joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011168
Capabilities:
Write file on windows

Disassembly:
jmp 0x14001cc60
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1402b90f6]
call fcn.140011c71
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x14001ccb7
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14001cdc3
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x14001cd5c
cmp qword [rbp + 0x28], 0
jle 0x14001cd5c
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14001ccfc
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140011bbd
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x14001cdb2
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x14001cdb2
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x1400112b2
Capabilities:
Create thread

Disassembly:
jmp 0x14001fec0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x1402b0b58]
xor rax, rbp
mov qword [rbp + 0x120], rax
lea rcx, [0x1402b9226]
call fcn.140011c71
mov edx, 8
lea rcx, [rbp + 8]
call fcn.1400113cf
mov rdx, qword [rbp + 0x158]
lea rcx, [rbp + 0x108]
call fcn.140011654
mov qword [rbp + 0x118], rax
mov rdx, qword [rbp + 0x118]
lea rcx, [rbp + 8]
call fcn.1400112e4
nop
lea rcx, [rbp + 0x108]
call fcn.140011537
lea rax, [0x14001187f]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x150]
add rax, 8
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 8]
call fcn.1400118b6
mov rcx, qword [rbp + 0x118]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x150]
mov qword [rcx], rax
mov rax, qword [rbp + 0x150]
cmp qword [rax], 0
je 0x14001ffc0
lea rcx, [rbp + 8]
call fcn.140011569
jmp 0x14001ffd9
mov rax, qword [rbp + 0x150]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.140011307
nop
lea rcx, [rbp + 8]
call fcn.140011537
lea rcx, [rbp - 0x30]
lea rdx, [0x1400332d0]
call fcn.140011a69
mov rcx, qword [rbp + 0x120]
xor rcx, rbp
call fcn.14001162c
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret

Function at 0x140011744
Capabilities:
Terminate process

Disassembly:
jmp 0x140028cc0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400118e3
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400299a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400299c0
xor al, al
jmp 0x140029a41
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400299d3
xor al, al
jmp 0x140029a41
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400299fd
xor al, al
jmp 0x140029a41
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140029a11
xor al, al
jmp 0x140029a41
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140029a23
xor al, al
jmp 0x140029a41
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140029a3f
xor al, al
jmp 0x140029a41
mov al, 1
add rsp, 0x38
ret
Function at 0x140011c44
Capabilities:
Write file on windows

Disassembly:
jmp 0x140018c00
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x3e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x1402b0b58]
xor rax, rbp
mov qword [rbp + 0x1a0], rax
lea rcx, [0x1402b90f6]
call fcn.140011c71
mov rax, qword [rbp + 0x1d0]
cmp qword [rax + 0x68], 0
je 0x140018c66
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140018c6d
mov al, 1
jmp 0x140018dc7
call fcn.14001138e
mov rcx, qword [rbp + 0x1d0]
mov rcx, qword [rcx]
mov qword [rbp + 0x198], rcx
mov edx, eax
mov rcx, qword [rbp + 0x1d0]
mov rax, qword [rbp + 0x198]
call qword [rax + 0x18]
mov dword [rbp + 0x164], eax
call fcn.14001138e
mov dword [rbp + 0x184], eax
lea rdx, [rbp + 0x164]
lea rcx, [rbp + 0x184]
call fcn.140011a87
movzx eax, al
test eax, eax
je 0x140018cc8
xor al, al
jmp 0x140018dc7
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1d0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x1d0]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x194], eax
cmp dword [rbp + 0x194], 0
je 0x140018d2d
cmp dword [rbp + 0x194], 1
je 0x140018d38
cmp dword [rbp + 0x194], 3
je 0x140018db6
jmp 0x140018dc5
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x140018d88
mov rax, qword [rbp + 0x1d0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x140018d88
xor al, al
jmp 0x140018dc7
mov rax, qword [rbp + 0x1d0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140018da3
mov dword [rbp + 0x194], 1
jmp 0x140018dad
mov dword [rbp + 0x194], 0
movzx eax, byte [rbp + 0x194]
jmp 0x140018dc7
mov rax, qword [rbp + 0x1d0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x140018dc7
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140031800]
call fcn.140011a69
mov rax, rdi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rbp
call fcn.14001162c
lea rsp, [rbp + 0x1b8]
pop rdi
pop rbp
ret
Function at 0x2006bec0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
test rdx, rdx
js 0x2006c176
mov rbx, r9
mov rdi, rdx
mov rsi, rcx
mov r15, qword [rcx + 0x18]
mov rax, r15
shr rax, 1
movabs r12, 0x7fffffffffffffff
mov rcx, rax
xor rcx, r12
cmp rcx, r15
jae 0x2006bf1b
movabs r14, 0x8000000000000000
jmp 0x2006bfb3
mov rcx, rdi
not rcx
mov rdx, rdi
xor rdx, 0xf
mov r8, rdi
xor r8, 0xfffffffffffffff0
and r8, rcx
or r8, rdx
not r8
and ecx, 0xf
mov rdx, rdi
and rdx, 0xfffffffffffffff0
or rdx, rcx
or rdx, r8
add rax, r15
cmp rdx, rax
mov r12, rax
cmova r12, rdx
mov rax, qword [0x205338c0]
mov rcx, rax
not rcx
movabs rdx, 0xdbc37c381ac81444
and rdx, rax
movabs r8, 0x243c83c7e537ebbb
movabs r9, 0x5bc37c381ac81444
and r9, rcx
and rcx, r8
or rcx, rdx
xor rax, r8
or r9, rax
not r9
lea r14, [rcx + r9*2]
add r14, r12
cmp r14, 0x1000
jb 0x2006c099
cmp r14, 0xffffffffffffffd9
jae 0x2006c17b
mov ecx, dword [0x205b3510]
lea eax, [rcx - 1]
imul eax, ecx
mov ecx, 0xf3dea19
add ecx, dword [0x205338c8]
xor edx, edx
div ecx
test edx, edx
je 0x2006c074
mov rax, r14
shl rax, 0x27
mov rcx, r14
sub rcx, rax
imul rcx, rax
add rcx, r14
mov edx, 0x507d971f
mov r8d, 0xc5f7ed3f
call fcn.2008daf0
mov rcx, rax
sub rcx, qword [0x205338c0]
imul rdx, rcx, 0x27
movabs rcx, 0x7ac7ec8c147b10b9
add rcx, rdx
mov rdx, rax
shl rdx, cl
mov r8, rcx
sub r8, rdx
mov rdx, r8
not rdx
mov r9, rcx
not r9
and r9, rdx
and rdx, rcx
xor rcx, r8
and r8, rcx
or r8, rdx
or r9, rcx
not r9
lea r8, [r8 + r9*2]
mov ecx, r8d
xor ecx, 0x20
mov edx, r8d
and edx, 0x20
lea ecx, [rcx + rdx*2]
neg cl
mov rdx, r8
shl rdx, cl
mov ecx, edx
shl r8, cl
mov ecx, edx
shl r8, cl
xor r8, rdx
not r8
and r8, rdx
mov qword [r8 - 8], rax
add r14, 0x27
mov rcx, r14
mov edx, 0x507d971f
mov r8d, 0xc5f7ed3f
call fcn.2008daf0
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x2006c0af
mov rcx, r14
mov edx, 0x507d971f
mov r8d, 0xc5f7ed3f
call fcn.2008daf0
mov r14, rax
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], r12
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call fcn.2044f800
mov byte [r14 + rdi], 0
cmp r15, 0x10
jb 0x2006c161
lea rdx, [r15 + 1]
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x2006c15c
mov rax, qword [rcx - 8]
sub rcx, rax
add rcx, 0xfffffffffffffff8
cmp rcx, 0x20
jae 0x2006c180
mov ecx, dword [0x205b3510]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
nop dword [rax + rax]
movabs rcx, 0xe2ad00c103ebfc64
xor rcx, r15
mov rdx, r15
not rdx
movabs r8, 0x1d52ff3efc14039b
and r8, rdx
or r8, rcx
not r8
lea rdx, [rcx + r8*2]
add rdx, qword [0x205338c0]
mov ecx, dword [0x205b3514]
cmp ecx, 0x60
jge 0x2006c110
movabs rcx, 0x418f8306e14bef7e
add rdx, rcx
mov rcx, rax
call fcn.2008bfb0
mov qword [rsi], r14
mov rax, rsi
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
call fcn.20069c50
call fcn.20067710
mov eax, dword [0x205b3510]
nop word cs:[rax + rax]
mov eax, dword [0x205b3510]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x2006c190
call fcn.20407a4c
int3
Function at 0x20076ba0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 8]
xor edx, edx
mov r8d, 0x1246459b
mov r9d, 0xa268bcdf
call fcn.2008e1e0
mov rax, qword [0x205b35b0]
mov qword [rbp - 0x10], rax
movabs rax, 0x243c83c7e537ebba
add rax, qword [0x205338c0]
cmp qword [0x205b7aa8], rax
jne 0x20076c43
lea rcx, [rbp - 0x20]
xor edx, edx
mov r8d, 0x1246459b
mov r9d, 0xa268bcdf
call fcn.2008e1e0
cmp qword [0x205b7aa8], 0
jne 0x20076c3a
movsxd rax, dword [0x205b7a90]
mov ecx, 0xf3dea18
add ecx, dword [0x205338c8]
movsxd rcx, ecx
add rcx, rax
mov dword [0x205b7a90], ecx
mov qword [0x205b7aa8], rcx
lea rcx, [rbp - 0x20]
call fcn.2008bff0
mov rbx, qword [0x205b7aa8]
mov rax, qword [rsi + 8]
cmp qword [rax + 0x18], rbx
jbe 0x20076c65
mov rcx, qword [rax + 0x10]
mov rdi, qword [rcx + rbx*8]
test rdi, rdi
jne 0x20076d40
cmp byte [rax + 0x24], 0
je 0x20076cbe
mov eax, dword [0x205b3514]
cmp eax, 0x1e
nop word cs:[rax + rax]
mov eax, 0xf3dea18
add eax, dword [0x205338c8]
lea rcx, [fcn.20076ba0]
add ecx, ecx
add ecx, 0x22a0
xor ecx, eax
not ecx
test ecx, eax
jne 0x20076c80
call fcn.204297f4
cmp qword [rax + 0x18], rbx
jbe 0x20076cbe
mov rax, qword [rax + 0x10]
mov rdi, qword [rax + rbx*8]
test rdi, rdi
jne 0x20076d40
mov rdi, qword [rbp - 0x10]
test rdi, rdi
jne 0x20076d40
jmp 0x20076ce9
mov eax, dword [0x205338c8]
mov ecx, eax
xor ecx, 0xf3dea17
and eax, 0xf3dea17
add eax, eax
add eax, ecx
je 0x20076cfa
mov eax, dword [0x205b3510]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
jne 0x20076cd0
mov eax, dword [0x205b3514]
cmp eax, 0x4a
jg 0x20076cd0
lea rcx, [rbp - 0x10]
mov rdx, rsi
call fcn.20076dd0
cmp rax, 0xffffffffffffffff
je 0x20076d55
mov rcx, qword [rbp - 0x10]
mov qword [rbp - 0x18], rcx
call fcn.204297bc
mov rcx, qword [rbp - 0x18]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x2010e313.0]
mov rdi, qword [rbp - 0x10]
mov qword [0x205b35b0], rdi
lea rcx, [rbp - 8]
call fcn.2008bff0
mov rax, rdi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop rbp
ret
call fcn.2006d010
int3
Function at 0x2008e7b0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x2008e7e8
movzx eax, byte [0x205331b3]
xor r9b, 0x4e
add r9b, byte [0x205338cc]
cmp al, r9b
je 0x2008e7e0
mov cl, 0xfa
nop dword [rax]
mov al, 0x35
lock cmpxchg byte [0x205331b3], cl
je 0x2008e818
cmp al, 0xbe
jne 0x2008e7d0
lea rax, [0x205331b0]
ret
movzx eax, byte [0x205331e9]
cmp al, 0xd1
je 0x2008e810
mov cl, 0x28
nop word cs:[rax + rax]
mov al, 0xe6
lock cmpxchg byte [0x205331e9], cl
je 0x2008e85f
cmp al, 0xd1
jne 0x2008e800
lea rax, [0x205331e0]
ret
xor edx, edx
lea rax, [0x205331b0]
lea rcx, [0x2046c230]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 3
jl 0x2008e830
mov al, 0xbe
xchg byte [0x205331b3], al
lea rax, [0x205331b0]
ret
xor eax, eax
lea rcx, [0x205331e0]
lea rdx, [0x2046c250]
nop
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x2008e888
inc rax
jmp 0x2008e870
mov al, 0xd1
xchg byte [0x205331e9], al
lea rax, [0x205331e0]
ret
Function at 0x2008e960
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8d, dword [rsp + 0x38]
test ecx, ecx
je 0x2008e9a9
test edx, edx
je 0x2008ea2f
movzx eax, byte [0x205b34e8]
mov ecx, r8d
xor cl, 0xf2
add cl, byte [0x205338cc]
cmp al, cl
je 0x2008ead5
mov cl, 0x3c
xor eax, eax
lock cmpxchg byte [0x205b34e8], cl
je 0x2008ea89
cmp al, 0xcd
jne 0x2008e990
jmp 0x2008ead5
test edx, edx
je 0x2008ea59
movzx eax, byte [0x20533096]
cmp al, 0x8f
je 0x2008eb52
mov cl, 0xc1
nop word cs:[rax + rax]
mov al, 0xb6
lock cmpxchg byte [0x20533096], cl
je 0x2008eae1
movzx edx, byte [0x205338cc]
mov r9d, r8d
not r9b
mov r10d, r8d
xor r10b, 0x4b
and r9b, 0xb4
or r10b, r9b
not r10b
or r10b, r9b
mov r9d, r10d
not r9b
mov r11d, r9d
and r11b, dl
mov ebx, r10d
xor r10b, dl
not dl
and bl, dl
or bl, r11b
and dl, r9b
or dl, r10b
not dl
add dl, dl
add dl, bl
cmp al, dl
jne 0x2008e9d0
jmp 0x2008eb52
movzx eax, byte [0x20533263]
cmp al, 6
je 0x2008ebc5
mov cl, 9
mov al, 0x6b
lock cmpxchg byte [0x20533263], cl
je 0x2008eb5e
cmp al, 6
jne 0x2008ea40
jmp 0x2008ebc5
movzx eax, byte [0x2053330d]
cmp al, 0x33
je 0x2008ec48
mov cl, 0x29
nop word [rax + rax]
mov al, 0xaa
lock cmpxchg byte [0x2053330d], cl
je 0x2008ebd1
cmp al, 0x33
jne 0x2008ea70
jmp 0x2008ec48
xor eax, eax
lea rcx, [0x205332d0]
lea rdx, [0x2046c340]
xor r8d, 0xd99c89a9
cdqe
movzx r9d, byte [rax + rdx]
mov r10d, r9d
xor r10b, r9b
not r10b
and r10b, byte [rax + rcx]
xor r10b, r9b
mov byte [rax + rcx], r10b
mov r9d, dword [0x205338c8]
add r9d, r8d
add eax, r9d
cmp eax, 0xd
jl 0x2008eaa0
mov al, 0xcd
xchg byte [0x205b34e8], al
lea rax, [0x205332d0]
jmp 0x2008ec4f
xor eax, eax
lea rcx, [0x20533090]
lea rdx, [0x2046c120]
mov r9d, r8d
xor r9d, 0xd99c89a9
nop dword [rax + rax]
cdqe
movzx r10d, byte [rax + rcx]
movzx r11d, byte [rax + rdx]
mov ebx, r10d
not bl
mov esi, ebx
xor sil, r11b
not r11b
and r10b, r11b
or r10b, sil
not r10b
xor bl, r11b
and bl, r11b
or bl, r10b
mov byte [rax + rcx], bl
mov r10d, dword [0x205338c8]
add r10d, r9d
add eax, r10d
cmp eax, 6
jl 0x2008eb00
xor r8b, 0xb4
add r8b, byte [0x205338cc]
xchg byte [0x20533096], r8b
lea rax, [0x20533090]
jmp 0x2008ec4f
xor eax, eax
lea rcx, [0x20533240]
lea rdx, [0x2046c2b0]
xor r8d, 0xd99c898b
nop word cs:[rax + rax]
movzx r9d, byte [rax + rcx]
movzx r10d, byte [rax + rdx]
add r9b, 0xd9
mov r11d, r9d
xor r11b, r10b
and r9b, r10b
add r9b, r9b
add r9b, r11b
add r9b, 0x27
mov byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x205338c8]
add r10d, r8d
cmp r9d, r10d
jge 0x2008ebbd
inc rax
jmp 0x2008eb80
mov al, 6
xchg byte [0x20533263], al
lea rax, [0x20533240]
jmp 0x2008ec4f
xor edx, edx
lea rax, [0x20533300]
lea rcx, [0x2046c370]
mov r9d, r8d
not r9d
and r9d, 0xd99c8995
xor r8d, 0x2663766a
or r8d, r9d
not r8d
or r8d, r9d
nop
movsxd rdx, edx
movzx r9d, byte [rdx + rax]
movzx r10d, byte [rdx + rcx]
not r9b
mov r11d, r9d
and r11b, r10b
or r9b, r10b
not r9b
or r9b, r11b
mov byte [rdx + rax], r9b
mov r9d, edx
xor r9d, 1
and edx, 1
lea edx, [r9 + rdx*2]
mov r9d, dword [0x205338c8]
add r9d, r8d
cmp edx, r9d
jl 0x2008ec00
mov al, 0x33
xchg byte [0x2053330d], al
lea rax, [0x20533300]
pop rbx
pop rsi
ret
Function at 0x2008ec60
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8d, dword [rsp + 0x38]
mov eax, dword [0x205338c8]
mov r9d, r8d
xor r9d, 0x80ba280
add r9d, 0xcd3b63a
mov r10d, r9d
xor r10d, eax
and r9d, eax
lea eax, [r10 + r9*2]
add eax, 0xf32c49c6
cmp ecx, eax
jne 0x2008ecc9
test edx, edx
je 0x2008ed4c
movzx eax, byte [0x205330b5]
cmp al, 0x76
je 0x2008ee1e
mov cl, 0x83
nop dword [rax]
mov al, 6
lock cmpxchg byte [0x205330b5], cl
je 0x2008edc9
cmp al, 0x76
jne 0x2008ecb0
jmp 0x2008ee1e
test edx, edx
je 0x2008ed99
movzx eax, byte [0x20533189]
nop dword [rax + rax]
cmp al, 0x34
je 0x2008ee00
movzx ecx, byte [0x205338cc]
mov edx, r8d
not dl
and dl, 0x17
mov eax, r8d
xor al, 0xe8
or al, dl
not al
or al, dl
add al, cl
mov edx, r8d
xor dl, 0xb3
add dl, cl
lock cmpxchg byte [0x20533189], dl
jne 0x2008ece0
xor eax, eax
lea rcx, [0x20533180]
lea rdx, [0x2046c200]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 8
jg 0x2008edf8
inc rax
jmp 0x2008ed30
movzx eax, byte [0x205332cf]
movzx ecx, byte [0x205338cc]
mov edx, r8d
xor dl, 0xfe
mov r9d, edx
xor r9b, cl
and dl, cl
add dl, dl
add dl, r9b
cmp al, dl
je 0x2008eeca
mov cl, 0x4b
nop word [rax + rax]
mov al, 0x9b
lock cmpxchg byte [0x205332cf], cl
je 0x2008ee2a
cmp al, 0xf3
jne 0x2008ed80
jmp 0x2008eeca
movzx eax, byte [0x205331f3]
cmp al, 0xcc
je 0x2008ef1f
mov cl, 2
nop word [rax + rax]
mov al, 0xb2
lock cmpxchg byte [0x205331f3], cl
je 0x2008eed3
cmp al, 0xcc
jne 0x2008edb0
jmp 0x2008ef1f
xor eax, eax
lea rcx, [0x205330a0]
lea rdx, [0x2046c130]
nop dword [rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0x14
jg 0x2008ee0c
inc rax
jmp 0x2008ede0
mov al, 0x34
xchg byte [0x20533189], al
lea rax, [0x20533180]
jmp 0x2008ef26
xor r8b, 0x7b
add r8b, byte [0x205338cc]
xchg byte [0x205330b5], r8b
lea rax, [0x205330a0]
jmp 0x2008ef26
xor r9d, r9d
lea rax, [0x205332c0]
lea rcx, [0x2046c330]
mov edx, r8d
xor edx, 0x80ba2b1
nop word cs:[rax + rax]
movsxd r9, r9d
movzx r10d, byte [r9 + rax]
movzx r11d, byte [r9 + rcx]
mov ebx, r10d
not bl
mov esi, r11d
xor sil, bl
xor bl, r10b
and bl, r11b
xor bl, r10b
and sil, r11b
add sil, sil
add sil, bl
mov byte [r9 + rax], sil
mov r10d, r9d
not r10d
mov r11d, r10d
and r11d, 1
mov esi, r9d
and esi, 0xfffffffe
or esi, r11d
xor r9d, 1
and r10d, 0x7ffffffe
or r10d, r9d
not r10d
lea r9d, [rsi + r10*2]
mov r10d, dword [0x205338c8]
add r10d, edx
cmp r9d, r10d
jl 0x2008ee50
xor r8b, 0xfe
add r8b, byte [0x205338cc]
xchg byte [0x205332cf], r8b
lea rax, [0x205332c0]
jmp 0x2008ef26
xor eax, eax
lea rcx, [0x205331f0]
lea rdx, [0x2046c260]
xor r8d, 0x80ba28f
nop word [rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x205338c8]
mov r10d, r8d
xor r10d, r9d
and r9d, r8d
lea r9d, [r10 + r9*2]
add eax, r9d
cmp eax, 3
jl 0x2008eef0
mov al, 0xcc
xchg byte [0x205331f3], al
lea rax, [0x205331f0]
pop rbx
pop rsi
ret
Function at 0x2008f8b0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub rsp, 0x28
mov rax, r9
mov r9, qword [rsp + 0x50]
test ecx, ecx
je 0x2008f8d0
mov rcx, rdx
mov rdx, r8
mov r8, rax
call fcn.2040d084
jmp 0x2008f8de
mov rcx, rdx
mov rdx, r8
mov r8, rax
call fcn.2040d398
nop
add rsp, 0x28
ret
Function at 0x200f18c0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x200f190c
mov eax, 0x4765e3a
add eax, dword [0x205416ec]
cmp edx, eax
jne 0x200f193c
movzx eax, byte [0x20536923]
movzx ecx, byte [0x205416e8]
add cl, 0x48
cmp al, cl
je 0x200f1904
mov cl, 0xaf
nop word [rax + rax]
mov al, 0x2a
lock cmpxchg byte [0x20536923], cl
je 0x200f19ca
cmp al, 0xc1
jne 0x200f18f0
lea rax, [0x20536920]
ret
test edx, edx
je 0x200f1981
movzx eax, byte [0x205367c0]
cmp al, 0x80
je 0x200f1934
mov cl, 0x59
nop dword [rax]
mov al, 0x3f
lock cmpxchg byte [0x205367c0], cl
je 0x200f1a65
cmp al, 0x80
jne 0x200f1920
lea rax, [0x205367b0]
ret
movzx eax, byte [0x205369bb]
cmp al, 0x47
je 0x200f1979
nop word [rax + rax]
movzx ecx, byte [0x205416e8]
lea eax, [rcx - 0x1d]
add cl, 0x1d
lock cmpxchg byte [0x205369bb], cl
je 0x200f1a0f
movzx ecx, byte [0x205416e8]
add cl, 0xce
cmp al, cl
jne 0x200f1950
lea rax, [0x205369b0]
ret
movzx eax, byte [0x20536865]
cmp al, 0x12
je 0x200f19c2
mov cl, 0x5d
nop
mov al, 0xe3
lock cmpxchg byte [0x20536865], cl
je 0x200f1ac7
movzx edx, byte [0x205416e8]
xor r8d, r8d
sub r8b, dl
mov edx, r8d
xor dl, 0x67
and r8b, 0x67
add r8b, r8b
add r8b, dl
add al, r8b
jne 0x200f1990
lea rax, [0x20536850]
ret
xor edx, edx
lea rax, [0x20536920]
lea rcx, [0x2046e540]
nop word [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 3
jl 0x200f19e0
mov al, 0xc1
xchg byte [0x20536923], al
lea rax, [0x20536920]
ret
xor eax, eax
lea rcx, [0x205369b0]
lea rdx, [0x2046e5d0]
nop
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r9b
mov r10d, r9d
xor r10b, r8b
and r10b, r9b
or r10b, r8b
not r10b
and r9b, r8b
or r9b, r10b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x200f1a55
inc rax
jmp 0x200f1a20
mov al, 0x47
xchg byte [0x205369bb], al
lea rax, [0x205369b0]
ret
xor r8d, r8d
lea rax, [0x205367b0]
lea rcx, [0x2046e3f0]
mov edx, 0x4765e4a
nop dword [rax + rax]
movsxd r8, r8d
movzx r9d, byte [r8 + rcx]
add byte [r8 + rax], r9b
mov r9d, r8d
xor r9d, 0x4bb3f1c4
and r8d, 0x4bb3f1c4
lea r8d, [r9 + r8*2]
add r8d, 0xb44c0e3d
mov r9d, dword [0x205416ec]
add r9d, edx
cmp r8d, r9d
jl 0x200f1a80
mov al, 0x80
xchg byte [0x205367c0], al
lea rax, [0x205367b0]
ret
xor eax, eax
lea rcx, [0x20536850]
lea rdx, [0x2046e480]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x200f1af8
inc rax
jmp 0x200f1ae0
mov al, 0x12
xchg byte [0x20536865], al
lea rax, [0x20536850]
ret