joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002efd5
Capabilities:
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x14], 0
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
call sym._fpreset
lea rax, [0x140038660]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
lea rax, [sym.pthread_tls_init]
mov rdx, rax
lea rax, [0x1400470d0]
mov rcx, rax
call sym._pthread_once_raw
mov eax, dword [0x140038650]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 8]
mov dword [rdx + 0x70], eax
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rdx, rbp
mov rax, qword [rbp - 8]
add rax, 0xd0
mov rcx, rax
call sym._setjmp
test eax, eax
jne 0x14002f0ea
mov qword [rbp - 0x10], pe_nt_image_headers64
lea rax, [0x140038660]
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x14002f0b8
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov rcx, rax
call rdx
mov qword [rbp - 0x10], rax
nop
nop
lea rax, [0x140038660]
mov rcx, rax
call sym.pthread_mutex_lock
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call sym._pthread_cleanup_dest
jmp 0x14002f0f9
lea rax, [0x140038660]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov dword [rbp - 0x14], eax
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x14002f135
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 8]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x14002f1a3
mov rax, qword [rbp - 8]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.push_pthread_mem
mov qword [rbp - 8], 0
mov eax, dword [0x140038650]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x14002f1ed
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 8]
mov dword [rax + 0xbc], 1
jmp 0x14002f1ed
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [0x140038660]
mov rcx, rax
call sym.pthread_mutex_unlock
test eax, eax
je 0x14002f1df
mov eax, dword [rbp - 0x14]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__endthreadex]
call rax
nop
Function at 0x1400039d0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov eax, 0x2028
call fcn.1401133c0
sub rsp, rax
mov eax, dword [0x14015e008]
cmp eax, 0xffffffff
jne 0x140003a18
lea rdx, str.debug
lea rcx, str.Direct3D
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetProfileIntA]
mov dword [0x14015e008], eax
cmp dword [rsp + 0x2030], eax
ja 0x140003a85
cmp dword [0x1402f4ec0], 0
jne 0x140003a85
mov r8, qword [rsp + 0x2038]
lea r9, [rsp + 0x2040]
lea rcx, [rsp + 0x20]
mov edx, 0x1000
call fcn.14003f290
lea r9, [rsp + 0x20]
lea r8, str.D3DX:__s_r_n
lea rcx, [rsp + 0x1020]
mov edx, 0x1000
mov byte [rsp + 0x101f], 0
call fcn.140067590
lea rcx, [rsp + 0x1020]
mov byte [rsp + 0x201f], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
add rsp, 0x2028
ret
Function at 0x140003a90
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x178
mov r8, qword [rsp + 0x180]
mov qword [rsp + 0x170], rbx
mov qword [rsp + 0x168], rbp
mov ebp, dword [rsp + 0x188]
mov qword [rsp + 0x160], rsi
mov rsi, qword [rsp + 0x190]
lea rdx, str.Assertion_failure____s__d_:__s
mov r9d, ebp
xor ecx, ecx
mov qword [rsp + 0x158], rdi
mov qword [rsp + 0x20], rsi
call fcn.1400039d0
xor edi, edi
cmp dword [0x1402f4ed0], edi
jne 0x140003bbe
lea rcx, str.kernel32.dll
mov dword [0x1402f4ed0], 1
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x140003b2e
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140003b45
lea rdx, [0x140119d40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402f4ec8], rax
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareMicrosoftDirect3D
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x38], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x140003bb7
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [0x1402f4ec4]
lea rdx, str.D3DX
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140003bb7
cmp dword [rsp + 0x30], 4
je 0x140003bbe
xor eax, eax
jmp 0x140003c73
mov rax, qword [0x1402f4ec8]
test rax, rax
je 0x140003bf6
call rax
test eax, eax
je 0x140003bf6
mov eax, dword [0x1402f4ec4]
test eax, eax
je 0x140003c71
dec eax
je 0x140003bef
dec eax
je 0x140003bef
dec eax
je 0x140003c08
jmp 0x140003c71
mov edi, 1
jmp 0x140003c6b
mov eax, dword [0x1402f4ec4]
test eax, eax
je 0x140003c71
dec eax
je 0x140003c71
dec eax
jne 0x140003be6
mov r9, qword [rsp + 0x180]
lea r8, str._s___d_:_n_nD3DXASSERT__s___n_nDo_you_want_to_invoke_the_debugger___Cancel_will_terminate_the_application
lea rcx, [rsp + 0x50]
mov edx, 0x100
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], ebp
call fcn.140067590
lea r8, str.D3DX_Assertion_Failure
lea rdx, [rsp + 0x50]
mov r9d, 0x2113
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
mov ebx, eax
jne 0x140003c5f
lea rdx, str.D3DX_Assertion_Failure__application_terminated
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FatalAppExitA]
cmp ebx, 6
sete dil
cmp edi, 1
jne 0x140003c71
call qword [sym.imp.KERNEL32.dll_DebugBreak]
mov eax, edi
mov rdi, qword [rsp + 0x158]
mov rsi, qword [rsp + 0x160]
mov rbp, qword [rsp + 0x168]
mov rbx, qword [rsp + 0x170]
add rsp, 0x178
ret
Function at 0x140003ca0
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x68
cmp qword [0x1402f4ee0], 0
mov qword [rsp + 0x58], rdi
mov edi, dword [rsp + 0x70]
mov dword [0x1402f4ec0], edi
jne 0x140003d45
cmp qword [0x1402f4ed8], 0
jne 0x140003d45
lea rcx, [0x140119db8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140003d0a
lea rcx, [0x140119db8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140003d0a
lea rdx, str.DebugSetMute
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402f4ee0], rax
lea rcx, str.d3d9d.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140003d45
lea rcx, str.d3d9d.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140003d45
lea rdx, str.DebugSetMute
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1402f4ed8], rax
mov eax, dword [0x14015e00c]
cmp eax, 0xffffffff
jne 0x140003dfd
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareMicrosoftDirect3D
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x40], 0
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x140003dd4
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x28], rax
lea rax, [0x14015e00c]
lea r9, [rsp + 0x38]
lea rdx, str.D3DXDoNotMute
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0x60]
jne 0x140003dd4
cmp dword [rsp + 0x38], 4
je 0x140003de0
mov dword [0x14015e00c], 0
jmp 0x140003e01
cmp dword [0x14015e00c], 0
je 0x140003e01
mov dword [0x14015e00c], 1
mov rdi, qword [rsp + 0x58]
add rsp, 0x68
ret
test eax, eax
jne 0x140003e21
mov rax, qword [0x1402f4ee0]
test rax, rax
je 0x140003e11
mov ecx, edi
call rax
mov rax, qword [0x1402f4ed8]
test rax, rax
je 0x140003e21
mov ecx, edi
call rax
mov rdi, qword [rsp + 0x58]
add rsp, 0x68
ret
Function at 0x140008910
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov eax, dword [rsp + 0x68]
mov ecx, dword [rsp + 0x70]
mov qword [rsp + 0x40], rbx
mov rbx, qword [rsp + 0x58]
imul eax, ecx
mov qword [rsp + 0x18], r13
mov r13d, eax
add r13, rbx
cmp rbx, r13
jae 0x140008aa5
mov eax, dword [rsp + 0x60]
mov qword [rsp + 0x30], rsi
mov rsi, qword [rsp + 0x50]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
mov qword [rsp + 8], r15
lea rdi, [rbx + rax*4]
mov eax, dword [rsp + 0x78]
mov qword [rsp + 0x38], rbp
mov r15d, ecx
lea r12, [rcx + rcx]
mov qword [rsp + 0x10], r14
nop
nop
nop
cmp rbx, rdi
mov r14, rsi
mov rbp, rbx
jae 0x140008a75
nop
mov r11d, dword [rbp + 4]
mov r9d, dword [rbp]
mov r10d, dword [r15 + rbp]
mov r8d, dword [r15 + rbp + 4]
mov ecx, r9d
mov eax, r11d
shr eax, 2
shr ecx, 2
add rbp, 8
and eax, 0xffc03fc0
and ecx, 0xffc03fc0
add r14, 4
add ecx, eax
mov eax, r10d
shr eax, 2
and eax, 0xffc03fc0
add ecx, eax
mov eax, r8d
shr eax, 2
and eax, 0xffc03fc0
lea edx, [rcx + rax - 0x7fff80]
mov ecx, r10d
shr r10d, 2
and ecx, 0xff00ff
mov eax, r8d
and r10d, 0x3fc03fc0
and eax, 0xff00ff
shr r8d, 2
add ecx, eax
mov eax, r9d
and r8d, 0x3fc03fc0
and eax, 0xff00ff
shr r9d, 2
add r10d, r8d
add ecx, eax
mov eax, r11d
and r9d, 0x3fc03fc0
and eax, 0xff00ff
shr r11d, 2
add r10d, r9d
lea ecx, [rcx + rax + 0x20002]
and r11d, 0x3fc03fc0
shr ecx, 2
lea eax, [r10 + r11 + 0x800080]
xor edx, ecx
and edx, 0xff00ff
xor edx, eax
cmp rbp, rdi
mov dword [r14 - 4], edx
jb 0x1400089a0
mov eax, dword [rsp + 0x78]
add rbx, r12
add rsi, rax
add rdi, r12
cmp rbx, r13
jb 0x140008990
mov r15, qword [rsp + 8]
mov r14, qword [rsp + 0x10]
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov r13, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x48
ret
Function at 0x140008db0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbp
mov rbp, qword [rsp + 0x50]
mov rcx, qword [rbp]
mov rax, qword [rbp + 8]
mov qword [rsp + 0x30], rsi
mov rsi, qword [rax + 0x28]
mov rbx, qword [rcx + 0x28]
mov eax, dword [rcx + 0x8c]
imul eax, dword [rcx + 0x80]
mov qword [rsp + 8], r15
mov r15d, eax
add r15, rbx
cmp rbx, r15
jae 0x140008f3a
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x18], r13
mov qword [rsp + 0x10], r14
nop
nop
nop
nop
mov eax, dword [rcx + 0x88]
mov edi, dword [rcx + 0x80]
mov r14, rsi
lea r12, [rbx + rax*2]
add rdi, rbx
mov r13, rbx
cmp rbx, r12
jae 0x140008f02
movzx r11d, word [rdi + 2]
movzx r8d, word [r13]
movzx r9d, word [rdi]
movzx r10d, word [r13 + 2]
mov ecx, r11d
mov eax, r8d
and eax, 0xf81f
and ecx, 0xf81f
add r13, 4
add ecx, eax
mov eax, r9d
add r14, 2
and eax, 0xf81f
add rdi, 4
add ecx, eax
mov eax, r10d
and eax, 0xf81f
lea edx, [rcx + rax + 0x1002]
mov ecx, r11d
and r11d, 0xf81f
and ecx, 0x7e0
shr edx, 2
mov eax, r8d
and eax, 0x7e0
and r8d, 0xf81f
add ecx, eax
mov eax, r9d
add r11d, r8d
and eax, 0x7e0
and r9d, 0xf81f
add ecx, eax
mov eax, r10d
add r11d, r9d
and eax, 0x7e0
and r10d, 0xf81f
lea ecx, [rcx + rax + 0x40]
lea eax, [r11 + r10 + 0x1002]
shr ecx, 2
shr eax, 2
xor dx, cx
and dx, 0x7e0
xor dx, ax
cmp r13, r12
mov word [r14 - 2], dx
jb 0x140008e42
mov rax, qword [rbp + 8]
mov ecx, dword [rax + 0x80]
add rsi, rcx
mov rcx, qword [rbp]
mov eax, dword [rcx + 0x80]
lea rbx, [rbx + rax*2]
cmp rbx, r15
jb 0x140008e20
mov r14, qword [rsp + 0x10]
mov r13, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r15, qword [rsp + 8]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x48
ret
Function at 0x1400090e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbp
mov rbp, qword [rsp + 0x50]
mov rcx, qword [rbp]
mov rax, qword [rbp + 8]
mov qword [rsp + 0x30], rsi
mov rsi, qword [rax + 0x28]
mov rbx, qword [rcx + 0x28]
mov eax, dword [rcx + 0x8c]
imul eax, dword [rcx + 0x80]
mov qword [rsp + 8], r15
mov r15d, eax
add r15, rbx
cmp rbx, r15
jae 0x14000926d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x18], r13
mov qword [rsp + 0x10], r14
nop
nop
nop
nop
mov eax, dword [rcx + 0x88]
mov edi, dword [rcx + 0x80]
mov r14, rsi
lea r12, [rbx + rax*2]
add rdi, rbx
mov r13, rbx
cmp rbx, r12
jae 0x140009235
movzx r11d, word [rdi + 2]
movzx r8d, word [r13]
movzx r9d, word [rdi]
movzx r10d, word [r13 + 2]
mov ecx, r11d
mov eax, r8d
and eax, 0x83e0
and ecx, 0x83e0
add r13, 4
add ecx, eax
mov eax, r9d
add r14, 2
and eax, 0x83e0
add rdi, 4
add ecx, eax
mov eax, r10d
and eax, 0x83e0
lea edx, [rcx + rax + 0x10040]
mov ecx, r11d
and r11d, 0x83e0
and ecx, 0x7c1f
shr edx, 2
mov eax, r8d
and eax, 0x7c1f
and r8d, 0x83e0
add ecx, eax
mov eax, r9d
add r11d, r8d
and eax, 0x7c1f
and r9d, 0x83e0
add ecx, eax
mov eax, r10d
add r11d, r9d
and eax, 0x7c1f
and r10d, 0x83e0
lea ecx, [rcx + rax + 0x802]
lea eax, [r11 + r10 + 0x10040]
shr ecx, 2
shr eax, 2
xor dx, cx
and dx, 0x7c1f
xor dx, ax
cmp r13, r12
mov word [r14 - 2], dx
jb 0x140009172
mov rax, qword [rbp + 8]
mov ecx, dword [rax + 0x80]
add rsi, rcx
mov rcx, qword [rbp]
mov eax, dword [rcx + 0x80]
lea rbx, [rbx + rax*2]
cmp rbx, r15
jb 0x140009150
mov r14, qword [rsp + 0x10]
mov r13, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r15, qword [rsp + 8]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x48
ret
Function at 0x140009290
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbp
mov rbp, qword [rsp + 0x50]
mov rcx, qword [rbp]
mov rax, qword [rbp + 8]
mov qword [rsp + 0x30], rsi
mov rsi, qword [rax + 0x28]
mov rbx, qword [rcx + 0x28]
mov eax, dword [rcx + 0x8c]
imul eax, dword [rcx + 0x80]
mov qword [rsp + 8], r15
mov r15d, eax
add r15, rbx
cmp rbx, r15
jae 0x14000941d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x18], r13
mov qword [rsp + 0x10], r14
nop
nop
nop
nop
mov eax, dword [rcx + 0x88]
mov edi, dword [rcx + 0x80]
mov r14, rsi
lea r12, [rbx + rax*2]
add rdi, rbx
mov r13, rbx
cmp rbx, r12
jae 0x1400093e5
movzx r11d, word [rdi + 2]
movzx r8d, word [r13]
movzx r9d, word [rdi]
movzx r10d, word [r13 + 2]
mov ecx, r11d
mov eax, r8d
and eax, 0xf0f0
and ecx, 0xf0f0
add r13, 4
add ecx, eax
mov eax, r9d
add r14, 2
and eax, 0xf0f0
add rdi, 4
add ecx, eax
mov eax, r10d
and eax, 0xf0f0
lea edx, [rcx + rax + 0x2020]
mov ecx, r11d
and r11d, 0xf0f0
and ecx, 0xf0f
shr edx, 2
mov eax, r8d
and eax, 0xf0f
and r8d, 0xf0f0
add ecx, eax
mov eax, r9d
add r11d, r8d
and eax, 0xf0f
and r9d, 0xf0f0
add ecx, eax
mov eax, r10d
add r11d, r9d
and eax, 0xf0f
and r10d, 0xf0f0
lea ecx, [rcx + rax + 0x202]
lea eax, [r11 + r10 + 0x2020]
shr ecx, 2
shr eax, 2
xor dx, cx
and dx, 0xf0f
xor dx, ax
cmp r13, r12
mov word [r14 - 2], dx
jb 0x140009322
mov rax, qword [rbp + 8]
mov ecx, dword [rax + 0x80]
add rsi, rcx
mov rcx, qword [rbp]
mov eax, dword [rcx + 0x80]
lea rbx, [rbx + rax*2]
cmp rbx, r15
jb 0x140009300
mov r14, qword [rsp + 0x10]
mov r13, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r15, qword [rsp + 8]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x48
ret
Function at 0x140009440
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x20], r12
mov r12, qword [rsp + 0x50]
mov qword [rsp + 8], r15
mov rcx, qword [r12]
mov rax, qword [r12 + 8]
mov rbp, qword [rax + 0x28]
mov rbx, qword [rcx + 0x28]
mov eax, dword [rcx + 0x8c]
imul eax, dword [rcx + 0x80]
mov r15d, eax
add r15, rbx
cmp rbx, r15
jae 0x1400095b5
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x18], r13
mov qword [rsp + 0x10], r14
nop
nop
nop
nop
mov edi, dword [rcx + 0x88]
mov esi, dword [rcx + 0x80]
mov r14, rbp
add rdi, rbx
add rsi, rbx
mov r13, rbx
cmp rbx, rdi
jae 0x14000957c
movzx r11d, byte [rsi + 1]
movzx r8d, byte [r13]
movzx r9d, byte [rsi]
movzx r10d, byte [r13 + 1]
mov ecx, r11d
mov eax, r8d
and eax, 0xe3
and ecx, 0xe3
add r13, 2
add ecx, eax
mov eax, r9d
inc r14
and eax, 0xe3
add rsi, 2
add ecx, eax
mov eax, r10d
and eax, 0xe3
lea edx, [rcx + rax + 0x42]
mov ecx, r11d
and r11d, 0xe3
and ecx, 0x1c
shr edx, 2
mov eax, r8d
and eax, 0x1c
and r8d, 0xe3
add ecx, eax
mov eax, r9d
add r11d, r8d
and eax, 0x1c
and r9d, 0xe3
add ecx, eax
mov eax, r10d
add r11d, r9d
and eax, 0x1c
and r10d, 0xe3
lea ecx, [rcx + rax + 8]
lea eax, [r11 + r10 + 0x42]
shr ecx, 2
shr eax, 2
xor dl, cl
and dl, 0x1c
xor dl, al
cmp r13, rdi
mov byte [r14 - 1], dl
jb 0x1400094d1
mov rax, qword [r12 + 8]
mov ecx, dword [rax + 0x80]
add rbp, rcx
mov rcx, qword [r12]
mov eax, dword [rcx + 0x80]
lea rbx, [rbx + rax*2]
cmp rbx, r15
jb 0x1400094b0
mov r14, qword [rsp + 0x10]
mov r13, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov r15, qword [rsp + 8]
mov r12, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x48
ret
Function at 0x1400096b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r12
mov r12, qword [rsp + 0x60]
mov rax, qword [r12 + 8]
mov rcx, qword [r12]
mov rbp, qword [rax + 0x28]
mov eax, dword [rcx + 0x8c]
mov rdi, qword [rcx + 0x28]
imul eax, dword [rcx + 0x80]
mov eax, eax
add rax, rdi
cmp rdi, rax
mov qword [rsp], rax
jae 0x140009840
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x18], r15
nop
nop
nop
mov eax, dword [rcx + 0x88]
mov esi, dword [rcx + 0x80]
mov r15, rbp
lea r13, [rdi + rax*2]
add rsi, rdi
mov r14, rdi
cmp rdi, r13
jae 0x140009801
movzx ebx, word [rsi + 2]
movzx r9d, word [r14]
movzx r10d, word [rsi]
movzx r11d, word [r14 + 2]
mov ecx, ebx
mov eax, r9d
and eax, 0xe3
and ecx, 0xe3
add r14, 4
add ecx, eax
mov eax, r10d
add r15, 2
and eax, 0xe3
add rsi, 4
add ecx, eax
mov eax, r11d
and eax, 0xe3
lea r8d, [rcx + rax + 0x42]
mov ecx, ebx
and ebx, 0xff1c
and ecx, 0xff1c
shr r8d, 2
mov eax, r9d
and eax, 0xff1c
and r9d, 0xff1c
add ecx, eax
mov eax, r10d
add ebx, r9d
and eax, 0xff1c
and r10d, 0xff1c
add ecx, eax
mov eax, r11d
add ebx, r10d
and eax, 0xff1c
and r11d, 0xff1c
lea ecx, [rcx + rax + 0x208]
lea eax, [rbx + r11 + 0x208]
shr ecx, 2
shr eax, 2
xor r8b, cl
and r8w, 0xe3
xor r8w, ax
cmp r14, r13
mov word [r15 - 2], r8w
jb 0x140009742
mov rax, qword [r12 + 8]
mov ecx, dword [rax + 0x80]
add rbp, rcx
mov rcx, qword [r12]
mov eax, dword [rcx + 0x80]
lea rdi, [rdi + rax*2]
cmp rdi, qword [rsp]
jb 0x140009720
mov r15, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x58
ret
Function at 0x1400099e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbp
mov rbp, qword [rsp + 0x50]
mov rcx, qword [rbp]
mov rax, qword [rbp + 8]
mov qword [rsp + 0x30], rsi
mov rsi, qword [rax + 0x28]
mov rbx, qword [rcx + 0x28]
mov eax, dword [rcx + 0x8c]
imul eax, dword [rcx + 0x80]
mov qword [rsp + 8], r15
mov r15d, eax
add r15, rbx
cmp rbx, r15
jae 0x140009b56
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x18], r13
mov qword [rsp + 0x10], r14
nop
nop
nop
nop
mov eax, dword [rcx + 0x88]
mov edi, dword [rcx + 0x80]
mov r14, rsi
lea r12, [rbx + rax*2]
add rdi, rbx
mov r13, rbx
cmp rbx, r12
jae 0x140009b1e
movzx r11d, word [rdi + 2]
movzx r8d, word [r13]
movzx r9d, word [rdi]
movzx r10d, word [r13 + 2]
movzx ecx, r11b
movzx eax, r8b
add ecx, eax
movzx eax, r9b
add r13, 4
add ecx, eax
movzx eax, r10b
add r14, 2
lea edx, [rcx + rax + 2]
mov ecx, r11d
and r11d, 0xff00
and ecx, 0xff00
mov eax, r8d
and r8d, 0xff00
and eax, 0xff00
add r11d, r8d
shr edx, 2
add ecx, eax
mov eax, r9d
and r9d, 0xff00
and eax, 0xff00
add r11d, r9d
add rdi, 4
add ecx, eax
mov eax, r10d
and r10d, 0xff00
and eax, 0xff00
lea ecx, [rcx + rax + 0x200]
lea eax, [r11 + r10 + 0x200]
shr ecx, 2
shr eax, 2
xor dl, cl
movzx ecx, dl
xor cx, ax
cmp r13, r12
mov word [r14 - 2], cx
jb 0x140009a72
mov rax, qword [rbp + 8]
mov ecx, dword [rax + 0x80]
add rsi, rcx
mov rcx, qword [rbp]
mov eax, dword [rcx + 0x80]
lea rbx, [rbx + rax*2]
cmp rbx, r15
jb 0x140009a50
mov r14, qword [rsp + 0x10]
mov r13, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov r15, qword [rsp + 8]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x48
ret
Function at 0x140009b80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x20], r12
mov r12, qword [rsp + 0x50]
mov qword [rsp + 8], r15
mov rcx, qword [r12]
mov rax, qword [r12 + 8]
mov rbp, qword [rax + 0x28]
mov rbx, qword [rcx + 0x28]
mov eax, dword [rcx + 0x8c]
imul eax, dword [rcx + 0x80]
mov r15d, eax
add r15, rbx
cmp rbx, r15
jae 0x140009cf5
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x18], r13
mov qword [rsp + 0x10], r14
nop
nop
nop
nop
mov edi, dword [rcx + 0x88]
mov esi, dword [rcx + 0x80]
mov r14, rbp
add rdi, rbx
add rsi, rbx
mov r13, rbx
cmp rbx, rdi
jae 0x140009cbc
movzx r11d, byte [rsi + 1]
movzx r8d, byte [r13]
movzx r9d, byte [rsi]
movzx r10d, byte [r13 + 1]
mov ecx, r11d
mov eax, r8d
and eax, 0xf0
and ecx, 0xf0
add r13, 2
add ecx, eax
mov eax, r9d
inc r14
and eax, 0xf0
add rsi, 2
add ecx, eax
mov eax, r10d
and eax, 0xf0
lea edx, [rcx + rax + 0x20]
mov ecx, r11d
and r11d, 0xf0
and ecx, 0xf
shr edx, 2
mov eax, r8d
and eax, 0xf
and r8d, 0xf0
add ecx, eax
mov eax, r9d
add r11d, r8d
and eax, 0xf
and r9d, 0xf0
add ecx, eax
mov eax, r10d
add r11d, r9d
and eax, 0xf
and r10d, 0xf0
lea ecx, [rcx + rax + 2]
lea eax, [r11 + r10 + 0x20]
shr ecx, 2
shr eax, 2
xor dl, cl
and dl, 0xf
xor dl, al
cmp r13, rdi
mov byte [r14 - 1], dl
jb 0x140009c11
mov rax, qword [r12 + 8]
mov ecx, dword [rax + 0x80]
add rbp, rcx
mov rcx, qword [r12]
mov eax, dword [rcx + 0x80]
lea rbx, [rbx + rax*2]
cmp rbx, r15
jb 0x140009bf0
mov r14, qword [rsp + 0x10]
mov r13, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov r15, qword [rsp + 8]
mov r12, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x48
ret