joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000f3c4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xb0
movzx eax, byte [rdx + 1]
lea r11, [rsp + 0x28]
movzx r8d, byte [rdx]
lea rsi, [0x140000000]
movdqu xmm1, xmmword [0x140015c50]
mov rdi, rcx
shl r8d, 8
movzx ecx, byte [rdx + 4]
or r8d, eax
movzx eax, byte [rdx + 2]
shl ecx, 8
shl r8d, 8
or r8d, eax
movzx eax, byte [rdx + 3]
shl r8d, 8
or r8d, eax
movzx eax, byte [rdx + 5]
or ecx, eax
mov dword [rsp], r8d
movzx eax, byte [rdx + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 9]
mov dword [rsp + 4], ecx
movzx ecx, byte [rdx + 8]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xd]
mov dword [rsp + 8], ecx
movzx ecx, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
mov dword [rsp + 0xc], ecx
xor r10d, r10d
movdqu xmm0, xmmword [rsp]
pxor xmm1, xmm0
lea ebx, [r10 + 0x20]
movdqu xmmword [rsp + 0x20], xmm1
psrldq xmm1, 8
movd eax, xmm1
mov edx, dword [r10 + rsi + 0x15c60]
lea r9, [r11 + 4]
xor edx, dword [r11 - 4]
xor edx, eax
xor edx, dword [r9]
mov eax, edx
shr rax, 0x18
movzx r8d, byte [rax + rsi + 0x15b50]
mov eax, edx
shr eax, 0x10
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rsi + 0x15b50]
or r8d, eax
mov eax, edx
shr eax, 8
movzx ecx, al
shl r8d, 8
movzx eax, byte [rcx + rsi + 0x15b50]
or r8d, eax
movzx eax, dl
shl r8d, 8
movzx eax, byte [rax + rsi + 0x15b50]
or r8d, eax
mov ecx, r8d
mov eax, r8d
rol ecx, 0xd
ror eax, 9
xor ecx, eax
mov eax, dword [r9]
xor ecx, dword [rsp + r10 + 0x20]
xor ecx, r8d
mov dword [r11 + 8], ecx
lea r11, [r9]
mov dword [r10 + rdi], ecx
lea r10, [r10 + 4]
sub rbx, 1
jne 0x14000f49e
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000f9dc
Capabilities:
Allocate or change rwx memory

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
xor edi, edi
lea rdx, str.C:InputCard.txt
xorps xmm0, xmm0
mov qword [rax - 0x48], rdi
lea rcx, [rax - 0x58]
mov qword [rax - 0x40], rdi
movups xmmword [rax - 0x58], xmm0
lea r8d, [rdi + 0x11]
call fcn.14000e26c
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.14000f638
lea rsi, [0x14001d0f0]
mov rdx, rax
mov rcx, rsi
call fcn.140009240
mov rdx, qword [rsp + 0x68]
mov ebx, 0x1000
cmp rdx, 0x10
jb 0x14000fa76
mov rcx, qword [rsp + 0x50]
inc rdx
mov rax, rcx
cmp rdx, rbx
jb 0x14000fa71
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000fa71
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140012368
mov r9d, 0x40
mov r8d, ebx
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor edx, edx
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.VMProtectSDK64.dll_VMProtectGetCurrentHWID]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.VMProtectSDK64.dll_VMProtectGetCurrentHWID]
lea r14, [0x14001d110]
mov rdx, rbx
mov rcx, r14
call fcn.140009900
cmp qword [0x14001d108], 0x10
mov rdx, rsi
mov rbp, qword [0x14001d100]
mov rcx, r14
cmovae rdx, qword [0x14001d0f0]
cmp qword [0x14001d128], 0x10
mov rbx, qword [0x14001d120]
cmovae rcx, qword [0x14001d110]
mov r8, rbx
cmp rbp, rbx
cmovb r8, rbp
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000fb02
cmp rbx, rbp
jb 0x14000fb02
jbe 0x14000fb6a
cmp qword [0x14001d128], 0x10
lea rdx, [0x1400162c9]
mov r8, rbx
cmovae r14, qword [0x14001d110]
test rbx, rbx
mov rcx, r14
cmovne r8, rdi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000fb34
test rbx, rbx
je 0x14000fb6a
cmp qword [0x14001d108], 0x10
lea r9, str.read_error
mov rdx, rbp
mov qword [rsp + 0x20], 0xa
cmovae rsi, qword [0x14001d0f0]
xor r8d, r8d
mov rcx, rsi
call fcn.14000a790
test rax, rax
jg 0x14000fb6a
mov dil, 1
lea r11, [rsp + 0x70]
mov al, dil
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x14000fb88
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov rax, qword [0x14001d148]
xor rax, rsp
mov qword [rbp + 0x37], rax
movdqa xmm1, xmmword [str.6666666666666666]
mov esi, edx
mov dword [rbp + 0x27], 0x73616854
lea rdx, [rbp + 0x27]
mov dword [rbp + 0x2b], 0x746e5565
mov rbx, rcx
mov dword [rbp + 0x2f], 0x54646c6f
lea rcx, [rbp - 0x69]
mov dword [rbp + 0x33], 0x676e6968
mov rdi, r8
movdqu xmm0, xmmword [rbp + 0x27]
pxor xmm1, xmm0
pxor xmm1, xmmword [0x140016170]
movdqu xmmword [rbp + 0x27], xmm1
call fcn.14000efe8
mov r9, rbx
mov qword [rsp + 0x20], rdi
mov r8d, esi
lea rcx, [rbp - 0x69]
xor edx, edx
call fcn.14000f038
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140012700
mov rbx, qword [rsp + 0x118]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140010208
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x1300]
mov eax, 0x1400
call fcn.140012740
sub rsp, rax
mov rax, qword [0x14001d148]
xor rax, rsp
mov qword [rbp + 0x12f0], rax
mov r14d, edx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
and dword [rsp + 0x20], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
and qword [rsp + 0x48], 0
and qword [rsp + 0x50], 0
mov r8d, 0x3e
lea rdx, str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789
lea rcx, [rsp + 0x38]
call fcn.14000e26c
nop
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov edx, eax
or dword [rbp + 0x12e4], 0xffffffff
mov dword [rsp + 0x64], eax
mov r13d, 1
mov ecx, r13d
mov r8d, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, ecx
mov dword [rsp + rcx*4 + 0x64], edx
add rcx, r13
cmp rcx, r8
jb 0x14001029d
mov dword [rsp + 0x60], r8d
mov r15d, dword [rsp + 0x48]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
and qword [rbx + 0x10], 0
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov dword [rsp + 0x20], r13d
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x38]
test r14d, r14d
jle 0x140010357
lea r9d, [r15 - 1]
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.140011e7c
lea rcx, [rsp + 0x38]
cmp rsi, 0x10
cmovae rcx, rdi
cdqe
mov r9b, byte [rax + rcx]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x140010344
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140010339
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x140010352
xor r8d, r8d
mov rdx, r13
mov rcx, rbx
call fcn.14000e32c
sub r14, r13
jne 0x1400102f1
cmp rsi, 0x10
jb 0x140010391
lea rdx, [rsi + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140010389
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140010389
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140012368
mov rax, rbx
mov rcx, qword [rbp + 0x12f0]
xor rcx, rsp
call fcn.140012700
lea r11, [rsp + 0x1400]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x1400107a8
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov rdi, qword [0x14001d560]
or rax, 0xffffffffffffffff
xor ebx, ebx
mov rbp, rcx
inc rax
cmp byte [rax + rcx], bl
jne 0x1400107d1
inc eax
mov dword [rsp + 0x20], 0x40
movsxd r14, eax
mov r9d, 0x1000
mov r8, r14
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
jne 0x14001082c
lea rdx, str.Alloc_Mem_Failed
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011c54
mov rcx, rax
lea rdx, [0x140011f38]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor eax, eax
jmp 0x1400108ea
mov r9, r14
mov qword [rsp + 0x20], rbx
mov r8, rbp
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140010850
lea rdx, str.Write_Process_Memory_Failed
jmp 0x140010809
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x140015df8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x30], rbx
xor r8d, r8d
mov r9, rax
mov dword [rsp + 0x28], ebx
xor edx, edx
mov qword [rsp + 0x20], rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbp, rax
test rax, rax
jne 0x1400108b9
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Create_Remote_Thread_Failed
call fcn.140011c54
mov rcx, rax
lea rdx, [0x140011f38]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400108d3
or edx, 0xffffffff
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, 1
mov r9d, 0x10000
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14001090c
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x70
cmp qword [rcx + 0x18], 0x10
mov rbx, rcx
jb 0x14001091f
mov rcx, qword [rcx]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
test eax, eax
je 0x1400109d7
mov rcx, qword [rbx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 0x1a
jb 0x1400109dd
cmp qword [rbx + 0x18], 0x10
mov rax, rbx
jb 0x140010955
mov rax, qword [rbx]
mov dl, byte [rsp + 0x40]
lea r9, str.Error_while_deleting_file
mov qword [rsp + 0x30], rcx
mov r8, rbx
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], 0x1a
call fcn.14000b2f0
cmp qword [rsp + 0x60], 0x10
lea rcx, [rsp + 0x48]
cmovae rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1400109d7
mov rcx, qword [rsp + 0x48]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400109d2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400109d2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140012368
add rsp, 0x70
pop rbx
ret
call fcn.1400012a0
int3
Function at 0x140011534
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x14001d148]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
test rax, rax
je 0x1400115c9
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x1400115c0
lea rdx, [rsp + 0x4c]
mov rax, rdi
sub rdx, rdi
movzx ecx, byte [rax]
movzx r8d, byte [rax + rdx]
sub ecx, r8d
jne 0x1400115a1
inc rax
test r8d, r8d
jne 0x14001158c
test ecx, ecx
mov rcx, rbx
je 0x1400115b4
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32Next
jmp 0x14001157d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x1400115cc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140012700
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x140012078
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, 0x270
mov rbx, rcx
cmp dword [rcx], r9d
jne 0x1400120cb
lea r8, [rcx + 8]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140012090
jmp 0x1400120d8
cmp dword [rcx], 0x4e0
jb 0x1400120d8
call fcn.1400121c4
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret

Function at 0x1400121c4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
lea r10, [rcx + 0x9c4]
mov r9, rcx
mov eax, dword [r10]
mov r11d, 0xe3
lea r8, [r10 + 4]
mov edx, dword [r8]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x1400121d7
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov eax, dword [r10]
lea r8, [r10 + 4]
mov edx, dword [r8]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd4c]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x140012222
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, dword [r9 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and dword [r9], 0
and ecx, 0x9908b0df
shr edx, 1
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
ret

Function at 0x140012d6c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140012db6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140012db6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140012db6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140012db6
cmp dword [rcx + 0x84], 0xe
jbe 0x140012db6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140012db8
xor al, al
add rsp, 0x28
ret
Function at 0x1400029c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0x10]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Testarea_tdetails_tuk_toptions_tspunky_tssssss_tgifs_tyabbse_tnwshp_tsdc_tbrands_tsecurehtml_tpricematch_tmietwagen_tchoices_tcomjomcomment_thotsite_tlifeinsurance_tegypt_treview_thtml_thp_tsubsilver_troutines_tkris_tcontent_tinjection_tprl_tadlogger_tbugzilla_tsandtrap_tsinc_tcontributions_tibs_tadrotator_topd_tcustom_taquarius_tselfservice_tonthisday_ttechnotes_tcccommon
mov r10, rax
sub rbx, rax
movabs rdi, 0x30e84f79812571dd
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 8]
movsx eax, al
mov word [r9 + 8], ax
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 0xa]
movsx eax, al
mov word [r9 + 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 0xc]
movsx eax, al
mov word [r9 + 0xc], ax
lea rcx, [r8 + 8]
mov rax, rdi
mul rcx
add r11d, 0xc
lea r9, [r9 + 0x18]
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 0xa]
movsx eax, al
mov word [r9 - 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xb]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 0xc
jb 0x140002a10
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140002f40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Testarea_tdetails_tuk_toptions_tspunky_tssssss_tgifs_tyabbse_tnwshp_tsdc_tbrands_tsecurehtml_tpricematch_tmietwagen_tchoices_tcomjomcomment_thotsite_tlifeinsurance_tegypt_treview_thtml_thp_tsubsilver_troutines_tkris_tcontent_tinjection_tprl_tadlogger_tbugzilla_tsandtrap_tsinc_tcontributions_tibs_tadrotator_topd_tcustom_taquarius_tselfservice_tonthisday_ttechnotes_tcccommon
mov r10, rax
sub rbx, rax
movabs rdi, 0x30e84f79812571dd
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xa]
mul rcx
add r11d, 0xa
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xa
jb 0x140002f90
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140003f90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Testarea_tdetails_tuk_toptions_tspunky_tssssss_tgifs_tyabbse_tnwshp_tsdc_tbrands_tsecurehtml_tpricematch_tmietwagen_tchoices_tcomjomcomment_thotsite_tlifeinsurance_tegypt_treview_thtml_thp_tsubsilver_troutines_tkris_tcontent_tinjection_tprl_tadlogger_tbugzilla_tsandtrap_tsinc_tcontributions_tibs_tadrotator_topd_tcustom_taquarius_tselfservice_tonthisday_ttechnotes_tcccommon
mov r10, rax
sub rbx, rax
movabs rdi, 0x30e84f79812571dd
lea r9, [rax + 1]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 1]
mov byte [r9 - 1], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
mov byte [r9], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 1]
mov byte [r9 + 1], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 2]
mov byte [r9 + 2], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 3]
mov byte [r9 + 3], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 4]
mov byte [r9 + 4], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 5]
mov byte [r9 + 5], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 8]
xor al, byte [rbx + r9 + 6]
mov byte [r9 + 6], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 7]
mov byte [r9 + 7], al
lea rcx, [r8 + 9]
mov rax, rdi
lea r9, [r9 + 0xc]
mul rcx
add r11d, 0xc
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 4]
mov byte [r9 - 4], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xb]
xor al, byte [rbx + r9 - 3]
mov byte [r9 - 3], al
mov rax, rdi
mul rcx
shr rdx, 6
imul rax, rdx, 0x14f
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 2]
mov byte [r9 - 2], al
cmp r11d, 0xc
jb 0x140003fe0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret