joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001000
Capabilities:
Delete file
Encode data using xor
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
and qword [rbp + 0x2f], 0
lea rax, [0x140002830]
mov qword [rbp + 0xf], rax
lea rcx, [rbp + 0x27]
lea rax, [rbp + 7]
mov dword [rbp + 7], 0x520050
xorps xmm0, xmm0
mov qword [rbp + 0x37], rax
mov dword [rbp + 0x27], 0x30
mov dword [rbp + 0x3f], 0x40
movdqu xmmword [rbp + 0x47], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwDeleteFile]
and dword [rsp + 0x50], 0
lea r9, [rbp + 0x17]
and qword [rsp + 0x48], 0
lea r8, [rbp + 0x27]
mov dword [rsp + 0x40], 0x860
lea rcx, [rbp + 0x67]
mov dword [rsp + 0x38], 3
mov edx, 0x10000000
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], 0x80
and qword [rsp + 0x20], 0
call qword [sym.imp.ntoskrnl.exe_ZwCreateFile]
mov ebx, eax
test eax, eax
js 0x14000111d
lea rsi, section..data
xor edx, edx
mov rcx, rsi
movdqu xmm0, xmmword [rcx]
add edx, 0x10
pxor xmm0, xmmword [0x140003100]
movdqu xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
cmp edx, 0x1cef40
jb 0x1400010b0
and qword [rsp + 0x40], 0
lea rax, [rbp + 0x17]
and qword [rsp + 0x38], 0
xor r9d, r9d
mov rcx, qword [rbp + 0x67]
xor r8d, r8d
mov dword [rsp + 0x30], 0x1cef40
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwWriteFile]
xor edx, edx
mov r8d, 0x1cef40
mov rcx, rsi
call fcn.140002740
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
lea r11, [rsp + 0xb0]
mov eax, ebx
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140001134
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x150
xor ebx, ebx
lea r9, [rax + 0x10]
mov r14, rcx
mov dword [rax + 0x10], ebx
xor r8d, r8d
lea rdx, [rax + 0x10]
lea ebp, [rbx + 0xb]
mov ecx, ebp
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140001288
mov edx, dword [rsp + 0x178]
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rsi, rax
test rax, rax
je 0x140001288
mov ecx, dword [rsp + 0x178]
mov rdi, rax
xor eax, eax
xor r9d, r9d
rep stosb byte [rdi], al
mov r8d, dword [rsp + 0x178]
mov ecx, ebp
mov rdx, rsi
call qword [sym.imp.ntoskrnl.exe_ZwQuerySystemInformation]
test eax, eax
js 0x140001278
mov edi, ebx
cmp qword [rsi], rbx
jbe 0x140001278
lea rbp, [rsi + 8]
mov rax, rbp
lea rcx, [rsp + 0x20]
mov edx, 2
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx + 0x50], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x1400011d6
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov rax, qword [rax + 0x20]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov qword [rcx + 0x20], rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
je 0x14000125f
mov rdx, r14
lea rcx, [rsp + 0x48]
call sub.ntoskrnl.exe_strstr
test rax, rax
jne 0x140001273
inc rdi
add rbp, 0x128
cmp rdi, qword [rsi]
jae 0x140001278
jmp 0x1400011c9
mov rbx, qword [rsp + 0x30]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, rbx
jmp 0x14000128a
xor eax, eax
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x14000173c
Capabilities:
Access pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
and dword [rax - 0x28], 0
mov r14d, r9d
mov ebx, r8d
mov r15, rdx
mov rbp, rcx
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov rdi, rax
test rax, rax
jne 0x14000177b
mov ebx, dword [rsp + 0x70]
jmp 0x140001802
movzx eax, word [rax + 0x18]
mov ecx, 0x10b
cmp ax, cx
je 0x140001799
mov ecx, 0x20b
cmp ax, cx
jne 0x140001772
mov rsi, qword [rdi + 0x30]
jmp 0x14000179c
mov esi, dword [rdi + 0x34]
mov r8d, 5
lea r9, [rsp + 0x20]
mov dl, 1
mov rcx, rbp
call qword [sym.imp.ntoskrnl.exe_RtlImageDirectoryEntryToData]
test rax, rax
je 0x1400017fa
mov ecx, dword [rsp + 0x20]
test ecx, ecx
je 0x1400017fa
mov rdi, rbp
sub rdi, rsi
add rdi, r15
mov edx, dword [rax + 4]
test edx, edx
je 0x140001772
sub ecx, edx
lea r8, [rax + 8]
mov dword [rsp + 0x20], ecx
add edx, 0xfffffff8
mov ecx, dword [rax]
mov r9, rdi
add rcx, rbp
shr edx, 1
call fcn.140001618
test rax, rax
je 0x140001772
mov ecx, dword [rsp + 0x20]
test ecx, ecx
jne 0x1400017c8
jmp 0x140001802
test byte [rdi + 0x16], 1
cmovne ebx, r14d
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x140001820
Capabilities:
Access pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rsi, rcx
xor ebx, ebx
call qword [sym.imp.ntoskrnl.exe_RtlImageNtHeader]
mov rbp, rax
test rax, rax
je 0x1400018b4
lea r8d, [rbx + 0xa]
mov dword [rsp + 0x48], ebx
lea r9, [rsp + 0x48]
mov dl, 1
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlImageDirectoryEntryToData]
mov rdi, rax
test rax, rax
je 0x1400018b9
mov r14d, 0x20b
cmp word [rbp + 0x18], r14w
jne 0x140001878
mov rax, qword [rax + 0x58]
jmp 0x14000187b
mov eax, dword [rax + 0x3c]
test rax, rax
je 0x1400018b9
mov rax, rsi
lea rcx, [rsp + 0x50]
shr rax, 0x20
xor eax, esi
mov dword [rsp + 0x50], eax
call qword [sym.imp.ntoskrnl.exe_RtlRandomEx]
mov ecx, eax
xor rcx, rsi
cmp word [rbp + 0x18], r14w
jne 0x1400018ad
mov rax, qword [rdi + 0x58]
mov qword [rax], rcx
jmp 0x1400018b9
mov eax, dword [rdi + 0x3c]
mov dword [rax], ecx
jmp 0x1400018b9
mov ebx, 0xc000007b
mov rbp, qword [rsp + 0x58]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1400018d0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
xor r10d, r10d
mov r13, r8
mov r14, rdx
mov r9, rcx
test rcx, rcx
je 0x1400019e4
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400019e4
movsxd rax, dword [rcx + 0x3c]
cmp dword [rax + rcx], 0x4550
jne 0x1400019e4
mov ecx, 0x20b
cmp word [rax + r9 + 0x18], cx
jne 0x14000193b
mov r11d, dword [rax + r9 + 0x8c]
mov ecx, dword [rax + r9 + 0x88]
jmp 0x140001945
mov r11d, dword [rax + r9 + 0x7c]
mov ecx, dword [rax + r9 + 0x78]
mov edx, ecx
xor r8d, r8d
add rdx, r9
mov eax, dword [rdx + 0x14]
mov r15d, dword [rdx + 0x24]
mov r12d, dword [rdx + 0x20]
add r15, r9
mov esi, dword [rdx + 0x1c]
add r12, r9
add rsi, r9
mov dword [rsp + 0x30], eax
test eax, eax
je 0x1400019df
cmp r14, 0xffff
ja 0x140001986
movzx ebx, r8w
mov ecx, ebx
movzx eax, r14w
add ecx, dword [rdx + 0x10]
cmp eax, ecx
jmp 0x1400019b2
cmp r8d, dword [rdx + 0x18]
jae 0x1400019e4
mov ecx, dword [r12 + r8*4]
mov rbp, r14
movzx ebx, word [r15 + r8*2]
add rcx, r9
sub rbp, rcx
movzx eax, byte [rcx]
movzx edi, byte [rcx + rbp]
sub eax, edi
jne 0x1400019b0
inc rcx
test edi, edi
jne 0x14000199e
test eax, eax
je 0x1400019c0
inc r8d
cmp r8d, dword [rsp + 0x30]
jb 0x14000196c
jmp 0x1400019df
movzx eax, bx
mov r10d, dword [rsi + rax*4]
add r10, r9
cmp r10, rdx
jb 0x1400019df
mov ecx, r11d
add rcx, rdx
cmp r10, rcx
ja 0x1400019df
test r13, r13
je 0x1400019e4
mov rax, r10
jmp 0x1400019e6
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140002314
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
lea rax, [0x1400023f0]
mov qword [rcx + 0x68], rax
lea rcx, [0x140002ed0]
call fcn.140001134
test rax, rax
jne 0x140002355
call fcn.1400012a4
lea rcx, [0x140002ed0]
call fcn.140001134
test rax, rax
je 0x1400023d3
and qword [rsp + 0x40], 0
lea rbx, [rax + 0x197000]
mov rsi, rbx
lea rdi, [rsp + 0x40]
mov ecx, 8
rep movsb byte [rdi], byte [rsi]
cmp qword [rsp + 0x40], 0x5000
je 0x1400023d3
lea rdx, [0x140002ee0]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea rcx, [rsp + 0x20]
call fcn.140001598
test eax, eax
js 0x1400023d8
lea rdx, [0x1401d2f40]
xor ecx, ecx
mov rax, rdx
movdqu xmm0, xmmword [rax]
add ecx, 0x10
pxor xmm0, xmmword [0x140003110]
movdqu xmmword [rax], xmm0
lea rax, [rax + 0x10]
cmp ecx, 0x34a0
jb 0x1400023a8
mov rcx, rbx
call fcn.140001e28
test eax, eax
js 0x1400023d8
mov eax, 0xc0000001
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400113ca
Capabilities:
Terminate process

Disassembly:
jmp 0x14001a6b0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400114c4
Capabilities:
Accept command line arguments
Read file on windows

Disassembly:
jmp 0x1400160a0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x258
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x5e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x278]
mov rax, qword [0x140028040]
xor rax, rbp
mov qword [rbp + 0x228], rax
lea rcx, [0x14002e101]
call fcn.1400116a9
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov qword [rbp + 0x98], rax
lea rdx, [0x140023deb]
lea rcx, [rbp + 0xb8]
call fcn.1400112fd
nop
mov dword [rbp + 0xf4], 2
jmp 0x140016127
mov eax, dword [rbp + 0xf4]
inc eax
mov dword [rbp + 0xf4], eax
mov eax, dword [rbp + 0x250]
cmp dword [rbp + 0xf4], eax
jge 0x14001617b
lea rdx, [0x140023f2c]
lea rcx, [rbp + 0xb8]
call fcn.14001107d
movsxd rax, dword [rbp + 0xf4]
mov rcx, qword [rbp + 0x258]
mov rdx, qword [rcx + rax*8]
lea rcx, [rbp + 0xb8]
call fcn.14001107d
lea rdx, [0x140023f30]
lea rcx, [rbp + 0xb8]
call fcn.14001107d
jmp 0x140016119
mov eax, 8
imul rax, rax, 1
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 0x258]
mov rcx, qword [rcx + rax]
call fcn.140016470
cmp dword [rbp + 0x3c], 0
jne 0x1400161cb
lea rcx, str.file_is_empty._n
call fcn.140011334
mov dword [rbp + 0x1d4], 0
lea rcx, [rbp + 0xb8]
call fcn.14001114a
mov eax, dword [rbp + 0x1d4]
jmp 0x1400162b9
mov eax, 8
imul rax, rax, 1
lea rdx, [0x140023f4c]
mov rcx, qword [rbp + 0x258]
mov rcx, qword [rcx + rax]
call qword [sym.imp.ucrtbased.dll_fopen]
mov qword [rbp + 0x78], rax
cmp qword [rbp + 0x78], 0
jne 0x140016238
mov eax, 8
imul rax, rax, 1
mov rcx, qword [rbp + 0x258]
mov rdx, qword [rcx + rax]
lea rcx, str.unable_to_open___s_._n
call fcn.140011334
mov dword [rbp + 0x1f4], 0
lea rcx, [rbp + 0xb8]
call fcn.14001114a
mov eax, dword [rbp + 0x1f4]
jmp 0x1400162b9
movsxd rax, dword [rbp + 0x3c]
mov rcx, rax
call qword [sym.imp.ucrtbased.dll_malloc]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
je 0x140016293
movsxd rax, dword [rbp + 0x3c]
mov r9, qword [rbp + 0x78]
mov r8, rax
mov edx, 1
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fread]
lea rcx, [rbp + 0xb8]
call fcn.1400110a0
movsxd rcx, dword [rbp + 0x3c]
mov r8, rax
mov rdx, rcx
mov rcx, qword [rbp + 8]
call fcn.140011569
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_free]
mov rcx, qword [rbp + 0x78]
call qword [sym.imp.ucrtbased.dll_fclose]
mov dword [rbp + 0x214], 0
lea rcx, [rbp + 0xb8]
call fcn.14001114a
mov eax, dword [rbp + 0x214]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.1400115af
mov rax, rdi
mov rcx, qword [rbp + 0x228]
xor rcx, rbp
call fcn.140011352
lea rsp, [rbp + 0x238]
pop rdi
pop rbp
ret
Function at 0x1400114dd
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001cbd0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001cbf0
xor al, al
jmp 0x14001cc71
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001cc03
xor al, al
jmp 0x14001cc71
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001cc2d
xor al, al
jmp 0x14001cc71
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001cc41
xor al, al
jmp 0x14001cc71
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001cc53
xor al, al
jmp 0x14001cc71
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001cc6f
xor al, al
jmp 0x14001cc71
mov al, 1
add rsp, 0x38
ret
Function at 0x140013930
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1400e47f8]
xor edx, edx
div dword [0x1400e47fc]
or eax, 0x9879a020
and eax, 0x57a0268b
add eax, 0x217c6e82
cmp eax, 0x8fc30b0d
je 0x1400139ac
jmp 0x140013959
mov edx, dword [0x1400e4800]
or edx, dword [0x1400e4804]
add edx, 0x863e6c72
add edx, 0xb9107f47
sub edx, 0xfe666033
mov rax, r8
add rax, 0x2f2d75ba
xor rax, 0x5da752cc
add rax, 0x22d49c05
mov r9, rax
rol r9, 4
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x226669b4
ja 0x140013959
ret
invalid

Function at 0x140013df0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1400e4818]
and eax, dword [0x1400e481c]
add eax, 0x93f9c6ee
imul eax, eax, 0x9ea5e63f
add eax, 0x87246cde
cmp eax, 0x91469fd6
jb 0x140013e67
jmp 0x140013e15
mov eax, dword [0x1400e4820]
imul eax, dword [0x1400e4824]
imul r8d, eax, 0xf863f2dc
or r8d, 0x42655782
sub r8d, 0x447240bd
mov rax, rdx
xor rax, 0xffffffff87a37282
add rax, 0xa421e30
mov r9, rax
rol r9, 6
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0x89594dec
je 0x140013e15
ret
movabs byte [0xc9fe3101694ce4e3], al
or esp, dword [rsp + rdi*2 - 0x15]
sahf
int3

Function at 0x140014020
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1400e4828]
add eax, dword [0x1400e482c]
add eax, 0x72e1019f
imul eax, eax, 0x3a73c21e
xor eax, 0xa8cf35b3
cmp eax, 0x570887d5
jb 0x1400140ab
jmp 0x140014048
mov eax, dword [0x1400e4830]
or eax, dword [0x1400e4834]
imul eax, eax, 0x8b96e115
mov r9d, 0xc0a72d5e
xor edx, edx
div r9d
mov edx, eax
and edx, 0x819c5f53
imul rax, r8, 0x726031bf
movabs r9, 0x335bd4ff8c112615
add rax, r9
mov r9, rax
shr r9, 4
xor r9, rax
mov r10, r9
rol r10, 3
xor r10, r9
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0xe94214ef
je 0x140014048
ret
sbb ecx, eax
mov cl, 0x8b
rcr ebx, 0x68
nop
jmp 0x140014046

Function at 0x140015010
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [str.E_6_b]
or eax, dword [0x1400e489c]
mov r9d, 0xfeabde19
xor edx, edx
div r9d
imul eax, eax, 0x765d21a3
imul eax, eax, 0xccc0f2b0
cmp eax, 0xfbc44e5d
je 0x1400150ae
jmp 0x14001503f
mov eax, dword [0x1400e48a0]
xor edx, edx
div dword [0x1400e48a4]
mov r9d, 0x5ed21755
xor edx, edx
div r9d
and eax, 0xfc99dfe4
mov r9d, 0x59646212
xor edx, edx
div r9d
mov edx, eax
mov rax, r8
shr rax, 4
xor rax, r8
movabs r9, 0xfce209db81706adf
imul rax, r9
movabs r9, 0x1b585dffdfdf620
add rax, r9
mov r9, rax
rol r9, 1
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xb2821b07
ja 0x14001503f
ret
in al, dx
invalid
Function at 0x140015350
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1400e48c8]
sub eax, dword [0x1400e48cc]
add eax, 0x70a01d29
add eax, 0xaeb4a9a1
and eax, 0xd787b37e
cmp eax, 0xe3314d71
ja 0x1400153d6
jmp 0x140015374
mov eax, dword [0x1400e48d0]
add eax, dword [0x1400e48d4]
imul eax, eax, 0x3cc1d52c
imul r8d, eax, 0x3d936e7
xor r8d, 0xa76f4796
mov rax, rdx
add rax, 0x481d0679
mov r9, rax
rol r9, 7
xor r9, rax
add r9, 0x77abc8d0
xor r9, 0xffffffffed567fec
mov r10, r9
rol r10, 4
xor r10, r9
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp r8d, 0xc3d082b1
ja 0x140015374
ret
xor byte [rbp + 0x2d4dbec5], dh
stosd dword [rdi], eax
clc
cmp al, 0x73
mov ch, 0xeb
mov cs, esp
int3

Function at 0x140015df0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1400e4918]
xor edx, edx
div dword [0x1400e491c]
and eax, 0x718212f3
imul eax, eax, 0x56cd860d
mov r9d, 0xf4d888d5
xor edx, edx
div r9d
cmp eax, 0x5bbf657e
ja 0x140015e7f
jmp 0x140015e20
mov eax, dword [0x1400e4920]
add eax, dword [0x1400e4924]
mov r9d, 0xe219b4f9
xor edx, edx
div r9d
mov edx, eax
and edx, 0xcbe771ac
xor edx, 0xda228d54
mov rax, r8
rol rax, 5
xor rax, r8
mov r9, rax
rol r9, 4
xor rax, r9
xor rax, 0x3d0f3014
mov r9, rax
rol r9, 7
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xccc3038a
jb 0x140015e20
ret
outsb dx, byte [rsi]
or byte [rsi + 0x43], dh
invalid

Function at 0x140015ec0
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1400e4928]
xor edx, edx
div dword [0x1400e492c]
or eax, 0xdb49040f
add eax, 0x3ac883db
and eax, 0x2c6cec9e
cmp eax, 0x21cb901a
ja 0x140015f3c
jmp 0x140015ee9
mov eax, dword [0x1400e4930]
imul eax, dword [0x1400e4934]
mov r9d, 0x55406971
xor edx, edx
div r9d
mov edx, eax
sub edx, 0x59c99496
and edx, 0xd173eafb
imul rax, r8, 0x11c411d7
add rax, 0xffffffffdd7084f5
mov r9, rax
rol r9, 6
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0xa2c75a28
ja 0x140015ee9
ret
invalid

Function at 0x140016270
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1400e4948]
xor eax, dword [0x1400e494c]
and eax, 0x6095026e
sub eax, 0x75b7832c
xor eax, 0x2cfc3fee
cmp eax, 0x971926f4
ja 0x1400162f2
jmp 0x140016294
mov r8d, dword [0x1400e4950]
add r8d, dword [0x1400e4954]
add r8d, 0x4cc05182
sub r8d, 0x1381ffc9
sub r8d, 0x582cab62
mov rax, rdx
xor rax, 0xffffffff81764ea7
mov r9, rax
rol r9, 4
xor r9, rax
add r9, 0xfffffffff32dbaec
mov r10, r9
rol r10, 3
xor r10, r9
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp r8d, 0x98c6f644
ja 0x140016294
ret
invalid
Function at 0x140016570
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1400e4958]
and eax, dword [0x1400e495c]
mov r9d, 0xfd7fc7e8
xor edx, edx
div r9d
sub eax, 0xfaf8c136
mov r9d, 0x76d2d0e7
xor edx, edx
div r9d
cmp eax, 0xb91bf5d8
ja 0x140016604
jmp 0x1400165a3
mov eax, dword [0x1400e4960]
sub eax, dword [0x1400e4964]
imul edx, eax, 0x2cf2e183
or edx, 0x6e9d12a2
and edx, 0x2ca5b005
imul rax, r8, 0x52adbc6f
movabs r9, 0xdb56c8fda351dd7d
add rax, r9
mov r9, rax
shr r9, 0xf
xor r9, rax
xor eax, eax
sub rax, r9
mov r9, rax
rol r9, 4
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp edx, 0x82dba94f
je 0x1400165a3
ret
xchg ebp, eax
pop rsi
adc byte [rdx + rcx*8 - 0x14cae947], dh
xchg ebx, eax
int3

Function at 0x140016690
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov eax, dword [0x1400e4968]
or eax, dword [0x1400e496c]
xor eax, 0x715cfa18
and eax, 0xa8c3cb37
imul eax, eax, 0x712f9366
cmp eax, 0xc6f156cd
je 0x140016712
jmp 0x1400166b5
mov eax, dword [0x1400e4970]
imul eax, dword [0x1400e4974]
imul r8d, eax, 0xaf0fd133
or r8d, 0xaae4bc1f
or r8d, 0x463b89cc
mov rax, rdx
shr rax, 0x10
xor rax, rdx
mov r9d, 0x9cb0ed2f
sub r9, rax
xor r9, 0xffffffffaf4fdb5f
mov r10, r9
rol r10, 5
xor r10, r9
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp r8d, 0x7dc9dbbf
je 0x1400166b5
ret
leave
and esi, esp
int 0x77
or byte [rbx + 0x70], 0xeb
xchg edi, eax
int3

Function at 0x140016860
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x1400e4978]
imul eax, dword [0x1400e497c]
or eax, 0x387260ac
or eax, 0x49809213
sub eax, 0x8089334a
cmp eax, 0xfa43ef37
jb 0x1400168e9
jmp 0x140016885
mov r8d, dword [0x1400e4980]
or r8d, dword [0x1400e4984]
add r8d, 0xd2ab7837
or r8d, 0x4f16717
sub r8d, 0xd3cbc563
imul rax, rdx, 0xffffffff8e5f2743
movabs r9, 0xd33ea6ed745e15db
add rax, r9
xor rax, 0xffffffffdfad5ac0
add rax, 0x2555bf58
mov r9, rax
rol r9, 6
xor r9, rax
and r9, 0xffff
mov rax, rcx
add rax, r9
cmp r8d, 0x352f94e1
jb 0x140016885
ret
stc
invalid

Function at 0x140016b40
Capabilities:
Encode data using xor

Disassembly:
mov r8, rdx
mov eax, dword [0x1400e4998]
imul eax, dword [0x1400e499c]
mov r9d, 0xdbcd1861
xor edx, edx
div r9d
sub eax, 0xcafbb908
imul eax, eax, 0x3c7ce27c
cmp eax, 0x71cda5ff
jbe 0x140016bd1
jmp 0x140016b6f
mov eax, dword [0x1400e49a0]
xor edx, edx
div dword [0x1400e49a4]
add eax, 0x5175613f
push rcx
add eax, 0xc79d44e1
mov r9d, 0x10c4fdcb
xor edx, edx
div r9d
mov edx, eax
movabs rax, 0xcb6d7abeeacc6f77
mov r9, r8
imul r9, rax
movabs rax, 0xbd822449dd56c3f7
add r9, rax
mov r10, r9
rol r10, 1
xor r10, r9
and r10, 0xffff
mov rax, rcx
add rax, r10
cmp edx, 0x6fb315cf
ja 0x140016b6f
ret
je 0x140016b81
invalid
Function at 0x140017370
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
movzx eax, byte [rsi + 0x20]
mov ecx, eax
sub ecx, 3
je 0x14001739a
jmp 0x140017387
sub eax, 4
je 0x1400174ba
jmp case.0x1400174f0.0
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
mov cx, word [rsi + 0x28]
mov rax, qword [rsi + 0x30]
cmp cx, 3
jne case.0x1400174f0.0
mov ecx, eax
and ecx, 3
mov rdx, rcx
sub rdx, 3
ja 0x1400173c6
lea rdx, [0x1400c4114]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov eax, dword [0x1400e4a18]
add eax, dword [0x1400e4a1c]
and eax, 0x700497f
xor eax, 0x66764c8e
or eax, 0xba2697bf
cmp eax, 0x765d282a
jb 0x140017542
jmp 0x1400173ee
mov eax, dword [0x1400e4a20]
sub eax, dword [0x1400e4a24]
sub eax, 0xf5bc3581
xor eax, 0xbca15a9d
sub eax, 0x52dcab5d
cmp eax, 0xb1112289
ja 0x1400173ee
ud2
cmp byte [rsi + 0x98], 3
jne 0x1400174cf
mov rcx, rsi
add rcx, 0x50
call fcn.14001a8c0
mov rax, qword [rsi + 0x28]
cmp rax, 0
je case.0x1400174f0.0
mov ecx, eax
and ecx, 3
lea rdx, [0x1400c4124]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
ret