joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401989b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
nop
sub rsp, 8
mov qword [rsp], r13
sub rsp, 0x30
xor ebx, ebx
mov r13d, r8d
xchg rcx, rdx
mov rdi, rcx
xchg rdx, rcx
test rdx, rdx
jne 0x1401989de
mov eax, ebx
jmp 0x140198a1e
mov eax, 0x600c41b1
xor eax, 0x18ec75e2
sub eax, 0x1a5424ef
xor eax, 0x6d5b6ab8
sub eax, 0x1dc82ed7
sub eax, 0x160edcb8
cmp word [rdx], ax
je 0x140198a0d
mov rax, rbx
jmp 0x140198a1e
movsxd rax, dword [rdx + 0x3c]
add rax, rdi
cmp dword [rax], 0x4550
cmovne rax, rbx
xchg rbp, r10
mov qword [rsp + 0x50], r10
xchg r10, rbp
mov ecx, 0x6c914ec9
sub ecx, 0x5a710d5b
add ecx, 0x42c58ed2
xor ecx, 0x3999158a
add ecx, 0xe95ba83
xor ecx, 0x7c128246
xchg rsi, r11
mov qword [rsp + 0x58], r11
xchg r11, rsi
xchg r12, r14
mov qword [rsp + 0x60], r14
xchg r14, r12
mov qword [rsp + 0x28], r14
xchg rdi, r15
mov qword [rsp + 0x20], rdi
xchg r15, rdi
cmp word [rax + 0x18], cx
jne 0x140198ae6
mov esi, dword [rax + 0x88]
add rsi, rdi
je 0x140198ae6
mov r14d, dword [rsi + 0x1c]
mov r15d, dword [rsi + 0x24]
add r14, rdi
mov r12d, dword [rsi + 0x20]
add r15, rdi
add r12, rdi
cmp dword [rsi + 0x18], 0
jbe 0x140198ae6
nop dword [rax]
nop dword [rax + rax]
mov eax, ebx
xor edx, edx
mov ecx, dword [r12 + rax*4]
movzx eax, word [r15 + rax*2]
add rcx, rdi
mov ebp, dword [r14 + rax*4]
add rbp, rdi
call fcn.140076110
cmp eax, r13d
je 0x140198b45
inc ebx
cmp ebx, dword [rsi + 0x18]
jb 0x140198ab6
xor eax, eax
xchg r13, r15
mov r13, qword [rsp + 0x20]
xchg r15, r13
xchg r14, r13
mov r13, qword [rsp + 0x28]
xchg r13, r14
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
xchg r14, rbp
mov r14, qword [rsp + 0x50]
xchg rbp, r14
add rsp, 0x30
nop
add rsp, 8
mov r13, qword [rsp - 8]
nop
add rsp, 8
xchg qword [rsp - 8], rdi
push rcx
push rcx
push rdx
push rdx
push rcx
push rdx
push rax
push rdx
xchg qword [rsp + 0x40], rbx
pop rdx
pop rax
pop rdx
pop rcx
pop rdx
pop rdx
pop rcx
pop rcx
add rsp, 8
ret
xchg rbp, rax
mov rbp, rax
xchg rbp, rax
jmp 0x140198ae8
Function at 0x1401aa730
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xchg r13, rdx
mov r11, r13
xchg rdx, r13
mov r10, rcx
test rdx, rdx
je 0x1401aa7ae
xchg rbx, r14
mov qword [rsp], r14
xchg r14, rbx
movzx ebx, byte [rsp + 0x30]
test r9, r9
je 0x1401aa7a1
movzx eax, byte [r10]
test bl, bl
je 0x1401aa783
lea rcx, [r9 - 1]
xchg rbx, r9
mov rdx, rbx
xchg r9, rbx
add rcx, r8
nop
xor al, byte [rcx]
lea rcx, [rcx - 1]
mov byte [r10], al
sub rdx, 1
jne 0x1401aa772
jmp 0x1401aa7a1
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
xor al, byte [rcx + r8]
inc rcx
mov byte [r10], al
cmp rcx, r9
jb 0x1401aa792
inc r10
sub r11, 1
jne 0x1401aa754
mov rbx, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401af700
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
xchg r8, rbp
mov qword [rsp + 0x10], r8
xchg r8, rbp
xchg rdi, rsi
mov qword [rsp + 0x20], rdi
xchg rdi, rsi
nop
sub rsp, 8
mov qword [rsp], rdi
mov eax, 0x3e389b10
add eax, 0xa884910
xor eax, 0x4823682d
xor eax, 0x64dc6aa0
xor eax, 0x2f698863
xor eax, 0xe63621a
sub eax, 0x4534f924
call fcn.1401fc7b0
sub rsp, rax
mov ebx, edx
mov edi, ecx
call fcn.1401fd2e0
mov dword [rsp + 0x24], eax
mov r9d, 0x608a382a
sub r9d, 0x4e72dbe2
sub r9d, 0x6d5a4c8
add r9d, 0x16ee71e3
xor r9d, 0x7203941f
xor r9d, 0x1995b79f
sub r9d, 0x919010e
xor r9d, 0x408d09d4
mov dword [rsp + 0x13a4], 0x54dda355
sub dword [rsp + 0x13a4], 0x38a1f808
xor dword [rsp + 0x13a4], 0x6c63f0b3
sub dword [rsp + 0x13a4], 0x1af31da0
sub dword [rsp + 0x13a4], 0x3f119ce0
xor dword [rsp + 0x13a4], 0x145cf302
xor dword [rsp + 0x13a4], 0x29b4c021
add dword [rsp + 0x13a4], 0x5260585f
add dword [rsp + 0x13a4], 0x81e41543
nop dword [rax + rax]
mov r8d, eax
shr r8d, 0xb
shr r8d, 0xe
shr r8d, 1
shr r8d, 1
shr r8d, 1
shr r8d, 1
shr r8d, 1
xor r8d, eax
imul eax, r8d, 0x6c078965
add eax, r9d
mov dword [rsp + r9*4 + 0x24], eax
inc r9
cmp r9, 0x270
jb 0x1401af7fb
mov ebp, 0x107b9284
xor ebp, 0x7a61ec51
sub ebp, 0x108334f7
add ebp, 0x18e12d91
sub ebp, 0x116d704
xor ebp, 0xf161a06b
mov dword [rsp + 0x20], 0x5da4c39d
xor dword [rsp + 0x20], 0x6b60e084
xor dword [rsp + 0x20], 0x334a352
sub dword [rsp + 0x20], 0x17491737
xor dword [rsp + 0x20], 0x29ce3ecd
add dword [rsp + 0x20], 0x28e39fd4
sub dword [rsp + 0x20], 0x604cf53d
cmp edi, ebp
lea rax, [rsp + 0x20]
xchg rbp, rax
mov qword [rsp + 0x13d0], rbp
xchg rbp, rax
lea rcx, [rsp + 0x13d0]
lea eax, [rdi - 0x80000000]
lea esi, [rdi + rbp]
cmovae esi, eax
lea edi, [rbx + rbp]
cmp ebx, ebp
lea eax, [rbx - 0x80000000]
cmovae edi, eax
sub edi, esi
cmp edi, 0xffffffff
jne 0x1401af8de
call fcn.1401afbb0
mov ecx, eax
jmp 0x1401af941
inc edi
mov ebx, edi
call fcn.1401afbb0
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jae 0x1401af92e
mov eax, edi
xor edx, edx
neg eax
div edi
mov edi, edx
cmp ecx, edx
jae 0x1401af92e
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x13d0]
call fcn.1401afbb0
mov ecx, eax
imul rcx, rbx
cmp ecx, edi
jb 0x1401af913
shr rcx, 0x10
shr rcx, 9
shr rcx, 4
shr rcx, 2
shr rcx, 1
lea edx, [rsi + rcx]
lea r11, [rsp + 0x13b0]
cmp edx, ebp
mov rbx, qword [r11 + 0x10]
lea eax, [rdx + rbp]
mov rbp, qword [r11 + 0x18]
lea ecx, [rdx - 0x80000000]
xchg rsi, rcx
mov rcx, qword [r11 + 0x28]
xchg rsi, rcx
cmovae eax, ecx
mov rsp, r11
nop
add rsp, 8
mov rdi, qword [rsp - 8]
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401afbb0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, qword [rcx]
mov r9d, 0x604a8eae
sub r9d, 0x502c5f86
xor r9d, 0x5e610412
add r9d, 0x2d588575
sub r9d, 0x5401b48
sub r9d, 0x3a350ccf
add r9d, 0x2c84c433
sub r9d, 0x30323947
xor r9d, 0x38b511f4
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x1401afc51
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1401afc0c
mov ecx, dword [r10]
jmp 0x1401afd8a
cmp ecx, 0x4e0
jb 0x1401afd8a
lea r11, [r10 + 0x9c4]
xchg r11, rbx
mov qword [rsp], r11
xchg r11, rbx
mov eax, dword [r11]
mov ebx, 0x2df84a46
xor ebx, 0x3a48f6ee
xor ebx, 0x2aefc24b
sub ebx, 0x38ce75e5
add ebx, 0x5b508dd6
xor ebx, 0x5fe19637
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401afc94
lea r11, [r10 + 0xd50]
mov ebx, 0x242dda6a
xor ebx, 0x1b7ee3c0
sub ebx, 0xe854a3c
sub ebx, 0x24985768
add ebx, 0xa56f529
sub ebx, 0xb22b4a7
sub ebx, 0xb69d6fc
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401afd0c
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 2
shr ecx, 7
shr ecx, 1
shr ecx, 1
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xa
shl eax, 3
shl eax, 1
shl eax, 1
xor edx, eax
mov eax, edx
shr eax, 5
shr eax, 0xa
shr eax, 1
shr eax, 1
shr eax, 1
xor eax, edx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401b0360
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x40]
mov rdi, rdx
mov rbx, rcx
mov byte [rax + rcx], 0x58
sub byte [rax + rcx], 0xd
sub byte [rax + rcx], 0x39
xor byte [rax + rcx], 0x19
add byte [rax + rcx], 0x11
add byte [rax + rcx], 0x56
sub byte [rax + rcx], 0x3c
add byte [rax + rcx], 0x4a
lea r8d, [rax + 1]
cmp eax, 0x38
jae 0x1401b03e0
cmp r8d, 0x38
jae 0x1401b0457
mov ecx, r8d
mov eax, 0xb350d1f
add eax, 0x1fb538c3
add eax, 0x51606e59
sub eax, 0x2c432849
xor eax, 0x1e4d7cb1
sub eax, 0x4e4af70b
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call fcn.1401fd4a6
jmp 0x1401b0457
cmp r8d, 0x40
jae 0x1401b041b
mov ecx, r8d
mov eax, 0x5f39b85d
xor eax, 0x719f085a
sub eax, 0x2709ed8a
add eax, 0x77b6551e
sub eax, 0x3603d2af
sub eax, 0x494f44ac
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call fcn.1401fd4a6
xchg rbx, r12
mov rdx, r12
xchg r12, rbx
mov rcx, rbx
call fcn.1401b0790
xorps xmm0, xmm0
xor eax, eax
xchg r9, rbx
movups xmmword [r9], xmm0
xchg r9, rbx
xchg rbx, rcx
movups xmmword [rcx + 0x10], xmm0
xchg rcx, rbx
xchg rdi, rbx
movups xmmword [rdi + 0x20], xmm0
xchg rdi, rbx
xchg r15, rax
mov qword [rbx + 0x30], r15
xchg r15, rax
mov edx, dword [rbx + 0x40]
xchg r14, rcx
mov r14, rbx
xchg r14, rcx
shl edx, 2
shl edx, 1
add rdx, qword [rbx + 0x48]
xchg rcx, rax
mov rcx, rdx
xchg rcx, rax
xchg r15, rdx
mov qword [rbx + 0x48], r15
xchg rdx, r15
shr rax, 6
shr rax, 1
shr rax, 1
mov byte [rbx + 0x3e], al
xchg rdi, rax
mov rdi, rdx
xchg rdi, rax
shr rax, 7
shr rax, 6
shr rax, 2
shr rax, 1
mov byte [rbx + 0x3d], al
xchg rdi, rax
mov rdi, rdx
xchg rdi, rax
shr rax, 0xd
shr rax, 2
shr rax, 6
shr rax, 2
shr rax, 1
mov byte [rbx + 0x3c], al
xchg rsi, rdx
mov rax, rsi
xchg rsi, rdx
shr rax, 5
shr rax, 0x1a
shr rax, 1
mov byte [rbx + 0x3b], al
mov rax, rdx
shr rax, 0x13
shr rax, 4
shr rax, 0xe
shr rax, 1
shr rax, 1
shr rax, 1
mov byte [rbx + 0x3a], al
xchg r14, rdx
mov rax, r14
xchg rdx, r14
mov byte [rbx + 0x3f], dl
shr rdx, 0x11
shr rdx, 0x15
shr rdx, 0xf
shr rdx, 2
shr rdx, 1
mov byte [rbx + 0x38], dl
mov rdx, rbx
shr rax, 0x2a
shr rax, 1
shr rax, 2
shr rax, 2
shr rax, 1
mov byte [rbx + 0x39], al
call fcn.1401b0790
xor r8d, r8d
lea rdx, [rdi + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbx + 0x50]
lea rdx, [rdx + 1]
mov ecx, 0x9466c9f
add ecx, 0x10fc5c56
add ecx, 0x1a67e1d5
xor ecx, 0x1ca27016
add ecx, 0x32a23d0b
xor ecx, 0x25d501b7
sub ecx, 0x7f7e1638
lea rdi, [rdi + 1]
sub ecx, r8d
neg r8d
add r8d, 0xfffffff8
neg r8d
shr eax, cl
mov byte [rdi - 1], al
mov eax, dword [rbx + 0x54]
shr eax, cl
mov byte [rdx - 5], al
mov eax, dword [rbx + 0x58]
shr eax, cl
mov byte [rdx - 1], al
mov eax, dword [rbx + 0x5c]
shr eax, cl
mov byte [rdx + 3], al
mov eax, dword [rbx + 0x60]
shr eax, cl
mov byte [rdx + 7], al
cmp r8d, 0x20
jb 0x1401b0545
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401b9ac0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp - 8], rbx
sub rsp, 8
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b90f8
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b90e1
mov r8, qword [rcx - 8]
nop
sub rdx, 0x71ca09d5
add rdx, 0x71ca09fc
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b910e
mov rcx, r8
call fcn.1401fc438
xor eax, eax
xchg r12, rax
mov qword [rbx + 0x18], r12
xchg r12, rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
lea rcx, [rbx + 8]
add rsp, 0x20
nop
mov rbx, qword [rsp]
add rsp, 8
jmp 0x1401b9ac0
push rdi
call 0x140ce243d
int3
mov qword [rsp + 0x10], rbx
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
xchg rbx, r9
mov r9, qword [rcx]
xchg rbx, r9
xchg rcx, r10
mov rsi, r10
xchg rcx, r10
mov rax, qword [rbx + 8]
mov qword [rax], 0x1da9bbf2
add qword [rax], 0x19bbaddb
sub qword [rax], 0x220d2fab
xor qword [rax], 0x44238354
sub qword [rax], 0x302f4cac
xor qword [rax], 0x7cad2074
xor qword [rax], 0x4eebb67
sub qword [rax], 0x590ff7d9
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401b9ba9
xchg r10, rdi
mov qword [rsp + 0x30], r10
xchg r10, rdi
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rdx, [rbx + 0x10]
xchg rsi, r11
mov rcx, r11
xchg r11, rsi
call fcn.1401b2b50
mov edx, 0x19de3d19
add edx, 0x1fdccf04
xor edx, 0x679c53b1
add edx, 0x19d72431
sub edx, 0x5f1318af
sub edx, 0x861c99f
xor edx, 0x7e26f5dd
xor edx, 0x6eaf5402
xchg rcx, r10
mov r10, rbx
xchg rcx, r10
call fcn.1401fc438
mov rbx, rdi
test rdi, rdi
jne 0x1401b9b40
xchg rdi, rsi
mov rsi, qword [rsp + 0x30]
xchg rdi, rsi
mov rcx, qword [rsi]
mov edx, 0x16801f1
add edx, 0x267086c0
sub edx, 0xd43d606
add edx, 0xe8b841
add edx, 0x4abac365
xor edx, 0x66382e01
xchg rcx, rbx
mov rcx, qword [rsp + 0x38]
xchg rcx, rbx
add rsp, 0x20
nop
add rsp, 8
mov rsi, qword [rsp - 8]
jmp fcn.1401fc438
Function at 0x1401b9bf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp - 8], rbx
sub rsp, 8
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b91ae
xchg rsi, rdx
mov rsi, qword [rbx + 0x28]
xchg rsi, rdx
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b918f
xchg r12, r8
mov r12, qword [rcx - 8]
xchg r8, r12
nop
add rdx, 0x6544b86a
sub rdx, 0x6544b843
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b91c4
xchg r11, rcx
mov r11, r8
xchg rcx, r11
call fcn.1401fc438
xor eax, eax
xchg r14, rax
mov qword [rbx + 0x18], r14
xchg r14, rax
xchg r15, rax
mov qword [rbx + 0x20], r15
xchg r15, rax
xchg rbp, rax
mov qword [rbx + 0x28], rbp
xchg rbp, rax
lea rcx, [rbx + 8]
add rsp, 0x20
nop
xchg qword [rsp], rbx
add rsp, 8
jmp 0x1401b9bf0
call 0x140c0bf35
int3
mov qword [rsp + 0x10], rbx
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
mov rbx, qword [rcx]
mov rsi, rcx
mov rax, qword [rbx + 8]
mov qword [rax], 0x5ed9a29a
sub qword [rax], 0x1d3c21fe
xor qword [rax], 0x614f4671
add qword [rax], 0x1cf2b549
add qword [rax], 0xa016dbe
xor qword [rax], 0x350b9c82
sub qword [rax], 0x72cd7576
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401b9cc3
xchg rdi, r11
mov qword [rsp + 0x30], r11
xchg r11, rdi
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rcx, [rbx + 0x10]
call fcn.1401b9d10
mov edx, 0x500d08ca
sub edx, 0x4a700a8f
xor edx, 0x3f17003d
sub edx, 0x19049b95
sub edx, 0x1f1c0980
add edx, 0x1bc80e20
add edx, 0x4c90ecae
sub edx, 0x6ac4537f
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.1401fc438
xchg rbp, rdi
mov rbx, rbp
xchg rbp, rdi
test rdi, rdi
jne 0x1401b9c5d
xchg r12, rdi
mov r12, qword [rsp + 0x30]
xchg rdi, r12
mov rcx, qword [rsi]
mov edx, 0xa9ac42f
add edx, 0x34d9815d
add edx, 0x3877ac91
add edx, 0xf2ad6c
sub edx, 0x3c18dc76
sub edx, 0x3cc5c2d3
xchg rbx, r11
mov r11, qword [rsp + 0x38]
xchg r11, rbx
add rsp, 0x20
push rcx
push rbx
push rbx
push rdx
push rbx
push rbx
push rbx
xchg qword [rsp + 0x38], rsi
add rsp, 0x40
jmp fcn.1401fc438
Function at 0x1401fce20
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
push rax
call 0x14068325e
test rax, rax
je 0x1401fce6a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401fce6a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401fce6a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401fce6a
cmp dword [rcx + 0x84], 0xe
jbe 0x1401fce6a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401fce6c
xor al, al
add rsp, 0x28
ret

Function at 0x1401fd288
Capabilities:
Encode data using xor

Disassembly:
cli
push rbp
add al, ch
sti
invalid
call 0x140749976
jb 0x1401fd25b
int3

Function at 0x14022b570
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14022b59d
xor al, al
jmp 0x14022b6ff
mov rax, qword [0x14024a6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14024a6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14024a6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14024a6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14024a6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14024a6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14024a6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14024a6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14024a700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14022b6f1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14022b649
mov r11d, 2
jmp 0x14022b66d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14022b663
mov r11d, 1
jmp 0x14022b66d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14022b715
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14022b6b2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14022b6ca
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14022b6da
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14022b6e8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14022b630
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14022b6fa
Function at 0x140277bc7
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
jmp 0x140b50a8e
syscall
ret

Function at 0x14062d2d5
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
jmp 0x140738b47
syscall
ret

Function at 0x14085fdab
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
jmp 0x14089cc3b
syscall
ret

Function at 0x140aa2f8f
Capabilities:
Execute syscall

Disassembly:
syscall
ret
mov r10, rcx
jmp 0x140a81ebf
Function at 0x140001a58
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rsi, rdx
mov r15d, ecx
mov edx, 0x1000
lea rcx, [rsp + 0x40]
mov rdi, r8
call fcn.1400017a4
mov edx, 0x74
xor ecx, ecx
mov r8d, 0x3000
movups xmm0, xmmword [rax]
lea r9d, [rdx - 0x70]
movups xmmword [rsp + 0x20], xmm0
movsd xmm0, qword [rax + 0x10]
movsd qword [rsp + 0x98], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, 0x5c
lea rdx, [0x140008040]
mov rcx, rax
mov r14, rax
call qword [sym.imp.VCRUNTIME140.dll_memcpy]
mov rbx, qword [rsp + 0x20]
lea rbp, [r14 + 0x5c]
mov r8d, 0x74
mov rdx, r14
lea r12, [rbx + 0x5c]
mov qword [r14 + 6], r12
mov qword [rbp + 0x10], rsi
mov ecx, dword [rdi + 0x28]
add rcx, rsi
mov qword [rbp + 8], rcx
mov rcx, rbx
call fcn.140001758
lea rcx, [0x140005550]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectDecryptStringA]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9d, r15d
mov rdx, rbx
mov r8, rax
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov rbx, rax
jmp 0x140001b58
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, r15d
call qword [sym.imp.USER32.dll_PostThreadMessageA]
mov r8d, 0x18
mov rdx, rbp
mov rcx, r12
call fcn.140001710
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [rbp], 2
jne case.default.0x140001bad
mov rcx, rbx
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
movups xmm0, xmmword [rsp + 0x20]
lea rcx, [rsp + 0x20]
movsd xmm1, qword [rsp + 0x98]
movaps xmmword [rsp + 0x20], xmm0
movsd qword [rsp + 0x30], xmm1
call fcn.1400017fc
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_VirtualFree]
test r13, 0xffffffffc762d7a0
sahf
xchg ebx, eax
xchg esi, eax
fst qword [rdi]
fild dword [rsi - 0x7500dc1f]
int1
cld
cmp dh, byte [rdi - 0x393c2c87]
and ecx, edi
rcl edx, 0xd5
invalid
pushfq
push rax
invalid
invalid
imul ebp, dword [rbx + 0x323c4324], 0x35
and al, 0x43
cmp al, 0x32
xor eax, 0x41302bd0
sub esi, dword [rax]
invalid
invalid
invalid
Function at 0x140001bb4
Capabilities:
Get file size
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x40
and qword [rax - 0x18], 0
xor r9d, r9d
mov dword [rax - 0x20], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rax - 0x28], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140001bf5
xor eax, eax
jmp 0x140001c5a
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor ecx, ecx
mov edx, eax
mov r8d, 0x3000
mov ebx, eax
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
and qword [rsp + 0x20], 0
xor r9d, r9d
mov rdx, rax
mov r8d, ebx
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140001c3d
cmp dword [rdi], 0x905a4d
je 0x140001c4e
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret

Function at 0x140001c6c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
movzx edi, dx
mov ecx, 0xfffffff5
mov esi, 0xc
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, si
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, rbx
call fcn.1400010f0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, di
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140001eb4
Capabilities:
Set console window title

Disassembly:
push rbx
sub rsp, 0x60
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
mov ecx, 0xfffffff5
mov ebx, 0xa
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
movzx edx, bx
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [rsp + 0x38]
call fcn.140001d40
mov rcx, rax
call fcn.14000327c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
lea rcx, [rsp + 0x38]
call fcn.14000332c
lea rcx, str.PhysJect_v5___pOwned_by_FACE_Team_n_n
call qword [sym.imp.VMProtectSDK64.dll_VMProtectDecryptStringA]
mov rcx, rax
call fcn.1400010f0
movzx eax, word [rsp + 0x28]
add rsp, 0x60
pop rbx
ret

Function at 0x140001f34
Capabilities:
Enumerate pe sections

Disassembly:
movzx r9d, word [rdx + 0x14]
movzx eax, word [rdx + 6]
add r9, 0x18
add r9, rdx
lea rdx, [rax + rax*4]
lea r10, [r9 + rdx*8]
cmp r9, r10
jae 0x140001f79
mov edx, dword [r9 + 0xc]
cmp rcx, rdx
jb 0x140001f65
mov eax, dword [r9 + 8]
add eax, edx
cmp rcx, rax
jb 0x140001f6b
add r9, 0x28
jmp 0x140001f4c
mov eax, dword [r9 + 0x14]
sub rax, rdx
add rax, rcx
add rax, r8
ret
xor eax, eax
ret