d, r8d
xor r9d, 0x2d49cab9
and r8d, 0x2d49cab9
lea r8d, [r9 + r8*2]
add eax, r8d
cmp eax, 6
jl 0x1400aa330
mov al, 0x1a
xchg byte [0x140591096], al
lea rax, [0x140591090]
ret
xor eax, eax
lea rcx, [0x140591180]
lea rdx, [0x1404ca250]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x1400aa3d8
inc rax
jmp 0x1400aa380
xor eax, eax
lea rcx, [0x1405910a0]
lea rdx, [0x1404ca180]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x1400aa3e8
inc rax
jmp 0x1400aa3b0
mov al, 0x3d
xchg byte [0x140591189], al
lea rax, [0x140591180]
ret
mov al, 0x9d
xchg byte [0x1405910b5], al
lea rax, [0x1405910a0]
ret
xor eax, eax
lea rcx, [0x140591190]
lea rdx, [0x1404ca260]
mov r8d, 0x2d49cace
nop
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
lea r9d, [rax + 1]
mov r10d, dword [0x140591cc0]
add r10d, r8d
cmp r9d, r10d
jge 0x1400aa441
inc rax
jmp 0x1400aa410
mov al, 0x34
xchg byte [0x1405911a6], al
lea rax, [0x140591190]
ret
Function at 0x1400aa5f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov r8d, dword [rsp + 0x30]
test ecx, ecx
je 0x1400aa635
movzx eax, byte [0x1405911b3]
xor r8b, 0x52
add r8b, byte [0x140591cd0]
cmp al, r8b
je 0x1400aa6c0
mov cl, 0x87
nop word [rax + rax]
mov al, 0xbb
lock cmpxchg byte [0x1405911b3], cl
je 0x1400aa675
cmp al, 0x67
jne 0x1400aa620
jmp 0x1400aa6c0
test edx, edx
je 0x1400aa6c9
movzx eax, byte [0x1405911d0]
cmp al, 0xe0
je 0x1400aa7b0
mov cl, 0xbc
nop
mov al, 0x20
lock cmpxchg byte [0x1405911d0], cl
je 0x1400aa761
mov edx, r8d
xor dl, 0xd9
add dl, byte [0x140591cd0]
cmp al, dl
jne 0x1400aa650
jmp 0x1400aa7b0
xor eax, eax
lea rcx, [0x1405911b0]
lea rdx, [0x1404ca280]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x1400aa6b8
inc rax
jmp 0x1400aa690
mov al, 0x67
xchg byte [0x1405911b3], al
lea rax, [0x1405911b0]
pop rsi
ret
movzx eax, byte [0x14059134f]
cmp al, 0x7b
je 0x1400aa758
movzx ecx, byte [0x140591cd0]
mov eax, r8d
xor al, 0x20
add al, cl
mov edx, r8d
xor dl, 0x4e
add dl, cl
lock cmpxchg byte [0x14059134f], dl
jne 0x1400aa6d0
xor eax, eax
lea rcx, [0x140591340]
lea rdx, [0x1404ca400]
mov r9d, r8d
xor r9d, 0x33e223b2
neg r9d
xor r8d, 0x33e223cc
nop dword [rax]
cdqe
movzx r10d, byte [rax + rdx]
xor byte [rax + rcx], r10b
mov r10d, dword [0x140591cc0]
mov r11d, r10d
neg r11d
mov esi, r9d
xor esi, r11d
and r11d, r9d
lea r11d, [rsi + r11*2]
sub eax, r11d
add r10d, r8d
cmp eax, r10d
jl 0x1400aa720
mov al, 0x7b
xchg byte [0x14059134f], al
lea rax, [0x140591340]
pop rsi
ret
xor eax, eax
lea rcx, [0x1405911c0]
lea rdx, [0x1404ca290]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x1400aa7a8
inc rax
jmp 0x1400aa780
mov al, pe_nt_image_headers64
xchg byte [0x1405911d0], al
lea rax, [0x1405911c0]
pop rsi
ret
Function at 0x1400abd50
Capabilities:
Check for software breakpoints

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1400abdac
test edx, edx
je 0x1400abdec
movzx eax, byte [0x1405910f8]
movzx ecx, byte [0x140591cd0]
xor r8b, 0x8c
mov edx, r8d
xor dl, cl
and r8b, cl
add r8b, r8b
add r8b, dl
cmp al, r8b
je 0x1400abda4
mov cl, 0xa4
nop dword [rax + rax]
mov al, 0x6a
lock cmpxchg byte [0x1405910f8], cl
je 0x1400abedc
cmp al, 0xfa
jne 0x1400abd90
lea rax, [0x1405910e0]
ret
test edx, edx
je 0x1400abe6c
movzx eax, byte [0x1405911e9]
cmp al, 0x2b
je 0x1400abde4
mov cl, 0xf7
nop word cs:[rax + rax]
mov al, 0xbc
lock cmpxchg byte [0x1405911e9], cl
je 0x1400abf38
cmp al, 0x2b
jne 0x1400abdd0
lea rax, [0x1405911e0]
ret
movzx eax, byte [0x1405912f3]
nop word cs:[rax + rax]
cmp al, 0xcc
je 0x1400abf30
movzx ecx, byte [0x140591cd0]
mov edx, r8d
not dl
mov r9d, edx
and r9b, 0xf7
mov eax, r8d
and al, 8
or al, r9b
add al, cl
and dl, 0x27
mov r9d, r8d
and r9b, 0xd8
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x1405912f3], r9b
jne 0x1400abe00
xor eax, eax
lea rcx, [0x1405912e0]
lea rdx, [0x1404ca3a0]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x12
jg 0x1400abf28
inc rax
jmp 0x1400abe50
movzx eax, byte [0x14059136f]
nop word cs:[rax + rax]
cmp al, 0x3e
je 0x1400abf85
movzx ecx, byte [0x140591cd0]
mov eax, r8d
xor al, 0xcd
mov edx, eax
xor dl, cl
and al, cl
add al, al
add al, dl
mov edx, r8d
xor dl, 0x46
add dl, cl
lock cmpxchg byte [0x14059136f], dl
jne 0x1400abe80
xor eax, eax
lea rcx, [0x140591360]
lea rdx, [0x1404ca420]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x1400abf7d
inc rax
jmp 0x1400abec0
xor eax, eax
lea rcx, [0x1405910e0]
lea rdx, [0x1404ca1c0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x17
jg 0x1400abf18
inc rax
jmp 0x1400abef0
mov al, 0xfa
xchg byte [0x1405910f8], al
lea rax, [0x1405910e0]
ret
mov al, 0xcc
xchg byte [0x1405912f3], al
lea rax, [0x1405912e0]
ret
xor eax, eax
lea rcx, [0x1405911e0]
lea rdx, [0x1404ca2a0]
xor r8d, 0x84ec48d9
nop
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x140591cc0]
add r9d, r8d
add eax, r9d
cmp eax, 9
jl 0x1400abf50
mov al, 0x2b
xchg byte [0x1405911e9], al
lea rax, [0x1405911e0]
ret
mov al, 0x3e
xchg byte [0x14059136f], al
lea rax, [0x140591360]
ret
Function at 0x14014fb00
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
mov eax, r8d
xor eax, 0x51259472
add eax, dword [0x1405a043c]
cmp ecx, eax
jne 0x14014fba8
movzx eax, byte [0x14059472f]
nop word cs:[rax + rax]
cmp al, 0x2d
je 0x14014fc14
movzx ecx, byte [0x1405a0438]
mov edx, r8d
xor dl, 0x4f
mov eax, r8d
and al, 0x4f
add al, al
add al, dl
mov edx, eax
xor dl, cl
and al, cl
add al, al
add al, dl
add al, 0xb1
mov edx, r8d
xor dl, 0x30
add dl, cl
lock cmpxchg byte [0x14059472f], dl
jne 0x14014fb30
xor eax, eax
lea rcx, [0x140594720]
lea rdx, [0x1404cc600]
nop dword [rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x14014fc0c
inc rax
jmp 0x14014fb80
test edx, edx
je 0x14014fbd8
movzx eax, byte [0x140594538]
cmp al, 0x5c
je 0x14014fbd0
mov cl, 0xcb
nop dword [rax]
mov al, 0xe4
lock cmpxchg byte [0x140594538], cl
je 0x14014fc1c
cmp al, 0x5c
jne 0x14014fbc0
lea rax, [0x140594530]
ret
movzx eax, byte [0x14059475f]
cmp al, 0x7d
je 0x14014fc04
mov cl, 0x75
nop word cs:[rax + rax]
mov al, 0x4d
lock cmpxchg byte [0x14059475f], cl
je 0x14014fc7e
cmp al, 0x7d
jne 0x14014fbf0
lea rax, [0x140594750]
ret
mov al, 0x2d
xchg byte [0x14059472f], al
lea rax, [0x140594720]
ret
xor edx, edx
lea rax, [0x140594530]
lea rcx, [0x1404cc430]
xor r8d, 0x5125947d
add r8d, 0x51d3e89b
nop word [rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
add byte [rdx + rax], r9b
mov r9d, dword [0x1405a043c]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add edx, r9d
add edx, 0xae2c1765
cmp edx, 8
jl 0x14014fc40
mov al, 0x5c
xchg byte [0x140594538], al
lea rax, [0x140594530]
ret
xor eax, eax
lea rcx, [0x140594750]
lea rdx, [0x1404cc630]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x14014fcb8
inc rax
jmp 0x14014fc90
mov al, 0x7d
xchg byte [0x14059475f], al
lea rax, [0x140594750]
ret