joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001a20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9b, byte [rcx]
mov eax, r8d
mov r11, rcx
xor r9b, dl
lea r10, [rcx + 2]
xor r9b, 0x11
cmp r9b, 2
jne 0x140001a44
mov rax, r10
jmp 0x140001a8f
test r9b, r9b
jne 0x140001a8d
mov r8d, edx
mov r9, r10
xor r8d, 0x6aa82011
test eax, eax
jle 0x140001a85
mov rbx, rax
movzx eax, byte [r9]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r9], cl
inc r9
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec rbx
jne 0x140001a5d
xor dl, 0x13
mov byte [r11], dl
jmp 0x140001a3f
xor eax, eax
mov rbx, qword [rsp + 8]
ret

Function at 0x140001a98
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x1401428a0]
xor rbx, r9
mov r11d, edx
mov ecx, 0x4bc28ee2
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0xb20d351f
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xe2
cmp al, 2
je 0x140001b17
test al, al
jne 0x140001b15
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001b0c
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001ae4
xor r9b, 0xe0
mov byte [rbx], r9b
jmp 0x140001b17
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140001b20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, str.Q_QTB
xor rbx, r9
mov r11d, edx
mov ecx, 0xd7ff1ce
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x84147219
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xce
cmp al, 2
je 0x140001b9f
test al, al
jne 0x140001b9d
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001b94
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001b6c
xor r9b, 0xcc
mov byte [rbx], r9b
jmp 0x140001b9f
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140001ba8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, str.iOkl_
xor rbx, r9
mov r11d, edx
mov ecx, 0x88f310dc
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x8aa5c5a4
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xdc
cmp al, 2
je 0x140001c27
test al, al
jne 0x140001c25
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001c1c
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001bf4
xor r9b, 0xde
mov byte [rbx], r9b
jmp 0x140001c27
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret
Function at 0x140001c30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, str.3hhg_
xor rbx, r9
mov r11d, edx
mov ecx, 0x9ad60ef9
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x461f9190
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xf9
cmp al, 2
je 0x140001caf
test al, al
jne 0x140001cad
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001ca4
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001c7c
xor r9b, 0xfb
mov byte [rbx], r9b
jmp 0x140001caf
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140001cb8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x140152de0]
xor rbx, r9
mov r11d, edx
mov ecx, 0x6d75ed79
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0xa1b17e29
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x79
cmp al, 2
je 0x140001d37
test al, al
jne 0x140001d35
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001d2c
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001d04
xor r9b, 0x7b
mov byte [rbx], r9b
jmp 0x140001d37
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140001d40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x140152e40]
xor rbx, r9
mov r11d, edx
mov ecx, 0xac66ee0e
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0xa0e93b2f
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xe
cmp al, 2
je 0x140001dbf
test al, al
jne 0x140001dbd
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001db4
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001d8c
xor r9b, 0xc
mov byte [rbx], r9b
jmp 0x140001dbf
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140001dc8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x1401532d0]
xor rbx, r9
mov r11d, edx
mov ecx, 0x21403b78
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x1b6f3fee
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x78
cmp al, 2
je 0x140001e47
test al, al
jne 0x140001e45
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001e3c
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001e14
xor r9b, 0x7a
mov byte [rbx], r9b
jmp 0x140001e47
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140001ec8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, ecx
mov r9d, edx
mov eax, edx
xor rcx, rax
xor r9d, r8d
lea rax, [0x140153ab0]
xor r9d, 0x157c2c32
xor rcx, 0x1b367056
lea r8d, [r9 + r9]
add rcx, rax
jmp fcn.140001e50
Function at 0x140001ef8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x140153de0]
xor rbx, r9
mov r11d, edx
mov ecx, 0x48e0664c
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x5340e5b1
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x4c
cmp al, 2
je 0x140001f77
test al, al
jne 0x140001f75
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140001f6c
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140001f44
xor r9b, 0x4e
mov byte [rbx], r9b
jmp 0x140001f77
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140001f80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9b, byte [rcx]
mov eax, r8d
mov r11, rcx
xor r9b, dl
lea r10, [rcx + 2]
xor r9b, 0x5f
cmp r9b, 2
jne 0x140001fa4
mov rax, r10
jmp 0x140001fef
test r9b, r9b
jne 0x140001fed
mov r8d, edx
mov r9, r10
xor r8d, 0x1326695f
test eax, eax
jle 0x140001fe5
mov rbx, rax
movzx eax, byte [r9]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r9], cl
inc r9
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec rbx
jne 0x140001fbd
xor dl, 0x5d
mov byte [r11], dl
jmp 0x140001f9f
xor eax, eax
mov rbx, qword [rsp + 8]
ret

Function at 0x140001ff8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x1401576a0]
xor rbx, r9
mov r11d, edx
mov ecx, 0x82b9715c
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0xc39adf6e
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x5c
cmp al, 2
je 0x140002077
test al, al
jne 0x140002075
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x14000206c
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140002044
xor r9b, 0x5e
mov byte [rbx], r9b
jmp 0x140002077
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140002080
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x140157980]
xor rbx, r9
mov r11d, edx
mov ecx, 0xfdc047fa
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0xf05d0fe0
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xfa
cmp al, 2
je 0x1400020ff
test al, al
jne 0x1400020fd
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x1400020f4
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x1400020cc
xor r9b, 0xf8
mov byte [rbx], r9b
jmp 0x1400020ff
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret
Function at 0x140002108
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9b, byte [rcx]
mov eax, r8d
mov r11, rcx
xor r9b, dl
lea r10, [rcx + 2]
xor r9b, 0xb
cmp r9b, 2
jne 0x14000212c
mov rax, r10
jmp 0x140002177
test r9b, r9b
jne 0x140002175
mov r8d, edx
mov r9, r10
xor r8d, 0x89a38c0b
test eax, eax
jle 0x14000216d
mov rbx, rax
movzx eax, byte [r9]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r9], cl
inc r9
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec rbx
jne 0x140002145
xor dl, 9
mov byte [r11], dl
jmp 0x140002127
xor eax, eax
mov rbx, qword [rsp + 8]
ret

Function at 0x1400021b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x14015b820]
xor rbx, r9
mov r11d, edx
mov ecx, 0x279310ed
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x271cc3de
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xed
cmp al, 2
je 0x14000222f
test al, al
jne 0x14000222d
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140002224
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x1400021fc
xor r9b, 0xef
mov byte [rbx], r9b
jmp 0x14000222f
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140002238
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov r10d, ecx
lea rax, [0x14015ba60]
xor r10, r9
mov ecx, 0xbc9d538f
mov r11d, r8d
xor r10, rcx
add r10, rax
mov al, byte [r10]
xor al, dl
lea rdx, [r10 + 2]
xor al, 0x8f
cmp al, 2
je 0x1400022be
test al, al
jne 0x1400022bc
mov eax, r9d
mov r8d, r9d
xor eax, r11d
xor r8d, ecx
xor eax, 0x209f2e1b
add eax, eax
movsxd rbx, eax
test eax, eax
jle 0x1400022b3
mov r11, rdx
movzx eax, byte [r11]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r11], cl
inc r11
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec rbx
jne 0x14000228b
xor r9b, 0x8d
mov byte [r10], r9b
jmp 0x1400022be
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x1400022c8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x14015bda8]
xor rbx, r9
mov r11d, edx
mov ecx, 0x2acce532
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x930ec70a
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x32
cmp al, 2
je 0x140002347
test al, al
jne 0x140002345
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x14000233c
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x140002314
xor r9b, 0x30
mov byte [rbx], r9b
jmp 0x140002347
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret
Function at 0x140002350
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x14015bde0]
xor rbx, r9
mov r11d, edx
mov ecx, 0x15e8b2bc
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x88e83fda
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xbc
cmp al, 2
je 0x1400023cf
test al, al
jne 0x1400023cd
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x1400023c4
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x14000239c
xor r9b, 0xbe
mov byte [rbx], r9b
jmp 0x1400023cf
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x1400023d8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9b, byte [rcx]
mov eax, r8d
mov r11, rcx
xor r9b, dl
lea r10, [rcx + 2]
xor r9b, 0x5f
cmp r9b, 2
jne 0x1400023fc
mov rax, r10
jmp 0x140002447
test r9b, r9b
jne 0x140002445
mov r8d, edx
mov r9, r10
xor r8d, 0xf39c6d5f
test eax, eax
jle 0x14000243d
mov rbx, rax
movzx eax, byte [r9]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r9], cl
inc r9
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec rbx
jne 0x140002415
xor dl, 0x5d
mov byte [r11], dl
jmp 0x1400023f7
xor eax, eax
mov rbx, qword [rsp + 8]
ret

Function at 0x140002450
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov r10d, ecx
lea rax, [0x14015be50]
xor r10, r9
mov ecx, 0xb3a62731
mov r11d, r8d
xor r10, rcx
add r10, rax
mov al, byte [r10]
xor al, dl
lea rdx, [r10 + 2]
xor al, 0x31
cmp al, 2
je 0x1400024d6
test al, al
jne 0x1400024d4
mov eax, r9d
mov r8d, r9d
xor eax, r11d
xor r8d, ecx
xor eax, 0x3522902f
add eax, eax
movsxd rbx, eax
test eax, eax
jle 0x1400024cb
mov r11, rdx
movzx eax, byte [r11]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r11], cl
inc r11
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec rbx
jne 0x1400024a3
xor r9b, 0x33
mov byte [r10], r9b
jmp 0x1400024d6
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x1400024e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x14015c198]
xor rbx, r9
mov r11d, edx
mov ecx, 0x6510201b
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x965e3270
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x1b
cmp al, 2
je 0x14000255f
test al, al
jne 0x14000255d
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140002554
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x14000252c
xor r9b, 0x19
mov byte [rbx], r9b
jmp 0x14000255f
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret
Function at 0x140002568
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x14015c1c0]
xor rbx, r9
mov r11d, edx
mov ecx, 0x53d24f1
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x216d9028
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xf1
cmp al, 2
je 0x1400025e7
test al, al
jne 0x1400025e5
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x1400025dc
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x1400025b4
xor r9b, 0xf3
mov byte [rbx], r9b
jmp 0x1400025e7
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x1400025f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x14015c6b0]
xor rbx, r9
mov r11d, edx
mov ecx, 0x87f998c5
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x8e1b548b
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0xc5
cmp al, 2
je 0x14000266f
test al, al
jne 0x14000266d
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x140002664
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x14000263c
xor r9b, 0xc7
mov byte [rbx], r9b
jmp 0x14000266f
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret

Function at 0x140002678
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r9d, edx
mov ebx, ecx
lea rax, [0x14015ec30]
xor rbx, r9
mov r11d, edx
mov ecx, 0x6137da7e
xor rbx, rcx
xor r11d, r8d
add rbx, rax
mov al, dl
xor r11d, 0x700735da
xor al, byte [rbx]
lea rdx, [rbx + 2]
xor al, 0x7e
cmp al, 2
je 0x1400026f7
test al, al
jne 0x1400026f5
mov r8d, r9d
mov r10, rdx
xor r8d, ecx
test r11d, r11d
jle 0x1400026ec
movzx eax, byte [r10]
mov ecx, r8d
shr ecx, 8
xor cl, al
add eax, r8d
mov byte [r10], cl
inc r10
imul r8d, eax, 0xce6d
add r8d, 0x58bf
dec r11
jne 0x1400026c4
xor r9b, 0x7c
mov byte [rbx], r9b
jmp 0x1400026f7
xor edx, edx
mov rbx, qword [rsp + 8]
mov rax, rdx
ret
Function at 0x1400047cc
Capabilities:
Shutdown system

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor ebx, ebx
test eax, eax
jne 0x140004804
xor eax, eax
jmp 0x140004863
lea r8, [rsp + 0x3c]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x44], 2
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140004800
lea ecx, [rax + 0x12]
xor edx, edx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
setne bl
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400e79e0
add rsp, 0x50
pop rbx
ret

Function at 0x140004878
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x360
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x350], rax
mov rbx, rcx
lea rcx, [0x140163efa]
mov edx, 0xca1e58b8
mov r8d, 0x18
call section..text
lea rdx, [rsp + 0x30]
sub rdx, rax
mov cl, byte [rax]
mov byte [rdx + rax], cl
inc rax
test cl, cl
jne 0x1400048b5
or rdx, 0xffffffffffffffff
test rbx, rbx
je 0x1400048f5
lea rcx, [rsp + 0x30]
mov rax, rdx
inc rax
cmp byte [rcx + rax], 0
jne 0x1400048d2
lea rcx, [rsp + 0x30]
add rcx, rax
mov byte [rcx], 0x2f
sub rcx, rbx
mov al, byte [rbx]
inc rbx
mov byte [rcx + rbx], al
test al, al
jne 0x1400048e9
lea rax, [rsp + 0x140]
mov r9d, edx
lea r8, [rsp + 0x30]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea r8, [rsp + 0x140]
lea rdx, str.open
xor r9d, r9d
xor ecx, ecx
mov dword [rsp + 0x28], 5
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x350]
xor rcx, rsp
call fcn.1400e79e0
add rsp, 0x360
pop rbx
ret

Function at 0x140004960
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x150
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x28]
xor edx, edx
mov r8d, 0x10c
mov qword [rsp + 0x20], 0x114
xor edi, edi
call fcn.1400ea1b0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x24], 6
jae 0x1400049f1
mov rbx, qword [0x1401745b8]
mov rax, qword [rbx + 8]
sub rax, qword [rbx]
sar rax, 3
test rax, rax
je 0x1400049e5
mov rcx, qword [rbx]
mov rcx, qword [rcx + rdi*8]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rax, qword [rbx + 8]
inc rdi
sub rax, qword [rbx]
sar rax, 3
cmp rdi, rax
jb 0x1400049c5
mov rax, qword [rbx]
mov qword [rbx + 8], rax
call fcn.14001a9c8
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400e79e0
mov rbx, qword [rsp + 0x160]
add rsp, 0x150
pop rdi
ret
Function at 0x140004a6c
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov qword [0x140174598], rcx
mov ecx, 0x30
call fcn.1400e8114
test rax, rax
je 0x140004aa7
mov rdx, qword [0x1401745c0]
and qword [rax + 0x10], 0
and qword [rax + 0x20], 0
mov qword [rax], rdx
mov qword [rax + 8], rbx
mov byte [rax + 0x2a], 0
mov qword [0x1401745b0], rax
mov rax, qword [0x1401745a8]
mov edx, dword [rax + 0x24]
shr edx, 6
and dl, 1
call fcn.14000a14c
mov rdx, rbx
call fcn.14000ba64
lea rcx, [0x140166cf2]
mov edx, 0x11838db2
mov r8d, 0x14
call fcn.140001198
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x140004b1d
lea rcx, [0x140166d08]
mov edx, 0xceccb0be
mov r8d, 0x1a
call fcn.140001198
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401746f0], rax
lea rcx, [fcn.14000963c]
xor edx, edx
call fcn.1400097e8
lea rax, [rsp + 0x40]
lea r8, [0x140008f74]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1401746a8], rax
add rsp, 0x30
pop rbx
ret
Function at 0x140005824
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x258
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rsp + 0x240], rax
add cl, 0x41
movzx eax, cl
lea rcx, [0x140174700]
mov rcx, qword [rcx + rax*8 - 0x208]
test rcx, rcx
je 0x1400058ae
cmp byte [rcx + 0x9b], 0
je 0x1400058ae
lea rdx, [rsp + 0x30]
call fcn.140028e04
lea rcx, [rsp + 0x30]
call fcn.14001f944
test al, al
je 0x1400058ae
mov edx, 0xbd2d0ebe
mov ecx, 0x59e556c7
mov r8d, 0xd85430c1
call fcn.140001078
lea r8, [rsp + 0x30]
xor r9d, r9d
xor ecx, ecx
mov rdx, rax
mov dword [rsp + 0x28], 5
and qword [rsp + 0x20], 0
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400e79e0
add rsp, 0x258
ret

Function at 0x1400058c8
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x140162470]
xor rax, rsp
mov qword [rbp + 0x4f], rax
movzx eax, dl
xor edi, edi
mov rbx, rcx
lea ecx, [rax + 0x41]
and edx, 0xff00
mov dword [rbp + 0x49], 0x5c003a
mov word [rbp + 0x47], cx
mov word [rbp + 0x4d], di
cmp edx, 0x2000
je 0x140005a64
cmp edx, 0x2100
je 0x140005a2e
cmp edx, 0x2200
je 0x140005a21
cmp edx, 0x2300
je 0x140005a14
cmp edx, 0x2400
je 0x140005a0a
cmp edx, 0x2500
je 0x140005a01
cmp edx, 0x2600
je 0x1400059f6
cmp edx, 0x2700
je 0x1400059f2
cmp edx, 0x2800
jne 0x140005a75
lea r8d, [rdi + 0x6c]
lea rcx, [rbp - 0x25]
xor edx, edx
call fcn.1400ea1b0
mov edx, 0xfde615c1
mov ecx, 0x192e4da4
mov r8d, 0x989f2bb0
mov dword [rbp - 0x29], 0x70
mov dword [rbp - 0x25], InitCommonControls
mov qword [rbp - 0x21], rbx
call fcn.140001078
mov edx, 0x8a1728e5
mov qword [rbp - 0x19], rax
lea rax, [rbp + 0x47]
mov ecx, 0x6edf7098
mov r8d, 0xef6e169e
mov qword [rbp - 0x11], rax
call fcn.140001078
lea rcx, [rbp - 0x29]
mov qword [rbp - 1], rdi
mov dword [rbp + 7], 5
mov qword [rbp + 0xf], rdi
mov qword [rbp - 9], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x140005a75
xor edx, edx
jmp 0x1400059f8
mov dl, 1
mov ecx, eax
call fcn.140005784
jmp 0x140005a75
mov ecx, eax
call fcn.140005824
jmp 0x140005a75
movzx edx, cx
call fcn.14000b1f8
jmp 0x140005a75
movzx edx, cx
mov rcx, rbx
call fcn.14000ea18
jmp 0x140005a75
movzx edx, cx
mov rcx, rbx
call fcn.14000e974
jmp 0x140005a75
mov edx, 0xd78425c7
mov ecx, 0x334c7d8a
mov r8d, 0xb2fd1bb8
call fcn.140001078
lea r8, [rbp + 0x47]
xor r9d, r9d
xor ecx, ecx
mov rdx, rax
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x140005a75
lea r8d, [rax + 0x41]
mov edx, 7
mov rcx, rbx
call fcn.1400184a8
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.1400e79e0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret