joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140049230
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x14020a260]
xor ebx, ebx
movdqu xmmword [rbp - 0x20], xmm0
mov eax, ebx
mov dword [rbp - 0x10], 0x444d7875
mov rsi, rcx
mov dword [rbp - 0xc], 0x78667471
mov dword [rbp - 8], 0x594676
mov byte [rbp - 4], 1
nop dword [rax]
xor byte [rbp + rax - 0x20], al
inc rax
cmp rax, 0x1b
jb 0x140049270
mov rdi, 0xffffffffffffffff
mov byte [rbp - 4], bl
mov rax, rdi
lea rcx, [rbp - 0x20]
nop
inc rax
cmp byte [rcx + rax], bl
jne 0x140049290
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
mov r8, qword [rsi + 0x10]
jb 0x1400492a9
mov rcx, qword [rsi]
mov qword [rsp + 0x68], r14
cmp r8, rax
jne 0x1400492c4
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400493ab
movdqa xmm0, xmmword [0x14020ac70]
mov rcx, rbx
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x81ba8982
mov dword [rbp - 0xc], 0xbb8d8d91
mov word [rbp - 8], 0xa6
mov byte [rbp - 6], 1
nop dword [rax]
lea eax, [rcx - 0x33]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x19
jb 0x1400492f0
mov r14, qword [rsi + 0x10]
lea rcx, [rbp - 0x20]
mov byte [rbp - 6], bl
mov rax, rdi
nop
inc rax
cmp byte [rcx + rax], bl
jne 0x140049310
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x140049325
mov rcx, qword [rsi]
cmp r14, rax
jne 0x14004933a
mov r8, r14
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400493ab
movdqa xmm0, xmmword [0x14020a400]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x90bebb8a
mov dword [rbp - 0xc], 0xa7bc8c8e
mov word [rbp - 8], 0x100
nop dword [rax + rax]
lea eax, [rbx - 0x33]
xor byte [rbp + rbx - 0x20], al
inc rbx
cmp rbx, 0x18
jb 0x140049360
mov byte [rbp - 7], 0
lea rax, [rbp - 0x20]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140049380
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x140049396
mov rcx, qword [rsi]
cmp r14, rdi
jne 0x1400493b7
mov r8, r14
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400493b7
mov rcx, rsi
call fcn.14000b7e0
mov al, 1
jmp 0x1400493c1
mov rcx, rsi
call fcn.14000b7e0
xor al, al
mov r14, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400498f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x14020a7b0]
xor ebx, ebx
mov rsi, rcx
mov dword [rbp - 0x10], 0x1009d82
movdqu xmmword [rbp - 0x20], xmm0
mov ecx, ebx
nop word [rax + rax]
lea eax, [rcx - 0x33]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x12
jb 0x140049920
mov rdi, 0xffffffffffffffff
mov byte [rbp - 0xd], bl
mov rax, rdi
lea rcx, [rbp - 0x20]
inc rax
cmp byte [rcx + rax], bl
jne 0x140049941
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
mov r8, qword [rsi + 0x10]
jb 0x14004995a
mov rcx, qword [rsi]
mov qword [rsp + 0x68], r14
cmp r8, rax
jne 0x140049975
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140049aab
movdqa xmm0, xmmword [0x14020a7c0]
mov rcx, rbx
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x1009d82
nop dword [rax]
lea eax, [rcx - 0x33]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x12
jb 0x140049990
mov r14, qword [rsi + 0x10]
lea rcx, [rbp - 0x20]
mov byte [rbp - 0xd], bl
mov rax, rdi
nop
inc rax
cmp byte [rcx + rax], bl
jne 0x1400499b0
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x1400499c5
mov rcx, qword [rsi]
cmp r14, rax
jne 0x1400499de
mov r8, r14
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140049aab
movdqa xmm0, xmmword [0x14020a7e0]
mov rcx, rbx
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x1009d82
nop word [rax + rax]
lea eax, [rcx - 0x33]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x12
jb 0x140049a00
mov byte [rbp - 0xd], bl
lea rcx, [rbp - 0x20]
mov rax, rdi
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], bl
jne 0x140049a20
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x140049a35
mov rcx, qword [rsi]
cmp r14, rax
jne 0x140049a4a
mov r8, r14
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140049aab
movdqa xmm0, xmmword [0x14020a7d0]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x1009d82
nop
lea eax, [rbx - 0x33]
xor byte [rbp + rbx - 0x20], al
inc rbx
cmp rbx, 0x12
jb 0x140049a60
mov byte [rbp - 0xd], 0
lea rax, [rbp - 0x20]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140049a80
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x140049a96
mov rcx, qword [rsi]
cmp r14, rdi
jne 0x140049ab7
mov r8, r14
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140049ab7
mov rcx, rsi
call fcn.14000b7e0
mov al, 1
jmp 0x140049ac1
mov rcx, rsi
call fcn.14000b7e0
xor al, al
mov r14, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140049ae0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
movdqa xmm0, xmmword [0x14020a430]
mov rbx, rcx
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x90beac8a
xor ecx, ecx
mov dword [rsp + 0x34], 0xbb918791
mov word [rsp + 0x38], 0xa6
mov byte [rsp + 0x3a], 1
nop word [rax + rax]
lea eax, [rcx - 0x33]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x19
jb 0x140049b20
mov byte [rsp + 0x3a], 0
lea rcx, [rsp + 0x20]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140049b41
cmp qword [rbx + 0x18], 0x10
mov rcx, rbx
mov r8, qword [rbx + 0x10]
jb 0x140049b5b
mov rcx, qword [rbx]
cmp r8, rax
jne 0x140049b7e
lea rdx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140049b7e
mov rcx, rbx
call fcn.14000b7e0
mov al, 1
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.14000b7e0
xor al, al
add rsp, 0x40
pop rbx
ret
Function at 0x140049b90
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x14020a250]
xor ebx, ebx
movdqu xmmword [rbp - 0x20], xmm0
mov eax, ebx
mov dword [rbp - 0x10], 0x444d2821
mov rsi, rcx
mov dword [rbp - 0xc], 0x67667466
mov dword [rbp - 8], 0x58456b7d
mov word [rbp - 4], 0x100
nop
xor byte [rbp + rax - 0x20], al
inc rax
cmp rax, 0x1c
jb 0x140049bd0
mov rdi, 0xffffffffffffffff
mov byte [rbp - 3], bl
mov rax, rdi
lea rcx, [rbp - 0x20]
nop
inc rax
cmp byte [rcx + rax], bl
jne 0x140049bf0
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
mov r8, qword [rsi + 0x10]
jb 0x140049c09
mov rcx, qword [rsi]
mov qword [rsp + 0x68], r14
cmp r8, rax
jne 0x140049c24
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140049d80
movdqa xmm0, xmmword [0x14020a240]
mov rax, rbx
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x444d5a25
mov dword [rbp - 0xc], 0x67667466
mov dword [rbp - 8], 0x58456b7d
mov word [rbp - 4], 0x100
nop
xor byte [rbp + rax - 0x20], al
inc rax
cmp rax, 0x1c
jb 0x140049c50
mov r14, qword [rsi + 0x10]
lea rcx, [rbp - 0x20]
mov byte [rbp - 3], bl
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], bl
jne 0x140049c70
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x140049c85
mov rcx, qword [rsi]
cmp r14, rax
jne 0x140049c9e
mov r8, r14
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140049d80
movdqa xmm0, xmmword [0x14020a2d0]
mov rax, rbx
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x61454e79
mov dword [rbp - 0xc], 0x72666575
mov dword [rbp - 8], 0x59466a
mov byte [rbp - 4], 1
nop word [rax + rax]
xor byte [rbp + rax - 0x20], al
inc rax
cmp rax, 0x1b
jb 0x140049cd0
mov byte [rbp - 4], bl
lea rcx, [rbp - 0x20]
mov rax, rdi
inc rax
cmp byte [rcx + rax], bl
jne 0x140049ce7
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x140049cfc
mov rcx, qword [rsi]
cmp r14, rax
jne 0x140049d11
mov r8, r14
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140049d80
movdqa xmm0, xmmword [0x14020a1a0]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x444d2840
mov dword [rbp - 0xc], 0x67667466
mov dword [rbp - 8], 0x58456b7d
mov word [rbp - 4], 0x100
nop dword [rax]
xor byte [rbp + rbx - 0x20], bl
inc rbx
cmp rbx, 0x1c
jb 0x140049d40
mov byte [rbp - 3], 0
lea rax, [rbp - 0x20]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140049d55
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x140049d6b
mov rcx, qword [rsi]
cmp r14, rdi
jne 0x140049d8c
mov r8, r14
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140049d8c
mov rcx, rsi
call fcn.14000b7e0
mov al, 1
jmp 0x140049d96
mov rcx, rsi
call fcn.14000b7e0
xor al, al
mov r14, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004a140
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x14020a890]
xor ebx, ebx
mov rsi, rcx
mov dword [rbp - 0x10], 0x85afaebc
movdqu xmmword [rbp - 0x20], xmm0
mov ecx, ebx
mov dword [rbp - 0xc], 0xa0bd93
mov byte [rbp - 8], 1
nop word [rax + rax]
lea eax, [rcx - 0x33]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x17
jb 0x14004a180
mov rdi, 0xffffffffffffffff
mov byte [rbp - 8], bl
mov rax, rdi
lea rcx, [rbp - 0x20]
inc rax
cmp byte [rcx + rax], bl
jne 0x14004a1a1
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
mov r8, qword [rsi + 0x10]
jb 0x14004a1ba
mov rcx, qword [rsi]
mov qword [rsp + 0x68], r14
cmp r8, rax
jne 0x14004a1d5
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14004a2bb
movdqa xmm0, xmmword [0x14020ad80]
mov rcx, rbx
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x92baaead
mov dword [rbp - 0xc], 0x100a1be
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x33]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x16
jb 0x14004a200
mov r14, qword [rsi + 0x10]
lea rcx, [rbp - 0x20]
mov byte [rbp - 9], bl
mov rax, rdi
nop
inc rax
cmp byte [rcx + rax], bl
jne 0x14004a220
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x14004a235
mov rcx, qword [rsi]
cmp r14, rax
jne 0x14004a24a
mov r8, r14
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14004a2bb
movdqa xmm0, xmmword [0x14020a880]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x85afaebc
mov dword [rbp - 0xc], 0xa0bd93
mov byte [rbp - 8], 1
nop dword [rax]
lea eax, [rbx - 0x33]
xor byte [rbp + rbx - 0x20], al
inc rbx
cmp rbx, 0x17
jb 0x14004a270
mov byte [rbp - 8], 0
lea rax, [rbp - 0x20]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14004a290
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x14004a2a6
mov rcx, qword [rsi]
cmp r14, rdi
jne 0x14004a2c7
mov r8, r14
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004a2c7
mov rcx, rsi
call fcn.14000b7e0
mov al, 1
jmp 0x14004a2d1
mov rcx, rsi
call fcn.14000b7e0
xor al, al
mov r14, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004a2f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movdqa xmm0, xmmword [0x14020a630]
xor ebx, ebx
mov rsi, rcx
mov word [rsp + 0x30], 0x100
movdqu xmmword [rsp + 0x20], xmm0
mov ecx, ebx
nop dword [rax + rax]
lea eax, [rcx - 0x33]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x10
jb 0x14004a320
mov rdi, 0xffffffffffffffff
mov byte [rsp + 0x31], bl
mov rax, rdi
lea rcx, [rsp + 0x20]
inc rax
cmp byte [rcx + rax], bl
jne 0x14004a343
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
mov r8, qword [rsi + 0x10]
jb 0x14004a35c
mov rcx, qword [rsi]
cmp r8, rax
jne 0x14004a36f
lea rdx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14004a3d9
movdqa xmm0, xmmword [0x14020ae70]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x1009d82
nop word [rax + rax]
lea eax, [rbx - 0x33]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x12
jb 0x14004a390
mov r8, qword [rsi + 0x10]
lea rax, [rsp + 0x20]
mov byte [rsp + 0x33], 0
nop
inc rdi
cmp byte [rax + rdi], 0
jne 0x14004a3b0
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x14004a3c6
mov rcx, qword [rsi]
cmp r8, rdi
jne 0x14004a3f3
lea rdx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004a3f3
mov rcx, rsi
call fcn.14000b7e0
mov al, 1
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov rcx, rsi
call fcn.14000b7e0
mov rbx, qword [rsp + 0x58]
xor al, al
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14004a410
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x14020a7a0]
xor ebx, ebx
mov rsi, rcx
mov dword [rbp - 0x10], 0xa380acb8
movdqu xmmword [rbp - 0x20], xmm0
mov ecx, ebx
mov word [rbp - 0xc], 0x100
lea eax, [rcx - 0x33]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x14
jb 0x14004a440
mov rdi, 0xffffffffffffffff
mov byte [rbp - 0xb], bl
mov rax, rdi
lea rcx, [rbp - 0x20]
inc rax
cmp byte [rcx + rax], bl
jne 0x14004a461
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
mov r8, qword [rsi + 0x10]
jb 0x14004a47a
mov rcx, qword [rsi]
mov qword [rsp + 0x68], r14
cmp r8, rax
jne 0x14004a495
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14004a572
movdqa xmm0, xmmword [0x14020a820]
mov rcx, rbx
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xbfadbbad
mov word [rbp - 0xc], 0xa2
mov byte [rbp - 0xa], 1
nop word [rax + rax]
lea eax, [rcx - 0x33]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x15
jb 0x14004a4c0
mov r14, qword [rsi + 0x10]
lea rcx, [rbp - 0x20]
mov byte [rbp - 0xa], bl
mov rax, rdi
nop
inc rax
cmp byte [rcx + rax], bl
jne 0x14004a4e0
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x14004a4f5
mov rcx, qword [rsi]
cmp r14, rax
jne 0x14004a50a
mov r8, r14
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14004a572
movdqa xmm0, xmmword [0x14020a280]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x444d7f65
mov dword [rbp - 0xc], 0x67667466
mov dword [rbp - 8], 0x58456b7d
mov word [rbp - 4], 0x100
xor byte [rbp + rbx - 0x20], bl
inc rbx
cmp rbx, 0x1c
jb 0x14004a532
mov byte [rbp - 3], 0
lea rax, [rbp - 0x20]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14004a547
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x14004a55d
mov rcx, qword [rsi]
cmp r14, rdi
jne 0x14004a57e
mov r8, r14
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004a57e
mov rcx, rsi
call fcn.14000b7e0
mov al, 1
jmp 0x14004a588
mov rcx, rsi
call fcn.14000b7e0
xor al, al
mov r14, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004a5a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x14020a3d0]
xor ebx, ebx
mov rsi, rcx
mov dword [rbp - 0x10], 0xbfeca891
movdqu xmmword [rbp - 0x20], xmm0
mov ecx, ebx
mov word [rbp - 0xc], 0xa2
mov byte [rbp - 0xa], 1
nop dword [rax]
lea eax, [rcx - 0x33]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x15
jb 0x14004a5e0
mov rdi, 0xffffffffffffffff
mov byte [rbp - 0xa], bl
mov rax, rdi
lea rcx, [rbp - 0x20]
inc rax
cmp byte [rcx + rax], bl
jne 0x14004a601
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
mov r8, qword [rsi + 0x10]
jb 0x14004a61a
mov rcx, qword [rsi]
cmp r8, rax
jne 0x14004a62c
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14004a698
movdqa xmm0, xmmword [0x14020a3d0]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xbfeda891
mov word [rbp - 0xc], 0xa2
mov byte [rbp - 0xa], 1
nop word [rax + rax]
lea eax, [rbx - 0x33]
xor byte [rbp + rbx - 0x20], al
inc rbx
cmp rbx, 0x15
jb 0x14004a650
mov r8, qword [rsi + 0x10]
lea rax, [rbp - 0x20]
mov byte [rbp - 0xa], 0
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14004a670
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x14004a686
mov rcx, qword [rsi]
cmp r8, rdi
jne 0x14004a6a4
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004a6a4
mov rcx, rsi
call fcn.14000b7e0
mov al, 1
jmp 0x14004a6ae
mov rcx, rsi
call fcn.14000b7e0
xor al, al
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop rbp
ret
Function at 0x14004a6d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x14020a770]
xor ebx, ebx
mov rsi, rcx
mov dword [rbp - 0x10], 0xd3a99282
movdqu xmmword [rbp - 0x20], xmm0
mov ecx, ebx
mov dword [rbp - 0xc], 0x100a1be
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x33]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x16
jb 0x14004a710
mov rdi, 0xffffffffffffffff
mov byte [rbp - 9], bl
mov rax, rdi
lea rcx, [rbp - 0x20]
inc rax
cmp byte [rcx + rax], bl
jne 0x14004a731
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
mov r8, qword [rsi + 0x10]
jb 0x14004a74a
mov rcx, qword [rsi]
mov qword [rsp + 0x68], r14
cmp r8, rax
jne 0x14004a765
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14004a8cb
movdqa xmm0, xmmword [0x14020a770]
mov rcx, rbx
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xd2a99282
mov dword [rbp - 0xc], 0x100a1be
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x33]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x16
jb 0x14004a790
mov r14, qword [rsi + 0x10]
lea rcx, [rbp - 0x20]
mov byte [rbp - 9], bl
mov rax, rdi
nop
inc rax
cmp byte [rcx + rax], bl
jne 0x14004a7b0
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x14004a7c5
mov rcx, qword [rsi]
cmp r14, rax
jne 0x14004a7de
mov r8, r14
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14004a8cb
movdqa xmm0, xmmword [0x14020a770]
mov rcx, rbx
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xd2a99282
mov dword [rbp - 0xc], 0xa7bca0be
mov word [rbp - 8], 0x100
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x33]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x18
jb 0x14004a810
mov byte [rbp - 7], bl
lea rcx, [rbp - 0x20]
mov rax, rdi
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], bl
jne 0x14004a830
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x14004a845
mov rcx, qword [rsi]
cmp r14, rax
jne 0x14004a85a
mov r8, r14
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14004a8cb
movdqa xmm0, xmmword [0x14020a770]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xd3a99282
mov dword [rbp - 0xc], 0xa7bca0be
mov word [rbp - 8], 0x100
nop dword [rax + rax]
lea eax, [rbx - 0x33]
xor byte [rbp + rbx - 0x20], al
inc rbx
cmp rbx, 0x18
jb 0x14004a880
mov byte [rbp - 7], 0
lea rax, [rbp - 0x20]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14004a8a0
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x14004a8b6
mov rcx, qword [rsi]
cmp r14, rdi
jne 0x14004a8d7
mov r8, r14
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004a8d7
mov rcx, rsi
call fcn.14000b7e0
mov al, 1
jmp 0x14004a8e1
mov rcx, rsi
call fcn.14000b7e0
xor al, al
mov r14, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004a900
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x40
movdqa xmm0, xmmword [0x14020a780]
xor ebx, ebx
mov rsi, rcx
mov dword [rbp - 0x10], 0x9c81ee
movdqu xmmword [rbp - 0x20], xmm0
mov ecx, ebx
mov byte [rbp - 0xc], 1
nop
lea eax, [rcx - 0x33]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x13
jb 0x14004a930
mov rdi, 0xffffffffffffffff
mov byte [rbp - 0xc], bl
mov rax, rdi
lea rcx, [rbp - 0x20]
inc rax
cmp byte [rcx + rax], bl
jne 0x14004a951
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
mov r8, qword [rsi + 0x10]
jb 0x14004a96a
mov rcx, qword [rsi]
mov qword [rsp + 0x68], r14
cmp r8, rax
jne 0x14004a985
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14004aadb
movdqa xmm0, xmmword [0x14020a780]
mov rcx, rbx
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0xbf9d81ee
mov word [rbp - 0xc], 0xa2
mov byte [rbp - 0xa], 1
nop word [rax + rax]
lea eax, [rcx - 0x33]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x15
jb 0x14004a9b0
mov r14, qword [rsi + 0x10]
lea rcx, [rbp - 0x20]
mov byte [rbp - 0xa], bl
mov rax, rdi
nop
inc rax
cmp byte [rcx + rax], bl
jne 0x14004a9d0
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x14004a9e5
mov rcx, qword [rsi]
cmp r14, rax
jne 0x14004a9fe
mov r8, r14
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14004aadb
movdqa xmm0, xmmword [0x14020a780]
mov rcx, rbx
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x9c81ef
mov byte [rbp - 0xc], 1
nop dword [rax]
lea eax, [rcx - 0x33]
xor byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x13
jb 0x14004aa20
mov byte [rbp - 0xc], bl
lea rcx, [rbp - 0x20]
mov rax, rdi
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], bl
jne 0x14004aa40
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x14004aa55
mov rcx, qword [rsi]
cmp r14, rax
jne 0x14004aa6a
mov r8, r14
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14004aadb
movdqa xmm0, xmmword [0x14020a780]
movdqu xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x10], 0x9d81ef
mov byte [rbp - 0xc], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx - 0x33]
xor byte [rbp + rbx - 0x20], al
inc rbx
cmp rbx, 0x13
jb 0x14004aa90
mov byte [rbp - 0xc], 0
lea rax, [rbp - 0x20]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x14004aab0
cmp qword [rsi + 0x18], 0x10
mov rcx, rsi
jb 0x14004aac6
mov rcx, qword [rsi]
cmp r14, rdi
jne 0x14004aae7
mov r8, r14
lea rdx, [rbp - 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004aae7
mov rcx, rsi
call fcn.14000b7e0
mov al, 1
jmp 0x14004aaf1
mov rcx, rsi
call fcn.14000b7e0
xor al, al
mov r14, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret