joyce8/EMBER2024-capa huggingface dataset:
Function at 0x201c1790
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov eax, edx
and eax, 0xf
cmp eax, 3
jbe 0x201c17be
cmp eax, 5
ja 0x201c17d3
mov edx, 0xd98e0137
mov r10, rcx
cmp eax, 4
jne 0x201c1821
ud2
cmp eax, 1
ja 0x201c17f5
test eax, eax
je 0x201c183e
mov eax, 2
mov edx, 0xd9e674c2
jmp 0x201c1801
cmp eax, 6
jne 0x201c181b
mov rsi, qword [rcx + 8]
test rsi, rsi
sete bl
movzx eax, byte [0x20525182]
cmp al, 0x13
je 0x201c186b
mov r10, r9
jmp 0x201c18dd
mov r10, rcx
mov rcx, r8
mov r8, r9
mov r9, r10
mov r10, r8
mov r8, rcx
cmp eax, 3
jne 0x201c182b
lea rax, [0x2041ad88]
mov qword [rcx], rax
jmp 0x201c19df
mov r10, r9
mov r9, rcx
mov qword [rsp + 0x20], r10
cmp r10, r9
jae 0x201c1837
xor ecx, ecx
test dl, 0x40
je 0x201c187e
jmp 0x201c198a
xor edi, edi
jmp 0x201c1992
mov rcx, r9
mov rdx, r8
call fcn.203c93a0
jmp 0x201c18ed
xor edi, edi
mov r14, rsi
cmp al, 0x13
je 0x201c186b
test edx, 0x100
jne 0x201c19b9
inc rcx
jmp 0x201c1985
lea rcx, [0x20525170]
test bl, 1
cmove rcx, rsi
jmp 0x201c19df
cmp rcx, r8
jae 0x201c189f
movzx eax, byte [r9 + rcx]
mov byte [r10 + rcx], al
inc rcx
xor esi, esi
xor edi, edi
mov ebx, edi
test edx, 0x2000
je 0x201c187e
jmp 0x201c186b
test edx, 0x200
jne 0x201c18ed
jmp 0x201c19d2
lea rsi, [rsp + 0x20]
mov r11, r8
test edx, 0x400
jne 0x201c191e
test r11, r11
je 0x201c18d9
test edx, 0x800
jne 0x201c18ed
movzx eax, byte [r9 + r11 - 1]
mov byte [r10 + r11 - 1], al
jmp 0x201c19ca
xor esi, esi
xor ebx, ebx
xor r11d, r11d
test edx, 0x4000
jne 0x201c18f4
jmp 0x201c19da
xor ecx, ecx
jmp 0x201c19df
mov dil, 0xe6
mov al, 6
lock cmpxchg byte [0x20525182], dil
jne 0x201c19c1
test edx, 0x10000
je 0x201c18bc
test edx, 0x1000
je 0x201c1a00
mov edi, ebx
mov eax, 0xf
lea rbx, [0x20525170]
lea r14, [0x2041b330]
nop word cs:[rax + rax]
mov r15d, eax
not r15d
lea r12d, [rax - 1]
and r12d, 0xe
xor r12, 0xf
movzx ebp, byte [rax + rbx - 0xf]
movzx r13d, byte [rax + rbx - 0xe]
xor bpl, byte [r12 + r14]
xor bpl, 0x64
mov byte [rax + rbx - 0xf], bpl
and r15d, 0xe
xor r13b, byte [r15 + r14]
xor r13b, 0x64
mov byte [rax + rbx - 0xe], r13b
add rax, 2
cmp rax, 0x21
jne 0x201c1940
test dl, 0x10
jne 0x201c19f3
mov dil, 1
cmp rcx, r8
jae 0x201c19d2
test dl, dl
jns 0x201c18ac
lea r14, [rsp + 0x20]
movzx eax, byte [r9 + rcx]
mov byte [r10 + rcx], al
mov rsi, r9
mov ebx, edi
test edx, 0x100
je 0x201c1863
mov rsi, r14
jmp 0x201c18f4
test dx, dx
js 0x201c184e
dec r11
jmp 0x201c18bc
mov rcx, r10
test dl, 0x20
je 0x201c19df
mov rcx, qword [rsp + 0x20]
mov rax, rcx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov al, 0x13
xchg byte [0x20525182], al
jmp 0x201c1893
jmp 0x201c1883
Function at 0x201d88e0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x201d891c
test edx, edx
je 0x201d894c
movzx eax, byte [0x20527f7d]
cmp al, 9
je 0x201d8914
mov cl, 0x32
nop word cs:[rax + rax]
mov al, 0x9b
lock cmpxchg byte [0x20527f7d], cl
je 0x201d89ac
cmp al, 9
jne 0x201d8900
lea rax, [0x20527f70]
ret
test edx, edx
je 0x201d897c
movzx eax, byte [0x20527ad5]
cmp al, 0x22
je 0x201d8944
mov cl, 0x78
nop dword [rax]
mov al, 0xc0
lock cmpxchg byte [0x20527ad5], cl
je 0x201d89e1
cmp al, 0x22
jne 0x201d8930
lea rax, [0x20527ac0]
ret
movzx eax, byte [0x20527ddc]
cmp al, 0xd1
je 0x201d8974
mov cl, 0x6a
nop dword [rax]
mov al, 0xc1
lock cmpxchg byte [0x20527ddc], cl
je 0x201d8a21
cmp al, 0xd1
jne 0x201d8960
lea rax, [0x20527dd0]
ret
movzx eax, byte [0x20527b15]
cmp al, 0xb7
je 0x201d89a4
mov cl, 0x54
nop dword [rax]
mov al, 0x23
lock cmpxchg byte [0x20527b15], cl
je 0x201d8a61
cmp al, 0xb7
jne 0x201d8990
lea rax, [0x20527b00]
ret
xor eax, eax
lea rcx, [0x20527f70]
lea rdx, [0x2041c080]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xd
jl 0x201d89c0
mov al, 9
xchg byte [0x20527f7d], al
lea rax, [0x20527f70]
ret
xor eax, eax
lea rcx, [0x20527ac0]
lea rdx, [0x2041bbf0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x15
jl 0x201d8a00
mov al, 0x22
xchg byte [0x20527ad5], al
lea rax, [0x20527ac0]
ret
xor eax, eax
lea rcx, [0x20527dd0]
lea rdx, [0x2041bee0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0xc
jl 0x201d8a40
mov al, 0xd1
xchg byte [0x20527ddc], al
lea rax, [0x20527dd0]
ret
xor eax, eax
lea rcx, [0x20527b00]
lea rdx, [0x2041bc20]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x15
jl 0x201d8a80
mov al, 0xb7
xchg byte [0x20527b15], al
lea rax, [0x20527b00]
ret
Function at 0x201d8b40
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x201d8b7c
test edx, edx
je 0x201d8bac
movzx eax, byte [0x20527f4d]
cmp al, 0x6e
je 0x201d8b74
mov cl, 0xea
nop word cs:[rax + rax]
mov al, 0x6c
lock cmpxchg byte [0x20527f4d], cl
je 0x201d8c0c
cmp al, 0x6e
jne 0x201d8b60
lea rax, [0x20527f40]
ret
test edx, edx
je 0x201d8bdc
movzx eax, byte [0x20527a4d]
cmp al, 0x52
je 0x201d8ba4
mov cl, 0xb7
nop dword [rax]
mov al, 0x17
lock cmpxchg byte [0x20527a4d], cl
je 0x201d8c41
cmp al, 0x52
jne 0x201d8b90
lea rax, [0x20527a30]
ret
movzx eax, byte [0x205280da]
cmp al, 0xc5
je 0x201d8bd4
mov cl, 0x18
nop dword [rax]
mov al, 8
lock cmpxchg byte [0x205280da], cl
je 0x201d8c81
cmp al, 0xc5
jne 0x201d8bc0
lea rax, [0x205280d0]
ret
movzx eax, byte [0x20527f93]
cmp al, 0x93
je 0x201d8c04
mov cl, 0x98
nop dword [rax]
mov al, 0xa3
lock cmpxchg byte [0x20527f93], cl
je 0x201d8cc1
cmp al, 0x93
jne 0x201d8bf0
lea rax, [0x20527f80]
ret
xor eax, eax
lea rcx, [0x20527f40]
lea rdx, [0x2041c050]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0xd
jl 0x201d8c20
mov al, 0x6e
xchg byte [0x20527f4d], al
lea rax, [0x20527f40]
ret
xor eax, eax
lea rcx, [0x20527a30]
lea rdx, [0x2041bb70]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x1d
jl 0x201d8c60
mov al, 0x52
xchg byte [0x20527a4d], al
lea rax, [0x20527a30]
ret
xor eax, eax
lea rcx, [0x205280d0]
lea rdx, [0x2041c1e0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0xa
jl 0x201d8ca0
mov al, 0xc5
xchg byte [0x205280da], al
lea rax, [0x205280d0]
ret
xor eax, eax
lea rcx, [0x20527f80]
lea rdx, [0x2041c090]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x13
jl 0x201d8ce0
mov al, 0x93
xchg byte [0x20527f93], al
lea rax, [0x20527f80]
ret
Function at 0x201e7190
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x201e71cc
test edx, edx
je 0x201e71fc
movzx eax, byte [0x205299a3]
cmp al, 0x90
je 0x201e71c4
mov cl, 0xd8
nop word cs:[rax + rax]
mov al, 0xe0
lock cmpxchg byte [0x205299a3], cl
je 0x201e725c
cmp al, 0x90
jne 0x201e71b0
lea rax, [0x205299a0]
ret
test edx, edx
je 0x201e722c
movzx eax, byte [0x2052998c]
cmp al, 7
je 0x201e71f4
mov cl, 0xe7
nop dword [rax]
mov al, 0xb4
lock cmpxchg byte [0x2052998c], cl
je 0x201e7291
cmp al, 7
jne 0x201e71e0
lea rax, [0x20529970]
ret
movzx eax, byte [0x205298d8]
cmp al, 0xb7
je 0x201e7224
mov cl, 0x90
nop dword [rax]
mov al, 0x53
lock cmpxchg byte [0x205298d8], cl
je 0x201e72d1
cmp al, 0xb7
jne 0x201e7210
lea rax, [0x205298d0]
ret
movzx eax, byte [0x2052994e]
cmp al, 0xda
je 0x201e7254
mov cl, 0xf3
nop dword [rax]
mov al, 0xe
lock cmpxchg byte [0x2052994e], cl
je 0x201e7311
cmp al, 0xda
jne 0x201e7240
lea rax, [0x20529940]
ret
xor eax, eax
lea rcx, [0x205299a0]
lea rdx, [0x2041d6b0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 3
jl 0x201e7270
mov al, 0x90
xchg byte [0x205299a3], al
lea rax, [0x205299a0]
ret
xor eax, eax
lea rcx, [0x20529970]
lea rdx, [0x2041d680]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x1c
jl 0x201e72b0
mov al, 7
xchg byte [0x2052998c], al
lea rax, [0x20529970]
ret
xor eax, eax
lea rcx, [0x205298d0]
lea rdx, [0x2041d5e0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 8
jl 0x201e72f0
mov al, 0xb7
xchg byte [0x205298d8], al
lea rax, [0x205298d0]
ret
xor eax, eax
lea rcx, [0x20529940]
lea rdx, [0x2041d650]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0xe
jl 0x201e7330
mov al, 0xda
xchg byte [0x2052994e], al
lea rax, [0x20529940]
ret
Function at 0x201f0060
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
cmp qword [0x20573218], 0
jne 0x201f0247
movzx eax, byte [0x2052aa9d]
cmp al, 0x91
je 0x201f013c
mov dl, 0x1c
nop dword [rax + rax]
mov al, 0xaf
lock cmpxchg byte [0x2052aa9d], dl
je 0x201f00a5
cmp al, 0x91
jne 0x201f0090
jmp 0x201f013c
mov eax, 1
mov edx, 0xea4bf3c5
mov r8d, 0x15b40c43
mov r9d, 0xea4bf3c6
mov r10d, 0x15b40c42
lea r11, [0x2052aa90]
lea rsi, [0x2041de20]
nop
mov edi, r10d
imul rdi, rdi, 0x38e38e39
shr rdi, 0x21
lea edi, [rdi + rdi*8]
add edi, r9d
movzx ebx, byte [rax + r11 - 1]
xor bl, byte [rdi + rsi]
xor bl, 0x40
mov byte [rax + r11 - 1], bl
cmp rax, 0xd
je 0x201f0134
mov edi, r8d
imul rdi, rdi, 0x38e38e39
shr rdi, 0x21
lea edi, [rdi + rdi*8]
add edi, edx
movzx ebx, byte [rax + r11]
mov edi, edi
xor bl, byte [rdi + rsi]
xor bl, 0x40
mov byte [rax + r11], bl
add rax, 2
add edx, 0xfffffffe
add r8d, 2
add r9d, 0xfffffffe
add r10d, 2
jmp 0x201f00d0
mov al, 0x91
xchg byte [0x2052aa9d], al
movzx eax, byte [0x2052aaac]
cmp al, 0x34
je 0x201f0216
mov dl, 0xf7
nop dword [rax]
mov al, 0x8d
lock cmpxchg byte [0x2052aaac], dl
je 0x201f0165
cmp al, 0x34
jne 0x201f0150
jmp 0x201f0216
mov eax, 0x2c991fbf
mov edx, 0xd366e04e
mov r8d, 1
mov r9d, 0x2c991fc0
mov r10d, 0xd366e04c
mov r11d, 0x92492493
lea rsi, [0x2052aaa0]
lea rdi, [0x2041de30]
nop word cs:[rax + rax]
mov ebx, edx
shr ebx, 1
imul rbx, r11
shr rbx, 0x22
lea ebp, [rbx + rbx]
shl ebx, 4
sub ebx, ebp
add ebx, eax
mov r14d, r10d
shr r14d, 1
imul r14, r11
shr r14, 0x22
lea ebp, [r14 + r14]
shl r14d, 4
sub r14d, ebp
add r14d, r9d
movzx ebp, byte [r8 + rsi - 1]
movzx r15d, byte [r8 + rsi]
xor bpl, byte [r14 + rdi]
xor bpl, 0x96
mov byte [r8 + rsi - 1], bpl
xor r15b, byte [rbx + rdi]
xor r15b, 0x96
mov byte [r8 + rsi], r15b
add eax, 0xfffffffe
add edx, 2
add r8, 2
add r9d, 0xfffffffe
add r10d, 2
cmp r8, 0xd
jne 0x201f01a0
mov al, 0x34
xchg byte [0x2052aaac], al
mov rsi, rcx
lea rcx, [0x2052aa90]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x201f023b
lea rdx, [0x2052aaa0]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
jmp 0x201f023d
xor eax, eax
mov rcx, rsi
mov qword [0x20573218], rax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp qword [0x20573218]
Function at 0x2020c620
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
cmp qword [0x20573448], 0
jne 0x2020c7f3
movzx eax, byte [0x2052e07d]
cmp al, 0xf0
je 0x2020c702
mov dl, 0xb7
nop dword [rax]
mov al, 0x32
lock cmpxchg byte [0x2052e07d], dl
je 0x2020c665
cmp al, 0xf0
jne 0x2020c650
jmp 0x2020c702
mov eax, 1
mov edx, 0x4615ce08
mov r8d, 0xb9ea3204
mov r9d, 0x4615ce09
mov r10d, 0xb9ea3203
lea r11, [0x2052e070]
lea rsi, [0x2041ea30]
nop
mov edi, r10d
imul rdi, rdi, 0x4ec4ec4f
shr rdi, 0x22
lea ebx, [rdi + rdi*2]
lea edi, [rdi + rbx*4]
add edi, r9d
movzx ebx, byte [rax + r11 - 1]
xor bl, byte [rdi + rsi]
xor bl, 0xf8
mov byte [rax + r11 - 1], bl
cmp rax, 0xd
je 0x2020c6fa
mov edi, r8d
imul rdi, rdi, 0x4ec4ec4f
shr rdi, 0x22
lea ebx, [rdi + rdi*2]
lea edi, [rdi + rbx*4]
add edi, edx
movzx ebx, byte [rax + r11]
mov edi, edi
xor bl, byte [rdi + rsi]
xor bl, 0xf8
mov byte [rax + r11], bl
add rax, 2
add edx, 0xfffffffe
add r8d, 2
add r9d, 0xfffffffe
add r10d, 2
jmp 0x2020c690
mov al, 0xf0
xchg byte [0x2052e07d], al
mov rsi, rcx
movzx eax, byte [0x2052e08e]
cmp al, 0x55
je 0x2020c7cb
mov cl, 7
nop word cs:[rax + rax]
mov al, 0x30
lock cmpxchg byte [0x2052e08e], cl
je 0x2020c735
cmp al, 0x55
jne 0x2020c720
jmp 0x2020c7cb
lea r8, [0x2041ea40]
mov r9d, 0xbdb65a35
add r9, r8
mov r10d, 0xbdb65a34
xor r11d, r11d
movabs rdi, 0xaaaaaaaaaaaaaaab
lea rbx, [0x2052e080]
mov ecx, 0xbdb65a34
nop word cs:[rax + rax]
mov rax, rcx
mul rdi
shr rdx, 1
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*2]
mov rdx, r9
sub rdx, rax
mov r14, r8
sub r14, rax
add r14, r11
movzx eax, byte [r11 + rbx]
movzx ebp, byte [r11 + rbx + 1]
xor al, byte [r10 + r14]
add al, 0x80
mov byte [r11 + rbx], al
xor bpl, byte [rdx]
add bpl, 0x80
mov byte [r11 + rbx + 1], bpl
add r11, 2
add r9, 2
add rcx, 2
cmp r11, 0xe
jne 0x2020c770
mov al, 0x55
xchg byte [0x2052e08e], al
lea rax, [0x2052e080]
mov qword [rsp + 0x28], rax
lea rdx, [0x2052e070]
mov r9d, 0xc35c538d
call fcn.20216610
mov qword [0x20573448], rax
mov rcx, rsi
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp qword [0x20573448]
Function at 0x20224b20
Capabilities:
Encrypt data using speck

Disassembly:
mov edx, ecx
mov r9d, 0x9e4d579d
jmp fcn.2022a4b0

Function at 0x20224b30
Capabilities:
Encrypt data using speck

Disassembly:
mov r8d, ecx
mov r9d, 0x5547ff52
jmp fcn.2022a4b0

Function at 0x20224b40
Capabilities:
Encrypt data using speck

Disassembly:
mov rax, rcx
mov ecx, edx
mov rdx, rax
xor r8d, r8d
mov r9d, 0xe3d712db
jmp fcn.2022a4b0

Function at 0x20224b60
Capabilities:
Encrypt data using speck

Disassembly:
mov r8d, ecx
mov r9d, 0xabdce8b
jmp fcn.2022a4b0
Function at 0x2023fa80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
movzx eax, byte [0x20532070]
cmp al, 0x92
je 0x2023fab0
mov cl, 0x9e
nop word cs:[rax + rax]
mov al, 0x9a
lock cmpxchg byte [0x20532070], cl
je 0x2023fabc
cmp al, 0x92
jne 0x2023faa0
lea rcx, [0x20532060]
call fcn.20078170
mov eax, 0xf
lea rcx, [0x20532060]
lea rdx, [0x2041ffe0]
nop
mov r8d, eax
not r8d
lea r9d, [rax - 1]
and r9d, 0xe
xor r9, 0xf
movzx r10d, byte [rax + rcx - 0xf]
movzx r11d, byte [rax + rcx - 0xe]
xor r10b, byte [r9 + rdx]
xor r10b, 0x3f
mov byte [rax + rcx - 0xf], r10b
and r8d, 0xe
xor r11b, byte [r8 + rdx]
xor r11b, 0x3f
mov byte [rax + rcx - 0xe], r11b
add rax, 2
cmp rax, 0x1f
jne 0x2023fad0
mov al, 0x92
xchg byte [0x20532070], al
lea rcx, [0x20532060]
call fcn.20078170
int3
Function at 0x20251b60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [0x20573750], 0
jne 0x20251d12
movzx eax, byte [0x2053504d]
cmp al, 0xe9
je 0x20251c3d
mov dl, 0x82
nop word cs:[rax + rax]
mov al, 5
lock cmpxchg byte [0x2053504d], dl
je 0x20251ba5
cmp al, 0xe9
jne 0x20251b90
jmp 0x20251c3d
mov r8d, 0xc11e112f
lea r9, [r8 + 1]
xor r11d, r11d
movabs rsi, 0x4ec4ec4ec4ec4ec5
lea rax, [0x204208f0]
mov edi, 0xc11e112d
add rdi, rax
lea rbx, [0x20535040]
nop word cs:[rax + rax]
mov rax, r9
mul rsi
mov r10, rdx
mov rax, r8
mul rsi
shr rdx, 2
imul rax, rdx, 0xfffffffffffffff3
add rax, rdi
movzx eax, byte [r11 + rax + 2]
xor al, 0x5f
add byte [r11 + rbx], al
cmp r11, 0xc
je 0x20251c35
shr r10, 2
imul rax, r10, 0xfffffffffffffff3
add rax, rdi
add rax, 3
movzx eax, byte [rax + r11]
xor al, 0x5f
add byte [r11 + rbx + 1], al
add r11, 2
add r9, 2
add r8, 2
jmp 0x20251be0
mov al, 0xe9
xchg byte [0x2053504d], al
movzx eax, byte [0x20535066]
cmp al, 0xb6
je 0x20251ce1
mov dl, 0xe5
nop
mov al, 0xbd
lock cmpxchg byte [0x20535066], dl
je 0x20251c62
cmp al, 0xb6
jne 0x20251c50
jmp 0x20251ce1
mov r8d, 0x4831c604
xor r9d, r9d
movabs r10, 0x2e8ba2e8ba2e8ba3
lea r11, [0x20420900]
lea rsi, [0x20535050]
nop word cs:[rax + rax]
mov rax, r8
mul r10
shr rdx, 2
imul rax, rdx, 0xffffffffffffffea
add rax, r11
movzx edx, byte [r9 + rsi]
movzx ebx, byte [r9 + rsi + 1]
xor dl, byte [r9 + rax + 0x4831c604]
xor dl, 0xb9
mov byte [r9 + rsi], dl
xor bl, byte [r9 + rax + 0x4831c605]
xor bl, 0xb9
mov byte [r9 + rsi + 1], bl
add r9, 2
add r8, 2
cmp r9, 0x16
jne 0x20251c90
mov al, 0xb6
xchg byte [0x20535066], al
mov rsi, rcx
lea rcx, [0x20535040]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x20251d06
lea rdx, [0x20535050]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
jmp 0x20251d08
xor eax, eax
mov rcx, rsi
mov qword [0x20573750], rax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [0x20573750]
Function at 0x20253c90
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov qword [rsp + 0x20], r9
cmp qword [0x20573798], 0
jne 0x20253e95
movzx eax, byte [0x205352bd]
cmp al, 0x78
je 0x20253d88
mov r10b, 0x41
nop word cs:[rax + rax]
mov al, 0x35
lock cmpxchg byte [0x205352bd], r10b
je 0x20253ce6
cmp al, 0x78
jne 0x20253cd0
jmp 0x20253d88
mov edi, edx
mov r10d, 0xae2a3310
lea r11, [r10 + 1]
xor ebx, ebx
movabs r14, 0x4ec4ec4ec4ec4ec5
lea rax, [0x20420ba0]
mov r15d, 0xae2a3308
add r15, rax
lea r12, [0x205352b0]
nop word cs:[rax + rax]
mov rax, r11
mul r14
mov rsi, rdx
mov rax, r10
mul r14
shr rdx, 2
imul rax, rdx, 0xfffffffffffffff3
add rax, r15
movzx edx, byte [rbx + r12]
xor dl, byte [rbx + rax + 8]
xor dl, 0xe7
mov byte [rbx + r12], dl
cmp rbx, 0xc
je 0x20253d7e
shr rsi, 2
imul rax, rsi, 0xfffffffffffffff3
add rax, r15
add rax, 9
movzx edx, byte [rbx + r12 + 1]
xor dl, byte [rax + rbx]
xor dl, 0xe7
mov byte [rbx + r12 + 1], dl
add rbx, 2
add r11, 2
add r10, 2
jmp 0x20253d20
mov al, 0x78
xchg byte [0x205352bd], al
mov edx, edi
movzx eax, byte [0x205352cc]
cmp al, 0xdf
je 0x20253e5a
mov r10b, 0x62
nop word [rax + rax]
mov al, 0x80
lock cmpxchg byte [0x205352cc], r10b
je 0x20253db6
cmp al, 0xdf
jne 0x20253da0
jmp 0x20253e5a
mov eax, 0x6f524f7f
mov r10d, 0x90adb08a
mov r11d, 1
mov esi, 0x6f524f80
mov edi, 0x90adb088
mov r9d, 0xcccccccd
lea r14, [0x205352c0]
lea r15, [0x20420bb0]
nop word cs:[rax + rax]
mov r12d, r10d
imul r12, r9
shr r12, 0x23
lea r12d, [r12 + r12*4]
lea r12d, [rax + r12*2]
mov r13d, edi
imul r13, r9
shr r13, 0x23
lea r13d, [r13 + r13*4]
lea r13d, [rsi + r13*2]
movzx ebp, byte [r11 + r14 - 1]
movzx ebx, byte [r11 + r14]
xor bpl, byte [r13 + r15]
xor bpl, 0xc2
mov byte [r11 + r14 - 1], bpl
xor bl, byte [r12 + r15]
xor bl, 0xc2
mov byte [r11 + r14], bl
add eax, 0xfffffffe
add r10d, 2
add r11, 2
add esi, 0xfffffffe
add edi, 2
cmp r11, 0xd
jne 0x20253df0
mov al, 0xdf
xchg byte [0x205352cc], al
mov rsi, rcx
mov edi, edx
mov ebx, r8d
lea rcx, [0x205352b0]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x20253e84
lea rdx, [0x205352c0]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
jmp 0x20253e86
xor eax, eax
mov r8d, ebx
mov edx, edi
mov rcx, rsi
mov qword [0x20573798], rax
mov rax, qword [0x20573798]
mov r9, qword [rsp + 0x20]
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp rax
Function at 0x20350de0
Capabilities:
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rax, qword [0x20562ac8]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
nop word [rax + rax]
mov r8d, dword [rdx + rax*4]
bswap r8d
mov dword [rsp + rax*4 + 0x50], r8d
inc rax
cmp rax, 0x10
jne 0x20350e10
mov edx, dword [rcx]
mov esi, dword [rcx + 4]
mov eax, dword [rcx + 8]
mov r13d, dword [rcx + 0xc]
mov r10d, dword [rcx + 0x10]
mov r14d, dword [rcx + 0x14]
mov ebp, dword [rcx + 0x18]
mov qword [rsp + 0x48], rcx
mov ebx, dword [rcx + 0x1c]
lea r15, [0x20436ce0]
xor r12d, r12d
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x3c], r14d
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x34], r13d
mov dword [rsp + 0x24], r13d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x2c], esi
mov dword [rsp + 0x28], edx
jmp 0x20350f5d
lea eax, [r12 + 0xe]
and eax, 0xf
mov r10d, dword [rsp + rax*4 + 0x50]
mov eax, r10d
rol eax, 0xf
mov edx, r10d
rol edx, 0xd
xor edx, eax
shr r10d, 0xa
xor r10d, edx
lea eax, [r12 + 9]
and eax, 0xf
add r10d, dword [rsp + rax*4 + 0x50]
lea eax, [r12 + 1]
and eax, 0xf
mov eax, dword [rsp + rax*4 + 0x50]
mov edx, eax
rol edx, 0x19
mov esi, eax
rol esi, 0xe
xor esi, edx
shr eax, 3
xor eax, esi
mov edx, r12d
and edx, 0xf
add r10d, dword [rsp + rdx*4 + 0x50]
add r10d, eax
mov dword [rsp + rdx*4 + 0x50], r10d
mov eax, edi
rol eax, 0x1a
mov edx, edi
rol edx, 0x15
xor edx, eax
mov eax, edi
rol eax, 7
xor eax, edx
add eax, r10d
mov ebp, r14d
xor ebp, r9d
and ebp, edi
xor ebp, r9d
add ebp, ebx
add ebp, eax
add ebp, dword [r15]
mov eax, ecx
rol eax, 0x1e
mov edx, ecx
rol edx, 0x13
xor edx, eax
mov eax, ecx
rol eax, 0xa
xor eax, edx
mov r10d, ecx
and r10d, r13d
mov edx, ecx
xor edx, r13d
and edx, r8d
or edx, r10d
add edx, eax
mov r10d, dword [rsp + 0x24]
add r10d, ebp
add edx, ebp
inc r12
add r15, 4
mov ebx, r9d
mov ebp, r14d
mov r11d, r9d
mov r9d, r14d
mov r14d, edi
mov dword [rsp + 0x24], r8d
mov eax, r13d
mov esi, ecx
cmp r12, 0x40
je 0x20350f7f
mov ecx, edx
mov r13d, esi
mov r8d, eax
mov edi, r10d
mov r9d, ebp
cmp r12, 0xf
ja 0x20350e80
mov r10d, dword [rsp + r12*4 + 0x50]
jmp 0x20350edf
add edx, dword [rsp + 0x28]
mov rax, qword [rsp + 0x48]
mov dword [rax], edx
add ecx, dword [rsp + 0x2c]
mov dword [rax + 4], ecx
add r13d, dword [rsp + 0x30]
mov dword [rax + 8], r13d
add r8d, dword [rsp + 0x34]
mov dword [rax + 0xc], r8d
add r10d, dword [rsp + 0x38]
mov dword [rax + 0x10], r10d
add edi, dword [rsp + 0x3c]
mov dword [rax + 0x14], edi
add r9d, dword [rsp + 0x40]
mov dword [rax + 0x18], r9d
add r11d, dword [rsp + 0x44]
mov dword [rax + 0x1c], r11d
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.203c9080
nop
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x20390150
Capabilities:
Write file on windows

Disassembly:
mov r9, r8
mov r8, rdx
mov edx, 1
jmp fcn.203aae90
jmp 0x2038ffc0
Function at 0x20394aa0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
cmp qword [0x20575328], 0
jne 0x20394c8b
movzx eax, byte [0x2056151c]
cmp al, 0x15
je 0x20394b6a
mov r10b, 2
nop
mov al, 0x2c
lock cmpxchg byte [0x2056151c], r10b
je 0x20394ae6
cmp al, 0x15
jne 0x20394ad0
jmp 0x20394b6a
mov eax, 0x58023f82
mov r10d, 0xa7fdc088
mov r11d, 1
mov esi, 0x58023f83
mov edi, 0xaaaaaaab
lea rbx, [0x20561510]
lea r14, [0x20439780]
nop
mov r15d, r10d
imul r15, rdi
shr r15, 0x23
shl r15d, 2
lea r15d, [r15 + r15*2]
lea r12d, [rax + r15]
add r15d, esi
movzx ebp, byte [r11 + rbx - 1]
xor bpl, byte [r15 + r14]
movzx r15d, byte [r11 + rbx]
xor bpl, 0xcf
xor r15b, byte [r12 + r14]
mov byte [r11 + rbx - 1], bpl
xor r15b, 0xcf
mov byte [r11 + rbx], r15b
add eax, 0xfffffffe
add r10d, 2
add r11, 2
add esi, 0xfffffffe
cmp r11, 0xd
jne 0x20394b10
mov al, 0x15
xchg byte [0x2056151c], al
movzx eax, byte [0x20561531]
cmp al, 0x4c
je 0x20394c4a
mov r10b, 0x7c
nop dword [rax]
mov al, 0xcd
lock cmpxchg byte [0x20561531], r10b
je 0x20394b96
cmp al, 0x4c
jne 0x20394b80
jmp 0x20394c4a
mov edi, edx
mov r10d, 0x2dd1525b
mov r11d, 0x2dd1525a
xor ebx, ebx
movabs r14, 0xf0f0f0f0f0f0f0f1
lea r15, [0x20439790]
add r15, 0x2dd15259
lea r12, [0x20561520]
nop word cs:[rax + rax]
mov rax, r10
mul r14
mov rsi, rdx
mov rax, r11
mul r14
mov rax, rdx
shr rax, 4
and rdx, 0xfffffffffffffff0
add rdx, rax
mov rax, r15
sub rax, rdx
movzx edx, byte [rbx + r12]
xor dl, byte [rax + rbx + 1]
xor dl, 0xf0
mov byte [rbx + r12], dl
cmp rbx, 0x10
je 0x20394c40
mov rax, rsi
shr rax, 4
and rsi, 0xfffffffffffffff0
add rsi, rax
mov rax, r15
sub rax, rsi
add rax, 2
movzx edx, byte [rbx + r12 + 1]
xor dl, byte [rax + rbx]
xor dl, 0xf0
mov byte [rbx + r12 + 1], dl
add rbx, 2
add r10, 2
add r11, 2
jmp 0x20394bd0
mov al, 0x4c
xchg byte [0x20561531], al
mov edx, edi
mov rsi, rcx
mov edi, edx
mov rbx, r8
mov ebp, r9d
lea rcx, [0x20561510]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x20394c77
lea rdx, [0x20561520]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
jmp 0x20394c79
xor eax, eax
mov r9d, ebp
mov r8, rbx
mov edx, edi
mov rcx, rsi
mov qword [0x20575328], rax
mov rax, qword [0x20575328]
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp rax