joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140084180
Capabilities:
Encode data using xor

Disassembly:
mov rax, r8
cmp rcx, rdx
je 0x1400842d3
xchg r9, rax
mov rax, r9
xchg r9, rax
lea r8, [rcx + 0x38]
sub r9, rcx
xor r10d, r10d
nop dword [rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x48]
xchg rsi, rax
movups xmmword [rsi], xmm0
xchg rsi, rax
xchg r15, r10
mov qword [r9 + r8 - 0x70], r15
xchg r15, r10
mov qword [r9 + r8 - 0x68], r10
xchg r8, r10
movups xmm0, xmmword [r10 - 0x80]
xchg r8, r10
movups xmmword [rax], xmm0
movups xmm1, xmmword [r8 - 0x70]
xorps xmm0, xmm0
xchg r14, rax
movups xmmword [r14 + 0x10], xmm1
xchg r14, rax
mov qword [r8 - 0x70], r10
nop
add rax, 0x6f3ab2d8
sub rax, 0x6f3ab290
mov qword [r8 - 0x68], 0x14ac08ea
xor qword [r8 - 0x68], 0x550c75e
sub qword [r8 - 0x68], 0x175e7ef
add qword [r8 - 0x68], 0x498936ef
xor qword [r8 - 0x68], 0x74d5c85f
xor qword [r8 - 0x68], 0x2ec5d6ec
mov word [r8 - 0x80], r10w
xchg r10, r9
movups xmmword [r10 + r8 - 0x60], xmm0
xchg r10, r9
mov qword [r9 + r8 - 0x50], r10
xchg r10, r15
mov qword [r9 + r8 - 0x48], r15
xchg r10, r15
xchg r12, r8
movups xmm0, xmmword [r12 - 0x60]
xchg r12, r8
movups xmmword [r9 + r8 - 0x60], xmm0
xchg r8, r13
movups xmm1, xmmword [r13 - 0x50]
xchg r8, r13
xchg rdx, r9
movups xmmword [rdx + r8 - 0x50], xmm1
xchg rdx, r9
mov qword [r8 - 0x50], r10
mov qword [r8 - 0x48], 0x45b3003f
xor qword [r8 - 0x48], 0x6ce79625
add qword [r8 - 0x48], 0x54009b2e
sub qword [r8 - 0x48], 0x6c00c6fd
add qword [r8 - 0x48], 0x477bc0be
xor qword [r8 - 0x48], 0x7985c675
sub qword [r8 - 0x48], 0xe9a8432
xor qword [r8 - 0x48], 0x33ed970f
sub qword [r8 - 0x48], 0x2156fe3e
mov word [r8 - 0x60], r10w
mov ecx, dword [r8 - 0x40]
mov dword [r9 + r8 - 0x40], ecx
lea rcx, [r8 - 0x38]
cmp rcx, rdx
jne 0x1400841a4
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x1400843f0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, rax
mov rbx, r8
xchg rbx, rax
cmp rcx, rdx
je 0x1400844a6
xchg rbp, rax
mov r9, rbp
xchg rbp, rax
lea r8, [rcx + 0x18]
sub r9, rcx
xor r10d, r10d
nop word [rax + rax]
xorps xmm0, xmm0
lea r8, [r8 + 0x20]
xchg r11, rax
movups xmmword [r11], xmm0
xchg r11, rax
mov qword [r9 + r8 - 0x28], r10
lea rcx, [r8 - 0x18]
xchg r13, r10
mov qword [r8 + r9 - 0x20], r13
xchg r13, r10
movups xmm0, xmmword [r8 - 0x38]
xchg r11, rax
movups xmmword [r11], xmm0
xchg r11, rax
xchg r9, r8
movups xmm1, xmmword [r9 - 0x28]
xchg r8, r9
xchg r15, rax
movups xmmword [r15 + 0x10], xmm1
xchg r15, rax
mov qword [r8 - 0x28], r10
add rax, 0x20
mov qword [r8 - 0x20], 0x5bb7bded
xor qword [r8 - 0x20], 0x1028c55b
sub qword [r8 - 0x20], 0x405cf487
add qword [r8 - 0x20], 0x12ca5020
add qword [r8 - 0x20], 0x1978c77f
sub qword [r8 - 0x20], 0x37859bc7
mov word [r8 - 0x38], r10w
cmp rcx, rdx
jne 0x14008441c
ret
Function at 0x14008e7a0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0xa], 0x37
sub byte [rcx + rax + 0xa], 0x1f
sub byte [rcx + rax + 0xa], 0xc
add byte [rcx + rax + 0xa], 0x5c
sub byte [rcx + rax + 0xa], 0x1f
sub byte [rcx + rax + 0xa], 0x10
add byte [rcx + rax + 0xa], 0x1f
xor byte [rcx + rax + 0xa], 0x75
sub byte [rcx + rax + 0xa], 0x2d
inc rax
cmp rax, 0x10
jb 0x14008e7a2
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14008e8d0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 0x14], 0x4e
sub byte [rcx + rax + 0x14], 0x25
sub byte [rcx + rax + 0x14], 4
add byte [rcx + rax + 0x14], 9
add byte [rcx + rax + 0x14], 0x2e
xor byte [rcx + rax + 0x14], 0x4c
xor byte [rcx + rax + 0x14], 0x10
inc rax
cmp rax, 0x24
jb 0x14008e8d2
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1400f1010
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
nop
push r15
mov qword [rsp], rbp
nop
sub rsp, 8
mov qword [rsp], rsi
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x80
xchg rdi, r9
mov r9, rdi
xchg rdi, r9
mov esi, r8d
xchg rbx, rdx
mov rdx, rbx
xchg rbx, rdx
xor ebp, ebp
lea rcx, [rsp + 0x50]
call fcn.140049c10
mov dword [rsp + 0x70], esi
mov qword [rsp + 0x78], rdi
lea ecx, [rbp + 0x30]
call fcn.1401fc590
test rax, rax
je 0x1400f10ab
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rax + 0x10], xmm1
movdqa xmm0, xmmword [0x140002c70]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], bp
mov dword [rax + 0x20], esi
xchg r13, rdi
mov qword [rax + 0x28], r13
xchg r13, rdi
jmp 0x1400f10b2
xchg rbp, rax
mov rbp, rax
xchg rbp, rax
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0x38]
xchg rcx, rbx
mov qword [rsp + 0x28], rbx
xchg rcx, rbx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x140082180]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400f1188
cmp dword [rsp + 0x38], 0
je 0x1400f11bb
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x1400f1180
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x50]
call fcn.14002f7f0
nop
xchg r13, rbx
mov rcx, r13
xchg rbx, r13
xchg rbx, rbp
mov rbp, qword [rsp + 0xa0]
xchg rbx, rbp
add rsp, 0x80
push rax
xchg qword [rsp + 8], rdi
pop rax
add rsp, 8
push rbx
push rax
push rax
xchg qword [rsp + 0x18], rsi
pop rax
pop rax
pop rbx
add rsp, 8
push rdx
push rcx
push rdx
push rdx
push rbx
push rbx
push rdx
xchg qword [rsp + 0x38], rbp
pop rdx
pop rbx
pop rbx
pop rdx
pop rdx
pop rcx
pop rdx
add rsp, 8
jmp fcn.14002f7f0
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov dword [rsp + 0x38], ebp
mov ecx, 0x5c61eaed
xor ecx, 0x38f9224e
sub ecx, 0x35b19a4
sub ecx, 0x56ac174c
add ecx, 0x1da6b430
add ecx, 0x4ce5c787
xor ecx, 0x751e136c
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 0xf5432f5
xor ecx, 0x57335130
xor ecx, 0x5aaabf54
add ecx, 0x670b6ce
add ecx, 0x1535ba80
add ecx, 0x7d536f
sub ecx, 0x1ef1a14d
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x140174070
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
xchg rcx, r8
mov rbx, r8
xchg rcx, r8
je 0x140174245
cmp byte [rcx + 0x72], 0
je 0x140174245
xchg r14, rax
mov r14, qword [rcx]
xchg r14, rax
mov qword [rsp + 0x68], rdi
mov edi, 0x5b0cc9d1
sub edi, 0x56f09204
add edi, 0x34df2a6a
xor edi, 0x425c7c43
sub edi, 0x66a16355
add edi, 0x27788dbd
xor edi, 0x2c4136e9
sub edi, 0x173e7e36
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140174222
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140174169
sub eax, 1
je 0x14017418d
cmp eax, 2
jne 0x140174222
mov rdi, qword [rsp + 0x68]
mov al, 0x2b
add al, 0x14
add al, 0x1d
sub al, 0x1c
xor al, 0x6b
add al, 0x3d
xor al, 1
sub al, 0x68
mov byte [rbx + 0x72], 0x35
sub byte [rbx + 0x72], 0x31
add byte [rbx + 0x72], 0x22
xor byte [rbx + 0x72], 0x50
sub byte [rbx + 0x72], 0x6c
add byte [rbx + 0x72], 6
xor byte [rbx + 0x72], 0x57
sub byte [rbx + 0x72], 0x1f
sub byte [rbx + 0x72], 0x28
add rsp, 0x50
nop
add rsp, 8
mov rbx, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
mov byte [rbx + 0x72], 0x2a
add byte [rbx + 0x72], 0x2d
xor byte [rbx + 0x72], 0x72
xor byte [rbx + 0x72], 0x55
sub byte [rbx + 0x72], 0x3a
xor byte [rbx + 0x72], 0x1a
add byte [rbx + 0x72], 0x3a
sub byte [rbx + 0x72], 0xe
sub byte [rbx + 0x72], 0x58
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x1401741f3
xchg r9, r15
mov r15, qword [rbx + 0x80]
xchg r9, r15
lea rcx, [rsp + 0x30]
xchg r8, r10
mov r10, rdi
xchg r8, r10
mov edx, 0x3d9b356f
add edx, 0x1fffae20
sub edx, 0x32dec8e3
add edx, 0x362c2688
xor edx, 0x20a3e923
add edx, 0x3e513c09
xor edx, 0x7e9ce421
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140174222
cmp byte [rbx + 0x72], 0
xchg rbx, rdi
mov rbx, qword [rsp + 0x68]
xchg rbx, rdi
sete al
add rsp, 0x50
push rax
push rdx
push rcx
push rcx
push rax
push rcx
push rax
xchg qword [rsp + 0x38], rbx
add rsp, 0x40
nop
add rsp, 8
jmp qword [rsp - 8]
xchg rdi, r15
mov r15, qword [rsp + 0x68]
xchg r15, rdi
xor al, al
add rsp, 0x50
nop
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
mov al, SHCreateMemStream
add al, 0x52
xor al, 7
sub al, 0x17
add al, 0x13
add al, 0x18
sub al, 0xb
xor al, 0x62
add rsp, 0x50
nop
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401aa780
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xchg r11, rdx
mov rdx, r11
xchg r11, rdx
xchg r10, r9
mov r9, rcx
xchg r10, r9
test rdx, rdx
je 0x1401aa7f8
mov qword [rsp], rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1401aa7eb
movzx eax, byte [r10]
test bl, bl
je 0x1401aa7cd
lea rcx, [r9 - 1]
mov rdx, r9
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1401aa7bc
jmp 0x1401aa7eb
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1401aa7dc
inc r10
sub r11, 1
jne 0x1401aa7a4
mov rbx, qword [rsp]
add rsp, 8
ret
Function at 0x1401af700
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
xchg r15, rbx
mov qword [rsp + 8], r15
xchg rbx, r15
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1dbd84ad
add eax, 0x31799853
xor eax, 0x4b289d16
xor eax, 0x684df918
sub eax, 0x27e91d03
sub eax, 0x7a00914
xor eax, 0x7d1e094b
sub eax, 0x188ce88
sub eax, 0x404e7984
call fcn.1401fc940
sub rsp, rax
mov ebx, edx
mov edi, ecx
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov dword [rsp + 0x24], eax
mov r9d, 0x5178d1e2
sub r9d, 0x71bcb2a
add r9d, 0x235d2eed
sub r9d, 0x4938d016
sub r9d, 0x136f0dbf
add r9d, 0x31a9f94b
xor r9d, 0x42aa9410
sub r9d, 0x16c50a
mov dword [rsp + 0x13a4], 0x90627c0
add dword [rsp + 0x13a4], 0x8083407
add dword [rsp + 0x13a4], 0x142d6730
add dword [rsp + 0x13a4], 0x3448dc17
add dword [rsp + 0x13a4], 0xaf360cf
sub dword [rsp + 0x13a4], 0x2c181297
sub dword [rsp + 0x13a4], 0x89430ce
add dword [rsp + 0x13a4], 0x4dd2d04f
xor dword [rsp + 0x13a4], 0x82617338
nop dword [rax + rax]
mov r8d, eax
shr r8d, 0x13
shr r8d, 7
shr r8d, 2
shr r8d, 1
shr r8d, 1
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, 0x270
jb 0x1401af7f7
mov ebp, 0x344602d3
add ebp, 0x54468de
sub ebp, 0x35944274
add ebp, 0x67a362d4
add ebp, 0x10fbdd49
xor ebp, 0xfc95695a
mov dword [rsp + 0x20], 0xfd663d1
xor dword [rsp + 0x20], 0x504235be
add dword [rsp + 0x20], 0x436f9ea
xor dword [rsp + 0x20], 0x1272a8d5
sub dword [rsp + 0x20], 0x41137083
xor dword [rsp + 0x20], 0x53fe41ff
sub dword [rsp + 0x20], 0xde02c56
xor dword [rsp + 0x20], 0x55789fd0
cmp edi, ebp
lea rax, [rsp + 0x20]
mov qword [rsp + 0x13d0], rax
lea rcx, [rsp + 0x13d0]
lea eax, [rdi - 0x80000000]
lea esi, [rdi + rbp]
cmovae esi, eax
lea edi, [rbx + rbp]
cmp ebx, ebp
lea eax, [rbx - 0x80000000]
cmovae edi, eax
sub edi, esi
cmp edi, 0xffffffff
jne 0x1401af8d9
call fcn.1401afb90
mov ecx, eax
jmp 0x1401af93a
inc edi
mov ebx, edi
call fcn.1401afb90
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jae 0x1401af929
mov eax, edi
xor edx, edx
neg eax
div edi
mov edi, edx
cmp ecx, edx
jae 0x1401af929
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x13d0]
call fcn.1401afb90
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jb 0x1401af90e
shr rcx, 0x11
shr rcx, 0xc
shr rcx, 1
shr rcx, 1
shr rcx, 1
lea edx, [rsi + rcx]
lea r11, [rsp + 0x13b0]
cmp edx, ebp
xchg rbx, rcx
mov rcx, qword [r11 + 0x10]
xchg rbx, rcx
lea eax, [rdx + rbp]
mov rbp, qword [r11 + 0x18]
lea ecx, [rdx - 0x80000000]
xchg rsi, r12
mov r12, qword [r11 + 0x28]
xchg r12, rsi
cmovae eax, ecx
mov rsp, r11
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401afb90
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
xchg rsi, r10
mov rsi, qword [rcx]
xchg rsi, r10
mov r9d, 0x14c33e6a
add r9d, 0x22dc0de3
xor r9d, 0x256ff234
xor r9d, 0x276c0617
add r9d, 0xb71683d
sub r9d, 0x410e1e3b
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x1401afc22
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1401afbdd
mov ecx, dword [r10]
jmp 0x1401afd73
cmp ecx, 0x4e0
jb 0x1401afd73
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0x1afa7bca
sub ebx, 0x12a49ecf
add ebx, 0x247fad77
add ebx, 0x3a336611
xor ebx, 0x379f04ec
sub ebx, 0x436070bc
add ebx, 0x23e088d9
xor ebx, 0x31180c6f
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401afc6b
lea r11, [r10 + 0xd50]
mov ebx, 0x7fe3fddc
sub ebx, 0x19ec2f90
add ebx, 0x10572d8e
xor ebx, 0x16ce2271
sub ebx, 0xa525500
xor ebx, 0x3891a285
sub ebx, 0x51891d9f
xor ebx, 0xb21775
xor ebx, 0x1d841e76
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401afcef
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
xchg rdx, rbx
mov rdx, qword [rsp]
xchg rbx, rdx
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 3
shr ecx, 5
shr ecx, 1
shr ecx, 2
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 4
shl eax, 2
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 5
shl eax, 4
shl eax, 4
shl eax, 1
shl eax, 1
xor edx, eax
mov eax, edx
shr eax, 0x11
shr eax, 1
xor eax, edx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401b9b90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp - 8], rbx
sub rsp, 8
sub rsp, 0x20
xchg rbx, rcx
mov rcx, rbx
xchg rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b915d
xchg rdx, rbp
mov rbp, qword [rbx + 0x28]
xchg rbp, rdx
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b9142
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b9177
mov rcx, r8
call fcn.1401fc5cc
xor eax, eax
xchg r15, rax
mov qword [rbx + 0x18], r15
xchg r15, rax
xchg r14, rax
mov qword [rbx + 0x20], r14
xchg r14, rax
mov qword [rbx + 0x28], rax
lea rcx, [rbx + 8]
add rsp, 0x20
push rdx
push rax
push rax
push rax
xchg qword [rsp + 0x20], rbx
add rsp, 0x28
jmp 0x1401b9b90
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xchg r8, rbx
mov qword [rsp + 0x10], r8
xchg rbx, r8
nop
sub rsp, 8
mov qword [rsp], rsi
sub rsp, 0x20
mov rbx, qword [rcx]
xchg rcx, r11
mov rsi, r11
xchg rcx, r11
xchg r12, rax
mov r12, qword [rbx + 8]
xchg r12, rax
mov qword [rax], 0x40d7afc5
add qword [rax], 0x2d0c3d47
xor qword [rax], 0x73bcbdfc
add qword [rax], 0x378aef8
xor qword [rax], 0x2fc222c3
xor qword [rax], 0x158e973
sub qword [rax], 0x230e1b7
add qword [rax], 0x6609ee31
xor qword [rax], 0x732640d2
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401b9c7d
xchg rbx, rdi
mov qword [rsp + 0x30], rbx
xchg rbx, rdi
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rdx, [rbx + 0x10]
xchg rcx, rdx
mov rdx, rsi
xchg rcx, rdx
call fcn.1401b2b80
mov edx, 0x387826ea
add edx, 0x33011372
sub edx, 0x3c111335
xor edx, 0x34a615d8
add edx, 0x1d057d48
xor edx, 0x7e1bb46b
sub edx, 0x46c803dc
xchg rbx, rbp
mov rcx, rbp
xchg rbx, rbp
call fcn.1401fc5cc
mov rbx, rdi
test rdi, rdi
jne 0x1401b9c1a
xchg rdx, rdi
mov rdx, qword [rsp + 0x30]
xchg rdi, rdx
xchg rcx, r13
mov r13, qword [rsi]
xchg rcx, r13
mov edx, 0x22aba8e2
add edx, 0x3504a797
add edx, 0x73fb5d7
sub edx, 0x1bc38b54
xor edx, 0x4463015f
sub edx, 0x74f7b53
xchg rbx, rcx
mov rcx, qword [rsp + 0x38]
xchg rbx, rcx
add rsp, 0x20
push rcx
push rax
push rbx
push rdx
xchg qword [rsp + 0x20], rsi
pop rdx
pop rbx
pop rax
pop rcx
add rsp, 8
jmp fcn.1401fc5cc
Function at 0x1401b9cd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp - 8], rbx
sub rsp, 8
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b91ed
xchg r10, rdx
mov r10, qword [rbx + 0x28]
xchg rdx, r10
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b91d2
mov r8, qword [rcx - 8]
neg rdx
add rdx, 0xffffffffffffffd9
neg rdx
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b920b
mov rcx, r8
call fcn.1401fc5cc
xor eax, eax
mov qword [rbx + 0x18], rax
xchg r13, rax
mov qword [rbx + 0x20], r13
xchg r13, rax
xchg r10, rax
mov qword [rbx + 0x28], r10
xchg r10, rax
lea rcx, [rbx + 8]
add rsp, 0x20
push rdx
push rax
push rdx
push rcx
push rax
push rcx
push rdx
push rdx
xchg qword [rsp + 0x40], rbx
add rsp, 0x48
jmp 0x1401b9cd0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xchg rbx, rsi
mov qword [rsp + 0x10], rsi
xchg rsi, rbx
nop
sub rsp, 8
mov qword [rsp], rsi
sub rsp, 0x20
mov rbx, qword [rcx]
xchg rcx, rsi
mov rcx, rsi
xchg rcx, rsi
mov rax, qword [rbx + 8]
mov qword [rax], 0x5dd802c7
sub qword [rax], 0x3d3b9d0e
xor qword [rax], 0x3b3a4a00
add qword [rax], 0x1a388009
xor qword [rax], 0x7b186ee0
add qword [rax], 0xbf34dca
add qword [rax], 0x1c8cfb20
xor qword [rax], 0x29939c9d
xor qword [rax], 0x5ed49691
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401b9db0
xchg r14, rdi
mov qword [rsp + 0x30], r14
xchg rdi, r14
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rcx, [rbx + 0x10]
call fcn.1401b9e00
mov edx, 0x23200f77
xor edx, 0x2aed920
xor edx, 0x71c57d0e
add edx, 0x170ca558
add edx, 0x112fdc0f
sub edx, 0x3ecf070b
sub edx, 0x39b92575
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.1401fc5cc
xchg rdi, rbx
mov rdi, rbx
xchg rbx, rdi
test rdi, rdi
jne 0x1401b9d56
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsi]
mov edx, 0x2c742ba8
add edx, 0x47dc7dbc
xor edx, 0x4d3f3485
xor edx, 0x1e24e9e3
xor edx, 0x3a881b35
add edx, 0x466e387c
add edx, 0x12db440d
sub edx, 0x770ceb80
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
nop
add rsp, 8
xchg qword [rsp - 8], rsi
jmp fcn.1401fc5cc
Function at 0x1401fcfb4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401fcffe
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401fcffe
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401fcffe
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401fcffe
cmp dword [rcx + 0x84], 0xe
jbe 0x1401fcffe
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401fd000
xor al, al
add rsp, 0x28
ret

Function at 0x14022c570
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14022c59d
xor al, al
jmp 0x14022c6ff
mov rax, qword [0x14024b6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14024b6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14024b6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14024b6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14024b6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14024b6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14024b6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14024b6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14024b700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14022c6f1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14022c649
mov r11d, 2
jmp 0x14022c66d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14022c663
mov r11d, 1
jmp 0x14022c66d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14022c715
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14022c6b2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14022c6ca
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14022c6da
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14022c6e8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14022c630
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14022c6fa

Function at 0x1403eba42
Capabilities:
Execute syscall

Disassembly:
syscall
ret
mov r10, rcx
jmp 0x140340214
Function at 0x140dd3498
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov al, bl
rol r10, cl
movzx bx, bpl
mov r11, qword [rsp + 0x28]
mov eax, dword [rdx + 8]
inc r10b
sbb r10b, cl
mov rbx, r9
btr r10, r15
lea r10, [r8 + r11]
movzx r9, r14w
xor r9w, 0x27dd
shrd r9d, ebx, 0x8f
mov r9, rcx
jmp 0x140dd34db
cmp rax, r10
jmp 0x140dd34e3
jae 0x140dd3502
sub al, al
cmovnp rbx, rsp
movzx bx, r15b
mov bl, r12b
mov rbx, qword [rsp + 8]
jmp 0x140dd3501
ret
mov edx, dword [rdx + 4]
clc
add rdx, qword [rcx]
cmp spl, 0x1c
test r11, r11
jmp 0x140dd3515
je 0x140dd3565
sub rbx, r8
movzx rax, r11w
bt rax, 0x3c
nop
bts ecx, edi
clc
mov eax, dword [r9 + 8]
ror cx, cl
mov ecx, r8d
rol eax, cl
clc
cmp r13b, r14b
add al, r8b
jmp 0x140dd3544
inc r8
xor al, byte [r8 + rdx - 1]
sub r11, 1
jmp 0x140dd3555
mov byte [rbx + r8 - 1], al
jmp 0x140dd355f
jne 0x140dd352c
mov rbx, qword [rsp + 8]
mov al, 0x78
mov al, 1
jmp 0x140dd3573
ret
Function at 0x1400111f9
Capabilities:
Terminate process

Disassembly:
jmp 0x140013660
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret