joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007d110
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rdi, rcx
lea rbx, [rdx + 0x70]
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
call fcn.14007a920
nop
xor eax, eax
mov byte [rbx + rax], SHCreateMemStream
xor byte [rbx + rax], 0x2f
xor byte [rbx + rax], 0x50
xor byte [rbx + rax], 0x25
add byte [rbx + rax], 4
xor byte [rbx + rax], 0x55
inc rax
cmp rax, 0xde
jb 0x14007d145
xchg r12, rax
mov r12, rdi
xchg r12, rax
xchg rbx, r14
mov r14, qword [rsp + 0x30]
xchg r14, rbx
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14007d210
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, r10
mov qword [rsp + 0x10], r10
xchg r10, rdx
push rax
mov qword [rsp], rdi
sub rsp, 0x20
xchg rsi, rdi
mov rsi, rcx
xchg rsi, rdi
lea rbx, [rdx + 0x7c]
xchg rdx, rbx
mov rbx, rdx
xchg rdx, rbx
call fcn.14007a920
nop
xor eax, eax
mov byte [rbx + rax], 0x28
xor byte [rbx + rax], 0x78
xor byte [rbx + rax], 0x1c
xor byte [rbx + rax], 0x67
add byte [rbx + rax], 0x2b
sub byte [rbx + rax], 0x2c
sub byte [rbx + rax], 0x2a
inc rax
cmp rax, 0xf4
jb 0x14007d247
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, r8
mov r8, qword [rsp + 0x30]
xchg rbx, r8
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret

Function at 0x14007d290
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [rdx + 0x9a]
mov rdx, rbx
call fcn.14007a920
nop
xor eax, eax
nop dword [rax]
nop dword [rax + rax]
mov byte [rbx + rax], 0x63
xor byte [rbx + rax], 0x6e
xor byte [rbx + rax], 0x32
xor byte [rbx + rax], 0x3e
add byte [rbx + rax], 0x5b
sub byte [rbx + rax], 0x37
sub byte [rbx + rax], 0x25
inc rax
cmp rax, 0x130
jb 0x14007d2c8
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rcx
push rcx
push rdx
push rax
push rax
xchg qword [rsp + 0x28], rdi
pop rax
pop rax
pop rdx
pop rcx
pop rcx
add rsp, 8
ret

Function at 0x14007d310
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg r12, rdx
mov qword [rsp + 0x10], r12
xchg rdx, r12
push rdi
sub rsp, 0x20
xchg rbp, rcx
mov rdi, rbp
xchg rcx, rbp
lea rbx, [rdx + 0xc]
xchg rdx, rsi
mov rsi, rbx
xchg rsi, rdx
call fcn.14007a920
nop
xor eax, eax
mov byte [rbx + rax], 0x15
add byte [rbx + rax], 0x69
sub byte [rbx + rax], 0x3c
sub byte [rbx + rax], 0x1f
xor byte [rbx + rax], 0x43
sub byte [rbx + rax], 0x31
xor byte [rbx + rax], 0x2f
inc rax
cmp rax, 0x14
jb 0x14007d343
xchg rbx, rax
mov rbx, rdi
xchg rbx, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
ret
Function at 0x14007d390
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x20
xchg rcx, rdx
mov rdi, rdx
xchg rdx, rcx
lea rbx, [rdx + 0xe]
mov rdx, rbx
call fcn.14007a920
nop
xor eax, eax
mov byte [rbx + rax], 0x1d
xor byte [rbx + rax], 0
sub byte [rbx + rax], 7
add byte [rbx + rax], 0x2f
add byte [rbx + rax], 0x30
xor byte [rbx + rax], 0x75
inc rax
cmp rax, 0x18
jb 0x14007d3b7
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rdx, rbx
add rsp, 0x20
push rbx
push rcx
push rcx
push rbx
xchg qword [rsp + 0x20], rdi
add rsp, 0x28
ret

Function at 0x14007d400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rdx, rdi
mov qword [rsp + 0x10], rdi
xchg rdx, rdi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
xchg rcx, rdi
mov rcx, rdi
xchg rcx, rdi
lea rbx, [rdx + 0xe]
mov rdx, rbx
call fcn.14007a920
nop
xor eax, eax
mov byte [rbx + rax], 0x32
xor byte [rbx + rax], 0
sub byte [rbx + rax], 0xc
xor byte [rbx + rax], 0x2a
add byte [rbx + rax], 1
add byte [rbx + rax], 0x2b
add byte [rbx + rax], 0x38
sub byte [rbx + rax], 0x70
inc rax
cmp rax, 0x1a
jb 0x14007d436
xchg r10, rax
mov r10, rdi
xchg r10, rax
xchg r14, rbx
mov r14, qword [rsp + 0x30]
xchg r14, rbx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
ret
Function at 0x140083c90
Capabilities:
Encode data using xor

Disassembly:
mov rax, r8
cmp rcx, rdx
je 0x140083e02
xchg rdi, r9
mov rdi, rax
xchg rdi, r9
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
xchg r10, rax
movups xmmword [r10], xmm0
xchg r10, rax
xchg r10, r11
mov qword [r9 + r8 - 0x70], r11
xchg r10, r11
xchg rsi, r10
mov qword [r9 + r8 - 0x68], rsi
xchg r10, rsi
xchg r8, rcx
movups xmm0, xmmword [rcx - 0x80]
xchg r8, rcx
xchg rbp, rax
movups xmmword [rbp], xmm0
xchg rbp, rax
xchg r10, r8
movups xmm1, xmmword [r10 - 0x70]
xchg r8, r10
xorps xmm0, xmm0
xchg r10, rax
movups xmmword [r10 + 0x10], xmm1
xchg r10, rax
mov qword [r8 - 0x70], r10
nop
sub rax, 0x476e93bb
add rax, 0x476e9403
mov qword [r8 - 0x68], 0x75760811
sub qword [r8 - 0x68], 0x47159333
add qword [r8 - 0x68], 0x36a5c7f2
xor qword [r8 - 0x68], 0x5df21006
sub qword [r8 - 0x68], 0x2c30dc01
add qword [r8 - 0x68], 0xaf62331
sub qword [r8 - 0x68], 0x17b973ff
mov word [r8 - 0x80], r10w
xchg rsi, r9
movups xmmword [rsi + r8 - 0x60], xmm0
xchg rsi, r9
xchg r15, r10
mov qword [r9 + r8 - 0x50], r15
xchg r15, r10
mov qword [r9 + r8 - 0x48], r10
xchg r8, rdx
movups xmm0, xmmword [rdx - 0x60]
xchg r8, rdx
xchg rcx, r9
movups xmmword [rcx + r8 - 0x60], xmm0
xchg rcx, r9
movups xmm1, xmmword [r8 - 0x50]
xchg r9, r12
movups xmmword [r12 + r8 - 0x50], xmm1
xchg r9, r12
xchg r10, rbx
mov qword [r8 - 0x50], rbx
xchg rbx, r10
mov qword [r8 - 0x48], 0x4ea0c56d
sub qword [r8 - 0x48], 0x29c75bbf
xor qword [r8 - 0x48], 0x472f466c
sub qword [r8 - 0x48], 0x2d7ae9b
xor qword [r8 - 0x48], 0x48a78f74
add qword [r8 - 0x48], 0x52937e02
add qword [r8 - 0x48], 0x2c3e2e5
sub qword [r8 - 0x48], 0x577491d1
xor qword [r8 - 0x48], 0x279bdd6e
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x140083cb6
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140083e10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
cmp rcx, rdx
je 0x140083ed7
xchg r13, rax
mov r13, rbx
xchg r13, rax
lea r8, [rcx + 0x18]
sub rax, rcx
xor r10d, r10d
nop dword [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg rbx, rcx
movups xmmword [rcx], xmm0
xchg rbx, rcx
mov qword [rax + r8 - 0x28], r10
lea rcx, [r8 - 0x18]
xchg rsi, r10
mov qword [r8 + rax - 0x20], rsi
xchg r10, rsi
xchg r8, rsi
movups xmm0, xmmword [rsi - 0x38]
xchg r8, rsi
movups xmmword [rbx], xmm0
movups xmm1, xmmword [r8 - 0x28]
xchg r10, rbx
movups xmmword [r10 + 0x10], xmm1
xchg rbx, r10
xchg r10, rbp
mov qword [r8 - 0x28], rbp
xchg r10, rbp
nop
sub rbx, 0x161bc232
add rbx, 0x161bc252
mov qword [r8 - 0x20], 0x2a61b932
add qword [r8 - 0x20], 0x1f30bdf8
xor qword [r8 - 0x20], 0x448e69fb
add qword [r8 - 0x20], 0x26842280
add qword [r8 - 0x20], 0x1bce6988
add qword [r8 - 0x20], 0x1166a063
sub qword [r8 - 0x20], 0x60d54b2d
mov byte [r8 - 0x38], r10b
cmp rcx, rdx
jne 0x140083e38
xchg r8, r11
mov r11, r9
xchg r11, r8
xchg r11, rbx
mov rdx, r11
xchg r11, rbx
mov rcx, rbx
call fcn.14007ef10
xchg r9, rax
mov r9, rbx
xchg r9, rax
add rsp, 0x20
nop
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140083f10
Capabilities:
Encode data using xor

Disassembly:
xchg r8, rax
mov r8, rax
xchg r8, rax
cmp rcx, rdx
je 0x140083fce
xchg r9, rax
mov rax, r9
xchg r9, rax
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
movups xmmword [rax], xmm0
mov qword [r9 + r8 - 0x28], r10
lea rcx, [r8 - 0x18]
xchg r10, rsi
mov qword [r8 + r9 - 0x20], rsi
xchg rsi, r10
movups xmm0, xmmword [r8 - 0x38]
xchg r15, rax
movups xmmword [r15], xmm0
xchg r15, rax
xchg r8, rcx
movups xmm1, xmmword [rcx - 0x28]
xchg r8, rcx
xchg rbp, rax
movups xmmword [rbp + 0x10], xmm1
xchg rbp, rax
xchg r10, r15
mov qword [r8 - 0x28], r15
xchg r15, r10
nop
add rax, 0x3cf6c4a3
sub rax, 0x3cf6c483
mov qword [r8 - 0x20], 0x4023c69f
add qword [r8 - 0x20], 0x1e8258ef
sub qword [r8 - 0x20], 0x1fc6e70f
add qword [r8 - 0x20], 0x38b7897a
sub qword [r8 - 0x20], 0x3a57c7e6
xor qword [r8 - 0x20], 0x3d3efa14
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x140083f3c
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14008e350
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0xa], 0x54
sub byte [rcx + rax + 0xa], 5
sub byte [rcx + rax + 0xa], 0x47
sub byte [rcx + rax + 0xa], 8
add byte [rcx + rax + 0xa], 0x32
sub byte [rcx + rax + 0xa], 0x17
xor byte [rcx + rax + 0xa], 0xa
xor byte [rcx + rax + 0xa], 0x3b
sub byte [rcx + rax + 0xa], 0x2a
inc rax
cmp rax, 0x10
jb 0x14008e352
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14008e460
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0x14], 0x78
sub byte [rcx + rax + 0x14], 0x2b
xor byte [rcx + rax + 0x14], 0x64
xor byte [rcx + rax + 0x14], 0x1b
xor byte [rcx + rax + 0x14], 0x24
sub byte [rcx + rax + 0x14], 0xf
sub byte [rcx + rax + 0x14], 7
inc rax
cmp rax, 0x24
jb 0x14008e462
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140178d10
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
mov r8d, edx
lea r9, [rsp + 0x52]
xchg rbx, rdx
mov rdx, rcx
xchg rdx, rbx
xor r10d, r10d
nop dword [rax]
nop dword [rax + rax]
nop
sub r9, 0x53f5ca09
add r9, 0x53f5ca07
mov eax, 0x7cdacf40
xor eax, 0x3b40730f
xor eax, 0x74d79194
sub eax, 0x1bcc4be2
xor eax, 0x1b0bc9e2
xor eax, 0xc047e4d6
mul r8d
shr edx, 2
shr edx, 1
movzx eax, dx
shl ax, 1
shl ax, 1
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
neg r8w
add r8w, 0xffd0
neg r8w
mov word [r9], r8w
mov r8d, edx
test edx, edx
jne 0x140178d36
xorps xmm0, xmm0
lea rax, [rsp + 0x52]
xchg rbp, rbx
movups xmmword [rbp], xmm0
xchg rbx, rbp
xchg r10, r11
mov qword [rbx + 0x10], r11
xchg r10, r11
mov qword [rbx + 0x18], r10
cmp r9, rax
jne 0x140178e2e
xchg r10, rsi
mov qword [rbx + 0x10], rsi
xchg rsi, r10
xchg r13, rax
mov r13, rbx
xchg r13, rax
mov qword [rbx + 0x18], 0x480d3b65
add qword [rbx + 0x18], 0x2242b0a6
sub qword [rbx + 0x18], 0x4e65583e
xor qword [rbx + 0x18], 0x14612797
sub qword [rbx + 0x18], 0xb6824bf
add qword [rbx + 0x18], 0x35bb6b20
add qword [rbx + 0x18], 0x192a5cf1
xor qword [rbx + 0x18], 0x1ecf3894
sub qword [rbx + 0x18], 0x4dc66f31
mov word [rbx], r10w
add rsp, 0x60
nop
xchg qword [rsp], rbx
add rsp, 8
ret
lea r8, [rsp + 0x52]
xchg r9, rdx
mov r9, rdx
xchg r9, rdx
sub r8, r9
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
sar r8, 1
call fcn.14007ea80
xchg rbx, rdx
mov rax, rdx
xchg rdx, rbx
add rsp, 0x60
nop
add rsp, 8
mov rbx, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140193860
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
xchg r15, rdx
mov r10, r15
xchg r15, rdx
xchg r11, rcx
mov rcx, r11
xchg rcx, r11
mov word [rsp + 0x30], 0x46e7
sub word [rsp + 0x30], 0x323b
xor word [rsp + 0x30], 0x1b70
add word [rsp + 0x30], 0x57b3
xor word [rsp + 0x30], 0x7edc
add word [rsp + 0x30], 0x3fa
sub word [rsp + 0x30], 0x1aab
xor word [rsp + 0x30], 0x12a5
xor word [rsp + 0x30], 0xe6f1
mov dword [rsp + 0x34], 0x2efdf43b
sub dword [rsp + 0x34], 0xed62200
xor dword [rsp + 0x34], 0x37ca992b
xor dword [rsp + 0x34], 0x2945cfad
xor dword [rsp + 0x34], 0x7bef32c9
add dword [rsp + 0x34], 0x3622af8d
xor dword [rsp + 0x34], 0x198368cd
xor dword [rsp + 0x34], 0x801fa9c
add dword [rsp + 0x34], 0x94670b01
mov byte [rsp + 0x32], 0x61
xor byte [rsp + 0x32], 0x74
add byte [rsp + 0x32], 0x25
xor byte [rsp + 0x32], 0x35
add byte [rsp + 0x32], 0x2c
add byte [rsp + 0x32], 0x2f
add byte [rsp + 0x32], 0xf
add byte [rsp + 0x32], 0x7d
mov dword [rsp + 0x38], 0x7de6631f
sub dword [rsp + 0x38], 0x64d9e4e6
add dword [rsp + 0x38], 0x55b53add
xor dword [rsp + 0x38], 0x546337d8
xor dword [rsp + 0x38], 0x700c69a2
xor dword [rsp + 0x38], 0x151bb809
sub dword [rsp + 0x38], 0x5fb46007
xor ebx, ebx
mov edx, ebx
nop dword [rax]
movzx eax, word [rsp + rdx*2 + 0x34]
movzx ecx, byte [rsp + rdx + 0x30]
add cx, ax
mov word [rsp + rdx*2 + 0x34], cx
mov byte [rsp + rdx + 0x30], bl
inc rdx
cmp rdx, 3
jb 0x140193967
mov qword [rsp + 0x28], r8
xchg r10, rbx
mov qword [rsp + 0x20], r10
xchg r10, rbx
xor r9d, r9d
lea r8, [rsp + 0x34]
mov rdx, r10
xchg rcx, r11
mov r11, rcx
xchg r11, rcx
call fcn.140193d80
nop
nop dword [rax]
mov byte [rsp + rbx + 0x34], 6
add byte [rsp + rbx + 0x34], 0x77
xor byte [rsp + rbx + 0x34], 0x1c
sub byte [rsp + rbx + 0x34], 0x39
xor byte [rsp + rbx + 0x34], 0x2b
add byte [rsp + rbx + 0x34], 0x10
add byte [rsp + rbx + 0x34], 0x27
sub byte [rsp + rbx + 0x34], 0x3a
inc rbx
cmp rbx, 6
jb 0x1401939b7
add rsp, 0x40
nop
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401980b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xchg r9, r13
mov qword [rsp + 0x20], r13
xchg r13, r9
xchg r8, rcx
mov qword [rsp + 0x18], rcx
xchg rcx, r8
xchg r12, rcx
mov qword [rsp + 8], r12
xchg rcx, r12
nop
mov qword [rsp - 8], rbx
sub rsp, 8
push rbp
push rsi
nop
push r11
mov qword [rsp], rdi
nop
mov qword [rsp - 8], r12
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], r13
push r14
push r15
sub rsp, 0x58
mov rbx, r9
xchg rdx, r11
mov rsi, r11
xchg rdx, r11
xchg rbx, rcx
mov r9, rbx
xchg rcx, rbx
xor ebp, ebp
test rdx, rdx
jne 0x140198126
mov eax, ebp
jmp 0x140198179
mov eax, 0x6d3cc3a
xor eax, 0x6e1151f1
sub eax, 0x20a9bbf
sub eax, 0x631147ef
add eax, 0x23af277c
sub eax, 0x30d678d
sub eax, 0x225a961c
add eax, 0x2497e996
xor eax, 0x268597cb
cmp word [rdx], ax
je 0x140198168
xchg rcx, rax
mov rcx, rbp
xchg rcx, rax
jmp 0x140198179
movsxd rax, dword [rdx + 0x3c]
add rax, rsi
cmp dword [rax], 0x4550
cmovne rax, rbp
mov ecx, 0x6155f7cd
xor ecx, 0x179c784b
xor ecx, 0x43208493
sub ecx, 0x3561ebb2
add ecx, 0x76a97444
sub ecx, 0x315b1b7f
add ecx, 0x147057c5
sub ecx, 0x5a45cde2
cmp word [rax + 0x18], cx
jne 0x1401982bf
mov r14d, dword [rax + 0x88]
add r14, rsi
je 0x1401982bf
mov r15d, dword [r14 + 0x1c]
add r15, rsi
mov r12d, dword [r14 + 0x24]
add r12, rsi
mov r13d, dword [r14 + 0x20]
add r13, rsi
mov edi, ebp
cmp dword [r14 + 0x18], 0
jbe 0x140198289
nop dword [rax]
nop dword [rax + rax]
mov eax, edi
mov ecx, dword [r13 + rax*4]
add rcx, rsi
movzx eax, word [r12 + rax*2]
mov edx, dword [r15 + rax*4]
add rdx, rsi
cmp rcx, 0xffff
jbe 0x14019827d
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], r9
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x14019833e
mov rax, qword [rcx]
lea rdx, [rsp + 0xa8]
xchg rdx, r10
mov qword [rsp + 0x20], r10
xchg r10, rdx
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x40]
call qword [rax + 0x10]
test al, al
je 0x140198289
mov r8, qword [rsp + 0xb0]
xchg rsi, r9
mov rsi, qword [rsp + 0xa0]
xchg r9, rsi
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x1401981f0
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1401982ac
cmp rcx, rbx
mov rax, qword [rcx]
setne dl
call qword [rax + 0x20]
xchg rbp, r14
mov qword [rbx + 0x38], r14
xchg r14, rbp
mov al, 6
add al, 0x43
add al, 0xe
sub al, 0x48
add al, 0x53
add al, 0x1b
sub al, 0x7c
jmp 0x1401982e4
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1401982e2
mov rax, qword [rcx]
cmp rcx, rbx
setne dl
call qword [rax + 0x20]
xchg rsi, rbp
mov qword [rbx + 0x38], rsi
xchg rsi, rbp
xor al, al
add rsp, 0x58
nop
add rsp, 8
mov r15, qword [rsp - 8]
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], r13
push rcx
push rbx
push rbx
push rbx
push rcx
xchg qword [rsp + 0x28], r12
add rsp, 0x30
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
xchg qword [rsp], rsi
add rsp, 8
push rdx
push rcx
push rdx
push rbx
xchg qword [rsp + 0x20], rbp
add rsp, 0x28
nop
add rsp, 8
mov rbx, qword [rsp - 8]
ret
call fcn.1401fd502
nop
int3
Function at 0x1401aaaa0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r11, rdx
xchg r10, r15
mov r15, rcx
xchg r15, r10
test rdx, rdx
je 0x1401aab18
mov qword [rsp], rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1401aab0b
movzx eax, byte [r10]
test bl, bl
je 0x1401aaaed
lea rcx, [r9 - 1]
xchg rdx, rbp
mov rbp, r9
xchg rdx, rbp
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1401aaadc
jmp 0x1401aab0b
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1401aaafc
inc r10
sub r11, 1
jne 0x1401aaabe
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x1401afe60
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
xchg r10, r14
mov r14, qword [rcx]
xchg r10, r14
mov r9d, 0xb0f3841
xor r9d, 0x219e8ef8
add r9d, 0x436c2bf2
sub r9d, 0x6593d9dc
xor r9d, 0x496dbbce
sub r9d, 0x4107b091
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x1401afef2
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1401afead
mov ecx, dword [r10]
jmp 0x1401b0031
cmp ecx, 0x4e0
jb 0x1401b0031
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0x1ee2d07a
xor ebx, 0x6f44330a
sub ebx, 0x43ab9881
xor ebx, 0x2f3754a
add ebx, 0x3418719a
xor ebx, 0x6320b1dc
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401aff2f
lea r11, [r10 + 0xd50]
mov ebx, 0x314e3e0c
xor ebx, 0x46abc048
xor ebx, 0x6985a666
xor ebx, 0x31d2399b
sub ebx, 0x1a909da8
add ebx, 0x3f39f781
add ebx, 0x21715e80
xor ebx, 0x3b365e50
xor ebx, 0x4efb45ce
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401affb3
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 9
shr ecx, 1
shr ecx, 1
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 4
shl eax, 1
shl eax, 1
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 3
shl eax, 0xc
xor edx, eax
mov eax, edx
shr eax, 0xc
shr eax, 1
shr eax, 5
xor eax, edx
add rsp, 8
ret
Function at 0x1401b05e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x40]
mov rdi, rdx
xchg rcx, rbx
mov rcx, rbx
xchg rbx, rcx
mov byte [rax + rcx], 0
add byte [rax + rcx], 0x57
sub byte [rax + rcx], 0x3b
xor byte [rax + rcx], 0x1d
xor byte [rax + rcx], 2
add byte [rax + rcx], 0x5f
add byte [rax + rcx], 0x1c
xor byte [rax + rcx], 0x2a
add byte [rax + rcx], 0x2c
lea r8d, [rax + 1]
cmp eax, 0x38
jae 0x1401b0674
cmp r8d, 0x38
jae 0x1401b06f7
mov ecx, r8d
mov eax, 0x5af9d897
sub eax, 0x61c101d
xor eax, 0x3616d91b
xor eax, 0x337b8f01
xor eax, 0x7997a12
add eax, 0x1678b47f
sub eax, 0x6b91f9eb
xor eax, 0x1109f3e
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call fcn.1401fd756
jmp 0x1401b06f7
cmp r8d, 0x40
jae 0x1401b06be
mov ecx, r8d
mov eax, 0x5307d0c4
add eax, 0x2a54fa70
xor eax, 0x81d033
sub eax, 0x4e2e7b95
sub eax, 0x23331360
add eax, 0x459be6ee
xor eax, 0x4b186dbd
xor eax, 0x5582fa00
sub eax, 0x4c8de47d
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call fcn.1401fd756
xchg r10, rbx
mov rdx, r10
xchg rbx, r10
xchg rbp, rcx
mov rbp, rbx
xchg rbp, rcx
call fcn.1401b0a40
xorps xmm0, xmm0
xor eax, eax
xchg rbx, r13
movups xmmword [r13], xmm0
xchg r13, rbx
movups xmmword [rbx + 0x10], xmm0
xchg rdi, rbx
movups xmmword [rdi + 0x20], xmm0
xchg rbx, rdi
mov qword [rbx + 0x30], rax
mov edx, dword [rbx + 0x40]
xchg r11, rcx
mov r11, rbx
xchg rcx, r11
shl edx, 3
add rdx, qword [rbx + 0x48]
xchg r8, rax
mov r8, rdx
xchg r8, rax
mov qword [rbx + 0x48], rdx
shr rax, 1
shr rax, 5
shr rax, 1
shr rax, 1
mov byte [rbx + 0x3e], al
xchg rsi, rax
mov rsi, rdx
xchg rsi, rax
shr rax, 0xd
shr rax, 2
shr rax, 1
mov byte [rbx + 0x3d], al
mov rax, rdx
shr rax, 6
shr rax, 0x10
shr rax, 1
shr rax, 1
mov byte [rbx + 0x3c], al
xchg r15, rax
mov r15, rdx
xchg r15, rax
shr rax, 0xa
shr rax, 0xc
shr rax, 8
shr rax, 1
shr rax, 1
mov byte [rbx + 0x3b], al
xchg r14, rdx
mov rax, r14
xchg r14, rdx
shr rax, 0x15
shr rax, 0x12
shr rax, 1
mov byte [rbx + 0x3a], al
xchg rbx, rdx
mov rax, rbx
xchg rbx, rdx
mov byte [rbx + 0x3f], dl
shr rdx, 0x2c
shr rdx, 0xc
mov byte [rbx + 0x38], dl
xchg rdx, rbx
mov rbx, rdx
xchg rbx, rdx
shr rax, 0x30
mov byte [rbx + 0x39], al
call fcn.1401b0a40
xor r8d, r8d
lea rdx, [rdi + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbx + 0x50]
lea rdx, [rdx + 1]
mov ecx, 0x2849b286
xor ecx, 0x1b03dc36
sub ecx, 0xcbfce2d
xor ecx, 0x287ee819
xor ecx, 0x5d8f7033
sub ecx, 0xfafb779
xor ecx, 0x43cb8128
lea rdi, [rdi + 1]
sub ecx, r8d
add r8d, 8
shr eax, cl
mov byte [rdi - 1], al
mov eax, dword [rbx + 0x54]
shr eax, cl
mov byte [rdx - 5], al
mov eax, dword [rbx + 0x58]
shr eax, cl
mov byte [rdx - 1], al
mov eax, dword [rbx + 0x5c]
shr eax, cl
mov byte [rdx + 3], al
mov eax, dword [rbx + 0x60]
shr eax, cl
mov byte [rdx + 7], al
cmp r8d, 0x20
jb 0x1401b07c1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401fd0d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
push rbx
call 0x1407971d8
test rax, rax
je 0x1401fd11a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401fd11a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401fd11a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401fd11a
cmp dword [rcx + 0x84], 0xe
jbe 0x1401fd11a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401fd11c
xor al, al
add rsp, 0x28
ret

Function at 0x14022c570
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14022c59d
xor al, al
jmp 0x14022c6ff
mov rax, qword [0x14024b6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14024b6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14024b6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14024b6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14024b6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14024b6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14024b6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14024b6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14024b700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14022c6f1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14022c649
mov r11d, 2
jmp 0x14022c66d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14022c663
mov r11d, 1
jmp 0x14022c66d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14022c715
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14022c6b2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14022c6ca
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14022c6da
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14022c6e8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14022c630
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14022c6fa