joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140068fb0
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x40], rbx
nop
xchg rdx, rdx
movabs r8, 0xffffffff7aa4634b
sub r8, 0x6c253d44
xor r8, 0x2bc9c930
mov rdi, rdi
add r8, 0x2eac3e81
add r8, 0xd05c1e2
xor r8, 0x71f33445
add r8, 0x7fffffff
mov r9, r9
xor r8, 0x6f642421
mov qword [rsp + 0x50], rsi
mov rdi, rcx
mov dword [rsp - 0x1c], ebp
mov qword [rsp + 0x20], r15
mov rsi, rdx
mov r15, qword [rcx + 8]
mov rbx, r8
mov dword [rsp - 0xc], ebp
nop dword [rax]
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x140069026
mov dword [rsp - 0x14], 0x44d055a5
lea rcx, [r15 + rbx]
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x28], r14
mov dword [rsp - 0x1c], esp
mov qword [rdi + 8], rcx
cmp rcx, 4
jbe 0x1400690ed
cmp r15, 4
mov dword [rsp - 0x24], edx
jbe 0x140069067
mov r14, qword [rdi]
jmp 0x14006906a
mov r14, rdi
mov eax, 0x6fa4ed28
xor eax, 0x37d6d039
add eax, 0x24374af4
xchg r9, r9
xor eax, 0x520112e5
sub eax, 0xc06b785
sub eax, 0x22a1e359
mov dword [rsp - 0xc], 0x7141ac68
mul rcx
cmovo rax, r8
mov rcx, rax
mov dword [rsp - 0x40], 0xdd8c87e
call fcn.140072200
mov rbp, rax
test r15, r15
je 0x1400690f0
mov dword [rsp - 0x14], 0x7405dae1
mov rdx, rax
sub r14, rax
mov r8, r15
xchg rdi, rdi
nop word [rax + rax]
movzx ecx, word [r14 + rdx]
mov word [rdx], cx
lea rdx, [rdx + 2]
mov dword [rsp - 0x10], 0x4a8fc8ab
sub r8, 1
jne 0x1400690d1
jmp 0x1400690f0
mov rbp, rdi
mov r14, qword [rsp + 0x28]
xor r8d, r8d
test rbx, rbx
mov rdi, rdi
je 0x140069173
lea r9, [r15 + r15]
sub r9, rsi
xchg rbp, rbp
add r9, rbp
nop
lea ecx, [r15 + r8]
mov dword [rsp - 0x24], 0x49f48ae3
mov edx, 0x67a5148d
xor edx, 0x1036c458
sub edx, 0x48b9f395
mov rsi, rsi
xor edx, 0x63fba094
xor edx, 0x56ae1d24
add edx, 0x3594fd75
xchg rbx, rbx
and cl, 3
lea rsi, [rsi + 2]
shl cl, 3
xchg rcx, rcx
inc r8
sar edx, cl
movsx eax, dl
xchg r13, r13
xor ax, word [rsi - 2]
mov word [r9 + rsi - 2], ax
cmp r8, rbx
jb 0x14006910f
mov dword [rsp - 0x24], 0x36cad9f6
mov rsi, qword [rsp + 0x50]
cmp r15, 4
mov r15, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x40]
mov rbx, rbx
jbe 0x140069197
mov rcx, qword [rdi]
call fcn.140072210
mov dword [rsp - 0x20], esi
cmp qword [rdi + 8], 4
mov rax, rdi
jbe 0x1400691a8
mov qword [rdi], rbp
mov dword [rsp - 0x40], ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400693f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov dword [rsp - 0x24], 0x7ccc8397
xor edi, edi
mov rbp, r8
mov qword [rdx], rdi
mov dword [rsp - 0x34], edx
mov rbx, rdx
mov qword [rdx + 8], rdi
mov rax, qword [rcx + 8]
mov rsp, rsp
cmp r8, rax
jae 0x1400695bc
mov qword [rsp + 0x30], rsi
mov dword [rsp - 0x10], esp
cmp rax, 4
jbe 0x14006943c
mov rcx, qword [rcx]
sub rax, rbp
xchg rcx, rcx
lea rsi, [rcx + r8*2]
cmp rax, r9
mov r8, rbx
cmovb r9, rax
mov dword [rsp - 0x1c], 0x57c90ce1
mov qword [rdx + 8], r9
cmp r9, 4
jbe 0x1400694f5
nop
mov dword [rsp - 0x1c], edi
movabs rcx, 0xffffffff2112f1c9
sub rcx, 0x16c3468
xor rcx, 0x69d1940d
xchg r12, r12
sub rcx, 0x6f1dc90a
add rcx, 0x75d54daf
sub rcx, 0x4d406a89
add rcx, 0x7fffffff
xchg rdi, rdi
add rcx, 0x5011bc78
mov eax, 0xb75232e
xor eax, 0x4068b45c
xchg rbx, rbx
sub eax, 0x10d968b7
add eax, 0x190f076e
sub eax, 0x2c3c9f53
mov r13, r13
add eax, 0x4e77cf3a
sub eax, 0x758e660e
mul r9
cmovo rax, rcx
mov dword [rsp - 0x18], 0x6cc16012
mov rcx, rax
call fcn.140072200
mov r8, rax
mov qword [rbx], rax
mov r11, r11
cmp qword [rbx + 8], rdi
jbe 0x14006959e
sub rsi, r8
mov dword [rsp - 0x38], 0x57b4c7a6
nop
lea ecx, [rdi + rbp]
mov edx, 0x78ee38b8
mov dword [rsp - 0x44], esi
xor edx, 0x4ba61fa1
xor edx, 0x4547ae51
sub edx, 0x754917c6
mov rdi, rdi
add edx, 0x505aece3
and cl, 3
lea r8, [r8 + 2]
shl cl, 3
mov dword [rsp - 0x30], 0x1bb33e74
mov eax, 0x37ea9908
sub eax, 0x2a8dd703
xor eax, 0x42114bf1
xchg rbx, rbx
xor eax, 0x5f4b0ae4
add eax, 0x58955c46
sub eax, 0x177a80f1
mov rsp, rsp
sar edx, cl
movzx ecx, dil
and cl, 3
xchg r13, r13
inc rdi
shl cl, 3
sar eax, cl
xor dl, al
mov r11, r11
movsx eax, dl
xor ax, word [rsi + r8 - 2]
mov word [r8 - 2], ax
mov dword [rsp - 0x14], edi
cmp rdi, qword [rbx + 8]
jb 0x14006950c
mov rsi, qword [rsp + 0x30]
mov rax, rbx
mov r10, r10
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
mov r8, r8
ret
mov rbp, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
xchg r13, r13
pop rdi
ret
Function at 0x140069940
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x1400a3b24], 0
jne 0x140069a46
xor edx, edx
mov r10, r10
lea r8, [0x1400a3b20]
nop word [rax + rax]
mov ecx, edx
lea r8, [r8 + 4]
mov rbp, rbp
and ecx, 1
mov eax, edx
shr eax, 1
xchg r10, r10
neg ecx
and ecx, 0xedb88320
inc edx
xchg r10, r10
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x3c], esi
and eax, 1
neg eax
and eax, 0xedb88320
xchg r14, r14
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
mov rbp, rbp
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
mov rdi, rdi
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
mov dword [rsp - 0x28], 0x4939394d
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
mov dword [rsp - 0x34], 0x5808fd58
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov rsp, rsp
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
mov dword [rsp - 0x3c], 0x7945828e
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
mov dword [rsp - 0x34], 0x5393742c
and ecx, 1
neg ecx
and ecx, 0xedb88320
mov rcx, rcx
xor ecx, eax
mov eax, ecx
shr ecx, 1
mov dword [rsp - 0x3c], 0x42a97085
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
xchg r8, r8
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x140069963
ret
Function at 0x14006a550
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
mov dword [rsp - 0x30], 0xa3e14a0
sub rsp, 0x20
mov r14, rcx
mov r9d, r8d
shr r9, 2
xchg rsi, rsi
mov rsi, rdx
nop
movabs rcx, 0xffffffff3888135a
add rcx, 0x412e7494
xchg r8, r8
sub rcx, 0x6172dea
sub rcx, 0x6cb198c8
xor rcx, 0x5c4e1c28
mov dword [rsp - 0x30], 0x19d874d3
add rcx, 0x132eeaa7
add rcx, 0x7fffffff
add rcx, 0x122d3845
mov dword [rsp - 0x20], 0xd1a46cc
mov ebx, r8d
mov eax, 0x54e3531c
xor eax, 0x603f945e
mov dword [rsp - 0x10], 0x6fcc96fd
sub eax, 0x3356882e
add eax, 0x782f5e72
sub eax, 0x30795225
xchg rdx, rdx
add eax, 0x32b83457
sub eax, 0x7bf47fb4
mul r9
mov dword [rsp - 0x14], 0x5c7e2e67
cmovo rax, rcx
mov rcx, rax
call fcn.140072200
lea rcx, [r14 + 8]
mov rcx, rcx
mov r8d, ebx
mov rdx, rax
mov rdi, rax
call fcn.140061e20
xchg r12, r12
test al, al
je 0x14006a77d
mov r9d, dword [r14]
xor edx, edx
mov dword [rsp - 0x40], esp
shr ebx, 2
movd xmm1, r9d
pshufd xmm1, xmm1, 0
test ebx, ebx
xchg r11, r11
je 0x14006a75d
cmp ebx, 0x10
jb 0x14006a72e
lea eax, [rbx - 1]
mov r9, r9
lea r8, [rsi + rax*4]
lea rax, [rdi + rax*4]
cmp rsi, rax
ja 0x14006a682
mov dword [rsp - 0x3c], 0x17461e95
cmp r8, rdi
jae 0x14006a72e
mov r8d, ebx
mov dword [rsp - 0x24], 0x16b96463
and r8d, 0xfffffff0
mov r10d, 0x690e92a6
xor r10d, 0x584bc565
sub r10d, 0x16410554
mov dword [rsp - 0x40], esi
add r10d, 0x58023f66
xor r10d, 0x730691dd
nop dword [rax + rax]
mov rdi, rdi
movdqu xmm0, xmmword [rdi + rdx*4]
lea eax, [r10 - 4]
pxor xmm0, xmm1
movdqu xmmword [rsi + rdx*4], xmm0
mov dword [rsp - 0x3c], 0x53636ad2
add edx, 0x10
movdqu xmm0, xmmword [rdi + rax*4]
pxor xmm0, xmm1
xchg r13, r13
movdqu xmmword [rsi + rax*4], xmm0
mov eax, r10d
movdqu xmm0, xmmword [rdi + rax*4]
mov dword [rsp - 0x14], 0x4285a676
pxor xmm0, xmm1
movdqu xmmword [rsi + rax*4], xmm0
lea eax, [r10 + 4]
add r10d, 0x10
mov r15, r15
movdqu xmm0, xmmword [rdi + rax*4]
pxor xmm0, xmm1
movdqu xmmword [rsi + rax*4], xmm0
xchg rbp, rbp
cmp edx, r8d
jb 0x14006a6bf
cmp edx, ebx
jae 0x14006a75d
mov rdi, rdi
mov r8, rdi
lea rax, [rsi + rdx*4]
sub r8, rsi
xchg r13, r13
sub ebx, edx
mov edx, ebx
mov ecx, r9d
xor ecx, dword [r8 + rax]
mov dword [rsp - 0x18], 0x38ceaa70
mov dword [rax], ecx
lea rax, [rax + 4]
sub rdx, 1
xchg r15, r15
jne 0x14006a73f
mov rcx, rdi
call fcn.140072210
mov al, 0x39
mov dword [rsp - 0x24], 0x31ea5d8d
xor al, 0x53
sub al, 0x10
add al, 0x18
mov dword [rsp - 0x10], ebp
sub al, 0x71
jmp 0x14006a78b
mov rcx, rdi
call fcn.140072210
xor al, al
mov dword [rsp - 0xc], ecx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
mov dword [rsp - 0x34], edi
pop r14
ret
Function at 0x14006a7b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r8, r8
push r14
sub rsp, 0x20
mov r14, rcx
mov r9d, r8d
mov dword [rsp - 0x40], 0xf6f0a4a
shr r9, 2
mov rbx, rdx
nop
mov dword [rsp - 0x3c], ebx
movabs rcx, 0xffffffff7fda26d8
sub rcx, 0x76ab7ada
add rcx, 0x6ccc3968
mov rdx, rdx
xor rcx, 0x49e4fa05
add rcx, 0x7fffffff
add rcx, 0x43e1e09d
mov r15, r15
mov esi, r8d
mov eax, 0x986edf9
sub eax, 0x351adde
mov dword [rsp - 0x40], 0x3eb844f1
add eax, 0x2a351736
xor eax, 0x6f6da8cc
xor eax, 0x4bb61279
add eax, 0x86ec30f
mov rbx, rbx
xor eax, 0x1d20b0f7
mul r9
cmovo rax, rcx
mov r15, r15
mov rcx, rax
call fcn.140072200
mov r9d, dword [r14]
mov dword [rsp - 0x24], ebp
mov edx, esi
shr edx, 2
xor r8d, r8d
mov rdi, rax
mov dword [rsp - 0x10], ebx
movd xmm1, r9d
pshufd xmm1, xmm1, 0
test edx, edx
je 0x14006a9b3
mov dword [rsp - 0xc], 0x48c9ea24
cmp edx, 0x10
jb 0x14006a97a
lea eax, [rdx - 1]
mov dword [rsp - 0x3c], ecx
lea r10, [rdi + rax*4]
lea rax, [rbx + rax*4]
cmp rdi, rax
ja 0x14006a8b6
mov dword [rsp - 0x3c], 0x3bca6264
cmp r10, rbx
jae 0x14006a97a
mov r10d, edx
and r10d, 0xfffffff0
mov dword [rsp - 0x30], 0x547cb622
mov r11d, 0x22328486
add r11d, 0x3abfa80c
sub r11d, 0x59d9e713
add r11d, 0x37bee9ea
mov dword [rsp - 0x18], esi
add r11d, 0x4509b01
xor r11d, 0x5c709608
xor r11d, 0x63575c6a
nop dword [rax + rax]
mov dword [rsp - 0x18], 0x4d11e457
movdqu xmm0, xmmword [rbx + r8*4]
lea eax, [r11 - 4]
pxor xmm0, xmm1
movdqu xmmword [rdi + r8*4], xmm0
mov dword [rsp - 0x2c], 0x5c7dd1c7
add r8d, 0x10
movdqu xmm0, xmmword [rbx + rax*4]
pxor xmm0, xmm1
mov dword [rsp - 0x28], ecx
movdqu xmmword [rdi + rax*4], xmm0
mov eax, r11d
movdqu xmm0, xmmword [rbx + rax*4]
mov dword [rsp - 0x18], 0x2d45174d
pxor xmm0, xmm1
movdqu xmmword [rdi + rax*4], xmm0
lea eax, [r11 + 4]
xchg rbp, rbp
add r11d, 0x10
movdqu xmm0, xmmword [rbx + rax*4]
pxor xmm0, xmm1
xchg r10, r10
movdqu xmmword [rdi + rax*4], xmm0
cmp r8d, r10d
jb 0x14006a906
cmp r8d, edx
mov rdx, rdx
jae 0x14006a9b3
sub rbx, rdi
lea rax, [rdi + r8*4]
sub edx, r8d
mov r13, r13
nop dword [rax]
nop word [rax + rax]
mov ecx, r9d
xor ecx, dword [rbx + rax]
mov dword [rsp - 0x44], 0x1f4ec6fc
mov dword [rax], ecx
lea rax, [rax + 4]
sub rdx, 1
xchg rsi, rsi
jne 0x14006a996
lea rcx, [r14 + 8]
mov r8d, esi
mov rdx, rdi
mov dword [rsp - 0x3c], edi
call fcn.140062200
mov rcx, rdi
test al, al
je 0x14006a9e9
mov dword [rsp - 0x10], 0x412f8c63
call fcn.140072210
mov al, 0x7e
xor al, 0x27
sub al, 0x10
mov rsp, rsp
add al, 0x28
xor al, 0x70
jmp 0x14006a9f3
call fcn.140072210
xor al, al
xchg r9, r9
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
mov r10, r10
pop r14
ret
Function at 0x14006ae90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x230
xchg rbp, rbp
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x1a0b527b
xchg r8, r8
xor r8d, 0x414c38b2
add r8d, 0x57803eb
sub r8d, 0x28d0a42
xor r8d, 0x63c1a72
mov rdx, rdx
xor r8d, 0x1acff1b6
xor r8d, 0x42c18dbe
call fcn.140072650
xchg r10, r10
lea rdx, [rsp + 0x240]
xor ecx, ecx
call fcn.14005dc40
xchg rcx, rcx
xor ebx, ebx
test rax, rax
je 0x14006af74
mov rax, qword [rsp + 0x240]
xchg rbp, rbp
lea rcx, [rsp + 0x20]
mov r9d, 0x680b3a21
sub r9d, 0xf2a569
sub r9d, 0x55ecd93f
mov dword [rsp - 0x40], 0x25830c4c
add r9d, 0x2888c4e4
add r9d, 0x1276076b
sub r9d, 0x4c2a86c5
mov dword [rsp - 0x3c], edi
mov r8, qword [rax + 0x50]
lea edx, [r9 + 1]
call fcn.140072bb0
mov dword [rsp - 0x30], edi
lea edx, [rbx + 0x5c]
lea rcx, [rsp + 0x20]
call fcn.140072c80
test rax, rax
mov dword [rsp - 0x2c], 0x541a6fcb
je 0x14006af74
mov word [rax], bx
nop
movabs r8, 0xffffffff4573554c
mov dword [rsp - 0x3c], esp
sub r8, 0x2eda5297
xor r8, 0x4962d64d
sub r8, 0x4f63802e
add r8, 0x7fffffff
mov dword [rsp - 0x18], 0x275d6483
add r8, 0x6f67ab36
mov qword [rdi], rbx
mov rcx, r8
mov dword [rsp - 0x20], edx
lea rax, [rsp + 0x20]
nop
inc rcx
cmp word [rax + rcx*2], bx
mov dword [rsp - 0xc], 0x3eca47ef
jne 0x14006afbe
mov qword [rdi + 8], rcx
mov rdx, rdi
cmp rcx, 4
mov dword [rsp - 0x3c], ebp
jbe 0x14006b022
mov eax, 0x7c5de355
sub eax, 0x8c58507
sub eax, 0xa6365a9
mov dword [rsp - 0x14], ebx
xor eax, 0xf652482
add eax, 0xcf952b0
sub eax, 0x3b0586df
xor eax, 0x3845a7fa
xchg r12, r12
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.140072200
mov r13, r13
mov rdx, rax
mov qword [rdi], rax
cmp qword [rdi + 8], rbx
jbe 0x14006b089
mov dword [rsp - 0x14], ecx
lea r8, [rsp + 0x20]
sub r8, rdx
nop
mov dword [rsp - 0x3c], esp
movzx ecx, bl
lea rdx, [rdx + 2]
and cl, 3
mov eax, 0x6d57395a
xchg r8, r8
sub eax, 0x4fcdb3f8
add eax, 0x26042b2b
sub eax, 0x2183542
xchg r15, r15
xor eax, 0x1054252e
shl cl, 3
inc rbx
mov r11, r11
sar eax, cl
movsx eax, al
xor ax, word [r8 + rdx - 2]
mov dword [rsp - 0xc], 0x564207b3
mov word [rdx - 2], ax
cmp rbx, qword [rdi + 8]
jb 0x14006b03a
mov rbx, qword [rsp + 0x248]
mov dword [rsp - 0x1c], 0xf687fe5
mov rax, rdi
add rsp, 0x230
pop rdi
mov dword [rsp - 0x20], edx
ret
Function at 0x14006b0b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x230
xchg rbx, rbx
mov rax, qword [0x1400a2df0]
mov rdi, rcx
xor rax, qword [0x1400a2a90]
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x28], 0x7e90b10d
mov edx, 0x74247248
add edx, 0x61b6905
xor edx, 0x632aa49c
xor edx, 0x7e83627f
mov dword [rsp - 0x40], edx
sub edx, 0xe43244a
xor edx, 0x399aeb1c
sub edx, 0x60c81174
mov dword [rsp - 0x20], 0x67c98c9a
call rax
xor ebx, ebx
lea rax, [rsp + 0x20]
nop
mov r10, r10
movabs rcx, 0xffffffff3eaf8b90
sub rcx, 0x19f9af09
sub rcx, 0xa0b23d5
add rcx, 0x145aca7a
xchg r14, r14
add rcx, 0x3a099bcd
add rcx, 0x7fffffff
add rcx, 0x16f0e107
mov r11, r11
mov qword [rdi], rbx
mov rdx, rcx
nop
inc rdx
mov r9, r9
cmp word [rax + rdx*2], bx
jne 0x14006b162
mov qword [rdi + 8], rdx
mov r8, rdi
mov r13, r13
cmp rdx, 4
jbe 0x14006b1cc
mov eax, 0x7b49881d
sub eax, 0x82708d6
xchg rbp, rbp
sub eax, 0x58e09703
add eax, 0x7bf693
xor eax, 0x496c9e89
sub eax, 0x3d4a819
mov dword [rsp - 0x2c], 0x193fbe36
xor eax, 0x4ffc9847
mul rdx
cmovo rax, rcx
mov rbp, rbp
mov rcx, rax
call fcn.140072200
mov r8, rax
mov qword [rdi], rax
mov dword [rsp - 0x20], 0x1b25d6dd
cmp qword [rdi + 8], rbx
jbe 0x14006b235
lea rdx, [rsp + 0x20]
mov dword [rsp - 0x18], ebp
sub rdx, r8
nop
movzx ecx, bl
lea r8, [r8 + 2]
xchg rsi, rsi
and cl, 3
mov eax, 0x367a7973
sub eax, 0x341b5440
mov dword [rsp - 0x3c], ebp
add eax, 0x7f5bf9e
xor eax, 0x22749737
add eax, 0x2900ea7f
xchg rsi, rsi
shl cl, 3
inc rbx
sar eax, cl
mov dword [rsp - 0x30], edi
movsx eax, al
xor ax, word [rdx + r8 - 2]
mov word [r8 - 2], ax
cmp rbx, qword [rdi + 8]
mov dword [rsp - 0x18], 0x5c49ab66
jb 0x14006b1e0
mov rbx, qword [rsp + 0x240]
mov rax, rdi
mov r11, r11
add rsp, 0x230
pop rdi
ret
Function at 0x14006c260
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
mov r11, qword [rcx + 0x18]
mov r10, r9
test r11, r11
mov dword [rsp - 0x44], 0x54214073
je 0x14006c2a3
mov r9, qword [rcx + 0x10]
lea rcx, [r9 + r11*8]
xchg rbp, rbp
cmp r9, rcx
je 0x14006c2a3
nop dword [rax]
mov rax, qword [r9]
mov dword [rsp - 0x24], esi
cmp dword [rax], edx
je 0x14006c2b3
add r9, 8
mov dword [rsp - 0x20], edx
cmp r9, rcx
jne 0x14006c28b
mov rax, r10
mov dword [rsp - 0x38], 0x37f1efda
add rsp, 0x28
ret
mov rdx, qword [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x20], rdi
xor edi, edi
mov dword [rsp - 0x2c], edi
test rdx, rdx
je 0x14006c2fe
mov rcx, qword [rax + 0x10]
lea rdx, [rcx + rdx*8]
xchg r13, r13
cmp rcx, rdx
je 0x14006c2fe
nop word [rax + rax]
mov rbx, qword [rcx]
mov r14, r14
cmp dword [rbx], r8d
je 0x14006c301
add rcx, 8
mov dword [rsp - 0x2c], 0x6dd93f3c
cmp rcx, rdx
jne 0x14006c2e2
mov rbx, rdi
test rbx, rbx
mov rbp, rbp
je 0x14006c381
cmp byte [rbx + 4], 4
jne 0x14006c381
mov dword [rsp - 0x28], 0x5317f2b5
movzx ecx, word [rbx + 5]
inc rcx
call fcn.140072200
mov rbx, rbx
mov r9, rax
movzx eax, word [rbx + 5]
mov byte [rax + r9], dil
cmp di, word [rbx + 5]
xchg rbp, rbp
jae 0x14006c367
nop dword [rax]
mov rcx, qword [rbx + 8]
movzx r8d, di
mov dword [rsp - 0x3c], 0x64c53bcc
inc di
movzx edx, byte [r8 + rcx]
xor dl, 0x37
mov byte [r8 + r9], dl
mov dword [rsp - 0x44], ebx
cmp di, word [rbx + 5]
jb 0x14006c33e
mov rbx, qword [rsp + 0x30]
mov rax, r9
mov dword [rsp - 0x18], 0x7c16903b
mov rdi, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rdi, qword [rsp + 0x20]
mov dword [rsp - 0x3c], esp
add rsp, 0x28
ret
Function at 0x14006f5d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov dword [rsp - 0x2c], edx
push r12
push r13
push r14
push r15
xchg rbx, rbx
xor r13d, r13d
movsxd rax, r8d
mov r12, r9
xchg rsp, rsp
mov rbx, rdx
mov rbp, rcx
mov r10d, r13d
lea r11, [rax + rax*2]
mov rcx, rcx
shl r11, 2
nop word [rax + rax]
movsxd rax, dword [r12 + r10*4]
mov dword [rsp - 0x34], edi
mov r9d, r13d
mov r8, qword [rbp + 8]
mov rcx, rax
and eax, 3
mov dword [rsp - 0x1c], 0x41a184ed
add r8, r11
lea rdi, [rbx + rax*2]
mov qword [r8], r13
mov dword [rsp - 0x44], 0x68854f4a
lea rax, [rcx + 1]
mov dword [r8 + 8], r13d
and eax, 3
lea rsi, [rbx + rax*2]
mov dword [rsp - 0x38], 0x3acfd634
lea rax, [rcx - 2]
and eax, 3
lea r14, [rbx + rax*2]
lea rax, [rcx - 1]
mov dword [rsp - 0x3c], 0x5093161b
and eax, 3
lea r15, [rbx + rax*2]
mov eax, 0x39f978f5
mov dword [rsp - 0x3c], ebx
xor eax, 0x24e403ab
sub eax, 0x1a31b9da
xor eax, 0x45047d1b
xchg r13, r13
add eax, 0x62baee0c
mov ecx, r9d
mul r9d
xchg rcx, rcx
inc r9d
shr edx, 1
lea eax, [rdx + rdx*2]
sub ecx, eax
mov rbx, rbx
movsxd rax, ecx
movzx ecx, word [rdi]
lea rdx, [r8 + rax*4]
mov eax, dword [r8 + rax*4]
mov r9, r9
and ecx, 1
add eax, eax
or eax, ecx
xchg rsp, rsp
not cx
mov dword [rdx], eax
movzx eax, word [rdi]
mov r12, r12
shr ax, 1
shl cx, 0xf
or cx, ax
mov dword [rsp - 0xc], esp
mov word [rdi], cx
movzx ecx, word [rsi]
mov eax, dword [rdx]
xchg r12, r12
and ecx, 1
add eax, eax
or eax, ecx
not cx
mov dword [rsp - 0x24], edi
mov dword [rdx], eax
movzx eax, word [rsi]
shr ax, 1
mov dword [rsp - 0x10], 0x75cfa7c
shl cx, 0xf
or cx, ax
mov word [rsi], cx
movzx ecx, word [r14]
xchg rsp, rsp
mov eax, dword [rdx]
and ecx, 1
add eax, eax
or eax, ecx
xchg r13, r13
not cx
mov dword [rdx], eax
movzx eax, word [r14]
mov dword [rsp - 0x28], esi
shr ax, 1
shl cx, 0xf
or cx, ax
mov r9, r9
mov word [r14], cx
movzx ecx, word [r15]
mov eax, dword [rdx]
xchg r10, r10
and ecx, 1
add eax, eax
or eax, ecx
mov rdx, rdx
not cx
mov dword [rdx], eax
movzx eax, word [r15]
mov r12, r12
shr ax, 1
shl cx, 0xf
or cx, ax
mov word [r15], cx
mov rbx, rbx
cmp r9d, 0xf
jl 0x14006f681
inc r10
add r11, 0xc
mov rcx, rcx
cmp r10, 8
jl 0x14006f61d
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
xchg r9, r9
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
xchg r12, r12
pop r13
pop r12
ret
Function at 0x14006fa00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov ebx, edx
mov r8d, ecx
test ecx, ecx
xchg rdi, rdi
jne 0x14006fa1d
xor eax, eax
mov rbx, qword [rsp + 8]
mov dword [rsp - 0x10], edx
ret
xor r10d, r10d
mov r11d, r8d
mov edx, r10d
mov r9d, r8d
mov dword [rsp - 0x3c], edi
nop dword [rax]
nop word [rax + rax]
lea eax, [r9 + r9]
xchg r12, r12
mov ecx, edx
xor ecx, r9d
mov r9d, eax
mov dword [rsp - 0x28], 0x7c0976e6
test r11b, 1
cmove ecx, edx
xor r9d, ebx
cmp eax, 0x100
mov rbx, rbx
mov edx, ecx
cmovb r9d, eax
shr r11d, 1
mov dword [rsp - 0x18], esi
jne 0x14006fa3b
mov r11d, r8d
mov r9d, r10d
test ecx, ecx
mov r13, r13
je 0x14006fab5
lea eax, [r11 + r11]
mov ecx, r9d
mov dword [rsp - 0x3c], esi
xor ecx, r11d
mov r11d, eax
test dl, 1
mov r11, r11
cmove ecx, r9d
xor r11d, ebx
cmp eax, 0x100
xchg rsp, rsp
mov r9d, ecx
cmovb r11d, eax
shr edx, 1
jne 0x14006fa80
mov dword [rsp - 0x44], esp
mov r11d, r9d
mov edx, r10d
test r9d, r9d
mov dword [rsp - 0x14], 0x29aa982
je 0x14006fb0e
nop dword [rax]
nop word [rax + rax]
lea eax, [r11 + r11]
mov dword [rsp - 0x28], 0x30da69ed
mov ecx, edx
xor ecx, r11d
mov r11d, eax
mov r11, r11
test r9b, 1
cmove ecx, edx
xor r11d, ebx
cmp eax, 0x100
mov dword [rsp - 0x28], ebx
mov edx, ecx
cmovb r11d, eax
shr r9d, 1
jne 0x14006fad6
xchg r8, r8
test edx, edx
je 0x14006fb57
nop word [rax + rax]
mov ecx, r10d
mov dword [rsp - 0x34], 0x2da09d50
xor ecx, r8d
test dl, 1
cmove ecx, r10d
mov dword [rsp - 0x30], 0x15c35dfd
mov r10d, ecx
lea ecx, [r8 + r8]
mov r8d, ecx
xor r8d, ebx
mov r8, r8
cmp ecx, 0x100
cmovb r8d, ecx
shr edx, 1
jne 0x14006fb18
mov dword [rsp - 0x10], ebp
mov rbx, qword [rsp + 8]
mov eax, r10d
ret
Function at 0x140c56b20
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140c56b2d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140c56b3d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140c56b25
lea eax, [rcx + 1]
jmp 0x140c56b4b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140c56b5e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140c56b44
sub eax, 3
jb 0x140c56b7e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140c56bcd
sar eax, 1
movsxd rbp, eax
jb 0x140c56bb4
jmp 0x140c56b8c
add ebx, ebx
jne 0x140c56b8a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140c56bb4
inc ecx
add ebx, ebx
jne 0x140c56b9a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140c56bb4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140c56bad
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140c56b9c
add ecx, 2
jmp 0x140c56bb9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140c56ae2
jmp 0x140c56b2d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0xc51000]
mov eax, dword [rdi]
or eax, eax
je 0x140c56c2d
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xc66e48]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140c56bdd
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140c56c27
mov qword [rbx], rax
add rbx, 8
jmp 0x140c56bfd
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1a7]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140c56cb0], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140c56cb0
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140c56ca0
sub rsp, 0xffffffffffffff80
jmp 0x140001150