joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002bc80
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x210
call fcn.14000e810
cmp byte [rax], 0
je 0x14002bcef
xor edx, edx
mov ecx, 0x210
call fcn.140010970
test al, al
je 0x14002bcef
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14002bcef
mov rbx, qword [0x1400e0190]
cmp byte [rbx + 0x37a9], 0
je 0x14002bcdb
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.140002970
mov dword [rbx + 0x380], 0x210
mov dword [rbx + 0x940], 0xa0
mov ecx, 0x214
call fcn.14000e810
cmp byte [rax], 0
je 0x14002bd58
xor edx, edx
mov ecx, 0x214
call fcn.140010970
test al, al
je 0x14002bd58
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14002bd58
mov rbx, qword [0x1400e0190]
cmp byte [rbx + 0x37a9], 0
je 0x14002bd44
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.140002970
mov dword [rbx + 0x384], 0x214
mov dword [rbx + 0x950], 0xa1
mov ecx, 0x212
call fcn.14000e810
cmp byte [rax], 0
je 0x14002bdc1
xor edx, edx
mov ecx, 0x212
call fcn.140010970
test al, al
je 0x14002bdc1
mov ecx, 0x5b
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14002bdc1
mov rbx, qword [0x1400e0190]
cmp byte [rbx + 0x37a9], 0
je 0x14002bdad
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.140002970
mov dword [rbx + 0x26c], 0x212
mov dword [rbx + 0x948], 0x5b
mov ecx, 0x216
call fcn.14000e810
cmp byte [rax], 0
je 0x14002be2a
xor edx, edx
mov ecx, 0x216
call fcn.140010970
test al, al
je 0x14002be2a
mov ecx, 0x5c
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x14002be2a
mov rbx, qword [0x1400e0190]
cmp byte [rbx + 0x37a9], 0
je 0x14002be16
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.140002970
mov dword [rbx + 0x270], 0x216
mov dword [rbx + 0x958], 0x5c
add rsp, 0x20
pop rbx
ret
Function at 0x1400306e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
lea rax, [rbp - 1]
mov qword [rbp + 0x1f], rax
movdqa xmm0, xmmword [0x14003c9f0]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x7f7643
xor r15d, r15d
mov eax, r15d
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rbp - 0x39]
xor byte [rbp + rax - 0x38], cl
inc rax
cmp rax, 0x12
jb 0x140030730
mov byte [rbp - 0x26], r15b
mov qword [rbp - 1], r15
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], 0xf
lea rax, [rbp - 0x38]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rax + r8], r15b
jne 0x140030763
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 1]
call fcn.140032560
lea rax, [rbp - 1]
mov qword [rbp + 0x27], rax
mov byte [rbp - 0x39], 7
mov al, 0x40
mov cl, 0x63
mov dl, 0x6e
mov r8b, 0x34
mov r9b, 0x35
mov r10b, 0x29
movzx r11d, cl
mov bl, 0x6b
movzx edi, bl
xor r14d, r14d
xor al, 7
mov byte [rbp - 0x38], al
xor cl, 7
mov byte [rbp - 0x37], cl
xor dl, 7
mov byte [rbp - 0x36], dl
xor r8b, 7
mov byte [rbp - 0x35], r8b
xor r9b, 7
mov byte [rbp - 0x34], r9b
xor r10b, 7
mov byte [rbp - 0x33], r10b
xor r11b, 7
mov byte [rbp - 0x32], r11b
xor bl, 7
mov byte [rbp - 0x31], bl
xor dil, 7
mov byte [rbp - 0x30], dil
mov byte [rbp - 0x2f], r14b
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], 0xf
lea rax, [rbp - 0x38]
inc rsi
cmp byte [rax + rsi], r14b
jne 0x1400307f7
mov r8, rsi
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x21]
call fcn.140032560
lea rax, [rbp - 0x21]
mov qword [rbp - 0x39], rax
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rdx, qword [rbp - 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [rsp + 0x28], 0x33
mov dword [rsp + 0x20], 0x33
xor edx, edx
xor ecx, ecx
mov r9d, 0x226
mov r8d, 0x320
call rax
mov rbx, rax
mov rdx, qword [rbp - 9]
cmp rdx, 0x10
jb 0x1400308a6
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400308a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400308a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003431c
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], 0xf
mov byte [rbp - 0x21], 0
mov rdx, qword [rbp + 0x17]
cmp rdx, 0x10
jb 0x1400308f4
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400308ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400308ef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003431c
mov rax, rbx
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x140030920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r12, rdx
mov r15, rcx
lea rax, [rbp - 0x30]
mov qword [rbp - 0x10], rax
mov cl, 0x1f
mov dword [rbp - 0x60], 0x6b7a4c1f
mov dword [rbp - 0x5c], 0x7b717648
mov dword [rbp - 0x58], 0x784d6870
mov word [rbp - 0x54], 0x71
xor edx, edx
mov eax, edx
nop dword [rax]
xor byte [rbp + rax - 0x5f], cl
inc rax
cmp rax, 0xc
jae 0x140030983
movzx ecx, byte [rbp - 0x60]
jmp 0x140030970
mov byte [rbp - 0x53], dl
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x18], 0xf
lea rax, [rbp - 0x5f]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], dl
jne 0x1400309a4
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x30]
call fcn.140032560
lea rax, [rbp - 0x30]
mov qword [rbp - 8], rax
mov byte [rbp - 0x60], 0xb
mov al, 0x5e
mov cl, 0x78
mov dl, 0x6e
mov r8b, 0x79
mov r9b, 0x38
mov r10b, 0x39
mov r11b, 0x25
mov bl, 0x6f
mov dil, 0x67
movzx esi, dil
xor r13d, r13d
xor al, 0xb
mov byte [rbp - 0x5f], al
xor cl, 0xb
mov byte [rbp - 0x5e], cl
xor dl, 0xb
mov byte [rbp - 0x5d], dl
xor r8b, 0xb
mov byte [rbp - 0x5c], r8b
xor r9b, 0xb
mov byte [rbp - 0x5b], r9b
xor r10b, 0xb
mov byte [rbp - 0x5a], r10b
xor r11b, 0xb
mov byte [rbp - 0x59], r11b
xor bl, 0xb
mov byte [rbp - 0x58], bl
xor dil, 0xb
mov byte [rbp - 0x57], dil
xor sil, 0xb
mov byte [rbp - 0x56], sil
mov byte [rbp - 0x55], r13b
xor edi, edi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], 0xf
lea rax, [rbp - 0x5f]
inc r14
cmp byte [rax + r14], dil
jne 0x140030a45
mov r8, r14
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x50]
call fcn.140032560
lea rax, [rbp - 0x50]
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
mov rdx, r12
mov rcx, r15
call rax
mov ebx, eax
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140030adc
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030ad7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140030ad7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003431c
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140030b2a
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030b25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140030b25
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003431c
mov eax, ebx
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140030b50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r15, rcx
lea rax, [rbp - 0x30]
mov qword [rbp - 0x10], rax
movdqa xmm0, xmmword [0x14003c6e0]
movdqu xmmword [rbp - 0x60], xmm0
xor r13d, r13d
mov eax, r13d
movzx ecx, byte [rbp - 0x60]
xor byte [rbp + rax - 0x5f], cl
inc rax
cmp rax, 0xe
jb 0x140030b90
mov byte [rbp - 0x51], r13b
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], 0xf
lea rax, [rbp - 0x5f]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], r13b
jne 0x140030bc3
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x30]
call fcn.140032560
lea rax, [rbp - 0x30]
mov qword [rbp - 8], rax
mov byte [rbp - 0x60], 0x34
mov al, 0x61
mov cl, 0x47
mov dl, 0x51
mov r8b, 0x46
mov r9b, 7
mov r10b, 6
mov r11b, 0x1a
mov bl, 0x50
mov dil, 0x58
movzx esi, dil
xor r12d, r12d
xor al, 0x34
mov byte [rbp - 0x5f], al
xor cl, 0x34
mov byte [rbp - 0x5e], cl
xor dl, 0x34
mov byte [rbp - 0x5d], dl
xor r8b, 0x34
mov byte [rbp - 0x5c], r8b
xor r9b, 0x34
mov byte [rbp - 0x5b], r9b
xor r10b, 0x34
mov byte [rbp - 0x5a], r10b
xor r11b, 0x34
mov byte [rbp - 0x59], r11b
xor bl, 0x34
mov byte [rbp - 0x58], bl
xor dil, 0x34
mov byte [rbp - 0x57], dil
xor sil, 0x34
mov byte [rbp - 0x56], sil
mov byte [rbp - 0x55], r12b
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], 0xf
lea rax, [rbp - 0x5f]
inc r14
cmp byte [rax + r14], r12b
jne 0x140030c62
mov r8, r14
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x50]
call fcn.140032560
lea rax, [rbp - 0x50]
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, 0xffffffec
mov rcx, r15
call rax
mov ebx, eax
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140030cf8
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030cf3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140030cf3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003431c
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140030d46
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030d41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140030d41
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003431c
mov eax, ebx
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140030d70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r12d, r8d
mov r15, rcx
lea rax, [rbp - 0x30]
mov qword [rbp - 0x10], rax
movdqa xmm0, xmmword [str.1bTEfX_UF_Vp]
movdqu xmmword [rbp - 0x60], xmm0
xor edx, edx
mov eax, edx
nop dword [rax]
movzx ecx, byte [rbp - 0x60]
xor byte [rbp + rax - 0x5f], cl
inc rax
cmp rax, 0xe
jb 0x140030db0
mov byte [rbp - 0x51], dl
mov qword [rbp - 0x30], rdx
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x18], 0xf
lea rax, [rbp - 0x5f]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], dl
jne 0x140030de2
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x30]
call fcn.140032560
lea rax, [rbp - 0x30]
mov qword [rbp - 8], rax
mov byte [rbp - 0x60], 0x52
mov al, 7
mov cl, 0x21
mov dl, 0x37
mov r8b, 0x20
mov r9b, 0x61
mov r10b, 0x60
mov r11b, 0x7c
mov bl, 0x36
mov dil, 0x3e
movzx esi, dil
xor r13d, r13d
xor al, 0x52
mov byte [rbp - 0x5f], al
xor cl, 0x52
mov byte [rbp - 0x5e], cl
xor dl, 0x52
mov byte [rbp - 0x5d], dl
xor r8b, 0x52
mov byte [rbp - 0x5c], r8b
xor r9b, 0x52
mov byte [rbp - 0x5b], r9b
xor r10b, 0x52
mov byte [rbp - 0x5a], r10b
xor r11b, 0x52
mov byte [rbp - 0x59], r11b
xor bl, 0x52
mov byte [rbp - 0x58], bl
xor dil, 0x52
mov byte [rbp - 0x57], dil
xor sil, 0x52
mov byte [rbp - 0x56], sil
mov byte [rbp - 0x55], r13b
xor edi, edi
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], 0xf
lea rax, [rbp - 0x5f]
inc r14
cmp byte [rax + r14], dil
jne 0x140030e83
mov r8, r14
lea rdx, [rbp - 0x5f]
lea rcx, [rbp - 0x50]
call fcn.140032560
lea rax, [rbp - 0x50]
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8d, r12d
mov edx, 0xffffffec
mov rcx, r15
call rax
mov ebx, eax
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x140030f1c
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030f17
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140030f17
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003431c
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140030f6a
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030f65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140030f65
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003431c
mov eax, ebx
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140031350
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov r15d, ecx
lea rax, [rbp - 1]
mov qword [rbp + 0x1f], rax
movdqa xmm0, xmmword [0x14003c720]
movdqu xmmword [rbp - 0x39], xmm0
mov word [rbp - 0x29], 0x2b
xor r13d, r13d
mov eax, r13d
nop dword [rax + rax]
movzx ecx, byte [rbp - 0x39]
xor byte [rbp + rax - 0x38], cl
inc rax
cmp rax, 0x10
jb 0x1400313a0
mov byte [rbp - 0x28], r13b
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], 0xf
lea rax, [rbp - 0x38]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], r13b
jne 0x1400313d3
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 1]
call fcn.140032560
lea rax, [rbp - 1]
mov qword [rbp + 0x27], rax
mov byte [rbp - 0x39], 0x17
mov al, 0x42
mov cl, 0x64
mov dl, 0x72
mov r8b, 0x65
mov r9b, 0x24
mov r10b, 0x25
mov r11b, 0x39
mov bl, 0x73
mov dil, 0x7b
movzx esi, dil
xor r12d, r12d
xor al, 0x17
mov byte [rbp - 0x38], al
xor cl, 0x17
mov byte [rbp - 0x37], cl
xor dl, 0x17
mov byte [rbp - 0x36], dl
xor r8b, 0x17
mov byte [rbp - 0x35], r8b
xor r9b, 0x17
mov byte [rbp - 0x34], r9b
xor r10b, 0x17
mov byte [rbp - 0x33], r10b
xor r11b, 0x17
mov byte [rbp - 0x32], r11b
xor bl, 0x17
mov byte [rbp - 0x31], bl
xor dil, 0x17
mov byte [rbp - 0x30], dil
xor sil, 0x17
mov byte [rbp - 0x2f], sil
mov byte [rbp - 0x2e], r12b
mov qword [rbp - 0x21], r13
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], 0xf
lea rax, [rbp - 0x38]
inc r14
cmp byte [rax + r14], r12b
jne 0x140031472
mov r8, r14
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x21]
call fcn.140032560
lea rax, [rbp - 0x21]
mov qword [rbp - 0x39], rax
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rdx, qword [rbp - 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, r15d
call rax
mov ebx, eax
mov rdx, qword [rbp - 9]
cmp rdx, 0x10
jb 0x140031503
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400314fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400314fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003431c
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], 0xf
mov byte [rbp - 0x21], 0
mov rdx, qword [rbp + 0x17]
cmp rdx, 0x10
jb 0x140031551
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003154c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003154c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003431c
mov eax, ebx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140031580
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov r15, rcx
lea rax, [rbp - 1]
mov qword [rbp + 0x1f], rax
movdqa xmm0, xmmword [0x14003ca10]
movdqu xmmword [rbp - 0x39], xmm0
mov word [rbp - 0x29], 0x4d
xor r13d, r13d
mov eax, r13d
nop dword [rax + rax]
movzx ecx, byte [rbp - 0x39]
xor byte [rbp + rax - 0x38], cl
inc rax
cmp rax, 0x10
jb 0x1400315d0
mov byte [rbp - 0x28], r13b
mov qword [rbp - 1], r13
mov qword [rbp + 0xf], r13
mov qword [rbp + 0x17], 0xf
lea rax, [rbp - 0x38]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], r13b
jne 0x140031603
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 1]
call fcn.140032560
lea rax, [rbp - 1]
mov qword [rbp + 0x27], rax
mov byte [rbp - 0x39], 0x5f
mov al, 0xa
mov cl, 0x2c
mov dl, 0x3a
mov r8b, 0x2d
mov r9b, 0x6c
mov r10b, 0x6d
mov r11b, 0x71
mov bl, 0x3b
mov dil, 0x33
movzx esi, dil
xor r12d, r12d
xor al, 0x5f
mov byte [rbp - 0x38], al
xor cl, 0x5f
mov byte [rbp - 0x37], cl
xor dl, 0x5f
mov byte [rbp - 0x36], dl
xor r8b, 0x5f
mov byte [rbp - 0x35], r8b
xor r9b, 0x5f
mov byte [rbp - 0x34], r9b
xor r10b, 0x5f
mov byte [rbp - 0x33], r10b
xor r11b, 0x5f
mov byte [rbp - 0x32], r11b
xor bl, 0x5f
mov byte [rbp - 0x31], bl
xor dil, 0x5f
mov byte [rbp - 0x30], dil
xor sil, 0x5f
mov byte [rbp - 0x2f], sil
mov byte [rbp - 0x2e], r12b
mov qword [rbp - 0x21], r13
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], 0xf
lea rax, [rbp - 0x38]
inc r14
cmp byte [rax + r14], r12b
jne 0x1400316a2
mov r8, r14
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x21]
call fcn.140032560
lea rax, [rbp - 0x21]
mov qword [rbp - 0x39], rax
lea rcx, [rbp - 0x21]
cmp qword [rbp - 9], 0x10
cmovae rcx, qword [rbp - 0x21]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 0x10
cmovae rdx, qword [rbp - 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, r15
call rax
movzx ebx, ax
mov rdx, qword [rbp - 9]
cmp rdx, 0x10
jb 0x140031734
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003172f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003172f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003431c
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], 0xf
mov byte [rbp - 0x21], 0
mov rdx, qword [rbp + 0x17]
cmp rdx, 0x10
jb 0x140031782
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003177d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003177d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003431c
movzx eax, bx
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140031a00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0x90
mov r12, rdx
mov r15, rcx
lea rax, [rbp - 0x11]
mov qword [rbp + 0xf], rax
movdqa xmm0, xmmword [0x14003c9e0]
movdqu xmmword [rbp - 0x49], xmm0
mov word [rbp - 0x39], 0x51
xor edx, edx
mov eax, edx
movzx ecx, byte [rbp - 0x49]
xor byte [rbp + rax - 0x48], cl
inc rax
cmp rax, 0x10
jb 0x140031a41
mov byte [rbp - 0x38], dl
mov qword [rbp - 0x11], rdx
mov qword [rbp - 1], rdx
mov qword [rbp + 7], 0xf
lea rax, [rbp - 0x48]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], dl
jne 0x140031a73
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x11]
call fcn.140032560
lea rax, [rbp - 0x11]
mov qword [rbp + 0x17], rax
mov byte [rbp - 0x49], 0x1b
mov al, 0x4e
mov cl, 0x68
mov dl, 0x7e
mov r8b, 0x69
mov r9b, 0x28
mov r10b, 0x29
mov r11b, 0x35
mov bl, 0x7f
mov dil, 0x77
movzx esi, dil
xor r13d, r13d
xor al, 0x1b
mov byte [rbp - 0x48], al
xor cl, 0x1b
mov byte [rbp - 0x47], cl
xor dl, 0x1b
mov byte [rbp - 0x46], dl
xor r8b, 0x1b
mov byte [rbp - 0x45], r8b
xor r9b, 0x1b
mov byte [rbp - 0x44], r9b
xor r10b, 0x1b
mov byte [rbp - 0x43], r10b
xor r11b, 0x1b
mov byte [rbp - 0x42], r11b
xor bl, 0x1b
mov byte [rbp - 0x41], bl
xor dil, 0x1b
mov byte [rbp - 0x40], dil
xor sil, 0x1b
mov byte [rbp - 0x3f], sil
mov byte [rbp - 0x3e], r13b
xor edi, edi
mov qword [rbp - 0x31], rdi
mov qword [rbp - 0x21], rdi
mov qword [rbp - 0x19], 0xf
lea rax, [rbp - 0x48]
inc r14
cmp byte [rax + r14], dil
jne 0x140031b14
mov r8, r14
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x31]
call fcn.140032560
lea rax, [rbp - 0x31]
mov qword [rbp - 0x49], rax
lea rcx, [rbp - 0x31]
cmp qword [rbp - 0x19], 0x10
cmovae rcx, qword [rbp - 0x31]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rdx, qword [rbp - 0x11]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdx, r12
mov rcx, r15
call rax
mov ebx, eax
mov rdx, qword [rbp - 0x19]
cmp rdx, 0x10
jb 0x140031ba8
inc rdx
mov rcx, qword [rbp - 0x31]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031ba3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140031ba3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003431c
mov qword [rbp - 0x21], rdi
mov qword [rbp - 0x19], 0xf
mov byte [rbp - 0x31], 0
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x140031bf6
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031bf1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140031bf1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14003431c
mov eax, ebx
mov rbx, qword [rsp + 0xe0]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret