joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140149f00
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x140149f3c
test edx, edx
je 0x140149f6c
movzx eax, byte [0x140498bab]
cmp al, 0x6a
je 0x140149f34
mov cl, 0xa9
nop word cs:[rax + rax]
mov al, 0xf9
lock cmpxchg byte [0x140498bab], cl
je 0x140149fcc
cmp al, 0x6a
jne 0x140149f20
lea rax, [0x140498ba0]
ret
test edx, edx
je 0x140149f9c
movzx eax, byte [0x140498972]
cmp al, 0x15
je 0x140149f64
mov cl, 0x22
nop dword [rax]
mov al, 0x4b
lock cmpxchg byte [0x140498972], cl
je 0x14014a001
cmp al, 0x15
jne 0x140149f50
lea rax, [0x140498970]
ret
movzx eax, byte [0x140498a60]
cmp al, 0x30
je 0x140149f94
mov cl, 0x88
nop dword [rax]
mov al, 0x1a
lock cmpxchg byte [0x140498a60], cl
je 0x14014a041
cmp al, 0x30
jne 0x140149f80
lea rax, [0x140498a50]
ret
movzx eax, byte [0x140498a02]
cmp al, 0xa5
je 0x140149fc4
mov cl, 0x23
nop dword [rax]
mov al, 0x93
lock cmpxchg byte [0x140498a02], cl
je 0x14014a081
cmp al, 0xa5
jne 0x140149fb0
lea rax, [0x1404989f0]
ret
xor eax, eax
lea rcx, [0x140498ba0]
lea rdx, [0x1403bcb90]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xb
jl 0x140149fe0
mov al, 0x6a
xchg byte [0x140498bab], al
lea rax, [0x140498ba0]
ret
xor eax, eax
lea rcx, [0x140498970]
lea rdx, [0x1403bc7b0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 2
jl 0x14014a020
mov al, 0x15
xchg byte [0x140498972], al
lea rax, [0x140498970]
ret
xor eax, eax
lea rcx, [0x140498a50]
lea rdx, [0x1403bca50]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x10
jl 0x14014a060
mov al, 0x30
xchg byte [0x140498a60], al
lea rax, [0x140498a50]
ret
xor eax, eax
lea rcx, [0x1404989f0]
lea rdx, [0x1403bc9f0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x12
jl 0x14014a0a0
mov al, 0xa5
xchg byte [0x140498a02], al
lea rax, [0x1404989f0]
ret
Function at 0x140154d50
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
movabs rbx, 0x9984d958403a33d5
mov r8, qword [rcx + 0x370]
mov rax, qword [rcx + 0x378]
sub rax, r8
shr rax, 5
imul eax, eax, 0xcccccccd
test eax, eax
jle 0x140154e38
mov edi, 0x80
movabs r14, 0xe5e28847bf04b4f5
xor r15d, r15d
mov ebp, 0x3748020e
movabs r12, 0xcccccccccccccccd
jmp 0x140154e26
mov edx, dword [r8 + rdi - 0x5c]
add r8, rdi
mov r9d, dword [0x14049af28]
add r9d, ebp
mov rcx, rsi
call fcn.140085650
mov r8, qword [rsi + 0x370]
mov rax, qword [rsi + 0x378]
sub rax, r8
sar rax, 5
imul rax, r12
mov ecx, dword [0x14049af20]
mov edx, ebx
sub edx, r14d
add edx, 0x1e
mov r9d, edx
xor r9d, ecx
and edx, ecx
lea ecx, [r9 + rdx*2]
add ecx, r14d
shl rax, cl
inc r15
sar rax, 0x20
add rdi, 0xa0
cmp r15, rax
jge 0x140154e38
cmp dword [r8 + rdi + 8], 0
jne 0x140154dc0
cmp qword [r8 + rdi + 8], 0
je 0x140154dda
jmp 0x140154dc0
movabs rcx, 0xf91cf246740c8e7b
mov rax, qword [rsi + 0x398]
add rax, rcx
sub rax, qword [rsi + 0x390]
sub rax, rcx
mov ecx, ebx
neg ecx
movabs rdx, 0xcf593503a9962f7a
mov r8d, dword [0x14049af20]
add r8d, edx
sub edx, r8d
mov r8d, ecx
xor r8d, edx
and edx, ecx
lea ecx, [r8 + rdx*2]
neg cl
shr rax, cl
test eax, eax
jle 0x140154f15
movabs r14, 0xc9493ced50350c8e
movabs r15, 0xb47fdf03dcec7634
movabs r12, 0x4db164be369a5b5c
xor edi, edi
movabs r13, 0x3c7328343466b8a8
lea rbp, [r14 + r15]
add rbp, r13
nop dword [rax + rax]
mov eax, dword [0x14049af28]
mov ecx, eax
xor ecx, 0x3748020e
and eax, 0x3748020e
lea r9d, [rcx + rax*2]
mov rcx, rsi
mov edx, edi
xor r8d, r8d
call fcn.140085650
inc edi
mov rax, qword [rsi + 0x398]
sub rax, r14
sub rax, r12
sub rax, r15
add rax, rbp
sub rax, qword [rsi + 0x390]
sub rax, r13
add rax, r12
mov ecx, dword [0x14049af20]
add ecx, ebx
shr rax, cl
cmp edi, eax
jl 0x140154ec0
lea rdi, [rsi + 0x558]
mov rcx, qword [rsi + 0x558]
test rcx, rcx
je 0x140154f51
cmp dword [rsi + 0x574], 1
jne 0x140154f3f
mov r8, qword [rsi + 0x560]
xor edx, edx
call fcn.14039e9a0
mov rcx, qword [rdi]
test rcx, rcx
je 0x140154f51
mov edx, 0x3935ad9d
call fcn.140084c10
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov byte [rsi + 0x570], 1
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.14007b380
Function at 0x14015af40
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov r11, qword [0x14049b488]
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x1404ee8fc]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
movsxd r8, dword [r11]
mov r10d, dword [0x1403bdef4]
test rdx, rdx
js 0x14015b11a
mov r14, qword [rdi + 8]
mov rbx, qword [rdi + 0x18]
sub rbx, r14
mov r9, rbx
shr r9, 1
movabs rax, 0x7fffffffffffffff
mov rdx, r9
xor rdx, rax
movzx ecx, byte [0x1404ee748]
mov r12d, dword [0x14049b480]
lea r15d, [r12 + 1]
mov dword [0x14049b480], r15d
mov r13d, r12d
not r13d
xor r12d, r15d
not r15d
and r15d, r13d
or r15d, r12d
xor r12d, r12d
xor r15d, 0xffffffff
jne 0x14015b003
test r10d, r10d
jle 0x14015b003
add r8, r11
xor r11d, r11d
xor r12d, r12d
movsxd r13, r11d
mov r13d, dword [r8 + r13]
xor r12d, r13d
add r11d, 4
cmp r11d, r10d
jl 0x14015aff0
mov r8, r9
xor r8, rbx
and r9, rbx
lea r8, [r8 + r9*2]
cmp r8, rsi
cmova rsi, r8
cmp rbx, rdx
cmova rsi, rax
test cl, 1
cmovne rsi, rax
test r14, r14
je 0x14015b08a
mov rcx, r14
xor edx, edx
mov r8, rbx
call fcn.14039e9a0
cmp rbx, 0x1000
jb 0x14015b065
mov rax, qword [r14 - 8]
cmp byte [0x1404ee91c], 0
jne 0x14015b05e
sub r14, rax
add r14, 0xfffffffffffffff8
cmp r14, 0x20
jae 0x14015b124
add rbx, 0x27
mov r14, rax
lea r13, [rdi + 8]
mov rcx, r14
mov rdx, rbx
mov r8d, 0xa270e721
call fcn.140084c10
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], 0
cmp rsi, 0x1000
jb 0x14015b0e4
cmp rsi, 0xffffffffffffffd9
jae 0x14015b11f
lea rcx, [rsi + 0x27]
mov edx, 0x2eede17
call fcn.140084df0
mov rcx, rax
mov eax, dword [0x1403bdffc]
xor edx, edx
cmp r15d, 1
sbb edx, edx
sub eax, r12d
xor edx, eax
not edx
test edx, eax
setne al
or al, byte [0x1404ee748]
and al, 1
mov byte [0x1404ee748], al
lea rax, [rcx + 0x27]
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14015b0fa
test rsi, rsi
je 0x14015b0f8
mov rcx, rsi
mov edx, 0x2eede17
call fcn.140084df0
jmp 0x14015b0fa
xor eax, eax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
add rsi, rax
mov qword [rdi + 0x18], rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.140159fb0
call fcn.14006e7a0
call fcn.140356a3c
int3
Function at 0x14018bdd0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test ecx, ecx
je 0x14018be09
test edx, edx
je 0x14018be39
movzx eax, byte [0x1404a0889]
cmp al, 0x2f
je 0x14018bec9
mov cl, 0x35
nop
mov al, 0xff
lock cmpxchg byte [0x1404a0889], cl
je 0x14018be99
cmp al, 0x2f
jne 0x14018bdf0
jmp 0x14018bec9
test edx, edx
je 0x14018be69
movzx eax, byte [0x1404a0705]
cmp al, 7
je 0x14018bf09
mov cl, 0xc2
nop
mov al, 0x45
lock cmpxchg byte [0x1404a0705], cl
je 0x14018bed5
cmp al, 7
jne 0x14018be20
jmp 0x14018bf09
movzx eax, byte [0x1404a08a8]
cmp al, 0x64
je 0x14018bf99
mov cl, 0x67
nop word [rax + rax]
mov al, 0x5c
lock cmpxchg byte [0x1404a08a8], cl
je 0x14018bf15
cmp al, 0x64
jne 0x14018be50
jmp 0x14018bf99
movzx eax, byte [0x1404a07d5]
cmp al, 0xe7
je 0x14018bfd9
mov cl, 0xa3
nop word [rax + rax]
mov al, 0x5d
lock cmpxchg byte [0x1404a07d5], cl
je 0x14018bfa2
cmp al, 0xe7
jne 0x14018be80
jmp 0x14018bfd9
xor eax, eax
lea rcx, [0x1404a0880]
lea rdx, [0x1403beec0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 9
jl 0x14018beb0
mov al, 0x2f
xchg byte [0x1404a0889], al
lea rax, [0x1404a0880]
jmp 0x14018bfe0
xor eax, eax
lea rcx, [0x1404a0700]
lea rdx, [0x1403bed60]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 5
jl 0x14018bef0
mov al, 7
xchg byte [0x1404a0705], al
lea rax, [0x1404a0700]
jmp 0x14018bfe0
cmp qword [0x1404eea30], 0
jne 0x14018bf6f
xor edi, edi
xor ecx, ecx
mov edx, 1
mov r8d, 4
mov r9d, 0x21d5f4e4
call fcn.14018bd70
mov rsi, rax
mov qword [0x1404eea30], rax
lea rcx, [0x14018b3a0]
mov edx, 0x5006f992
call fcn.140137f30
lea rax, [0x1403bef10]
nop dword [rax + rax]
movzx ecx, byte [rdi + rax]
mov byte [rsi + rdi], cl
inc rdi
cmp edi, 2
jle 0x14018bf60
mov rax, qword [0x1404eea30]
xor ecx, ecx
lea rdx, [0x1403bef20]
nop
movzx r8d, byte [rcx + rdx]
xor byte [rax + rcx], r8b
inc rcx
cmp ecx, 3
jl 0x14018bf80
mov al, 0x64
xchg byte [0x1404a08a8], al
mov rax, qword [0x1404eea30]
jmp 0x14018bfe0
xor eax, eax
lea rcx, [0x1404a07c0]
lea rdx, [0x1403bee10]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x15
jl 0x14018bfc0
mov al, 0xe7
xchg byte [0x1404a07d5], al
lea rax, [0x1404a07c0]
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1401cbac0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x1401cbafc
test edx, edx
je 0x1401cbb2c
cmp byte [0x1404a6957], 0
je 0x1401cbaf4
mov cl, 0x75
nop word cs:[rax + rax]
mov al, 0xa0
lock cmpxchg byte [0x1404a6957], cl
je 0x1401cbb8c
test al, al
jne 0x1401cbae0
lea rax, [0x1404a6950]
ret
test edx, edx
je 0x1401cbb5c
movzx eax, byte [0x1404a6acb]
cmp al, 0x7f
je 0x1401cbb24
mov cl, 0xa2
nop dword [rax]
mov al, 0x20
lock cmpxchg byte [0x1404a6acb], cl
je 0x1401cbbc1
cmp al, 0x7f
jne 0x1401cbb10
lea rax, [0x1404a6ac0]
ret
movzx eax, byte [0x1404a6a96]
cmp al, 0x46
je 0x1401cbb54
mov cl, 0x5c
nop dword [rax]
mov al, 0x93
lock cmpxchg byte [0x1404a6a96], cl
je 0x1401cbc01
cmp al, 0x46
jne 0x1401cbb40
lea rax, [0x1404a6a70]
ret
movzx eax, byte [0x1404a6946]
cmp al, 0xdc
je 0x1401cbb84
mov cl, 0xd1
nop dword [rax]
mov al, 0xcc
lock cmpxchg byte [0x1404a6946], cl
je 0x1401cbc41
cmp al, 0xdc
jne 0x1401cbb70
lea rax, [0x1404a6940]
ret
xor eax, eax
lea rcx, [0x1404a6950]
lea rdx, [0x1403c05f0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 7
jl 0x1401cbba0
xor eax, eax
xchg byte [0x1404a6957], al
lea rax, [0x1404a6950]
ret
xor eax, eax
lea rcx, [0x1404a6ac0]
lea rdx, [0x1403c0750]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xb
jl 0x1401cbbe0
mov al, 0x7f
xchg byte [0x1404a6acb], al
lea rax, [0x1404a6ac0]
ret
xor eax, eax
lea rcx, [0x1404a6a70]
lea rdx, [0x1403c0700]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x26
jl 0x1401cbc20
mov al, 0x46
xchg byte [0x1404a6a96], al
lea rax, [0x1404a6a70]
ret
xor eax, eax
lea rcx, [0x1404a6940]
lea rdx, [0x1403c05e0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 6
jl 0x1401cbc60
mov al, 0xdc
xchg byte [0x1404a6946], al
lea rax, [0x1404a6940]
ret
Function at 0x1401ccc90
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
mov rdi, qword [rcx]
mov r12, qword [rcx + 8]
sub r12, rdi
sar r12, 4
inc r12
mov rcx, qword [rcx + 0x10]
sub rcx, rdi
sar rcx, 4
mov rax, rcx
shr rax, 1
movabs r11, 0xfffffffffffffff
mov r10, r11
sub r10, rax
add rax, rcx
cmp rax, r12
cmovbe rax, r12
cmp rcx, r10
cmova rax, r11
mov rcx, rax
shr rcx, 0x3c
jne 0x1401ccf29
mov r15, rdx
mov rcx, rax
shl rcx, 4
cmp rax, 0x100
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], r8
jb 0x1401ccd61
cmp byte [0x1404ee731], 0
jne 0x1401ccd36
movabs rdx, 0xffffffffffffffe
cmp rax, rdx
jae 0x1401ccf29
mov r13, r9
add rcx, 0x27
mov edx, 0x97df8c59
call fcn.140084df0
mov rcx, rax
xor rcx, 0x27
mov edx, eax
and edx, 0x27
lea rbx, [rcx + rdx*2]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x1401ccd71
mov r13, r9
mov edx, 0x97df8c59
call fcn.140084df0
mov rbx, rax
mov r14, r15
sub r14, rdi
sar r14, 4
shl r14, 4
mov rax, qword [r13]
mov rcx, qword [rbp - 0x10]
mov rcx, qword [rcx]
mov qword [rbx + r14], rcx
mov qword [rbx + r14 + 8], rax
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
cmp rax, r15
je 0x1401ccdf6
cmp rcx, r15
je 0x1401ccdc3
mov rax, rbx
nop word [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
add rax, 0x10
add rcx, 0x10
cmp rcx, r15
jne 0x1401ccdb0
mov rax, qword [rsi + 8]
cmp rax, r15
je 0x1401cce13
lea rcx, [r14 + rbx]
add rcx, 0x10
nop word cs:[rax + rax]
movups xmm0, xmmword [r15]
movups xmmword [rcx], xmm0
add r15, 0x10
add rcx, 0x10
cmp r15, rax
jne 0x1401ccde0
jmp 0x1401cce13
cmp rcx, rax
je 0x1401cce16
mov rdx, rbx
nop
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
add rdx, 0x10
add rcx, 0x10
cmp rcx, rax
jne 0x1401cce00
mov rcx, qword [rsi]
add r14, rbx
movsxd r11, dword [0x1403c08ec]
mov edi, dword [0x1403c08e8]
test rcx, rcx
je 0x1401ccefc
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x1401ccef1
lea rax, [0x1403c08ec]
add r11, rax
mov rax, qword [rcx - 8]
mov r8d, dword [0x1404a6d24]
lea r9d, [r8 + 1]
mov dword [0x1404a6d24], r9d
xor r10d, r10d
test r8d, r9d
jne 0x1401cce93
test edi, edi
jle 0x1401cce93
xor r15d, r15d
xor r10d, r10d
nop word cs:[rax + rax]
movsxd r13, r15d
add r13, r11
xor r10d, dword [r13]
add r15d, 4
cmp r15d, edi
jl 0x1401cce80
cmp byte [0x1404eecc4], 0
jne 0x1401ccead
sub rcx, rax
add rcx, 0xfffffffffffffff8
cmp rcx, 0x20
jae 0x1401ccf2e
xor r11d, r11d
test r8d, r9d
setne r11b
mov r8d, dword [0x1403c08d4]
sub r8d, r10d
lea ecx, [r11 - 1]
xor ecx, r8d
not r8d
neg r11d
and r11d, r8d
or ecx, r11d
not ecx
test ecx, ecx
setne cl
or cl, byte [0x1404eecc4]
and cl, 1
mov byte [0x1404eecc4], cl
add rdx, 0x27
mov rcx, rax
mov r8d, 0x404aba79
call fcn.140084c10
mov qword [rsi], rbx
shl r12, 4
add r12, rbx
mov qword [rsi + 8], r12
mov rax, qword [rbp - 8]
add rax, rbx
mov qword [rsi + 0x10], rax
mov rax, r14
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.14006e7a0
call fcn.140356a3c
int3
Function at 0x1401d72f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rax, qword [rcx]
mov r14, qword [0x1404a8638]
mov rdi, rdx
mov rsi, rcx
movsxd r15, dword [r14]
mov ebx, dword [0x1403c12a4]
cmp rax, 0xffffffffffffffff
je 0x1401d7380
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x1401d7365
mov rax, qword [rsi + 0x10]
mov rax, qword [rax + 0x6e0]
xor ecx, ecx
call qword [case.0x14014757d.0]
cmp eax, 1
sete al
movzx ecx, byte [0x1404eec70]
test cl, al
jne 0x1401d735d
xor cl, al
je 0x1401d7365
mov qword [rsi + 8], 0
mov rcx, qword [rsi]
mov rax, qword [rsi + 0x10]
mov rax, qword [rax + 0x6e8]
call qword [case.0x14014757d.0]
mov qword [rsi], 0xffffffffffffffff
mov rax, r15
xor rax, r14
and r15, r14
lea rax, [rax + r15*2]
mov r14d, dword [0x1404a8630]
mov ecx, r14d
neg ecx
mov r15d, 1
sub r15d, ecx
mov dword [0x1404a8630], r15d
xor r15d, r14d
not r15d
xor r12d, r12d
test r15d, r14d
jne 0x1401d73ce
test ebx, ebx
jle 0x1401d73ce
xor ecx, ecx
xor r12d, r12d
movsxd rcx, ecx
xor r12d, dword [rax + rcx]
add ecx, 4
cmp ecx, ebx
jl 0x1401d73c0
mov rax, qword [rsi + 0x10]
cmp qword [rax + 0x6d0], 0
je 0x1401d74a2
mov rax, qword [rax + 0x698]
mov r13d, 1
mov edx, 1
mov r8d, 0x18
mov rcx, rdi
call qword [case.0x14014757d.0]
test rax, rax
jne 0x1401d745d
mov rax, qword [rsi + 0x10]
mov ecx, dword [0x1403c12a0]
and r15d, r14d
xor ebx, ebx
cmp r15d, 1
mov edx, 0
sbb edx, edx
sub ecx, r12d
test ecx, edx
setne cl
or cl, byte [0x1404eec70]
and cl, 1
mov byte [0x1404eec70], cl
mov rax, qword [rax + 0x698]
mov r13d, 2
mov edx, 2
mov r8d, 0x18
mov rcx, rdi
call qword [case.0x14014757d.0]
test rax, rax
je 0x1401d74a4
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x10], 0
movabs rax, 0x8800000038
mov qword [rbp - 0x38], rax
mov qword [rbp - 8], rdi
mov qword [rbp - 0x18], r13
mov rax, qword [rsi + 0x10]
mov rax, qword [rax + 0x6d0]
lea rcx, [rbp - 0x38]
call qword [case.0x14014757d.0]
mov qword [rsi], rax
mov bl, 1
jmp 0x1401d74a4
xor ebx, ebx
mov eax, ebx
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1401d7b80
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
movzx edx, byte [0x1404eec72]
mov eax, dword [0x1404a8adc]
mov qword [rbp - 8], rdx
or eax, edx
add eax, 0xffffe5ab
cdqe
add rax, qword [0x1404a8b08]
lea rcx, [rbp - 0x50]
mov edx, 0x4dd23840
call qword [case.0x14014757d.0]
mov rbx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x38], rax
mov rax, qword [0x1404a88b8]
movsxd r15, dword [rax]
add r15, rax
mov r12d, dword [0x1403c1514]
mov rax, qword [rbp - 8]
neg eax
mov qword [rbp - 0x30], rax
jmp 0x1401d7c67
add rax, 0x28
mov rdx, rax
mov rcx, r8
and esi, r13d
movzx eax, word [0x1403c152c]
cmp esi, 1
mov r8d, 0
sbb r8d, r8d
sub eax, r14d
and eax, r8d
test ax, ax
setne al
or al, byte [0x1404eec72]
and al, 1
mov byte [0x1404eec72], al
mov eax, dword [0x1404a8ae0]
xor eax, dword [rbp - 8]
add eax, 0xffffe5ab
cdqe
add rax, qword [0x1404a8b18]
mov r8d, 0x1da5cedd
call qword [case.0x14014757d.0]
mov rcx, qword [rbx + 8]
mov rax, rdi
call qword [case.0x14014757d.0]
add rbx, 0x10
cmp rbx, qword [rbp - 0x38]
je 0x1401d7d7a
cmp qword [rbx + 8], 0
je 0x1401d7c63
mov esi, dword [0x1404a88b0]
lea r13d, [rsi + 1]
mov dword [0x1404a88b0], r13d
test esi, r13d
je 0x1401d7ca0
xor r14d, r14d
jmp 0x1401d7ce0
xor eax, eax
mov r14d, 0
test r12d, r12d
jle 0x1401d7ce0
xor ecx, ecx
nop
movsxd rdx, eax
add rdx, r15
movzx edx, word [rdx]
mov r14d, edx
xor r14d, edx
not r14d
and r14d, ecx
xor r14d, edx
add eax, 2
mov ecx, r14d
cmp eax, r12d
jl 0x1401d7cb0
nop word cs:[rax + rax]
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], 0xf
mov eax, dword [0x1404a8ad4]
mov rcx, qword [rbp - 0x30]
add eax, ecx
add eax, 0xffffe5ab
cdqe
add rax, qword [0x1404a8af0]
mov ecx, 0x256b8913
call qword [case.0x14014757d.0]
mov rcx, qword [rax]
mov rax, qword [rax + 7]
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x21], rax
mov byte [rbp - 0x19], 0
lea rcx, [rbp - 0x28]
call fcn.1401d8090
mov rdi, rax
mov rax, qword [rbp - 0x10]
cmp byte [0x1404ee8f4], 0
jne 0x1401d7d4b
cmp rax, 0x10
jb 0x1401d7c56
mov rcx, qword [rbp - 0x28]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1401d7c03
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jb 0x1401d7bf9
call fcn.140356a3c
mov eax, dword [0x1404a8ad8]
mov rcx, qword [rbp - 8]
add eax, ecx
add eax, 0xffffe5ab
cdqe
add rax, qword [0x1404a8b10]
lea rcx, [rbp - 0x50]
call qword [case.0x14014757d.0]
nop
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x1401d99f0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1401d9a2c
test edx, edx
je 0x1401d9a6c
movzx eax, byte [0x1404a8c3c]
cmp al, 0x21
je 0x1401d9a24
mov cl, 0x9c
nop word cs:[rax + rax]
mov al, 0x5f
lock cmpxchg byte [0x1404a8c3c], cl
je 0x1401d9adc
cmp al, 0x21
jne 0x1401d9a10
lea rax, [0x1404a8c20]
ret
test edx, edx
je 0x1401d9a9c
test r8d, r8d
je 0x1401d9b11
movzx eax, byte [0x1404a8b5d]
cmp al, 0x72
je 0x1401d9a64
mov cl, 0xf9
nop word cs:[rax + rax]
mov al, 0x29
lock cmpxchg byte [0x1404a8b5d], cl
je 0x1401d9ba9
cmp al, 0x72
jne 0x1401d9a50
lea rax, [0x1404a8b50]
ret
movzx eax, byte [0x1404a8c9b]
cmp al, 0x45
je 0x1401d9a94
mov cl, 0xb8
nop dword [rax]
mov al, 0xfb
lock cmpxchg byte [0x1404a8c9b], cl
je 0x1401d9b3c
cmp al, 0x45
jne 0x1401d9a80
lea rax, [0x1404a8c90]
ret
test r8d, r8d
je 0x1401d9b71
movzx eax, byte [0x1404a8bf5]
cmp al, 0x60
je 0x1401d9ad4
mov cl, 0xaf
nop word cs:[rax + rax]
mov al, 0x7c
lock cmpxchg byte [0x1404a8bf5], cl
je 0x1401d9be1
cmp al, 0x60
jne 0x1401d9ac0
lea rax, [0x1404a8be0]
ret
xor eax, eax
lea rcx, [0x1404a8c20]
lea rdx, [0x1403c17c0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x1c
jl 0x1401d9af0
mov al, 0x21
xchg byte [0x1404a8c3c], al
lea rax, [0x1404a8c20]
ret
movzx eax, byte [0x1404a8c53]
cmp al, 0x47
je 0x1401d9b34
mov cl, 0x69
nop
mov al, 0x94
lock cmpxchg byte [0x1404a8c53], cl
je 0x1401d9c21
cmp al, 0x47
jne 0x1401d9b20
lea rax, [0x1404a8c50]
ret
xor eax, eax
lea rcx, [0x1404a8c90]
lea rdx, [0x1403c1830]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xb
jl 0x1401d9b50
mov al, 0x45
xchg byte [0x1404a8c9b], al
lea rax, [0x1404a8c90]
ret
movzx eax, byte [0x1404a8c12]
cmp al, 0xf9
je 0x1401d9c99
mov cl, 0xb2
nop word cs:[rax + rax]
mov al, 0xe8
lock cmpxchg byte [0x1404a8c12], cl
je 0x1401d9c61
cmp al, 0xf9
jne 0x1401d9b90
jmp 0x1401d9c99
xor eax, eax
lea rcx, [0x1404a8b50]
lea rdx, [0x1403c1700]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xd
jl 0x1401d9bc0
mov al, 0x72
xchg byte [0x1404a8b5d], al
lea rax, [0x1404a8b50]
ret
xor eax, eax
lea rcx, [0x1404a8be0]
lea rdx, [0x1403c1780]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x15
jl 0x1401d9c00
mov al, 0x60
xchg byte [0x1404a8bf5], al
lea rax, [0x1404a8be0]
ret
xor eax, eax
lea rcx, [0x1404a8c50]
lea rdx, [0x1403c17f0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 3
jl 0x1401d9c40
mov al, 0x47
xchg byte [0x1404a8c53], al
lea rax, [0x1404a8c50]
ret
xor eax, eax
lea rcx, [0x1404a8c00]
lea rdx, [0x1403c17a0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x12
jl 0x1401d9c80
mov al, 0xf9
xchg byte [0x1404a8c12], al
lea rax, [0x1404a8c00]
ret
Function at 0x1401dd3c0
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call fcn.14035a820
nop
add rsp, 0x28
ret

Function at 0x1401dd3e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x1401dd41c
test edx, edx
je 0x1401dd44c
movzx eax, byte [0x1404a8f12]
cmp al, 0xf6
je 0x1401dd414
mov cl, 0x59
nop word cs:[rax + rax]
mov al, 0x9e
lock cmpxchg byte [0x1404a8f12], cl
je 0x1401dd4ac
cmp al, 0xf6
jne 0x1401dd400
lea rax, [0x1404a8f10]
ret
test edx, edx
je 0x1401dd47c
movzx eax, byte [0x1404a8e3a]
cmp al, 0xa
je 0x1401dd444
mov cl, 0x3a
nop dword [rax]
mov al, 0x26
lock cmpxchg byte [0x1404a8e3a], cl
je 0x1401dd4e1
cmp al, 0xa
jne 0x1401dd430
lea rax, [0x1404a8e30]
ret
movzx eax, byte [0x1404a8de2]
cmp al, 0xa4
je 0x1401dd474
mov cl, 0x7b
nop dword [rax]
mov al, 0xca
lock cmpxchg byte [0x1404a8de2], cl
je 0x1401dd521
cmp al, 0xa4
jne 0x1401dd460
lea rax, [0x1404a8de0]
ret
movzx eax, byte [0x1404a8ef6]
cmp al, 0x4d
je 0x1401dd4a4
mov cl, 0x9b
nop dword [rax]
mov al, 0x3b
lock cmpxchg byte [0x1404a8ef6], cl
je 0x1401dd561
cmp al, 0x4d
jne 0x1401dd490
lea rax, [0x1404a8ed0]
ret
xor eax, eax
lea rcx, [0x1404a8f10]
lea rdx, [0x1403c1c20]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 2
jl 0x1401dd4c0
mov al, 0xf6
xchg byte [0x1404a8f12], al
lea rax, [0x1404a8f10]
ret
xor eax, eax
lea rcx, [0x1404a8e30]
lea rdx, [0x1403c1b40]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xa
jl 0x1401dd500
mov al, 0xa
xchg byte [0x1404a8e3a], al
lea rax, [0x1404a8e30]
ret
xor eax, eax
lea rcx, [0x1404a8de0]
lea rdx, [0x1403c1b00]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 2
jl 0x1401dd540
mov al, 0xa4
xchg byte [0x1404a8de2], al
lea rax, [0x1404a8de0]
ret
xor eax, eax
lea rcx, [0x1404a8ed0]
lea rdx, [0x1403c1be0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x26
jl 0x1401dd580
mov al, 0x4d
xchg byte [0x1404a8ef6], al
lea rax, [0x1404a8ed0]
ret