joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400687b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.140150d80
sub rsp, rax
mov rax, qword [0x1402274c0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r13, qword [rbp + 0x68]
mov r14d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r13]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r12, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r15d, r15d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r13
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r14d, r14d
je 0x140068976
mov r13, qword [rbp - 0x28]
sub r12, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r14d
test ebx, ebx
jne 0x140068913
lea rcx, [rbp - 0x30]
mov rdx, r13
call fcn.1400680c0
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r15d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r12 + rsi - 1], cl
and ebx, 7
test r14d, r14d
jne 0x1400688b0
mov r13, qword [rbp - 0x20]
test r15d, r15d
je 0x140068976
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r13], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140150a60
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400689a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
push rdx
call fcn.140003900
mov r8, qword [rsp]
cmp eax, 0
jne 0x140003d9d
mov r14d, dword [r8 + 0xf0]
xor rdi, rdi
lea rcx, [rdi + r14*4]
mov rsi, r8
lea rdi, [r8 + rcx*4]
mov rax, qword [rsi]
mov rbx, qword [rsi + 8]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
mov qword [rdi], rax
mov qword [rdi + 8], rbx
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
lea rsi, [rsi + 0x10]
lea rdi, [rdi - 0x10]
cmp rdi, rsi
jne 0x140003bd8
lea rax, [0x140004f80]
mov rsi, qword [rax + 0x28]
mov rdi, qword [rax + 0x30]
mov rbp, qword [rax + 0x38]
mov r15, r8
sub r14d, 1
nop
lea r15, [r15 + 0x10]
mov rax, qword [r15]
mov rcx, qword [r15 + 8]
mov r9, rsi
mov r12, rsi
and r9, rax
and r12, rcx
mov rbx, r9
mov rdx, r12
shr r9, 7
lea r8, [rax + rax]
shr r12, 7
lea r11, [rcx + rcx]
sub rbx, r9
sub rdx, r12
and r8, rdi
and r11, rdi
and rbx, rbp
and rdx, rbp
xor r8, rbx
xor r11, rdx
mov r10, rsi
mov r13, rsi
and r10, r8
and r13, r11
mov rbx, r10
mov rdx, r13
shr r10, 7
lea r9, [r8 + r8]
shr r13, 7
lea r12, [r11 + r11]
sub rbx, r10
sub rdx, r13
and r9, rdi
and r12, rdi
and rbx, rbp
and rdx, rbp
xor r9, rbx
xor r12, rdx
mov r10, rsi
mov r13, rsi
and r10, r9
and r13, r12
mov rbx, r10
mov rdx, r13
shr r10, 7
xor r8, rax
shr r13, 7
xor r11, rcx
sub rbx, r10
sub rdx, r13
lea r10, [r9 + r9]
lea r13, [r12 + r12]
xor r9, rax
xor r12, rcx
and r10, rdi
and r13, rdi
and rbx, rbp
and rdx, rbp
xor r10, rbx
xor r13, rdx
xor rax, r10
xor rcx, r13
xor r8, r10
xor r11, r13
mov rbx, rax
mov rdx, rcx
xor r9, r10
shr rbx, 0x20
xor r12, r13
shr rdx, 0x20
xor r10, r8
rol eax, 8
xor r13, r11
rol ecx, 8
xor r10, r9
rol ebx, 8
xor r13, r12
rol edx, 8
xor eax, r10d
shr r10, 0x20
xor ecx, r13d
shr r13, 0x20
xor ebx, r10d
xor edx, r13d
mov r10, r8
rol r8d, 0x18
mov r13, r11
rol r11d, 0x18
shr r10, 0x20
xor eax, r8d
shr r13, 0x20
xor ecx, r11d
rol r10d, 0x18
mov r8, r9
rol r13d, 0x18
mov r11, r12
shr r8, 0x20
xor ebx, r10d
shr r11, 0x20
xor edx, r13d
rol r9d, 0x10
rol r12d, 0x10
rol r8d, 0x10
xor eax, r9d
rol r11d, 0x10
xor ecx, r12d
xor ebx, r8d
xor edx, r11d
mov dword [r15], eax
mov dword [r15 + 4], ebx
mov dword [r15 + 8], ecx
mov dword [r15 + 0xc], edx
sub r14d, 1
jne 0x140003c1c
xor rax, rax
mov r15, qword [rsp + 8]
mov r14, qword [rsp + 0x10]
mov r13, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
mov eax, Ordinal_41
call fcn.140150d80
sub rsp, rax
add rsp, 0x28
jmp 0x140003b90
Function at 0x140068e80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
mov eax, 0x40
call fcn.140150d80
sub rsp, rax
mov r15, qword [rsp + 0xa8]
mov r14, rdx
mov rdx, qword [rsp + 0xb0]
mov ebx, dword [rdx]
mov r10, r9
mov rdi, r8
mov rbp, rcx
test ebx, ebx
je 0x140068ee3
nop
test rdi, rdi
je 0x140068ee3
mov eax, ebx
inc r14
inc rbp
movzx ecx, byte [rax + r15]
dec rdi
xor cl, byte [rbp - 1]
inc ebx
mov byte [r14 - 1], cl
and ebx, 0xf
jne 0x140068ec0
mov r9, qword [rsp + 0xb8]
mov r13d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x38], r12
mov esi, 1
cmp rdi, r13
jb 0x140068ffd
mov rcx, rdi
xor ebx, ebx
mov r15, r14
shr rcx, 4
mov r12, rbp
mov dword [rsp + 0x20], ebx
mov rbx, qword [rsp + 0xa8]
imul rax, rcx, 0xfffffffffffffff0
add rdi, rax
mov rax, rcx
sub r15, rbx
shl rax, 4
sub r12, rbx
mov qword [rsp + 0x90], rdi
mov rdi, qword [rsp + 0x98]
add r14, rax
add rbp, rax
mov qword [rsp + 0x80], rbp
mov rbp, qword [rsp + 0xa0]
mov qword [rsp + 0x88], r14
mov r14, rcx
mov r8, rdi
mov rdx, rbx
mov rcx, rbp
call r9
mov r8d, r13d
mov ecx, esi
lea rdx, [rbp + 0x10]
nop dword [rax]
movzx eax, byte [rdx - 1]
lea rdx, [rdx - 1]
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
dec r8d
jne 0x140068f80
mov rax, rbx
lea edx, [r8 + 2]
nop dword [rax + rax]
mov rcx, qword [r12 + rax]
lea rax, [rax + 8]
xor rcx, qword [rax - 8]
mov qword [r15 + rax - 8], rcx
dec rdx
jne 0x140068fa0
mov r9, qword [rsp + 0xb8]
add r15, r13
add r12, r13
dec r14
jne 0x140068f64
mov ebx, dword [rsp + 0x20]
mov rdi, qword [rsp + 0x90]
mov r14, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov r15, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xb0]
mov r10, qword [rsp + 0x98]
test rdi, rdi
je 0x140069061
mov r12, qword [rsp + 0xa0]
mov r8, r10
mov rdx, r15
mov rcx, r12
call r9
lea rcx, [r12 + 0x10]
nop dword [rax + rax]
movzx eax, byte [rcx - 1]
lea rcx, [rcx - 1]
add esi, eax
mov byte [rcx], sil
shr esi, 8
dec r13d
jne 0x140069020
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + r15]
mov byte [rcx + r14], al
dec rdi
jne 0x140069040
mov rax, qword [rsp + 0xb0]
mov dword [rax], ebx
jmp 0x140069063
mov dword [rdx], ebx
mov r12, qword [rsp + 0x38]
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140069080
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.140150d80
sub rsp, rax
mov rdi, r8
mov r8, qword [rsp + 0xb0]
mov r15, rdx
mov ebx, dword [r8]
mov r12, rcx
mov dword [rsp + 0x30], ebx
test ebx, ebx
je 0x1400690e9
mov rdx, qword [rsp + 0xa8]
test rdi, rdi
je 0x1400690e5
mov eax, ebx
inc r15
inc r12
movzx ecx, byte [rax + rdx]
dec rdi
xor cl, byte [r12 - 1]
inc ebx
mov byte [r15 - 1], cl
and ebx, 0xf
jne 0x1400690c1
mov dword [rsp + 0x30], ebx
mov rax, qword [rsp + 0xa0]
mov r10, qword [rsp + 0xb8]
mov ebp, 1
mov ecx, dword [rax + 0xc]
lea r14, [rax + 0xc]
mov qword [rsp + 0x80], rsi
bswap ecx
lea r13d, [rbp + 0xb]
mov dword [rsp + 0x90], ecx
cmp rdi, 0x10
jb 0x1400691fb
mov rbx, qword [rsp + 0xa0]
mov eax, 0x10000000
nop dword [rax]
nop word [rax + rax]
mov rsi, rdi
shr rsi, 4
cmp rsi, rax
cmova rsi, rax
add ecx, esi
mov eax, ecx
mov dword [rsp + 0x90], ecx
cmp rax, rsi
jae 0x14006916a
sub rsi, rax
xor eax, eax
mov dword [rsp + 0x90], eax
mov r8, rsi
mov rdx, r15
mov rcx, r12
mov qword [rsp + 0x20], rbx
call r10
mov ecx, dword [rsp + 0x90]
mov eax, ecx
bswap eax
mov dword [r14], eax
test ecx, ecx
jne 0x1400691bb
mov r8d, r13d
mov ecx, ebp
mov rdx, r14
nop word [rax + rax]
movzx eax, byte [rdx - 1]
lea rdx, [rdx - 1]
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
dec r8d
jne 0x1400691a0
mov ecx, dword [rsp + 0x90]
mov r10, qword [rsp + 0xb8]
mov r9, qword [rsp + 0x98]
shl rsi, 4
sub rdi, rsi
add r15, rsi
add r12, rsi
mov eax, 0x10000000
cmp rdi, 0x10
jae 0x140069140
mov ebx, dword [rsp + 0x30]
mov rax, qword [rsp + 0xa0]
mov r8, qword [rsp + 0xb0]
test rdi, rdi
je 0x140069271
mov rsi, qword [rsp + 0xa8]
xor ecx, ecx
mov r8, rbp
mov qword [rsi], rcx
mov qword [rsi + 8], rcx
mov rcx, rsi
mov rdx, rsi
mov qword [rsp + 0x20], rax
call r10
mov eax, dword [rsp + 0x90]
inc eax
bswap eax
mov dword [r14], eax
jne 0x140069250
movzx eax, byte [r14 - 1]
lea r14, [r14 - 1]
add ebp, eax
mov byte [r14], bpl
shr ebp, 8
dec r13d
jne 0x140069232
nop dword [rax + rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r12]
xor al, byte [rcx + rsi]
mov byte [rcx + r15], al
dec rdi
jne 0x140069250
mov rax, qword [rsp + 0xb0]
mov dword [rax], ebx
jmp 0x140069274
mov dword [r8], ebx
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x140069290
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r15
mov eax, Ordinal_41
call fcn.140150d80
sub rsp, rax
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov r10, r9
mov ebx, dword [rsi]
mov rdi, r8
mov r15, rdx
mov r12, rcx
test ebx, ebx
je 0x1400692f4
nop dword [rax]
test rdi, rdi
je 0x1400692f4
mov eax, ebx
inc r15
inc r12
movzx ecx, byte [rax + rbp]
dec rdi
xor cl, byte [r12 - 1]
inc ebx
mov byte [r15 - 1], cl
and ebx, 0xf
jne 0x1400692d0
mov r9, qword [rsp + 0x90]
cmp rdi, 0x10
jb 0x1400693ac
mov qword [rsp + 0x60], r13
mov rsi, r15
mov r13, rdi
shr r13, 4
mov qword [rsp + 0x20], r14
mov r14, r12
sub rsi, rbp
sub r14, rbp
imul rax, r13, 0xfffffffffffffff0
add rdi, rax
mov rax, r13
shl rax, 4
add r15, rax
add r12, rax
mov qword [rsp + 0x68], r15
mov r15, qword [rsp + 0x78]
mov r8, r15
mov rdx, rbp
mov rcx, rbp
call r9
cmp ebx, 0x10
jae 0x140069379
mov edx, reloc.WS2_32.dll_ntohs
mov eax, ebx
sub edx, ebx
add rax, rbp
shr edx, 3
inc edx
mov rcx, qword [r14 + rax]
lea rax, [rax + 8]
xor rcx, qword [rax - 8]
mov qword [rsi + rax - 8], rcx
dec rdx
jne 0x140069363
mov r9, qword [rsp + 0x90]
add rsi, 0x10
add r14, 0x10
xor ebx, ebx
dec r13
jne 0x140069341
mov r15, qword [rsp + 0x68]
mov r10, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x60]
test rdi, rdi
je 0x1400693d5
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r9
nop dword [rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r12]
xor al, byte [rcx + rbp]
mov byte [rcx + r15], al
dec rdi
jne 0x1400693c0
mov dword [rsi], ebx
add rsp, 0x28
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400696a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.140150d80
sub rsp, rax
cmp dword [rsp + 0x90], 0
mov r15, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov ebx, dword [r15]
mov r10, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
je 0x14006980f
test ebx, ebx
je 0x14006971a
test rdi, rdi
je 0x14006971a
movzx eax, byte [r14]
mov ecx, ebx
inc rsi
movzx edx, byte [rcx + rbp]
inc r14
dec rdi
xor edx, eax
inc ebx
mov byte [rcx + rbp], dl
mov byte [rsi - 1], dl
and ebx, 0xf
jne 0x1400696f3
mov r9, qword [rsp + 0x98]
cmp rdi, 0x10
jb 0x1400697d3
mov r15, rsi
mov r13, rdi
mov r12, r14
shr r13, 4
sub r15, rbp
sub r12, rbp
imul rax, r13, 0xfffffffffffffff0
add rdi, rax
mov rax, r13
shl rax, 4
add rsi, rax
add r14, rax
mov qword [rsp + 0x68], rsi
mov rsi, qword [rsp + 0x78]
nop dword [rax]
mov r8, rsi
mov rdx, rbp
mov rcx, rbp
call r9
cmp ebx, 0x10
jae 0x1400697aa
mov edx, reloc.WS2_32.dll_ntohs
mov ecx, ebx
sub edx, ebx
add rcx, rbp
shr edx, 3
inc edx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r12 + rcx]
lea rcx, [rcx + 8]
xor qword [rcx - 8], rax
mov rax, qword [rcx - 8]
mov qword [r15 + rcx - 8], rax
dec rdx
jne 0x140069790
mov r9, qword [rsp + 0x98]
add r15, 0x10
add r12, 0x10
xor ebx, ebx
dec r13
jne 0x140069760
mov rsi, qword [rsp + 0x68]
mov r10, qword [rsp + 0x78]
mov r15, qword [rsp + 0x88]
test rdi, rdi
je 0x14006991a
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r9
nop dword [rax + rax]
mov edx, ebx
inc ebx
movzx ecx, byte [rdx + r14]
movzx eax, byte [rdx + rbp]
xor ecx, eax
mov byte [rdx + rbp], cl
mov byte [rdx + rsi], cl
dec rdi
jne 0x1400697f0
jmp 0x14006991a
test ebx, ebx
je 0x14006983a
test rdi, rdi
je 0x14006983a
movzx edx, byte [r14]
mov ecx, ebx
inc rsi
movzx eax, byte [rcx + rbp]
inc r14
dec rdi
xor al, dl
inc ebx
mov byte [rsi - 1], al
mov byte [rcx + rbp], dl
and ebx, 0xf
jne 0x140069813
mov r13, qword [rsp + 0x98]
cmp rdi, 0x10
jb 0x1400698e4
mov r12, rdi
mov r15, rsi
shr r12, 4
sub r15, rbp
imul rax, r12, 0xfffffffffffffff0
add rdi, rax
mov qword [rsp + 0x70], rdi
mov rdi, qword [rsp + 0x78]
nop word [rax + rax]
mov r8, rdi
mov rdx, rbp
mov rcx, rbp
call r13
cmp ebx, 0x10
jae 0x1400698bf
mov r9d, reloc.WS2_32.dll_ntohs
mov r8d, ebx
mov r10, r14
sub r9d, ebx
add r8, rbp
sub r10, rsi
shr r9d, 3
inc r9d
nop dword [rax]
lea rcx, [r15 + r8]
lea r8, [r8 + 8]
mov rdx, qword [rcx + r10]
mov rax, rdx
xor rax, qword [r8 - 8]
mov qword [rcx], rax
mov qword [r8 - 8], rdx
dec r9
jne 0x1400698a0
add rsi, 0x10
add r15, 0x10
add r14, 0x10
xor ebx, ebx
dec r12
jne 0x140069870
mov rdi, qword [rsp + 0x70]
mov r10, qword [rsp + 0x78]
mov r15, qword [rsp + 0x88]
test rdi, rdi
je 0x14006991a
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r13
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx edx, byte [rcx + r14]
movzx eax, byte [rcx + rbp]
xor al, dl
mov byte [rcx + rsi], al
mov byte [rcx + rbp], dl
dec rdi
jne 0x140069900
mov dword [r15], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140069940
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push r14
push r15
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.140150d80
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov r15, qword [rcx + 0x168]
mov rbx, r8
mov r8, qword [rcx + 0x160]
mov r14, rdx
mov rsi, rcx
je 0x140069989
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, rbx
cmp rcx, rax
ja 0x140069a5e
cmp rcx, rbx
jb 0x140069a5e
mov qword [rsp + 0x48], rdi
mov edi, dword [rsi + 0x174]
mov qword [rsi + 0x30], rcx
test edi, edi
je 0x1400699ed
nop
test rbx, rbx
je 0x1400699de
movzx eax, byte [r14]
mov ecx, edi
inc r14
xor byte [rcx + rsi + 0x40], al
dec rbx
inc edi
and edi, 0xf
jne 0x1400699c0
jmp 0x1400699e2
test edi, edi
jne 0x140069a42
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call r8
mov qword [rsp + 0x40], rbp
mov rbp, rbx
and rbp, 0xfffffffffffffff0
je 0x140069a12
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
mov r9, rbp
mov r8, r14
call r15
add r14, rbp
sub rbx, rbp
mov rbp, qword [rsp + 0x40]
test rbx, rbx
je 0x140069a42
mov edi, ebx
lea rcx, [rsi + 0x40]
sub r14, rsi
nop word [rax + rax]
movzx eax, byte [r14 + rcx - 0x40]
lea rcx, [rcx + 1]
xor byte [rcx - 1], al
dec rbx
jne 0x140069a30
mov dword [rsi + 0x174], edi
mov rdi, qword [rsp + 0x48]
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
or eax, 0xffffffff
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
Function at 0x140069d30
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
mov eax, 0x50
call fcn.140150d80
sub rsp, rax
mov rax, qword [rcx + 0x180]
mov rdi, qword [rcx + 0x160]
mov rbx, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x168]
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x38], rax
add rcx, r9
movabs rax, 0xfffffffe0
mov r14, r9
mov rbp, r8
mov r15, rdx
cmp rcx, rax
ja 0x140069f6d
cmp rcx, r9
jb 0x140069f6d
cmp dword [rbx + 0x174], 0
mov qword [rsp + 0x88], rsi
mov qword [rbx + 0x38], rcx
mov qword [rsp + 0x48], r12
je 0x140069dc1
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
call rdi
mov dword [rbx + 0x174], 0
mov esi, dword [rbx + 0x170]
mov r12d, dword [rbx + 0xc]
bswap r12d
mov dword [rsp + 0x80], esi
test esi, esi
je 0x140069e24
nop dword [rax]
test r14, r14
je 0x140069e12
movzx edx, byte [r15]
mov ecx, esi
inc rbp
movzx eax, byte [rcx + rbx + 0x10]
inc r15
dec r14
xor al, dl
mov byte [rbp - 1], al
xor byte [rcx + rbx + 0x40], dl
inc esi
and esi, 0xf
mov dword [rsp + 0x80], esi
jne 0x140069de0
jmp 0x140069e1a
test esi, esi
jne 0x140069f4c
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
call rdi
mov qword [rsp + 0x40], r13
mov r13, qword [rsp + 0xa0]
cmp r14, 0xc00
jb 0x140069eb7
movabs rax, 0xaaaaaaaaaaaaaaab
mul r14
mov rdi, rdx
shr rdi, 0xb
imul rax, rdi, 0xfffffffffffff400
add r14, rax
nop dword [rax + rax]
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
mov r9d, 0xc00
mov r8, r15
call qword [rsp + gethostname]
mov r9, qword [rsp + 0x30]
mov r8d, 0xc0
mov rdx, rbp
mov rcx, r15
mov qword [rsp + 0x20], rbx
call r13
add r12d, 0xc0
add rbp, 0xc00
mov eax, r12d
add r15, 0xc00
bswap eax
mov dword [rbx + 0xc], eax
dec rdi
jne 0x140069e60
mov esi, dword [rsp + 0x80]
mov r13, r14
and r13, 0xfffffffffffffff0
je 0x140069f07
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
mov rdi, r13
mov r9, r13
mov r8, r15
shr rdi, 4
call qword [rsp + gethostname]
mov r9, qword [rsp + 0x30]
mov r8, rdi
mov rdx, rbp
mov rcx, r15
mov qword [rsp + 0x20], rbx
call qword [rsp + 0xa0]
add r12d, edi
add rbp, r13
mov eax, r12d
add r15, r13
sub r14, r13
bswap eax
mov dword [rbx + 0xc], eax
mov r13, qword [rsp + 0x40]
test r14, r14
je 0x140069f4c
mov r8, qword [rsp + 0x30]
lea rdx, [rbx + 0x10]
mov rcx, rbx
call qword [rbx + 0x178]
inc r12d
bswap r12d
mov dword [rbx + 0xc], r12d
nop dword [rax]
mov edx, esi
inc esi
movzx ecx, byte [rdx + r15]
movzx eax, byte [rdx + rbx + 0x10]
xor byte [rdx + rbx + 0x40], cl
xor al, cl
mov byte [rdx + rbp], al
dec r14
jne 0x140069f30
mov r12, qword [rsp + 0x48]
mov dword [rbx + 0x170], esi
mov rsi, qword [rsp + 0x88]
xor eax, eax
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
or eax, 0xffffffff
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x14006a250
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
push r14
push r15
mov eax, 0x50
call fcn.140150d80
sub rsp, rax
mov rax, qword [rcx + 0x180]
mov rdi, qword [rcx + 0x160]
mov rbx, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x168]
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x38], rax
add rcx, r9
movabs rax, 0xfffffffe0
mov r14, r9
mov r15, r8
mov rbp, rdx
cmp rcx, rax
ja 0x14006a4ad
cmp rcx, r9
jb 0x14006a4ad
cmp dword [rbx + 0x174], 0
mov qword [rsp + 0x88], rsi
mov qword [rbx + 0x38], rcx
mov qword [rsp + 0x48], r12
je 0x14006a2e1
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
call rdi
mov dword [rbx + 0x174], 0
mov esi, dword [rbx + 0x170]
mov r12d, dword [rbx + 0xc]
bswap r12d
mov dword [rsp + 0x80], esi
test esi, esi
je 0x14006a342
nop dword [rax]
test r14, r14
je 0x14006a330
mov ecx, esi
inc r15
inc rbp
movzx eax, byte [rcx + rbx + 0x10]
dec r14
xor al, byte [rbp - 1]
mov byte [r15 - 1], al
xor byte [rcx + rbx + 0x40], al
inc esi
and esi, 0xf
mov dword [rsp + 0x80], esi
jne 0x14006a300
jmp 0x14006a338
test esi, esi
jne 0x14006a48c
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
call rdi
mov r10, qword [rsp + 0xa0]
mov qword [rsp + 0x40], r13
cmp r14, 0xc00
jb 0x14006a3f5
movabs rax, 0xaaaaaaaaaaaaaaab
mul r14
mov rdi, rdx
shr rdi, 0xb
imul rax, rdi, 0xfffffffffffff400
add r14, rax
mov qword [rsp + 0x98], r14
mov r14, qword [rsp + 0x30]
nop word [rax + rax]
mov r9, r14
mov r8d, 0xc0
mov rdx, r15
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call r10
add r12d, 0xc0
lea rdx, [rbx + 0x60]
mov eax, r12d
lea rcx, [rbx + 0x40]
mov r9d, 0xc00
bswap eax
mov r8, r15
mov dword [rbx + 0xc], eax
call qword [rsp + gethostname]
mov r10, qword [rsp + 0xa0]
add r15, 0xc00
add rbp, 0xc00
dec rdi
jne 0x14006a390
mov esi, dword [rsp + 0x80]
mov r14, qword [rsp + 0x98]
mov r13, r14
and r13, 0xfffffffffffffff0
je 0x14006a441
mov r9, qword [rsp + 0x30]
mov rdi, r13
mov rdx, r15
shr rdi, 4
mov rcx, rbp
mov qword [rsp + 0x20], rbx
mov r8, rdi
call r10
add r12d, edi
lea rdx, [rbx + 0x60]
mov eax, r12d
lea rcx, [rbx + 0x40]
mov r9, r13
bswap eax
mov r8, r15
add rbp, r13
mov dword [rbx + 0xc], eax
sub r14, r13
call qword [rsp + gethostname]
add r15, r13
mov r13, qword [rsp + 0x40]
test r14, r14
je 0x14006a48c
mov r8, qword [rsp + 0x30]
lea rdx, [rbx + 0x10]
mov rcx, rbx
call qword [rbx + 0x178]
inc r12d
bswap r12d
mov dword [rbx + 0xc], r12d
nop word [rax + rax]
mov ecx, esi
inc esi
movzx edx, byte [rcx + rbp]
movzx eax, byte [rcx + rbx + 0x10]
xor edx, eax
mov byte [rcx + r15], dl
xor byte [rcx + rbx + 0x40], dl
dec r14
jne 0x14006a470
mov r12, qword [rsp + 0x48]
mov dword [rbx + 0x170], esi
mov rsi, qword [rsp + 0x88]
xor eax, eax
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
or eax, 0xffffffff
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret