joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ca8d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x390
mov rax, qword [rcx]
nop dword [rax]
mov rdx, rax
xor r8d, r8d
test dl, 3
sete r8b
or r8, rax
or r8, 0x20
lock cmpxchg qword [rcx], r8
jne 0x6ca8e0
test dl, 3
je 0x6ca92f
mov rax, 0xffffffffffffffc0
lock xadd qword [rcx], rax
cmp rax, 0x3f
jbe 0x6ca9aa
and rax, 0xffffffffffffffc0
cmp rax, 0x40
jne 0x6ca99e
add rsp, 0x390
pop rbx
pop rdi
pop rsi
jmp sym._ZN4core3ptr224drop_in_place_LT_alloc..boxed..Box_LT_tokio..runtime..task..core..Cell_LT_xelis_miner..broadcast_stats_task.._u
movabs rbx, 0x8000000000000000
mov rdi, rcx
lea rsi, [rcx + 0x20]
lea rax, [rbx + 1]
mov qword [rsp + 0x1d8], rax
lea rdx, [rsp + 0x1d8]
mov rcx, rsi
call sym.tokio::runtime::task::core::Core_T_S_::set_stage::hc286717514fbfed4
xor eax, eax
mov rcx, qword [rdi + 0x28]
mov qword [rsp + 0x28], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x20], rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call sym.tokio::runtime::task::core::Core_T_S_::set_stage::hc286717514fbfed4
mov rcx, rdi
add rsp, 0x390
pop rbx
pop rdi
pop rsi
jmp sym.tokio::runtime::task::harness::Harness_T_S_::complete::hdbf609fd65a6aee0
nop
add rsp, 0x390
pop rbx
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.ref_count_____1
lea r8, [0x007b4e50]
mov edx, 0x27
call sym.core::panicking::panic::h8ea5606244902eff
mov rcx, rax
call sym.std::panicking::try::cleanup::h0bfda5eb954e6696
jmp 0x6ca95e

Function at 0x6ca9e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
mov eax, 0x5e48
call sym.___chkstk_ms
sub rsp, rax
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rdx, rax
xor r8d, r8d
test dl, 3
sete r8b
or r8, rax
or r8, 0x20
lock cmpxchg qword [rcx], r8
jne 0x6caa00
test dl, 3
je 0x6caa4e
mov rax, 0xffffffffffffffc0
lock xadd qword [rcx], rax
cmp rax, 0x3f
jbe 0x6caac1
and rax, 0xffffffffffffffc0
cmp rax, 0x40
jne 0x6caab6
add rsp, 0x5e48
pop rdi
pop rsi
jmp sym._ZN4core3ptr228drop_in_place_LT_alloc..boxed..Box_LT_tokio..runtime..task..core..Cell_LT_xelis_miner..communication_task.._u7b
mov rdi, rcx
lea rsi, [rcx + 0x20]
mov qword [rsp + 0x2f30], 5
lea rdx, [rsp + 0x2f30]
mov rcx, rsi
call sym.tokio::runtime::task::core::Core_T_S_::set_stage::h152580d5e86445d3
xor eax, eax
mov rcx, qword [rdi + 0x28]
mov qword [rsp + 0x28], 1
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x20], 4
lea rdx, [rsp + 0x20]
mov rcx, rsi
call sym.tokio::runtime::task::core::Core_T_S_::set_stage::h152580d5e86445d3
mov rcx, rdi
add rsp, 0x5e48
pop rdi
pop rsi
jmp sym.tokio::runtime::task::harness::Harness_T_S_::complete::haf4150c54c02de0d
nop
add rsp, 0x5e48
pop rdi
pop rsi
ret
lea rcx, str.assertion_failed:_prev.ref_count_____1
lea r8, [0x007b4e50]
mov edx, 0x27
call sym.core::panicking::panic::h8ea5606244902eff
mov rcx, rax
call sym.std::panicking::try::cleanup::h0bfda5eb954e6696
jmp 0x6caa73
Function at 0x6d9090
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.006d9090
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
ret

Function at 0x6d919a
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x6d9170
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
ret
Function at 0x6da9bd
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
mov r8, qword [rsp + 0x28]
xchg rcx, rdx
test rcx, rcx
je 0x6dab31
lea rsp, [rsp - 0xb8]
movaps xmmword [rsp + 0x10], xmm6
movaps xmmword [rsp + 0x20], xmm7
movaps xmmword [rsp + 0x30], xmm8
movaps xmmword [rsp + 0x40], xmm9
movaps xmmword [rsp + 0x50], xmm10
movaps xmmword [rsp + 0x60], xmm11
movaps xmmword [rsp + 0x70], xmm12
movaps xmmword [rsp + 0x80], xmm13
movaps xmmword [rsp + 0x90], xmm14
movaps xmmword [rsp + 0xa0], xmm15
movdqu xmm0, xmmword [r8]
movdqa xmm8, xmmword [0x007d78a0]
sub rsi, rdi
call fcn.006dab40
movdqa xmm6, xmm0
pshufb xmm6, xmmword [0x007d7890]
test rcx, 1
je 0x6daa7a
movdqu xmm7, xmmword [rdi]
call fcn.006da1c0
pxor xmm0, xmm7
paddd xmm6, xmm8
movdqu xmmword [rsi + rdi], xmm0
sub rcx, 1
lea rdi, [rdi + 0x10]
je 0x6daae6
movdqa xmm14, xmm6
movdqa xmm15, xmm6
paddd xmm15, xmm8
movdqa xmm1, xmmword [0x007d7890]
movdqa xmm0, xmm14
movdqa xmm6, xmm15
pshufb xmm0, xmm1
pshufb xmm6, xmm1
call fcn.006da320
movdqu xmm1, xmmword [rdi]
movdqu xmm2, xmmword [rdi + 0x10]
movdqa xmm3, xmmword [0x007d78b0]
pxor xmm0, xmm1
pxor xmm6, xmm2
paddd xmm14, xmm3
paddd xmm15, xmm3
movdqu xmmword [rsi + rdi], xmm0
movdqu xmmword [rsi + rdi + 0x10], xmm6
sub rcx, 2
lea rdi, [rdi + 0x20]
jne 0x6daa89
movaps xmm6, xmmword [rsp + 0x10]
movaps xmm7, xmmword [rsp + 0x20]
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm9, xmmword [rsp + 0x40]
movaps xmm10, xmmword [rsp + 0x50]
movaps xmm11, xmmword [rsp + 0x60]
movaps xmm12, xmmword [rsp + 0x70]
movaps xmm13, xmmword [rsp + 0x80]
movaps xmm14, xmmword [rsp + 0x90]
movaps xmm15, xmmword [rsp + 0xa0]
lea rsp, [rsp + 0xb8]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
ret
Function at 0x6e3d40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
vmovdqu xmm4, xmmword [r9 - 0x80]
vmovdqu xmm2, xmmword [r11 + 0x20]
lea r13, [r10 - 1]
vmovups xmm15, xmmword [r9 - 0x70]
lea r12, [r9 - 0x60]
vpxor xmm9, xmm1, xmm4
add ebx, 0x6000000
jb 0x6e3e60
vpaddb xmm10, xmm1, xmm2
vpaddb xmm11, xmm10, xmm2
vpxor xmm10, xmm10, xmm4
vpaddb xmm12, xmm11, xmm2
vpxor xmm11, xmm11, xmm4
vpaddb xmm13, xmm12, xmm2
vpxor xmm12, xmm12, xmm4
vpaddb xmm14, xmm13, xmm2
vpxor xmm13, xmm13, xmm4
vpaddb xmm1, xmm14, xmm2
vpxor xmm14, xmm14, xmm4
jmp 0x6e3da0
vaesenc xmm9, xmm9, xmm15
vaesenc xmm10, xmm10, xmm15
vaesenc xmm11, xmm11, xmm15
vaesenc xmm12, xmm12, xmm15
vaesenc xmm13, xmm13, xmm15
vaesenc xmm14, xmm14, xmm15
vmovups xmm15, xmmword [r12]
lea r12, [r12 + 0x10]
dec r13d
jne 0x6e3da0
vmovdqu xmm3, xmmword [r12]
vaesenc xmm9, xmm9, xmm15
vpxor xmm4, xmm3, xmmword [rcx]
vaesenc xmm10, xmm10, xmm15
vpxor xmm5, xmm3, xmmword [rcx + 0x10]
vaesenc xmm11, xmm11, xmm15
vpxor xmm6, xmm3, xmmword [rcx + 0x20]
vaesenc xmm12, xmm12, xmm15
vpxor xmm8, xmm3, xmmword [rcx + 0x30]
vaesenc xmm13, xmm13, xmm15
vpxor xmm2, xmm3, xmmword [rcx + 0x40]
vaesenc xmm14, xmm14, xmm15
vpxor xmm3, xmm3, xmmword [rcx + 0x50]
lea rcx, [rcx + 0x60]
vaesenclast xmm9, xmm9, xmm4
vaesenclast xmm10, xmm10, xmm5
vaesenclast xmm11, xmm11, xmm6
vaesenclast xmm12, xmm12, xmm8
vaesenclast xmm13, xmm13, xmm2
vaesenclast xmm14, xmm14, xmm3
vmovups xmmword [rdx], xmm9
vmovups xmmword [rdx + 0x10], xmm10
vmovups xmmword [rdx + 0x20], xmm11
vmovups xmmword [rdx + 0x30], xmm12
vmovups xmmword [rdx + 0x40], xmm13
vmovups xmmword [rdx + 0x50], xmm14
lea rdx, [rdx + 0x60]
ret
vpshufb xmm6, xmm1, xmm0
vmovdqu xmm5, xmmword [r11 + 0x30]
vpaddd xmm10, xmm6, xmmword [r11 + 0x40]
vpaddd xmm11, xmm6, xmm5
vpaddd xmm12, xmm10, xmm5
vpshufb xmm10, xmm10, xmm0
vpaddd xmm13, xmm11, xmm5
vpshufb xmm11, xmm11, xmm0
vpxor xmm10, xmm10, xmm4
vpaddd xmm14, xmm12, xmm5
vpshufb xmm12, xmm12, xmm0
vpxor xmm11, xmm11, xmm4
vpaddd xmm1, xmm13, xmm5
vpshufb xmm13, xmm13, xmm0
vpxor xmm12, xmm12, xmm4
vpshufb xmm14, xmm14, xmm0
vpxor xmm13, xmm13, xmm4
vpshufb xmm1, xmm1, xmm0
vpxor xmm14, xmm14, xmm4
jmp 0x6e3da0
Function at 0x6e7cc0
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r8, 0xd
jne 0x6e7d6e
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12d, 1
mov rax, qword [rbp + 0xa0]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp + 0xa0]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 0xa8]
mov r9, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 0xa8]
mul r11
add r15, rax
adc rdx, 0
imul r9, r12
add r15, r10
adc r9, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r9
shrd r15, r9, 2
shr r9, 2
add r15, r13
adc r9, r14
add r10, r15
adc r11, r9
adc r12, 0
ret
cmp r8, 0x10
jb 0x6e7e19
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
mov rax, qword [rbp + 0xa0]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp + 0xa0]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 0xa8]
mov r9, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 0xa8]
mul r11
add r15, rax
adc rdx, 0
imul r9, r12
add r15, r10
adc r9, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r9
shrd r15, r9, 2
shr r9, 2
add r15, r13
adc r9, r14
add r10, r15
adc r11, r9
adc r12, 0
lea rcx, [rcx + 0x10]
sub r8, 0x10
jmp 0x6e7d6e
cmp r8, 0
je 0x6e7edf
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r8
shld r14, r13, 8
shl r13, 8
movzx r15, byte [rcx - 1]
xor r13, r15
dec rcx
dec r8
jne 0x6e7e2f
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp + 0xa0]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp + 0xa0]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 0xa8]
mov r9, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 0xa8]
mul r11
add r15, rax
adc rdx, 0
imul r9, r12
add r15, r10
adc r9, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r9
shrd r15, r9, 2
shr r9, 2
add r15, r13
adc r9, r14
add r10, r15
adc r11, r9
adc r12, 0
ret
Function at 0x6f68f0
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]

Function at 0x6f6960
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rdi, dword [0x0083c914]
mov r12, rcx
mov rsi, rdx
mov rbx, r8
test edi, edi
jle 0x6f6b08
mov rax, qword [0x0083c918]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp r12, rdx
jb 0x6f69ac
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x6f6a37
add ecx, 1
add rax, 0x28
cmp ecx, edi
jne 0x6f6990
mov rcx, r12
call sym.__mingw_GetSectionForAddress
mov rbp, rax
test rax, rax
je 0x6f6b42
mov rax, qword [0x0083c918]
lea rdi, [rdi + rdi*4]
shl rdi, 3
add rax, rdi
mov qword [rax + 0x20], rbp
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [rbp + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x0083c918]
mov qword [rax + rdi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6f6b51
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x6f6a30
sub eax, 4
and eax, 0xfffffffb
jne 0x6f6ac0
add dword [0x0083c914], 1
cmp ebx, 8
jae 0x6f6a68
test bl, 4
jne 0x6f6b10
test ebx, ebx
je 0x6f6a59
movzx eax, byte [rsi]
mov byte [r12], al
test bl, 2
jne 0x6f6b30
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rax, qword [rsi]
lea rcx, [r12 + 8]
and rcx, 0xfffffffffffffff8
mov qword [r12], rax
mov eax, ebx
mov rdx, qword [rsi + rax - 8]
mov qword [r12 + rax - 8], rdx
sub r12, rcx
add ebx, r12d
sub rsi, r12
and ebx, 0xfffffff8
cmp ebx, 8
jb 0x6f6a59
and ebx, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov r8, qword [rsi + rdx]
mov qword [rcx + rdx], r8
cmp eax, ebx
jb 0x6f6a9a
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
add rdi, qword [0x0083c918]
mov qword [rdi + 8], rcx
mov r9, rdi
mov qword [rdi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6f6a30
call qword [sym.imp.kernel32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
nop dword [rax]
xor edi, edi
jmp 0x6f69b7
mov eax, dword [rsi]
mov ebx, ebx
mov dword [r12], eax
mov eax, dword [rsi + rbx - 4]
mov dword [r12 + rbx - 4], eax
jmp 0x6f6a59
mov ebx, ebx
movzx eax, word [rsi + rbx - 2]
mov word [r12 + rbx - 2], ax
jmp 0x6f6a59
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call sym.__report_error
mov rax, qword [0x0083c918]
mov edx, dword [rbp + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rdi + 0x18]
call sym.__report_error
nop
nop dword [rax]
Function at 0x6f7330
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x0083cc00]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x0083cbe0]
test rbx, rbx
je 0x6f7384
mov rdi, qword [sym.imp.kernel32.dll_TlsGetValue]
mov rsi, qword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x6f737b
test r12, r12
je 0x6f737b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6f7360
lea rcx, [0x0083cc00]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]

Function at 0x6f75b0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
jne 0x6f75c0
jmp sym._ValidateImageBase.part.0
xor eax, eax
ret

Function at 0x6f75d0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6f7615
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp r8, rdx
ja 0x6f760c
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6f7617
add rax, 0x28
cmp rax, r9
jne 0x6f75f8
xor eax, eax
ret

Function at 0x6f76c0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r10, qword [0x007d89b0]
xor r8d, r8d
cmp word [r10], 0x5a4d
mov r9, rcx
jne 0x6f7739
mov rcx, r10
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6f7739
movsxd rax, dword [r10 + 0x3c]
mov rcx, r9
sub rcx, r10
add r10, rax
movzx eax, word [r10 + 0x14]
lea r8, [r10 + rax + 0x18]
movzx eax, word [r10 + 6]
test eax, eax
je 0x6f7736
sub eax, 1
lea rax, [rax + rax*4]
lea r9, [r8 + rax*8 + 0x28]
nop dword [rax]
mov edx, dword [r8 + 0xc]
mov rax, rdx
cmp rcx, rdx
jb 0x6f772d
add eax, dword [r8 + 8]
cmp rcx, rax
jb 0x6f7739
add r8, 0x28
cmp r8, r9
jne 0x6f7718
xor r8d, r8d
mov rax, r8
add rsp, 0x28
ret

Function at 0x6f7820
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x007d89b0]
xor eax, eax
cmp word [r9], 0x5a4d
mov r8, rcx
jne 0x6f788f
mov rcx, r9
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6f788f
movsxd rax, dword [r9 + 0x3c]
mov rcx, r8
sub rcx, r9
add r9, rax
movzx eax, word [r9 + 0x14]
movzx edx, word [r9 + 6]
lea rax, [r9 + rax + 0x18]
test edx, edx
je 0x6f788d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x6f7884
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6f7898
add rax, 0x28
cmp rax, r9
jne 0x6f7870
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret
Function at 0x6f78b0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x007d89b0]
xor r9d, r9d
cmp word [r11], 0x5a4d
mov r8d, ecx
jne 0x6f7928
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6f7928
movsxd rcx, dword [r11 + 0x3c]
add rcx, r11
mov eax, dword [rcx + 0x90]
test eax, eax
je 0x6f7928
movzx edx, word [rcx + 0x14]
lea rdx, [rcx + rdx + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6f7928
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r10, [rdx + rcx*8 + 0x28]
nop dword [rax + rax]
mov r9d, dword [rdx + 0xc]
mov rcx, r9
cmp rax, r9
jb 0x6f791c
add ecx, dword [rdx + 8]
cmp rax, rcx
jb 0x6f7930
add rdx, 0x28
cmp rdx, r10
jne 0x6f7908
xor r9d, r9d
mov rax, r9
add rsp, 0x28
ret
add rax, r11
jmp 0x6f7940
sub r8d, 1
add rax, 0x14
mov ecx, dword [rax + 4]
test ecx, ecx
jne 0x6f794e
mov edx, dword [rax + 0xc]
test edx, edx
je 0x6f7925
test r8d, r8d
jg 0x6f7938
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
add rsp, 0x28
ret
Function at 0x7040f0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
xor r13d, r13d
xor r9d, r9d
xor r11d, r11d
xor r14d, r14d
xor esi, esi
xor r10d, r10d
xor ebx, ebx
xor edi, edi
xor ebp, ebp
xor r12d, r12d
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 8], 0
mov qword [rsp + 0x18], 0
mov qword [rsp + 0x10], 0
mov qword [rsp + 0x120], rcx
xor ecx, ecx
mov qword [rsp + 0x130], r8
xor r8d, r8d
nop dword [rax]
mov r15, qword [rsp + 0x130]
add rcx, 1
xor r15, rcx
mov rax, r15
sub r15, 1
not rax
and rax, r15
mov r15, qword [rdx]
sar rax, 0x3f
xor r15, rbp
and r15, rax
xor rbp, r15
mov r15, qword [rdx + 0x30]
xor r15, rdi
and r15, rax
xor rdi, r15
mov r15, qword [rdx + 0x60]
xor r15, r12
and r15, rax
xor r12, r15
mov r15, qword [rsp + 0x10]
xor r15, qword [rdx + 8]
and r15, rax
xor qword [rsp + 0x10], r15
mov r15, qword [rsp + 0x18]
xor r15, qword [rdx + 0x38]
and r15, rax
xor qword [rsp + 0x18], r15
mov r15, qword [rsp + 8]
xor r15, qword [rdx + 0x68]
and r15, rax
xor qword [rsp + 8], r15
mov r15, qword [rdx + 0x10]
xor r15, rbx
and r15, rax
xor rbx, r15
mov r15, qword [rdx + 0x40]
xor r15, r10
and r15, rax
xor r10, r15
mov r15, qword [rdx + 0x70]
xor r15, rsi
and r15, rax
xor rsi, r15
mov r15, qword [rdx + 0x18]
add rdx, 0x90
xor r15, r14
and r15, rax
xor r14, r15
mov r15, qword [rsp + 0x20]
xor r15, qword [rdx - 0x48]
and r15, rax
xor qword [rsp + 0x20], r15
mov r15, qword [rsp + 0x28]
xor r15, qword [rdx - 0x18]
and r15, rax
xor qword [rsp + 0x28], r15
mov r15, qword [rdx - 0x70]
xor r15, r11
and r15, rax
xor r11, r15
mov r15, qword [rdx - 0x40]
xor r15, r9
and r15, rax
xor r9, r15
mov r15, qword [rdx - 0x10]
xor r15, r8
and r15, rax
xor r8, r15
mov r15, qword [rdx - 0x68]
xor r15, r13
and r15, rax
xor r13, r15
mov r15, qword [rsp + 0x30]
xor r15, qword [rdx - 0x38]
and r15, rax
xor qword [rsp + 0x30], r15
mov r15, qword [rsp + 0x38]
xor r15, qword [rdx - 8]
and rax, r15
xor qword [rsp + 0x38], rax
cmp rcx, 0x10
jne 0x704178
mov rax, r12
movq xmm5, r14
mov r12, rbp
mov rbp, rdi
movq xmm2, rbx
mov rdi, rax
movq xmm1, r12
mov rax, qword [rsp + 0x120]
punpcklqdq xmm2, xmm5
movq xmm3, r11
movq xmm5, r13
movq xmm4, rbp
movhps xmm1, qword [rsp + 0x10]
punpcklqdq xmm3, xmm5
movups xmmword [rax + 0x10], xmm2
movhps xmm4, qword [rsp + 0x18]
movups xmmword [rax], xmm1
movq xmm5, r10
movq xmm1, r9
movups xmmword [rax + 0x20], xmm3
movq xmm2, rdi
movq xmm3, rsi
movhps xmm5, qword [rsp + 0x20]
movups xmmword [rax + 0x30], xmm4
movq xmm4, r8
movhps xmm1, qword [rsp + 0x30]
movhps xmm2, qword [rsp + 8]
movhps xmm3, qword [rsp + 0x28]
movhps xmm4, qword [rsp + 0x38]
movups xmmword [rax + 0x40], xmm5
movups xmmword [rax + 0x50], xmm1
movups xmmword [rax + 0x60], xmm2
movups xmmword [rax + 0x70], xmm3
movups xmmword [rax + 0x80], xmm4
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x7047e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
test r8, r8
je 0x7049f8
lea rax, [r8 - 1]
cmp rax, 0xe
jbe 0x7049ff
mov r9, r8
xor eax, eax
pxor xmm0, xmm0
and r9, 0xfffffffffffffff0
nop dword [rax + rax]
movdqu xmm1, xmmword [rcx + rax]
movdqu xmm2, xmmword [rdx + rax]
add rax, 0x10
pxor xmm1, xmm2
por xmm0, xmm1
cmp rax, r9
jne 0x704810
movdqu xmm1, xmm0
mov r9, r8
psrldq xmm1, 8
and r9, 0xfffffffffffffff0
por xmm0, xmm1
movdqu xmm1, xmm0
psrldq xmm1, 4
por xmm0, xmm1
movdqu xmm1, xmm0
psrldq xmm1, 2
por xmm0, xmm1
movdqu xmm1, xmm0
psrldq xmm1, 1
por xmm0, xmm1
movups xmmword [rsp], xmm0
movzx eax, byte [rsp]
test r8b, 0xf
je 0x7049e9
movzx r10d, byte [rcx + r9]
xor r10b, byte [rdx + r9]
or eax, r10d
lea r10, [r9 + 1]
cmp r8, r10
jbe 0x7049e9
movzx r10d, byte [rcx + r9 + 1]
xor r10b, byte [rdx + r9 + 1]
or eax, r10d
lea r10, [r9 + 2]
cmp r8, r10
jbe 0x7049e9
movzx r10d, byte [rcx + r9 + 2]
xor r10b, byte [rdx + r9 + 2]
or eax, r10d
lea r10, [r9 + 3]
cmp r8, r10
jbe 0x7049e9
movzx r10d, byte [rcx + r9 + 3]
xor r10b, byte [rdx + r9 + 3]
or eax, r10d
lea r10, [r9 + 4]
cmp r8, r10
jbe 0x7049e9
movzx r10d, byte [rcx + r9 + 4]
xor r10b, byte [rdx + r9 + 4]
or eax, r10d
lea r10, [r9 + 5]
cmp r8, r10
jbe 0x7049e9
movzx r10d, byte [rcx + r9 + 5]
xor r10b, byte [rdx + r9 + 5]
or eax, r10d
lea r10, [r9 + 6]
cmp r8, r10
jbe 0x7049e9
movzx r10d, byte [rcx + r9 + 6]
xor r10b, byte [rdx + r9 + 6]
or eax, r10d
lea r10, [r9 + 7]
cmp r8, r10
jbe 0x7049e9
movzx r10d, byte [rcx + r9 + 7]
xor r10b, byte [rdx + r9 + 7]
or eax, r10d
lea r10, [r9 + 8]
cmp r8, r10
jbe 0x7049e9
movzx r10d, byte [rcx + r9 + 8]
xor r10b, byte [rdx + r9 + 8]
or eax, r10d
lea r10, [r9 + 9]
cmp r8, r10
jbe 0x7049e9
movzx r10d, byte [rcx + r9 + 9]
xor r10b, byte [rdx + r9 + 9]
or eax, r10d
lea r10, [r9 + 0xa]
cmp r8, r10
jbe 0x7049e9
movzx r10d, byte [rcx + r9 + 0xa]
xor r10b, byte [rdx + r9 + 0xa]
or eax, r10d
lea r10, [r9 + 0xb]
cmp r8, r10
jbe 0x7049e9
movzx r10d, byte [rcx + r9 + 0xb]
xor r10b, byte [rdx + r9 + 0xb]
or eax, r10d
lea r10, [r9 + 0xc]
cmp r8, r10
jbe 0x7049e9
movzx r10d, byte [rcx + r9 + 0xc]
xor r10b, byte [rdx + r9 + 0xc]
or eax, r10d
lea r10, [r9 + 0xd]
cmp r8, r10
jbe 0x7049e9
movzx r10d, byte [rcx + r9 + 0xd]
xor r10b, byte [rdx + r9 + 0xd]
or eax, r10d
lea r10, [r9 + 0xe]
cmp r8, r10
jbe 0x7049e9
movzx edx, byte [rdx + r9 + 0xe]
xor dl, byte [rcx + r9 + 0xe]
or eax, edx
movzx eax, al
add rsp, 0x18
ret
xor eax, eax
add rsp, 0x18
ret
xor r9d, r9d
xor eax, eax
jmp 0x704878

Function at 0x706df0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
test rdx, rdx
je 0x706e30
lea r10, [rcx + rdx*8]
mov r8, 0xffffffffffffffff
mov rdx, qword [rcx]
mov r9, r8
add rcx, 8
mov rax, rdx
sub rdx, 1
not rax
and rax, rdx
sar rax, 0x3f
xor rax, r8
and rax, r9
xor r8, rax
cmp r10, rcx
jne 0x706e00
mov rax, r8
ret
mov r8, 0xffffffffffffffff
mov rax, r8
ret