joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140064930
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rbp, rdx
mov rdi, rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov qword [rcx], r12
mov qword [rcx + 8], r12
mov qword [rcx + 0x10], r12
mov dword [rsp + 0x20], 1
test rdx, rdx
je 0x140064a8c
movabs rax, 0x1fffffffffffffff
cmp rdx, rax
ja 0x140064aa9
call fcn.140064850
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14d, dword [rsp + 0x2c]
lea r15, [r14 + r14*2]
nop dword [rax]
mov r9d, 4
mov r8d, 0x3000
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x140064a80
lea rsi, [rax + r14]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualLock]
mov rcx, rbx
test eax, eax
jne 0x1400649ed
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x140064a80
mov r8, r15
xor edx, edx
call fcn.140154200
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0xa8], r12d
mov edx, dword [rsp + 0x2c]
lea r9, [rsp + 0xa8]
mov r8d, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [rsp + 0xb0], r12d
mov edx, dword [rsp + 0x2c]
lea rcx, [rbx + r14*2]
lea r9, [rsp + 0xb0]
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov qword [rsp + 0xb8], rsi
mov rdx, qword [rdi + 8]
cmp rdx, qword [rdi + 0x10]
je 0x140064a70
mov qword [rdx], rsi
add qword [rdi + 8], 8
jmp 0x140064a80
lea r8, [rsp + 0xb8]
mov rcx, rdi
call fcn.140064650
sub rbp, 1
jne 0x1400649a0
jmp 0x140064a97
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rax, rdi
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.14003f4e0
int3
Function at 0x140064ab0
Capabilities:
Get system information on windows

Disassembly:
push rbp
push rsi
push r14
push r15
sub rsp, 0x58
mov rsi, rcx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov rcx, qword [rsi]
xor r15d, r15d
mov rax, qword [rsi + 8]
mov r14d, r15d
mov ebp, dword [rsp + 0x24]
sub rax, rcx
cmp rax, 8
jb 0x140064bb5
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x50], rdi
nop dword [rax]
nop dword [rax + rax]
mov rbx, qword [rcx + r14*8]
xor eax, eax
mov rdi, rbx
mov rcx, rbp
rep stosb byte [rdi], al
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x24]
lea r9, [rsp + 0x80]
mov rdi, rbx
mov dword [rsp + 0x80], r15d
sub rdi, rbp
mov r8d, 4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x24]
lea rcx, [rbx + rbp]
lea r9, [rsp + 0x88]
mov dword [rsp + 0x88], r15d
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualUnlock]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsi]
inc r14
mov rax, qword [rsi + 8]
sub rax, rcx
sar rax, 3
cmp r14, rax
jne 0x140064b00
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x90]
add rsp, 0x58
pop r15
pop r14
pop rsi
pop rbp
ret

Function at 0x140064c20
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
test eax, eax
je 0x140064c7e
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x24]
imul rcx, rax, 0xb
mov rax, qword [rsp + 0x60]
cmp rax, rcx
jbe 0x140064c7e
sub rax, rcx
mov ecx, 0x80000
cmp rax, rcx
cmova rax, rcx
add rsp, 0x58
ret
xor eax, eax
add rsp, 0x58
ret
Function at 0x1400657c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [rcx + 0x30]
mov r15, r9
mov r14, r8
mov rsi, rdx
mov rdi, rcx
cmp qword [rcx + 0x28], rax
jne 0x1400657f3
call fcn.140041540
mov rbx, qword [rdi + 0x48]
mov rcx, qword [rdi + 0x40]
mov rax, rbx
mov rbp, qword [rdi + 0x58]
sub rax, rcx
sub rax, rbp
cmp r15, rax
jb 0x14006592f
mov rdx, rbp
xor ebp, ebp
nop word [rax + rax]
sub rbx, rcx
lea r8, [rcx + rdx]
sub rbx, rdx
mov r9, rbx
mov rdx, rbx
and r9d, 0x1f
sub rdx, r9
je 0x1400658c4
mov r11, rsi
mov r10, r14
sub r11, r8
mov rcx, r8
sub r10, r8
nop dword [rax]
movups xmm0, xmmword [r11 + rcx]
mov rax, rbp
movups xmm1, xmmword [r11 + rcx + 0x10]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm1
nop dword [rax]
movdqu xmm0, xmmword [rsp + rax + 0x20]
movdqu xmm1, xmmword [rsp + rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax + 0x20], xmm1
add rax, 0x10
cmp rax, 0x20
jl 0x140065880
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [r10 + rcx], xmm0
movups xmmword [r10 + rcx + 0x10], xmm1
add rcx, 0x20
mov rax, rcx
sub rax, r8
cmp rax, rdx
jne 0x140065850
cmp rdx, rbx
je 0x1400658f4
lea rcx, [rdx + rsi]
sub r8, rsi
mov rdx, r14
sub rdx, rsi
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor al, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x1400658e0
mov r9, qword [rdi + 8]
mov rcx, rdi
mov r8, qword [rdi + 0x28]
mov rdx, qword [rdi + 0x40]
call fcn.140065330
sub r15, rbx
mov qword [rdi + 0x58], rbp
mov rcx, qword [rdi + 0x40]
add rsi, rbx
add r14, rbx
mov rdx, rbp
mov rbx, qword [rdi + 0x48]
mov rax, rbx
sub rax, rcx
cmp r15, rax
jae 0x140065820
lea r8, [rcx + rbp]
mov r9, r15
mov rcx, r14
mov rdx, rsi
call fcn.14004bbb0
add qword [rdi + 0x58], r15
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140066790
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [rcx + 0x28]
mov r15, r9
mov r14, r8
mov rbp, rdx
mov rdi, rcx
cmp qword [rcx + 0x20], rax
jne 0x1400667c3
call fcn.140041540
mov rbx, qword [rdi + 0x40]
mov rcx, qword [rdi + 0x38]
mov rax, rbx
mov rsi, qword [rdi + 0x50]
sub rax, rcx
sub rax, rsi
cmp r15, rax
jb 0x140066914
mov rdx, rsi
xor esi, esi
nop word [rax + rax]
sub rbx, rcx
lea r8, [rcx + rdx]
sub rbx, rdx
mov r9, rbx
mov rdx, rbx
and r9d, 0x1f
sub rdx, r9
je 0x140066894
mov r11, rbp
mov r10, r14
sub r11, r8
mov rcx, r8
sub r10, r8
nop dword [rax]
movups xmm0, xmmword [r11 + rcx]
mov rax, rsi
movups xmm1, xmmword [r11 + rcx + 0x10]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm1
nop dword [rax]
movdqu xmm0, xmmword [rsp + rax + 0x20]
movdqu xmm1, xmmword [rsp + rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax + 0x20], xmm1
add rax, 0x10
cmp rax, 0x20
jl 0x140066850
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [r10 + rcx], xmm0
movups xmmword [r10 + rcx + 0x10], xmm1
add rcx, 0x20
mov rax, rcx
sub rax, r8
cmp rax, rdx
jne 0x140066820
cmp rdx, rbx
je 0x1400668c4
lea rcx, [rdx + rbp]
sub r8, rbp
mov rdx, r14
sub rdx, rbp
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor al, byte [rcx]
mov byte [rcx + rdx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x1400668b0
mov rdx, qword [rdi + 0x20]
mov r8d, reloc.WS2_32.dll_sendto
mov rcx, qword [rdi + 0x38]
call fcn.140066d90
mov rax, qword [rdi + 0x20]
mov rdx, rsi
inc dword [rax + 0x20]
mov eax, esi
mov rcx, qword [rdi + 0x20]
cmp dword [rcx + 0x20], eax
sete al
sub r15, rbx
add dword [rcx + 0x24], eax
add rbp, rbx
mov qword [rdi + 0x50], rsi
add r14, rbx
mov rbx, qword [rdi + 0x40]
mov rcx, qword [rdi + 0x38]
mov rax, rbx
sub rax, rcx
cmp r15, rax
jae 0x1400667f0
lea r8, [rcx + rsi]
mov r9, r15
mov rcx, r14
mov rdx, rbp
call fcn.14004bbb0
add qword [rdi + 0x50], r15
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x140066a60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x18
mov eax, dword [rdx + 0x34]
mov r8d, dword [rdx]
mov r14d, dword [rdx + 4]
mov r15d, dword [rdx + 8]
mov r12d, dword [rdx + 0xc]
mov ebp, dword [rdx + 0x10]
mov r9d, dword [rdx + 0x14]
mov r10d, dword [rdx + 0x18]
mov r11d, dword [rdx + 0x1c]
mov ebx, dword [rdx + 0x20]
mov edi, dword [rdx + 0x24]
mov esi, dword [rdx + 0x28]
mov r13d, dword [rdx + 0x2c]
mov ecx, dword [rdx + 0x30]
mov dword [rsp + 0x68], eax
mov eax, dword [rdx + 0x38]
mov edx, dword [rdx + 0x3c]
mov dword [rsp + 0x70], eax
mov qword [rsp + 8], 0xa
nop dword [rax]
lea eax, [rcx + r8]
rol eax, 7
xor ebp, eax
lea eax, [r8 + rbp]
rol eax, 9
xor ebx, eax
lea eax, [rbx + rbp]
rol eax, 0xd
xor ecx, eax
lea eax, [rcx + rbx]
ror eax, 0xe
xor r8d, eax
lea eax, [r9 + r14]
rol eax, 7
xor edi, eax
lea eax, [rdi + r9]
rol eax, 9
xor dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
add eax, edi
rol eax, 0xd
xor r14d, eax
mov eax, dword [rsp + 0x68]
add eax, r14d
ror eax, 0xe
xor r9d, eax
lea eax, [rsi + r10]
rol eax, 7
xor dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x70]
add eax, esi
rol eax, 9
xor r15d, eax
mov eax, dword [rsp + 0x70]
add eax, r15d
rol eax, 0xd
xor r10d, eax
lea eax, [r10 + r15]
ror eax, 0xe
xor esi, eax
lea eax, [rdx + r13]
rol eax, 7
xor r12d, eax
lea eax, [rdx + r12]
rol eax, 9
xor r11d, eax
lea eax, [r11 + r12]
rol eax, 0xd
xor r13d, eax
lea eax, [r11 + r13]
ror eax, 0xe
xor edx, eax
lea eax, [r12 + r8]
rol eax, 7
xor r14d, eax
mov dword [rsp], r14d
lea eax, [r14 + r8]
rol eax, 9
xor r15d, eax
lea eax, [r15 + r14]
rol eax, 0xd
xor r12d, eax
lea eax, [r12 + r15]
ror eax, 0xe
xor r8d, eax
lea eax, [r9 + rbp]
rol eax, 7
xor r10d, eax
lea eax, [r10 + r9]
rol eax, 9
xor r11d, eax
lea eax, [r11 + r10]
rol eax, 0xd
xor ebp, eax
lea eax, [r11 + rbp]
ror eax, 0xe
xor r9d, eax
lea eax, [rsi + rdi]
rol eax, 7
xor r13d, eax
lea eax, [rsi + r13]
mov r14d, dword [rsp + 0x70]
rol eax, 9
xor ebx, eax
lea eax, [rbx + r13]
rol eax, 0xd
xor edi, eax
lea eax, [rdi + rbx]
ror eax, 0xe
xor esi, eax
mov eax, dword [rsp + 0x70]
add eax, edx
rol eax, 7
xor ecx, eax
lea eax, [rdx + rcx]
rol eax, 9
xor dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
add eax, ecx
rol eax, 0xd
xor r14d, eax
mov eax, dword [rsp + 0x68]
add eax, r14d
mov dword [rsp + 0x70], r14d
mov r14d, dword [rsp]
ror eax, 0xe
xor edx, eax
sub qword [rsp + 8], 1
jne 0x140066ac0
mov rcx, qword [rsp + 0x60]
mov dword [rcx], r8d
mov dword [rcx + 4], r9d
mov dword [rcx + 8], esi
mov dword [rcx + 0xc], edx
mov dword [rcx + 0x10], r10d
mov dword [rcx + 0x14], r11d
mov dword [rcx + 0x18], ebx
mov dword [rcx + 0x1c], edi
add rsp, 0x18
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140067770
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r14
push r15
sub rsp, 0x60
mov rax, qword [rcx + 0x10]
mov r14, r9
mov r15, r8
mov rbp, rdx
mov rbx, rcx
cmp qword [rcx + 8], rax
jne 0x14006779e
call fcn.140041540
mov rdi, qword [rbx + 0x38]
mov eax, 0xa8
sub rax, rdi
cmp r14, rax
jb 0x140067900
mov rcx, rdi
mov qword [rsp + 0x80], rsi
xor edi, edi
mov r8, qword [rbx + 0x20]
mov esi, 0xa8
sub rsi, rcx
add r8, rcx
mov r9, rsi
mov rdx, rsi
and r9d, 0x1f
sub rdx, r9
je 0x140067864
mov r11, rbp
mov r10, r15
sub r11, r8
mov rcx, r8
sub r10, r8
movups xmm0, xmmword [r11 + rcx]
mov rax, rdi
movups xmm1, xmmword [r11 + rcx + 0x10]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm1
nop word [rax + rax]
movdqu xmm0, xmmword [rsp + rax + 0x20]
movdqu xmm1, xmmword [rsp + rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax + 0x20], xmm1
add rax, 0x10
cmp rax, 0x20
jl 0x140067820
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [r10 + rcx], xmm0
movups xmmword [r10 + rcx + 0x10], xmm1
add rcx, 0x20
mov rax, rcx
sub rax, r8
cmp rax, rdx
jne 0x1400677f1
cmp rdx, rsi
je 0x140067894
lea rcx, [rdx + rbp]
sub r8, rbp
mov rdx, r15
sub rdx, rbp
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor al, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x140067880
mov rcx, qword [rbx + 0x38]
add r14, 0xffffffffffffff58
add r14, rcx
mov eax, 0xa8
sub rax, rcx
add rbp, rax
mov eax, 0xa8
sub rax, rcx
mov rcx, qword [rbx + 8]
add r15, rax
call fcn.1400580e0
mov rcx, qword [rbx + 8]
mov r8d, reloc.WS2_32.dll_setsockopt
mov rdx, qword [rbx + 0x20]
nop
mov rax, qword [rcx]
lea rcx, [rcx + 8]
mov qword [rdx], rax
lea rdx, [rdx + 8]
sub r8, 1
jne 0x1400678d0
mov qword [rbx + 0x38], rdi
mov rcx, rdi
cmp r14, 0xa8
jae 0x1400677c0
mov rsi, qword [rsp + 0x80]
mov r8, qword [rbx + 0x20]
mov r9, r14
add r8, rdi
mov rdx, rbp
mov rcx, r15
call fcn.14004bbb0
add qword [rbx + 0x38], r14
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x140069a70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, r9
mov rdi, rcx
shl rsi, 5
mov rdx, rbp
mov r8, rsi
mov rcx, r14
mov rbx, r9
call fcn.14004bc70
mov rax, qword [rdi]
mov r9, rbx
mov r8, r14
mov rdx, r14
mov rcx, rdi
call qword [rax + 0x40]
mov r8, rsi
mov rdx, rbp
mov rcx, r14
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.14004bc70
Function at 0x14006a9b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [rcx + 0x60]
mov r12, r9
mov r14, r8
mov rbp, rdx
mov rsi, rcx
cmp qword [rcx + 0x58], rax
jne 0x14006a9dd
call fcn.140041540
mov r13, qword [rsi + 0x40]
mov r15, qword [rsi + 0x48]
mov rax, qword [rsi + 0x70]
sub r15, r13
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], rdi
test rax, rax
je 0x14006aa5f
mov rdi, r15
lea r8, [rax + r13]
sub rdi, rax
mov rbx, r12
cmp rdi, r12
mov rdx, rbp
mov rcx, r14
cmovb rbx, rdi
mov r9, rbx
call fcn.14004bbb0
add qword [rsi + 0x70], rbx
sub r12, rbx
add rbp, rbx
add r14, rbx
cmp rbx, rdi
jne 0x14006aa5f
mov rdx, qword [rsi + 0x20]
mov rcx, rsi
call fcn.14006a7b0
mov rcx, qword [rsi + 8]
mov r9, qword [rsi + 0x20]
mov r8, qword [rsi + 0x40]
mov rdx, qword [rsi + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov qword [rsi + 0x70], 0
cmp r12, r15
jb 0x14006ab83
mov rax, r15
mov rbx, r15
and eax, 0x1f
mov rdi, r13
sub rbx, rax
mov qword [rsp + 0x90], rax
sub rdi, rbp
test rbx, rbx
je 0x14006ab1e
mov rdx, r13
mov rcx, r13
neg rdx
nop dword [rax]
nop dword [rax + rax]
lea rax, [rdx + rcx]
movups xmm0, xmmword [rax + rbp]
movups xmm1, xmmword [rax + rbp + 0x10]
xor eax, eax
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm1
nop word [rax + rax]
movdqu xmm0, xmmword [rsp + rax + 0x20]
movdqu xmm1, xmmword [rsp + rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax + 0x20], xmm1
add rax, 0x10
cmp rax, 0x20
jl 0x14006aad0
movups xmm0, xmmword [rsp + 0x20]
lea rax, [rdx + rcx]
add rcx, 0x20
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rax + r14], xmm0
movups xmmword [rax + r14 + 0x10], xmm1
lea rax, [rdx + rcx]
cmp rax, rbx
jne 0x14006aaa0
mov rax, qword [rsp + 0x90]
cmp rbx, r15
je 0x14006ab44
mov r8, r14
lea rcx, [rbx + rbp]
sub r8, rbp
mov rdx, rax
movzx eax, byte [rdi + rcx]
xor al, byte [rcx]
mov byte [r8 + rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14006ab30
mov rdx, qword [rsi + 0x20]
mov rcx, rsi
sub r12, r15
add rbp, r15
sub rdi, r15
add r14, r15
call fcn.14006a7b0
mov rcx, qword [rsi + 8]
mov r9, qword [rsi + 0x20]
mov r8, qword [rsi + 0x40]
mov rdx, qword [rsi + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov rax, qword [rsp + 0x90]
cmp r12, r15
jae 0x14006aa82
mov r9, r12
mov r8, r13
mov rdx, rbp
mov rcx, r14
call fcn.14004bbb0
add qword [rsi + 0x70], r12
mov rdi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x98]
mov rbp, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rsi
ret
Function at 0x14006ba60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r11, qword [rcx + 0x18]
mov rbx, r9
mov r10, qword [rcx + 0x10]
mov rax, r11
mov r14, qword [rcx + 0x28]
sub rax, r10
sub rax, r14
mov r12, r8
mov r15, rdx
mov r13, rcx
cmp r9, rax
jb 0x14006bc29
mov qword [rsp + 0x90], rbp
mov rcx, r14
mov qword [rsp + 0x98], rsi
xor r14d, r14d
mov qword [rsp + 0xa0], rdi
nop word [rax + rax]
sub r11, r10
lea rdx, [r10 + rcx]
sub r11, rcx
mov r8, r11
mov r9, r11
and r8d, 0x1f
sub r9, r8
je 0x14006bb6c
mov rbx, r15
mov r10, r12
sub rbx, rdx
mov rcx, rdx
sub r10, rdx
nop dword [rax]
movups xmm0, xmmword [rbx + rcx]
mov rax, r14
movups xmm1, xmmword [rbx + rcx + 0x10]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm1
nop word [rax + rax]
movdqu xmm0, xmmword [rsp + rax + 0x20]
movdqu xmm1, xmmword [rsp + rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax + 0x20], xmm1
add rax, 0x10
cmp rax, 0x20
jl 0x14006bb20
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [r10 + rcx], xmm0
movups xmmword [r10 + rcx + 0x10], xmm1
add rcx, 0x20
mov rax, rcx
sub rax, rdx
cmp rax, r9
jne 0x14006baf0
mov rbx, qword [rsp + 0xa8]
cmp r9, r11
je 0x14006bb94
lea rcx, [r9 + r15]
sub rdx, r15
mov r9, r12
sub r9, r15
nop
movzx eax, byte [rdx + rcx]
xor al, byte [rcx]
mov byte [r9 + rcx], al
lea rcx, [rcx + 1]
sub r8, 1
jne 0x14006bb80
mov rbp, qword [r13 + 0x10]
mov rsi, qword [r13 + 0x18]
mov rax, rbp
sub rax, rsi
add rax, qword [r13 + 0x28]
add rbx, rax
mov rax, rsi
sub rax, rbp
mov qword [rsp + 0xa8], rbx
mov rbx, qword [r13 + 8]
sub rax, qword [r13 + 0x28]
mov rcx, rbx
add r15, rax
add r12, rax
mov rdi, qword [rbx]
call qword [rdi + Ordinal_41]
xor edx, edx
sub rsi, rbp
mov r8, rax
mov rcx, rbx
mov rax, rsi
div r8
mov r8, rbp
mov rdx, rbp
mov r9, rax
call qword [rdi + 0x40]
mov rbx, qword [rsp + 0xa8]
mov rcx, r14
mov qword [r13 + 0x28], r14
mov r11, qword [r13 + 0x18]
mov r10, qword [r13 + 0x10]
mov rax, r11
sub rax, r10
cmp rbx, rax
jae 0x14006bac0
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
lea r8, [r10 + r14]
mov r9, rbx
mov rdx, r15
mov rcx, r12
call fcn.14004bbb0
add qword [r13 + 0x28], rbx
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rbx
ret
Function at 0x14006c340
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x60
mov rax, qword [rcx + 0x20]
mov r14, r9
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
cmp qword [rcx + 0x18], rax
jne 0x14006c370
call fcn.140041540
mov r11, qword [rsi + 0x38]
mov rdx, qword [rsi + 0x30]
mov rax, r11
mov rcx, qword [rsi + 0x48]
sub rax, rdx
sub rax, rcx
cmp r14, rax
jb 0x14006c4bf
mov qword [rsp + 0x70], rbx
nop dword [rax]
nop word [rax + rax]
sub r11, rdx
lea r8, [rdx + rcx]
sub r11, rcx
mov r9, r11
mov rdx, r11
and r9d, 0x1f
sub rdx, r9
je 0x14006c444
mov rbx, rdi
mov r10, rbp
sub rbx, r8
mov rcx, r8
sub r10, r8
nop dword [rax]
movups xmm0, xmmword [rbx + rcx]
xor eax, eax
movups xmm1, xmmword [rbx + rcx + 0x10]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm1
nop word [rax + rax]
movdqu xmm0, xmmword [rsp + rax + 0x20]
movdqu xmm1, xmmword [rsp + rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rsp + rax + 0x20], xmm1
add rax, 0x10
cmp rax, 0x20
jl 0x14006c400
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [r10 + rcx], xmm0
movups xmmword [r10 + rcx + 0x10], xmm1
add rcx, 0x20
mov rax, rcx
sub rax, r8
cmp rax, rdx
jne 0x14006c3d0
cmp rdx, r11
je 0x14006c474
lea rcx, [rdx + rdi]
sub r8, rdi
mov rdx, rbp
sub rdx, rdi
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor al, byte [rcx]
mov byte [rcx + rdx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x14006c460
mov r8, qword [rsi + 0x38]
mov rcx, rsi
mov rax, qword [rsi + 0x30]
sub rax, r8
sub r8, qword [rsi + 0x30]
sub r8, qword [rsi + 0x48]
add rax, qword [rsi + 0x48]
add rdi, r8
add rbp, r8
add r14, rax
call fcn.14006c590
mov r11, qword [rsi + 0x38]
mov rcx, qword [rsi + 0x48]
mov rax, r11
mov rdx, qword [rsi + 0x30]
sub rax, rcx
sub rax, rdx
cmp r14, rax
jae 0x14006c3a0
mov rbx, qword [rsp + 0x70]
lea r8, [rdx + rcx]
mov r9, r14
mov rdx, rdi
mov rcx, rbp
call fcn.14004bbb0
add qword [rsi + 0x48], r14
lea r11, [rsp + 0x60]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x14006c6f0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r15, rdx
mov rdi, rcx
mov edx, 0x100
add rcx, 0x18
mov rbp, r8
call fcn.14003aab0
mov edx, 0x100
lea rcx, [rdi + 0x30]
call fcn.14003aab0
xor ebx, ebx
mov word [rdi + 0x10], 0
mov qword [rdi + 0x48], rbx
mov eax, ebx
nop dword [rax + rax]
mov rcx, qword [rdi + 0x18]
mov byte [rax + rcx], al
inc rax
cmp rax, 0x100
jne 0x14006c740
mov r11, rbx
mov r10, rbx
nop dword [rax + rax]
mov r8, qword [rdi + 0x18]
xor edx, edx
mov rax, r10
div rbp
movzx r9d, byte [r8 + r10]
movzx ecx, byte [rdx + r15]
add rcx, r11
add rcx, r9
movzx r11d, cl
movzx eax, byte [r8 + r11]
mov byte [r8 + r10], al
inc r10
mov byte [r8 + r11], r9b
cmp r10, 0x100
jne 0x14006c760
nop dword [rax]
mov rcx, rdi
call fcn.14006c590
mov rcx, qword [rdi + 0x38]
sub rcx, qword [rdi + 0x30]
mov rax, qword [rdi + 8]
add rbx, rcx
cmp rbx, rax
jbe 0x14006c7a0
mov rbx, qword [rsp + 0x40]
xor edx, edx
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
div rcx
add qword [rdi + 0x48], rdx
add rsp, 0x20
pop r15
pop r14
pop rdi
ret