joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140017560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x1400175da
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x1400175d0
cmp r11, r10
ja 0x140017673
cmp r10, rdx
ja 0x140017687
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x1400175d2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x1400175b0
jmp 0x140017647
ja 0x1400175da
mov r11, r10
cmp rax, r8
jne 0x140017582
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14001764b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x140017620
mov r8, r10
sub ecx, r9d
jns 0x14001763e
jmp 0x14001764d
cmp r10, rdx
je 0x140017659
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14001764d
xor al, 1
cmp r8, rdx
jne 0x140017600
jmp 0x14001764d
xor eax, eax
jmp 0x14001764d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.called__Option::unwrap____on_a__None__valuelibrarycore_src_nummod.rsfrom_str_radix_int:_must_lie_in_the_range___2__36_____found
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.14001a090
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.14001a4f0
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.14001a480
ud2

Function at 0x140019084
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.kernel32.dll_GetModuleHandleW]
test rax, rax
je 0x1400190ce
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400190ce
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400190ce
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400190ce
cmp dword [rcx + 0x84], 0xe
jbe 0x1400190ce
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400190d0
xor al, al
add rsp, 0x28
ret
Function at 0x140026060
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x14002618d
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
xchg rbx, rdx
mov rdx, rbx
xchg rdx, rbx
xchg rcx, rbx
mov rdi, rbx
xchg rbx, rcx
mov esi, r8d
sub rdi, rdx
xchg r13, rcx
mov rbp, r13
xchg r13, rcx
neg rdi
add rdi, 0xffffffffffffff10
neg rdi
dec rsi
shr rsi, 2
shr rsi, 1
shr rsi, 1
inc rsi
nop dword [rax]
xchg r10, rbx
movups xmm0, xmmword [r10]
xchg rbx, r10
xchg rbp, rsi
mov rdx, rsi
xchg rbp, rsi
xchg rcx, rdi
mov rdi, rbx
xchg rdi, rcx
call fcn.140026870
mov ecx, 0xe21dcd3
add ecx, 0x69933572
xor ecx, 0x302a3728
sub ecx, 0x24a517ab
add ecx, 0x162080c7
xor ecx, 0x6829f2a
sub ecx, 0x108f60ea
sub ecx, 0x20633f5b
xor ecx, 0xea5714e
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x140026129
nop
add rdi, 0x46a77a24
sub rdi, 0x46a77a34
xchg rbp, r11
movups xmmword [r11 + 0xf0], xmm0
xchg r11, rbp
sub rsi, 1
jne 0x1400260c6
xchg rdi, r8
mov r8, qword [rsp + 0x30]
xchg rdi, r8
xchg r8, rbx
mov r8, qword [rsp + 0x38]
xchg rbx, r8
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
push rdx
xchg qword [rsp + 8], rsi
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x1400261a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov edi, r8d
xchg rbx, r9
mov r9, rdx
xchg rbx, r9
lea r9, [rcx + 0xf0]
xchg rdi, rcx
mov rsi, rdi
xchg rdi, rcx
test r8d, r8d
je 0x140026270
dec rdi
shr rdi, 3
shr rdi, 1
inc rdi
nop dword [rax]
nop word [rax + rax]
xchg rcx, rax
mov rcx, rbx
xchg rcx, rax
sub r9, rbx
mov edx, 0x2846f333
xor edx, 0x1734855f
add edx, 0xd62c17a
add edx, 0x7fe44c8
sub edx, 0x1517e89d
sub edx, 0x3fbb9401
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x14002622d
xchg rdx, rbp
mov rbp, rsi
xchg rbp, rdx
xchg rsi, rbx
mov rcx, rsi
xchg rbx, rsi
call fcn.140026320
xchg rsi, r9
mov rsi, rbx
xchg r9, rsi
sub rbx, 0xfffffffffffffff0
sub rdi, 1
jne 0x1400261fb
xchg r9, rdi
movups xmm0, xmmword [rdi]
xchg r9, rdi
xchg rcx, rbx
mov rcx, qword [rsp + 0x30]
xchg rbx, rcx
mov rbp, qword [rsp + 0x38]
xchg rsi, r11
movups xmmword [r11 + 0xf0], xmm0
xchg r11, rsi
xchg r8, rsi
mov r8, qword [rsp + 0x40]
xchg r8, rsi
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140027a00
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg rbx, r12
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x10
mov rbx, rdx
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
test r8b, 0xf
je 0x140027a52
xor al, al
xchg rbx, rsi
mov rsi, qword [rsp + 0x20]
xchg rsi, rbx
add rsp, 0x10
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
xor edx, edx
test r8d, r8d
je 0x140027afe
movdqa xmm2, xmmword [rsp]
nop
xchg rbp, rdx
movdqu xmm1, xmmword [rbp + rbx]
xchg rbp, rdx
test edx, edx
jne 0x140027a80
movdqu xmm2, xmmword [r10 + 0x200]
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
pxor xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0x3e62c2cc
add ecx, 0x1da1a52f
sub ecx, 0x4956268a
add ecx, 0xe3aae3e
add ecx, 0x12660722
add ecx, 0x3d2d82a5
sub ecx, 0x707c7969
nop dword [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027ac2
aesdeclast xmm0, xmmword [r10 + 0x1e0]
pxor xmm0, xmm2
movdqa xmm2, xmm1
xchg r10, rdx
movups xmmword [r10 + r9], xmm0
xchg r10, rdx
add edx, 0x10
cmp edx, r8d
jb 0x140027a63
xchg rbx, rsi
mov rsi, qword [rsp + 0x20]
xchg rsi, rbx
mov al, 0x6d
xor al, 0x6d
add al, 0x3b
xor al, 0x6c
sub al, 0x3b
add al, 0
add al, 6
sub al, 0x21
add rsp, 0x10
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140028990
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rsi, rdx
mov qword [rsp + 0x10], rdx
xchg rsi, rdx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg r8, r13
mov rbx, r13
xchg r13, r8
mov rdi, rdx
xchg rsi, rdx
mov rdx, rcx
xchg rdx, rsi
jne 0x140028a22
nop
mov r8, qword [rbx + 0x10]
xchg rdi, rsi
mov rdx, rsi
xchg rdi, rsi
mov rcx, rsi
call fcn.140028990
xchg r13, rbx
mov rcx, r13
xchg rbx, r13
mov edx, 0x3ef1e379
xor edx, 0x30c9cd19
add edx, 0xd8b2f21
add edx, 0x4cd176d0
add edx, 0xf26e0ba
xor edx, 0x77bbb53b
mov rbx, qword [rbx]
call fcn.1401fd468
cmp byte [rbx + 0x19], 0
je 0x1400289cf
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140029950
Capabilities:
Encode data using xor

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg r12, rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, r9
mov rdi, r9
xchg rcx, r9
xor ebx, ebx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1400299cc
xchg r10, rdx
mov r10, qword [rdi + 0x28]
xchg r10, rdx
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1400299bb
mov r8, qword [rcx - 8]
sub rdx, 0xffffffffffffffd9
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140029a8b
mov rcx, r8
call fcn.1401fd468
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x20], rbx
mov qword [rdi + 0x28], rbx
mov rcx, qword [rdi + 8]
mov rax, qword [rcx + 8]
mov qword [rax], rbx
mov rcx, qword [rcx]
test rcx, rcx
je 0x140029a3a
nop dword [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x64b8022
add edx, 0x49f5e089
sub edx, 0x2e5fd12e
sub edx, 0x1910a316
add edx, 0x579d76ff
sub edx, 0x57e96cc3
add edx, 0x388e2301
xor edx, 0x542cdcc4
sub edx, 0x153fc548
call fcn.1401fd468
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
test rbx, rbx
jne 0x1400299eb
mov rcx, qword [rdi + 8]
mov edx, 0x78cb8ee1
sub edx, 0x195b281a
add edx, 0x1e238c05
sub edx, 0x683897fa
xor edx, 0x5a585d84
xor edx, 0xf89456d
sub edx, 0x1614f9ee
sub edx, 0x2a754835
xchg r14, rbx
mov r14, qword [rsp + 0x30]
xchg r14, rbx
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
jmp fcn.1401fd468
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14002cb10
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
xchg rdi, r11
mov qword [rsp + 0x20], r11
xchg r11, rdi
push rdx
mov qword [rsp], r14
sub rsp, 0x30
xchg rcx, r15
mov rsi, r15
xchg rcx, r15
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x60]
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
mov qword [rsp + 0x40], rbx
sub rcx, 0x6215314f
add rcx, 0x62153217
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x6e979a5c
sub dword [rsp + 0x20], 0x7d18777
xor dword [rsp + 0x20], 0x6e38e423
add dword [rsp + 0x20], 0x629d62ba
sub dword [rsp + 0x20], 0xe741434
sub dword [rsp + 0x20], 0x1c2be0ce
xor dword [rsp + 0x20], 0x1e7d1783
sub dword [rsp + 0x20], 0x280f5907
xor dword [rsp + 0x20], 0x36721afe
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b750
test eax, eax
js 0x14002cbdb
cmp qword [rsp + 0x40], rbx
je 0x14002cbdb
lea eax, [rbx + 1]
jmp 0x14002ccfe
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0x70], 2
jbe 0x14002cc1a
mov eax, 0x6e13138
add eax, 0x828f850
add eax, 0x512590a7
xor eax, 0x46f63952
add eax, 0x31861f48
xor eax, 0x5053473
xor eax, 0x5d5a96b4
jmp 0x14002ccfe
cmp dword [rcx + 0x74], ebx
jbe 0x14002cc4b
mov eax, 0x274a70ce
xor eax, 0x189eab8f
sub eax, 0x3d8445bc
xor eax, 0x5a2df00a
sub eax, 0x299c34f7
sub eax, 0x1ef75a6b
sub eax, 0xfe9d62a
jmp 0x14002ccfe
cmp byte [rdi + 2], bl
je 0x14002cc77
mov eax, 0x64b665eb
xor eax, 0x35780ea
xor eax, 0x155d9fd3
sub eax, 0x33c1df64
add eax, 0x40c7e0cd
sub eax, 0x7fc27c37
jmp 0x14002ccfe
cmp r14d, 0xa
jb 0x14002ccc3
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002ccc3
mov eax, 0x6b436ba7
xor eax, 0x31fd97de
sub eax, 0x5a4eb37
sub eax, 0x47c390b1
xor eax, 0x7e9eefdb
sub eax, 0x2984d69
sub eax, 0x9dddbf6
sub eax, 0x675245e3
jmp 0x14002ccfe
lea rcx, [rsi + 0xb8]
mov edx, 0x21847191
add edx, 0x128054fa
add edx, 0x42b17324
xor edx, 0x4de57dd9
xor edx, 0x6fa67268
add edx, 0x44a4637b
call fcn.14002c0b0
jmp 0x14002ccfc
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
nop
add rsp, 8
xchg qword [rsp - 8], r14
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140033c90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg rbx, r8
mov r8, rbx
xchg r8, rbx
xchg rsi, rdx
mov rdx, rsi
xchg rsi, rdx
xchg rbp, r8
mov r8, rcx
xchg r8, rbp
jne 0x140033d55
xchg rbp, rdi
mov qword [rsp + 0x30], rbp
xchg rbp, rdi
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
mov rdx, rsi
xchg rcx, rbp
mov rbp, rcx
xchg rcx, rbp
call fcn.140033c90
xchg rdi, rsi
mov rsi, rbx
xchg rsi, rdi
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004cfa0
mov edx, 0x64c7c586
sub edx, 0x56b24f6
add edx, 0x153c150c
xor edx, 0x40791c5c
xor edx, 0x793c00af
sub edx, 0x4ddda91f
xchg rcx, rdi
mov rdi, rcx
xchg rcx, rdi
call fcn.1401fd468
cmp byte [rbx + 0x19], 0
je 0x140033ce5
xchg rdi, r14
mov r14, qword [rsp + 0x30]
xchg rdi, r14
xchg rbx, rsi
mov rsi, qword [rsp + 0x38]
xchg rbx, rsi
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
nop
add rsp, 8
mov rsi, qword [rsp - 8]
ret

Function at 0x140033d80
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r15
mov qword [rsp + 0x10], r15
xchg rbx, r15
mov qword [rsp + 0x18], rbp
push rdx
mov qword [rsp], rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg rbx, r8
mov r8, rbx
xchg r8, rbx
mov rsi, rdx
xchg rcx, rdx
mov rbp, rdx
xchg rcx, rdx
jne 0x140033e40
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
xchg rbp, r8
mov rbp, qword [rbx + 0x10]
xchg r8, rbp
xchg rsi, rdx
mov rsi, rdx
xchg rsi, rdx
xchg r11, rbp
mov rcx, r11
xchg r11, rbp
call fcn.140033d80
xchg rbx, rcx
mov rdi, rcx
xchg rbx, rcx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004cfa0
mov edx, 0x34221e1f
sub edx, 0x5a4eba
xor edx, 0x4b92f7de
sub edx, 0x6e89205f
xor edx, 0x7788764c
sub edx, 0x7e446dc0
mov rcx, rdi
call fcn.1401fd468
cmp byte [rbx + 0x19], 0
je 0x140033dca
xchg rdi, r9
mov r9, qword [rsp + 0x30]
xchg rdi, r9
xchg r14, rbx
mov r14, qword [rsp + 0x38]
xchg rbx, r14
xchg r15, rbp
mov r15, qword [rsp + 0x40]
xchg r15, rbp
add rsp, 0x20
nop
xchg qword [rsp], rsi
add rsp, 8
ret
Function at 0x140035ac0
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rcx
mov qword [rsp + 8], r9
xchg r9, rcx
push rbx
nop
mov qword [rsp - 8], rsi
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
mov qword [rsp - 8], r13
sub rsp, 8
nop
mov qword [rsp - 8], r14
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x30
xchg r13, rdx
mov r15, r13
xchg r13, rdx
xchg rcx, rdi
mov r14, rdi
xchg rdi, rcx
movabs rsi, 0xfffffff2c304007
sub rsi, 0x2969f6d5
add rsi, 0x1ea40894
add rsi, 0x22af29e7
sub rsi, 0x135b3ef3
add rsi, 0x7fffffff
add rsi, 0x4f41c346
cmp rdx, rsi
ja 0x140035d06
xchg r12, r8
mov r8, qword [rcx + 8]
xchg r8, r12
sub r12, qword [rcx]
sar r12, 3
sar r12, 1
mov rcx, qword [rcx + 0x10]
sub rcx, qword [r14]
sar rcx, 1
sar rcx, 1
sar rcx, 2
xchg rcx, rdx
mov rcx, rdx
xchg rcx, rdx
shr rdx, 1
mov rax, rsi
sub rax, rdx
cmp rcx, rax
ja 0x140035ba4
lea rsi, [rdx + rcx]
cmp rsi, r15
cmovb rsi, r15
xchg rsi, r12
mov qword [rsp + 0x88], r12
xchg r12, rsi
xchg rdx, r12
mov r12, rsi
xchg rdx, r12
xchg rcx, r10
mov r10, r14
xchg rcx, r10
call fcn.140053af0
xchg r13, rax
mov rax, r13
xchg r13, rax
xchg rsi, rax
mov qword [rsp + 0x28], rsi
xchg rsi, rax
xchg rbx, r12
mov r12, rbx
xchg r12, rbx
shl rbx, 1
shl rbx, 2
shl rbx, 1
add rbx, rax
mov qword [rsp + 0x20], rbx
xchg r15, r14
mov rdi, r14
xchg r15, r14
sub rdi, r12
mov qword [rsp + 0x78], rbx
je 0x140035c4c
nop word [rax + rax]
mov byte [rbx], 0x2f
add byte [rbx], 4
sub byte [rbx], 0x15
add byte [rbx], 0x2a
xor byte [rbx], 0x43
sub byte [rbx], 0xb
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004bdc0
nop
neg rbx
add rbx, 0xfffffffffffffff0
neg rbx
mov qword [rsp + 0x78], rbx
sub rdi, 1
jne 0x140035c15
xchg rbp, r8
mov rbp, qword [r14 + 8]
xchg r8, rbp
mov rdx, r13
xchg rcx, r8
mov r8, qword [r14]
xchg rcx, r8
cmp rcx, r8
je 0x140035c9d
xor r9d, r9d
movzx eax, byte [rcx]
mov byte [rdx], al
mov rax, qword [rcx + 8]
xchg r13, rax
mov qword [rdx + 8], r13
xchg r13, rax
mov byte [rcx], r9b
xchg r9, r12
mov qword [rcx + 8], r12
xchg r9, r12
lea rdx, [rdx + 0x10]
add rcx, 0x10
cmp rcx, r8
jne 0x140035c6e
xchg rsi, r15
mov r9, r15
xchg r15, rsi
mov r8, r15
xchg r13, rdx
mov r13, rdx
xchg r13, rdx
xchg rcx, r14
mov r14, rcx
xchg r14, rcx
add rsp, 0x30
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
mov r12, qword [rsp]
add rsp, 8
nop
xchg qword [rsp], rdi
add rsp, 8
nop
mov rsi, qword [rsp]
add rsp, 8
nop
add rsp, 8
mov rbx, qword [rsp - 8]
jmp fcn.140052cd0
call fcn.14002f9c0
int3
Function at 0x140035d80
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rbx
mov qword [rsp + 8], rcx
xchg rcx, rbx
nop
push 0x10dfb2ee
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rdx
xchg rbx, rbp
mov rbp, rcx
xchg rbp, rbx
test rdx, rdx
je 0x140035de0
nop word [rax + rax]
mov byte [rbx], 0x28
sub byte [rbx], 0xb
xor byte [rbx], 0x77
add byte [rbx], 9
sub byte [rbx], 0x44
sub byte [rbx], 0x1e
sub byte [rbx], 0x11
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004bdc0
nop
add rbx, 0x10
sub rdi, 1
jne 0x140035db5
mov rax, rbx
xchg r12, rbx
mov r12, qword [rsp + 0x30]
xchg r12, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14004c560
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x2a
xor byte [rcx + rax + 6], 0x2e
sub byte [rcx + rax + 6], 2
xor byte [rcx + rax + 6], 0x10
add byte [rcx + rax + 6], 0x5b
xor byte [rcx + rax + 6], 0x4d
add byte [rcx + rax + 6], 0x1a
xor byte [rcx + rax + 6], 0x2f
sub byte [rcx + rax + 6], 0x15
inc rax
cmp rax, 8
jb 0x14004c562
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14004c5b0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 6
add byte [rcx + rax + 6], 0x60
sub byte [rcx + rax + 6], 0x1f
add byte [rcx + rax + 6], 0x1a
add byte [rcx + rax + 6], 3
sub byte [rcx + rax + 6], 0x32
sub byte [rcx + rax + 6], 0x2f
xor byte [rcx + rax + 6], 3
inc rax
cmp rax, 0xa
jb 0x14004c5b2
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140076580
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
mov r8d, 0x5e469e53
sub r8d, 0xb87b39d
add r8d, 0x1d53a041
sub r8d, 0x6b5af6be
add r8d, 0x363827b3
xor r8d, 0x398dac2e
add r8d, 0x537c71cb
add r8d, 0xa9217672
test rcx, rcx
je 0x1400766a4
cmp byte [rcx], 0
je 0x1400766a4
test rdx, rdx
jne 0x140076636
nop
movabs rdx, 0xffffffff0272d396
add rdx, 0x7ca72b55
sub rdx, 0x2bd0e31d
sub rdx, 0x9565cf1
xor rdx, 0x7d0dedd2
xor rdx, 0x14086962
sub rdx, 0xa1fdeb
add rdx, 0x14e183d9
add rdx, 0x7fffffff
add rdx, 0x4ac93fa5
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x140076620
test rdx, rdx
je 0x1400766a1
xor r10d, r10d
lea r11, [0x140002dd0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
xor rcx, qword [rsp]
add rsp, 0x10
shr r8d, 1
shr r8d, 6
shr r8d, 1
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x140076648
not r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007ada0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
xchg rbp, rcx
mov rbx, rbp
xchg rcx, rbp
test rdx, rdx
jne 0x14007ade6
xchg rdx, r13
mov qword [rcx + 0x10], r13
xchg rdx, r13
xchg r13, rcx
mov rax, r13
xchg rcx, r13
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret
nop
movabs r8, 0xffffffff5fe320f8
xor r8, 0x3073083a
sub r8, 0xd1d2da0
sub r8, 0x4a8ee500
sub r8, 0x11c73c3e
add r8, 0x37d73009
add r8, 0x7fffffff
add r8, 0x420bf613
xchg r8, rbp
mov rcx, rbp
xchg rbp, r8
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x14007ae2b
inc rcx
mov eax, 0x4b36ef0
xor eax, 0x2c4eab78
add eax, 0xa389854
add eax, 0x93af3be
add eax, 0x1d80457a
xor eax, 0x1619e7ea
sub eax, 0x2257a499
sub eax, 0x2d90cc63
mul rcx
xchg r11, rcx
mov qword [rbx + 8], r11
xchg rcx, r11
cmovo rax, r8
xchg r9, rcx
mov r9, rax
xchg rcx, r9
call fcn.1401fd470
mov r8, qword [rbx + 8]
xchg rdi, rbx
mov rdx, rbx
xchg rdi, rbx
add r8, r8
xchg r11, rax
mov qword [rbx + 0x10], r11
xchg r11, rax
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000ffff
jge 0x14007aebd
dec eax
or eax, 0xffff0000
inc eax
xor edx, edx
mov word [rbx + 2], ax
cmp qword [rbx + 8], rdx
jbe 0x14007aeeb
nop
mov rax, qword [rbx + 0x10]
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x14007aecf
mov byte [rbx], 0x46
add byte [rbx], 0x27
xor byte [rbx], 0x48
add byte [rbx], 0x50
add byte [rbx], 6
sub byte [rbx], 0x6f
sub byte [rbx], 0xc
xchg rbx, rax
mov rbx, rax
xchg rbx, rax
xchg rbx, r9
mov r9, qword [rsp + 0x30]
xchg rbx, r9
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b4e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg rdx, r11
mov r11, rcx
xchg rdx, r11
test rax, rax
jne 0x14007b501
xor r8d, r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b54a
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b52f
xchg r15, rax
mov r15, qword [rdx + 0x10]
xchg r15, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b50f
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x70
sub byte [rdx], 0x10
sub byte [rdx], 0x22
xor byte [rdx], 0x35
xor byte [rdx], 0x2f
add byte [rdx], 0x32
xor byte [rdx], 0x2e
xor byte [rdx], 0x66
sub byte [rdx], 0x1d
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b560
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 0x10]
xchg rcx, r13
mov rdx, r13
xchg r13, rcx
test rax, rax
jne 0x14007b581
xor r8d, r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
cmp byte [rcx], 0
jne 0x14007b5c0
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b5a8
mov rcx, qword [rdx + 0x10]
movzx eax, byte [rdx + 1]
xor byte [rcx + r8], al
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b58f
mov rax, qword [rdx + 0x10]
mov byte [rdx], 0x25
xor byte [rdx], 0x40
sub byte [rdx], 0x2e
sub byte [rdx], 8
sub byte [rdx], 0x26
add byte [rdx], 2
add byte [rdx], 4
xor byte [rdx], 0xe
ret
Function at 0x14007b880
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov qword [rsp], rbx
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
xchg rcx, rbx
mov rcx, rbx
xchg rbx, rcx
je 0x14007b8f3
cmp byte [rcx], 0
je 0x14007b8f3
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000ffff
jge 0x14007b8b4
dec eax
or eax, 0xffff0000
inc eax
xor word [rbx + 2], ax
xor edx, edx
cmp qword [rbx + 8], rdx
jbe 0x14007b8e1
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x14007b8c9
mov byte [rbx], 0x5e
sub byte [rbx], 8
xor byte [rbx], 0x5a
add byte [rbx], 0x1e
add byte [rbx], 0x2d
sub byte [rbx], 0x57
add rsp, 0x20
nop
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007b910
Capabilities:
Encode data using xor

Disassembly:
xchg r10, rax
mov r10, qword [rcx + 0x10]
xchg r10, rax
mov rdx, rcx
test rax, rax
jne 0x14007b921
ret
cmp byte [rcx], 0
jne 0x14007b966
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b954
nop dword [rax + rax]
mov rax, qword [rdx + 0x10]
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b934
xchg r8, rax
mov r8, qword [rdx + 0x10]
xchg r8, rax
mov byte [rdx], 0x77
sub byte [rdx], 1
sub byte [rdx], 0x29
sub byte [rdx], 0x18
add byte [rdx], 0x2a
xor byte [rdx], 0x5e
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c1b0
Capabilities:
Encode data using xor

Disassembly:
xchg r13, rbx
mov qword [rsp + 8], r13
xchg r13, rbx
xchg r10, rdx
mov qword [rsp + 0x10], r10
xchg rdx, r10
push rdi
sub rsp, 0x20
xchg rdi, rsi
mov rsi, rcx
xchg rsi, rdi
lea rbx, [rdx + 4]
xchg rbx, r11
mov rdx, r11
xchg rbx, r11
call fcn.14007ada0
nop
xor eax, eax
mov byte [rbx + rax], 0x74
xor byte [rbx + rax], 0x7b
xor byte [rbx + rax], 0x62
xor byte [rbx + rax], 0x2a
xor byte [rbx + rax], 0x61
xor byte [rbx + rax], 0x32
add byte [rbx + rax], 0x10
xor byte [rbx + rax], 0x24
inc rax
cmp rax, 6
jb 0x14007c1e9
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14007c230
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r9
mov qword [rsp + 8], r9
xchg rbx, r9
xchg rdx, r10
mov qword [rsp + 0x10], r10
xchg rdx, r10
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 6]
xchg r13, rdx
mov r13, rbx
xchg rdx, r13
call fcn.14007ada0
nop
xor eax, eax
mov byte [rbx + rax], 0x5c
sub byte [rbx + rax], 0x3b
sub byte [rbx + rax], 0xc
add byte [rbx + rax], 0x3f
xor byte [rbx + rax], 0x62
add byte [rbx + rax], 0x1d
sub byte [rbx + rax], 0x53
inc rax
cmp rax, 8
jb 0x14007c271
xchg r10, rax
mov r10, rdi
xchg r10, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rcx
push rbx
push rbx
xchg qword [rsp + 0x20], rdi
pop rbx
pop rbx
pop rcx
pop rcx
add rsp, 8
ret