joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f8c34
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movabs rax, 0xfffffffffffffff
mov qword [rsp + 0x20], rcx
mov rsi, rcx
mov r8d, 1
bsr rcx, rax
mov eax, r8d
shl rax, cl
cmp rdx, rax
jbe 0x1400f8c7d
lea rcx, str.invalid_hash_bucket_count
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
mov rbp, qword [rsi + 8]
lea rax, [rdx - 1]
or rax, r8
lea r12, [rsi + 0x18]
bsr rcx, rax
mov rbx, r8
mov r8, rbp
inc ecx
shl rbx, cl
mov rcx, r12
lea rdx, [rbx + rbx]
call fcn.1400f7d34
lea rax, [rbx - 1]
mov qword [rsi + 0x38], rbx
mov qword [rsi + 0x30], rax
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
mov rdi, rbx
cmp rbx, rbp
je 0x1400f8e0d
mov rdi, qword [rdi]
lea r15, [rbx + 0x10]
mov rax, qword [r15 + 0x18]
mov rdx, r15
mov r13, qword [r15 + 0x10]
cmp rax, 0xf
jbe 0x1400f8ce1
mov rdx, qword [r15]
xor ecx, ecx
movabs r14, 0xcbf29ce484222325
test r13, r13
je 0x1400f8d13
movzx eax, byte [rdx + rcx]
movabs r8, 0x100000001b3
xor r14, rax
inc rcx
imul r14, r8
cmp rcx, r13
jb 0x1400f8cf2
mov rax, qword [r15 + 0x18]
and r14, qword [rsi + 0x30]
mov r12, qword [r12]
add r14, r14
cmp qword [r12 + r14*8], rbp
jne 0x1400f8d32
mov qword [r12 + r14*8], rbx
mov qword [r12 + r14*8 + 8], rbx
jmp 0x1400f8dfd
mov rsi, qword [r12 + r14*8 + 8]
lea rdx, [rsi + 0x10]
cmp qword [rdx + 0x18], 0xf
mov r8, qword [rdx + 0x10]
jbe 0x1400f8d49
mov rdx, qword [rdx]
mov rcx, r15
cmp rax, 0xf
jbe 0x1400f8d55
mov rcx, qword [r15]
cmp r13, r8
jne 0x1400f8dcd
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400f8dc9
mov r8, qword [rsi]
cmp r8, rbx
je 0x1400f8d8f
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12 + r14*8 + 8], rbx
jmp 0x1400f8df8
mov rsi, qword [rsi + 8]
lea rdx, [rsi + 0x10]
cmp qword [rdx + 0x18], 0xf
mov r8, qword [rdx + 0x10]
jbe 0x1400f8dac
mov rdx, qword [rdx]
mov rcx, r15
cmp rax, 0xf
jbe 0x1400f8db8
mov rcx, qword [r15]
cmp r13, r8
jne 0x1400f8dcd
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400f8e35
mov rax, qword [r15 + 0x18]
cmp qword [r12 + r14*8], rsi
jne 0x1400f8d96
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rsi
mov rax, qword [rsi + 8]
mov qword [rax], rbx
mov qword [rsi + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12 + r14*8], rbx
mov rsi, qword [rsp + 0x20]
lea r12, [rsi + 0x18]
mov rbx, rdi
cmp rdi, rbp
jne 0x1400f8cc6
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call fcn.1400f8e5c
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8, qword [rsi]
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
jmp 0x1400f8df8
Function at 0x1400f8f30
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, rdx
mov qword [rsp + 0x20], rcx
mov rbp, r8
mov rdx, rcx
cmp r14, r8
je 0x1400f90d0
mov rax, qword [rcx + 8]
mov rsi, r14
mov r12, qword [rcx + 0x18]
lea rcx, [r14 + 0x10]
cmp qword [rcx + 0x18], 0xf
mov r15, qword [r14 + 8]
mov r10, qword [rcx + 0x10]
mov qword [rsp + 0x30], rax
jbe 0x1400f8f89
mov rcx, qword [rcx]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
movabs r11, 0x100000001b3
test r10, r10
je 0x1400f8fb9
movzx eax, byte [rcx + r8]
inc r8
xor r9, rax
imul r9, r11
cmp r8, r10
jb 0x1400f8fa5
mov r13, qword [rdx + 0x30]
and r13, r9
add r13, r13
mov rax, qword [r12 + r13*8]
mov qword [rsp + 0x28], rax
mov rax, qword [r12 + r13*8 + 8]
mov qword [rsp + 0x38], rax
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x10]
call fcn.140063264
mov edx, 0x50
mov rcx, rbx
call fcn.1400fefc0
mov rdx, qword [rsp + 0x20]
dec qword [rdx + 0x10]
cmp rbx, qword [rsp + 0x38]
je 0x1400f901e
cmp rsi, rbp
jne 0x1400f8fd6
cmp qword [rsp + 0x28], r14
jne 0x1400f90c9
mov qword [r12 + r13*8], rsi
jmp 0x1400f90c9
cmp qword [rsp + 0x28], r14
jne 0x1400f9033
mov r8, qword [rsp + 0x30]
mov qword [r12 + r13*8], r8
mov rax, r8
jmp 0x1400f9036
mov rax, r15
mov qword [r12 + r13*8 + 8], rax
jmp 0x1400f90ff
lea rcx, [rsi + 0x10]
cmp qword [rcx + 0x18], 0xf
mov r9, qword [rcx + 0x10]
jbe 0x1400f9052
mov rcx, qword [rcx]
xor r8d, r8d
movabs r14, 0xcbf29ce484222325
test r9, r9
je 0x1400f9087
movabs rdx, 0x100000001b3
movzx eax, byte [r8 + rcx]
inc r8
xor r14, rax
imul r14, rdx
cmp r8, r9
jb 0x1400f906e
mov rdx, qword [rsp + 0x20]
and r14, qword [rdx + 0x30]
add r14, r14
mov r13, qword [r12 + r14*8 + 8]
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x10]
call fcn.140063264
mov edx, 0x50
mov rcx, rbx
call fcn.1400fefc0
mov rdx, qword [rsp + 0x20]
dec qword [rdx + 0x10]
cmp rbx, r13
je 0x1400f90f1
cmp rsi, rbp
jne 0x1400f9093
mov qword [r12 + r14*8], rsi
mov qword [r15], rsi
mov qword [rsi + 8], r15
lea r11, [rsp + 0x40]
mov rax, rbp
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, qword [rsp + 0x30]
mov qword [r12 + r14*8], rax
mov qword [r12 + r14*8 + 8], rax
cmp rsi, rbp
jne 0x1400f9040
jmp 0x1400f90c9
Function at 0x1400fb5f8
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x14015b040]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
lea r9, [rbp - 0x30]
and dword [rbp - 0x30], ebx
mov r14, rcx
xor r8d, r8d
xor edx, edx
lea edi, [rbx + 0xb]
mov ecx, edi
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, 0xc0000004
jmp 0x1400fb67a
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x30]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rbp - 0x30]
lea r9, [rbp - 0x30]
mov rdx, rax
mov ecx, edi
mov rbx, rax
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, esi
je 0x1400fb63e
test eax, eax
js 0x1400fb73a
xor edi, edi
cmp dword [rbx], edi
jbe 0x1400fb73a
and qword [rbp - 0x18], 0
xorps xmm0, xmm0
and qword [rbp - 0x10], 0
mov eax, edi
imul rsi, rax, 0x128
movups xmmword [rbp - 0x28], xmm0
movzx edx, word [rsi + rbx + 0x2e]
add rdx, 0x30
add rdx, rsi
add rdx, rbx
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x1400fb6bd
lea rcx, [rbp - 0x28]
call fcn.140045210
cmp qword [r14 + 0x18], 0xf
mov rdx, r14
jbe 0x1400fb6dd
mov rdx, qword [r14]
cmp qword [rbp - 0x10], 0xf
lea rcx, [rbp - 0x28]
cmova rcx, qword [rbp - 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400fb76e
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x1400fb730
mov rcx, qword [rbp - 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fb72b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400fb7b6
call fcn.1400fefc0
inc edi
cmp edi, dword [rbx]
jb 0x1400fb690
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400feed0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov rdi, qword [rsi + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x1400fb7c2
mov rcx, qword [rbp - 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fb7bd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400fb7bd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400fefc0
mov rax, rdi
jmp 0x1400fb74d
Function at 0x1400fba7c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1400fbaac
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1400fbb24
mov rax, qword [rcx + 0x40]
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x1400fbac3
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400fbac5
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400fbb1e
test ecx, ecx
jle 0x1400fbafe
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400fbb1e
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400fbb1e
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x1400fbb40
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400fbb60
xor eax, eax
jmp 0x1400fbc49
cmp qword [rcx + 0x68], 0
je 0x1400fbb72
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x1400fbc49
mov rax, qword [rcx + 0x38]
mov rdi, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400fbb89
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400fbb8b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400fbbbd
cmp rax, rbp
mov rbx, rbp
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rbx
sub rdi, rbx
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400fbc43
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400fbbf4
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov ebx, 0xfff
jmp 0x1400fbc1e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rdi, rax
cmp rax, rbx
jne 0x1400fbc43
cmp rdi, rbx
ja 0x1400fbbfb
test rdi, rdi
je 0x1400fbc43
mov r9, qword [rsi + 0x80]
mov r8, rdi
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rbp, rdi
mov rax, rbp
add rsp, 0x20
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400fc110
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14015b040]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x1400fc149
xor eax, eax
jmp 0x1400fc269
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x1400fc183
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x1400fc183
lea ecx, [r8 - 1]
mov eax, esi
mov dword [rdx], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
jmp 0x1400fc269
cmp qword [rbx + 0x80], 0
je 0x1400fc267
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400fc1be
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400fc1df
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, edi
jmp 0x1400fc264
lea rax, [rbp - 0x40]
mov byte [rbp - 0x30], sil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x2f]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x28], rax
lea r8, [rbp - 0x30]
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400fc22d
sub eax, 1
je 0x1400fc22d
cmp eax, 2
jne 0x1400fc267
movsx ecx, byte [rbp - 0x30]
jmp 0x1400fc1cb
mov r14, qword [rbp - 0x40]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x1400fc258
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r14, rax
jne 0x1400fc267
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x38], rax
cmovne edi, esi
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400feed0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400fc3f8
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14015b040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400fc467
cmp byte [rcx + 0x71], 0
je 0x1400fc467
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400fc4bc
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400fc481
sub eax, 1
je 0x1400fc485
cmp eax, 2
jne 0x1400fc4bc
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400feed0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400fc4b3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400fc4bc
cmp byte [rbx + 0x71], 0
sete al
jmp 0x1400fc469
xor al, al
jmp 0x1400fc469
Function at 0x1400fd154
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov rdi, r8
mov rsi, rcx
test r8, r8
je 0x1400fd314
cmp qword [0x14015bf18], 0
jne 0x1400fd2f4
mov eax, 0xe
mov dword [rbp - 9], eax
movdqa xmm0, xmmword [0x1401525d0]
movdqu xmmword [rbp - 5], xmm0
xor edx, edx
test eax, eax
je 0x1400fd1b7
lea eax, [rdx - 0x1b]
xor byte [rbp + rdx - 5], al
inc edx
mov eax, dword [rbp - 9]
cmp edx, eax
jb 0x1400fd1a7
mov byte [rbp + rax - 5], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x37], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x47], xmm1
lea rax, [rbp - 5]
or rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400fd1d6
lea rdx, [rbp - 5]
lea rcx, [rbp + 0x37]
call fcn.140045210
nop
mov eax, 0xc
mov dword [rbp - 9], eax
movdqa xmm0, xmmword [0x1401524e0]
movdqu xmmword [rbp - 5], xmm0
xor edx, edx
test eax, eax
je 0x1400fd219
lea eax, [rdx - 0x1b]
xor byte [rbp + rdx - 5], al
inc edx
mov eax, dword [rbp - 9]
cmp edx, eax
jb 0x1400fd209
mov byte [rbp + rax - 5], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x17], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x27], xmm1
lea rax, [rbp - 5]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400fd231
mov r8, rbx
lea rdx, [rbp - 5]
lea rcx, [rbp + 0x17]
call fcn.140045210
nop
lea rcx, [rbp + 0x17]
call fcn.1400fb5f8
mov rdx, rax
lea r8, [rbp + 0x37]
mov rcx, rsi
call fcn.1400fd4f0
mov qword [0x14015bf18], rax
mov ebx, 0x1000
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0xf
jbe 0x1400fd2a9
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, rbx
jb 0x1400fd2a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400fd2a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400fefc0
movdqa xmm0, xmmword [0x1401524b0]
movdqu xmmword [rbp + 0x27], xmm0
mov byte [rbp + 0x17], 0
mov rdx, qword [rbp + 0x4f]
cmp rdx, 0xf
jbe 0x1400fd2f4
inc rdx
mov rcx, qword [rbp + 0x37]
mov rax, rcx
cmp rdx, rbx
jb 0x1400fd2ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400fd2ef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400fefc0
and qword [rbp + 0xf], 0
mov qword [rsp + 0x20], rdi
lea rdx, [rbp + 0xf]
mov rcx, rsi
call fcn.1400fdee4
test al, al
je 0x1400fd314
mov rax, qword [rbp + 0xf]
jmp 0x1400fd316
xor eax, eax
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400fd330
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
jne 0x1400fd354
xor al, al
jmp 0x1400fd4dd
cmp qword [0x14015bf20], 0
jne 0x1400fd4d2
mov eax, 0xa
mov dword [rbp - 0x60], eax
mov dword [rbp - 0x5c], 0x9aa19ea0
mov dword [rbp - 0x58], 0x83bb8f8c
mov dword [rbp - 0x54], 0xef8282
xor edx, edx
test eax, eax
je 0x1400fd395
lea eax, [rdx - 0x1b]
xor byte [rbp + rdx - 0x5c], al
inc edx
mov eax, dword [rbp - 0x60]
cmp edx, eax
jb 0x1400fd385
mov byte [rbp + rax - 0x5c], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
lea rax, [rbp - 0x5c]
or rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400fd3b4
lea rdx, [rbp - 0x5c]
lea rcx, [rbp - 0x28]
call fcn.140045210
nop
mov eax, 0xc
mov dword [rbp - 0x60], eax
movdqa xmm0, xmmword [0x1401524e0]
movdqu xmmword [rbp - 0x5c], xmm0
xor edx, edx
test eax, eax
je 0x1400fd3f7
lea eax, [rdx - 0x1b]
xor byte [rbp + rdx - 0x5c], al
inc edx
mov eax, dword [rbp - 0x60]
cmp edx, eax
jb 0x1400fd3e7
mov byte [rbp + rax - 0x5c], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
lea rax, [rbp - 0x5c]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400fd40f
mov r8, rbx
lea rdx, [rbp - 0x5c]
lea rcx, [rbp - 0x48]
call fcn.140045210
nop
lea rcx, [rbp - 0x48]
call fcn.1400fb5f8
mov rdx, rax
lea r8, [rbp - 0x28]
mov rcx, rsi
call fcn.1400fd4f0
mov qword [0x14015bf20], rax
mov ebx, 0x1000
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x1400fd487
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, rbx
jb 0x1400fd482
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400fd482
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400fefc0
movdqa xmm0, xmmword [0x1401524b0]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x1400fd4d2
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, rbx
jb 0x1400fd4cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400fd4cd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400fefc0
mov r9, rdi
mov rcx, rsi
call fcn.1400fe6d8
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400fd7c8
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov rax, qword [0x14015b040]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r14, r8
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x14015bf28]
test rax, rax
je 0x1400fd80c
cmp qword [0x14015bf48], 0
jne 0x1400fd9d5
mov eax, 0x1d
mov dword [rbp - 0x49], eax
movdqa xmm0, xmmword [0x140153100]
movdqu xmmword [rbp - 0x45], xmm0
movdqa xmm1, xmmword [0x1401524f0]
movdqu xmmword [rbp - 0x35], xmm1
xor edx, edx
test eax, eax
je 0x1400fd844
lea eax, [rdx - 0x1b]
xor byte [rbp + rdx - 0x45], al
inc edx
mov eax, dword [rbp - 0x49]
cmp edx, eax
jb 0x1400fd834
mov byte [rbp + rax - 0x45], 0
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf], xmm1
lea rax, [rbp - 0x45]
or rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x1400fd863
lea rdx, [rbp - 0x45]
lea rcx, [rbp - 1]
call fcn.140045210
nop
mov eax, 0xe
mov dword [rbp - 0x49], eax
movdqa xmm0, xmmword [0x1401525c0]
movdqu xmmword [rbp - 0x45], xmm0
xor edx, edx
test eax, eax
je 0x1400fd8a6
lea eax, [rdx - 0x1b]
xor byte [rbp + rdx - 0x45], al
inc edx
mov eax, dword [rbp - 0x49]
cmp edx, eax
jb 0x1400fd896
mov byte [rbp + rax - 0x45], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x11], xmm1
lea rax, [rbp - 0x45]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400fd8be
mov r8, rbx
lea rdx, [rbp - 0x45]
lea rcx, [rbp - 0x21]
call fcn.140045210
nop
lea rcx, [rbp - 0x21]
call fcn.1400fb5f8
mov rdx, rax
lea r8, [rbp - 1]
mov rcx, rdi
call fcn.1400fd4f0
mov rbx, rax
mov rdx, qword [rbp - 9]
cmp rdx, 0xf
jbe 0x1400fd931
inc rdx
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fd92c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400fd92c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400fefc0
movdqa xmm0, xmmword [0x1401524b0]
movdqu xmmword [rbp - 0x11], xmm0
mov byte [rbp - 0x21], 0
mov rdx, qword [rbp + 0x17]
cmp rdx, 0xf
jbe 0x1400fd980
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400fd97b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400fd97b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400fefc0
test rbx, rbx
je 0x1400fd9e6
and dword [rbp + 0x1f], 0
lea r8, [rbx + 7]
mov r9d, 4
lea rdx, [rbp + 0x1f]
mov rcx, rdi
call fcn.1400fcf44
test al, al
je 0x1400fd9e6
movsxd r8, dword [rbp + 0x1f]
add r8, 0xb
add r8, rbx
mov qword [0x14015bf28], r8
mov r9d, 8
lea rdx, [0x14015bf48]
mov rcx, rdi
call fcn.1400fcf44
test al, al
je 0x1400fd9e6
mov rax, qword [0x14015bf28]
mov qword [rsi], rax
mov rcx, qword [0x14015bf48]
mov qword [r14], rcx
mov al, 1
jmp 0x1400fd9e8
xor al, al
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400feed0
add rsp, 0xa0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret