joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003420
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
lea rdx, [0x1400098d0]
mov edi, 1
mov r8, rdx
sub r8, rcx
mov al, byte [rcx]
mov byte [r8 + rcx], al
add rcx, rdi
test al, al
jne 0x14000343f
lea rcx, [0x140004130]
call sub.ntoskrnl.exe_DbgPrint
and dword [rbp - 0x1c], 0
xorps xmm0, xmm0
and qword [rbp - 0x10], 0
movdqu xmmword [rbp - 0x2c], xmm0
call qword [sym.imp.ntoskrnl.exe_ObGetFilterVersion]
and qword [rbp - 0x18], 0
lea rdx, [0x140004150]
lea rcx, [rbp - 0x28]
mov word [rbp - 0x30], ax
mov word [rbp - 0x2e], di
call qword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov rax, qword [sym.imp.ntoskrnl.exe_PsProcessType]
lea rdx, [0x140009920]
and dword [rbp - 0x44], 0
lea rcx, [rbp - 0x30]
and qword [rbp - 0x38], 0
mov qword [rbp - 0x50], rax
lea rax, [0x140003880]
mov qword [rbp - 0x40], rax
lea rax, [rbp - 0x50]
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x48], 3
call qword [sym.imp.ntoskrnl.exe_ObRegisterCallbacks]
test eax, eax
jns 0x1400034dc
lea rcx, [0x140004160]
call sub.ntoskrnl.exe_DbgPrint
mov rax, qword [0x140009920]
mov rdi, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret

Function at 0x1400034f4
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x20], r9
mov dword [rax + 0x18], r8d
push rsi
push rdi
push r14
sub rsp, 0x60
mov rsi, r9
mov ebx, r8d
mov r14, rdx
and qword [rax - 0x58], 0
xorps xmm0, xmm0
movups xmmword [rax - 0x50], xmm0
movups xmmword [rax - 0x40], xmm0
movups xmmword [rax - 0x30], xmm0
mov ecx, ecx
lea rdx, [rax - 0x58]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov edi, eax
test eax, eax
jns 0x140003550
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_MmIsAddressValid]
test al, al
jne 0x140003550
mov eax, 0xc0000001
jmp 0x1400035c1
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r8d, 1
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call fcn.1400039c0
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
jmp 0x1400035b4
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov eax, edi
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop r14
pop rdi
pop rsi
ret
Function at 0x1400035d4
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
and qword [rax + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rax - 0x48], xmm0
mov r14d, ecx
movabs rcx, 0x7ffffffefffe
movups xmmword [rax - 0x38], xmm0
mov rbx, r9
mov rdi, rdx
movups xmmword [rax - 0x28], xmm0
lea rax, [rdx - 0x10001]
cmp rax, rcx
ja 0x140003711
mov edx, r8d
xor ecx, ecx
mov ebp, r8d
call qword [sym.imp.ntoskrnl.exe_ExAllocatePool]
mov rsi, rax
test rax, rax
jne 0x140003640
lea rcx, [0x1400040b0]
jmp 0x140003718
mov r8, rbp
mov rdx, rbx
mov rcx, rsi
call fcn.1400039c0
mov rcx, r14
lea rdx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
jns 0x14000367e
lea rcx, [0x1400040d0]
call sub.ntoskrnl.exe_DbgPrint
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
jmp 0x14000371d
mov rcx, qword [rsp + 0x78]
lea rdx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
mov r8, rbp
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_MmCreateMdl]
mov rdi, rax
test rax, rax
je 0x1400036ec
mov rcx, rax
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPages]
mov rbx, rax
test rax, rax
je 0x1400036de
mov r8, rbp
mov rdx, rsi
mov rcx, rax
call fcn.1400039c0
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
xor ebx, ebx
jmp 0x1400036e3
mov ebx, 0xc0000001
mov rcx, rdi
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
lea rcx, [rsp + 0x20]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
jmp 0x140003722
lea rcx, [0x1400041e0]
call sub.ntoskrnl.exe_DbgPrint
mov eax, 0xc0000001
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140003738
Capabilities:
Attach user process memory
Find process by pid
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0x80
mov r14, r9
mov edi, r8d
mov rsi, rdx
and qword [rax - 0x58], 0
xorps xmm0, xmm0
movups xmmword [rax - 0x40], xmm0
movups xmmword [rax - 0x30], xmm0
movups xmmword [rax - 0x20], xmm0
mov ecx, ecx
lea rdx, [rax - 0x58]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
mov ebx, eax
test eax, eax
jns 0x140003794
mov edx, eax
lea rcx, [0x140004170]
call sub.ntoskrnl.exe_DbgPrint
mov eax, ebx
jmp 0x140003864
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
and qword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_IoAllocateMdl]
mov rbx, rax
mov qword [rsp + 0x38], rax
test rax, rax
jne 0x1400037f1
lea rcx, [0x140004180]
call sub.ntoskrnl.exe_DbgPrint
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov eax, 0xc0000001
jmp 0x140003864
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmBuildMdlForNonPagedPool]
nop
xor edx, edx
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_MmMapLockedPages]
mov qword [rsp + 0x40], rax
mov r8, rdi
mov rdx, r14
mov rcx, rax
call fcn.1400039c0
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ntoskrnl.exe_MmUnmapLockedPages]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_IoFreeMdl]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
xor eax, eax
jmp 0x140003864
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
Function at 0x1400f7540
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x1400f756d
xor al, al
jmp 0x1400f76cf
mov rax, qword [0x1401176c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x1401176c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x1401176d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x1401176d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x1401176e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x1401176e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x1401176f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x1401176f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x140117700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x1400f76c1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x1400f7619
mov r11d, 2
jmp 0x1400f763d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x1400f7633
mov r11d, 1
jmp 0x1400f763d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x1400f76e5
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x1400f7682
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x1400f769a
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x1400f76aa
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x1400f76b8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x1400f7600
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x1400f76ca
Function at 0x140021ffa
Capabilities:
Encode data using xor
Execute syscall

Disassembly:
fisttp dword [0x13ffad9e7]
call rcx
clc

Function at 0x140026de4
Capabilities:
Encode data using xor

Disassembly:
xor cl, cl
outsb dx, byte [rsi]
mov dword [rsp - 0xc], 0x7e0cb35d
jne 0x1400265ee
je 0x1400265ee
pushfq
cmp r8d, 0xb4411121
neg rbx
test r14d, 0x477e99bd
call rcx
cmp edx, 0x82335a2
test r11, rcx
push r10
cmp edi, 0x52091071
pop r14
test r14d, 0xd6412257
movabs r14, 0x519c94d84c4712eb
push r8
cmp edx, 0x7dceed44
div r15
ret
jmp 0x140026602
call fcn.1400f0720
movzx ecx, al
mov eax, dword [rdi]
mov dword [rsp - 0x3c], 0x6a4e32d
jmp fcn.140026550
lea rdx, [rsp + 0x30]
mov rsi, rax
mov rcx, qword [rax]
mov r14, r14
xchg rdx, rdx
jmp 0x14002728c
mov rcx, rbx
call fcn.14008fd00
lea rdx, [rbp + 0x1e8]
mov r14, rax
xchg r11, r11
mov rsi, rsi
jmp 0x1400271c4
mov dword [rbp + 0x1e0], eax
call rsi
mov r10, r10
mov rsp, rsp
mov rdx, rdx
jmp 0x14002679f
pop rcx
call fcn.140025904
mul r13
ret
call fcn.1400f0de0
mov r9d, r15d
mov dword [rsp - 0x2c], 0x2d09cd29
jmp 0x140026dc9
jmp 0x140027d6b
ret
pop r10
xchg r9, r9
lea rdx, [rbp + 0x1e0]
sar eax, 1
jmp 0x1400267bc
mov dword [rbp + 0x1dc], 2
call fcn.1400f0de0
mov edi, dword [rax + 4]
xchg r13, r13
mov dword [rsp - 0x2c], 0x2058ecb3
jmp 0x14002765d
jmp 0x14002878c
mov dword [rsp - 0x30], 0x4d62efca
mov dword [rsp - 0x44], 0x3b009cde
xchg r8, r8
xchg r15, r15
jmp 0x1400273b4
mov rcx, rcx
mov dword [rsp - 0x28], esi
mov dword [rsp - 0x38], edi
xchg r8, r8
push r15
movabs r15, 0x2fbed00000ae9e9
add dh, byte [rbp - 0xa]
jmp 0x1400277a3
je 0x140026cd5
jne 0x140026cd5
jns 0x1400265af
int3
jmp 0x140027791
pop r8
ret
pop r8
mov r13, r13
jmp 0x140027c28
call fcn.1400f91e0
mov r15, qword [rax + 0x50]
test r15, r15
xchg r9, r9
je 0x140026d13
jne 0x140026d13
jmp rcx
jmp 0x14002822b
jl 0x14002781d
xor r12d, 0xd01984cb
bswap r15
lea edx, [rcx - 0x86dd]
jmp 0x140026847
xchg rdx, rdx
mov dword [rsp - 0x1c], 0x58b9f4e1
mov dword [rsp - 0x1c], ecx
lea r8, [rbp + 0x1d8]
mov rcx, r14
jmp 0x14002820b
adc al, 0
invalid
je 0x14002832b
mov rcx, rbx
call fcn.1400f91e0
xchg rbp, rbp
jmp 0x140027ea2
mov dword [rsp - 0x18], 0x3c23d22e
mov rbp, rbp
mov dword [rsp - 0x28], 0x32cc1840
xchg r12, r12
jmp 0x140027150
mov rcx, rbx
mov edi, dword [rax + 4]
mov dword [rsp - 0x2c], 0x50f1e776
xchg r11, r11
xchg r13, r13
mov rbx, rbx
sub edi, 3
jmp 0x1400269b6
mov r11, r11
mov dword [rsp - 0x3c], edx
je 0x1400295ec
cmp byte [r15 + 0x310], r12b
je 0x1400295ec
mov dword [rsp - 0x1c], 0x1f036a5
mov rcx, rcx
jmp 0x14002749c
mov r9d, 2
mov dword [rsp - 0x3c], 0x1d6ebb67
mov dword [rsp - 0x1c], 0x67ea901e
mov dword [rsp - 0x3c], 0x59bd6fd6
invalid
and al, 0xc8
Function at 0x1400296e0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
xchg rbx, rbx
jmp 0x140029a4b
mov byte [r14 + 0x5a8], 0
push r15
movabs r15, 0x16cd1800000197e9
jne 0x14002979c
je 0x14002979c
jmp 0x14002992c
mov dword [rsp - 0x10], 0x1d9779a8
mov dword [rsp - 0x24], 0x3349045b
mov rbx, rdx
mov r14, rcx
call fcn.1400f0930
mov dword [rsp - 0x10], 0x1bfc4778
jmp 0x140029790
call fcn.1400299ac
add rsp, 0x20
pop r15
ret
mov dword [rsp - 0x44], 0x472bf1ca
mov dword [rsp - 0x14], ebx
push r14
jmp 0x140029aab
sub rsp, 0x20
mov rsi, r9
mov rdi, r8
mov dword [rsp - 0x38], 0x6bb6addc
xchg rbp, rbp
mov dword [rsp - 0x18], 0x30ca3ca
jne 0x140029af1
je 0x140029af1
rcr r11d, 0xe1
lea r14d, [rcx - 0x4e05]
ror ecx, 0x30
test r12d, 0xfad3817a
lea edi, [rbp - 0x4082]
pause
popfq
inc rdi
syscall
movabs r12, 0x6f7669fffffd96e9
xor r10d, 0x6f4722e6
ret
jmp 0x14002988c

Function at 0x140029a05
Capabilities:
Execute syscall

Disassembly:
div byte [rbx + rsi + 0x75]
xor dword [rdi], ecx
test dword [rsi + 0x48000007], eax
test ecx, ebp
Function at 0x14002a930
Capabilities:
Execute syscall

Disassembly:
and al, 0x10
mov dword [rsp - 0x18], ebx
xchg rbx, rbx
rcl edx, 0x7a
pushf
xor r14d, 0x6b839ea3
lea r10d, [rcx - 0x2066]
pop r9
lea r9d, [rbp + 0x81ab]
lea r9d, [rcx + 0x85af]
movabs r9, 0x7ede61000006abe9
jmp 0x14002b005
invalid
fidivr word [rsi + 0x41]
or edx, 0xe889d587
cmp rdi, rbx
xor r15d, 0xd3deea72
js 0x140029b38
or edx, 0x573d668e
jmp 0x14002b439
ret 0x18
Function at 0x14003781a
Capabilities:
Encode data using xor

Disassembly:
mov dword [rbp + 0x3de], 0x1800c6
mov dword [rbp + 0x3e2], 0x80031
mov dword [rbp + 0x3e6], 0x1900c8
mov dword [rbp + 0x3ea], 0x20031
xchg rcx, rcx
mov dword [rbp + 0x3ee], 0xf00cc
jmp 0x1400379a2
pop r12
ret
pop r12
xchg r12, r12
jmp 0x140037128
mov qword [rbp + 0x10a8], rax
mov rax, qword [rbp + 0x10a8]
mov rcx, qword [rbp + 0x10a8]
mov dword [rsp - 0x28], 0x7f696986
mov rsp, rsp
jmp 0x140037502
mov dword [rsp - 0x44], 0x54d0f881
mov dword [rsp - 0x1c], ebp
mov dword [rsp - 0x14], 0x45b7fa18
mov dword [rsp - 0x28], 0x8073e0
mov rax, qword [rbp + 0x10a8]
jmp loc.1400373ae
movabs r12, 0x32a5edfffff95ae9
jne 0x14003781c
jmp 0x14003717b
je 0x14003781c
call fcn.140037a00
add rsp, 0x5e
invalid
stc
Function at 0x14003e300
Capabilities:
Execute syscall

Disassembly:
rol dword [rax], 1
syscall
call rax
movabs r10, 0x53c1447f5b7c86eb
or r10d, 0x5b4ea072
test r9d, 0xd4259bd8
call rcx
rcl ebx, 0xef
rcr r11d, 0xd5
lea esi, [rdi - 0x5181]
ret

Function at 0x14003f3a7
Capabilities:
Execute syscall

Disassembly:
mov dword [rsp - 0x28], esp
mov dword [rsp - 0x28], 0x4151ce5e
xchg r15, r15
mov dword [rsp - 0x3c], 0x6b1b6b43
push rbx
jmp 0x14003e875
movabs rbx, 0x1dbc24000000b1e9
jne 0x14003e877
jmp 0x14003e92d
je 0x14003e877
jmp 0x14003e895
mov rax, qword [rcx]
add rsp, 0x20
pop rbx
jmp 0x14003e858
call fcn.14003e78a
add rsp, 0x20
pop rbx
mov rcx, qword [0x1401495f0]
call fcn.1400ecb4c
mov rax, qword [rbx + 8]
xchg r15, r15
mov dword [rsp - 0x1c], ebx
mov dword [rsp - 0x20], 0x7bd9b523
mov rcx, qword [rax]
jmp 0x14003e888
jne 0x14003e918
lea r9d, [rcx + 0x3fb9]
lea r10d, [rdx - 0x9630]
jmp rax
jmp 0x14003e8a5
pop rbx
jmp qword [rax + 0x30]
xor r9d, 0x450b4fb5
popf
and edi, 0x45b8c13
popfq
rcl r13d, 0xc6
invalid
jle 0x14003eda4
jne 0x14003f5ad
lea r15d, [rbx + 0xe772]
invalid
invalid
invalid
Function at 0x140043cb7
Capabilities:
Encode data using xor

Disassembly:
test byte [rcx + 0xf], 0x85
xchg edx, eax
add eax, dword [rax]
add byte [rcx - 0x7cd1e23d], al
add byte [rax + 0x39], cl
in eax, dx
popfq
jp 0x14004416a
pushf
call fcn.140042d26
test byte [rdi - 2], bl
invalid

Function at 0x14004b83c
Capabilities:
Execute syscall

Disassembly:
not rax
mov dword [rsp - 0x44], 0xa0aded4
mov dword [rsp - 0xc], 0x3871ff63
mov dword [rsp - 0x44], 0x55df7a76
je 0x14004afcb
rol rax, 0x15
je 0x14004b867
jne 0x14004b867
xor r13d, 0xcce92d6a
mov r8d, 0x28a72f41
neg rsi
call rax
push r12
jmp rax
jmp 0x14004af90
Function at 0x140052000
Capabilities:
Execute syscall

Disassembly:
mov dword [rsp - 0x30], ebp
jne 0x14005202c
je 0x14005202c
lea r8d, [rbp - 0x69bc]
lea r13d, [rdx - 0xf94f]
xor edx, 0xad9ae33e
pause
add r14d, 0x3c0d0e9e
rcr r9d, 0x71
pop rdi
movabs rdi, 0x1bbc490000007de9
jl 0x140052722
jmp 0x1400520ae
add byte [rax], al
syscall
ja 0x140051419
and esi, 0xbeba1c9d
jl 0x140052038
cpuid
ret 0x18
mov dword [rsp - 0x24], esi
mov dword [rsp - 0x34], 0x141ad1bc
jmp 0x140052144
invalid

Function at 0x140053fef
Capabilities:
Execute syscall

Disassembly:
mov ecx, 0x179410eb
mov ch, 0x8d
or dword [rdx], esi
syscall
call rax
test rbp, rbx
ret 0x18

Function at 0x1400555f0
Capabilities:
Encode data using xor

Disassembly:
xchg rbx, r8
mov qword [rsp + 8], r8
xchg rbx, r8
nop
sub rsp, 8
mov qword [rsp], rdi
sub rsp, 0x20
xchg rdx, rdx
xchg rcx, rbx
mov rcx, rdx
xchg rcx, rbx
xchg rdi, rcx
mov rcx, rdi
xchg rdi, rcx
nop
movabs rdx, 0xffffffff7749ee82
xor rdx, 0x73bca9c1
add rdx, 0x3a100926
add rdx, 0x7fffffff
add rdx, 0x40faaf97
nop word [rax + rax]
mov dword [rsp - 0x38], esp
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x140055651
mov qword [rcx + 0x38], rdx
mov dword [rsp - 0x44], 0x47b6dcff
call fcn.140017ab0
xor r8d, r8d
mov edx, 0x72ca0c58
xor edx, 0x4de454b
sub edx, 0x5d02556b
add edx, 0x3215b67b
xor edx, 0x218eca32
cmp qword [rdi + 0x38], r8
jbe 0x140055705
mov rcx, rcx
sub rbx, rax
mov r9d, 0x7f16e065
sub r9d, 0x48833d3
xor r9d, 0x207d067e
add r9d, 0x1e67cc74
sub r9d, 0x795b7661
nop word [rax + rax]
mov dword [rsp - 0xc], edi
movzx ecx, dx
lea rax, [rax + 2]
and cx, r9w
ror edx, 3
ror edx, 4
ror edx, 1
xor cx, word [rbx + rax - 2]
inc r8
mov dword [rsp - 0x1c], 0x6fb007a1
mov word [rax - 2], cx
cmp r8, qword [rdi + 0x38]
jb 0x1400556cc
mov dword [rsp - 0x2c], 0x13ef2b09
xchg r10, rbx
mov r10, qword [rsp + 0x30]
xchg r10, rbx
xchg rdi, rax
mov rdi, rax
xchg rdi, rax
sub rsp, 0xffffffffffffffe0
pop rdi
mov r14, r14
ret
Function at 0x140055801
Capabilities:
Encode data using xor

Disassembly:
xor ebp, ebp
mov r13, r13
mov ebx, 0x762b5362
sub ebx, 0x20b4d1e5
sub ebx, 0x19b80b2c
add ebx, 0xb940f9f
xor ebx, 0x2dfbe5e1
xchg rbp, rax
mov rsi, rbp
xchg rbp, rax
mov eax, ebx
mov r8, r8
mov r8d, ebp
mov r10d, 0x6f373bab
sub r10d, 0x24010f0c
add r10d, 0x2078f270
sub r10d, 0x462d5711
sub r10d, 0x2581c6ff
cmp qword [r15 + 0x38], rbp
jbe 0x14005589b
mov dword [rsp - 0x40], edx
nop word [rax + rax]
mov rcx, qword [r15]
movzx edx, ax
mov dword [rsp - 0x3c], ebx
and dx, r10w
ror eax, 1
ror eax, 6
ror eax, 1
xor dx, word [rcx + r8*2]
mov word [rsi + r8*2], dx
inc r8
mov dword [rsp - 0x1c], ebp
cmp r8, qword [r15 + 0x38]
jb 0x14005586b
mov r8d, ebx
mov dword [rsp - 0x3c], 0x18fd752e
xchg rcx, rbp
mov r9, rcx
xchg rcx, rbp
cmp qword [r12 + 0x38], rbp
mov dword [rsp - 0x28], ecx
jbe 0x14005590f
nop dword [rax]
xchg r11, rax
mov r11, qword [r12]
xchg r11, rax
movzx edx, r8w
mov rcx, qword [r15 + 0x38]
mov dword [rsp - 0x34], ebp
and dx, r10w
add rcx, r9
ror r8d, 3
ror r8d, 1
ror r8d, 1
ror r8d, 2
ror r8d, 1
xor dx, word [rax + r9*2]
mov dword [rsp - 0x28], 0x7d2481ab
inc r9
mov word [rsi + rcx*2], dx
cmp r9, qword [r12 + 0x38]
jb 0x1400558c1
mov rbp, rbp
lea rax, [r14 + 8]
mov word [rsi + r13*2], bp
xorps xmm0, xmm0
mov qword [r14], rax
mov dword [rsp - 0x40], 0x402967d3
xchg rsi, rax
movups xmmword [rsi], xmm0
xchg rsi, rax
xchg r14, rax
movups xmmword [r14 + 0x10], xmm0
xchg r14, rax
xchg rsp, rax
movups xmmword [rsp + 0x20], xmm0
xchg rsp, rax
inc rdi
mov dword [rsp - 0x40], 0x7174d354
cmp word [rsi + rdi*2], bp
jne 0x14005593f
mov rdx, rdi
xchg rdi, r10
mov qword [r14 + 0x38], r10
xchg r10, rdi
mov rcx, r14
call fcn.140017ab0
mov r15, r15
cmp qword [r14 + 0x38], rbp
jbe 0x1400559d9
xchg rdi, rdx
mov rdi, rsi
xchg rdi, rdx
mov r8d, 0x40634e6f
sub r8d, 0x210712ce
add r8d, 0x4df798b3
sub r8d, 0x4296af2a
sub ch, byte [rdi - 0x7ebebd6a]
call 0x16ac27dcc
sub rdx, rax
xchg r14, r14
nop
movzx ecx, bx
lea rax, [rax + 2]
and cx, r8w
mov dword [rsp - 0x34], esp
ror ebx, 7
ror ebx, 1
xor cx, word [rdx + rax - 2]
mov rdi, rdi
inc rbp
mov word [rax - 2], cx
cmp rbp, qword [r14 + 0x38]
mov r15, r15
jb 0x1400559a9
xchg rsi, rdi
mov rcx, rdi
xchg rsi, rdi
call fcn.140099d60
mov dword [rsp - 0x18], ebp
mov rbx, qword [rsp + 0x50]
mov rax, r14
xchg rbp, r12
mov r12, qword [rsp + 0x58]
xchg rbp, r12
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
mov dword [rsp - 0x28], 0x46a2b233
pop r15
nop
mov r14, qword [rsp]
add rsp, 8
pop r13
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
ret
Function at 0x140055996
Capabilities:
Encode data using xor

Disassembly:
xor ebp, ebp
mov r13, r13
mov ebx, 0x762b5362
sub ebx, 0x20b4d1e5
sub ebx, 0x19b80b2c
add ebx, 0xb940f9f
xor ebx, 0x2dfbe5e1
xchg rbp, rax
mov rsi, rbp
xchg rbp, rax
mov eax, ebx
mov r8, r8
mov r8d, ebp
mov r10d, 0x6f373bab
sub r10d, 0x24010f0c
add r10d, 0x2078f270
sub r10d, 0x462d5711
sub r10d, 0x2581c6ff
cmp qword [r15 + 0x38], rbp
jbe 0x14005589b
mov dword [rsp - 0x40], edx
nop word [rax + rax]
mov rcx, qword [r15]
movzx edx, ax
mov dword [rsp - 0x3c], ebx
and dx, r10w
ror eax, 1
ror eax, 6
ror eax, 1
xor dx, word [rcx + r8*2]
mov word [rsi + r8*2], dx
inc r8
mov dword [rsp - 0x1c], ebp
cmp r8, qword [r15 + 0x38]
jb 0x14005586b
mov r8d, ebx
mov dword [rsp - 0x3c], 0x18fd752e
xchg rcx, rbp
mov r9, rcx
xchg rcx, rbp
cmp qword [r12 + 0x38], rbp
mov dword [rsp - 0x28], ecx
jbe 0x14005590f
nop dword [rax]
xchg r11, rax
mov r11, qword [r12]
xchg r11, rax
movzx edx, r8w
mov rcx, qword [r15 + 0x38]
mov dword [rsp - 0x34], ebp
and dx, r10w
add rcx, r9
ror r8d, 3
ror r8d, 1
ror r8d, 1
ror r8d, 2
ror r8d, 1
xor dx, word [rax + r9*2]
mov dword [rsp - 0x28], 0x7d2481ab
inc r9
mov word [rsi + rcx*2], dx
cmp r9, qword [r12 + 0x38]
jb 0x1400558c1
mov rbp, rbp
lea rax, [r14 + 8]
mov word [rsi + r13*2], bp
xorps xmm0, xmm0
mov qword [r14], rax
mov dword [rsp - 0x40], 0x402967d3
xchg rsi, rax
movups xmmword [rsi], xmm0
xchg rsi, rax
xchg r14, rax
movups xmmword [r14 + 0x10], xmm0
xchg r14, rax
xchg rsp, rax
movups xmmword [rsp + 0x20], xmm0
xchg rsp, rax
inc rdi
mov dword [rsp - 0x40], 0x7174d354
cmp word [rsi + rdi*2], bp
jne 0x14005593f
mov rdx, rdi
xchg rdi, r10
mov qword [r14 + 0x38], r10
xchg r10, rdi
mov rcx, r14
call fcn.140017ab0
mov r15, r15
cmp qword [r14 + 0x38], rbp
jbe 0x1400559d9
xchg rdi, rdx
mov rdi, rsi
xchg rdi, rdx
mov r8d, 0x40634e6f
sub r8d, 0x210712ce
add r8d, 0x4df798b3
sub r8d, 0x4296af2a
sub ch, byte [rdi - 0x7ebebd6a]
call 0x16ac27dcc
sub rdx, rax
xchg r14, r14
nop
movzx ecx, bx
lea rax, [rax + 2]
and cx, r8w
mov dword [rsp - 0x34], esp
ror ebx, 7
ror ebx, 1
xor cx, word [rdx + rax - 2]
mov rdi, rdi
inc rbp
mov word [rax - 2], cx
cmp rbp, qword [r14 + 0x38]
mov r15, r15
jb 0x1400559a9
xchg rsi, rdi
mov rcx, rdi
xchg rsi, rdi
call fcn.140099d60
mov dword [rsp - 0x18], ebp
mov rbx, qword [rsp + 0x50]
mov rax, r14
xchg rbp, r12
mov r12, qword [rsp + 0x58]
xchg rbp, r12
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
mov dword [rsp - 0x28], 0x46a2b233
pop r15
nop
mov r14, qword [rsp]
add rsp, 8
pop r13
nop
mov r12, qword [rsp]
add rsp, 8
nop
mov rdi, qword [rsp]
add rsp, 8
ret