joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14015b400
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov ebx, r8d
mov rsi, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
cmp byte [rcx + 0x17], 0
jns 0x14015b42b
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dil, 1
test eax, eax
je 0x14015b457
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1400d5720
mov eax, edi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
ret
test bl, bl
je 0x14015b46c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x14015b539
mov ecx, 2
call fcn.1400b0f50
test al, al
je 0x14015b532
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x40]
mov r8d, 0x61
mov r9d, 2
call fcn.140126e40
lea rcx, [rsp + 0x50]
lea rdx, str.CreateDirectory
mov r8d, 0x10
call fcn.1400a5d10
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x190]
mov rcx, rsi
call fcn.1400b6800
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14015b506
mov r8, qword [rsp + 0x198]
mov rsi, qword [rsp + 0x190]
mov rcx, rdi
mov rdx, rsi
call fcn.1400a5d10
cmp byte [rsp + 0x1a7], 0
jns 0x14015b528
mov rcx, qword [rsp + 0x190]
call fcn.1400d4ef4
lea rcx, [rsp + 0x40]
call fcn.140126ec0
xor edi, edi
jmp 0x14015b43a
mov dil, 1
mov rcx, rsi
mov dl, 1
call fcn.14015b2d0
test al, al
jne 0x14015b43a
mov ecx, 2
call fcn.1400b0f50
test al, al
je 0x14015b532
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x40]
mov r8d, 0x5c
mov r9d, 2
call fcn.140050ec0
lea rdi, [rsp + 0x50]
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x180]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x190]
mov rcx, rsi
call fcn.1400b6800
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14015b5c9
mov r8, qword [rsp + 0x198]
mov rsi, qword [rsp + 0x190]
mov rcx, rdi
mov rdx, rsi
call fcn.1400a5d10
lea rdx, str._not_a_directory
mov r8d, 0x10
mov rcx, rax
call fcn.1400a5d10
cmp byte [rsp + 0x1a7], 0
jns 0x14015b600
mov rcx, qword [rsp + 0x190]
call fcn.1400d4ef4
lea rcx, [rsp + 0x40]
call fcn.140051360
jmp 0x14015b532
Function at 0x14015b610
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x14015b637
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14015b667
test eax, 0x410
sete sil
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400d5720
mov eax, esi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400b0f50
test al, al
je 0x14015b71e
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x74
mov r9d, 2
call fcn.140126e40
lea rcx, [rsp + 0x60]
lea rdx, str.GetFileAttributes
mov r8d, 0x12
call fcn.1400a5d10
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.1400b6800
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14015b6f8
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.1400a5d10
cmp byte [rsp + 0x4f], 0
jns 0x14015b714
mov rcx, qword [rsp + 0x38]
call fcn.1400d4ef4
lea rcx, [rsp + 0x50]
call fcn.140126ec0
xor esi, esi
jmp 0x14015b64b

Function at 0x14015b730
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
sub rsp, 0x198
mov rsi, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x14015b757
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14015b772
and eax, 0x410
cmp eax, 0x410
je 0x14015b865
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x14015b77e
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
je 0x14015b7a7
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400d5720
mov eax, edi
add rsp, 0x198
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400b0f50
test al, al
je 0x14015b85e
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x94
mov r9d, 2
call fcn.140126e40
lea rcx, [rsp + 0x60]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.1400a5d10
mov rdi, rax
movzx eax, byte [rsi + 0x17]
test al, al
mov rcx, qword [rsi]
cmovns rcx, rsi
lea rdx, [rsp + 0x28]
mov qword [rdx], rcx
cmovs rax, qword [rsi + 8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x38]
mov rcx, rsi
call fcn.1400b6800
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14015b838
mov r8, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rcx, rdi
mov rdx, rsi
call fcn.1400a5d10
cmp byte [rsp + 0x4f], 0
jns 0x14015b854
mov rcx, qword [rsp + 0x38]
call fcn.1400d4ef4
lea rcx, [rsp + 0x50]
call fcn.140126ec0
xor edi, edi
jmp 0x14015b78b
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1400d5720
mov rcx, rsi
add rsp, 0x198
pop rdi
pop rsi
jmp fcn.14015b890
Function at 0x14015b890
Capabilities:
Delete directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rdi, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x14015b8b8
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
je 0x14015b8e6
test esi, esi
setne bl
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400d5720
mov eax, ebx
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov ecx, 2
call fcn.1400b0f50
test al, al
je 0x14015b8c4
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str..._.._third_party_crashpad_crashpad_util_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x2f
mov r9d, 2
call fcn.140126e40
lea rcx, [rsp + 0x68]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.1400a5d10
mov rbx, rax
movzx eax, byte [rdi + 0x17]
test al, al
mov rcx, qword [rdi]
cmovns rcx, rdi
lea rdx, [rsp + 0x30]
mov qword [rdx], rcx
cmovs rax, qword [rdi + 8]
mov qword [rdx + 8], rax
lea rdi, [rsp + 0x40]
mov rcx, rdi
call fcn.1400b6800
movzx r8d, byte [rdi + 0x17]
test r8b, r8b
jns 0x14015b973
mov r8, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rcx, rbx
mov rdx, rdi
call fcn.1400a5d10
cmp byte [rsp + 0x57], 0
jns 0x14015b98f
mov rcx, qword [rsp + 0x40]
call fcn.1400d4ef4
lea rcx, [rsp + 0x58]
call fcn.140126ec0
jmp 0x14015b8c4
Function at 0x140166ae0
Capabilities:
Get system information on windows

Disassembly:
push rsi
sub rsp, 0x1a0
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x198], rax
movaps xmm0, xmmword [0x1401a01c0]
lea rsi, [rsp + 0x160]
movaps xmmword [rsi + 0x20], xmm0
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsi + 0x20], 0x100
jb 0x140166b73
mov ecx, 1
call fcn.1400b0f50
test al, al
je 0x140166b73
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_system_snapshot_win.cc
lea rsi, [rsp + 0x28]
mov rcx, rsi
mov r8d, 0xbc
mov r9d, 1
call fcn.140050ec0
lea rcx, [rsp + 0x38]
lea rdx, str.dwNumberOfProcessors_exceeds_uint8_t_storage
mov r8d, 0x2c
call fcn.1400a5d10
mov rcx, rsi
call fcn.140051360
mov eax, dword [rsp + 0x180]
cmp eax, 0x100
mov esi, 0xff
cmovb esi, eax
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1400d5720
mov eax, esi
add rsp, 0x1a0
pop rsi
ret
Function at 0x140171180
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x1401a01c0]
lea rbx, [rsp + 0x160]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdi, [rcx + 0x18]
mov rcx, rdi
call fcn.14010ae10
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, rbx
call fcn.140174260
test al, al
je 0x140171247
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x1401712d3
mov rcx, rdi
call fcn.14010ae10
movsxd rdi, dword [rsp + 0x19c]
add rdi, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, rdi
mov r9, r15
call fcn.140174260
test al, al
je 0x140171318
cmp dword [r15], 0x4550
jne 0x140171357
mov sil, 1
test r14, r14
je 0x1401712b2
mov qword [r14], rdi
jmp 0x1401712b2
mov ecx, 1
call fcn.1400b0f50
test al, al
je 0x1401712b0
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.140050ec0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1400a5d10
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x14017129d
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1400a5d10
mov rcx, rdi
call fcn.140051360
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1400d5720
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1400b0f50
test al, al
je 0x1401712b0
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.140050ec0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x140171287
mov ecx, 1
call fcn.1400b0f50
test al, al
je 0x1401712b0
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.140050ec0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x140171281
mov ecx, 1
call fcn.1400b0f50
test al, al
je 0x1401712b0
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.140050ec0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x140171287
Function at 0x1401713a0
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov r14, r8
mov r15, rdx
mov rsi, rcx
mov rax, qword [0x1401c8018]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x1401a01c0]
lea rbx, [rsp + 0x160]
movaps xmmword [rbx + 0x30], xmm0
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
lea rdi, [rcx + 0x18]
mov rcx, rdi
call fcn.14010ae10
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, rbx
call fcn.140174260
test al, al
je 0x140171467
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x1401714f3
mov rcx, rdi
call fcn.14010ae10
movsxd rdi, dword [rsp + 0x19c]
add rdi, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, rdi
mov r9, r15
call fcn.140174260
test al, al
je 0x140171538
cmp dword [r15], 0x4550
jne 0x140171577
mov sil, 1
test r14, r14
je 0x1401714d2
mov qword [r14], rdi
jmp 0x1401714d2
mov ecx, 1
call fcn.1400b0f50
test al, al
je 0x1401714d0
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.140050ec0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1400a5d10
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
jns 0x1401714bd
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1400a5d10
mov rcx, rdi
call fcn.140051360
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1400d5720
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1400b0f50
test al, al
je 0x1401714d0
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.140050ec0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x1401714a7
mov ecx, 1
call fcn.1400b0f50
test al, al
je 0x1401714d0
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.140050ec0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x1401714a1
mov ecx, 1
call fcn.1400b0f50
test al, al
je 0x1401714d0
lea rdx, str..._.._third_party_crashpad_crashpad_snapshot_win_pe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.140050ec0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x1401714a7
Function at 0x140010188
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140019760], eax
call fcn.140010b30
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140019760], 0
jne case.default.0x1400101de
mov ecx, 1
call fcn.140010b30
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
push rsp
and dword [rsi + 0x2f88284a], edi
jg 0x14002b070
or byte [rdx + 0x69232799], dh
invalid
invalid
Function at 0x140c6a058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140c6a1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140c6a089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c6a06f
add dl, dl
jne 0x140c6a096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c6a0f6
xor eax, eax
add dl, dl
jne 0x140c6a0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c6a1ad
add dl, dl
jne 0x140c6a0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c6a0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c6a0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c6a0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140c6a0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140c6a07e
mov eax, 1
add dl, dl
jne 0x140c6a106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c6a113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c6a0fb
sub eax, ebx
mov ebx, 1
jne 0x140c6a14c
mov ecx, 1
add dl, dl
jne 0x140c6a12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c6a13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c6a123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c6a07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140c6a168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c6a175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c6a15d
cmp eax, 0x7d00
jae 0x140c6a19b
cmp eax, 0x500
jb 0x140c6a196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c6a07e
cmp eax, 0x7f
ja 0x140c6a19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c6a07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140c6a1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140c6a07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001180
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 6]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x14000f040]
mov r10, rax
sub rbx, rax
movabs rdi, 0x4e04e04e04e04e05
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xe]
mul rcx
add r11d, 0xe
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 6]
mov byte [r9 - 6], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xb]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xc]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xd]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xe
jb 0x1400011d0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x72]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea rsi, [0x14000f040]
mov r11, rax
sub rbx, rax
movabs rdi, 0x4e04e04e04e04e05
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r10d
lea r9, [r9 + 2]
mov rax, rdi
mov rcx, r8
mul r8
add r10d, 2
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r10d, 0x7a
jb 0x140001450
mov rbx, qword [rsp + 0x30]
mov rax, r11
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400014c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, [0x14000f040]
mov r10, rax
sub rbx, rax
movabs rdi, 0x4e04e04e04e04e05
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xb]
mul rcx
add r11d, 0xb
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xb
jb 0x140001510
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001770
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 6]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r10d, r10d
lea rsi, [0x14000f1f0]
mov r11, rax
sub rbx, rax
movabs rdi, 0x4e04e04e04e04e05
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r10d
lea r9, [r9 + 2]
mov rax, rdi
mov rcx, r8
mul r8
add r10d, 2
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x1a4
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r10d, 2
jb 0x1400017c0
mov rbx, qword [rsp + 0x30]
mov rax, r11
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret