joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a9130
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x260
mov rax, qword [0x1403e5188]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
mov ecx, dword [0x1403f55e8]
mov rax, qword gs:[0x58]
mov edx, 0x18
mov rcx, qword [rax + rcx*8]
mov eax, dword [rdx + rcx]
cmp dword [0x1403f2f18], eax
jg 0x1401a91ae
lea rdx, [0x1403f2ef8]
mov rcx, rbx
call fcn.140030ce0
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14026fc70
add rsp, 0x260
pop rbx
ret
inc r8
cmp word [rax + r8*2], 0
je 0x1401a921e
jmp 0x1401a91a1
lea rcx, [0x1403f2f18]
call fcn.14026f630
cmp dword [0x1403f2f18], 0xffffffff
jne 0x1401a9176
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x40]
call fcn.1402b61f1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov qword [0x1403f2ef8], 0
movdqa xmm0, xmmword [0x1402e0710]
movdqu xmmword [0x1403f2f08], xmm0
test eax, eax
js 0x1401a922f
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
jmp 0x1401a91a1
lea rdx, [rsp + 0x40]
lea rcx, [0x1403f2ef8]
call fcn.14003fb20
lea rcx, [0x1402d8750]
call fcn.14026fbcc
nop
lea rcx, [0x1403f2f18]
call fcn.14026f5d0
jmp 0x1401a9176

Function at 0x1401a97f0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x1f0
mov rax, qword [0x1403e5188]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x1403f1510], eax
inc eax
cmp eax, 1
jne 0x1401a983d
lea ecx, [rax + 1]
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x1403f1514], eax
test bl, bl
je 0x1401a98b1
xor ebx, ebx
lock xadd dword [0x1403f1514], ebx
test ebx, ebx
je 0x1401a98b1
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x200], rsi
add rcx, qword [0x1403c20f8]
lea rsi, [0x1403c20f0]
mov dword [rsp + 0x24], 0
cmp rcx, 1
jbe 0x1401a988e
mov rax, qword [0x1403c20f0]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x1401a9890
mov al, 1
movzx eax, al
add rax, 2
mov qword [rsp + 0x28], rsi
mov rsi, qword [rsp + 0x200]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], ebx
test al, 1
jne 0x1401a98d5
mov rax, rdi
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.14026fc70
mov rbx, qword [rsp + 0x208]
add rsp, 0x1f0
pop rdi
ret
lea rdx, str.winsock
lea rcx, [rsp + 0x20]
call fcn.14003fed0
int3
Function at 0x1401ab2c0
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [0x1403f1520]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
lea rbx, [rdi + 3]
xor esi, esi
shr rbx, 2
test rax, rax
je 0x1401ab362
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1401ab362
mov ecx, esi
mov r9, rdx
mov r8, qword [rdx]
test r8, r8
je 0x1401ab313
movzx eax, byte [r8]
cmp rax, rbx
jae 0x1401ab339
inc ecx
add rdx, 8
cmp ecx, 2
jl 0x1401ab302
mov ecx, esi
mov rax, rsi
mov rdx, qword [r9 + rax*8]
test rdx, rdx
jne 0x1401ab353
inc ecx
inc rax
cmp rax, 2
jl 0x1401ab323
jmp 0x1401ab362
movsxd rcx, ecx
mov rax, r8
mov qword [r9 + rcx*8], rsi
movzx ecx, byte [r8]
mov byte [r8 + rdi], cl
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
movsxd rax, ecx
mov rcx, rdx
mov qword [r9 + rax*8], rsi
call fcn.14026fc90
lea rcx, [rbx*4 + 1]
call fcn.14026fc98
cmp rbx, 0xff
movzx ecx, bl
cmova ecx, esi
mov byte [rax + rdi], cl
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret

Function at 0x1401ab390
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
push rdi
sub rsp, 0x28
mov rbx, rcx
mov rdi, rdx
mov ecx, dword [0x1403f1520]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
xor r8d, r8d
test rax, rax
je 0x1401ab3c0
mov r9, qword [rax + 8]
jmp 0x1401ab3c3
mov r9, r8
cmp rdi, 0x3fc
ja 0x1401ab3e7
test r9, r9
je 0x1401ab3e7
mov rax, r8
cmp qword [r9 + rax*8], 0
je 0x1401ab3f5
inc r8d
inc rax
cmp rax, 2
jl 0x1401ab3d4
mov rcx, rbx
add rsp, 0x28
pop rdi
pop rbx
jmp fcn.14026fc90
movzx eax, byte [rbx + rdi]
mov byte [rbx], al
movsxd rax, r8d
mov qword [r9 + rax*8], rbx
add rsp, 0x28
pop rdi
pop rbx
ret

Function at 0x1401abcf0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x1403f2f40], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x1401abd4d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
add rsp, 0x30
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [0x1401ab2b0]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
add rsp, 0x30
pop rbx
ret
Function at 0x1401abf10
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xd0
mov rsi, rdx
mov rbx, rcx
xor edi, edi
mov eax, edi
lock xadd dword [rcx + 0x30], eax
test eax, eax
jne 0x1401abf5d
call fcn.1401ac570
xorps xmm0, xmm0
mov qword [rsp + 0xc0], rdi
movups xmmword [rsi], xmm0
movsd xmm0, qword [rsp + 0xc0]
movsd qword [rsi + 0x10], xmm0
xor eax, eax
jmp 0x1401ac05c
mov dword [rsp + 0x90], edi
lea rcx, [rsp + 0x98]
call fcn.14026ea70
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
lea rax, [rbx + 0x28]
test rbx, rbx
cmove rax, rdi
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov ecx, dword [0x1403f1520]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x20]
mov ecx, dword [0x1403f1520]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov r9, rsi
lea r8, [rsp + 0x40]
mov edx, 0xffffffff
mov rcx, rbx
call fcn.1401ab6c0
test rax, rax
je 0x1401ac019
nop word [rax + rax]
lea rax, [rdi + 1]
cmp rdi, 0xffffffffffffffff
cmove rax, rdi
mov rdi, rax
mov r9, rsi
lea r8, [rsp + 0x40]
mov edx, 0xffffffff
mov rcx, rbx
call fcn.1401ab6c0
test rax, rax
jne 0x1401abff0
mov rdx, qword [rsp + 0x30]
mov ecx, dword [0x1403f1520]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
lea rbx, [rsp + 0x40]
mov esi, 0xa
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401ac042
call fcn.14026fc90
add rbx, 8
sub rsi, 1
jne 0x1401ac035
lea rcx, [rsp + 0x98]
call fcn.14026ea76
mov rax, rdi
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1401ad630
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
xor eax, eax
mov byte [rcx + 0x68], 0
mov qword [rcx + 0x10], rax
mov rbx, rcx
mov dword [rcx], 0x67452301
mov dword [rcx + 4], 0xefcdab89
mov dword [rcx + 8], 0x98badcfe
mov dword [rcx + 0xc], 0x10325476
cmp qword [rdx + 0x18], 0x10
mov r8, qword [rdx + 0x10]
jb 0x1401ad66c
mov rdx, qword [rdx]
call fcn.1401ae680
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x1401b63b0
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
xor r10d, r10d
mov r11, rcx
test r8, r8
je 0x1401b6493
cmp r8, 0x20
jb 0x1401b6468
lea rax, [rcx + 0x10]
mov r9, r8
and r9, 0xffffffffffffffe0
mov rcx, rdx
sub rcx, r11
xorps xmm3, xmm3
xorps xmm2, xmm2
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r10, 0x20
movdqu xmm1, xmmword [rcx + rax - 0x10]
lea rax, [rax + 0x20]
pxor xmm1, xmm0
por xmm1, xmm3
movdqa xmm3, xmm1
movdqu xmm1, xmmword [rcx + rax - 0x20]
movdqu xmm0, xmmword [rax - 0x20]
pxor xmm1, xmm0
por xmm1, xmm2
movdqa xmm2, xmm1
cmp r10, r9
jb 0x1401b63f0
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd r9d, xmm2
cmp r10, r8
jae 0x1401b6493
sub rdx, r11
lea rax, [r10 + r11]
sub r8, r10
nop word [rax + rax]
movzx ecx, byte [rax + rdx]
xor cl, byte [rax]
lea rax, [rax + 1]
or r9b, cl
sub r8, 1
jne 0x1401b6480
movzx eax, r9b
ret
Function at 0x1401ba210
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
push rdx
call fcn.140001e00
mov r8, qword [rsp]
cmp eax, 0
jne 0x14000229d
mov r14d, dword [r8 + 0xf0]
xor rdi, rdi
lea rcx, [rdi + r14*4]
mov rsi, r8
lea rdi, [r8 + rcx*4]
mov rax, qword [rsi]
mov rbx, qword [rsi + 8]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
mov qword [rdi], rax
mov qword [rdi + 8], rbx
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
lea rsi, [rsi + 0x10]
lea rdi, [rdi - 0x10]
cmp rdi, rsi
jne 0x1400020d8
lea rax, [0x140003480]
mov rsi, qword [rax + 0x28]
mov rdi, qword [rax + 0x30]
mov rbp, qword [rax + 0x38]
mov r15, r8
sub r14d, 1
nop
lea r15, [r15 + 0x10]
mov rax, qword [r15]
mov rcx, qword [r15 + 8]
mov r9, rsi
mov r12, rsi
and r9, rax
and r12, rcx
mov rbx, r9
mov rdx, r12
shr r9, 7
lea r8, [rax + rax]
shr r12, 7
lea r11, [rcx + rcx]
sub rbx, r9
sub rdx, r12
and r8, rdi
and r11, rdi
and rbx, rbp
and rdx, rbp
xor r8, rbx
xor r11, rdx
mov r10, rsi
mov r13, rsi
and r10, r8
and r13, r11
mov rbx, r10
mov rdx, r13
shr r10, 7
lea r9, [r8 + r8]
shr r13, 7
lea r12, [r11 + r11]
sub rbx, r10
sub rdx, r13
and r9, rdi
and r12, rdi
and rbx, rbp
and rdx, rbp
xor r9, rbx
xor r12, rdx
mov r10, rsi
mov r13, rsi
and r10, r9
and r13, r12
mov rbx, r10
mov rdx, r13
shr r10, 7
xor r8, rax
shr r13, 7
xor r11, rcx
sub rbx, r10
sub rdx, r13
lea r10, [r9 + r9]
lea r13, [r12 + r12]
xor r9, rax
xor r12, rcx
and r10, rdi
and r13, rdi
and rbx, rbp
and rdx, rbp
xor r10, rbx
xor r13, rdx
xor rax, r10
xor rcx, r13
xor r8, r10
xor r11, r13
mov rbx, rax
mov rdx, rcx
xor r9, r10
shr rbx, 0x20
xor r12, r13
shr rdx, 0x20
xor r10, r8
rol eax, 8
xor r13, r11
rol ecx, 8
xor r10, r9
rol ebx, 8
xor r13, r12
rol edx, 8
xor eax, r10d
shr r10, 0x20
xor ecx, r13d
shr r13, 0x20
xor ebx, r10d
xor edx, r13d
mov r10, r8
rol r8d, 0x18
mov r13, r11
rol r11d, 0x18
shr r10, 0x20
xor eax, r8d
shr r13, 0x20
xor ecx, r11d
rol r10d, 0x18
mov r8, r9
rol r13d, 0x18
mov r11, r12
shr r8, 0x20
xor ebx, r10d
shr r11, 0x20
xor edx, r13d
rol r9d, 0x10
rol r12d, 0x10
rol r8d, 0x10
xor eax, r9d
rol r11d, 0x10
xor ecx, r12d
xor ebx, r8d
xor edx, r11d
mov dword [r15], eax
mov dword [r15 + 4], ebx
mov dword [r15 + 8], ecx
mov dword [r15 + 0xc], edx
sub r14d, 1
jne 0x14000211c
xor rax, rax
mov r15, qword [rsp + 8]
mov r14, qword [rsp + 0x10]
mov r13, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
mov eax, 0x28
call fcn.14026ff20
sub rsp, rax
add rsp, 0x28
jmp 0x140002090
Function at 0x1401ba4f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r13
push r15
mov eax, 0x20
call fcn.14026ff20
sub rsp, rax
mov r13, qword [rsp + 0x70]
mov r15, r9
mov r12, qword [rsp + 0x78]
mov r10, r13
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp r8, 0x10
jb 0x1401ba588
mov qword [rsp + 0x50], rbp
mov rbp, r8
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
nop dword [rax]
sub r10, rsi
mov r8, rbx
sub r8, rsi
mov rax, rsi
mov edx, 2
mov rcx, qword [r10 + rax]
xor rcx, qword [rax]
mov qword [r8 + rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1401ba551
mov r8, r15
mov rdx, rbx
mov rcx, rbx
call r12
mov r10, rbx
add rsi, 0x10
add rbx, 0x10
sub rbp, 1
jne 0x1401ba540
mov rbp, qword [rsp + 0x50]
test rdi, rdi
je 0x1401ba68d
mov qword [rsp + 0x58], r14
nop word [rax + rax]
mov r8, r10
lea rcx, [rsi + 1]
mov r9, rbx
mov r11d, 1
sub r8, rsi
sub r9, rsi
sub r11, rsi
xor edx, edx
mov r14d, 2
sub r14, rsi
cmp rdx, rdi
jae 0x1401ba63a
movzx eax, byte [r8 + rcx - 1]
xor al, byte [rcx - 1]
mov byte [r9 + rcx - 1], al
mov rax, rcx
sub rax, rsi
cmp rax, rdi
jae 0x1401ba637
movzx eax, byte [rcx + r8]
xor al, byte [rcx]
mov byte [rcx + r9], al
lea rax, [r11 + rcx]
cmp rax, rdi
jae 0x1401ba631
movzx eax, byte [r8 + rcx + 1]
xor al, byte [rcx + 1]
mov byte [r9 + rcx + 1], al
lea rax, [r14 + rcx]
cmp rax, rdi
jae 0x1401ba62b
movzx eax, byte [r8 + rcx + 2]
add rdx, 4
xor al, byte [rcx + 2]
mov byte [r9 + rcx + 2], al
add rcx, 4
cmp rdx, 0x10
jb 0x1401ba5c4
jmp 0x1401ba661
add rdx, 3
jmp 0x1401ba63a
add rdx, 2
jmp 0x1401ba63a
inc rdx
cmp rdx, 0x10
jae 0x1401ba661
sub r10, rbx
lea rcx, [rdx + rbx]
mov r8d, 0x10
sub r8, rdx
movzx eax, byte [r10 + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub r8, 1
jne 0x1401ba650
mov r8, r15
mov rdx, rbx
mov rcx, rbx
call r12
mov r10, rbx
cmp rdi, 0x10
jbe 0x1401ba688
add rsi, 0x10
add rbx, 0x10
sub rdi, 0x10
jne 0x1401ba5a0
mov r14, qword [rsp + 0x58]
movups xmm0, xmmword [r10]
mov rbx, qword [rsp + 0x60]
movups xmmword [r13], xmm0
add rsp, 0x20
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1401ba6b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
mov eax, 0x40
call fcn.14026ff20
sub rsp, rax
mov r15, qword [rsp + 0xb0]
mov rbp, rdx
mov rdx, qword [rsp + 0xa8]
mov r10, r9
mov rdi, r8
mov r12, rcx
mov ebx, dword [r15]
test ebx, ebx
je 0x1401ba712
nop
test rdi, rdi
je 0x1401ba712
mov eax, ebx
dec rdi
movzx ecx, byte [rax + rdx]
xor cl, byte [r12]
inc r12
mov byte [rbp], cl
inc rbp
inc ebx
and ebx, 0xf
jne 0x1401ba6f0
mov r9, qword [rsp + 0xb8]
mov esi, 0x10
mov r13, qword [rsp + 0xa0]
mov qword [rsp + 0x38], r14
cmp rdi, rsi
jb 0x1401ba823
mov rcx, rdi
mov r14, rbp
shr rcx, 4
mov r15, r12
imul rax, rcx, 0xfffffffffffffff0
sub r14, rdx
sub r15, rdx
add rdi, rax
mov rax, rcx
shl rax, 4
add rbp, rax
mov qword [rsp + 0x90], rdi
mov rdi, qword [rsp + 0x98]
add r12, rax
mov qword [rsp + 0x80], r12
mov r12, rcx
mov qword [rsp + 0x88], rbp
mov rbp, qword [rsp + 0xa8]
nop word [rax + rax]
mov r8, rdi
mov rdx, rbp
mov rcx, r13
call r9
mov edx, esi
nop
dec edx
add byte [rdx + r13], 1
jne 0x1401ba7ad
test edx, edx
jne 0x1401ba7a0
cmp ebx, esi
jae 0x1401ba7e5
mov edx, 0xf
mov eax, ebx
sub edx, ebx
add rax, rbp
shr edx, 3
inc edx
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r15 + rax]
xor rcx, qword [rax]
mov qword [r14 + rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1401ba7d0
mov r9, qword [rsp + 0xb8]
add r14, rsi
add r15, rsi
xor ebx, ebx
sub r12, 1
jne 0x1401ba790
mov rdi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
mov r10, qword [rsp + 0x98]
mov r15, qword [rsp + 0xb0]
test rdi, rdi
je 0x1401ba866
mov r14, qword [rsp + 0xa8]
mov r8, r10
mov rdx, r14
mov rcx, r13
call r9
nop dword [rax]
dec esi
add byte [rsi + r13], 1
jne 0x1401ba850
test esi, esi
jne 0x1401ba840
nop dword [rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r12]
xor al, byte [rcx + r14]
mov byte [rcx + rbp], al
sub rdi, 1
jne 0x1401ba850
mov r14, qword [rsp + 0x38]
mov dword [r15], ebx
add rsp, 0x40
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401ba880
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], r9
push rsi
push rdi
push r13
push r14
push r15
mov eax, 0x30
call fcn.14026ff20
sub rsp, rax
mov rbx, r8
mov rsi, rdx
mov r8, qword [rsp + 0x90]
mov rbp, rcx
mov edi, dword [r8]
test edi, edi
je 0x1401ba8e4
mov rdx, qword [rsp + 0x88]
test rbx, rbx
je 0x1401ba8e4
mov eax, edi
dec rbx
movzx ecx, byte [rax + rdx]
xor cl, byte [rbp]
inc rbp
mov byte [rsi], cl
inc rsi
inc edi
and edi, 0xf
jne 0x1401ba8c4
mov r14, qword [rsp + 0x80]
mov r15d, 0xc
mov r10, qword [rsp + 0x98]
mov qword [rsp + 0x60], r12
mov r13d, dword [r14 + 0xc]
bswap r13d
cmp rbx, 0x10
jb 0x1401ba9ae
mov eax, 0x10000000
nop word [rax + rax]
mov rdx, rbx
mov qword [rsp + 0x20], r14
shr rdx, 4
cmp rdx, rax
cmova rdx, rax
add r13d, edx
mov r12, rdx
mov eax, r13d
mov ecx, r13d
sub r12, rax
cmp rax, rdx
cmovae r12, rdx
xor r13d, r13d
cmp rax, rdx
mov r8, r12
mov rdx, rsi
cmovae r13d, ecx
mov rcx, rbp
call r10
mov eax, r13d
bswap eax
mov dword [r14 + 0xc], eax
test r13d, r13d
jne 0x1401ba97d
mov eax, r15d
dec eax
add byte [rax + r14], 1
jne 0x1401ba97d
test eax, eax
jne 0x1401ba970
mov r10, qword [rsp + 0x98]
mov eax, 0x10000000
mov r9, qword [rsp + 0x78]
shl r12, 4
sub rbx, r12
add rsi, r12
add rbp, r12
cmp rbx, 0x10
jae 0x1401ba920
mov r8, qword [rsp + 0x90]
test rbx, rbx
je 0x1401baa21
mov r12, qword [rsp + 0x88]
xorps xmm0, xmm0
mov r8d, 1
mov qword [rsp + 0x20], r14
mov rdx, r12
mov rcx, r12
movups xmmword [r12], xmm0
call r10
add r13d, 1
bswap r13d
mov dword [r14 + 0xc], r13d
jne 0x1401baa00
dec r15d
add byte [r15 + r14], 1
jne 0x1401baa00
test r15d, r15d
jne 0x1401ba9e4
nop dword [rax]
nop word [rax + rax]
mov ecx, edi
inc edi
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + r12]
mov byte [rcx + rsi], al
sub rbx, 1
jne 0x1401baa00
mov rax, qword [rsp + 0x90]
mov dword [rax], edi
jmp 0x1401baa24
mov dword [r8], edi
mov r12, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x1401bb430
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push r13
push r14
mov eax, 0x28
call fcn.14026ff20
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov rdi, r8
mov r8, qword [rcx + 0x160]
mov r14, rdx
mov r13, qword [rcx + 0x168]
mov rbp, rcx
je 0x1401bb472
mov eax, 0xfffffffe
add rsp, 0x28
pop r14
pop r13
pop rdi
pop rbp
ret
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, rdi
cmp rcx, rax
ja 0x1401bb564
cmp rcx, rdi
jb 0x1401bb564
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov esi, dword [rbp + 0x174]
mov qword [rsp + 0x60], r12
mov qword [rbp + 0x30], rcx
test esi, esi
je 0x1401bb4e7
test rdi, rdi
je 0x1401bb4d0
movzx eax, byte [r14]
dec rdi
mov ecx, esi
inc r14
xor byte [rcx + rbp + 0x40], al
inc esi
and esi, 0xf
jne 0x1401bb4b2
jmp 0x1401bb4d4
test esi, esi
jne 0x1401bb542
lea r12, [rbp + 0x60]
lea rbx, [rbp + 0x40]
mov rdx, r12
mov rcx, rbx
call r8
jmp 0x1401bb4ef
lea r12, [rbp + 0x60]
lea rbx, [rbp + 0x40]
mov qword [rsp + 0x20], r15
mov r15, rdi
and r15, 0xfffffffffffffff0
je 0x1401bb512
mov r9, r15
mov r8, r14
mov rdx, r12
mov rcx, rbx
call r13
add r14, r15
sub rdi, r15
mov r15, qword [rsp + 0x20]
test rdi, rdi
je 0x1401bb542
mov esi, edi
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r14 + rbx - 0x40]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x1401bb530
mov rbx, qword [rsp + 0x50]
xor eax, eax
mov r12, qword [rsp + 0x60]
mov dword [rbp + 0x174], esi
mov rsi, qword [rsp + 0x58]
add rsp, 0x28
pop r14
pop r13
pop rdi
pop rbp
ret
mov eax, 0xffffffff
add rsp, 0x28
pop r14
pop r13
pop rdi
pop rbp
ret
Function at 0x1401bb580
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r12
push r14
mov eax, 0x40
call fcn.14026ff20
sub rsp, rax
mov rax, qword [rcx + 0x178]
mov rbx, rcx
mov r12, qword [rcx + 0x160]
mov r14, r9
mov qword [rsp + 0x88], rax
mov rsi, r8
mov rax, qword [rcx + 0x180]
mov rdi, rdx
mov qword [rsp + 0x70], rax
mov rax, qword [rcx + 0x168]
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x28], rax
add rcx, r9
movabs rax, 0xfffffffe0
cmp rcx, rax
ja 0x1401bb7ff
cmp rcx, r9
jb 0x1401bb7ff
cmp dword [rbx + 0x174], 0
lea r8, [rbx + 0x60]
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r15
mov qword [rbx + 0x38], rcx
je 0x1401bb62a
lea rcx, [rbx + 0x40]
mov rdx, r8
call r12
lea r8, [rbx + 0x60]
mov dword [rbx + 0x174], 0
mov r15d, dword [rbx + 0xc]
mov ebp, dword [rbx + 0x170]
bswap r15d
test ebp, ebp
je 0x1401bb67b
nop dword [rax + rax]
test r14, r14
je 0x1401bb669
movzx edx, byte [rdi]
dec r14
mov ecx, ebp
inc rdi
movzx eax, byte [rcx + rbx + 0x10]
xor al, dl
mov byte [rsi], al
inc rsi
xor byte [rcx + rbx + 0x40], dl
inc ebp
and ebp, 0xf
jne 0x1401bb640
jmp 0x1401bb671
test ebp, ebp
jne 0x1401bb7dc
lea rcx, [rbx + 0x40]
mov rdx, r8
call r12
cmp r14, 0xc00
jb 0x1401bb71a
movabs rax, 0xaaaaaaaaaaaaaaab
mul r14
shr rdx, 0xb
imul rax, rdx, 0xfffffffffffff400
mov qword [rsp + 0x20], rdx
add r14, rax
nop dword [rax + rax]
mov r9d, 0xc00
lea rdx, [rbx + 0x60]
mov r8, rdi
lea rcx, [rbx + 0x40]
call qword [rsp + 0x28]
mov r12d, 0xc0
nop dword [rax + rax]
mov r8, qword [rsp + 0x70]
lea rdx, [rbx + 0x10]
mov rcx, rbx
call qword [rsp + 0x88]
inc r15d
mov eax, r15d
bswap eax
mov dword [rbx + 0xc], eax
mov rax, qword [rbx + 0x10]
xor rax, qword [rdi]
mov qword [rsi], rax
mov rax, qword [rdi + 8]
add rdi, 0x10
xor rax, qword [rbx + 0x18]
mov qword [rsi + 8], rax
add rsi, 0x10
sub r12, 1
jne 0x1401bb6d0
sub qword [rsp + 0x20], 1
jne 0x1401bb6b0
mov r9, r14
and r9, 0xfffffffffffffff0
je 0x1401bb792
mov r8, rdi
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
call qword [rsp + 0x28]
cmp r14, 0x10
jb 0x1401bb792
mov r12, r14
shr r12, 4
imul rax, r12, 0xfffffffffffffff0
add r14, rax
nop word [rax + rax]
mov r8, qword [rsp + 0x70]
lea rdx, [rbx + 0x10]
mov rcx, rbx
call qword [rsp + 0x88]
inc r15d
mov eax, r15d
bswap eax
mov dword [rbx + 0xc], eax
mov rax, qword [rbx + 0x10]
xor rax, qword [rdi]
mov qword [rsi], rax
mov rax, qword [rdi + 8]
add rdi, 0x10
xor rax, qword [rbx + 0x18]
mov qword [rsi + 8], rax
add rsi, 0x10
sub r12, 1
jne 0x1401bb750
test r14, r14
je 0x1401bb7dc
mov r8, qword [rsp + 0x70]
lea rdx, [rbx + 0x10]
mov rcx, rbx
call qword [rsp + 0x88]
inc r15d
bswap r15d
mov dword [rbx + 0xc], r15d
nop dword [rax]
nop dword [rax + rax]
mov edx, ebp
inc ebp
movzx ecx, byte [rdx + rdi]
movzx eax, byte [rdx + rbx + 0x10]
xor byte [rdx + rbx + 0x40], cl
xor al, cl
mov byte [rdx + rsi], al
sub r14, 1
jne 0x1401bb7c0
mov r13, qword [rsp + 0x38]
xor eax, eax
mov r15, qword [rsp + 0x30]
mov dword [rbx + 0x170], ebp
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret
mov eax, 0xffffffff
add rsp, 0x40
pop r14
pop r12
pop rdi
pop rsi
pop rbx
ret