joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013500
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov dword [rsp - 0x2c], 0x7d9e1d0c
push rdi
push r14
push r15
xchg r8, r8
sub rsp, 0x20
mov r8, qword [rdx + 8]
lea r15, [rdx + 8]
inc r8
mov dword [rsp - 0x28], 0xe1fc29a
mov rdi, rdx
mov r14, rcx
mov eax, 0x365ae79e
mov r12, r12
sub eax, 0x24bfce19
xor eax, 0x64ca0608
sub eax, 0x71da90e1
add eax, 0x37c75c27
mov dword [rsp - 0x3c], esp
xor eax, 0xbd39203
xor eax, 0x30ee78d2
mul r8
pushf
mov r8, r8
movabs rbx, 0xffffffff5c9d9263
add rbx, 0x301d9a5
xor rbx, 0x7240679d
mov r10, r10
add rbx, 0x507d5bbb
add rbx, 0x7fffffff
add rbx, 0x1a398b0
xchg r14, r14
popf
cmovo rax, rbx
mov rcx, rax
mov dword [rsp - 0x20], 0x16b0e577
call fcn.140073cf0
mov rsi, qword [r15]
mov rbp, rax
xchg rsi, rsi
cmp rsi, 4
jbe 0x1400135c9
mov rdi, qword [rdi]
lea rcx, [rsi + 1]
mov r12, r12
mov eax, 0x42ca1479
sub eax, 0x7028eae
add eax, 0xcb10168
add eax, 0x35a9525e
xchg rdi, rdi
sub eax, 0x7e21d98f
mul rcx
cmovo rax, rbx
mov r14, r14
mov rcx, rax
call fcn.140073cf0
xor r10d, r10d
mov dword [rsp - 0x28], 0x3a71cbc
mov rbx, rax
mov r9d, r10d
test rsi, rsi
mov dword [rsp - 0x10], edx
je 0x14001367c
mov r8, rax
sub rdi, rax
nop
xchg r9, r9
movzx ecx, r9b
lea r8, [r8 + 2]
and cl, 3
mov edx, 0x7205126c
mov rdx, rdx
sub edx, 0x301f4602
add edx, 0x3b083b77
sub edx, 0x4f1ca174
add edx, 0x9af3152
xchg r12, r12
xor edx, 0x2fd3c93a
shl cl, 3
inc r9
mov dword [rsp - 0x20], 0xed3f3cc
sar edx, cl
movsx eax, dl
xor ax, word [rdi + r8 - 2]
xchg r10, r10
mov word [r8 - 2], ax
cmp r9, rsi
jb 0x140013622
mov word [rbx + rsi*2], r10w
xchg r12, r12
mov r8, rbx
mov rdx, qword [r15]
mov rcx, rbp
mov dword [rsp - 0x2c], 0x4e46daca
inc rdx
call fcn.1400745b0
mov rcx, rbx
call fcn.140073d00
mov dword [rsp - 0x34], ebx
mov rbx, qword [rsp + 0x40]
mov rax, r14
mov rsi, qword [rsp + 0x50]
mov qword [r14], rbp
mov rdi, rdi
mov rbp, qword [rsp + 0x48]
mov byte [r14 + 8], 0x7e
xor byte [r14 + 8], 0x1d
xor byte [r14 + 8], 0x41
mov dword [rsp - 0x28], 0x285ca5b7
sub byte [r14 + 8], 0x18
xor byte [r14 + 8], 0x4b
xor byte [r14 + 8], 0x5b
xchg r9, r9
sub byte [r14 + 8], 0x19
add rsp, 0x20
pop r15
mov r11, r11
pop r14
pop rdi
ret
Function at 0x14002f560
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov rax, qword [0x1400a51a0]
lea rcx, [rsp + 0x20]
xor rax, qword [0x1400a4ab0]
mov dword [rsp - 0x44], 0x68a62f2a
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call rax
mov dword [rsp - 0x14], edx
test eax, eax
je 0x14002f600
nop word [rax + rax]
mov dword [rsp - 0x10], 0x702c1cc0
mov rax, qword [0x1400a51c0]
lea rcx, [rsp + 0x20]
xor rax, qword [0x1400a4ab0]
call rax
xchg rsp, rsp
mov rax, qword [0x1400a51d0]
lea rcx, [rsp + 0x20]
xor rax, qword [0x1400a4ab0]
call rax
xchg r9, r9
mov rax, qword [0x1400a51a0]
lea rcx, [rsp + 0x20]
xor rax, qword [0x1400a4ab0]
xor r9d, r9d
xchg rbp, rbp
xor r8d, r8d
xor edx, edx
call rax
test eax, eax
mov dword [rsp - 0x14], 0x5ea005ae
jne 0x14002f5a4
add rsp, 0x58
ret
Function at 0x1400319f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov dword [rsp - 0x20], 0x59be2083
sub rsp, 0x30
mov rdi, rcx
lea rdx, [rcx + 0x30]
mov dword [rsp - 0x3c], 0x12bb65e5
lea rcx, [rsp + 0x20]
call fcn.140005a90
mov rbx, qword [rax]
mov r13, r13
mov eax, 0x2052a3a6
add eax, 0x2ead5291
xor eax, 0x498328fd
add eax, 0x1c7c65ae
mov r15, r15
add eax, 0x2f79c632
add eax, 0xac8cf555
mov dword [rsp + 0x40], eax
xchg r8, r8
cmp byte [rbx], 0
je 0x140031aa5
nop dword [rax]
xchg rsi, rsi
mov r8d, 0x50696d1
add r8d, 0x136f89ae
add r8d, 0x7334e92
mov dword [rsp - 0x30], esi
add r8d, 0x5b6cc508
xor r8d, 0x7ab20b11
sub r8d, 0x1a43f07
xchg rdi, rdi
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.14006b380
mov dword [rsp - 0x18], edx
inc rbx
cmp byte [rbx], 0
jne 0x140031a55
mov eax, dword [rsp + 0x40]
mov rcx, rcx
mov ebx, dword [rdi + 0x58]
not eax
xor ebx, 0x3355
mov dword [rsp - 0x28], ebp
shl ebx, 0x10
or ebx, dword [rdi + 0x40]
xor ebx, eax
mov rsi, rsi
cmp byte [rsp + 0x28], 0
je 0x140031ad3
mov rcx, qword [rsp + 0x20]
call fcn.140073d00
xchg r11, r11
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
mov r13, r13
ret

Function at 0x140031af0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov r14, r14
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
xchg rcx, rcx
sub rsp, 0x30
mov eax, dword [rcx + 0x50]
mov r14, rdx
mov r11, r11
mov edi, dword [rcx + 0x5c]
xor eax, 0x27223355
movaps xmmword [rsp + 0x20], xmm6
mov dword [rsp - 0x3c], 0x59b7c084
mov rbp, rcx
xor ebx, ebx
xor edi, 0x27223355
mov dword [rsp - 0x14], 0x186bdad9
xor edx, edx
mov rcx, r14
movd xmm6, eax
mov dword [rsp - 0x3c], esp
add edi, edi
cvtdq2ps xmm6, xmm6
mov esi, ebx
mov dword [rsp - 0x44], esi
call fcn.14006b310
test ax, ax
je 0x140031bc8
xchg rbx, rbx
nop dword [rax]
nop word [rax + rax]
movzx ecx, ax
inc rsi
mov dword [rsp - 0x34], 0xdb0880d
mov rax, qword [rbp + 0x60]
add rcx, rcx
mov rdx, rsi
mov dword [rsp - 0x24], edi
movups xmm1, xmmword [rax + rcx*8]
xorps xmm1, xmmword [0x1400a9f70]
movaps xmm0, xmm1
xchg rbx, rbx
shufps xmm0, xmm1, 0xaa
subss xmm0, xmm1
mulss xmm0, xmm6
cvttss2si ecx, xmm0
mov rdi, rdi
sub ecx, edi
add ebx, ecx
mov rcx, r14
call fcn.14006b310
xchg rdx, rdx
test ax, ax
jne 0x140031b74
mov rbp, qword [rsp + 0x48]
mov eax, ebx
xchg r9, r9
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
xchg rcx, rcx
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop r14
ret
Function at 0x140031db0
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rcx + 0x50]
xor r8d, r8d
mov r9d, dword [rcx + 0x5c]
xor eax, 0x27223355
mov rsi, rsi
xor r9d, 0x27223355
add r9d, r9d
movd xmm3, eax
movzx eax, word [rdx]
mov dword [rsp - 0x44], esi
cvtdq2ps xmm3, xmm3
test ax, ax
je 0x140031e47
mov rdi, rdi
mov r10, qword [rcx + 0x60]
movaps xmm2, xmmword [0x1400a9f70]
nop dword [rax]
nop word [rax + rax]
xchg r15, r15
movzx eax, ax
add rdx, 2
add rax, rax
mov r13, r13
movups xmm1, xmmword [r10 + rax*8]
movzx eax, word [rdx]
xorps xmm1, xmm2
movaps xmm0, xmm1
mov dword [rsp - 0x3c], ebp
shufps xmm0, xmm1, 0xaa
subss xmm0, xmm1
mulss xmm0, xmm3
mov dword [rsp - 0x18], 0x75c2d04a
cvttss2si ecx, xmm0
sub ecx, r9d
add r8d, ecx
mov dword [rsp - 0x38], 0x33b43473
test ax, ax
jne 0x140031dfd
mov eax, r8d
mov r13, r13
ret
Function at 0x14003ee10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp - 0x10], 0x1f0cac1d
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
mov dword [rsp - 0x30], 0x716ced55
push r14
push r15
sub rsp, 0x20
lea r14, [rcx + 0x128]
mov dword [rsp - 0x40], ecx
mov r15, rdx
mov rbp, qword [r14 + 8]
mov rsi, rcx
mov r8, r8
cmp rbp, 4
jbe 0x14003ee5f
mov r14, qword [r14]
lea rcx, [rbp + 1]
mov r10, r10
mov eax, 0x35b0885a
add eax, 0x130a46b1
sub eax, 0xd8f5414
xor eax, 0x3edfd710
mov rbp, rbp
xor eax, 0x5f4ade5
mul rcx
pushf
movabs r12, 0xffffffff6da98ae0
mov dword [rsp - 0x34], 0x45a4c658
sub r12, 0x5e16b3b7
xor r12, 0x24111704
add r12, 0x4b45e61d
add r12, 0x7fffffff
xchg r15, r15
add r12, 0x93659b6
popf
cmovo rax, r12
mov rbp, rbp
mov rcx, rax
call fcn.140073cf0
xor edi, edi
mov rbx, rax
mov rdx, rdx
mov r9d, edi
test rbp, rbp
je 0x14003ef4d
mov r8, rax
xchg r11, r11
sub r14, rax
nop word [rax + rax]
movzx ecx, r9b
lea r8, [r8 + 2]
mov dword [rsp - 0x2c], esp
and cl, 3
mov edx, 0x638ae6bc
sub edx, 0x32b0d42c
sub edx, 0x30cf966c
xchg rdx, rdx
add edx, 0x4ab7205f
sub edx, 0x16a6a3bd
xor edx, 0x2c49a643
shl cl, 3
xchg rdx, rdx
inc r9
sar edx, cl
movsx eax, dl
xor ax, word [r14 + r8 - 2]
mov dword [rsp - 0x18], 0x18d7867e
mov word [r8 - 2], ax
cmp r9, rbp
jb 0x14003eeef
mov r12, r12
mov word [rbx + rbp*2], di
cmp word [rsi + 0x150], di
je 0x14003ef94
mov rcx, rdi
mov dword [rsp - 0x44], ebp
cmp qword [rsi + 0x130], rcx
jbe 0x14003ef94
nop dword [rax]
nop dword [rax + rax]
xchg r14, r14
movzx eax, word [rsi + 0x150]
mov word [rbx + rcx*2], ax
inc rcx
cmp rcx, qword [rsi + 0x130]
mov dword [rsp - 0x2c], esp
jb 0x14003ef79
mov qword [r15], rdi
mov rcx, r12
mov dword [rsp - 0x1c], edx
nop dword [rax]
inc rcx
cmp word [rbx + rcx*2], di
jne 0x14003efa1
mov dword [rsp - 0x3c], 0x5d24dd73
mov qword [r15 + 8], rcx
mov r8, r15
cmp rcx, 4
xchg r10, r10
jbe 0x14003f008
mov eax, 0x2b824742
xor eax, 0x689c04
add eax, 0x7bb7d2e
xchg r13, r13
sub eax, 0x3931a36
add eax, 0x466cb7ea
sub eax, 0x321b86cf
sub eax, 0x44646f57
mov dword [rsp - 0x1c], 0x558eba87
mul rcx
cmovo rax, r12
mov rcx, rax
call fcn.140073cf0
mov rbx, rbx
mov r8, rax
mov qword [r15], rax
cmp qword [r15 + 8], rdi
jbe 0x14003f086
mov dword [rsp - 0x40], 0x56b35dd6
mov r9, rbx
sub r9, r8
nop dword [rax]
mov r13, r13
movzx ecx, dil
lea r8, [r8 + 2]
and cl, 3
mov dword [rsp - 0x44], esi
mov edx, 0x334c5a35
sub edx, 0x2d622872
add edx, 0x2af0bc6f
xor edx, 0x9547c28
mov dword [rsp - 0x24], 0x2c199c07
xor edx, 0x21ddcc9f
shl cl, 3
inc rdi
mov dword [rsp - 0x28], 0xb62ce6
sar edx, cl
movsx eax, dl
xor ax, word [r9 + r8 - 2]
mov dword [rsp - 0x28], 0x90448ad
mov word [r8 - 2], ax
cmp rdi, qword [r15 + 8]
jb 0x14003f023
mov r14, r14
mov rcx, rbx
call fcn.140073d00
mov rbx, qword [rsp + 0x40]
mov rax, r15
mov dword [rsp - 0xc], esp
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
xchg r9, r9
pop r15
pop r14
pop r12
mov dword [rsp - 0x44], 0x54e29797
ret
Function at 0x14005edc0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov rsp, rsp
push r14
sub rsp, 0x20
movsxd rbx, dword [rcx + 0x3c]
xchg rdx, rdx
mov rdi, rdx
mov rsi, rcx
mov edx, dword [rbx + rcx + 0xb0]
mov dword [rsp - 0x40], 0x5d727bd8
call fcn.140060150
sub rdi, qword [rbx + rsi + 0x30]
xor r14d, r14d
mov ebp, dword [rbx + rsi + 0xb4]
xchg rsp, rsp
mov r10, rax
mov ebx, r14d
test ebp, ebp
je 0x14005ef24
mov r13, r13
nop dword [rax]
movsxd rcx, dword [rsi + 0x3c]
lea rdx, [rsi + 0x18]
mov rsp, rsp
mov r11d, dword [r10]
add rdx, rcx
movzx r8d, r14w
mov dword [rsp - 0x18], esi
movzx eax, word [rcx + rsi + 0x14]
movzx ecx, word [rcx + rsi + 6]
add rdx, rax
cmp r14w, cx
xchg rsi, rsi
jae 0x14005ee87
mov eax, dword [rdx + 8]
test eax, eax
jne 0x14005ee61
mov dword [rsp - 0x30], ecx
mov eax, dword [rdx + 0x10]
mov r9d, dword [rdx + 0xc]
cmp r11d, r9d
jb 0x14005ee76
mov dword [rsp - 0x38], esp
add eax, r9d
cmp r11d, eax
jb 0x14005eee8
inc r8w
mov rbx, rbx
add rdx, 0x28
cmp r8w, cx
jb 0x14005ee53
mov r8, r14
xchg rbp, rbp
mov eax, dword [r10 + 4]
lea r9, [r10 + 4]
sub rax, 8
mov dword [rsp - 0x14], 0x67cae580
add r10, 8
shr rax, 1
test eax, eax
xchg r9, r9
je 0x14005ef15
mov edx, eax
nop word [rax + rax]
movzx eax, word [r10]
mov r13, r13
mov ecx, eax
shr ecx, 0xc
cmp ecx, 3
mov dword [rsp - 0x40], 0x70e67df9
je 0x14005eeff
cmp ecx, 0xa
jne 0x14005ef08
and eax, 0xfff
mov dword [rsp - 0x20], 0x7caf8d3b
add qword [rax + r8], rdi
jmp 0x14005ef08
mov r8d, dword [rdx + 0x14]
sub r8, r9
mov dword [rsp - 0xc], 0x397bbd91
add r8, rsi
add r8, r11
jmp 0x14005ee8d
and eax, 0xfff
add dword [rax + r8], edi
add r10, 2
sub rdx, 1
xchg r14, r14
jne 0x14005eeb7
add ebx, dword [r9]
cmp ebx, ebp
jb 0x14005ee24
mov dword [rsp - 0x30], ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r8, r8
add rsp, 0x20
pop r14
ret

Function at 0x140060150
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
movsxd r8, dword [rcx + 0x3c]
xor r9d, r9d
add r8, rcx
mov dword [rsp - 0x30], 0x1d9795ec
mov r10d, edx
mov rbx, rcx
movzx eax, word [r8 + 0x14]
mov dword [rsp - 0x28], edx
movzx r11d, word [r8 + 6]
add rax, 0x18
add rax, r8
mov r14, r14
cmp r9w, r11w
jae 0x1400601c7
nop dword [rax]
mov rdi, rdi
mov ecx, dword [rax + 8]
test ecx, ecx
jne 0x1400601a0
mov dword [rsp - 0x3c], esi
mov ecx, dword [rax + 0x10]
mov edx, dword [rax + 0xc]
cmp r10d, edx
xchg rdx, rdx
jb 0x1400601b5
add ecx, edx
cmp r10d, ecx
mov r11, r11
jb 0x1400601d2
inc r9w
add rax, 0x28
cmp r9w, r11w
mov dword [rsp - 0x24], edx
jb 0x140060192
xor eax, eax
mov rbx, qword [rsp + 8]
mov rbx, rbx
ret
mov eax, dword [rax + 0x14]
sub rax, rdx
add rax, rbx
mov rbx, qword [rsp + 8]
mov dword [rsp - 0x40], 0xef6b27c
add rax, r10
ret
Function at 0x1400601f0
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rcx, rcx
push rsi
push rdi
push r12
mov dword [rsp - 0x18], 0x329e8d3b
push r13
push r14
push r15
xchg rsp, rsp
sub rsp, 0x20
movzx eax, word [rcx]
mov r15d, edx
xor eax, 0x463463e0
xchg rdi, rdi
mov rsi, rcx
cmp eax, 0x463439ad
jne 0x140060376
mov rbp, rbp
movsxd rdx, dword [rcx + 0x3c]
mov eax, dword [rdx + rcx]
xor eax, 0x463463e0
mov rsi, rsi
cmp eax, 0x463426b0
jne 0x140060376
mov edx, dword [rdx + rcx + 0x88]
call fcn.140060150
mov dword [rsp - 0xc], 0x1f4b3a77
mov rcx, rsi
mov r14, rax
mov edx, dword [rax + 0x20]
mov r15, r15
call fcn.140060150
mov edx, dword [r14 + 0x24]
mov rcx, rsi
mov r12, rax
mov dword [rsp - 0x38], 0x300e4d66
call fcn.140060150
mov edx, dword [r14 + 0x1c]
mov rcx, rsi
mov dword [rsp - 0xc], 0x9257fe1
mov r13, rax
call fcn.140060150
xor edi, edi
mov dword [rsp - 0x1c], esp
mov qword [rsp + 0x70], rax
cmp dword [r14 + 0x18], edi
jbe 0x140060376
nop dword [rax]
mov rbp, rbp
mov edx, dword [r12 + rdi*4]
mov rcx, rsi
call fcn.140060150
mov ecx, 0x1c337abb
xchg r9, r9
add ecx, 0xd87b97a
add ecx, 0x3f391dce
sub ecx, 0x155243d3
add ecx, 0xac5df1cf
mov dword [rsp - 0x14], 0x426087d7
mov rbx, rax
mov dword [rsp + 0x60], ecx
cmp byte [rax], 0
mov dword [rsp - 0x24], 0x423f79e4
je 0x140060360
nop dword [rax]
mov r8d, 0x6604760a
sub r8d, 0x1d9e491
xchg rbx, rbx
xor r8d, 0x39e588a8
sub r8d, 0x2b3186c9
add r8d, 0xbad4cd2
xchg rsi, rsi
xor r8d, 0x4f419fa1
sub r8d, 0x710b407a
lea rcx, [rsp + 0x60]
xchg r11, r11
mov rdx, rbx
call fcn.14006b380
inc rbx
xchg r14, r14
cmp byte [rbx], 0
jne 0x140060308
mov ecx, dword [rsp + 0x60]
mov r9, r9
not ecx
cmp ecx, r15d
je 0x140060397
mov rdx, rdx
inc edi
cmp edi, dword [r14 + 0x18]
jb 0x1400602bd
xor eax, eax
xchg rbp, rbp
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
mov r12, r12
pop r14
pop r13
pop r12
mov dword [rsp - 0xc], edi
pop rdi
pop rsi
pop rbp
ret
movzx edx, word [r13 + rdi*2]
mov rcx, rsi
mov rbx, rbx
mov rax, qword [rsp + 0x70]
mov edx, dword [rax + rdx*4]
call fcn.140060150
xchg r9, r9
jmp 0x14006037b
Function at 0x140060a10
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x240
mov rbx, rcx
mov dword [rsp - 0x24], esi
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x1b02f396
xchg r8, r8
xor r8d, 0x354987bc
add r8d, 0x23304e0a
add r8d, 0x1df1245b
sub r8d, 0x3d4ac1cd
mov dword [rsp - 0x3c], esp
xor r8d, 0x322226ca
call fcn.140074120
mov rax, qword gs:[0x60]
mov rdx, qword [rax + 0x18]
mov rcx, rcx
mov rax, qword [rdx + 0x10]
mov r8, qword [rax]
test r8, r8
je 0x140060bc2
mov dword [rsp - 0x40], edx
mov r8, qword [r8 + 0x50]
test r8, r8
je 0x140060bc2
mov edx, 0x609f09c4
mov dword [rsp - 0x38], edx
add edx, 0x1cad1993
xor edx, 0x5c0c5958
sub edx, 0x12c9d124
mov dword [rsp - 0x34], ebp
xor edx, 0xe76a9ef
lea rcx, [rsp + 0x30]
lea r9d, [rdx - 1]
call fcn.140074660
mov rsi, rsi
mov edx, 0x1d0f6938
add edx, 0x5d27009a
sub edx, 0xccfa44a
mov r14, r14
sub edx, 0x6022ecff
sub edx, 0xd43d82d
lea rcx, [rsp + 0x30]
mov dword [rsp - 0x10], ebp
call fcn.140074740
test rax, rax
je 0x140060bc2
mov r15, r15
mov qword [rsp + 0x250], rdi
lea rcx, [rsp + 0x20]
xor edi, edi
mov r13, r13
mov rdx, rbx
mov word [rax], di
mov rax, qword [0x1400a4af0]
xor rax, qword [0x1400a4ab0]
mov dword [rsp - 0x3c], esp
call rax
mov rax, qword [0x1400a4ad0]
lea r9, [rsp + 0x260]
mov dword [rsp - 0x24], 0x47147b37
xor rax, qword [0x1400a4ab0]
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x258]
mov dword [rsp - 0x2c], 0x2aab9961
mov qword [rsp + 0x260], rdi
lea rcx, [rsp + 0x30]
call rax
mov dword [rsp - 0x34], 0x7bf6ccbd
mov rdi, qword [rsp + 0x250]
test eax, eax
jns 0x140060bb1
mov dword [rsp - 0x20], esi
mov rdx, qword [0x1400a4b70]
mov ecx, eax
xor rdx, qword [0x1400a4ab0]
call rdx
mov dword [rsp - 0x1c], ebp
mov rdx, qword [0x1400a4e50]
mov ecx, eax
xor rdx, qword [0x1400a4ab0]
call rdx
mov r8, r8
mov rax, qword [rsp + 0x260]
add rsp, 0x240
pop rbx
ret
xor eax, eax
add rsp, 0x240
mov dword [rsp - 0x3c], ebp
pop rbx
ret

Function at 0x140060c90
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x20
mov dword [rsp - 0xc], 0x55cd6dc9
mov rdi, qword [0x1400a4a98]
test rdi, rdi
je 0x140060d6e
xchg rsp, rsp
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x30], rbx
test rcx, rcx
je 0x140060d0e
xchg r9, r9
mov rbx, qword [rdi]
mov qword [rsp + 0x38], rsi
lea rsi, [rbx + rcx*8]
cmp rbx, rsi
mov dword [rsp - 0x28], 0x6bb2e6a4
je 0x140060d06
mov rax, qword [0x1400a4ae0]
xor rax, qword [0x1400a4ab0]
mov rcx, qword [rbx]
mov dword [rsp - 0x38], edx
call rax
add rbx, 8
cmp rbx, rsi
mov dword [rsp - 0x10], ecx
jne 0x140060cdb
mov rdi, qword [0x1400a4a98]
mov rsi, qword [rsp + 0x38]
xchg r14, r14
xor ebx, ebx
test rdi, rdi
je 0x140060d5e
mov dword [rsp - 0x44], esp
mov rcx, qword [rdi]
test rcx, rcx
je 0x140060d31
mov dword [rsp - 0x1c], 0x5e6160fb
call fcn.140073d00
mov qword [rdi], rbx
mov edx, 0x2511cadd
add edx, 0x4507a133
mov dword [rsp - 0x40], ebp
sub edx, 0x35eb9525
add edx, 0x2d90c429
xor edx, 0x61be9b34
mov dword [rsp - 0x1c], ebx
mov rcx, rdi
call fcn.140073d00
mov qword [0x1400a4a98], rbx
mov rbx, qword [rsp + 0x30]
mov dword [rsp - 0x34], ebx
add rsp, 0x20
pop rdi
ret
Function at 0x140062ef0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x20
mov ebx, dword [rsp + 0x80]
mov r12, r8
mov rdi, qword [rsp + 0x70]
mov r15, rdx
mov ebp, r9d
mov r14, rcx
test ebx, ebx
jne 0x140062f4b
cmp byte [rcx + 9], 0
mov ebx, 5
jne 0x140062f4b
cmp rdx, rdi
mov r10, rdx
mov rax, rdi
cmovb rax, rdx
cmovb r10, rdi
sub r10, rax
mov eax, 0xe
cmp r10, 0x7ffff000
cmova ebx, eax
cmp byte [rcx + 9], 0
mov qword [rsp + 0x50], rsi
jne 0x140062fb1
cmp ebx, 5
je 0x140062f91
mov eax, ebx
cmp ebx, 0xe
jne 0x1400630c1
lea ecx, [rbp + 1]
mov byte [rbp + r8], 0xff
mov byte [rcx + r8], 0x25
xor esi, esi
lea ecx, [rbp + 2]
mov dword [rcx + r8], esi
lea ecx, [rbp + 6]
mov r8d, dword [rsp + 0x78]
add r8, rdi
mov qword [rcx + r12], r8
jmp 0x1400630c1
mov edx, dword [rsp + 0x78]
lea eax, [rbp + 1]
sub edi, r15d
mov byte [rbp + r8], 0xe9
sub edi, ebp
add edx, 0xfffffffb
add edx, edi
mov dword [rax + r8], edx
jmp 0x1400630bf
mov rax, qword [rcx]
mov qword [rsp + 0x58], r13
call qword [rax + 0x30]
mov ecx, 0x5a4d
xor esi, esi
cmp word [rax], cx
jne 0x140062fd7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140062fda
mov rcx, rsi
movzx eax, word [rcx + 0x14]
lea rdx, [rcx + 0x18]
movzx r10d, word [rcx + 6]
lea r9d, [r15 + rbp]
add rdx, rax
movzx r8d, si
cmp si, r10w
jae 0x14006301b
test r9d, r9d
je 0x14006300d
mov ecx, dword [rdx + 0x14]
cmp r9d, ecx
jb 0x14006300d
add ecx, dword [rdx + 0x10]
cmp r9d, ecx
jb 0x14006301e
inc r8w
add rdx, 0x28
cmp r8w, r10w
jb 0x140062ff8
mov rdx, rsi
mov r13d, dword [rdx + 0xc]
mov rcx, r14
sub r13d, dword [rdx + 0x14]
mov rax, qword [r14]
add r13d, r15d
add r13d, ebp
call qword [rax + 0x30]
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006304e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140063051
mov rcx, rsi
mov r11d, dword [rsp + 0x78]
lea rdx, [rcx + 0x18]
movzx eax, word [rcx + 0x14]
movzx r8d, si
movzx r10d, word [rcx + 6]
add rdx, rax
lea r9d, [rdi + r11]
cmp si, r10w
jae 0x140063097
test r9d, r9d
je 0x140063089
mov ecx, dword [rdx + 0x14]
cmp r9d, ecx
jb 0x140063089
add ecx, dword [rdx + 0x10]
cmp r9d, ecx
jb 0x14006309a
inc r8w
add rdx, 0x28
cmp r8w, r10w
jb 0x140063074
mov rdx, rsi
mov eax, dword [rdx + 0x14]
mov edx, dword [rdx + 0xc]
sub edx, eax
mov byte [rbp + r12], 0xe9
add edx, edi
lea eax, [rbp + 1]
add edx, r11d
sub edx, r13d
mov r13, qword [rsp + 0x58]
sub edx, 5
mov dword [rax + r12], edx
mov eax, ebx
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x14006a0a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xchg r15, r15
cmp qword [rcx + 8], 4
mov rdi, rdx
mov rbx, rcx
jbe 0x14006a0c5
mov rsp, rsp
mov rcx, qword [rcx]
call fcn.140073d00
nop
movabs r9, 0xffffffff3458ded5
mov dword [rsp - 0x38], ebx
add r9, 0x232d5e68
sub r9, 0x23b2c537
xor r9, 0x85be660
add r9, 0x1bf8cb7a
mov dword [rsp - 0x2c], esp
add r9, 0x7fffffff
xor r9, 0x287e9620
mov rcx, r9
nop dword [rax]
xchg rsp, rsp
inc rcx
cmp word [rdi + rcx*2], 0
jne 0x14006a10f
mov rbx, rbx
mov qword [rbx + 8], rcx
mov r8, rbx
cmp rcx, 4
jbe 0x14006a172
mov r14, r14
inc rcx
mov eax, 0xdbfa13b
xor eax, 0x25336fda
sub eax, 0xf1b5fb8
mov dword [rsp - 0xc], edi
xor eax, 0x5061d436
xor eax, 0x15a1fac7
sub eax, 0x5cb141d6
mov dword [rsp - 0x20], 0x15aaa11e
mul rcx
cmovo rax, r9
mov rcx, rax
call fcn.140073cf0
mov dword [rsp - 0x38], ebx
mov r8, rax
mov qword [rbx], rax
xor r9d, r9d
cmp qword [rbx + 8], r9
xchg r11, r11
jbe 0x14006a1e9
sub rdi, r8
movzx ecx, r9b
mov dword [rsp - 0xc], esp
lea r8, [r8 + 2]
and cl, 3
mov edx, 0x34bea132
mov dword [rsp - 0x40], 0x6429fc97
sub edx, 0xf4a3879
xor edx, 0x804bc21
add edx, 0x30fb89eb
sub edx, 0x2eb74c2f
mov dword [rsp - 0x20], 0x405b9381
sub edx, 0x1761b3cf
shl cl, 3
inc r9
mov dword [rsp - 0x24], edi
sar edx, cl
movsx eax, dl
xor ax, word [rdi + r8 - 2]
mov r9, r9
mov word [r8 - 2], ax
cmp r9, qword [rbx + 8]
jb 0x14006a181
xchg rbp, rbp
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
mov dword [rsp - 0x1c], ebp
ret