joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff674b905f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
mov r10, rdx
xor r11b, r11b
xor edx, edx
mov rdi, r9
mov rbx, rcx
test rcx, rcx
je 0x7ff674b906f1
test r10, r10
je 0x7ff674b906f1
movzx eax, byte [rcx]
test r8d, r8d
jne 0x7ff674b90639
cmp al, 0x7f
jbe 0x7ff674b906ea
mov edx, 1
mov eax, edx
add rax, r10
jmp 0x7ff674b906f9
mov r11b, 0xff
cmp al, 0x80
jbe 0x7ff674b9064f
mov edx, 1
mov eax, edx
add rax, r10
jmp 0x7ff674b906f9
jne 0x7ff674b906ea
mov eax, 1
lea rcx, [r10 - 1]
cmp r10, rax
jbe 0x7ff674b906df
cmp rcx, 8
jb 0x7ff674b906d1
and ecx, 7
mov rdx, r10
sub rdx, rcx
xorps xmm3, xmm3
xorps xmm2, xmm2
nop dword [rax]
movd xmm1, dword [rbx + rax]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
orps xmm3, xmm1
movd xmm1, dword [rbx + rax + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
orps xmm2, xmm1
cmp rax, rdx
jb 0x7ff674b90680
orps xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
orps xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
orps xmm2, xmm0
movd edx, xmm2
cmp rax, r10
jae 0x7ff674b906df
movzx ecx, byte [rbx + rax]
inc rax
or edx, ecx
cmp rax, r10
jb 0x7ff674b906d1
neg edx
sbb r11b, r11b
mov edx, r11d
and edx, 1
mov eax, edx
add rax, r10
jmp 0x7ff674b906f9
mov eax, 1
mov r10, rdx
test rdi, rdi
je 0x7ff674b90755
mov rcx, qword [r9]
test rcx, rcx
je 0x7ff674b90755
mov edx, edx
mov r8d, r11d
add rdx, rcx
mov byte [rcx], r11b
and r8d, 1
test r10, r10
je 0x7ff674b90752
lea r9, [r10 + rbx]
mov rbx, r10
sub rbx, r10
add rbx, rdx
nop word [rax + rax]
movzx edx, byte [r9 - 1]
lea r9, [r9 - 1]
dec r10
movzx ecx, r11b
xor edx, ecx
add r8d, edx
mov byte [rbx + r10], r8b
shr r8d, 8
test r10, r10
jne 0x7ff674b90730
add qword [rdi], rax
mov rbx, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x7ff674b90960
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x28
call fcn.7ff674cf3860
sub rsp, rax
mov r8d, dword [rcx + 4]
mov r9, rdx
movsxd rdx, dword [rcx]
and r8d, 0x100
mov rcx, qword [rcx + 8]
add rsp, 0x28
jmp fcn.7ff674b905f0

Function at 0x7ff674b935e0
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x28
call fcn.7ff674cf3860
sub rsp, rax
cmp dword [0x7ff67506f490], 0
jne 0x7ff674b9369a
xor edx, edx
mov dword [0x7ff67506f490], 1
mov r8d, 0x198
lea rcx, [0x7ff67506f4a0]
call fcn.7ff674cf66c0
mov ecx, 0x202
lea rdx, [0x7ff67506f4a0]
call qword [sym.imp.ws2_32.dll_WSAStartup]
test eax, eax
je 0x7ff674b9369a
call fcn.7ff674b31360
lea r8, [0x7ff674d5c2b8]
mov edx, 0x99
lea rcx, [0x7ff674d5c2a0]
call fcn.7ff674b31480
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
lea r8, [0x7ff674d5c2c8]
mov ecx, 2
mov edx, eax
call fcn.7ff674b315e0
call fcn.7ff674b31360
lea r8, [0x7ff674d5c2b8]
mov edx, 0x9b
lea rcx, [0x7ff674d5c2a0]
call fcn.7ff674b31480
xor r8d, r8d
lea edx, [r8 + 0x7a]
lea ecx, [rdx - 0x5a]
call fcn.7ff674b315e0
mov eax, 0xffffffff
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret
Function at 0x7ff674b936b0
Capabilities:
Set socket configuration

Disassembly:
push rbx
mov eax, 0x20
call fcn.7ff674cf3860
sub rsp, rax
mov dword [rsp + 0x30], edx
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
movsxd rcx, ecx
call qword [sym.imp.ws2_32.dll_ioctlsocket]
mov ebx, eax
test eax, eax
jns 0x7ff674b93712
call fcn.7ff674b31360
lea r8, [0x7ff674d5c2e0]
mov edx, 0xf7
lea rcx, [0x7ff674d5c2a0]
call fcn.7ff674b31480
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
lea r8, [0x7ff674d5c2f8]
mov ecx, 2
mov edx, eax
call fcn.7ff674b315e0
xor eax, eax
test ebx, ebx
sete al
add rsp, 0x20
pop rbx
ret

Function at 0x7ff674b93720
Capabilities:
Get socket status

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x260
call fcn.7ff674cf3860
sub rsp, rax
mov rax, qword [0x7ff675045040]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov edi, ecx
mov rbx, r8
mov esi, edx
cmp ecx, 0x3f
ja 0x7ff674b937b2
test rbx, rbx
jne 0x7ff674b9375a
lea eax, [r8 + 1]
jmp 0x7ff674b937b7
xor ecx, ecx
call fcn.7ff674cd5f0c
mov rcx, rax
cmp rbx, rax
jge 0x7ff674b9376d
xor eax, eax
jmp 0x7ff674b937b7
xor eax, eax
mov qword [rsp + 0x48], rdi
sub ebx, ecx
mov dword [rsp + 0x34], eax
test esi, esi
mov dword [rsp + 0x40], 1
lea r8, [rsp + 0x40]
mov dword [rsp + 0x30], ebx
cmovne r8, rax
lea rdx, [rsp + 0x40]
cmove rdx, rax
lea ecx, [rdi + 1]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ws2_32.dll_select]
jmp 0x7ff674b937b7
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.7ff674a3df50
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret

Function at 0x7ff674b93b00
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x28
call fcn.7ff674cf3860
sub rsp, rax
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x28
jmp fcn.7ff674b93eb0
Function at 0x7ff674b94470
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r14
mov eax, 0x28
call fcn.7ff674cf3860
sub rsp, rax
mov r14, qword [rsp + 0x90]
mov r10, r9
mov r12, qword [rsp + 0x88]
mov rdi, r8
mov rsi, rdx
mov rbp, rcx
mov ebx, dword [r14]
test ebx, ebx
je 0x7ff674b944d1
nop dword [rax]
test rdi, rdi
je 0x7ff674b944d1
mov eax, ebx
dec rdi
movzx ecx, byte [rax + r12]
xor cl, byte [rbp]
inc rbp
mov byte [rsi], cl
inc rsi
inc ebx
and ebx, 0xf
jne 0x7ff674b944b0
mov r9, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x80]
cmp rdi, 0x10
jb 0x7ff674b9459e
mov qword [rsp + 0x60], r13
xor ebx, ebx
mov r13, rdi
mov qword [rsp + 0x20], r15
shr r13, 4
mov r14, rsi
imul rax, r13, 0xfffffffffffffff0
mov r15, rbp
mov dword [rsp + 0x70], ebx
mov rbx, qword [rsp + 0x78]
add rdi, rax
mov rax, r13
sub r14, r12
shl rax, 4
sub r15, r12
add rsi, rax
add rbp, rax
mov r8, rbx
mov rdx, r12
call r9
mov rcx, qword [rsp + 0x80]
call fcn.7ff674b94800
mov edx, 2
mov rcx, r12
nop word [rax + rax]
mov rax, qword [r15 + rcx]
xor rax, qword [rcx]
mov qword [r14 + rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x7ff674b94550
mov rcx, qword [rsp + 0x80]
add r14, 0x10
mov r9, qword [rsp + 0x98]
add r15, 0x10
sub r13, 1
jne 0x7ff674b94527
mov r15, qword [rsp + 0x20]
mov r13, qword [rsp + 0x60]
mov ebx, dword [rsp + 0x70]
mov r14, qword [rsp + 0x90]
mov r10, qword [rsp + 0x78]
test rdi, rdi
je 0x7ff674b945d5
mov r8, r10
mov rdx, r12
call r9
mov rcx, qword [rsp + 0x80]
call fcn.7ff674b94800
nop dword [rax]
mov ecx, ebx
inc ebx
movzx eax, byte [r12 + rcx]
xor al, byte [rcx + rbp]
mov byte [rsi + rcx], al
sub rdi, 1
jne 0x7ff674b945c0
mov dword [r14], ebx
add rsp, 0x28
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x7ff674b945f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
mov eax, 0x40
call fcn.7ff674cf3860
sub rsp, rax
mov rbx, r8
mov r14, rdx
mov r8, qword [rsp + 0xb0]
mov rbp, rcx
mov edi, dword [r8]
mov dword [rsp + 0x30], edi
test edi, edi
je 0x7ff674b94655
mov rdx, qword [rsp + 0xa8]
test rbx, rbx
je 0x7ff674b94651
mov eax, edi
dec rbx
movzx ecx, byte [rax + rdx]
xor cl, byte [rbp]
inc rbp
mov byte [r14], cl
inc r14
inc edi
and edi, 0xf
jne 0x7ff674b94630
mov dword [rsp + 0x30], edi
mov rax, qword [rsp + 0xa0]
mov esi, 1
mov ecx, dword [rax + 0xc]
lea r15, [rax + 0xc]
mov r10, qword [rsp + 0xb8]
mov qword [rsp + 0x80], r12
lea r13d, [rsi + 0xb]
bswap ecx
mov dword [rsp + 0x90], ecx
cmp rbx, 0x10
jb 0x7ff674b94763
mov rdi, qword [rsp + 0xa0]
mov eax, 0x10000000
nop dword [rax]
mov rdx, rbx
mov qword [rsp + 0x20], rdi
shr rdx, 4
cmp rdx, rax
cmova rdx, rax
add ecx, edx
mov r12, rdx
mov eax, ecx
sub r12, rax
cmp rax, rdx
cmovae r12, rdx
xor r8d, r8d
cmp rax, rdx
mov rdx, r14
cmovae r8d, ecx
mov rcx, rbp
mov dword [rsp + 0x90], r8d
mov r8, r12
call r10
mov ecx, dword [rsp + 0x90]
mov eax, ecx
bswap eax
mov dword [r15], eax
test ecx, ecx
jne 0x7ff674b9471c
mov r8d, r13d
mov eax, esi
mov rdx, r15
nop dword [rax]
movzx ecx, byte [rdx - 1]
lea rdx, [rdx - 1]
add eax, ecx
mov byte [rdx], al
shr eax, 8
add r8d, 0xffffffff
jne 0x7ff674b94700
mov ecx, dword [rsp + 0x90]
mov r10, qword [rsp + 0xb8]
mov eax, 0x10000000
mov r9, qword [rsp + 0x98]
shl r12, 4
sub rbx, r12
add r14, r12
add rbp, r12
cmp rbx, 0x10
jae 0x7ff674b946a0
mov edi, dword [rsp + 0x30]
mov r8, qword [rsp + 0xb0]
mov rax, qword [rsp + 0xa0]
mov dword [rsp + 0x90], ecx
test rbx, rbx
je 0x7ff674b947e2
mov r12, qword [rsp + 0xa8]
xorps xmm0, xmm0
mov r8, rsi
mov qword [rsp + 0x20], rax
mov rdx, r12
mov rcx, r12
movups xmmword [r12], xmm0
call r10
mov r8d, dword [rsp + 0x90]
add r8d, esi
bswap r8d
mov dword [r15], r8d
jne 0x7ff674b947c0
nop dword [rax]
movzx eax, byte [r15 - 1]
lea r15, [r15 - 1]
add esi, eax
mov byte [r15], sil
shr esi, 8
add r13d, 0xffffffff
jne 0x7ff674b947a0
nop word [rax + rax]
mov ecx, edi
inc edi
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + r12]
mov byte [r14 + rcx], al
sub rbx, 1
jne 0x7ff674b947c0
mov rax, qword [rsp + 0xb0]
mov dword [rax], edi
jmp 0x7ff674b947e5
mov dword [r8], edi
mov r12, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x7ff674b948c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r15
mov eax, 0x28
call fcn.7ff674cf3860
sub rsp, rax
mov rsi, qword [rsp + 0x88]
mov r10, r9
mov r15, qword [rsp + 0x80]
mov rdi, r8
mov rbp, rdx
mov r12, rcx
mov ebx, dword [rsi]
test ebx, ebx
jns 0x7ff674b9490f
mov dword [rsi], 0xffffffff
add rsp, 0x28
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
je 0x7ff674b94934
test rdi, rdi
je 0x7ff674b94934
mov eax, ebx
dec rdi
movzx ecx, byte [rax + r15]
xor cl, byte [r12]
inc r12
mov byte [rbp], cl
inc rbp
inc ebx
and ebx, 0xf
jne 0x7ff674b94911
mov r9, qword [rsp + 0x90]
cmp rdi, 0x10
jb 0x7ff674b949f9
mov qword [rsp + 0x60], r13
mov rsi, rbp
mov r13, rdi
mov qword [rsp + 0x20], r14
shr r13, 4
mov r14, r12
imul rax, r13, 0xfffffffffffffff0
sub rsi, r15
sub r14, r15
add rdi, rax
mov rax, r13
shl rax, 4
add rbp, rax
mov qword [rsp + 0x68], rbp
add r12, rax
mov rbp, qword [rsp + 0x78]
mov r8, rbp
mov rdx, r15
mov rcx, r15
call r9
cmp ebx, 0x10
jae 0x7ff674b949c5
mov edx, 0xf
mov ecx, ebx
sub edx, ebx
add rcx, r15
shr edx, 3
inc edx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r14 + rcx]
xor rax, qword [rcx]
mov qword [rsi + rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x7ff674b949b0
mov r9, qword [rsp + 0x90]
add rsi, 0x10
add r14, 0x10
xor ebx, ebx
sub r13, 1
jne 0x7ff674b94981
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x88]
mov r10, qword [rsp + 0x78]
test rdi, rdi
je 0x7ff674b94a26
mov r8, r10
mov rdx, r15
mov rcx, r15
call r9
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx eax, byte [r15 + rcx]
xor al, byte [rcx + r12]
mov byte [rcx + rbp], al
sub rdi, 1
jne 0x7ff674b94a10
mov dword [rsi], ebx
add rsp, 0x28
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x7ff674b95410
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push r14
mov eax, 0x20
call fcn.7ff674cf3860
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov rbx, r8
mov r14, rdx
mov rbp, rcx
je 0x7ff674b95440
mov eax, 0xfffffffe
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, rbx
cmp rcx, rax
ja 0x7ff674b95532
cmp rcx, rbx
jb 0x7ff674b95532
mov qword [rsp + 0x40], rsi
mov esi, dword [rbp + 0x17c]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
mov qword [rbp + 0x30], rcx
test esi, esi
je 0x7ff674b954b6
test rbx, rbx
je 0x7ff674b95512
movzx eax, byte [r14]
dec rbx
mov ecx, esi
inc r14
xor byte [rcx + rbp + 0x40], al
inc esi
and esi, 0xf
jne 0x7ff674b95480
lea r12, [rbp + 0x60]
lea rdi, [rbp + 0x40]
mov rdx, r12
mov rcx, rdi
call qword [rbp + 0x170]
jmp 0x7ff674b954be
lea r12, [rbp + 0x60]
lea rdi, [rbp + 0x40]
mov qword [rsp + 0x58], r15
mov r15, rbx
and r15, 0xfffffffffffffff0
je 0x7ff674b954e4
mov r9, r15
mov r8, r14
mov rdx, r12
mov rcx, rdi
call qword [rbp + 0x168]
add r14, r15
sub rbx, r15
mov r15, qword [rsp + 0x58]
test rbx, rbx
je 0x7ff674b95512
mov esi, ebx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + r14 - 0x40]
xor byte [rdi], al
lea rdi, [rdi + 1]
sub rbx, 1
jne 0x7ff674b95500
mov rdi, qword [rsp + 0x48]
xor eax, eax
mov r12, qword [rsp + 0x50]
mov dword [rbp + 0x17c], esi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov eax, 0xffffffff
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
Function at 0x7ff674b964d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r13
push r14
mov eax, 0x20
call fcn.7ff674cf3860
sub rsp, rax
xor r13d, r13d
lea r14, [rcx + 0x40]
mov qword [rcx + 0x30], r13
mov rsi, r8
mov qword [rcx + 0x38], r13
mov rdi, rdx
mov qword [rcx + 0x178], r13
mov rbx, rcx
cmp r8, 0xc
jne 0x7ff674b96528
movsd xmm0, qword [rdx]
lea edi, [r8 - 0xb]
movsd qword [rcx], xmm0
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
mov dword [rcx + 0xc], 0x1000000
jmp 0x7ff674b96651
mov qword [rsp + 0x50], rbp
mov rbp, rsi
mov qword [rsp + 0x60], r15
lea r15, [rcx + 0x60]
mov qword [r14], r13
mov qword [rcx + 0x48], r13
cmp rsi, 0x10
jb 0x7ff674b965ee
mov qword [rsp + 0x58], r12
mov r12, rsi
shr r12, 4
imul rax, r12, 0xfffffffffffffff0
add rsi, rax
nop dword [rax]
movzx eax, byte [rdi]
mov rdx, r15
xor byte [r14], al
mov rcx, r14
movzx eax, byte [rdi + 1]
xor byte [rbx + 0x41], al
movzx eax, byte [rdi + 2]
xor byte [rbx + 0x42], al
movzx eax, byte [rdi + 3]
xor byte [rbx + 0x43], al
movzx eax, byte [rdi + 4]
xor byte [rbx + 0x44], al
movzx eax, byte [rdi + 5]
xor byte [rbx + 0x45], al
movzx eax, byte [rdi + 6]
xor byte [rbx + 0x46], al
movzx eax, byte [rdi + 7]
xor byte [rbx + 0x47], al
movzx eax, byte [rdi + 8]
xor byte [rbx + 0x48], al
movzx eax, byte [rdi + 9]
xor byte [rbx + 0x49], al
movzx eax, byte [rdi + 0xa]
xor byte [rbx + 0x4a], al
movzx eax, byte [rdi + 0xb]
xor byte [rbx + 0x4b], al
movzx eax, byte [rdi + 0xc]
xor byte [rbx + 0x4c], al
movzx eax, byte [rdi + 0xd]
xor byte [rbx + 0x4d], al
movzx eax, byte [rdi + 0xe]
xor byte [rbx + 0x4e], al
movzx eax, byte [rdi + 0xf]
xor byte [rbx + 0x4f], al
call qword [rbx + 0x170]
add rdi, 0x10
sub r12, 1
jne 0x7ff674b96560
mov r12, qword [rsp + 0x58]
test rsi, rsi
je 0x7ff674b9661d
mov rcx, r14
sub rdi, rbx
nop dword [rax]
movzx eax, byte [rcx + rdi - 0x40]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rsi, 1
jne 0x7ff674b96600
mov rdx, r15
mov rcx, r14
call qword [rbx + 0x170]
shl rbp, 3
mov rdx, r15
bswap rbp
xor qword [rbx + 0x48], rbp
mov rcx, r14
call qword [rbx + 0x170]
mov rax, qword [r14]
mov edi, dword [rbx + 0x4c]
mov r15, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x50]
mov qword [rbx], rax
mov rax, qword [rbx + 0x48]
mov qword [rbx + 8], rax
bswap edi
mov qword [r14], r13
lea rdx, [rbx + 0x20]
mov qword [rbx + 0x48], r13
mov rcx, rbx
mov r8, qword [rbx + 0x188]
call qword [rbx + 0x180]
inc edi
bswap edi
mov dword [rbx + 0xc], edi
add rsp, 0x20
pop r14
pop r13
pop rdi
pop rsi
pop rbx
ret
Function at 0x7ff674b96e50
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x78
call fcn.7ff674cf3860
sub rsp, rax
mov rax, qword [0x7ff675045040]
xor rax, rsp
mov qword [rsp + 0x60], rax
movzx edi, byte [rcx]
mov rbp, r9
mov r10, qword [rsp + 0xe0]
mov r13, r9
mov r9, qword [rcx + 0x30]
mov r15, r8
mov rax, qword [rcx + 0x28]
mov r14, rdx
mov qword [rsp + 0x38], r9
mov rbx, rcx
mov qword [rsp + 0x40], r10
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x48], rax
test dil, 0x40
jne 0x7ff674b96ec8
lea rdx, [rcx + 0x10]
mov r8, r9
call rax
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r12d, 0xf
xor esi, esi
mov r8d, edi
mov eax, r12d
and r8d, 7
mov ecx, esi
sub eax, r8d
mov dword [rsp + 0x40], r8d
mov byte [rbx], r8b
cmp eax, r12d
jae 0x7ff674b96f08
mov edx, eax
add rdx, rbx
movzx eax, byte [rdx]
mov byte [rdx], sil
lea rdx, [rdx + 1]
or rcx, rax
shl rcx, 8
sub r8, 1
jne 0x7ff674b96ef1
movzx eax, byte [rbx + 0xf]
or rcx, rax
mov byte [rbx + 0xf], 1
cmp rcx, rbp
je 0x7ff674b96f22
mov eax, 0xffffffff
jmp 0x7ff674b9704d
mov rdi, rbp
shr rdi, 4
test rdi, rdi
je 0x7ff674b96fa3
lea rax, [rbx + 0x10]
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0x20], rbx
call r10
shl rdi, 4
add r14, rdi
add r15, rdi
sub rbp, rdi
je 0x7ff674b96ff9
shr rdi, 4
lea r8, [rbx + 0x10]
mov r9, 0xfffffffffffffff8
mov rdx, rsi
sub r9, rbx
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
add rdx, rax
movzx ecx, dil
add rdx, rcx
shr rdi, 8
mov byte [r8], dl
lea rax, [r9 + r8]
shr rdx, 8
test rax, rax
je 0x7ff674b96fa8
test rdi, rdi
jne 0x7ff674b96f70
test rdx, rdx
jne 0x7ff674b96f70
jmp 0x7ff674b96fa8
test r13, r13
je 0x7ff674b96ff9
mov rdi, qword [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov r13, qword [rsp + 0x48]
mov r8, rdi
mov rcx, rbx
call r13
test rbp, rbp
je 0x7ff674b96fea
mov rcx, rsi
nop dword [rax + rax]
movzx eax, byte [rcx + r14]
inc esi
xor al, byte [rsp + rcx + 0x50]
mov byte [rcx + r15], al
xor byte [rcx + rbx + 0x10], al
mov ecx, esi
cmp rcx, rbp
jb 0x7ff674b96fd0
lea rcx, [rbx + 0x10]
mov r8, rdi
mov rdx, rcx
call r13
jmp 0x7ff674b97003
mov r13, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
sub r12d, dword [rsp + 0x40]
cmp r12d, 0x10
jae 0x7ff674b97024
mov r8d, 0x10
mov ecx, r12d
sub r8d, r12d
add rcx, rbx
xor edx, edx
call fcn.7ff674cf66c0
mov r8, rdi
lea rdx, [rsp + 0x50]
mov rcx, rbx
call r13
mov rax, qword [rsp + 0x50]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x58]
xor qword [rbx + 0x18], rax
movzx eax, byte [rsp + 0x30]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.7ff674a3df50
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x7ff674b98ee0
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x7ff674b99049
mov eax, 8
call fcn.7ff674cf3860
sub rsp, rax
xor r10d, r10d
mov r11, rcx
cmp r8, rax
jb 0x7ff674b9901d
lea rcx, [r9 - 1]
lea rax, [rdx - 1]
add rcx, r8
add rax, r8
cmp r9, rax
ja 0x7ff674b98f21
cmp rcx, rdx
jae 0x7ff674b9901d
lea rax, [r8 - 1]
add rax, r11
cmp r9, rax
ja 0x7ff674b98f36
cmp rcx, r11
jae 0x7ff674b9901d
mov rcx, r11
mov qword [rsp + 0x10], rbx
sub rcx, rdx
mov qword [rsp], rdi
cmp r8, 0x40
jb 0x7ff674b98fd7
mov rbx, r8
mov qword [rsp + 0x18], rsi
and ebx, 0x3f
mov rdi, r8
sub rdi, rbx
mov rsi, r9
lea rax, [rdx + 0x10]
sub rsi, rdx
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r10, 0x40
movdqu xmm1, xmmword [rcx + rax - 0x10]
movdqu xmm2, xmmword [rcx + rax]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rsi + rax - 0x50], xmm1
xorps xmm2, xmm0
movdqu xmm0, xmmword [rcx + rax - 0x30]
movdqu xmm1, xmmword [rax - 0x30]
movdqu xmmword [rsi + rax - 0x40], xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rcx + rax - 0x20]
movdqu xmm2, xmmword [rax - 0x20]
movdqu xmmword [rsi + rax - 0x30], xmm1
xorps xmm2, xmm0
movdqu xmmword [rsi + rax - 0x20], xmm2
cmp r10, rdi
jb 0x7ff674b98f70
mov rsi, qword [rsp + 0x18]
cmp rbx, 8
jb 0x7ff674b9900f
mov rbx, r8
and rbx, 0xfffffffffffffff8
mov rdi, r9
lea rax, [r10 + rdx]
sub rdi, rdx
nop dword [rax + rax]
movq xmm1, qword [rax + rcx]
add r10, 8
movq xmm0, qword [rax]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rdi + rax - 8], xmm1
cmp r10, rbx
jb 0x7ff674b98ff0
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r10, r8
jae 0x7ff674b99045
sub r11, rdx
lea rax, [r10 + rdx]
sub r9, rdx
sub r8, r10
nop word [rax + rax]
movzx ecx, byte [rax + r11]
xor cl, byte [rax]
mov byte [r9 + rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x7ff674b99030
add rsp, 8
ret
Function at 0x7ff674b99130
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
mov eax, 0x20
call fcn.7ff674cf3860
sub rsp, rax
mov rdi, qword [rcx + 0x28]
mov rbx, rdx
mov rbp, rcx
cmp rdx, rdi
ja 0x7ff674b9916e
shl rbx, 4
add rbx, qword [rcx + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov rcx, qword [rcx + 0x30]
cmp rbx, rcx
jb 0x7ff674b991ba
sub rdx, rcx
lea r8, [0x7ff674d5c518]
add rdx, 4
mov r9d, 0x71
and rdx, 0xfffffffffffffffc
add rdx, rcx
mov rcx, qword [rbp + 0x58]
mov qword [rbp + 0x30], rdx
shl rdx, 4
call fcn.7ff674b32f40
test rax, rax
jne 0x7ff674b991b6
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov qword [rbp + 0x58], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r12
mov r12, rbx
mov qword [rsp + 0x50], r15
mov r15, rdi
shl r15, 4
sub r12, rdi
nop word [rax + rax]
mov rcx, qword [rbp + 0x58]
mov edx, 1
add rcx, r15
movzx edi, byte [rcx]
lea rsi, [rcx + 0x10]
shr dil, 7
mov r8, rsi
neg dil
and dil, 0x87
call fcn.7ff674b98d30
xor byte [rsi + 0xf], dil
add r15, 0x10
sub r12, 1
jne 0x7ff674b991e0
mov r15, qword [rsp + 0x50]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov qword [rbp + 0x28], rbx
shl rbx, 4
add rbx, qword [rbp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x7ff674b99ad0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x28
call fcn.7ff674cf3860
sub rsp, rax
cmp dword [0x7ff67506f6b0], 0
jne 0x7ff674b99c50
mov qword [rsp + 0x40], rsi
lea r8d, [rax + 8]
mov qword [rsp + 0x48], rdi
lea rcx, [0x7ff674d5c548]
mov qword [rsp + 0x30], rbx
lea rdi, [0x7ff67506f650]
mov rdx, rdi
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x20], r14
mov dword [0x7ff67506f6b0], 1
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
dec eax
cmp eax, 0x2e
ja 0x7ff674b99c12
movzx ebx, word [0x7ff67506f650]
xor ebp, ebp
cmp bx, 0x7e
mov ecx, ebp
mov r14d, 2
cmove ecx, r14d
add rcx, rdi
call fcn.7ff674b99c60
mov rsi, rax
cmp bx, 0x7e
jne 0x7ff674b99b91
lea rcx, [0x7ff675072550]
mov rbx, rax
call fcn.7ff674881030
not rsi
movabs rcx, 0xedfff7fdffffffff
and rax, rsi
and ebx, 0x1000000
mov rsi, rax
and rsi, rcx
test rbx, rbx
cmove rsi, rax
jmp 0x7ff674b99baa
cmp word [0x7ff67506f650], 0x3a
jne 0x7ff674b99baa
lea rcx, [0x7ff675072550]
call fcn.7ff674881030
mov rsi, rax
movzx eax, word [0x7ff67506f650]
test ax, ax
je 0x7ff674b99bc8
lea rdi, [rdi + 2]
cmp ax, 0x3a
je 0x7ff674b99bd1
movzx eax, word [rdi]
test ax, ax
jne 0x7ff674b99bb6
mov qword [0x7ff675072558], rbp
jmp 0x7ff674b99c21
movzx ebx, word [rdi]
cmp bx, 0x7e
cmove rbp, r14
lea rcx, [rdi + rbp]
call fcn.7ff674b99c60
mov rcx, rax
shr rcx, 0x20
cmp bx, 0x7e
jne 0x7ff674b99c04
not eax
not ecx
and dword [0x7ff675072558], eax
and dword [0x7ff67507255c], ecx
jmp 0x7ff674b99c21
mov dword [0x7ff675072558], eax
mov dword [0x7ff67507255c], ecx
jmp 0x7ff674b99c21
lea rcx, [0x7ff675072550]
call fcn.7ff674881030
mov rsi, rax
mov r14, qword [rsp + 0x20]
mov eax, esi
mov rdi, qword [rsp + 0x48]
bts eax, 0xa
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
shr rsi, 0x20
mov dword [0x7ff675072554], esi
mov rsi, qword [rsp + 0x40]
mov dword [0x7ff675072550], eax
add rsp, 0x28
ret