joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006ac40
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14006ac70
xor eax, eax
jmp 0x14006ad33
mov rbp, rbx
cmp word [rax], si
je 0x14006ac95
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x14006ac7c
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14006ac78
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14006ab90
movsxd r14, eax
test eax, eax
jne 0x14006acd3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14006ac69
mov rcx, r14
call fcn.14006858c
mov rdi, rax
test rax, rax
jne 0x14006acec
xor ecx, ecx
call fcn.1400685ec
jmp 0x14006acc8
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14006ab90
test eax, eax
jne 0x14006ad1d
mov rcx, rdi
call fcn.1400685ec
jmp 0x14006ad27
xor ecx, ecx
call fcn.1400685ec
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14006e19c
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140069c94
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14006e226
cmp byte [rbp - 0x21], r15b
je 0x14006e221
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14006e25c
call fcn.14006c2b4
test eax, eax
jne 0x14006e248
cmp byte [rbp - 0x21], r15b
je 0x14006e240
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14006e25c
cmp byte [rbp - 0x21], r15b
je 0x14006e259
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140069270
test eax, eax
jne 0x14006e2fc
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140069c94
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14006e29b
cmp byte [rbp - 0x21], r15b
je 0x14006e2d0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14006e2d0
call fcn.14006c2b4
test eax, eax
jne 0x14006e2bc
cmp byte [rbp - 0x21], r15b
je 0x14006e2b5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14006e2d0
cmp byte [rbp - 0x21], r15b
je 0x14006e2cd
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140069270
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14006e2fc
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14006e2ff
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14006e30d
mov rcx, rdi
call fcn.1400685ec
cmp byte [rbp + 0x3f], r15b
je 0x14006e31c
mov rcx, qword [rbp + 0x27]
call fcn.1400685ec
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400030bf
Capabilities:
Parse pe header
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x14000f140]
xor rax, rsp
mov qword [rbp + 0xb0], rax
xor ebx, ebx
mov qword [rbp - 0x80], rcx
xorps xmm0, xmm0
mov dword [rsp + 0x28], 0x860
lea r9, [rsp + 0x60]
mov dword [rsp + 0x70], 0x30
lea r8, [rsp + 0x70]
mov qword [rsp + 0x78], rbx
lea edx, [rbx + 1]
mov dword [rbp - 0x78], 0x240
lea rcx, [rsp + 0x58]
mov dword [rsp + 0x20], 1
movdqu xmmword [rbp - 0x70], xmm0
call qword [sym.imp.ntoskrnl.exe_ZwOpenFile]
test eax, eax
jns 0x1400030ab
xor eax, eax
jmp 0x140003195
mov rcx, qword [rsp + 0x58]
xor eax, eax
mov qword [rsp + 0x50], rax
xor r9d, r9d
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
xor r8d, r8d
lea rax, [rbp - 0x60]
mov dword [rsp + 0x30], 0x40
mov qword [rsp + 0x28], rax
xor edx, edx
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
js 0x140003188
mov eax, 0x5a4d
cmp ax, word [rbp - 0x60]
jne 0x140003188
movsxd rax, dword [rbp - 0x24]
xor r9d, r9d
mov rcx, qword [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x50], rax
xor edx, edx
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x60]
mov dword [rsp + 0x30], 0x108
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
js 0x140003188
cmp dword [rbp - 0x60], 0x4550
jne 0x140003188
mov eax, 0x10b
cmp ax, word [rbp - 0x48]
jne 0x14000316e
cmp dword [rbp + 0x38], ebx
je 0x140003188
cmp dword [rbp + 0x3c], ebx
jmp 0x140003181
mov eax, 0x20b
cmp ax, word [rbp - 0x48]
jne 0x140003188
cmp dword [rbp + 0x48], ebx
je 0x140003188
cmp dword [rbp + 0x4c], ebx
je 0x140003188
mov ebx, 1
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, ebx
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.14000b650
mov rbx, qword [rsp + 0x1d8]
add rsp, 0x1c0
pop rbp
ret
Function at 0x1400087e9
Capabilities:
Attach user process memory
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x14000f140]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x40], rcx
xor edi, edi
mov qword [r11 - 0x80], rdi
test rcx, rcx
je 0x140008812
lea rdx, [r11 - 0x60]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
xor edx, edx
test rbx, rbx
je 0x140008952
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x140008952
movsxd rax, dword [rbx + 0x3c]
cmp dword [rax + rbx], 0x4550
jne 0x140008952
mov ecx, 0x20b
cmp word [rax + rbx + 0x18], cx
jne 0x140008859
mov r12d, dword [rax + rbx + 0x8c]
mov ecx, dword [rax + rbx + 0x88]
jmp 0x140008862
mov r12d, dword [rax + rbx + 0x7c]
mov ecx, dword [rax + rbx + 0x78]
mov r9d, ecx
add r9, rbx
mov r11d, dword [r9 + 0x24]
add r11, rbx
mov qword [rsp + 0x38], r11
mov eax, dword [r9 + 0x20]
add rax, rbx
mov qword [rsp + 0x30], rax
mov r13d, dword [r9 + 0x1c]
add r13, rbx
xor r10d, r10d
xor r15d, r15d
xor ecx, ecx
mov dword [rsp + 0x20], r10d
cmp r15d, dword [r9 + 0x14]
jae 0x14000893e
xor r8d, r8d
cmp r14, 0xffff
jbe 0x1400088d3
cmp r15d, dword [r9 + 0x18]
jae 0x14000893c
mov eax, r15d
mov r8, qword [rsp + 0x30]
mov r8d, dword [r8 + rax*4]
add r8, rbx
mov eax, ecx
movzx r10d, word [r11 + rax*2]
cmp r14, 0xffff
ja 0x1400088ec
movzx ecx, r10w
add ecx, dword [r9 + 0x10]
movzx eax, r14w
cmp eax, ecx
je 0x14000890a
cmp r14, 0xffff
jbe 0x14000892d
mov r11, r14
sub r11, r8
movzx eax, byte [r8]
movzx ecx, byte [r8 + r11]
sub eax, ecx
jne 0x140008906
inc r8
test ecx, ecx
jne 0x1400088f2
test eax, eax
jne 0x140008928
movzx eax, r10w
mov edx, dword [r13 + rax*4]
add rdx, rbx
cmp rdx, r9
jb 0x14000893e
mov eax, r12d
add rax, r9
cmp rdx, rax
ja 0x14000893e
jmp 0x140008952
mov r11, qword [rsp + 0x38]
lea r10d, [r15 + 1]
mov r15d, r10d
mov ecx, r10d
jmp 0x14000888f
jmp 0x140008952
mov rdi, rdx
mov qword [rsp + 0x28], rdx
jmp 0x140008952
test rsi, rsi
je 0x140008962
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rax, rdi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14000b650
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000940c
Capabilities:
Attach user process memory

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x14000f140]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, rdx
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x220
call fcn.14000bbc0
xor edi, edi
call qword [sym.imp.ntoskrnl.exe_IoGetCurrentProcess]
cmp rbx, rax
je 0x140009468
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov edi, 1
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x60]
mov r9d, 0x220
mov edx, 0x2b
or rcx, 0xffffffffffffffff
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
mov ebx, eax
test eax, eax
js 0x14000949c
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
test edi, edi
je 0x1400094ab
lea rcx, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, ebx
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14000b650
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400094d4
Capabilities:
Find process by pid

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1400094f9
mov rcx, qword [rsp + 0x40]
mov rdx, rbx
call fcn.14000940c
add rsp, 0x20
pop rbx
ret
Function at 0x140026040
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x14002615b
xchg rbx, rsi
mov qword [rsp + 0x10], rsi
xchg rsi, rbx
xchg r11, rbp
mov qword [rsp + 0x18], r11
xchg rbp, r11
nop
mov qword [rsp - 8], rsi
sub rsp, 8
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
xchg rcx, rdx
mov rbx, rcx
xchg rcx, rdx
mov rdi, rcx
mov esi, r8d
sub rdi, rdx
xchg rbp, r14
mov r14, rcx
xchg rbp, r14
sub rdi, 0xffffffffffffff10
dec rsi
shr rsi, 3
shr rsi, 1
inc rsi
nop dword [rax]
xchg r8, rbx
movups xmm0, xmmword [r8]
xchg r8, rbx
xchg rcx, rbp
mov rdx, rcx
xchg rcx, rbp
xchg rcx, r10
mov r10, rbx
xchg r10, rcx
call fcn.1400267d0
mov ecx, 0x15ef6b83
add ecx, 0x23e2fad2
xor ecx, 0x719da28b
add ecx, 0x1366dbdd
sub ecx, 0x2824e595
xor ecx, 0x3e78de1f
sub ecx, 0xde96529
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rbx]
xor byte [rbx], al
inc rbx
sub rcx, 1
jne 0x1400260fb
neg rdi
sub rdi, 0xfffffffffffffff0
neg rdi
movups xmmword [rbp + 0xf0], xmm0
sub rsi, 1
jne 0x1400260a4
xchg rdi, r8
mov r8, qword [rsp + 0x30]
xchg rdi, r8
xchg rbx, r13
mov r13, qword [rsp + 0x38]
xchg r13, rbx
xchg rbp, rcx
mov rcx, qword [rsp + 0x40]
xchg rbp, rcx
add rsp, 0x20
push rcx
push rax
xchg qword [rsp + 0x10], rsi
pop rax
pop rcx
add rsp, 8
ret

Function at 0x140026160
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
xchg rdx, rbx
mov rdx, rbx
xchg rbx, rdx
lea r9, [rcx + 0xf0]
mov rsi, rcx
test r8d, r8d
je 0x14002622d
dec rdi
shr rdi, 3
shr rdi, 1
inc rdi
nop dword [rax]
nop word [rax + rax]
xchg r15, rax
mov r15, rbx
xchg r15, rax
sub r9, rbx
mov edx, 0x5c8ce8f
xor edx, 0x24d56f1e
add edx, 0x22fdfdfa
add edx, 0x1e7899e4
xor edx, 0x110a77d4
sub edx, 0x739e4eab
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1400261df
xchg rsi, rbx
mov rdx, rbx
xchg rsi, rbx
xchg rcx, rbp
mov rbp, rbx
xchg rcx, rbp
call fcn.1400262c0
xchg r9, r14
mov r14, rbx
xchg r14, r9
nop
add rbx, 0x75d28b29
sub rbx, 0x75d28b19
sub rdi, 1
jne 0x1400261ad
movups xmm0, xmmword [r9]
mov rbx, qword [rsp + 0x30]
xchg r11, rbp
mov r11, qword [rsp + 0x38]
xchg r11, rbp
xchg r10, rsi
movups xmmword [r10 + 0xf0], xmm0
xchg r10, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140027980
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
xchg r12, rbx
mov qword [rsp + 8], r12
xchg r12, rbx
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x10
xchg rdi, rbx
mov rdi, rdx
xchg rbx, rdi
xchg r11, rcx
mov r10, r11
xchg rcx, r11
test r8b, 0xf
je 0x1400279e0
xor al, al
xchg rdi, rbx
mov rdi, qword [rsp + 0x20]
xchg rdi, rbx
add rsp, 0x10
push rdx
push rbx
push rdx
push rax
xchg qword [rsp + 0x20], rdi
pop rax
pop rdx
pop rbx
pop rdx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
xor edx, edx
test r8d, r8d
je 0x140027a7f
movdqa xmm2, xmmword [rsp]
nop
movdqu xmm1, xmmword [rdx + rbx]
test edx, edx
jne 0x140027a07
movdqu xmm2, xmmword [r10 + 0x200]
movdqa xmm0, xmm1
lea rax, [r10 + 0x1c0]
pxor xmm0, xmmword [r10 + 0x1d0]
mov ecx, 0x21d89125
add ecx, 0x596a0445
xor ecx, 0x46ac66ac
xor ecx, 0x5fe617a5
sub ecx, 0xedafa0b
sub ecx, 0x532dea4b
nop dword [rax + rax]
aesdec xmm0, xmmword [rax]
lea rax, [rax - 0x10]
sub rcx, 1
jne 0x140027a43
aesdeclast xmm0, xmmword [r10 + 0x1e0]
pxor xmm0, xmm2
movdqa xmm2, xmm1
xchg r14, rdx
movups xmmword [r14 + r9], xmm0
xchg r14, rdx
sub edx, 0xfffffff0
cmp edx, r8d
jb 0x1400279f1
xchg rbx, rcx
mov rcx, qword [rsp + 0x20]
xchg rbx, rcx
mov al, 0x49
xor al, 0x10
add al, 4
sub al, 0x56
add al, 0x3d
add al, 0x25
xor al, 0x7a
sub al, 0x12
add rsp, 0x10
push rcx
push rdx
push rax
xchg qword [rsp + 0x18], rdi
pop rax
pop rdx
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x140027ac0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbx
sub rsp, 0x10
xchg rbx, rdx
mov rdx, rbx
xchg rdx, rbx
xchg r10, rcx
mov rcx, r10
xchg rcx, r10
test r8b, 0xf
je 0x140027afa
xor al, al
add rsp, 0x10
nop
xchg qword [rsp], rbx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
xor edx, edx
test r8d, r8d
je 0x140027bbb
movdqa xmm0, xmmword [rsp]
xchg r8, rdi
mov qword [rsp + 0x20], r8
xchg rdi, r8
nop dword [rax + rax]
movdqu xmm1, xmmword [rdx + rbx]
test edx, edx
jne 0x140027b36
xchg r10, r11
movdqu xmm0, xmmword [r11 + 0x200]
xchg r10, r11
pxor xmm0, xmm1
lea rax, [r10 + 0x10]
pxor xmm0, xmmword [r10 + 0x1e0]
mov ecx, 0x66f597ef
sub ecx, 0x4ccb9cae
add ecx, 0x1325972b
add ecx, 0x2d40f309
sub ecx, 0x27259664
sub ecx, 0x81906fd
sub ecx, 0x2b51e807
nop dword [rax + rax]
aesenc xmm0, xmmword [rax]
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x140027b78
aesenclast xmm0, xmmword [r10 + 0xe0]
xchg r11, rdx
movups xmmword [r11 + r9], xmm0
xchg rdx, r11
nop
sub edx, 0x20896364
add edx, 0x20896374
cmp edx, r8d
jb 0x140027b1a
mov rdi, qword [rsp + 0x20]
mov al, 9
xor al, 0x68
sub al, 0x2f
add al, 0x4a
sub al, 0x64
sub al, 0x17
add rsp, 0x10
push rcx
push rax
xchg qword [rsp + 0x10], rbx
pop rax
pop rcx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14002ca50
Capabilities:
Access peb ldr_data
Check os version
Get number of processors

Disassembly:
xchg r12, rbx
mov qword [rsp + 0x10], r12
xchg rbx, r12
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
xchg rsi, rbp
mov rbp, rcx
xchg rbp, rsi
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 0x60]
mov r14d, dword [0x7ffe026c]
xor ebx, ebx
mov qword [rsp + 0x40], rbx
sub rcx, 0x5b1169ab
add rcx, 0x5b116a73
xchg rcx, rbx
mov qword [rsp + 0x28], rcx
xchg rbx, rcx
mov dword [rsp + 0x20], 0x45b590b2
xor dword [rsp + 0x20], 0x100ef240
add dword [rsp + 0x20], 0x58bbe61
sub dword [rsp + 0x20], 0x176b63b
xor dword [rsp + 0x20], 0x245ff1d3
sub dword [rsp + 0x20], 0x6fdb5250
add dword [rsp + 0x20], 0x1e6acd59
xor dword [rsp + 0x20], 0x2c1f15dc
lea r9, [rsp + 0x40]
lea rdx, [rbx - 1]
lea r8d, [rbx + 7]
call fcn.14002b6c0
test eax, eax
js 0x14002cb16
cmp qword [rsp + 0x40], rbx
je 0x14002cb16
lea eax, [rbx + 1]
jmp 0x14002cc6f
mov rax, qword gs:[0x60]
xchg r12, rcx
mov r12, qword [rax + 0x30]
xchg r12, rcx
cmp dword [rcx + 0x70], 2
jbe 0x14002cb65
mov eax, 0x15068d9
add eax, 0x6b6d73da
sub eax, 0x15daeb7e
xor eax, 0x4ec13058
add eax, 0x4e10e7ab
sub eax, 0x46f182f3
xor eax, 0x75fcae72
xor eax, 0x23b26c09
sub eax, 0x490de45c
jmp 0x14002cc6f
cmp dword [rcx + 0x74], ebx
jbe 0x14002cb96
mov eax, 0x23f70462
add eax, 0x4c6ec673
xor eax, 0x40a58c24
add eax, 0x3d6d1ed3
xor eax, 0x7c9c294b
xor eax, 0x20803f61
sub eax, 0x323173eb
jmp 0x14002cc6f
cmp byte [rdi + 2], bl
je 0x14002cbd1
mov eax, 0x63a8c621
sub eax, 0x320bcc5f
sub eax, 0x28ca0f8d
xor eax, 0x6ee51238
sub eax, 0x51b4eb1b
xor eax, 0x6f3fd666
sub eax, 0x41aeea08
xor eax, 0x64af6b12
xor eax, 0x5ea29b9a
jmp 0x14002cc6f
cmp r14d, 0xa
jb 0x14002cc22
mov ax, word [0x7ffe0260]
cmp word [rdi + 0x120], ax
je 0x14002cc22
mov eax, 0x38612ed3
xor eax, 0x793ac56c
add eax, 0x39179fc0
sub eax, 0x154f2231
sub eax, 0x5854b1d2
add eax, 0x1ab23e90
add eax, 0x4186753b
xor eax, 0x26065cf9
xor eax, 0x4f0e37b6
jmp 0x14002cc6f
lea rcx, [rsi + 0xb8]
mov edx, 0x67812e08
sub edx, 0x16486a2f
xor edx, 0x6f15f24d
add edx, 0x1a630aaa
sub edx, 0x3c94dc28
xor edx, 0x2c0cf354
xor edx, 0x33d443f0
add edx, 0x53c0a337
add edx, 0x41b525b0
call fcn.14002c000
jmp 0x14002cc6d
mov eax, ebx
xchg rsi, rbx
mov rsi, qword [rsp + 0x48]
xchg rsi, rbx
xchg rsi, rbx
mov rbx, qword [rsp + 0x50]
xchg rbx, rsi
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
push rcx
push rcx
push rdx
push rcx
push rcx
push rdx
push rdx
xchg qword [rsp + 0x38], r14
add rsp, 0x40
ret
Function at 0x140035820
Capabilities:
Encode data using xor

Disassembly:
xchg rcx, r13
mov qword [rsp + 8], r13
xchg r13, rcx
nop
mov qword [rsp - 8], rbx
sub rsp, 8
nop
sub rsp, 8
mov qword [rsp], rsi
push rdx
mov qword [rsp], rdi
nop
sub rsp, 8
mov qword [rsp], r12
nop
sub rsp, 8
mov qword [rsp], r13
push r14
nop
sub rsp, 8
mov qword [rsp], r15
sub rsp, 0x30
xchg rdx, r15
mov rdx, r15
xchg rdx, r15
mov r14, rcx
movabs rsi, 0xfffffff5914ee4d
xor rsi, 0x6ddbbf96
xor rsi, 0x5466c36e
xor rsi, 0x4677ab9a
add rsi, 0x3f723e28
sub rsi, 0x17649f8f
add rsi, 0x7fffffff
add rsi, 0x31142838
cmp rdx, rsi
ja 0x140035a8b
xchg r10, r12
mov r10, qword [rcx + 8]
xchg r12, r10
sub r12, qword [rcx]
sar r12, 2
sar r12, 1
sar r12, 1
mov rcx, qword [rcx + 0x10]
sub rcx, qword [r14]
sar rcx, 4
xchg rdx, r11
mov r11, rcx
xchg r11, rdx
shr rdx, 1
xchg rbp, rax
mov rbp, rsi
xchg rbp, rax
sub rax, rdx
cmp rcx, rax
ja 0x140035900
lea rsi, [rdx + rcx]
cmp rsi, r15
cmovb rsi, r15
mov qword [rsp + 0x88], rsi
xchg rdx, r11
mov r11, rsi
xchg r11, rdx
xchg rcx, rdx
mov rdx, r14
xchg rdx, rcx
call fcn.140053780
xchg r13, rax
mov rax, r13
xchg r13, rax
mov qword [rsp + 0x28], rax
mov rbx, r12
shl rbx, 2
shl rbx, 2
add rbx, rax
xchg rbx, rcx
mov qword [rsp + 0x20], rcx
xchg rbx, rcx
xchg rdi, r15
mov r15, rdi
xchg rdi, r15
sub rdi, r12
xchg rbx, r9
mov qword [rsp + 0x78], r9
xchg r9, rbx
je 0x1400359ad
nop word [rax + rax]
mov byte [rbx], 0x19
xor byte [rbx], 0x23
add byte [rbx], 0x44
xor byte [rbx], 0x60
add byte [rbx], 0x36
xor byte [rbx], 0x6c
add byte [rbx], 0x17
xor byte [rbx], 0x4f
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004ba60
nop
nop
sub rbx, 0x1b8057b6
add rbx, 0x1b8057c6
mov qword [rsp + 0x78], rbx
sub rdi, 1
jne 0x14003596b
mov r8, qword [r14 + 8]
mov rdx, r13
xchg rcx, rdx
mov rdx, qword [r14]
xchg rdx, rcx
cmp rcx, r8
je 0x140035a03
xor r9d, r9d
movzx eax, byte [rcx]
mov byte [rdx], al
xchg rbx, rax
mov rbx, qword [rcx + 8]
xchg rbx, rax
mov qword [rdx + 8], rax
mov byte [rcx], r9b
xchg r14, r9
mov qword [rcx + 8], r14
xchg r9, r14
lea rdx, [rdx + 0x10]
nop
sub rcx, 0x510746e2
add rcx, 0x510746f2
cmp rcx, r8
jne 0x1400359c9
xchg r11, rsi
mov r9, r11
xchg rsi, r11
mov r8, r15
xchg r13, rdx
mov r13, rdx
xchg rdx, r13
xchg r15, rcx
mov r15, r14
xchg rcx, r15
add rsp, 0x30
push rdx
push rcx
push rbx
push rax
push rcx
xchg qword [rsp + 0x28], r15
add rsp, 0x30
push rax
push rcx
push rcx
push rcx
push rcx
xchg qword [rsp + 0x28], r14
pop rcx
pop rcx
pop rcx
pop rcx
pop rax
add rsp, 8
push rcx
push rax
push rax
push rbx
push rax
push rcx
push rdx
push rbx
xchg qword [rsp + 0x40], r13
pop rbx
pop rdx
pop rcx
pop rax
pop rbx
pop rax
pop rax
pop rcx
add rsp, 8
nop
xchg qword [rsp], r12
add rsp, 8
push rdx
xchg qword [rsp + 8], rdi
add rsp, 0x10
nop
add rsp, 8
mov rsi, qword [rsp - 8]
nop
add rsp, 8
mov rbx, qword [rsp - 8]
jmp fcn.1400528d0
call fcn.14002f8c0
int3
Function at 0x140035b00
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r14
mov qword [rsp + 8], r14
xchg r14, rbx
push rdi
sub rsp, 0x20
xchg rdi, r14
mov r14, rdx
xchg rdi, r14
xchg rbx, rsi
mov rsi, rcx
xchg rbx, rsi
test rdx, rdx
je 0x140035b5d
nop word [rax + rax]
mov byte [rbx], 0x5b
add byte [rbx], 0
sub byte [rbx], 0x43
add byte [rbx], 4
add byte [rbx], 0x44
sub byte [rbx], 0x57
xor byte [rbx], 9
lea rcx, [rbx + 8]
xor edx, edx
call fcn.14004ba60
nop
sub rbx, 0xfffffffffffffff0
sub rdi, 1
jne 0x140035b32
xchg r12, rax
mov r12, rbx
xchg r12, rax
xchg rbx, r12
mov r12, qword [rsp + 0x30]
xchg r12, rbx
add rsp, 0x20
push rcx
push rcx
push rbx
push rcx
push rax
push rdx
push rbx
push rbx
xchg qword [rsp + 0x40], rdi
add rsp, 0x48
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x14004c230
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x17
xor byte [rcx + rax + 6], 0x14
xor byte [rcx + rax + 6], 0x53
sub byte [rcx + rax + 6], 0x21
sub byte [rcx + rax + 6], 1
xor byte [rcx + rax + 6], 0x7c
xor byte [rcx + rax + 6], 0x52
inc rax
cmp rax, 8
jb 0x14004c232
nop
add rsp, 8
jmp qword [rsp - 8]

Function at 0x14004c270
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
mov byte [rcx + rax + 6], 0x18
xor byte [rcx + rax + 6], 0x6b
xor byte [rcx + rax + 6], 0x10
xor byte [rcx + rax + 6], 0x40
sub byte [rcx + rax + 6], 0x18
add byte [rcx + rax + 6], 8
add byte [rcx + rax + 6], 0xa
sub byte [rcx + rax + 6], 0x1d
inc rax
cmp rax, 0xa
jb 0x14004c272
ret
Function at 0x14006c1b0
Capabilities:
Encode data using base64

Disassembly:
test dl, dl
je 0x14006c224
nop dword [rax]
nop dword [rax + rax]
inc qword [rcx + 0x18]
mov rax, qword [rcx]
cmp rax, qword [rcx + 8]
je 0x14006c1e7
movzx edx, byte [rax]
inc rax
xchg rsi, rax
mov qword [rcx], rsi
xchg rsi, rax
mov dword [rcx + 0x10], edx
cmp edx, 0x4e
je 0x14006c1c0
jmp fcn.140064ae0
mov edx, 0x136f3020
xor edx, 0x547138f
xor edx, 0x115ad663
add edx, 0x2d45d381
sub edx, 0x14350df0
sub edx, 0x11f1692a
sub edx, 0xa5ce33c
xor edx, 0x649e6319
xor edx, 0x9f54f211
mov dword [rcx + 0x10], edx
jmp fcn.140064ae0
mov edx, dword [rcx + 0x10]
jmp fcn.140064ae0