joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b11a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x25], 0x6c6c642e
mov dword [rsp + 0x20], 0x33656c4f
mov byte [rsp + 0x29], 0
mov byte [rsp + 0x24], 0x32
call fcn.140003a20
add rsp, 0x38
ret

Function at 0x1400b1210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x25], 0x2e323369
mov dword [rsp + 0x29], 0x6c6c64
mov word [rsp + 0x20], 0x7457
mov word [rsp + 0x23], 0x7061
mov byte [rsp + 0x22], reloc.WS2_32.dll_WSAStartup
call fcn.140003a20
add rsp, 0x38
ret

Function at 0x1400b1290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
xor ebx, ebx
call fcn.140009720
mov rdi, rax
test rax, rax
je 0x1400b1304
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x24], 0x6f6d6552
mov rcx, rax
mov dword [rsp + 0x29], 0x6c694665
mov dword [rsp + 0x20], 0x68746150
mov dword [rsp + 0x2d], 0x65705365
mov word [rsp + 0x32], 0x41
mov byte [rsp + 0x28], 0x76
mov byte [rsp + 0x31], 0x63
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b12fc
mov rcx, rsi
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400b1320
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rbx, rcx
mov word [rbp - 0x19], 0x6d65
mov word [rbp - 0x16], 0x6d69
mov dword [rbp - 0xe], 0x6d695465
mov word [rbp - 0xa], 0x65
mov word [rbp - 0x1b], 0x7473
mov dword [rbp - 0x20], 0x53746547
mov dword [rbp - 0x13], 0x69467341
mov byte [rbp - 0x14], 0x65
mov byte [rbp - 0x17], 0x54
mov byte [rbp - 0x1c], 0x79
mov byte [rbp - 0xf], WSAGetLastError
call fcn.140003ad0
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b1389
mov rcx, rbx
call rax
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rbp
ret

Function at 0x1400b13a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
mov dword [rsp + 0x26], 0x50657461
mov dword [rsp + 0x2d], 0x737365
mov dword [rsp + 0x20], 0x6d726554
mov word [rsp + 0x24], 0x6e69
mov word [rsp + 0x2b], 0x636f
mov byte [rsp + 0x2a], WSAStartup
call fcn.140003ad0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b13f9
xor edx, edx
mov rcx, rbx
call rax
add rsp, 0x40
pop rbx
ret
add rsp, 0x40
pop rbx
ret
Function at 0x1400b1400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, r8
mov r14, rcx
xor ebx, ebx
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x1400b1499
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x14], 0x72637365
mov rcx, rax
mov dword [rbp - 0x1b], 0x69727563
mov dword [rbp - 0x20], 0x53746553
mov dword [rbp - 0xa], 0x6c6361
mov word [rbp - 0xf], 0x7470
mov word [rbp - 0xc], 0x4472
mov word [rbp - 0x16], 0x4479
mov byte [rbp - 0x1c], 0x65
mov byte [rbp - 0x10], 0x69
mov byte [rbp - 0x17], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0xd], reloc.WS2_32.dll_WSAGetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b1491
xor r9d, r9d
lea edx, [rbx + 1]
mov r8, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret

Function at 0x1400b1590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov dword [rbp - 9], 0x496e6f69
mov dword [rbp - 0xd], 0x73736553
mov dword [rbp - 0x16], 0x6f436576
mov dword [rbp - 0x20], 0x47535457
mov dword [rbp - 0x11], 0x656c6f73
mov dword [rbp - 0x1a], 0x69746341
mov word [rbp - 5], 0x64
mov word [rbp - 0x1c], 0x7465
mov byte [rbp - 0x12], WSASetLastError
call fcn.140003ad0
mov rcx, rax
lea rdx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b15f2
call rax
add rsp, 0x40
pop rbp
ret
mov eax, 0xffffffff
add rsp, 0x40
pop rbp
ret

Function at 0x1400b1600
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, r8
mov rbp, rdx
xor ebx, ebx
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x1400b1696
lea rdx, [rsp + 0x20]
mov word [rsp + 0x29], 0x6976
mov rcx, rax
mov dword [rsp + 0x31], 0x4165756c
mov word [rsp + 0x2f], 0x6156
mov dword [rsp + 0x22], 0x70756b6f
mov word [rsp + 0x2c], 0x6765
mov byte [rsp + 0x35], bl
mov byte [rsp + 0x2e], 0x65
mov word [rsp + 0x20], 0x6f4c
mov word [rsp + 0x26], 0x7250
mov byte [rsp + 0x28], 0x69
mov byte [rsp + 0x2b], WSASetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b168e
mov r8, rsi
mov rdx, rbp
xor ecx, ecx
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400b16b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rsi, r8
mov rbp, rcx
xor ebx, ebx
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x1400b1749
lea rdx, [rsp + 0x30]
mov word [rsp + 0x3f], 0x6c69
mov rcx, rax
mov dword [rsp + 0x42], 0x736567
mov dword [rsp + 0x31], 0x73756a64
mov dword [rsp + 0x3a], 0x6972506e
mov dword [rsp + 0x36], 0x656b6f54
mov byte [rsp + 0x3e], 0x76
mov byte [rsp + 0x41], 0x65
mov byte [rsp + 0x35], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x30], 0x41
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b1741
mov qword [rsp + 0x28], rbx
lea r9d, [rbx + 0x10]
mov r8, rsi
mov qword [rsp + 0x20], rbx
xor edx, edx
mov rcx, rbp
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x1400b1760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rcx
call fcn.140009720
mov rbx, rax
test rax, rax
je 0x1400b17d6
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x68746150
mov rcx, rax
mov word [rsp + 0x24], 0x6552
mov word [rsp + 0x2e], 0x736e
mov dword [rsp + 0x29], 0x74784565
mov dword [rsp + 0x30], 0x416e6f69
mov word [rsp + 0x27], 0x766f
mov byte [rsp + 0x34], 0
mov byte [rsp + 0x2d], 0x65
mov byte [rsp + 0x26], WSASetLastError
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b17ce
mov rcx, rdi
call rax
mov rcx, rbx
call fcn.1400ab270
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400b17f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x40
mov rsi, r9
mov rbp, r8
mov r14, rdx
mov ebx, 1
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x1400b1886
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x27], 0x49736569
mov rcx, rax
mov dword [rsp + 0x2c], 0x416c6341
mov word [rsp + 0x21], 0x7465
mov word [rsp + 0x24], 0x746e
mov byte [rsp + 0x20], 0x53
mov byte [rsp + 0x2b], WSASetLastError
mov byte [rsp + 0x30], 0
mov byte [rsp + 0x26], WSAStartup
mov byte [rsp + 0x23], 0x45
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b187e
mov r9, rsi
mov r8, rbp
mov rdx, r14
mov ecx, ebx
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x1400b1930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbp, rcx
mov ebx, recv
call fcn.140003b10
mov rdi, rax
test rax, rax
je 0x1400b19a0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x2a], 0x41676e
mov rcx, rax
mov dword [rsp + 0x26], 0x69727453
mov dword [rsp + 0x20], 0x64697555
mov word [rsp + 0x24], 0x6f54
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b1998
mov rdx, rsi
mov rcx, rbp
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400b19c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rcx
call fcn.140009720
mov rdi, rax
test rax, rax
je 0x1400b1a36
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x23], 0x6e694668
mov rcx, rax
mov word [rsp + 0x21], 0x7461
mov word [rsp + 0x2f], 0x4165
mov byte [rsp + 0x31], 0
mov dword [rsp + 0x28], 0x656c6946
mov word [rsp + 0x2c], 0x614e
mov byte [rsp + 0x20], 0x50
mov byte [rsp + 0x2e], WSASetLastError
mov byte [rsp + 0x27], 0x64
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b1a2e
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, rdi
call fcn.1400ab270
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400b1b60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov edi, r9d
mov esi, r8d
mov r14, rdx
mov r15, rcx
call fcn.140003a90
mov rbx, rax
test rax, rax
je 0x1400b1c0f
lea rdx, [rbp - 0x20]
mov word [rbp - 9], 0x614e
mov rcx, rax
mov word [rbp - 6], 0x4165
mov dword [rbp - 0x14], 0x63634174
mov word [rbp - 0xe], 0x5773
mov byte [rbp - 4], 0
mov dword [rbp - 0x20], 0x6c697542
mov dword [rbp - 0x1a], 0x696c7078
mov byte [rbp - 7], WSASetLastError
mov word [rbp - 0xb], 0x6874
mov byte [rbp - 0xc], 0x69
mov word [rbp - 0x10], 0x7365
mov word [rbp - 0x16], 0x6963
mov word [rbp - 0x1c], 0x4564
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b1c07
mov r9d, edi
mov dword [rsp + 0x20], 0
mov r8d, esi
mov rdx, r14
mov rcx, r15
call rax
mov rcx, rbx
call fcn.1400ab270
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rbp
ret

Function at 0x1400b1c30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
mov dword [rsp + 0x26], 0x746e6572
mov dword [rsp + 0x21], 0x75437465
mov dword [rsp + 0x2e], 0x737365
mov dword [rsp + 0x2a], 0x636f7250
mov byte [rsp + 0x20], 0x47
mov byte [rsp + 0x25], WSAStartup
call fcn.140003ad0
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b1c7d
call rax
add rsp, 0x48
ret
mov rax, 0xffffffffffffffff
add rsp, 0x48
ret
Function at 0x1400b1d00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x50
mov rsi, r9
mov rbp, rdx
mov r14, rcx
mov ebx, 1
call fcn.140003a90
mov rdi, rax
test rax, rax
je 0x1400b1db2
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x3a], 0x4565756c
mov rcx, rax
mov dword [rsp + 0x30], 0x51676552
mov word [rsp + 0x3f], 0x57
mov word [rsp + 0x37], 0x5679
mov word [rsp + 0x34], 0x6575
mov byte [rsp + 0x3e], 0x78
mov byte [rsp + 0x39], 0x61
mov byte [rsp + 0x36], WSAStartup
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x1400b1daa
mov rax, qword [rsp + 0x88]
mov r9, rsi
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rax, qword [rsp + 0x80]
mov rdx, rbp
mov rcx, r14
mov qword [rsp + 0x20], rax
call r10
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret

Function at 0x1400b1dd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov rbp, rdx
xor ebx, ebx
call fcn.140009760
mov rdi, rax
test rax, rax
je 0x1400b1e44
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x25], 0x6f426567
mov rcx, rax
mov dword [rsp + 0x20], 0x7373654d
mov byte [rsp + 0x24], 0x61
mov word [rsp + 0x29], 0x4178
mov byte [rsp + 0x2b], bl
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b1e3c
lea r9d, [rbx + 0x10]
mov r8, rsi
mov rdx, rbp
xor ecx, ecx
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rbp, qword [rsp + 0x48]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1400b1e60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x40
mov rsi, rdx
mov r14, rcx
xor ebx, ebx
call fcn.1400b1250
mov rdi, rax
test rax, rax
je 0x1400b1eed
lea rdx, [rbp - 0x20]
mov dword [rbp - 0x16], 0x6e6f6973
mov rcx, rax
mov word [rbp - 0xa], 0x41
mov dword [rbp - 0x1f], 0x69467465
mov dword [rbp - 0x1a], 0x72655665
mov dword [rbp - 0xf], 0x7a69536f
mov word [rbp - 0x11], 0x666e
mov byte [rbp - 0x12], 0x49
mov byte [rbp - 0x1b], WSAGetLastError
mov byte [rbp - 0x20], 0x47
mov byte [rbp - 0xb], 0x65
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400b1ee5
mov rdx, rsi
mov rcx, r14
call rax
mov ebx, eax
mov rcx, rdi
call fcn.1400ab270
mov rsi, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x1800123dc
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x18000003c]
lea rsi, [0x180000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x180012454
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x180012454
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x180012454
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x180012448
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x180012466
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x180012436
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x180012456

Function at 0x180012990
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1800129b8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1800129b8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140004770
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x40], rcx
mov eax, dword [0x1401f3460]
mov ecx, dword [0x1401f3464]
xor ecx, 0x7703e652
or eax, ecx
mov edx, 0xaa2dfff0
xor edx, 0xb5e56afe
mov ecx, eax
and ecx, edx
shl ecx, 1
add eax, 0x1fc8950e
sub eax, ecx
mov r8d, 0xffffffff
xor r8d, 0xd8ab2d75
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xd8ab2d75
mov r8d, 0xedc56d27
xor r8d, 0x356e4052
or eax, r8d
imul eax, edx
add eax, ecx
or eax, 0x2462fa26
mov ecx, 0x8994212d
xor ecx, 0xe8667256
cmp eax, ecx
ja 0x1400048c1
mov eax, dword [0x1401f3468]
mov ecx, 0x8c6c03e1
xor ecx, 0x7b3b8ddd
xor eax, ecx
mov ecx, dword [0x1401f346c]
xor ecx, 0x1a02c618
xor eax, ecx
sub eax, 0x1f448a0b
xor eax, 0xdf5649ce
mov ecx, 0xe74eba0e
xor ecx, 0xe74eba0e
mov edx, 0x9659f9d0
xor edx, 0x7a4b5506
sub ecx, edx
sub eax, ecx
mov dword [rsp + 0x38], eax
call fcn.14000448f
mov rcx, rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov rcx, rax
add rcx, 0x18
mov qword [rsp + 0x30], rcx
mov rcx, qword [rax + 0x18]
call fcn.1400044b0
mov cl, al
mov eax, dword [rsp + 0x38]
mov byte [rsp + 0x3f], cl
cmp eax, 0xd9c0228f
jae 0x1400047f8
mov al, byte [rsp + 0x3f]
test al, 1
jne 0x14000488e
jmp 0x1400048bb
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call fcn.1400d44b0
mov rax, qword [rsp + 0x28]
cmp byte [rax], 0
jne 0x1400048bb
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
mov edx, 8
call fcn.14000fac0
nop
add rsp, 0x48
ret
sub dword [rdx], eax
retf 0xe98e
Function at 0x14000a130
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rdx
mov eax, dword [0x1401f37c8]
mov ecx, dword [0x1401f37cc]
xor ecx, 0x8efa19b2
sub eax, ecx
mov ecx, eax
and ecx, 0x85a32e02
shl ecx, 1
add eax, 0x85a32e02
sub eax, ecx
add eax, 0x1b57410a
mov ecx, 0x7936a398
xor edx, edx
div ecx
cmp eax, 0x2d402494
je 0x14000a1e1
mov eax, dword [0x1401f37d0]
or eax, dword [0x1401f37d4]
or eax, 0x52831991
mov ecx, 0x6b747047
xor ecx, 0xfa65b986
xor edx, edx
div ecx
mov ecx, 0x185fe032
xor edx, edx
div ecx
mov rdx, qword [rsp + 0x30]
mov dword [rsp + 0x24], eax
xor eax, eax
mov ecx, eax
mov r8d, 0x3000
mov r9d, 4
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, rax
mov eax, dword [rsp + 0x24]
mov qword [rsp + 0x28], rcx
cmp eax, 0x2d07c261
ja 0x14000a178
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret
mov dh, 5
leave
in al, dx
jmp 0x14000a178

Function at 0x14000c804
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rcx
call fcn.14000c827
mov rdx, qword [rsp + 0x20]
mov rcx, rax
add rcx, 0x58
add rsp, 0x28
jmp fcn.14000bd40

Function at 0x140017ed0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rcx
mov edx, dword [0x1401f3cb8]
mov eax, 0xf7ac42e8
xor eax, 0x2d2e6ce7
xor edx, eax
mov ecx, dword [0x1401f3cbc]
mov eax, edx
xor eax, 0xffffffff
mov r8d, 0xbaf6c131
xor r8d, 0x45093ece
xor edx, r8d
and eax, edx
or ecx, ecx
mov edx, 0x2feae508
xor edx, 0xd0151af7
xor ecx, edx
xor eax, 0xffffffff
xor ecx, 0xffffffff
and eax, ecx
xor ecx, ecx
sub ecx, 0xa7ca4656
add eax, ecx
mov edx, 0x37c8fa3c
xor edx, 0x1cfdb74f
mov ecx, eax
xor ecx, edx
xor ecx, 0xffffffff
and ecx, 0x2b354d73
shl ecx, 1
sub ecx, 0x2b354d73
sub eax, ecx
mov r8d, 0xffffffff
xor r8d, 0xdd18d462
mov edx, eax
and edx, r8d
mov ecx, eax
or ecx, r8d
xor ecx, 0xffffffff
imul ecx, edx
mov edx, eax
and edx, 0xdd18d462
mov r8d, 0xf36892ac
xor r8d, 0x2e7046ce
or eax, r8d
imul eax, edx
add eax, ecx
mov ecx, 0x4129fcf5
xor ecx, 0x991a2ee7
cmp eax, ecx
je 0x140017fe7
mov rcx, qword [rsp + 0x30]
mov eax, dword [0x1401f3cc0]
and eax, dword [0x1401f3cc4]
mov edx, 0xb78a5ef
xor edx, 0x7c562c70
add eax, edx
xor eax, 0x7ebe6c14
mov edx, 0x43ee0378
xor edx, 0x22e3b96f
imul eax, edx
mov dword [rsp + 0x2c], eax
call fcn.140017c50
mov eax, dword [rsp + 0x2c]
cmp eax, 0x60c87453
jae 0x140017f99
add rsp, 0x38
ret
movsd dword [rdi], dword [rsi]
mov ebx, 0xa9e9ca88
invalid
Function at 0x14001af30
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x40
mov qword [rsp + 0x38], rcx
mov r8d, dword [0x1401f3dd8]
mov edx, dword [0x1401f3ddc]
xor edx, 0x402db91
mov eax, r8d
xor eax, 0xffffffff
and eax, 0xc7f79c44
mov r9d, 0x7e2ef39c
xor r9d, 0xb9d96fd8
mov ecx, 0xfc82c1b7
xor ecx, 0x37d3e48
xor r9d, ecx
and r8d, r9d
mov ecx, edx
xor ecx, 0xffffffff
and ecx, 0xc7f79c44
and edx, r9d
or eax, r8d
or ecx, edx
xor eax, ecx
or eax, 0xb0377864
xor ecx, ecx
sub ecx, 0xf8e567d2
sub eax, ecx
sub eax, 0xeeb3e786
cmp eax, 0x78c2ce3a
jb 0x14001b143
mov r11d, dword [0x1401f3de0]
mov r10d, dword [0x1401f3de4]
xor r10d, 0x24f24bb1
mov ecx, r11d
xor ecx, 0xffffffff
mov r8d, r10d
xor r8d, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x52e1d61d
mov eax, ecx
and eax, 0x52e1d61d
and r11d, edx
mov esi, 0xf3d70637
xor esi, 0xa136d02a
mov r9d, r8d
and r9d, esi
and r10d, edx
or eax, r11d
or r9d, r10d
xor eax, r9d
or ecx, r8d
xor ecx, 0xffffffff
or edx, 0x52e1d61d
and ecx, edx
or eax, ecx
sub eax, 0x998f435a
sub eax, 0xcc4f5637
add eax, 0x254ca521
add eax, 0xcc4f5637
mov ecx, 0x2ee0e811
xor ecx, 0x94fa5d30
xor eax, ecx
mov dword [rsp + 0x30], eax
mov eax, 0x5c0bdb2d
xor eax, 0x8e0e0cfc
mov dword [rsp + 0x2c], eax
call fcn.14000c827
mov rcx, rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rax]
call fcn.1400c9800
mov rdx, qword [rsp + 0x20]
mov ecx, dword [rsp + 0x2c]
mov eax, dword [rsp + 0x30]
cmp byte [rdx + 0x50], 0
sete dl
mov byte [rsp + 0x37], dl
cmp eax, ecx
jae 0x14001afaa
mov al, byte [rsp + 0x37]
test al, 1
jne 0x14001b08c
jmp 0x14001b13d
mov eax, dword [0x1401f3de8]
mov ecx, dword [0x1401f3dec]
xor ecx, 0xe70d4c1b
sub eax, ecx
or eax, 0xc724c51f
mov ecx, 0xffffffff
xor ecx, 0x7448c719
xor edx, edx
sub edx, 1
sub ecx, edx
sub eax, ecx
mov ecx, 0x8ca7c044
xor ecx, 0x951d1456
add eax, ecx
add eax, 0xc98f8a3a
sub eax, 0x19bad412
cmp eax, 0x13095532
jbe 0x14001b14c
mov rdx, qword [rsp + 0x38]
mov eax, dword [0x1401f3df0]
mov r8d, dword [0x1401f3df4]
mov r9d, eax
and r9d, r8d
mov ecx, 0xc08b273
xor ecx, 0xc08b271
imul ecx, r9d
add eax, r8d
sub eax, ecx
or eax, 0x750ff2f1
mov ecx, 0x76035512
xor ecx, 0x90ab1ba1
xor eax, ecx
sub eax, 0x70af87ec
mov ecx, 0xbd5a0db9
xor ecx, 0x254af86a
mov qword [rdx], 0
cmp eax, ecx
jb 0x14001b0db
jmp 0x14001b13d
add rsp, 0x40
pop rsi
ret
sbb eax, 0x5ee97b2b
invalid
mov dword [rdx + 0x64], esi
sub al, 0xe9
xchg bh, bh
invalid
Function at 0x140022840
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
mov rdx, qword [rcx]
mov rax, rdx
add rax, 0xffffffffffffffff
mov qword [rsp + 0x50], rax
mov rcx, rax
xor rcx, rdx
cmp rcx, 0
setl cl
cmp rax, 0xffffffffffffffff
setg al
and al, cl
test al, 1
jne 0x140022898
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
add rcx, 8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
jmp 0x1400228a2
call fcn.140009cc0
jmp 0x140022980
mov rcx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x28], rax
cmp rax, rcx
jl 0x140022973
mov rax, qword [rsp + 0x28]
cmp rax, 0
jl 0x1400228dc
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x48]
cmp rax, qword [rcx]
jl 0x1400228e9
mov rcx, rdx
call fcn.140013c92
jmp 0x140022980
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
add rcx, 8
shl rax, 5
add rcx, rax
call fcn.1400227f8
mov rcx, qword [rsp + 0x28]
mov rax, rcx
add rax, 0xffffffffffffffff
mov r8, rax
xor r8, rcx
xor r8, 0xffffffffffffffff
mov rdx, rcx
and rdx, r8
movabs r8, 0xefb166f9a0bd3bbd
movabs r9, 0xefb166f9a0bd3bbf
xor r8, r9
imul r8, rdx
sub r8, rcx
mov rdx, rax
sub rdx, r8
cmp rdx, 0
setl dl
cmp rcx, 0
setne cl
and cl, dl
test cl, 1
mov qword [rsp + 0x38], rax
jne 0x140022969
jmp 0x1400228a2
call fcn.140009cc0
jmp 0x140022980
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov qword [rax], rcx
mov eax, dword [0x1401f40f8]
mov ecx, 0xa3c7b63a
xor ecx, 0x4aae9801
xor eax, ecx
add eax, dword [0x1401f40fc]
mov edx, 0xf8075d6d
xor edx, 0x7f8a292
mov ecx, eax
xor ecx, edx
mov edx, 0x33aa0687
xor edx, 0x5bed898e
and ecx, edx
mov edx, 0xffffffff
xor edx, 0x68478f09
and eax, edx
sub eax, ecx
mov edx, 0x4965a26c
xor edx, 0xb69a5d93
mov ecx, eax
xor ecx, edx
mov edx, 0xffffffff
xor edx, 0xeb404575
and ecx, edx
mov edx, 0x79107623
xor edx, 0x92503356
or eax, edx
mov edx, 0x2b7a7afa
xor edx, 0xd4858505
xor eax, edx
xor ecx, 0xffffffff
xor eax, 0xffffffff
and ecx, eax
mov edx, 0xffffffff
xor edx, 0xbe45e77f
mov eax, ecx
xor eax, edx
and eax, ecx
cmp eax, 0xfde47c54
je 0x140022a8f
mov ecx, dword [0x1401f4100]
add ecx, dword [0x1401f4104]
mov eax, 0x297a2518
xor eax, 0x4076e084
mov edx, 0xcfe9f3f1
xor edx, 0x30160c0e
xor eax, edx
add ecx, eax
add ecx, 1
mov edx, 0x63963098
xor edx, 0x9c69cf67
mov eax, ecx
xor eax, edx
and eax, 0xb33e790a
mov edx, 0x184031c
xor edx, 0xb2ba7a16
mov r8d, 0xe4101342
xor r8d, 0x1befecbd
xor edx, r8d
and ecx, edx
or eax, ecx
imul eax, eax, 0xda474d8c
cmp eax, 0x35ad4781
je 0x140022a1e
add rsp, 0x58
ret
in al, dx
mov ch, 0xe1
invalid