joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002700
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x140051c60]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000271f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002728
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140002740
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x140051c60]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002760
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002768
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002760
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x140002760
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x1400027b4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400027c0
add rdx, 0x28
cmp r9, rdx
jne 0x1400027a0
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x1400027d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x140051c60]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x1400027f2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002800
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400027f2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x1400027f2
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x1400027f2
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x140002855
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140002868
add rdx, 0x28
cmp rdx, r10
jne 0x140002840
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140002877
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140002887
mov edx, dword [rax + 0xc]
test edx, edx
je 0x14000285e
test ecx, ecx
jg 0x140002870
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret

Function at 0x140c9cda7
Capabilities:
Encode data using xor

Disassembly:
push rcx
pushfq
movabs rcx, 0x14c975f61191260b
mov qword [rsp + 0x18], 0xffffffff8fb76a14
movabs rcx, 0x734b1ca51216553b
add ecx, ecx
push rdi
xor ecx, 0x406a421d
mov rcx, qword [rsp + 0x10]
movabs rdi, 0x25d11a546721011
jb 0x140c9cdc8
xor dil, 0x72
pop rdi
call fcn.140da7e99
push rbx
call fcn.1406e7f19
invalid
Function at 0x14001125d
Capabilities:
Terminate process

Disassembly:
jmp 0x140013b40
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112f8
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014e90
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014eb0
xor al, al
jmp 0x140014f31
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014ec3
xor al, al
jmp 0x140014f31
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014eed
xor al, al
jmp 0x140014f31
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014f01
xor al, al
jmp 0x140014f31
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014f13
xor al, al
jmp 0x140014f31
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014f2f
xor al, al
jmp 0x140014f31
mov al, 1
add rsp, 0x38
ret
Function at 0x1400113d4
Capabilities:
Log keystrokes via polling

Disassembly:
jmp 0x140012200
push rbp
push rdi
sub rsp, 0x138
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14001e008]
xor rax, rbp
mov qword [rbp + 0xf8], rax
lea rcx, [0x1400240f3]
call fcn.140011406
lea rdx, str.Enter_interval_time_of_clicks:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140011087
lea rdx, [rbp + 4]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::operator___int____ptr64____ptr64]
lea rdx, [0x14001146f]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov byte [rbp + 0x24], 0
xor eax, eax
cmp eax, 1
je 0x1400122f6
mov ecx, 0x45
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x140012296
mov byte [rbp + 0x24], 1
jmp 0x1400122aa
mov ecx, 0x51
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x1400122aa
mov byte [rbp + 0x24], 0
movzx eax, byte [rbp + 0x24]
cmp eax, 1
jne 0x1400122f4
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 2
call qword [sym.imp.USER32.dll_mouse_event]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 4
call qword [sym.imp.USER32.dll_mouse_event]
mov ecx, dword [rbp + 4]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140012279
lea rcx, [rbp - 0x30]
lea rdx, [0x14001ad00]
call fcn.14001138e
mov rcx, qword [rbp + 0xf8]
xor rcx, rbp
call fcn.140011212
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x14000220c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002256
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002256
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002256
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002256
cmp dword [rcx + 0x84], 0xe
jbe 0x140002256
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002258
xor al, al
add rsp, 0x28
ret
Function at 0x1400057dd
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
Function at 0x407080
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
mov esi, eax
movabs eax, dword [0xda8b088900409214]
test ebx, ebx
jle 0x4070a1
mov eax, 0xff
call fcn.00402680
xor byte [rsi], al
jne 0x407091
pop rsi
pop rbx
ret

Function at 0x40be2c
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x68
lea rcx, [rsp + 0x20]
call fcn.0040be04
xor r8d, r8d
cmp eax, r8d
je 0x40be6b
cmp qword [rsp + 0x20], r8
je 0x40be6b
mov rcx, r8
lea eax, [r8 + 0x40]
mov rdx, qword [rsp + 0x20]
shr rdx, cl
inc rcx
and edx, 1
add r8d, edx
dec rax
jne 0x40be50
mov eax, r8d
jmp 0x40be7a
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x50]
add rsp, 0x68
ret

Function at 0x40be80
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x60
movabs rax, 0x100000000
mov rbx, rcx
mov dword [rsp + 0x20], 0x40
mov qword [rcx], rax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
test eax, eax
je 0x40bec2
mov rax, qword [rsp + 0x28]
cmp qword [rsp + 0x48], rax
cmovb rax, qword [rsp + 0x48]
mov qword [rbx], rax
mov al, 1
add rsp, 0x60
pop rbx
ret

Function at 0x429270
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x60
mov r13d, edx
xor edx, edx
mov rbp, r8
mov r14, rcx
lea r8d, [rdx + 0x40]
lea rcx, [rsp + 0x20]
mov rsi, r9
call sub.msvcrt.dll_memset
xor ebx, ebx
test rbp, rbp
je 0x42933d
mov rdi, qword [rsp + 0xc8]
mov r12, qword [rsp + 0xc0]
test rdi, rdi
je 0x4292cc
test bl, bl
jne 0x4292cc
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
test eax, eax
jne 0x42933f
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 0x18]
mov r11, qword [r12]
mov r8d, r13d
mov rdx, r14
mov rcx, r12
call qword [r11 + 0x20]
mov r11, qword [r12]
lea rdx, [rsp + 0x20]
mov rcx, r12
call qword [r11 + 0x28]
mov r11, qword [r12]
mov rcx, r12
call qword [r11 + 0x30]
cmp eax, 0x40
ja 0x42934e
xor ecx, ecx
test eax, eax
je 0x429328
lea r8d, [rax - 1]
lea rdx, [rsp + 0x20]
shr r8d, 2
inc r8d
xor ecx, dword [rdx]
add rdx, 4
dec r8
jne 0x42931d
test rsi, rsi
je 0x429331
cmp ecx, dword [rsi]
jne 0x42934e
inc rbx
cmp rbx, rbp
jb 0x4292b6
xor eax, eax
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, 1
jmp 0x42933f
Function at 0x429358
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
je 0x4294eb
mov eax, edx
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
add ecx, r8d
xor ecx, r8d
dec rax
jne 0x429362
mov eax, ecx
ret

Function at 0x42957c
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
test edx, edx
mov r10, rcx
je 0x4295c6
mov r11, rcx
mov ebx, edx
mov r9d, dword [r8]
mov ecx, dword [r8 + 4]
movzx eax, r9w
shr r9d, 0x10
imul eax, eax, 0x9069
add eax, r9d
mov dword [r8], eax
movzx eax, cx
shr ecx, 0x10
imul eax, eax, 0x4650
add eax, ecx
mov dword [r8 + 4], eax
mov byte [r11], al
inc r11
dec rbx
jne 0x42958e
mov rcx, r10
add rsp, 0x20
pop rbx
jmp fcn.00429540
Function at 0x42a87c
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x20
xor ecx, ecx
call fcn.004ac240
mov ecx, 0x500
call fcn.004ac150
xor ebx, ebx
cmp rax, rbx
mov rdi, rax
je 0x42a976
mov eax, ebx
mov rcx, rdi
mov r8d, 0x100
mov byte [rcx], al
inc eax
inc rcx
cmp eax, r8d
jb 0x42a8b1
mov edx, 0xffffffff
mov r9, rdi
mov eax, edx
lea r10, [0x00509820]
xor al, byte [r9]
inc r9
movzx ecx, al
mov eax, edx
mov edx, dword [r10 + rcx*4]
shr eax, 8
xor edx, eax
dec r8
jne 0x42a8c5
not edx
cmp edx, 0x29058c73
jne 0x42a976
mov edx, 0x1f123bb5
mov r9d, 0x159a55e5
lea r8, [rdi + 0x100]
mov r10d, 0x400
movzx ecx, r9w
shr r9d, 0x10
imul ecx, ecx, 0x9069
add r9d, ecx
movzx ecx, dx
shr edx, 0x10
imul ecx, ecx, 0x4650
add edx, ecx
mov byte [r8], dl
inc r8
dec r10
mov dword [rsp + 0x54], edx
mov al, dl
jne 0x42a90d
mov esi, ebx
mov r12d, esi
mov ebp, ebx
add r12, rdi
mov edx, ebp
mov rcx, r12
call fcn.004c8a60
mov edx, ebp
mov rcx, r12
mov r11d, eax
call fcn.00429540
cmp eax, r11d
jne 0x42a976
inc ebp
cmp ebp, 0x20
jb 0x42a947
inc esi
cmp esi, 0x4e0
jb 0x42a93f
mov bl, 1
mov rcx, rdi
call fcn.004ac240
mov al, bl
add rsp, 0x20
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x469f68
Capabilities:
Parse pe header

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
cmp rdx, 0x200
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov dword [r8], 0
mov dword [r8 + 4], 0
jb 0x469feb
cmp word [rcx], 0x5a4d
jne 0x469feb
mov r9d, dword [rcx + 0x3c]
cmp r9d, 0x1000
jae 0x469feb
lea ecx, [r9 + 0x200]
cmp rcx, rdx
ja 0x469feb
test r9b, 7
jne 0x469feb
lea rdx, [rbx + r9]
cmp dword [rdx], 0x4550
jne 0x469feb
movzx ecx, word [rdx + 4]
sub ecx, 0x14c
je 0x46a025
sub ecx, 0x74
je 0x46a01e
sub ecx, 2
je 0x46a01e
sub ecx, 2
je 0x46a017
sub ecx, 0x3c
je 0x46a010
cmp ecx, 0x8464
je 0x46a025
mov rdx, rsi
mov rcx, rbx
call fcn.00469d2c
test eax, eax
jne 0x46a009
mov rdx, rsi
mov rcx, rbx
call fcn.00469de8
test eax, eax
je 0x46a04b
mov eax, 1
jmp 0x46a059
mov eax, 0x3030401
jmp 0x46a02a
mov eax, 0x3030701
jmp 0x46a02a
mov eax, 0x3030501
jmp 0x46a02a
mov eax, 0x3030103
cmp word [rdx + 0x14], 0x400
ja 0x469feb
movzx ecx, word [rdx + 0x18]
cmp ecx, 0x10b
je 0x46a046
cmp ecx, 0x20b
jne 0x469feb
mov dword [r8], eax
jmp 0x46a009
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.00469eac
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x471270
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
cmp edx, 8
mov r9, rcx
jb 0x471297
mov ecx, edx
shr rcx, 3
mov eax, dword [r9 + 4]
add edx, 0xfffffff8
xor eax, dword [r9]
add r9, 8
xor r8d, eax
dec rcx
jne 0x471281
cmp edx, 4
jb 0x4712a3
xor r8d, dword [r9]
add r9, 4
and edx, 3
cmp edx, 2
jbe 0x4712b8
movzx eax, byte [r9]
shl eax, 0x10
xor r8d, eax
inc r9
cmp edx, 1
jbe 0x4712ca
movzx ecx, byte [r9]
shl ecx, 8
xor r8d, ecx
inc r9
test edx, edx
je 0x4712d5
movzx ecx, byte [r9]
xor r8d, ecx
mov eax, r8d
ret
Function at 0x485e54
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx eax, word [rcx + 2]
cmp ax, word [rdx + 2]
je 0x485e61
xor al, al
ret
movzx r10d, word [rdx]
cmp word [rcx], r10w
jne 0x485e6e
mov al, 1
ret
cmp ax, 8
mov r8d, 0xffff
je 0x485e88
cmp ax, 6
ja 0x485e8e
mov r8d, 0x7fff
jmp 0x485e8e
mov r8d, 0x7ff9
movzx eax, r10w
xor r9d, r9d
xor ax, word [rcx]
bt ax, 0xb
jae 0x485ee1
cmp dword [rcx + 0x30], r9d
mov rax, qword [rcx + 0x28]
mov r11d, r9d
jbe 0x485ebd
cmp byte [rax], 0x80
jae 0x485ee1
inc r11d
inc rax
cmp r11d, dword [rcx + 0x30]
jb 0x485eac
mov r11d, dword [rdx + 0x30]
mov rax, qword [rdx + 0x28]
mov edx, r9d
cmp r11d, r9d
jbe 0x485edc
cmp byte [rax], 0x80
jae 0x485ee1
inc edx
inc rax
cmp edx, r11d
jb 0x485ecd
btr r8d, 0xb
movzx ecx, word [rcx]
movzx edx, r10w
and ecx, r8d
and edx, r8d
cmp ecx, edx
sete al
ret

Function at 0x494ef0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [rcx + 0x40], 0xa
mov r8, rcx
jae 0x494f63
nop
nop
mov r9d, dword [r8]
cmp r9d, 8
jae 0x494f38
mov r10, qword [r8 + 8]
cmp r10, qword [r8 + 0x10]
je 0x495034
movzx edx, byte [r10]
lea eax, [r9 + 8]
mov ecx, 0x18
sub ecx, r9d
mov dword [r8], eax
lea rax, [r10 + 1]
shl edx, cl
mov qword [r8 + 8], rax
or dword [r8 + 4], edx
mov eax, dword [r8 + 4]
add dword [r8], 0xfffffff8
mov ecx, eax
shl eax, 8
mov dword [r8 + 4], eax
mov eax, dword [r8 + 0x40]
shr ecx, 0x18
mov byte [rax + r8 + 0x70de], cl
inc dword [r8 + 0x40]
cmp dword [r8 + 0x40], 0xa
jb 0x494f00
mov dword [r8 + 0x70e8], 0
movzx eax, byte [r8 + 0x70e4]
shl eax, 8
mov dword [r8 + 0x70e8], eax
movzx ecx, byte [r8 + 0x70e5]
or ecx, eax
shl ecx, 8
mov dword [r8 + 0x70e8], ecx
movzx edx, byte [r8 + 0x70e6]
or edx, ecx
shl edx, 8
mov dword [r8 + 0x70e8], edx
movzx eax, byte [r8 + 0x70e7]
or eax, edx
mov dword [r8 + 0x70e8], eax
cmp byte [r8 + 0x70de], 0x31
jne 0x495037
cmp byte [r8 + 0x70df], 0x41
jne 0x495037
cmp byte [r8 + 0x70e0], 0x59
jne 0x495037
cmp byte [r8 + 0x70e1], 0x26
jne 0x495037
cmp byte [r8 + 0x70e2], 0x53
jne 0x495037
cmp byte [r8 + 0x70e3], 0x59
jne 0x495037
cmp byte [r8 + 0x70f0], 0
jne 0x495006
inc qword [r8 + 0x70f8]
inc qword [r8 + 0x7100]
mov byte [r8 + 0x70f0], 1
mov eax, dword [r8 + 0x70ec]
rol eax, 1
xor eax, dword [r8 + 0x70e8]
mov dword [r8 + 0x70ec], eax
mov dword [r8 + 0x3c], 2
xor eax, eax
ret
cmp byte [r8 + 0x70de], 0x17
jne 0x4950db
cmp byte [r8 + 0x70df], 0x72
jne 0x4950db
cmp byte [r8 + 0x70e0], 0x45
jne 0x4950db
cmp byte [r8 + 0x70e1], 0x38
jne 0x4950db
cmp byte [r8 + 0x70e2], 0x50
jne 0x4950db
cmp byte [r8 + 0x70e3], 0x90
jne 0x4950db
cmp byte [r8 + 0x70f0], 0
jne 0x49508c
inc qword [r8 + 0x70f8]
mov edx, dword [r8 + 4]
mov byte [r8 + 0x70f0], 1
test edx, edx
je 0x4950a4
mov byte [r8 + 0x70f2], 1
mov eax, dword [r8]
mov dword [r8 + 0x3c], 0xb
mov ecx, eax
and ecx, 7
sub eax, ecx
shl edx, cl
mov dword [r8], eax
mov eax, dword [r8 + 0x70ec]
mov dword [r8 + 4], edx
cmp dword [r8 + 0x70e8], eax
je 0x495034
mov byte [r8 + 0x70f1], 1
mov eax, 1
ret
Function at 0x499370
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x2c], 8
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x28]
mov r8d, edx
mov rdx, qword [rcx]
mov qword [rcx + 0x20], rax
mov rax, qword [rcx + 0x8cf8]
mov qword [rsp + 0x60], rsi
xor esi, esi
mov rbx, rcx
mov dword [rsp + 0x28], esi
mov byte [rsp + 0x30], sil
mov dword [rcx + 0x8ce8], esi
mov r9d, dword [rax + 0x19c]
call fcn.00498ba0
mov rcx, qword [rbx + 0x8cf8]
cmp byte [rcx + 0x1e4], sil
je 0x4993f6
mov eax, dword [rbx + 0x8cec]
mov rcx, qword [rcx + 0x1a8]
imul rax, rax, 0x8e28
mov rcx, qword [rax + rcx + 0x8d18]
call fcn.004c3430
cmp dword [rbx + 0x8ce8], esi
mov edx, esi
jbe 0x499437
lea r8, [rbx + 0x7ce8]
nop
nop
nop
mov rcx, qword [rbx + 0x8cf8]
inc edx
add r8, 4
mov eax, dword [rcx + 0x1a0]
rol eax, 1
xor eax, dword [r8 - 4]
mov dword [rcx + 0x1a0], eax
cmp edx, dword [rbx + 0x8ce8]
jb 0x499410
mov eax, dword [rsp + 0x28]
movzx r9d, byte [rsp + 0x30]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x8cf8]
lea r8d, [rax*8 + 8]
mov qword [rsp + 0x58], rbp
sub r8d, dword [rsp + 0x2c]
call fcn.00498e30
mov rbp, qword [rbx + 0x8cf8]
cmp byte [rbp + 0x1e4], sil
je 0x499506
mov qword [rsp + 0x68], rdi
mov edi, dword [rbx + 0x8cec]
inc edi
cmp edi, dword [rbp + 0x1e0]
cmove edi, esi
cmp qword [rbp + 0x200], rsi
je 0x4994dc
lea rcx, [rbp + 0x160]
call fcn.00410814
mov ecx, 0xf
lea rdx, [rbx + 0x8d20]
sub ecx, dword [rbp + 0x158]
lea r8, [rsp + 0x20]
shr rcx, 3
lea r11, [rcx + rax]
mov rax, qword [rbx + 0x8cf8]
mov qword [rsp + 0x20], r11
mov rcx, qword [rax + 0x200]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov esi, eax
mov rcx, qword [rbx + 0x8cf8]
mov r8d, edi
mov rdx, qword [rcx + 0x1a8]
imul r8, r8, 0x8e28
lea rcx, [r8 + rdx + 0x8d18]
call fcn.004c34a0
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x48
ret
Function at 0x4aa1a0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
xor ebx, ebx
cmp r8, 0x40
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, r8
mov qword [rax - 0x48], rbx
mov qword [rax - 0x40], rbx
mov qword [rax - 0x38], rbx
mov qword [rax - 0x30], rbx
mov qword [rax - 0x28], rbx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x18], rbx
mov qword [rax - 0x10], rbx
mov rbp, rdx
mov rsi, rcx
jbe 0x4aa20a
call fcn.004c1ab0
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
call fcn.004c2160
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.004c22f0
jmp 0x4aa219
test r8, r8
je 0x4aa219
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_memcpy
mov rdi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x78]
mov rax, rbx
nop
nop
xor byte [rsp + rax + 0x20], 0x36
xor byte [rsp + rax + 0x21], 0x36
add rax, 2
cmp rax, 0x40
jb 0x4aa230
mov rcx, rsi
call fcn.004c1ab0
lea rdx, [rsp + 0x20]
mov r8d, 0x40
mov rcx, rsi
call fcn.004c2160
nop
xor byte [rsp + rbx + 0x20], 0x6a
xor byte [rsp + rbx + 0x21], 0x6a
add rbx, 2
cmp rbx, 0x40
jb 0x4aa260
lea rcx, [rsi + 0x60]
call fcn.004c1ab0
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x60]
mov r8d, 0x40
call fcn.004c2160
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret

Function at 0x4aa330
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xe8
mov qword [rax + 8], rbx
xor ebx, ebx
cmp r8, 0x40
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, r8
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov rsi, rdx
mov rbp, rcx
jbe 0x4aa3d8
lea rcx, [rax - 0x68]
call fcn.004c1ab0
lea rcx, [rsp + 0x80]
mov r8, rdi
mov rdx, rsi
call fcn.004c2160
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x80]
call fcn.004c22f0
mov r11, rbx
nop
nop
nop
mov eax, dword [rsp + r11 + 0x60]
add r11, 4
cmp r11, 0x14
bswap eax
mov dword [rsp + r11 + 0x1c], eax
jb 0x4aa3c0
jmp 0x4aa40b
test rdi, rdi
mov r8, rbx
je 0x4aa40b
mov eax, r8d
mov rdx, r8
mov ecx, 3
and eax, 3
shr rdx, 2
inc r8
sub ecx, eax
movzx eax, byte [r8 + rsi - 1]
shl ecx, 3
shl eax, cl
or dword [rsp + rdx*4 + 0x20], eax
cmp r8, rdi
jb 0x4aa3e0
mov rdi, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x100]
mov rax, rbx
nop
xor dword [rsp + rax*4 + 0x20], 0x36363636
inc rax
cmp rax, 0x10
jb 0x4aa420
mov rcx, rbp
call fcn.004c1ab0
lea rdx, [rsp + 0x20]
mov r8d, 0x10
mov rcx, rbp
call fcn.004c2440
nop
xor dword [rsp + rbx*4 + 0x20], 0x6a6a6a6a
inc rbx
cmp rbx, 0x10
jb 0x4aa450
lea rcx, [rbp + 0x60]
call fcn.004c1ab0
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x60]
mov r8d, 0x10
call fcn.004c2440
mov rbp, qword [rsp + 0xf8]
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe8
ret
Function at 0x4aa520
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xa8
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rbx, rdx
mov qword [rax + 0x20], rdi
mov edi, r8d
lea rdx, [rsp + 0x20]
mov r8d, 5
mov rsi, rcx
call fcn.004c23e0
lea rdx, [rsp + 0x60]
lea rcx, [rsi + 0x60]
mov r8d, 5
call fcn.004c23e0
test edi, edi
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov eax, dword [rbx + 0x10]
mov dword [rsp + 0x30], eax
je 0x4aa5d1
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.004c1ae0
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x60]
lea rcx, [rsi + 0x60]
call fcn.004c1ae0
mov eax, dword [rsp + 0x24]
mov r11d, dword [rsp + 0x20]
xor dword [rbx + 4], eax
mov eax, dword [rsp + 0x28]
xor dword [rbx], r11d
xor dword [rbx + 8], eax
mov eax, dword [rsp + 0x2c]
xor dword [rbx + 0xc], eax
mov eax, dword [rsp + 0x30]
xor dword [rbx + 0x10], eax
dec rdi
jne 0x4aa583
mov rdi, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xc0]
mov rbp, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa8
ret

Function at 0x4aaee0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
test r8, r8
mov eax, dword [rcx + 4]
mov qword [rsp + 0x30], rbx
movsxd rbx, dword [rcx]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x20], r12
lea rbp, [rcx + rax*4 + 8]
mov rsi, r8
mov rdi, rdx
mov r12, rcx
je 0x4aafb8
cmp ebx, 0x10
je 0x4aaf48
lea rdx, [rbp + rbx]
nop
nop
nop
movzx eax, byte [rdx]
inc rdi
inc ebx
xor byte [rdi - 1], al
inc rdx
dec rsi
je 0x4aaf48
cmp ebx, 0x10
jne 0x4aaf30
cmp rsi, 0x10
jb 0x4aaf74
mov rbx, rsi
lea rcx, [rbp + 0x10]
mov rdx, rdi
shr rbx, 4
mov r8, rbx
call qword [0x0050b830]
shl rbx, 4
add rdi, rbx
sub rsi, rbx
mov ebx, 0x10
test rsi, rsi
je 0x4aafb4
xor ebx, ebx
lea rcx, [rbp + 0x10]
mov rdx, rbp
mov qword [rbp], rbx
lea r8d, [rbx + 1]
mov qword [rbp + 8], rbx
call qword [0x0050b830]
nop
nop
nop
movzx eax, byte [rbp]
inc rdi
inc ebx
xor byte [rdi - 1], al
inc rbp
dec rsi
jne 0x4aafa0
mov dword [r12], ebx
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret