joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14021a3b0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x1a0
mov rsi, rcx
mov rax, qword [0x14029c028]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp byte [rcx + 0x17], 0
jns 0x14021a3d8
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14021a3ef
and eax, 0x410
cmp eax, 0x410
je 0x14021a435
cmp byte [rsi + 0x17], 0
mov rcx, rsi
jns 0x14021a3fb
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dil, 1
test eax, eax
jne 0x14021a418
mov ecx, 2
call fcn.1400ee5f0
test al, al
jne 0x14021a457
xor edi, edi
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1401879f0
mov eax, edi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
ret
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.1401879f0
mov rcx, rsi
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
jmp fcn.14021a520
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x58]
mov r8d, 0x95
mov r9d, 2
call fcn.1401fa650
lea rcx, [rsp + 0x68]
lea rdx, str.DeleteFile
mov r8d, 0xb
call fcn.1401c2dd0
mov rdi, rax
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x14021a4a7
and r8d, 0x7f
jmp 0x14021a4ae
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, rsi
call fcn.1401825c0
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov rdx, rbx
call fcn.1401482e0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x14021a4de
and r8d, 0x7f
jmp 0x14021a4e8
mov r8, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.1401c2dd0
cmp byte [rsp + 0x57], 0
jns 0x14021a504
mov rcx, qword [rsp + 0x40]
call fcn.140184dbc
lea rcx, [rsp + 0x58]
call fcn.1401fa6d0
jmp 0x14021a416
Function at 0x14021a520
Capabilities:
Delete directory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x198
mov rdi, rcx
mov rax, qword [0x14029c028]
xor rax, rsp
mov qword [rsp + 0x190], rax
cmp byte [rcx + 0x17], 0
jns 0x14021a54a
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
test eax, eax
jne 0x14021a564
mov ecx, 2
call fcn.1400ee5f0
test al, al
jne 0x14021a588
test esi, esi
setne bl
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.1401879f0
mov eax, ebx
add rsp, 0x198
pop rbx
pop rdi
pop rsi
pop r14
ret
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutil_file_filesystem_win.cc
lea rcx, [rsp + 0x50]
mov r8d, 0x30
mov r9d, 2
call fcn.1401fa650
lea rcx, [rsp + 0x60]
lea rdx, str.RemoveDirectory
mov r8d, 0x10
call fcn.1401c2dd0
mov rbx, rax
movzx r8d, byte [rdi + 0x17]
test r8b, r8b
js 0x14021a5d8
and r8d, 0x7f
jmp 0x14021a5df
mov r8, qword [rdi + 8]
mov rdi, qword [rdi]
lea r14, [rsp + 0x28]
mov rcx, r14
mov rdx, rdi
call fcn.1401825c0
lea rdi, [rsp + 0x38]
mov rcx, rdi
mov rdx, r14
call fcn.1401482e0
movzx r8d, byte [rdi + 0x17]
test r8b, r8b
js 0x14021a60f
and r8d, 0x7f
jmp 0x14021a619
mov r8, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rcx, rbx
mov rdx, rdi
call fcn.1401c2dd0
cmp byte [rsp + 0x4f], 0
jns 0x14021a635
mov rcx, qword [rsp + 0x38]
call fcn.140184dbc
lea rcx, [rsp + 0x50]
call fcn.1401fa6d0
jmp 0x14021a564
Function at 0x14021f1f0
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x14029c028]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x1402ba268]
mov ecx, dword [0x1402ac5e0]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14021f459
mov rax, qword [0x1402ba260]
test rax, rax
je 0x14021f2d7
lea rdx, [rsp + 0x174]
mov dword [rdx], 0xaaaaaaaa
mov rcx, rdi
call qword [0x1402ca008]
test eax, eax
je 0x14021f285
cmp dword [rsp + 0x174], 0
setne byte [rsi + 0x81]
je 0x14021f2de
mov byte [rsi + 0x80], 0
mov dl, 1
jmp 0x14021f313
cmp dword [0x1402b75e0], 2
jg 0x14021f2d7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x4b
mov r9d, 2
call fcn.1401fa650
lea rcx, [rsp + 0x40]
lea rdx, [0x140284180]
mov r8d, 0xe
call fcn.1401c2dd0
mov rcx, rbx
call fcn.1401fa6d0
mov byte [rsi + 0x81], 0
movaps xmm0, xmmword [0x14026dc70]
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rbx], 9
sete byte [rsi + 0x80]
cmp byte [rsi + 0x81], 0
setne dl
lea rax, [rsi + 0x30]
lea r9, [rsi + 0x28]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov r8, rsi
call fcn.14021f4a0
test al, al
jne 0x14021f396
cmp dword [0x1402b75e0], 2
jg 0x14021f377
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x21e
mov r9d, 2
call fcn.1400078c0
lea rcx, [rsp + 0x40]
lea rdx, str.GetProcessBasicInformation_failed
mov r8d, 0x21
call fcn.1401c2dd0
mov rcx, rsi
call fcn.1400079b0
xor esi, esi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1401879f0
mov eax, esi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
cmp byte [rsi + 0x80], 0
mov rdx, qword [rsi + 0x28]
mov rcx, rdi
mov r8, rsi
je 0x14021f3b0
call fcn.14021f6c0
jmp 0x14021f3b5
call fcn.14021fd10
test al, al
jne 0x14021f3f9
cmp dword [0x1402b75e0], 2
jg 0x14021f377
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x227
mov r9d, 2
call fcn.1400078c0
lea rcx, [rsp + 0x40]
lea rdx, str.ReadProcessData_failed
mov r8d, 0x16
jmp 0x14021f36a
mov dl, byte [rsi + 0x80]
mov rcx, rdi
mov r8, rsi
call fcn.1400d1dc0
mov sil, 1
test al, al
jne 0x14021f379
cmp dword [0x1402b75e0], 2
jg 0x14021f377
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x22c
mov r9d, 2
call fcn.1400078c0
lea rcx, [rsp + 0x40]
lea rdx, str.ReadMemoryInfo_failed
mov r8d, 0x15
jmp 0x14021f36a
lea rcx, [0x1402ba268]
call fcn.140184f58
cmp dword [0x1402ba268], 0xffffffff
jne 0x14021f23b
lea rcx, [0x140278570]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.1400d1ca0
mov qword [0x1402ba260], rax
lea rcx, [0x1402ba268]
call fcn.140184fc0
jmp 0x14021f23b
Function at 0x14022b3d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rax, qword [0x14029c028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, 0xaaaaaaaa
lea rdi, [rsp + 0x44]
mov dword [rdi], eax
lea r8, [rsp + 0x40]
mov dword [r8], eax
lea rax, [rsp + 0x3c]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x14022b430
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401879f0
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x1402388a0
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14029c028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x14026dc70]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.1401c8200
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.140241010
test al, al
je 0x1402389f5
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x14023896d
mov rcx, r14
call fcn.1401c8200
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.140241010
test al, al
je 0x1402389b6
cmp dword [rbx], 0x4550
jne 0x140238a26
mov sil, 1
test rdi, rdi
je 0x140238a05
mov qword [rdi], r14
jmp 0x140238a05
mov ecx, 1
call fcn.1400ee5f0
test al, al
je 0x140238a03
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.1400078c0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x140238a9a
mov ecx, 1
call fcn.1400ee5f0
test al, al
je 0x140238a03
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.1400078c0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x140238a94
mov ecx, 1
call fcn.1400ee5f0
test al, al
jne 0x140238a68
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1401879f0
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1400ee5f0
test al, al
je 0x140238a03
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.1400078c0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x140238a9a
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.1400078c0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1401c2dd0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x140238aaf
and r8d, 0x7f
jmp 0x140238ab6
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1401c2dd0
mov rcx, rdi
call fcn.1400079b0
jmp 0x140238a03
Function at 0x140238ad0
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x14029c028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x14026dc70]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.1401c8200
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.140241010
test al, al
je 0x140238c25
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x140238b9d
mov rcx, r14
call fcn.1401c8200
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.140241010
test al, al
je 0x140238be6
cmp dword [rbx], 0x4550
jne 0x140238c56
mov sil, 1
test rdi, rdi
je 0x140238c35
mov qword [rdi], r14
jmp 0x140238c35
mov ecx, 1
call fcn.1400ee5f0
test al, al
je 0x140238c33
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.1400078c0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x140238cca
mov ecx, 1
call fcn.1400ee5f0
test al, al
je 0x140238c33
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.1400078c0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x140238cc4
mov ecx, 1
call fcn.1400ee5f0
test al, al
jne 0x140238c98
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1401879f0
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1400ee5f0
test al, al
je 0x140238c33
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.1400078c0
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x140238cca
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.1400078c0
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1401c2dd0
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x140238cdf
and r8d, 0x7f
jmp 0x140238ce6
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1401c2dd0
mov rcx, rdi
call fcn.1400079b0
jmp 0x140238c33
Function at 0x14007beb0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x80]
movaps xmmword [rbp], xmm6
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
lea rax, [0x14035d968]
mov qword [rcx], rax
lea rax, [rcx + 8]
mov qword [rbp - 0x48], rax
mov dword [rcx + 8], 0
mov word [rcx + 0xc], 0
mov qword [rcx + 0x10], 0
mov qword [rcx + 0x30], 0
mov qword [rcx + 0x38], 0xf
mov byte [rcx + 0x20], 0
lea rax, [0x14035c428]
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x58], 0
mov qword [rcx + 0x60], 0xf
mov byte [rcx + 0x48], 0
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x80], 0
mov qword [rcx + 0x88], 0xf
mov byte [rcx + 0x70], 0
mov qword [rcx + 0x68], rax
mov byte [rcx + 0x90], 0
mov dword [rcx + 0x94], 0
lea rax, [rcx + 0xa8]
mov qword [rbp - 0x40], rax
xorps xmm6, xmm6
movups xmmword [rcx + 0xb0], xmm6
mov qword [rcx + 0xc0], 0
mov byte [rcx + 0xc8], 1
mov dword [rcx + 0xcc], 1
movups xmmword [rcx + 0xd0], xmm6
mov qword [rcx + 0xe0], 0
lea rdi, [0x14035e2c8]
mov qword [rcx + 0xa8], rdi
mov qword [rcx + 0xa0], 0
mov byte [rcx + 0x1e0], 0
lea rbx, [rcx + 0x1e4]
mov r8d, 0x150
mov rcx, rbx
xor edx, edx
call fcn.140341b50
mov qword [rbp - 0x38], rbx
mov rcx, rbx
xor edx, edx
call fcn.1402285b0
mov dword [rsi + 0x334], 0
lea rax, [rsi + 0x348]
mov qword [rbp - 0x30], rax
movups xmmword [rsi + 0x348], xmm6
movups xmmword [rsi + 0x358], xmm6
mov qword [rsi + 0x368], 0
mov ecx, 0x70
call fcn.14031953c
lea rcx, [rsi + 0x360]
mov qword [rbp - 0x28], rcx
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsi + 0x360], rax
lea rax, [rsi + 0x370]
mov qword [rbp - 0x20], rax
movups xmmword [rsi + 0x370], xmm6
mov qword [rsi + 0x380], 0
lea rax, [rsi + 0x390]
mov qword [rbp - 0x18], rax
movups xmmword [rsi + 0x390], xmm6
mov qword [rsi + 0x3a0], 0
mov eax, dword [0x1404902e0]
mov ecx, dword [0x140493eb8]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x26838]
jg 0x14007c10d
lea rax, [0x140490118]
mov qword [rsi + 0x3a8], rax
lea rax, [rsi + 0x3c8]
mov qword [rbp - 0x10], rax
movups xmmword [rsi + 0x3d0], xmm6
mov qword [rsi + 0x3e0], 0
mov byte [rsi + 0x3e8], 1
mov dword [rsi + 0x3ec], 1
movups xmmword [rsi + 0x3f0], xmm6
mov qword [rsi + 0x400], 0
mov qword [rsi + 0x3c8], rdi
mov rcx, rsi
call fcn.14007c540
mov rax, rsi
movaps xmm6, xmmword [rbp]
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x1404902e0]
xor ecx, ecx
mov edx, 1
mov r9d, 0x40da4f9
call fcn.140084660
cmp dword [0x1404902e0], 0xffffffff
jne 0x14007c09d
lea rcx, [0x140490118]
call fcn.14007ca20
mov dword [rsp + 0x30], 0xff3b04ef
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
lea r8, [0x14007cca0]
mov ecx, 1
mov edx, 1
xor r9d, r9d
call fcn.1400848b0
lea r8, [0x1404902e0]
mov ecx, 1
xor edx, edx
mov r9d, 0x40da4f9
call fcn.140084660
jmp 0x14007c09d
Function at 0x140084600
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub rsp, 0x28
mov rax, r9
mov r9, qword [rsp + 0x50]
test ecx, ecx
je 0x140084620
mov rcx, rdx
mov rdx, r8
mov r8, rax
call fcn.1402f9ed0
jmp 0x14008462e
mov rcx, rdx
mov rdx, r8
mov r8, rax
call fcn.1402fa1e4
nop
add rsp, 0x28
ret
Function at 0x1400debe0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x1a0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x118], 0xfffffffffffffffe
mov rsi, rcx
mov rax, qword [rcx]
mov r14, qword [rcx + 8]
mov r15d, dword [0x1404903d4]
add r15d, dword [rax + 0xc134]
mov byte [rbp - 0x58], 0
lea rdi, [rbp - 0x54]
mov r8d, 0x150
mov rcx, rdi
xor edx, edx
call fcn.140341b50
mov rcx, rdi
xor edx, edx
mov r8d, 0x5bdfd325
call fcn.1400dee80
mov ecx, 1
mov edx, 1
mov r8d, 0xbaad0eaf
call fcn.1400dee90
movaps xmm0, xmmword [rax]
movaps xmmword [rbp + 0x100], xmm0
lea r12, [rbp - 4]
movzx r9d, byte [rbp - 0x58]
mov qword [rsp + 0x20], r12
lea rdx, [rbp + 0x100]
mov r8d, 0x10
mov rcx, rdi
call fcn.140228730
movsxd rdi, dword [0x14035ed40]
mov ebx, dword [0x14035ed44]
xorps xmm0, xmm0
movups xmmword [r12], xmm0
mov rax, qword [rsi]
mov r12d, dword [rax + 0xc130]
cmp r12, 8
jb 0x1400dece1
shr r12, 3
add r14, r15
add r14, 4
xor r15d, r15d
nop dword [rax]
mov edx, dword [r14 + r15*8 - 4]
add rdx, qword [rsi + 8]
movsxd r8, dword [r14 + r15*8]
lea rcx, [rbp - 0x54]
mov r9, rdx
call fcn.140228e70
inc r15
cmp r12, r15
jne 0x1400decc0
lea rax, [0x14035ed40]
add rdi, rax
mov r14d, dword [0x140439e00]
lea r15d, [r14 + 1]
mov dword [0x140439e00], r15d
xor esi, esi
mov r12d, 0
test r14d, r15d
jne 0x1400ded3a
xor eax, eax
mov esi, 0
mov r12d, 0
test ebx, ebx
jle 0x1400ded3a
xor esi, esi
xor r12d, r12d
movsxd rcx, eax
add rcx, rdi
mov rdx, qword [rcx]
mov rcx, qword [rcx + 8]
xor rsi, rdx
xor r12, rcx
add eax, 0x10
cmp eax, ebx
jl 0x1400ded20
lea rcx, [rbp - 0x54]
call fcn.1402289c0
mov rax, qword [0x14035ed38]
mov rcx, qword [0x14035ed30]
xor edx, edx
test r14d, r15d
setne dl
movabs r8, 0x23dff269f5f7d8ba
or r8, rdx
xor edx, edx
movabs r9, 0xdc200d960a082745
add r8, r9
adc rdx, 0xffffffffffffffff
sub rcx, rsi
sbb rax, r12
xor r8, rcx
xor rdx, rax
not rdx
not r8
and r8, rcx
and rdx, rax
or rdx, r8
mov rax, rdx
shr rax, 0x20
or eax, edx
add dword [0x1404903d4], eax
add rsp, 0x1a0
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
Function at 0x1400dee90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x1400deecc
test edx, edx
je 0x1400deefc
movzx eax, byte [0x140439e20]
cmp al, 0x67
je 0x1400deec4
mov cl, 0x46
nop word cs:[rax + rax]
mov al, 0x6b
lock cmpxchg byte [0x140439e20], cl
je 0x1400def5c
cmp al, 0x67
jne 0x1400deeb0
lea rax, [0x140439e10]
ret
test edx, edx
je 0x1400def2c
movzx eax, byte [0x140439e5b]
cmp al, 0x91
je 0x1400deef4
mov cl, 0x3f
nop dword [rax]
mov al, 0xbb
lock cmpxchg byte [0x140439e5b], cl
je 0x1400def91
cmp al, 0x91
jne 0x1400deee0
lea rax, [0x140439e50]
ret
movzx eax, byte [0x140439e35]
cmp al, 0xe6
je 0x1400def24
mov cl, 0xf6
nop dword [rax]
mov al, 0xc7
lock cmpxchg byte [0x140439e35], cl
je 0x1400defd1
cmp al, 0xe6
jne 0x1400def10
lea rax, [0x140439e30]
ret
movzx eax, byte [0x140439e42]
cmp al, 0x2b
je 0x1400def54
mov cl, 0x87
nop dword [rax]
mov al, 0x9b
lock cmpxchg byte [0x140439e42], cl
je 0x1400df011
cmp al, 0x2b
jne 0x1400def40
lea rax, [0x140439e40]
ret
xor eax, eax
lea rcx, [0x140439e10]
lea rdx, [0x14035ed50]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x10
jl 0x1400def70
mov al, 0x67
xchg byte [0x140439e20], al
lea rax, [0x140439e10]
ret
xor eax, eax
lea rcx, [0x140439e50]
lea rdx, [0x14035ed80]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0xb
jl 0x1400defb0
mov al, 0x91
xchg byte [0x140439e5b], al
lea rax, [0x140439e50]
ret
xor eax, eax
lea rcx, [0x140439e30]
lea rdx, [0x14035ed60]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 5
jl 0x1400deff0
mov al, 0xe6
xchg byte [0x140439e35], al
lea rax, [0x140439e30]
ret
xor eax, eax
lea rcx, [0x140439e40]
lea rdx, [0x14035ed70]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 2
jl 0x1400df030
mov al, 0x2b
xchg byte [0x140439e42], al
lea rax, [0x140439e40]
ret
Function at 0x1400e0f30
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x20], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rcx
mov rax, qword [rbp + 0x80]
mov r8d, dword [rbp + 0x90]
mov r10d, dword [rbp + 0xa0]
lea rcx, [rbp - 0x40]
mov qword [rbp - 0x28], 0
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
lea r11, [0x14035c428]
mov qword [rbp - 0x40], r11
mov qword [rbp], 0
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
mov qword [rbp - 0x18], r11
mov dword [rbp - 0x58], edx
mov dword [rbp - 0x54], r10d
mov dword [rbp - 0x50], r9d
mov dword [rbp - 0x4c], r8d
mov dword [rbp - 0x48], 0
mov rdx, rax
call fcn.1401ec490
mov rdx, qword [rbp + 0x88]
lea rcx, [rbp - 0x18]
call fcn.1401ec490
mov r15, qword [rbp + 0x98]
movzx eax, byte [rbp + 0xa8]
mov byte [rbp + 0x10], al
mov rax, qword [0x140490570]
lea rcx, [0x14035ed90]
movsxd rbx, dword [0x14035ed90]
add rbx, rcx
mov r14d, dword [0x14035ed9c]
test rax, rax
jne 0x1400e1029
mov ecx, 0x700
call fcn.14031953c
mov qword [rbp + 0x18], rax
mov rcx, rax
call fcn.14007bbb0
mov rax, qword [rbp + 0x18]
mov qword [0x140490570], rax
mov rcx, qword [0x140490570]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
mov r10, qword [case.0x1400eabdd.0]
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x58]
mov rdx, rsi
mov r8, rdi
call r10
mov rax, qword [rbp + 8]
cmp rax, 0x10
jb 0x1400e109e
mov r8, qword [rbp - 0x10]
lea r9, [rax + 1]
cmp r9, 0x1000
jb 0x1400e108a
mov rcx, qword [r8 - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x20
jae 0x1400e1175
add rax, 0x28
mov r9, rax
mov r8, rcx
mov dword [rsp + 0x20], 0x8b1ee9a1
xor ecx, ecx
mov edx, 1
call fcn.1400e13e0
mov qword [rbp], 0
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
mov rax, qword [rbp - 0x20]
cmp rax, 0x10
jb 0x1400e1162
mov r8, qword [rbp - 0x38]
lea r9, [rax + 1]
cmp r9, 0x1000
jb 0x1400e114e
mov ecx, dword [0x140439f24]
lea edx, [rcx + 1]
mov dword [0x140439f24], edx
test ecx, edx
je 0x1400e10e9
xor r9d, r9d
jmp 0x1400e111f
xor r10d, r10d
xor r9d, r9d
test r14d, r14d
jle 0x1400e111f
nop word cs:[rax + rax]
movsxd r11, r10d
mov r11, qword [rbx + r11]
mov rdi, r11
xor rdi, r11
not rdi
and r9, rdi
xor r9, r11
add r10d, 8
cmp r10d, r14d
jl 0x1400e1100
mov r10, qword [r8 - 8]
add r8, 0xfffffffffffffff8
mov r11, qword [0x1404903d8]
mov rdi, r11
xor rdi, r10
and r11, r10
lea r10, [rdi + r11*2]
sub r8, r10
cmp r8, 0x20
jae 0x1400e117a
add rax, 0x28
mov r9, rax
mov r8, r10
mov dword [rsp + 0x20], 0x8b1ee9a1
xor ecx, ecx
mov edx, 1
call fcn.1400e13e0
mov rax, rsi
add rsp, 0xa8
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
call fcn.1402f9bec
mov rax, qword [0x14035eda8]
xor r8d, r8d
test ecx, edx
setne r8b
lea rcx, [r8 - 1]
sub rax, r9
mov rdx, rax
not rdx
neg r8
and r8, rdx
xor rax, rcx
or rax, r8
not rax
add qword [0x1404903d8], rax
call fcn.1402f9bec
int3