joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180076e20
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x1800cf040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
lea r9, [rsp + 0x20]
imul rbx, rax, 0x38
mov r8d, 0x40
add rbx, qword [0x1801fe130]
mov rdx, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [rdx - 5]
cmove rdi, rdx
lea rsi, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180076e89
mov eax, 0xa
jmp 0x180076ed6
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180076ea5
mov rax, qword [rbx]
mov word [rax], 0xf9eb
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
or byte [rbx + 0x20], 6
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800a8790
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180076f00
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov eax, dword [0x1801fe13c]
xor edi, edi
mov ebx, edi
test eax, eax
je 0x180077010
mov rcx, qword [0x1801fe130]
add rcx, 0x20
test byte [rcx], 2
je 0x180076f43
inc ebx
add rcx, 0x38
cmp ebx, eax
jb 0x180076f27
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
cmp ebx, 0xffffffff
je 0x180077010
mov edx, 0xffffffff
lea rcx, [rsp + 0x20]
mov r8d, 1
call fcn.180076c70
mov edx, dword [0x1801fe13c]
cmp ebx, edx
jae 0x180076f9d
nop dword [rax + rax]
mov eax, ebx
imul rcx, rax, 0x38
mov rax, qword [0x1801fe130]
test byte [rcx + rax + 0x20], 2
jne 0x180076f97
mov ecx, ebx
call fcn.180076e20
mov edi, eax
test eax, eax
jne 0x180076f9d
mov edx, dword [0x1801fe13c]
inc ebx
cmp ebx, edx
jb 0x180076f70
cmp qword [rsp + 0x20], 0
je 0x180077010
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180076ffc
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
mov qword [rsp + 0x48], rsi
nop
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180076fe8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x180076fc0
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1801fd4e8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x18007a080
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x18007a0a8
xor eax, eax
lea r8, [0x180079180]
mov r9, rcx
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x18008fc80
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x18008fca1
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x18008fcce
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x18008fcd0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x18008fd29
test ecx, ecx
jle 0x18008fd09
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x18008fd29
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x18008fd29
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
sbb dword [0x1821ae033], esp
add byte [r14], bpl
xor eax, 0x1353535
sub esi, dword [0x1804d1171]
invalid
Function at 0x18008fd50
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x18008fd72
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x18008fd81
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x18008fda4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18008fda6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18008fde2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x18008fe7e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18008fe1d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x18008fe5e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x18008fe7e
cmp rbx, rax
ja 0x18008fe30
test rbx, rbx
je 0x18008fe7e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
add eax, dword [rsi]
add byte [rax], al
add dword [rdi], edx
add al, 0xf2
add byte [rcx], al
add eax, 0x401d0001
syscall
add al, 3
add al, byte [rax]
cmp al, 0x3c
sub ch, byte [rdx]
and eax, 0x2030405
cmp eax, 0x35352e00
xor eax, 0x352b0135
xor eax, 0xff003535
invalid
Function at 0x1800902e0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1800cf040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x18009030d
xor eax, eax
jmp 0x180090479
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x180090347
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x180090347
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x180090479
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x18009046c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18009038a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1800903b5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180090471
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180090424
sub eax, 1
je 0x180090424
cmp eax, 2
jne 0x18009046c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x180090471
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x180090452
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x18009046c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x180090471
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1800a8790
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1800923b0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1800cf040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180092483
cmp byte [rcx + 0x71], 0
je 0x180092483
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18009247f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x180092444
sub eax, 1
je 0x180092448
cmp eax, 2
jne 0x18009247f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800a8790
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180092476
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x18009247f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18009242c
xor al, al
jmp 0x18009242c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800a8790
add rsp, 0x60
pop rbx
ret
Function at 0x1800a0220
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rax, qword [0x1801fd4c0]
mov rbp, rdx
mov r14, rcx
mov rdx, rcx
mov rbx, qword [rax + 0x4040]
mov rcx, rbx
call fcn.18002e690
add rbx, 0x108
mov edi, eax
mov ecx, dword [rbx]
mov r8d, dword [rbx + 4]
cmp ecx, r8d
jne 0x1800a028d
inc ecx
test r8d, r8d
je 0x1800a0279
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x1800a027e
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.18003c760
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rax, qword [0x1801fd4c0]
mov rcx, qword [rax + 0x4040]
mov rdi, qword [rcx + 0x1b8]
call fcn.18002eb20
xor r8d, r8d
mov edx, eax
mov rcx, rdi
mov esi, eax
call fcn.1800203b0
test eax, eax
jne 0x1800a02f6
movsxd rdx, dword [r14]
lea rcx, [0x1800b7370]
mov rcx, qword [rcx + rdx*8]
mov rdx, rbp
call fcn.180058560
test al, al
je 0x1800a0362
mov r8d, 1
mov edx, esi
mov rcx, rdi
call fcn.1800204c0
jmp 0x1800a0362
mov rdx, rbp
mov qword [rsp + 0x40], r15
lea rcx, [0x1800b1310]
call fcn.180058560
xor r15d, r15d
lea rbx, [0x1800b70d0]
lea rbp, [0x1800b7368]
nop dword [rax + rax]
mov ecx, 0x1b
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1800a0335
mov dword [r14], r15d
jmp 0x1800a0347
mov ecx, dword [rbx]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x1800a0354
mov eax, dword [rbx]
mov dword [r14], eax
xor r8d, r8d
mov edx, esi
mov rcx, rdi
call fcn.1800204c0
add rbx, 4
cmp rbx, rbp
jne 0x1800a0320
mov r15, qword [rsp + 0x40]
mov rax, qword [0x1801fd4c0]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rcx, qword [rax + 0x4040]
dec dword [rcx + 0x108]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1800a9930
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x1800a996a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1800a996f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1800a99b8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1800b0a60]
cmp byte [rcx + rax], 0
je 0x1800a99b8
dec r8
sub rdx, 1
jne 0x1800a999e
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x14000f3b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
xchg rbp, r14
mov r14, rsp
xchg r14, rbp
nop
sub rsp, 0x1aecab8f
add rsp, 0x1aecab6f
lea r10, [rbp - 0x1f]
mov dword [rsp - 0x18], esp
mov dword [rbp - 0x20], 0x4eb358dc
xor dword [rbp - 0x20], 0x5971cdb5
xor dword [rbp - 0x20], 0x25bd9f6f
add dword [rbp - 0x20], 0x2eedfc62
sub dword [rbp - 0x20], 0x44a9439c
nop
movabs r9, 0xffffffff27a980f2
xor r9, 0x54830914
sub r9, 0x4da66710
add r9, 0x7fffffff
add r9, 0x5a7bdd29
mov dword [rbp - 0x1c], 0x52eba65a
sub dword [rbp - 0x1c], 0x2c5336a3
add dword [rbp - 0x1c], 0x462c57a6
xor dword [rbp - 0x1c], 0x97a20fc
sub dword [rbp - 0x1c], 0x48c4afaa
sub r10, rcx
mov dword [rbp - 0x18], 0xf5ddf54
add dword [rbp - 0x18], 0x392d794a
sub dword [rbp - 0x18], 0x1ac2b373
xor dword [rbp - 0x18], 0x43ec492c
sub dword [rbp - 0x18], 0x5a1bf171
sub r9, rcx
mov dword [rsp - 0x38], 0x709d1acf
mov dword [rbp - 0x14], 0x4a9b34e
add dword [rbp - 0x14], 0x528d4cf0
add dword [rbp - 0x14], 0x1e7eeee0
sub dword [rbp - 0x14], 0x12d0d66b
lea r11, [rbp - 0x20]
mov dword [rbp - 0x10], 0x45480f92
sub dword [rbp - 0x10], 0x23d56917
xor dword [rbp - 0x10], 0x3b566920
add dword [rbp - 0x10], 0xd20ac1e6
sub r11, rcx
mov dword [rsp - 0x10], 0xb85c49c
mov dword [rbp - 0xc], 0x15bb3793
add dword [rbp - 0xc], 0x529f3751
sub dword [rbp - 0xc], 0x2956c13c
sub dword [rbp - 0xc], 0x2410df09
xor dword [rbp - 0xc], 0xef9c2dfa
mov dword [rbp - 8], 0x33c9f155
sub dword [rbp - 8], 0x27417966
xor dword [rbp - 8], 0x7568ac29
xor dword [rbp - 8], 0x27c45c18
lea r8, [rcx + 2]
xchg rsi, rsi
mov dword [rbp - 4], 0x797e8a7b
xor dword [rbp - 4], 0x361d0dcc
xor dword [rbp - 4], 0x3ab67f70
xor dword [rbp - 4], 0xcf37225b
nop dword [rax]
lea edx, [r9 + r8]
mov dword [rsp - 0x34], ebx
mov eax, 0x4201bc3d
sub eax, 0x43b172c
sub eax, 0x292670b0
add eax, 0x5eadd292
mov ecx, edx
lea r8, [r8 + 4]
rol eax, cl
xchg rdi, rdi
lea ecx, [rdx + 1]
xor al, byte [r11 + r8 - 6]
mov byte [r8 - 6], al
mov dword [rsp - 0x34], 0x1f6e7336
mov eax, 0x4a9c1c83
sub eax, 0x42a9a915
add eax, 0x6e634838
sub eax, 0x46bf15d
add eax, 0x1643caa
rol eax, cl
xchg r14, r14
lea ecx, [rdx + 2]
xor al, byte [r10 + r8 - 6]
mov byte [r8 - 5], al
mov eax, 0x1e3a9331
add eax, 0xbbad9ab
add eax, 0x45d5c3d0
sub eax, 0x454a9751
add eax, 0x48cd6d98
rol eax, cl
mov dword [rsp - 0x3c], 0x39815415
lea ecx, [rdx + 3]
xor al, byte [r11 + r8 - 4]
mov byte [r8 - 4], al
mov dword [rsp - 0x3c], 0x5a74a30d
mov eax, 0x26d8c5d4
add eax, 0x4a55b9e
sub eax, 0x2a4118db
xor eax, 0x76f92a9
add eax, 0x6cfb6cb5
rol eax, cl
xor al, byte [r10 + r8 - 4]
mov rcx, rcx
mov byte [r8 - 3], al
lea rax, [r9 + r8]
cmp rax, 0x20
jb 0x14000f51c
mov r12, r12
nop
sub rsp, 0x2f44bf17
add rsp, 0x2f44bf37
pop rbp
mov rcx, rcx
ret
Function at 0x140019c7e
Capabilities:
Encode data using xor

Disassembly:
xchg r14, rsi
mov qword [rsp + 0x18], r14
xchg r14, rsi
push rdx
mov qword [rsp], rdi
sub rsp, 0x60
lea rax, [rcx + 8]
mov dword [rsp - 0x20], edx
mov qword [rsp + 0x70], rbx
mov qword [rcx], rax
xorps xmm0, xmm0
xchg rsi, rsi
xchg r12, rax
movups xmmword [r12], xmm0
xchg r12, rax
mov rsi, rcx
mov qword [rsp + 0x78], rbp
xchg rdi, rax
movups xmmword [rdi + 0x10], xmm0
xchg rdi, rax
lea rcx, [rsp + 0x20]
mov dword [rsp - 0x10], 0x3b7de414
movups xmmword [rax + 0x20], xmm0
xchg r12, rax
movups xmmword [r12 + 0x30], xmm0
xchg r12, rax
xchg r10, rax
movups xmmword [r10 + 0x40], xmm0
xchg r10, rax
xchg rdx, rax
movups xmmword [rdx + 0x50], xmm0
xchg rdx, rax
xchg r9, rax
movups xmmword [r9 + 0x60], xmm0
xchg r9, rax
xchg rsp, rax
movups xmmword [rsp + 0x70], xmm0
xchg rsp, rax
mov rbp, qword [rdx + 0x38]
mov dword [rsp - 0x1c], esi
lea rax, [rsp + 0x28]
xchg rdi, rbx
mov rdi, qword [rdx]
xchg rdi, rbx
xchg rdx, rax
mov qword [rsp + 0x20], rdx
xchg rdx, rax
xchg r11, rsp
movups xmmword [r11 + 0x28], xmm0
xchg rsp, r11
lea rdx, [rbp + 1]
mov dword [rsp - 0x18], 0x676ffb09
movups xmmword [rsp + 0x38], xmm0
xchg rsp, r13
movups xmmword [r13 + 0x48], xmm0
xchg r13, rsp
call fcn.14000ee60
mov edx, 0x74db1da1
xor edx, 0xc2ce75d
xor edx, 0x58f078bd
add edx, 0x446ad15
add edx, 0x2d392cd3
test rbp, rbp
mov dword [rsp - 0x38], 0x1f09d8a8
je 0x140019dd7
xchg rdi, rdx
mov rdx, rax
xchg rdi, rdx
sub rbx, rax
mov dword [rsp - 0x24], esp
xchg r15, r9
mov r15, rbp
xchg r15, r9
mov r8d, 0x53ebc571
sub r8d, 0x2b0292df
add r8d, 0x3d6061cb
sub r8d, 0x6649935e
nop word [rax + rax]
movzx ecx, dx
mov dword [rsp - 0x38], 0x3265f0a1
lea rdi, [rdi + 2]
and cx, r8w
ror edx, 6
ror edx, 1
ror edx, 1
xor cx, word [rdi + rbx - 2]
xchg r15, r15
mov word [rdi - 2], cx
sub r9, 1
jne 0x140019da7
xor ecx, ecx
xchg r9, r9
xchg rdx, r8
mov rdx, rbp
xchg rdx, r8
mov word [rax + rbp*2], cx
mov rcx, rsi
xchg rcx, rdx
mov rcx, qword [rsp + 0x20]
xchg rdx, rcx
call fcn.140073d90
mov dword [rsp - 0x18], 0xb4ce547
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x28]
mov rbp, qword [rsp + 0x78]
xchg r14, rbx
mov r14, qword [rsp + 0x70]
xchg r14, rbx
cmp rcx, rax
mov dword [rsp - 0x30], 0x3e98969
jne 0x140019e76
xor eax, eax
lea rdi, [rsp + 0x28]
mov ecx, 0x4bf1eb0f
add ecx, 0x1da6d2e9
xor ecx, 0x2971703
sub ecx, 0x6b0faacb
rep stosb byte [rdi], al
mov rax, rsi
mov rsi, qword [rsp + 0x80]
mov r11, r11
nop
sub rsp, 0x51773911
add rsp, 0x51773971
pop rdi
mov dword [rsp - 0xc], 0x7cc1eac9
ret
call fcn.140098730
mov dword [rsp - 0x28], 0x38b83144
xchg rbp, rax
mov rbp, rsi
xchg rbp, rax
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
xchg r9, r9
ret
Function at 0x140031d50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov dword [rcx + 8], 0x57b5493c
add dword [rcx + 8], 0xb3691af
xor dword [rcx + 8], 0x62ebdaea
lea rsi, [rcx + 0x298]
xorps xmm0, xmm0
lea rax, [0x140001a98]
mov qword [rcx], rax
mov r14, rdx
lea rax, [rsi + 8]
mov rdi, rcx
mov qword [rsi], rax
xor ebp, ebp
mov qword [rcx + 0x290], rbp
mov rbx, r8
movups xmmword [rax], xmm0
mov rcx, rsi
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
mov rdx, qword [r8 + 0x38]
mov qword [rsi + 0x38], rdx
call fcn.14000ee60
mov r8d, ebp
cmp qword [rsi + 0x38], rbp
jbe 0x140031dec
nop word [rax + rax]
mov rcx, qword [rbx]
movzx edx, word [rcx + r8*2]
mov word [rax + r8*2], dx
inc r8
cmp r8, qword [rsi + 0x38]
jb 0x140031dd2
mov ecx, dword [rbx + 0x40]
mov esi, 0x4ca76d12
add esi, 0xd4e3676
sub esi, 0x59f4a389
mov qword [rdi + 0x2e0], rbp
bts ecx, 0xe
mov dword [rdi + 0x2d8], ecx
mov edx, 0x23a66f26
add edx, 0x4a580636
sub edx, 0x6dfe754c
mov eax, dword [rbx + 0x54]
xor eax, 0x63c4968
mov dword [rdi + 0x2e8], eax
mov eax, dword [rbx + 0x58]
xor eax, 0x63c4968
mov dword [rdi + 0x2ec], eax
mov eax, dword [rbx + 0x44]
xor eax, 0x63c4968
mov dword [rdi + 0x2f0], eax
mov eax, dword [rbx + 0x48]
xor eax, 0x63c4968
mov dword [rdi + 0x2f4], eax
mov rax, qword [rbx + 0x60]
mov qword [rdi + 0x2f8], rax
mov eax, dword [rbx + 0x4c]
xor eax, 0xe047f30
mov dword [rdi + 0x308], eax
mov eax, dword [rbx + 0x50]
xor eax, 0x63c4968
mov byte [rdi + 0x310], bpl
bt ecx, 0xd
mov dword [rdi + 0x30c], eax
pushf
mov eax, 0x51bafaf4
sub eax, 0x7d9d062
xor eax, 0x1f5cf432
sub eax, 0x56bddda1
popf
mov qword [rdi + 0x318], r14
cmovb esi, eax
mov ecx, esi
shl rcx, 4
call fcn.140098670
mov rcx, rax
mov edx, esi
nop dword [rax]
movaps xmm0, xmmword [0x1404a8590]
movups xmmword [rcx], xmm0
lea rcx, [rcx + 0x10]
sub rdx, 1
jne 0x140031ec1
mov qword [rdi + 0x300], rax
mov rdx, rbp
nop
mov rax, qword [rbx + 0x68]
lea rdx, [rdx + 0x10]
inc rbp
mov ecx, dword [rdx + rax - 0x10]
xor ecx, 0xe047f30
mov dword [rsp + 0x50], ecx
movss xmm3, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
shufps xmm3, xmm3, 0xe1
mov ecx, dword [rdx + rax - 0xc]
xor ecx, 0xe047f30
mov dword [rsp + 0x50], ecx
movss xmm0, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
movss xmm3, xmm0
shufps xmm3, xmm3, 0xc6
mov ecx, dword [rdx + rax - 8]
xor ecx, 0xe047f30
mov dword [rsp + 0x50], ecx
movss xmm1, dword [rsp + 0x50]
mov rax, qword [rbx + 0x68]
movss xmm3, xmm1
shufps xmm3, xmm3, 0x27
mov ecx, dword [rdx + rax - 4]
xor ecx, 0xe047f30
mov dword [rsp + 0x50], ecx
movss xmm2, dword [rsp + 0x50]
mov rax, qword [rdi + 0x300]
movss xmm3, xmm2
shufps xmm3, xmm3, 0x39
xorps xmm3, xmmword [0x1404a8590]
movups xmmword [rdx + rax - 0x10], xmm3
cmp rbp, rsi
jl 0x140031ee5
lea rcx, [r14 + 0xa8]
mov qword [rsp + 0x50], rdi
lea rdx, [rsp + 0x50]
call fcn.1400122e0
mov rbx, qword [rsp + 0x58]
mov rax, rdi
mov rbp, qword [rsp + 0x60]
nop
add rsp, 0x6a507e4c
sub rsp, 0x6a507e1c
pop r14
pop rdi
pop rsi
ret