joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013ec0
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140013cec

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002248]
mov r8d, 2
lea r9, str._J_ms8m
mov qword [rsp + 0x38], rax
lea rax, [0x140002238]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140026060
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x140026164
mov qword [rsp + 0x10], rbx
xchg rbx, rbp
mov qword [rsp + 0x18], rbx
xchg rbx, rbp
push rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
xchg rbx, r9
mov r9, rdx
xchg rbx, r9
xchg rdi, rcx
mov rcx, rdi
xchg rcx, rdi
mov esi, r8d
sub rdi, rdx
xchg r12, rbp
mov r12, rcx
xchg rbp, r12
add rdi, 0xf0
dec rsi
shr rsi, 1
shr rsi, 1
shr rsi, 2
inc rsi
nop dword [rax]
xchg rbx, rdi
movups xmm0, xmmword [rdi]
xchg rdi, rbx
xchg rbp, rdx
mov rbp, rdx
xchg rbp, rdx
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.140026830
mov ecx, 0x33145f0c
xor ecx, 0x44c699ed
sub ecx, 0x1c1bb96c
sub ecx, 0x47e1add2
add ecx, 0x8813ca
sub ecx, 0x145d735d
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x14002610e
nop
add rdi, 0x4e48e9e8
sub rdi, 0x4e48e9f8
xchg rbp, r8
movups xmmword [r8 + 0xf0], xmm0
xchg rbp, r8
sub rsi, 1
jne 0x1400260be
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
nop
mov rsi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140026170
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xchg rbp, rcx
mov qword [rsp + 0x10], rcx
xchg rbp, rcx
xchg r8, rsi
mov qword [rsp + 0x18], r8
xchg r8, rsi
push rdi
sub rsp, 0x20
mov edi, r8d
xchg rbx, r12
mov r12, rdx
xchg rbx, r12
lea r9, [rcx + 0xf0]
xchg rsi, rcx
mov rcx, rsi
xchg rsi, rcx
test r8d, r8d
je 0x140026241
dec rdi
shr rdi, 2
shr rdi, 2
inc rdi
nop dword [rax]
nop word [rax + rax]
xchg rbx, rsi
mov rax, rsi
xchg rsi, rbx
sub r9, rbx
mov edx, 0xd41770c
add edx, 0x50ecda21
add edx, 0x1107e9ff
sub edx, 0x585d635f
add edx, 0x3a888f55
sub edx, 0x51616712
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x140026204
xchg r8, rdx
mov r8, rsi
xchg rdx, r8
xchg rsi, rbx
mov rcx, rsi
xchg rbx, rsi
call fcn.1400262f0
mov r9, rbx
sub rbx, 0xfffffffffffffff0
sub rdi, 1
jne 0x1400261d0
xchg r9, rdx
movups xmm0, xmmword [rdx]
xchg r9, rdx
xchg rsi, rbx
mov rsi, qword [rsp + 0x30]
xchg rbx, rsi
mov rbp, qword [rsp + 0x38]
xchg rsi, rdi
movups xmmword [rdi + 0xf0], xmm0
xchg rdi, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140027a00
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x10
mov rbx, rdx
xchg r10, r8
mov r8, rcx
xchg r10, r8
test r8b, 0xf
je 0x140027a3e
xor al, al
mov rbx, qword [rsp + 0x20]
add rsp, 0x10
nop
add rsp, 8
xchg qword [rsp - 8], rdi
nop
add rsp, 8
jmp qword [rsp - 8]
xor edx, edx
test r8d, r8d
je 0x140027aed
movdqa xmm2, xmmword [rsp]
nop
xchg rdx, rbp
movdqu xmm1, xmmword [rbp + rbx]
xchg rdx, rbp
test edx, edx
jne 0x140027a71
xchg r10, rbx
movdqu xmm2, xmmword [rbx + 0x200]
xchg rbx, r10
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
pxor xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0x50682640
sub ecx, 0x33049d48
add ecx, 0x1e1fe894
add ecx, 0x445829f2
sub ecx, 0x6422e2fc
xor ecx, 0x1bb8b88f
nop dword [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027aad
aesdeclast xmm0, xmmword [r10 + 0x1e0]
pxor xmm0, xmm2
movdqa xmm2, xmm1
movups xmmword [rdx + r9], xmm0
nop
add edx, 0x5bb5d459
sub edx, 0x5bb5d449
cmp edx, r8d
jb 0x140027a4f
xchg r12, rbx
mov r12, qword [rsp + 0x20]
xchg r12, rbx
mov al, 0x1c
sub al, 7
add al, 0x19
add al, 0x3a
sub al, 0x10
sub al, 0x40
sub al, 0x17
add rsp, 0x10
push rbx
push rbx
push rbx
xchg qword [rsp + 0x18], rdi
pop rbx
pop rbx
pop rbx
add rsp, 8
ret

Function at 0x140027b20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x10
xchg rdx, rdi
mov rbx, rdi
xchg rdi, rdx
xchg rcx, r9
mov r10, r9
xchg rcx, r9
test r8b, 0xf
je 0x140027b5a
xor al, al
add rsp, 0x10
nop
xchg qword [rsp], rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
xor edx, edx
test r8d, r8d
je 0x140027c10
movdqa xmm0, xmmword [rsp]
mov qword [rsp + 0x20], rdi
nop dword [rax + rax]
xchg rdi, rdx
movdqu xmm1, xmmword [rdi + rbx]
xchg rdi, rdx
test edx, edx
jne 0x140027b95
xchg r10, rdi
movdqu xmm0, xmmword [rdi + 0x200]
xchg r10, rdi
pxor xmm0, xmm1
lea rax, [r10 + 0x10]
pxor xmm0, xmmword [r10 + 0x1e0]
mov ecx, 0x49bf81c
add ecx, 0xbfc9350
add ecx, 0x9b888fb
add ecx, 0x2948ba14
sub ecx, 0x1bac34f4
xor ecx, 0x27ed998a
nop dword [rax + rax]
aesenc xmm0, xmmword [rax]
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x140027bd1
aesenclast xmm0, xmmword [r10 + 0xe0]
xchg r15, rdx
movups xmmword [r15 + r9], xmm0
xchg r15, rdx
add edx, 0x10
cmp edx, r8d
jb 0x140027b74
xchg rdi, rdx
mov rdx, qword [rsp + 0x20]
xchg rdx, rdi
mov al, 0x78
add al, 4
sub al, 0xd
sub al, 0x18
sub al, 0x33
sub al, 0x23
add rsp, 0x10
nop
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x1400289b0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rbp
mov qword [rsp + 8], rbp
xchg rbx, rbp
mov qword [rsp + 0x10], rsi
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg r9, r8
mov rbx, r9
xchg r9, r8
xchg r15, rdi
mov r15, rdx
xchg rdi, r15
mov rsi, rcx
jne 0x140028a42
nop
xchg r14, r8
mov r14, qword [rbx + 0x10]
xchg r14, r8
mov rdx, rdi
xchg r14, rcx
mov r14, rsi
xchg rcx, r14
call fcn.1400289b0
mov rcx, rbx
mov edx, 0x285e7c09
add edx, 0x1d0e4e10
add edx, 0x2c032fb9
sub edx, 0x6fd844dd
add edx, 0x359c0e4b
xor edx, 0x3733c370
mov rbx, qword [rbx]
call fcn.1401fd08c
cmp byte [rbx + 0x19], 0
je 0x1400289ef
mov rbx, qword [rsp + 0x30]
xchg r10, rsi
mov r10, qword [rsp + 0x38]
xchg r10, rsi
add rsp, 0x20
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140029930
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 8], r12
xchg r12, rbx
push rdi
sub rsp, 0x20
xchg r15, rcx
mov rdi, r15
xchg r15, rcx
xor ebx, ebx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1400299b4
xchg r11, rdx
mov r11, qword [rdi + 0x28]
xchg rdx, r11
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1400299a3
mov r8, qword [rcx - 8]
nop
add rdx, 0x5e3bc101
sub rdx, 0x5e3bc0da
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140029a67
xchg rcx, r14
mov r14, r8
xchg rcx, r14
call fcn.1401fd08c
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x20], rbx
mov qword [rdi + 0x28], rbx
xchg rcx, r15
mov r15, qword [rdi + 8]
xchg rcx, r15
mov rax, qword [rcx + 8]
mov qword [rax], rbx
mov rcx, qword [rcx]
test rcx, rcx
je 0x140029a22
nop dword [rax + rax]
mov rbx, qword [rcx]
mov edx, 0x2fb4de47
add edx, 0x41df6e1a
sub edx, 0x311aca35
sub edx, 0x18470617
add edx, 0x473e4795
xor edx, 0x541b0f97
sub edx, 0x223d9694
add edx, 0x4db0cf59
sub edx, 0x66df04ea
call fcn.1401fd08c
mov rcx, rbx
test rbx, rbx
jne 0x1400299d9
xchg rcx, rbx
mov rbx, qword [rdi + 8]
xchg rcx, rbx
mov edx, 0x5ef1e9c7
sub edx, 0x9144f78
sub edx, 0x1e75d945
xor edx, 0xac689a4
xor edx, 0x2dd58e0a
xor edx, 0x1074c6bc
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
jmp fcn.1401fd08c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14002cb20
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
mov qword [rsp + 0x10], rbx
xchg rsi, rdx
mov qword [rsp + 0x18], rdx
xchg rsi, rdx
xchg r14, rdi
mov qword [rsp + 0x20], r14
xchg r14, rdi
nop
sub rsp, 8
mov qword [rsp], r14
sub rsp, 0x30
xchg r13, rcx
mov rsi, r13
xchg rcx, r13
mov rax, qword gs:[0x30]
xchg rsi, rdi
mov rsi, qword [rax + 0x60]
xchg rdi, rsi
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
mov qword [rsp + 0x40], rbx
neg rcx
add rcx, 0xffffffffffffff38
neg rcx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x5a7312b8
xor dword [rsp + 0x20], 0x11e6486c
add dword [rsp + 0x20], 0x2860cd67
sub dword [rsp + 0x20], 0x521e2d87
add dword [rsp + 0x20], 0x3e4d9a75
xor dword [rsp + 0x20], 0x640698b3
xor dword [rsp + 0x20], 0x435889d7
xor dword [rsp + 0x20], 0x6323e7af
sub dword [rsp + 0x20], 0x245863da
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b7a0
test eax, eax
js 0x14002cbfa
cmp qword [rsp + 0x40], rbx
je 0x14002cbfa
lea eax, [rbx + 1]
jmp 0x14002cd28
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x30]
cmp dword [rcx + 0x70], 2
jbe 0x14002cc39
mov eax, 0xaacb364
xor eax, 0x5d8ef215
xor eax, 0x17ac9444
add eax, 0x78e1c2a
add eax, 0x447c0d3
add eax, 0x177ebad
xor eax, 0x4ddc9ddd
jmp 0x14002cd28
cmp dword [rcx + 0x74], ebx
jbe 0x14002cc74
mov eax, 0x4d9b2ec2
sub eax, 0x27598f28
sub eax, 0x1d9dad73
add eax, 0x2b340701
add eax, 0x28abb22b
add eax, 0x16c1ee08
xor eax, 0x5f7e1585
xor eax, 0xe06e041
xor eax, 0x223d6c9c
jmp 0x14002cd28
cmp byte [rdi + 2], bl
je 0x14002cca0
mov eax, 0x2400819d
sub eax, 0x7028260
sub eax, 0x193f06a1
xor eax, 0x4f51be9a
xor eax, 0x1ceed24a
sub eax, 0x50019448
jmp 0x14002cd28
cmp r14d, 0xa
jb 0x14002cce7
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002cce7
mov eax, 0x19a10eda
add eax, 0x13da8347
add eax, 0x47290a04
sub eax, 0x10b67dc2
sub eax, 0x5db6b7
xor eax, 0x20f414b3
xor eax, 0x43647317
jmp 0x14002cd28
lea rcx, [rsi + 0xb8]
mov edx, 0x5c60ff73
sub edx, 0x5983336
add edx, 0x23eba57d
sub edx, 0x4d15ee20
add edx, 0x11fee13f
sub edx, 0x2001eae7
add edx, 0x79fe1fa7
call fcn.14002c0a0
jmp 0x14002cd26
mov eax, ebx
xchg r12, rbx
mov r12, qword [rsp + 0x48]
xchg r12, rbx
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
push rbx
push rax
push rcx
push rax
push rcx
push rcx
push rbx
xchg qword [rsp + 0x38], r14
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140033c50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
xchg r8, rbp
mov qword [rsp + 0x18], r8
xchg r8, rbp
nop
sub rsp, 8
mov qword [rsp], rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
xchg r10, r8
mov rbx, r10
xchg r8, r10
xchg r10, rdx
mov rsi, r10
xchg r10, rdx
xchg rbp, rdx
mov rdx, rcx
xchg rdx, rbp
jne 0x140033d20
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
xchg r12, r8
mov r12, qword [rbx + 0x10]
xchg r8, r12
xchg rdx, r11
mov r11, rsi
xchg r11, rdx
mov rcx, rbp
call fcn.140033c50
mov rdi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004cca0
mov edx, 0x2fb85aed
xor edx, 0x1624c99b
xor edx, 0x55a49854
xor edx, 0x6337479a
xor edx, 0x34651b3d
xor edx, 0x6eab9d05
xor edx, 0x2fab1987
xor edx, 0x42d23227
xor edx, 0x38b8e170
mov rcx, rdi
call fcn.1401fd08c
cmp byte [rbx + 0x19], 0
je 0x140033ca4
xchg r14, rdi
mov r14, qword [rsp + 0x30]
xchg r14, rdi
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
push rax
push rdx
xchg qword [rsp + 0x10], rsi
add rsp, 0x18
ret

Function at 0x140033d40
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r12
mov qword [rsp + 0x10], r12
xchg rbx, r12
mov qword [rsp + 0x18], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
sub rsp, 0x20
cmp byte [r8 + 0x19], 0
mov rbx, r8
xchg rsi, rdx
mov rdx, rsi
xchg rsi, rdx
xchg r11, rcx
mov rbp, r11
xchg r11, rcx
jne 0x140033e04
mov qword [rsp + 0x30], rdi
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [rbx + 0x10]
xchg rsi, r8
mov rdx, r8
xchg rsi, r8
mov rcx, rbp
call fcn.140033d40
xchg rcx, rdi
mov rcx, rbx
xchg rcx, rdi
mov rbx, qword [rbx]
lea rcx, [rdi + 0x20]
call fcn.14004cca0
mov edx, 0x1bb4e1f
xor edx, 0x15d913d5
add edx, 0x40e581b6
xor edx, 0x29a7c467
sub edx, 0x6f331631
xor edx, 0x43ce1b04
sub edx, 0x4e631e62
xchg rcx, rdi
mov rdi, rcx
xchg rcx, rdi
call fcn.1401fd08c
cmp byte [rbx + 0x19], 0
je 0x140033d8e
xchg rdi, r9
mov r9, qword [rsp + 0x30]
xchg rdi, r9
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
nop
xchg qword [rsp], rsi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x140035a50
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, rdi
mov qword [rsp + 8], rdi
xchg rdi, rcx
nop
sub rsp, 8
mov qword [rsp], rbx
nop
sub rsp, 8
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
push r12
nop
mov qword [rsp - 8], r13
sub rsp, 8
push r14
nop
mov qword [rsp - 8], r15
sub rsp, 8
sub rsp, 0x30
mov r15, rdx
xchg r15, rcx
mov r14, r15
xchg rcx, r15
movabs rsi, 0xfffffff780e0255
sub rsi, 0x69a8e914
xor rsi, 0xcc3a035
add rsi, 0x21b6e80d
xor rsi, 0x2fefabc8
add rsi, 0x5c4bfcb9
add rsi, 0x7fffffff
xor rsi, 0x1801f8fe
cmp rdx, rsi
ja 0x140035cae
xchg r12, rsi
mov rsi, qword [rcx + 8]
xchg r12, rsi
sub r12, qword [rcx]
sar r12, 2
sar r12, 1
sar r12, 1
mov rcx, qword [rcx + 0x10]
sub rcx, qword [r14]
sar rcx, 2
sar rcx, 1
sar rcx, 1
xchg rcx, r15
mov rdx, r15
xchg rcx, r15
shr rdx, 1
xchg r14, rax
mov r14, rsi
xchg r14, rax
sub rax, rdx
cmp rcx, rax
ja 0x140035b34
lea rsi, [rdx + rcx]
cmp rsi, r15
cmovb rsi, r15
xchg r8, rsi
mov qword [rsp + 0x88], r8
xchg r8, rsi
xchg r11, rsi
mov rdx, r11
xchg r11, rsi
xchg rcx, r8
mov r8, r14
xchg rcx, r8
call fcn.1400537a0
xchg r13, rax
mov rax, r13
xchg r13, rax
mov qword [rsp + 0x28], rax
xchg rcx, rbx
mov rcx, r12
xchg rcx, rbx
shl rbx, 1
shl rbx, 1
shl rbx, 1
shl rbx, 1
add rbx, rax
xchg r9, rbx
mov qword [rsp + 0x20], r9
xchg rbx, r9
mov rdi, r15
sub rdi, r12
mov qword [rsp + 0x78], rbx
je 0x140035be8
nop word [rax + rax]
mov byte [rbx], 0x5f
xor byte [rbx], 0x10
sub byte [rbx], 0x19
xor byte [rbx], 0x58
sub byte [rbx], 0x3a
sub byte [rbx], 2
sub byte [rbx], 0x32
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004bb00
nop
nop
sub rbx, 0x69a821d2
add rbx, 0x69a821e2
xchg r15, rbx
mov qword [rsp + 0x78], r15
xchg r15, rbx
sub rdi, 1
jne 0x140035ba3
mov r8, qword [r14 + 8]
xchg r13, rsi
mov rdx, rsi
xchg r13, rsi
mov rcx, qword [r14]
cmp rcx, r8
je 0x140035c29
xor r9d, r9d
movzx eax, byte [rcx]
mov byte [rdx], al
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov byte [rcx], r9b
mov qword [rcx + 8], r9
lea rdx, [rdx + 0x10]
add rcx, 0x10
cmp rcx, r8
jne 0x140035c04
xchg r9, rbx
mov rbx, rsi
xchg rbx, r9
xchg r15, rdx
mov r8, rdx
xchg r15, rdx
xchg r13, rdx
mov r13, rdx
xchg r13, rdx
xchg rcx, rbx
mov rbx, r14
xchg rcx, rbx
add rsp, 0x30
nop
add rsp, 8
xchg qword [rsp - 8], r15
nop
mov r14, qword [rsp]
add rsp, 8
nop
add rsp, 8
xchg qword [rsp - 8], r13
push rax
push rbx
xchg qword [rsp + 0x10], r12
pop rbx
pop rax
add rsp, 8
push rdx
push rdx
push rbx
push rbx
push rbx
push rbx
push rax
push rcx
xchg qword [rsp + 0x40], rdi
pop rcx
pop rax
pop rbx
pop rbx
pop rbx
pop rbx
pop rdx
pop rdx
add rsp, 8
nop
add rsp, 8
mov rsi, qword [rsp - 8]
push rcx
push rdx
xchg qword [rsp + 0x10], rbx
add rsp, 0x18
jmp fcn.140052930
call fcn.14002f9e0
int3
Function at 0x140035d30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xchg rdx, rdi
mov rdx, rdi
xchg rdi, rdx
xchg rbx, r15
mov r15, rcx
xchg rbx, r15
test rdx, rdx
je 0x140035d92
nop word [rax + rax]
mov byte [rbx], 0x38
xor byte [rbx], 0x16
add byte [rbx], 0x12
add byte [rbx], 6
xor byte [rbx], 0x20
xor byte [rbx], 0x61
sub byte [rbx], 7
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004bb00
nop
nop
sub rbx, 0x67b4d2d8
add rbx, 0x67b4d2e8
sub rdi, 1
jne 0x140035d5c
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rdx
push rax
push rbx
push rdx
push rax
push rdx
push rdx
push rax
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
ret
Function at 0x14004c300
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x42
xor byte [rcx + rax + 6], 0x55
add byte [rcx + rax + 6], 0x43
xor byte [rcx + rax + 6], 0x1b
sub byte [rcx + rax + 6], 0x17
xor byte [rcx + rax + 6], 0x39
xor byte [rcx + rax + 6], 0x28
sub byte [rcx + rax + 6], 0x16
sub byte [rcx + rax + 6], 0x25
inc rax
cmp rax, 8
jb 0x14004c302
ret

Function at 0x14004c340
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x6a
xor byte [rcx + rax + 6], 6
xor byte [rcx + rax + 6], 0x70
add byte [rcx + rax + 6], 0x42
sub byte [rcx + rax + 6], 0x5a
sub byte [rcx + rax + 6], 4
inc rax
cmp rax, 0xa
jb 0x14004c342
ret
Function at 0x140070f30
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
lea r10, [rsp + 0x3d]
mov r8d, edx
xchg rcx, rbx
mov rcx, rbx
xchg rbx, rcx
test edx, edx
jns 0x140070fd9
neg r8d
nop dword [rax + rax]
dec r10
mov eax, 0x1b0fa7f8
xor eax, 0x1ce1c31b
xor eax, 0x6228e05f
sub eax, 0x5a25fb5e
add eax, 0x23737956
sub eax, 0x95e1da8
xor eax, 0xe97929c1
mul r8d
shr edx, 1
shr edx, 2
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
sub r8b, 0xd0
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140070f5a
dec r10
mov byte [r10], 0x1b
xor byte [r10], 0x71
sub byte [r10], 0x48
add byte [r10], 0xb
add byte [r10], 0xa
add byte [r10], 0x3e
sub byte [r10], 0x48
jmp 0x140071028
dec r10
mov eax, 0xfd60eeb
add eax, 0x207d0019
add eax, 0x162ecd2c
sub eax, 0x10d4a66c
add eax, 0x1c17168a
xor eax, 0x53c0103c
xor eax, 0xcec890bf
mul r8d
shr edx, 1
shr edx, 2
movzx eax, dl
shl al, 1
shl al, 1
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140070fd9
lea r9, [rsp + 0x58]
xchg rcx, rdx
mov rcx, r10
xchg rdx, rcx
lea r8, [rsp + 0x3d]
xchg rbx, r14
mov rcx, r14
xchg r14, rbx
call fcn.1400300c0
xchg rdx, rbx
mov rax, rdx
xchg rbx, rdx
add rsp, 0x40
push rcx
push rax
xchg qword [rsp + 0x10], rbx
add rsp, 0x18
ret
Function at 0x140076220
Capabilities:
Encode data using xor

Disassembly:
mov r9, rcx
mov r8d, 0x1f9dc014
sub r8d, 0x8f87771
sub r8d, 0xbfa5d8c
add r8d, 0x740fad58
sub r8d, 0x386018ae
xor r8d, 0x5c3e99
add r8d, 0xb9f9bea7
test rcx, rcx
je 0x140076333
cmp byte [rcx], 0
je 0x140076333
test rdx, rdx
jne 0x1400762c1
nop
movabs rdx, 0xffffffff5e05b742
sub rdx, 0x4c8bf0a8
xor rdx, 0x1652a48
xor rdx, 0x5a7d1516
sub rdx, 0x3fd96afa
xor rdx, 0x33b47a18
add rdx, 0x7fffffff
add rdx, 0x46c30b2e
nop
inc rdx
cmp byte [rcx + rdx], 0
jne 0x1400762ab
test rdx, rdx
je 0x140076330
xor r10d, r10d
lea r11, [0x140002dd0]
nop dword [rax + rax]
movsx eax, byte [r9]
lea r9, [r9 + 1]
movzx ecx, r8b
inc r10d
push rcx
xor ecx, eax
push rcx
xor rcx, qword [rsp + 8]
shr rcx, 0x20
ror rax, 0x20
xor ecx, eax
ror rax, 0x20
shl rcx, 0x20
xor rcx, qword [rsp]
add rsp, 0x10
shr r8d, 4
shr r8d, 2
shr r8d, 1
shr r8d, 1
and ecx, 0x3ff
mov eax, r10d
xor r8d, dword [r11 + rcx*4]
xor r8d, 0x3948a593
cmp rax, rdx
jb 0x1400762d3
not r8d
mov eax, r8d
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14007aa00
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rsi
mov qword [rsp + 8], rsi
xchg rsi, rbx
nop
push 0x17051711
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdi, r14
mov r14, rdx
xchg rdi, r14
xchg rsi, rcx
mov rbx, rsi
xchg rcx, rsi
test rdx, rdx
jne 0x14007aa68
mov qword [rcx + 0x10], rdx
xchg rcx, rdx
mov rax, rdx
xchg rcx, rdx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
push rbx
push rdx
push rax
push rdx
push rdx
push rax
xchg qword [rsp + 0x30], rdi
pop rax
pop rdx
pop rdx
pop rax
pop rdx
pop rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
nop
movabs r8, 0xffffffff7de79426
sub r8, 0x68b846ba
add r8, 0x51d9d173
sub r8, 0x60f2098a
xor r8, 0x2cd5f7ca
xor r8, 0x3286bb01
xor r8, 0x305eef3c
add r8, 0x7fffffff
xor r8, 0x57e5495e
xchg r14, rcx
mov r14, r8
xchg rcx, r14
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x14007aab4
inc rcx
mov eax, 0x37366fd6
sub eax, 0x2c79256d
add eax, 0x4c77457c
sub eax, 0x41ad396f
xor eax, 0x717cf09c
sub eax, 0x45dc2adf
add eax, 0x4847db42
xor eax, 0x48718ca7
xor eax, 0x2f16dbe8
mul rcx
mov qword [rbx + 8], rcx
cmovo rax, r8
xchg rcx, r14
mov r14, rax
xchg r14, rcx
call fcn.1401fd094
mov r8, qword [rbx + 8]
xchg rdx, r11
mov r11, rdi
xchg rdx, r11
add r8, r8
xchg r15, rax
mov qword [rbx + 0x10], r15
xchg r15, rax
xchg rcx, rax
mov rax, rcx
xchg rcx, rax
call sub.VCRUNTIME140.dll_memcpy
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x8000ffff
jge 0x14007ab49
dec eax
or eax, 0xffff0000
inc eax
xor edx, edx
mov word [rbx + 2], ax
cmp qword [rbx + 8], rdx
jbe 0x14007ab77
nop
mov rax, qword [rbx + 0x10]
lea rcx, [rax + rdx*2]
movzx eax, word [rbx + 2]
xor word [rcx], ax
inc rdx
cmp rdx, qword [rbx + 8]
jb 0x14007ab5b
mov byte [rbx], 0x35
add byte [rbx], 0x17
sub byte [rbx], 0x18
xor byte [rbx], 0x2a
add byte [rbx], 0x50
sub byte [rbx], 0x62
xor byte [rbx], 0x2e
add byte [rbx], 7
sub byte [rbx], 0x29
xchg r11, rax
mov r11, rbx
xchg r11, rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rdi
ret

Function at 0x14007b1a0
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rax
mov r14, qword [rcx + 0x10]
xchg r14, rax
xchg rbx, rdx
mov rbx, rcx
xchg rdx, rbx
test rax, rax
jne 0x14007b1bd
xor r8d, r8d
mov eax, r8d
ret
cmp byte [rcx], 0
jne 0x14007b207
xor r8d, r8d
cmp qword [rcx + 8], r8
jbe 0x14007b1ef
xchg rbp, rax
mov rbp, qword [rdx + 0x10]
xchg rbp, rax
lea rcx, [rax + r8*2]
movzx eax, word [rdx + 2]
xor word [rcx], ax
inc r8
cmp r8, qword [rdx + 8]
jb 0x14007b1cb
xchg rsi, rax
mov rsi, qword [rdx + 0x10]
xchg rsi, rax
mov byte [rdx], 0x6c
xor byte [rdx], 0x12
sub byte [rdx], 0x3a
add byte [rdx], 0x25
sub byte [rdx], 0x2f
add byte [rdx], 0x42
sub byte [rdx], 0x74
sub byte [rdx], 7
ret