joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000ef6c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov edx, dword [rcx]
mov r10d, 0x138
mov r8, rcx
xorps xmm1, xmm1
cmp edx, r10d
jne 0x14000efdd
lea r9, [rcx + 0x10]
movabs rbx, 0xb5026f5aa96619e9
mov r11, 0xffffffff80000000
mov rdx, qword [r9]
xor rdx, qword [r9 - 8]
and rdx, r11
xor rdx, qword [r9]
lea r9, [r9 + 8]
mov al, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rbx
xor rcx, qword [r9 + 0x4d0]
xor rcx, rdx
mov qword [r9 + 0x9b0], rcx
sub r10, 1
jne 0x14000ef9e
mov edx, dword [r8]
jmp 0x14000f0c3
cmp edx, 0x270
jb 0x14000f0c3
lea r10, [rcx + 0x9c8]
mov edi, 0x9c
mov r9, qword [r10]
movabs rbx, 0xb5026f5aa96619e9
mov r11, 0xffffffff80000000
mov rdx, r10
add r10, 8
xor r9, qword [r10]
and r9, r11
xor r9, qword [r10]
mov al, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, rbx
xor rcx, qword [rdx + 0x4e0]
xor rcx, r9
mov r9, qword [r10]
mov qword [rdx - 0x9c0], rcx
sub rdi, 1
jne 0x14000f009
lea r10, [r8 + 0xea8]
mov edi, 0x9b
mov r9, qword [r10]
mov rdx, r10
add r10, 8
xor r9, qword [r10]
and r9, r11
xor r9, qword [r10]
mov al, r9b
and al, 1
neg al
sbb rcx, rcx
shr r9, 1
and rcx, rbx
xor rcx, qword [rdx - 0xea0]
xor rcx, r9
mov r9, qword [r10]
mov qword [rdx - 0x9c0], rcx
sub rdi, 1
jne 0x14000f052
mov rdx, qword [r8 + 8]
xor rdx, qword [r8 + 0x1380]
and rdx, r11
xor rdx, qword [r8 + 8]
mov al, dl
and al, 1
neg al
sbb rcx, rcx
shr rdx, 1
and rcx, rbx
xor rcx, qword [r8 + 0x4e0]
xor rcx, rdx
xor edx, edx
mov qword [r8 + 0x9c0], rcx
mov dword [r8], edx
mov eax, edx
xorps xmm0, xmm0
mov rcx, qword [r8 + rax*8 + 8]
lea eax, [rdx + 1]
mov dword [r8], eax
movabs rdx, 0x38eb3ffff6d3
mov rax, rcx
shr rax, 0x1d
and rax, qword [r8 + 0x1388]
xor rcx, rax
mov rax, rcx
and rax, rdx
shl rax, 0x11
xor rcx, rax
mov rax, rcx
and rax, 0xffffffffffffbf77
shl rax, 0x25
xor rcx, rax
mov rdx, rcx
shr rdx, 0x2b
xor rdx, rcx
js 0x14000f11e
cvtsi2sd xmm0, rdx
jmp 0x14000f133
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2sd xmm0, rax
addsd xmm0, xmm0
mov rbx, qword [rsp + 8]
subsd xmm0, xmm1
mov rdi, qword [rsp + 0x10]
addsd xmm0, xmm1
mulsd xmm0, qword [0x1404470a0]
ret
Function at 0x140012c88
Capabilities:
Create service
Modify service
Start service

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x70
mov rbp, rcx
mov rsi, rdx
mov rcx, rdx
call fcn.140012e14
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
lea r8, [rax - 1]
cmp r8, 0xfffffffffffffffd
ja 0x140012d4e
mov r8d, 0x10
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
xor r14d, r14d
mov rbx, rax
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x140012d6b
mov qword [rsp + 0x60], r14
lea r9d, [r14 + 0x10]
mov qword [rsp + 0x58], r14
mov r8, rsi
mov qword [rsp + 0x50], r14
mov rdx, rsi
mov qword [rsp + 0x48], r14
mov rcx, rdi
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rbx, rax
dec rax
cmp rax, 0xfffffffffffffffd
jbe 0x140012d6b
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x140012df6
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov r8d, 0x12
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rsp + 0x50], r14
or edx, 0xffffffff
mov qword [rsp + 0x48], r14
mov r9d, edx
mov qword [rsp + 0x40], r14
mov r8d, 3
mov qword [rsp + 0x38], r14
mov rcx, rax
mov qword [rsp + 0x30], r14
mov rbx, rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
je 0x140012df6
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x140012df6
mov rcx, rsi
call fcn.140012e14
jmp 0x140012d4e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
jmp 0x140012d50

Function at 0x140012e14
Capabilities:
Delete service
Stop service

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x140451040]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
mov rbx, rcx
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov r8d, 0x10022
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140380350
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140012ed4
Capabilities:
Print debug messages

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x80
mov rax, qword [0x140451040]
xor rax, rsp
mov qword [rsp + 0x78], rax
and qword [r11 - 0x28], 0
lea r10, [r11 - 0x18]
mov rax, qword [rsp + 0xb0]
mov qword [r11 - 0x30], r10
mov qword [r11 - 0x38], rax
and qword [r11 - 0x40], 0
and dword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x800
mov qword [r11 - 0x58], r9
xor r9d, r9d
mov qword [r11 - 0x60], r8
xor r8d, r8d
and qword [r11 - 0x68], 0
call qword [sym.imp.d3dx11_43.dll_D3DX11CompileFromMemory]
mov rcx, qword [rsp + 0x70]
mov ebx, eax
test eax, eax
jns 0x140012f65
test rcx, rcx
je 0x140012f61
mov rdx, qword [rcx]
call qword [rdx + 0x18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140012f61
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, ebx
jmp 0x140012f72
test rcx, rcx
je 0x140012f70
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140380350
add rsp, 0x80
pop rbx
ret
Function at 0x14004645c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x140046477
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0xe
jb 0x140046464
mov byte [rcx + 0xf], 0
mov rax, rcx
ret

Function at 0x14004647c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x140046497
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0xb
jb 0x140046484
mov byte [rcx + 0xc], 0
mov rax, rcx
ret

Function at 0x14004649c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x1400464b7
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 9
jb 0x1400464a4
mov byte [rcx + 0xa], 0
mov rax, rcx
ret

Function at 0x1400464bc
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x1400464d7
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0xf
jb 0x1400464c4
mov byte [rcx + 0x10], 0
mov rax, rcx
ret

Function at 0x1400464dc
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x1400464f7
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0xa
jb 0x1400464e4
mov byte [rcx + 0xb], 0
mov rax, rcx
ret

Function at 0x1400464fc
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
je 0x140046517
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x13
jb 0x140046504
mov byte [rcx + 0x14], 0
mov rax, rcx
ret

Function at 0x14004651c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
je 0x140046537
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x12
jb 0x140046524
mov byte [rcx + 0x13], 0
mov rax, rcx
ret

Function at 0x14004653c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x140046557
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x11
jb 0x140046544
mov byte [rcx + 0x12], 0
mov rax, rcx
ret

Function at 0x14004655c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x140046577
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x14
jb 0x140046564
mov byte [rcx + 0x15], 0
mov rax, rcx
ret

Function at 0x14004657c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x140046597
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0xc
jb 0x140046584
mov byte [rcx + 0xd], 0
mov rax, rcx
ret

Function at 0x14004659c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
je 0x1400465b7
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x1b
jb 0x1400465a4
mov byte [rcx + 0x1c], 0
mov rax, rcx
ret

Function at 0x1400465bc
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x1400465d7
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x10
jb 0x1400465c4
mov byte [rcx + 0x11], 0
mov rax, rcx
ret
Function at 0x1400465dc
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x1400465f7
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0xd
jb 0x1400465e4
mov byte [rcx + 0xe], 0
mov rax, rcx
ret

Function at 0x1400465fc
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x17], 0
je 0x140046617
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x16
jb 0x140046604
mov byte [rcx + 0x17], 0
mov rax, rcx
ret

Function at 0x14004661c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1a], 0
je 0x140046637
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x19
jb 0x140046624
mov byte [rcx + 0x1a], 0
mov rax, rcx
ret

Function at 0x14004663c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1d], 0
je 0x140046657
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x1c
jb 0x140046644
mov byte [rcx + 0x1d], 0
mov rax, rcx
ret

Function at 0x14004665c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x140046677
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 3
jb 0x140046664
mov byte [rcx + 4], 0
mov rax, rcx
ret

Function at 0x14004667c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x140046697
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x17
jb 0x140046684
mov byte [rcx + 0x18], 0
mov rax, rcx
ret

Function at 0x14004669c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x1400466b7
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 4
jb 0x1400466a4
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x1400466bc
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1b], 0
je 0x1400466d7
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x1a
jb 0x1400466c4
mov byte [rcx + 0x1b], 0
mov rax, rcx
ret

Function at 0x1400466dc
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6a], 0
je 0x1400466f7
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x69
jb 0x1400466e4
mov byte [rcx + 0x6a], 0
mov rax, rcx
ret

Function at 0x1400466fc
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x140046717
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 8
jb 0x140046704
mov byte [rcx + 9], 0
mov rax, rcx
ret

Function at 0x14004671c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x140046737
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 7
jb 0x140046724
mov byte [rcx + 8], 0
mov rax, rcx
ret

Function at 0x14004673c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x16], 0
je 0x140046757
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x15
jb 0x140046744
mov byte [rcx + 0x16], 0
mov rax, rcx
ret
Function at 0x14004675c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x140046777
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 5
jb 0x140046764
mov byte [rcx + 6], 0
mov rax, rcx
ret

Function at 0x14004677c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x140046797
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 6
jb 0x140046784
mov byte [rcx + 7], 0
mov rax, rcx
ret

Function at 0x1400656c4
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x31], 0
je 0x1400656df
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x30
jb 0x1400656cc
mov byte [rcx + 0x31], 0
ret

Function at 0x1400656e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x1400656fb
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 5
jb 0x1400656e8
mov byte [rcx + 6], 0
ret

Function at 0x1400656fc
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x16], 0
je 0x140065717
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x15
jb 0x140065704
mov byte [rcx + 0x16], 0
ret

Function at 0x140065718
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x140065733
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 7
jb 0x140065720
mov byte [rcx + 8], 0
ret

Function at 0x140065734
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x14006574f
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 8
jb 0x14006573c
mov byte [rcx + 9], 0
ret

Function at 0x140065750
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1b], 0
je 0x14006576b
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x1a
jb 0x140065758
mov byte [rcx + 0x1b], 0
ret

Function at 0x14006576c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x17], 0
je 0x140065787
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x16
jb 0x140065774
mov byte [rcx + 0x17], 0
ret

Function at 0x140065788
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x1400657a3
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0xd
jb 0x140065790
mov byte [rcx + 0xe], 0
ret

Function at 0x1400657a4
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x1400657bf
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x10
jb 0x1400657ac
mov byte [rcx + 0x11], 0
ret

Function at 0x1400657c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x1400657db
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0xc
jb 0x1400657c8
mov byte [rcx + 0xd], 0
ret

Function at 0x1400657dc
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x1400657f7
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x14
jb 0x1400657e4
mov byte [rcx + 0x15], 0
ret
Function at 0x1400657f8
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x140065813
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x11
jb 0x140065800
mov byte [rcx + 0x12], 0
ret

Function at 0x140065814
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
je 0x14006582f
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x12
jb 0x14006581c
mov byte [rcx + 0x13], 0
ret

Function at 0x140065830
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
je 0x14006584b
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0x13
jb 0x140065838
mov byte [rcx + 0x14], 0
ret

Function at 0x14006584c
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x140065867
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0xa
jb 0x140065854
mov byte [rcx + 0xb], 0
ret

Function at 0x140065868
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x140065883
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0xf
jb 0x140065870
mov byte [rcx + 0x10], 0
ret

Function at 0x140065884
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x14006589f
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 9
jb 0x14006588c
mov byte [rcx + 0xa], 0
ret

Function at 0x1400658a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x1400658bb
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0xb
jb 0x1400658a8
mov byte [rcx + 0xc], 0
ret

Function at 0x1400658bc
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x1400658d7
xor edx, edx
lea eax, [rdx - 0x13]
xor byte [rcx + rdx], al
inc rdx
cmp rdx, 0xe
jb 0x1400658c4
mov byte [rcx + 0xf], 0
ret
Function at 0x140066274
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r15, rdx
mov r14, rcx
xor edx, edx
mov rcx, r15
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
xor edi, edi
test eax, eax
jne 0x140066311
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rbx, eax
test eax, eax
js 0x140066311
jne 0x1400662bc
xor eax, eax
jmp 0x140066316
lea eax, [rbx + 1]
movsxd rcx, eax
lea rdx, [0x140383b40]
call fcn.140380720
mov rsi, rax
test rax, rax
jne 0x1400662db
lea eax, [rsi - 2]
jmp 0x140066316
xor r8d, r8d
mov byte [rbx + rax], dil
xor edx, edx
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov r9, r15
mov r8, rbx
mov edx, 1
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r15, rax
cmp rax, rbx
je 0x14006632e
mov rcx, rsi
call fcn.1403805b0
mov eax, 0xfffffffd
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r13, rsi
cmp r15, 3
jb 0x140066356
cmp word [rsi], 0xbbef
jne 0x14006635f
cmp byte [rsi + 2], 0xbf
jne 0x14006635f
add r15, 0xfffffffffffffffd
lea r13, [rsi + 3]
cmp qword [r14], rdi
jne 0x140066356
mov byte [r14 + 0x38], 1
test r15, r15
je 0x1400664a6
cmp r15, 0xffffffffffffffff
jne 0x14006636d
or edi, r15d
jmp 0x1400664a6
lea r12, [r15 + 1]
mov rcx, r12
lea rdx, [0x140383b40]
call fcn.140380720
mov rbx, rax
test rax, rax
jne 0x140066390
lea edi, [rax - 2]
jmp 0x1400664a6
mov r8, r12
xor edx, edx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memset
mov r8, r15
mov rdx, r13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r15, qword [r14]
lea r13, [r14 + 0x10]
test r15, r15
mov qword [rbp - 8], rbx
lea rax, [0x14043c9b2]
mov qword [rbp - 0x18], rdi
setne byte [rbp + 0x50]
mov qword [rbp - 0x10], rax
mov qword [rbp - 0x20], rdi
mov qword [rbp + 0x58], rdi
cmp qword [r13], rdi
jne 0x14006640d
xor r9d, r9d
mov byte [rsp + 0x20], dil
mov r8, r13
lea rdx, [rbp - 8]
call fcn.140068a78
test al, al
je 0x14006640d
test r15, r15
je 0x14006640d
mov rdx, r13
mov rcx, r14
call fcn.140067a88
test eax, eax
jns 0x14006640d
mov edi, eax
jmp 0x1400664a6
lea rax, [rbp + 0x58]
mov rcx, r14
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x18]
lea rax, [rbp - 0x20]
lea r8, [rbp - 0x10]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 8]
call fcn.1400685d4
test al, al
je 0x140066490
mov r13b, byte [rbp + 0x50]
mov rax, qword [rbp + 0x58]
mov rcx, r14
mov r9, qword [rbp - 0x20]
mov r8, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
mov byte [rsp + 0x30], r13b
mov byte [rsp + 0x28], dil
mov qword [rsp + 0x20], rax
call fcn.140066610
test eax, eax
js 0x140066406
lea rax, [rbp + 0x58]
mov rcx, r14
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x18]
lea rax, [rbp - 0x20]
lea r8, [rbp - 0x10]
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 8]
call fcn.1400685d4
test al, al
jne 0x14006643b
test r15, r15
je 0x14006649f
mov rcx, rbx
call fcn.1403805b0
jmp 0x1400664a6
mov qword [r14], rbx
mov qword [r14 + 8], r12
mov rcx, rsi
call fcn.1403805b0
mov eax, edi
jmp 0x140066316
Function at 0x14006ad88
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x14006ade2
mov r11b, 0x23
lea rbx, [0x1403e6fd0]
movzx edi, byte [r10]
dec rdx
inc r10
cmp dil, r11b
jne 0x14006adcc
cmp rdx, 2
jb 0x14006adcc
cmp byte [r10], r11b
jne 0x14006adcc
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rdi
shr r9d, 8
xor r9d, dword [rbx + rcx*4]
test rdx, rdx
jne 0x14006adaa
jmp 0x14006ae23
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x14006ae23
mov r11b, 0x23
lea rbx, [0x1403e6fd0]
cmp dl, r11b
jne 0x14006ae07
cmp byte [r10], r11b
jne 0x14006ae07
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rbx + rcx*4]
test dl, dl
jne 0x14006adf5
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret

Function at 0x14006af58
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
test r8, r8
je 0x14006af78
and qword [r8], 0
lea rdx, [0x140444964]
call fcn.14006ae34
mov rbx, rax
test rax, rax
je 0x14006b069
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x14006b060
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14006b060
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14006b060
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14006b060
mov rbp, rdi
cmp rdi, 0xffffffffffffffff
je 0x14006b060
mov rax, qword [0x1404ad5b0]
test rax, rax
je 0x14006affd
inc dword [rax + 0xf4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x14006b060
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x14006b04d
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1404ad5b0]
test rax, rax
je 0x14006b042
dec dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14006b069
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rsi, rsi
je 0x14006b05b
mov qword [rsi], rbp
mov rax, rdi
jmp 0x14006b06b
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret