joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002df60
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x140042010]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x14002e073
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14002e073
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
xor edx, edx
mov qword [rsp + 0x50], rdx
mov ecx, dword [rax + rsi + 0xb0]
test ecx, ecx
jne 0x14002dfd8
mov qword [rdi], rdx
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rdx
jmp 0x14002e080
lea rbx, [rsi + rcx]
mov ebp, dword [rax + rsi + 0xb4]
add rbp, rbx
mov rcx, qword [rsp + 0x48]
cmp rbx, rbp
jae 0x14002e061
mov r8d, dword [rbx + 4]
test r8d, r8d
je 0x14002e061
mov eax, dword [rbx]
add rax, rsi
mov qword [rsp + 0x28], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x30], rax
lea rax, [r8 - 8]
shr rax, 1
mov dword [rsp + 0x38], eax
cmp rcx, rdx
je 0x14002e03a
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x38]
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x48], rcx
jmp 0x14002e056
lea r8, [rsp + 0x28]
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.14002e6c0
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, rbp
jb 0x14002dff0
mov rax, qword [rsp + 0x40]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rdx
jmp 0x14002e080
xor edx, edx
mov qword [rcx], rdx
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], rdx
mov rax, rdi
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14002f7c0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14002f460
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rbp
push r14
sub rsp, 0x50
mov rax, qword [0x140042010]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
lea r9, [rsp + 0x20]
mov r14, rcx
mov dword [rsp + 0x20], ebp
xor r8d, r8d
xor edx, edx
mov ebx, ebp
lea ecx, [rbp + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14002f4ee
nop dword [rax]
test rbx, rbx
je 0x14002f4b6
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x14002f4a0
test eax, eax
jns 0x14002f50f
test rbx, rbx
je 0x14002f514
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x14002f606
test rbx, rbx
jne 0x14002f51b
xor eax, eax
jmp 0x14002f606
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rdi
mov edi, ebp
cmp dword [rbx], ebp
jbe 0x14002f5e6
mov esi, edi
lea rdx, [rbx + 0x30]
imul rax, rsi, 0x128
mov qword [rsp + 0x28], rbp
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], 0xf
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
add rdx, rcx
inc r8
cmp byte [rdx + r8], bpl
jne 0x14002f564
lea rcx, [rsp + 0x28]
call fcn.140005e20
cmp qword [r14 + 0x18], 0x10
mov rdx, r14
jb 0x14002f584
mov rdx, qword [r14]
cmp qword [rsp + 0x40], 0x10
lea rcx, [rsp + 0x28]
cmovae rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14002f61c
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14002f5dc
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002f5d7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002f66d
call fcn.14002f7e0
inc edi
cmp edi, dword [rbx]
jb 0x14002f532
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14002f7c0
add rsp, 0x50
pop r14
pop rbp
pop rbx
ret
imul rax, rsi, 0x128
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
mov rdi, qword [rax + rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x14002f679
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002f674
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002f674
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002f7e0
mov rax, rdi
jmp 0x14002f5f9
Function at 0x1b990
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
sub rsp, 0x1c8
mov rax, qword [0x000181d8]
mov qword [rsp + 0x190], rax
mov qword [r11 - 0x10], rbp
mov qword [r11 - 0x18], rsi
mov qword [r11 - 0x28], r12
mov r12, rdx
mov esi, r8d
mov rbp, rcx
mov rax, cr8
test al, al
je 0x1b9d0
mov eax, 1
jmp 0x1baac
lea r8, str.RegistryMACHINESystemCurrentControlSetMultiKeyDumps
lea rdx, [0x00021940]
lea rcx, [rsp + 0x90]
add r9, 0x1264
mov qword [rsp + 0x1c0], rbx
mov qword [rsp + 0x1a8], rdi
call qword [sym.imp.ntoskrnl.exe_swprintf]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
xor ebx, ebx
lea rax, [rsp + 0x78]
lea r8, [rsp + 0x38]
lea rcx, [rsp + 0x30]
mov edx, 0x20006
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], 0x30
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x50], 0x40
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
call qword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
mov edi, eax
js 0x1ba95
lea rcx, [rsp + 0x68]
mov rdx, rbp
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rcx, qword [rsp + 0x30]
lea r9d, [rbx + 3]
lea rdx, [rsp + 0x68]
xor r8d, r8d
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r12
call qword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test edi, edi
mov rdi, qword [rsp + 0x1a8]
sets bl
mov eax, ebx
mov rbx, qword [rsp + 0x1c0]
mov r12, qword [rsp + 0x1a0]
mov rsi, qword [rsp + 0x1b0]
mov rbp, qword [rsp + 0x1b8]
mov rcx, qword [rsp + 0x190]
call fcn.00017320
add rsp, 0x1c8
ret
Function at 0x21020
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov rax, qword [0x000181d8]
mov qword [rsp + 0x28], rax
mov eax, dword [rdx + 0x1a8]
mov r10, r8
mov r11d, ecx
and eax, 0x1f0000
cmp eax, 0x1f0000
jne 0x21177
movzx r8d, word [rdx + 0x91]
mov qword [rsp + 0x68], rbx
movzx ebx, word [rdx + 0x8d]
movzx eax, r8w
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rdi
movzx edi, word [rdx + 0x8f]
shr ax, 0xc
mov word [rsp + 8], 0xf
and al, 0xf
mov word [rsp + 0xa], 0
lea r9, [rsp + 0x10]
mov byte [rsp + 0x20], al
movzx eax, r8w
shr r8b, 4
shr ax, 8
and r8b, 0xf
and al, 0xf
mov byte [rsp + 0x22], r8b
mov byte [rsp + 0x21], al
movzx eax, byte [rdx + 0x91]
and al, 0xf
xor esi, esi
mov r8d, esi
mov byte [rsp + 0x23], al
nop
movzx ecx, r8w
movzx edx, bx
movzx eax, di
shr dx, cl
shr ax, cl
inc r8d
and dl, 1
and al, 1
inc r9
add dl, dl
or dl, al
cmp r8d, 0x10
mov byte [r9 - 1], dl
jl 0x210c0
movzx r8d, word [rsp + 8]
movzx edx, word [rsp + 0xc]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x68]
lea r9, [rsp + r8 + 0x10]
shr r11d, 0x1c
nop
nop
nop
movzx eax, sil
movzx ecx, r11b
add dx, dx
xor al, 1
inc esi
shl al, 2
sub cl, al
movzx eax, byte [r9]
and cl, 0xf
xor cl, byte [rsp + rax + 0x20]
movzx eax, cl
xor r8w, ax
movzx eax, r8w
mov word [rsp + 8], r8w
lea r9, [rsp + rax + 0x10]
movzx eax, byte [rsp + rax + 0x10]
and al, 1
movzx ecx, al
or cx, dx
cmp esi, 8
mov dx, cx
mov word [rsp + 0xc], cx
jl 0x21110
mov word [r10], cx
mov rsi, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
call fcn.00017320
add rsp, 0x48
ret
mov byte [rsp], 0xff
mov byte [rsp + 1], 0xfe
movzx eax, word [rsp]
mov word [r8], ax
mov rcx, qword [rsp + 0x28]
call fcn.00017320
add rsp, 0x48
ret
Function at 0x211a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
sub rsp, 0xb8
mov rax, qword [0x000181d8]
mov qword [rsp + 0x90], rax
movzx r8d, word [rcx + 0x91]
movzx r10d, word [rcx + 0x8d]
mov qword [r11 + 0x20], rbp
movzx eax, r8w
mov qword [r11 - 8], rsi
mov rbp, rcx
shr ax, 0xc
mov rsi, rdx
lea r9, [rsp + 0x28]
and al, 0xf
mov byte [rsp + 0x38], al
movzx eax, r8w
shr r8b, 4
shr ax, 8
and r8b, 0xf
and al, 0xf
mov byte [rsp + 0x39], al
movzx eax, byte [rcx + 0x91]
mov byte [r11 - 0x7e], r8b
movzx r11d, word [rcx + 0x8f]
and al, 0xf
xor r8d, r8d
mov byte [rsp + 0x3b], al
nop
movzx ecx, r8w
movzx edx, r10w
movzx eax, r11w
shr dx, cl
shr ax, cl
inc r8d
and dl, 1
and al, 1
inc r9
add dl, dl
or dl, al
cmp r8d, 0x10
mov byte [r9 - 1], dl
jl 0x21220
xor eax, eax
mov qword [rsp + 0xd0], rbx
lea rbx, [rsp + 0x40]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rax
mov rax, qword [rbp + 0x93]
mov qword [rsp + 0xa8], rdi
mov edi, 6
sub rbx, 4
mov qword [rsp + 0x68], rax
nop
nop
mov eax, dword [rsp + 0x6c]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x64]
lea rcx, [rsp + 0x6c]
mov r9, rbp
mov dword [rsp + 0x60], eax
mov dword [rsp + 0x64], eax
call fcn.00016d00
add rbx, 4
movzx r11d, al
mov eax, dword [rsp + 0x68]
dec edi
xor dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x60]
add word [rsp + 0x5c], r11w
test edi, edi
mov dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x64]
mov dword [rbx], eax
jg 0x212a0
mov eax, dword [rsp + 0x44]
mov rdi, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
mov dword [rsi], eax
mov eax, dword [rsp + 0x40]
mov dword [rsi + 4], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsi + 8], eax
mov eax, dword [rsp + 0x48]
mov dword [rsi + 0xc], eax
mov eax, dword [rsp + 0x54]
mov dword [rsi + 0x10], eax
mov eax, dword [rsp + 0x50]
mov dword [rsi + 0x14], eax
movzx eax, word [rsp + 0x5c]
mov word [rsi + 0x18], ax
mov rsi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x90]
call fcn.00017320
add rsp, 0xb8
ret
Function at 0x140044b70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, rdx
mov rsi, rcx
mov rcx, rdx
call qword [0x1400ee088]
cmp rax, 4
jle 0x140044c46
xor edx, edx
mov rcx, r14
call qword [0x1400edfb0]
cmp al, 1
jne 0x140044c46
mov rcx, r14
call qword [0x1400ee8c8]
mov edi, dword [rax]
bswap edi
mov rcx, r14
call qword [0x1400ee088]
lea rdx, [rax - 4]
xor r8d, r8d
lea rcx, [rsp + 0x20]
call qword [0x1400ee8d8]
nop
lea rcx, [rsp + 0x20]
call qword [0x1400ee088]
test eax, eax
jle 0x140044c2a
xor ebp, ebp
mov r15d, eax
lea rdx, [rbp + 4]
mov rcx, r14
call qword [0x1400edfb0]
movzx ebx, al
mov rdx, rbp
lea rcx, [rsp + 0x20]
call qword [0x1400edfa8]
mov ecx, edi
shr ecx, 1
xor cl, bl
mov byte [rax], cl
mov ecx, ebx
imul ecx, edi
shr edi, 5
add edi, ecx
inc rbp
sub r15, 1
jne 0x140044bf1
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [0x1400edfc8]
nop
lea rcx, [rsp + 0x20]
call qword [0x1400eec98]
jmp 0x140044c4f
mov rcx, rsi
call qword [0x1400ee8e0]
mov rax, rsi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret

Function at 0x14008b170
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, qword [rcx + 0x10]
mov qword [rsp + 0x28], rdi
mov rdi, qword [rcx + 8]
mov rcx, qword [rcx]
test rcx, rcx
je 0x14008b18e
lock inc dword [rcx]
mov rax, rbx
shl rax, 4
add rax, rdi
cmp rdi, rax
je 0x14008b258
mov qword [rsp + 0x48], rbp
mov ebp, 0x9e3779b9
mov qword [rsp + 0x50], rsi
movabs rsi, 0xd6e8feb86659fd93
mov qword [rsp + 0x20], r14
movabs r14, 0x282c15e7f9
nop dword [rax]
mov r8, qword [rdi]
shr r8, 0x20
xor r8, qword [rdi]
imul r8, rsi
shl rbx, 8
mov rdx, r8
shr rdx, 0x20
xor rdx, r8
mov r8, qword [rdi + 8]
imul rdx, rsi
shr r8, 0x20
xor r8, qword [rdi + 8]
mov r10, rdx
imul r8, rsi
shr r10, 0x20
add rdi, 0x10
xor r10, rdx
mov rdx, r8
shr rdx, 0x20
xor rdx, r8
imul rdx, rsi
lea r11, [r10 + rbp]
shl r10, 6
mov r9, rdx
mov r8, r11
shr r9, 0x20
xor r9, rdx
shr r8, 2
add r9, r10
add r9, r14
add r9, r8
xor rbx, r9
xor rbx, r11
cmp rdi, rax
jne 0x14008b1d0
mov r14, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x28]
test rcx, rcx
je 0x14008b27f
mov edx, 0xffffffff
lock xadd dword [rcx], edx
cmp edx, 1
jne 0x14008b27f
mov edx, 0x10
lea r8d, [rdx - 8]
call qword [0x1400eecb8]
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1400b17e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1401abc78]
xor rax, rsp
mov qword [rsp + 0x60], rax
movsxd rbx, dword [rcx + 0x14]
mov rdi, rcx
imul rbx, qword [rcx + 0x20]
add rbx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x90]
mov rdx, rbx
mov rax, qword [rcx]
call qword [rax + pe_nt_image_headers64]
mov rdx, qword [rdi + 0x18]
movabs r14, 0xff000000000000
movsxd r9, dword [rdi + 0x14]
mov rcx, rdx
mov r10, qword [rdi + 0x20]
and ecx, 0xff00
mov r8, rdx
mov dword [rsp + 0x20], 0x324e5445
and r8, r14
mov dword [rsp + 0x24], 0x20000000
mov rax, rdx
movabs rbp, 0xff0000000000
shr rax, 0x10
movabs rsi, 0xff00000000
or r8, rax
mov r11d, 0xff000000
shr r8, 0x10
mov rax, rdx
and rax, rbp
or r8, rax
mov rax, rdx
and rax, rsi
shr r8, 0x10
or r8, rax
mov rax, rdx
shl rax, 0x10
or rcx, rax
shr r8, 8
shl rcx, 0x10
mov rax, rdx
and eax, 0xff0000
and rdx, r11
or rcx, rax
shl rcx, 0x10
or rcx, rdx
mov rdx, r9
shl rcx, 8
or r8, rcx
mov qword [rsp + 0x28], r8
imul rdx, r10
mov rcx, rdx
mov r8, rdx
and r8, r14
and ecx, 0xff00
mov rax, rdx
shr rax, 0x10
or r8, rax
mov rax, rdx
and rax, rbp
shr r8, 0x10
or r8, rax
mov rax, rdx
and rax, rsi
shr r8, 0x10
or r8, rax
mov rax, rdx
shl rax, 0x10
or rcx, rax
shr r8, 8
shl rcx, 0x10
mov rax, rdx
and eax, 0xff0000
and rdx, r11
or rcx, rax
mov eax, 0x3000000
shl rcx, 0x10
or rcx, rdx
shl rcx, 8
or r8, rcx
mov qword [rsp + 0x30], r8
xor r8d, r8d
cmp r9d, 0x800
cmove eax, r8d
mov dword [rsp + 0x38], eax
mov rdx, r10
and rdx, r14
mov dword [rsp + 0x3c], r8d
mov rax, r10
mov qword [rsp + 0x48], 0x21444e45
shr rax, 0x10
mov rcx, r10
or rdx, rax
shl rcx, 0x10
shr rdx, 0x10
mov rax, r10
and rax, rbp
mov dword [rsp + 0x50], 0x3552454e
or rdx, rax
mov r8d, 0x3c
shr rdx, 0x10
mov rax, r10
and rax, rsi
or rdx, rax
mov rax, r10
and eax, 0xff00
shr rdx, 8
or rcx, rax
mov rax, r10
shl rcx, 0x10
and eax, 0xff0000
or rcx, rax
and r10, r11
shl rcx, 0x10
mov rax, rbx
or rcx, r10
shr rax, 0x10
shl rcx, 8
or rdx, rcx
mov rcx, rbx
mov qword [rsp + 0x40], rdx
and ecx, 0xff00
mov rdx, rbx
and rdx, r14
or rdx, rax
mov rax, rbx
and rax, rbp
shr rdx, 0x10
or rdx, rax
mov rax, rbx
and rax, rsi
shr rdx, 0x10
or rdx, rax
mov rax, rbx
shl rax, 0x10
or rcx, rax
shr rdx, 8
shl rcx, 0x10
mov rax, rbx
and eax, 0xff0000
and rbx, r11
or rcx, rax
shl rcx, 0x10
or rcx, rbx
shl rcx, 8
or rdx, rcx
mov rcx, qword [rdi + 0x90]
mov qword [rsp + 0x54], rdx
lea rdx, [rsp + 0x20]
call qword [0x1400ee640]
mov rbx, qword [rdi + 0x90]
mov rcx, rbx
mov rdi, qword [rbx]
call qword [rdi + 0x70]
mov rdx, rax
mov rcx, rbx
call qword [rdi + 0xe8]
mov al, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400dea10
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400e2650
Capabilities:
Encode data using xor

Disassembly:
sub r8d, edx
movsxd r9, edx
add r9, rcx
xor ecx, ecx
lea eax, [r8 + 1]
cdq
and edx, 3
lea r10d, [rdx + rax]
sar r10d, 2
sub r10d, 1
js 0x1400e26da
lea r11, [0x1401abcb0]
nop dword [rax + rax]
movzx edx, byte [r9]
mov eax, ecx
movzx r8d, byte [r9 + 3]
lea r9, [r9 + 4]
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 - 3]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 - 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
mov edx, ecx
shr ecx, 8
xor r8, rdx
movzx edx, r8b
xor ecx, dword [r11 + rdx*4]
sub r10d, 1
jns 0x1400e2680
mov eax, ecx
ret
Function at 0x1400e2c10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov esi, 0x1a
lea rdi, [rcx + 0x8bc]
mov rbx, rcx
lea r11, [rdi + 1]
xor r14d, r14d
lea rbp, [0x140167d00]
lea r15d, [rsi + 0x3d]
nop dword [rax]
movzx r9d, r14w
movzx r10d, r14w
mov rax, rbx
mov r8, r14
nop
movzx ecx, byte [rax]
mov rdx, 0xfffffffffffff79b
add rcx, r8
inc rax
xor r10w, word [rbp + rcx*2]
movzx ecx, byte [rax]
add rcx, r8
add r8, 0x100
xor r9w, word [rbp + rcx*2]
lea rcx, [rax + 0x57]
cmp rcx, rdi
cmovb rdx, r15
add rax, rdx
cmp r8, 0x2b00
jl 0x1400e2c60
movzx eax, r10w
mov byte [r11 + 0x33], r10b
shr ax, 8
add rbx, 0x56
mov byte [r11 - 1], al
movzx eax, r9w
shr ax, 8
mov byte [r11], al
mov byte [r11 + 0x34], r9b
add r11, 2
sub rsi, 1
jne 0x1400e2c50
mov rbx, qword [rsp + 0x18]
xor eax, eax
mov rbp, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
pop r15
pop r14
ret

Function at 0x1401c0560
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1401c058c
xor al, al
jmp 0x1401c06b0
movdqa xmm0, xmmword [0x1401e1aa0]
movdqa xmm1, xmmword [0x1401e1ab0]
mov rax, qword [r9]
xor r11d, r11d
mov qword [rsp + 0x50], r12
mov rcx, r8
movdqa xmmword [rsp], xmm0
movdqa xmm0, xmmword [0x1401e1ac0]
movdqa xmmword [rsp + 0x10], xmm1
lea r12, [r8 + rax]
mov edx, r11d
movdqa xmm1, xmmword [0x1401e1ad0]
movdqa xmmword [rsp + 0x20], xmm0
movdqa xmmword [rsp + 0x30], xmm1
test rbx, rbx
je 0x1401c06a2
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1401c0609
mov r11d, 2
jmp 0x1401c062d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1401c0623
mov r11d, 1
jmp 0x1401c062d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, r12
ja 0x1401c06c5
mov eax, r10d
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov eax, r10d
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1401c066a
mov byte [rcx + 2], 0x3d
jmp 0x1401c067a
shr r10, 6
and r10d, 0x3f
movzx eax, byte [rsp + r10]
mov byte [rcx + 2], al
add rcx, 3
add r8, 3
test r11, r11
je 0x1401c068c
mov byte [rcx], 0x3d
jmp 0x1401c0693
movzx eax, byte [rsp + r9]
mov byte [rcx], al
inc rcx
inc r8
cmp rdx, rbx
jb 0x1401c05f0
sub rcx, rsi
mov al, 1
mov qword [rbp], rcx
mov r12, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor al, al
jmp 0x1401c06ab

Function at 0x14032882a
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], 0x54c0d170
lea rsp, [rsp + 0x10]
call fcn.14045a906
fsubr qword [rbx + 0x153285a8]
xchg ecx, eax
sahf
mov bh, 0xbb
cmp byte [rbx], cl
sub dword [rbp + 0x28e17fcf], 0x30
mov al, 0x74
xor bl, dh
sub edx, dword [rbx + 0x34406259]
fimul word [rdi - 0x54]
int 0x4e
invalid
Function at 0x140619e34
Capabilities:
Encode data using xor

Disassembly:
mov r12, qword [rsp + r12 - 0x599ed6f8]
mov qword [rsp + 0x10], 0x5b0500d1
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x10]
call fcn.1406cc324
mov dh, 0x57
movabs dword [0xab71be6696593141], eax
cwde
mov esi, 0xbb786e90
push r10
and eax, 0xc841a100
xor byte [rbp - 0xf3841bb], dl
cdq
mov dh, 0x41
pop rbp
cld
test dword [rdi - 0x42], ecx
xor eax, 0x2d41a795
loope 0x140619e7b
mov esi, 0x20f54e41
mov esi, 0x5429cc9f
mov esi, 0x878ef909
shl dword [r11 - 0x80], 0xa5
push 0xffffffffbe5a60ae
invalid
Function at 0x1408b2175
Capabilities:
Execute anti-debugging instructions

Disassembly:
push rsi
jmp 0x14091598d
sub eax, 0x5f0b6d12
test r14w, r15w
cmp r9w, 0x204c
push rsi
mov rsi, rbx
btr si, dx
movsxd rsi, r13d
xor dword [rsp], eax
bsf rsi, r11
test edx, 0x5c171d7
pop rsi
stc
cmp r10w, 0x3b93
movsxd rax, eax
cmp r11, r9
add r10, rax
jmp r10
push r11
cmovs r11d, ecx
movzx r11, bp
pushfq
movzx r11, dx
push r15
jmp 0x14093e246
add r11, 4
xor eax, esi
jmp 0x14091f545
push r12
push r13
movzx r11d, r11w
lahf
push rcx
cbw
lahf
movabs rbp, 0
setle dh
push rbp
movsx rax, r12w
mov r11, qword [rsp + 0x90]
dec r11d
inc r9b
rdtsc
add dx, r10w
bswap r11d
adc r10d, eax
neg r11d
inc si
rdtsc
dec r11d
add r11, rbp
movabs rdx, 0x100000000
lea r11, [r11 + rdx]
mov r9, rsp
sub rsp, 0x180
shr si, cl
add r10w, 0x2b8a
movsx eax, r15w
and rsp, 0xfffffffffffffff0
sal al, 0xc5
shr r10w, cl
sal sil, cl
mov rsi, r11
movabs rax, 0
movsx r10d, r10w
sub rsi, rax
rcr rax, 0x48
lea r10, [0x140915a22]
rol rax, 0x91
mov eax, dword [r11]
cmc
test sil, dil
jmp 0x1408f289b
rol eax, 1
xor eax, 0x6eb80298
test r10b, bpl
add eax, 0x1c265eb2
clc
ror eax, 3
stc
clc
xor eax, 0x6f2b0e65
jmp 0x14085290f
push r10
push r8
push r9
movsxd r10, eax
push r14
xchg r9d, r9d
not r9w
seta r9b
push rdi
push rbx
dec r9b
movsx r9, bp
setbe r9b
push rax
inc r10w
movzx ax, r8b
dec r9b
push rdx
dec r11b
movzx eax, r8w
push rbp
cwde
jmp 0x14084ddfd

Function at 0x141191202
Capabilities:
Execute anti-debugging instructions

Disassembly:
rol eax, 1
xor eax, 0x6eb80298
test r10b, bpl
add eax, 0x1c265eb2
clc
ror eax, 3
stc
clc
xor eax, 0x6f2b0e65
jmp 0x1411dd44e
push r12
push r13
movzx r11d, r11w
lahf
push rcx
cbw
lahf
movabs rbp, 0
setle dh
push rbp
movsx rax, r12w
mov r11, qword [rsp + 0x90]
dec r11d
inc r9b
rdtsc
add dx, r10w
bswap r11d
adc r10d, eax
neg r11d
inc si
rdtsc
dec r11d
add r11, rbp
movabs rdx, 0x100000000
lea r11, [r11 + rdx]
mov r9, rsp
sub rsp, 0x180
shr si, cl
add r10w, 0x2b8a
movsx eax, r15w
and rsp, 0xfffffffffffffff0
sal al, 0xc5
shr r10w, cl
sal sil, cl
mov rsi, r11
movabs rax, 0
movsx r10d, r10w
sub rsi, rax
rcr rax, 0x48
lea r10, [0x14111321d]
rol rax, 0x91
mov eax, dword [r11]
cmc
test sil, dil
jmp 0x14111b894
add r11, 4
xor eax, esi
jmp 0x1410e3f57
push rsi
jmp 0x141113188
push r10
push r8
push r9
movsxd r10, eax
push r14
xchg r9d, r9d
not r9w
seta r9b
push rdi
push rbx
dec r9b
movsx r9, bp
setbe r9b
push rax
inc r10w
movzx ax, r8b
dec r9b
push rdx
dec r11b
movzx eax, r8w
push rbp
cwde
jmp 0x14114e31a
push r11
cmovs r11d, ecx
movzx r11, bp
pushfq
movzx r11, dx
push r15
jmp 0x14116e216
sub eax, 0x5f0b6d12
test r14w, r15w
cmp r9w, 0x204c
push rsi
mov rsi, rbx
btr si, dx
movsxd rsi, r13d
xor dword [rsp], eax
bsf rsi, r11
test edx, 0x5c171d7
pop rsi
stc
cmp r10w, 0x3b93
movsxd rax, eax
cmp r11, r9
add r10, rax
jmp r10