joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004020
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.AZRkCmYVKvNgzuGoWryPVwMGrDZtFNnICsqzEZZtCIBwrlJrZHiJCaSBVXEiTBfLimMJSLVFxqlOPNfsJEedRdPrGnCtIKMphFAVqvrlLwXZzxjObPFuvTkXwpHCqXjDUCJKZnNyVqrBCCXFimRJbapklAlzbYpKbGAoXmQXIfHwHxpOevVRaJfxWLtPSrQDsOtTgXZpVSLcABCWIbxOcQQqBpuBqtQepddOqHzGTRhBGROCbOSTUMNHYzCnHMBfCOpGxXUZLykHjdtvFECCurxHPNXzxIerEVXZFppzcNGazDYOHrFeTwqnuGSjFMbwgZQpVwawLcRuRBcDNAWEEDpzIbUwHwuONUqhHcBglTMqnKwsTBeMKkdHThdiWoFuUVvouJBBKepGffHdDkXEghHlkoimSbJYxSAPFmHqaBaJukXSdfUYJzeuohAbFvUnFGDVBGSHjfCTRsnLIVHdxkfidIUQOhmZpQKvrIRNlUyWXkaFz
mov r10, rax
sub rbx, rax
movabs rdi, 0x1073260a47f7c66d
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xc]
mul rcx
add r11d, 0xc
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xb]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xc
jb 0x140004070
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004260
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx - 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.AZRkCmYVKvNgzuGoWryPVwMGrDZtFNnICsqzEZZtCIBwrlJrZHiJCaSBVXEiTBfLimMJSLVFxqlOPNfsJEedRdPrGnCtIKMphFAVqvrlLwXZzxjObPFuvTkXwpHCqXjDUCJKZnNyVqrBCCXFimRJbapklAlzbYpKbGAoXmQXIfHwHxpOevVRaJfxWLtPSrQDsOtTgXZpVSLcABCWIbxOcQQqBpuBqtQepddOqHzGTRhBGROCbOSTUMNHYzCnHMBfCOpGxXUZLykHjdtvFECCurxHPNXzxIerEVXZFppzcNGazDYOHrFeTwqnuGSjFMbwgZQpVwawLcRuRBcDNAWEEDpzIbUwHwuONUqhHcBglTMqnKwsTBeMKkdHThdiWoFuUVvouJBBKepGffHdDkXEghHlkoimSbJYxSAPFmHqaBaJukXSdfUYJzeuohAbFvUnFGDVBGSHjfCTRsnLIVHdxkfidIUQOhmZpQKvrIRNlUyWXkaFz
mov r10, rax
sub rbx, rax
movabs rdi, 0x1073260a47f7c66d
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 6]
mov rax, rdi
mov rcx, r8
mul r8
add r11d, 6
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 7]
mov byte [r9 - 7], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 6]
mov byte [r9 - 6], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 6
jb 0x1400042b0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004700
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 5]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.AZRkCmYVKvNgzuGoWryPVwMGrDZtFNnICsqzEZZtCIBwrlJrZHiJCaSBVXEiTBfLimMJSLVFxqlOPNfsJEedRdPrGnCtIKMphFAVqvrlLwXZzxjObPFuvTkXwpHCqXjDUCJKZnNyVqrBCCXFimRJbapklAlzbYpKbGAoXmQXIfHwHxpOevVRaJfxWLtPSrQDsOtTgXZpVSLcABCWIbxOcQQqBpuBqtQepddOqHzGTRhBGROCbOSTUMNHYzCnHMBfCOpGxXUZLykHjdtvFECCurxHPNXzxIerEVXZFppzcNGazDYOHrFeTwqnuGSjFMbwgZQpVwawLcRuRBcDNAWEEDpzIbUwHwuONUqhHcBglTMqnKwsTBeMKkdHThdiWoFuUVvouJBBKepGffHdDkXEghHlkoimSbJYxSAPFmHqaBaJukXSdfUYJzeuohAbFvUnFGDVBGSHjfCTRsnLIVHdxkfidIUQOhmZpQKvrIRNlUyWXkaFz
mov r10, rax
sub rbx, rax
movabs rdi, 0x1073260a47f7c66d
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xd]
mul rcx
add r11d, 0xd
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 5]
mov byte [r9 - 5], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xb]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xc]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xd
jb 0x140004750
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004c00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.AZRkCmYVKvNgzuGoWryPVwMGrDZtFNnICsqzEZZtCIBwrlJrZHiJCaSBVXEiTBfLimMJSLVFxqlOPNfsJEedRdPrGnCtIKMphFAVqvrlLwXZzxjObPFuvTkXwpHCqXjDUCJKZnNyVqrBCCXFimRJbapklAlzbYpKbGAoXmQXIfHwHxpOevVRaJfxWLtPSrQDsOtTgXZpVSLcABCWIbxOcQQqBpuBqtQepddOqHzGTRhBGROCbOSTUMNHYzCnHMBfCOpGxXUZLykHjdtvFECCurxHPNXzxIerEVXZFppzcNGazDYOHrFeTwqnuGSjFMbwgZQpVwawLcRuRBcDNAWEEDpzIbUwHwuONUqhHcBglTMqnKwsTBeMKkdHThdiWoFuUVvouJBBKepGffHdDkXEghHlkoimSbJYxSAPFmHqaBaJukXSdfUYJzeuohAbFvUnFGDVBGSHjfCTRsnLIVHdxkfidIUQOhmZpQKvrIRNlUyWXkaFz
mov r10, rax
sub rbx, rax
movabs rdi, 0x1073260a47f7c66d
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 0xc]
mov rax, rdi
mov rcx, r8
mul r8
add r11d, 6
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 0xe]
movsx eax, al
mov word [r9 - 0xe], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 0xc]
movsx eax, al
mov word [r9 - 0xc], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 - 0xa]
movsx eax, al
mov word [r9 - 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 6
jb 0x140004c50
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004d70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xe]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.AZRkCmYVKvNgzuGoWryPVwMGrDZtFNnICsqzEZZtCIBwrlJrZHiJCaSBVXEiTBfLimMJSLVFxqlOPNfsJEedRdPrGnCtIKMphFAVqvrlLwXZzxjObPFuvTkXwpHCqXjDUCJKZnNyVqrBCCXFimRJbapklAlzbYpKbGAoXmQXIfHwHxpOevVRaJfxWLtPSrQDsOtTgXZpVSLcABCWIbxOcQQqBpuBqtQepddOqHzGTRhBGROCbOSTUMNHYzCnHMBfCOpGxXUZLykHjdtvFECCurxHPNXzxIerEVXZFppzcNGazDYOHrFeTwqnuGSjFMbwgZQpVwawLcRuRBcDNAWEEDpzIbUwHwuONUqhHcBglTMqnKwsTBeMKkdHThdiWoFuUVvouJBBKepGffHdDkXEghHlkoimSbJYxSAPFmHqaBaJukXSdfUYJzeuohAbFvUnFGDVBGSHjfCTRsnLIVHdxkfidIUQOhmZpQKvrIRNlUyWXkaFz
mov r10, rax
sub rbx, rax
movabs rdi, 0x1073260a47f7c66d
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 8]
movsx eax, al
mov word [r9 + 8], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 0xa]
movsx eax, al
mov word [r9 + 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 0xc]
movsx eax, al
mov word [r9 + 0xc], ax
lea rcx, [r8 + 8]
mov rax, rdi
mul rcx
add r11d, 0xb
lea r9, [r9 + 0x16]
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 5
imul rax, rdx, 0x1f2
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 0xb
jb 0x140004dc0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400096a0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x140009702
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000b6f0
test al, al
jne 0x140009714
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x1400096d0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov eax, 0x4e
mov dword [rbp - 0x20], 0x1f000a
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], ax
mov dword [rbp - 0x1c], 0x250000
mov dword [rbp - 0x18], 0x210006
mov dword [rbp - 0x14], 0x17001b
mov dword [rbp - 0x10], 0x330018
call fcn.140004d70
mov rcx, rax
call 0x1400096a0
mov qword [0x1400101b8], rax
lea rcx, [rbp - 0x20]
mov eax, 0x4b
mov dword [rbp - 0x20], 0x1f000a
mov word [rbp - 0x10], ax
mov dword [rbp - 0x1c], 0x250000
mov dword [rbp - 0x18], 0x210006
mov dword [rbp - 0x14], 0x64006a
call fcn.140002330
mov rcx, rax
call 0x1400096a0
lea rcx, [rbp - 0x20]
mov qword [0x1400101a8], rax
mov dword [rbp - 0x20], 0x2e002f
mov dword [rbp - 0x1c], 0x70036
mov dword [rbp - 0x18], 0x6d002f
call fcn.140004c00
mov rcx, rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp 0x1400096a0
Function at 0x14000d0d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400101c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x320012
mov dword [rbp - 0x1c], 0x70037
mov dword [rbp - 0x18], 0x5e002f
mov dword [rbp - 0x14], 0x78006b
mov dword [rbp - 0x10], 0x1a002f
mov dword [rbp - 0xc], 0x670022
call fcn.140002a50
mov rcx, rax
call rbx
mov rbx, qword [0x1400101c0]
lea rcx, [rbp - 0x20]
mov qword [0x1400101a0], rax
mov dword [rbp - 0x20], 0x330016
mov dword [rbp - 0x1c], 0x2003c
mov dword [rbp - 0x18], 0x8002d
mov dword [rbp - 0x14], 0x78002d
mov dword [rbp - 0x10], 0x1a002f
mov dword [rbp - 0xc], 0x670022
call fcn.140002a50
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x14000f0f0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400101b0], rax
mov word [rbp - 0x10], 0x2521
mov byte [rbp - 0xe], 0x79
call fcn.1400043c0
mov rcx, qword [0x1400101a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140010130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x7373212
mov dword [rbp - 0x1c], 0x3321282f
mov dword [rbp - 0x18], 0x23a0328
mov word [rbp - 0x14], 0x752d
call fcn.140001180
mov rcx, qword [0x1400101a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140010130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0xe263408
mov dword [rbp - 0x1c], 0x223c0331
mov dword [rbp - 0x18], 0x92b0604
mov word [rbp - 0x14], 0x753b
call fcn.140001180
mov rcx, qword [0x1400101b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000f1c0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400100e8], rax
mov byte [rbp - 0x10], 0x57
call fcn.1400014c0
mov rcx, qword [0x1400101b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000f090]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400100f0], rax
mov dword [rbp - 0x10], 0x501c1e33
call fcn.1400026f0
mov rcx, qword [0x1400101b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000f120]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400100e0], rax
mov byte [rbp - 0x10], 0x57
call fcn.1400014c0
mov rcx, qword [0x1400101b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000f190]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400100d8], rax
mov dword [rbp - 0x10], 0x11171d3e
mov byte [rbp - 0xc], 0x56
call fcn.1400031c0
mov rcx, qword [0x1400101b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x14000f070]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140010130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x3339
mov byte [rbp - 0xe], 0x79
call fcn.1400043c0
mov rcx, qword [0x1400101b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rbp
jmp rax
Function at 0x416300
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4164ab
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [0x00603148]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432ae0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
nop
jne 0x41636e
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x416381
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x4163a5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x4163b9
cmp rbx, 0x1000
jae 0x416378
nop
jmp 0x416429
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x4163cd
xor edx, edx
jmp 0x416420
mov rcx, qword [0x00603148]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00432ae0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop
test dl, dl
jne 0x4163af
jmp 0x416395
call fcn.00462c00
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00437240
lea rax, [0x004ddf47]
mov ebx, 0x18
nop dword [rax + rax]
call fcn.00437b40
mov rax, qword [rsp + 0x38]
call fcn.00437840
lea rax, [0x004de007]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00437b40
mov rax, qword [rsp + 0x30]
call fcn.00437840
call fcn.004374a0
call fcn.004372c0
lea rax, [0x004e02ba]
mov ebx, 0x21
call fcn.00435980
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f040
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00416300
Function at 0x4164e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x41670a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x00603150]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.00432b60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x41655b
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x41656e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x416590
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x4165a4
cmp rbx, 0x1000
jae 0x416565
jmp 0x41662e
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x4165b6
xor esi, esi
jmp 0x416620
mov rax, qword [0x00603150]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.00432b60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x41659a
jmp 0x416582
call fcn.00462c00
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x4166a9
call fcn.00437240
lea rax, [0x004de3bd]
mov ebx, 0x19
call fcn.00437b40
mov rax, qword [rsp + 0x68]
call fcn.00437840
lea rax, [0x004de007]
mov ebx, 0x19
nop
call fcn.00437b40
mov eax, dword [rsp + 0x34]
call fcn.00437840
call fcn.004374a0
call fcn.004372c0
lea rax, [0x004daead]
mov ebx, 0xd
call fcn.00435980
cmp eax, 0x5af
je 0x416653
call fcn.00437240
lea rax, [0x004de3bd]
mov ebx, 0x19
call fcn.00437b40
mov rax, qword [rsp + 0x38]
call fcn.00437840
lea rax, [0x004de007]
mov ebx, 0x19
nop dword [rax]
call fcn.00437b40
mov eax, dword [rsp + 0x34]
call fcn.00437840
call fcn.004374a0
call fcn.004372c0
lea rax, [0x004dfb49]
mov ebx, 0x1f
call fcn.00435980
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f040
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004164e0