joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14019d5e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov rax, qword [rcx]
mov rbx, rcx
mov r11d, edx
mov esi, r8d
movsxd rcx, dword [rax + 0x10]
mov edi, dword [rbx + 0x10]
mov eax, ecx
sub r11d, dword [rbx + 0x14]
imul eax, edx
imul edi, r9d
movsxd r10, eax
add r10, qword [rbx + 0x20]
sar edi, 8
cmp edi, 0xfe
jge 0x14019d723
mov qword [rsp + 0x10], rbp
mov rbp, rcx
nop dword [rax]
mov rcx, qword [rbx + 8]
mov eax, r11d
cdq
inc r11d
dec esi
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rcx, eax
mov rax, qword [rbx + 0x28]
movzx edx, byte [rcx + rax]
mov ecx, 0x100
mov r9d, edx
shl r9d, 0x10
or r9d, edx
mov edx, 0x100
imul r9d, edi
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rbp
test esi, esi
jg 0x14019d630
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
ret
mov rdi, rcx
nop word [rax + rax]
mov rcx, qword [rbx + 8]
mov eax, r11d
cdq
inc r11d
dec esi
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rcx, eax
mov rax, qword [rbx + 0x28]
movzx edx, byte [rcx + rax]
mov ecx, 0x100
mov r9d, edx
shl r9d, 0x10
or r9d, edx
mov edx, 0x100
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rdi
test esi, esi
jg 0x14019d730
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
ret
Function at 0x14019d810
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
mov ebp, edx
mov edi, r8d
mov rsi, rcx
movsxd rdx, dword [r9 + 0x10]
mov eax, edx
imul eax, ebp
sub ebp, dword [rcx + 0x14]
movsxd rbx, eax
add rbx, qword [rcx + 0x20]
cmp dword [rcx + 0x10], 0xfe
jge 0x14019d95c
mov qword [rsp + 0x48], r14
mov r14, rdx
nop
mov rax, qword [rsi + 8]
mov edx, ebp
mov r9d, dword [rbx]
inc ebp
dec edi
mov ecx, dword [rax + 0x10]
imul ecx, edx
movsxd rdx, ecx
mov ecx, 0x100
add rdx, qword [rsi + 0x28]
movzx r11d, byte [rdx + 1]
movzx r10d, byte [rdx + 2]
or r11d, 0xff0000
imul r11d, dword [rsi + 0x10]
shl r10d, 0x10
shr r11d, 8
and r11d, 0xff00ff
mov eax, r11d
shr eax, 0x10
sub ecx, eax
movzx eax, byte [rdx]
or r10d, eax
mov edx, 0x100
imul r10d, dword [rsi + 0x10]
mov eax, r9d
and eax, 0xff00ff
shr r9d, 8
imul eax, ecx
and r9d, 0xff00ff
imul r9d, ecx
mov ecx, 0x100
shr r10d, 8
and r10d, 0xff00ff
shr eax, 8
and eax, 0xff00ff
shr r9d, 8
add r10d, eax
and r9d, 0xff00ff
add r11d, r9d
mov eax, r11d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r11d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r10d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r11d
or ecx, r10d
shr eax, 8
xor edx, ecx
shl r11d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r11d
xor edx, ecx
mov dword [rbx], edx
add rbx, r14
test edi, edi
jg 0x14019d850
mov r14, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov r8, qword [rcx + 8]
movsxd rcx, dword [r8 + 0x10]
mov eax, ecx
imul eax, ebp
cdqe
add rax, qword [rsi + 0x28]
cmp edx, ecx
jne 0x14019d99e
cmp dword [r8 + 8], 1
jne 0x14019d99e
cmp dword [r9 + 8], 1
jne 0x14019d99e
imul ecx, edi
mov rdx, rax
movsxd r8, ecx
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
jmp sub.VCRUNTIME140.dll_memcpy
mov r8, rdx
mov r9, rcx
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [rax]
dec edi
movzx edx, byte [rax + 2]
add rax, r9
shl edx, 8
mov word [rsp + 0x40], cx
movzx ecx, byte [rsp + 0x41]
or edx, ecx
movzx ecx, byte [rsp + 0x40]
shl edx, 8
or edx, ecx
or edx, 0xff000000
mov dword [rbx], edx
add rbx, r8
test edi, edi
jg 0x14019d9b0
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x14019da00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov r10, qword [rcx]
mov ebp, edx
mov esi, dword [rcx + 0x10]
mov ebx, r8d
imul esi, r9d
mov rdi, rcx
movsxd rdx, dword [r10 + 0x10]
mov eax, edx
imul eax, ebp
sub ebp, dword [rcx + 0x14]
sar esi, 8
movsxd r11, eax
add r11, qword [rcx + 0x20]
cmp esi, 0xfe
jge 0x14019db5b
mov qword [rsp + 0x48], r14
mov r14, rdx
nop dword [rax + rax]
mov rax, qword [rdi + 8]
mov edx, ebp
mov r8d, dword [r11]
inc ebp
dec ebx
mov ecx, dword [rax + 0x10]
imul ecx, edx
movsxd rdx, ecx
mov ecx, 0x100
add rdx, qword [rdi + 0x28]
movzx r10d, byte [rdx + 1]
movzx r9d, byte [rdx + 2]
or r10d, 0xff0000
shl r9d, 0x10
imul r10d, esi
shr r10d, 8
and r10d, 0xff00ff
mov eax, r10d
shr eax, 0x10
sub ecx, eax
movzx eax, byte [rdx]
or r9d, eax
mov edx, 0x100
mov eax, r8d
imul r9d, esi
and eax, 0xff00ff
shr r8d, 8
imul eax, ecx
and r8d, 0xff00ff
imul r8d, ecx
mov ecx, 0x100
shr r9d, 8
and r9d, 0xff00ff
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r10d, r8d
mov eax, r10d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r10d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r10d
or ecx, r9d
shr eax, 8
xor edx, ecx
shl r10d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r10d
xor edx, ecx
mov dword [r11], edx
add r11, r14
test ebx, ebx
jg 0x14019da50
mov r14, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov r8, qword [rcx + 8]
movsxd rcx, dword [r8 + 0x10]
mov eax, ecx
imul eax, ebp
cdqe
add rax, qword [rdi + 0x28]
cmp edx, ecx
jne 0x14019db9d
cmp dword [r8 + 8], 1
jne 0x14019db9d
cmp dword [r10 + 8], 1
jne 0x14019db9d
imul ecx, ebx
mov rdx, rax
movsxd r8, ecx
mov rcx, r11
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
jmp sub.VCRUNTIME140.dll_memcpy
mov r8, rdx
mov r9, rcx
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rax]
dec ebx
movzx edx, byte [rax + 2]
add rax, r9
shl edx, 8
mov word [rsp + 0x40], cx
movzx ecx, byte [rsp + 0x41]
or edx, ecx
movzx ecx, byte [rsp + 0x40]
shl edx, 8
or edx, ecx
or edx, 0xff000000
mov dword [r11], edx
add r11, r8
test ebx, ebx
jg 0x14019dbb0
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x14019dc00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
mov rax, qword [rcx]
mov rsi, rcx
mov r9d, edx
mov ebp, r8d
movsxd rcx, dword [rax + 0x10]
sub r9d, dword [rsi + 0x14]
mov eax, ecx
imul eax, edx
movsxd rdi, eax
add rdi, qword [rsi + 0x20]
cmp dword [rsi + 0x10], 0xfe
jge 0x14019dd48
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], r14
mov r14, rcx
mov rcx, qword [rsi + 8]
mov eax, r9d
mov r10d, dword [rdi]
cdq
inc r9d
dec ebp
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
mov edx, 0x100
movsxd rcx, eax
add rcx, qword [rsi + 0x28]
movzx ebx, byte [rcx + 1]
movzx r11d, byte [rcx + 2]
or ebx, 0xff0000
imul ebx, dword [rsi + 0x10]
shl r11d, 0x10
shr ebx, 8
and ebx, 0xff00ff
mov eax, ebx
shr eax, 0x10
sub edx, eax
movzx eax, byte [rcx]
or r11d, eax
mov ecx, 0x100
imul r11d, dword [rsi + 0x10]
mov eax, r10d
and eax, 0xff00ff
shr r10d, 8
imul eax, edx
and r10d, 0xff00ff
imul r10d, edx
mov edx, 0x100
shr r11d, 8
and r11d, 0xff00ff
shr eax, 8
and eax, 0xff00ff
shr r10d, 8
add r11d, eax
and r10d, 0xff00ff
add ebx, r10d
mov eax, ebx
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, ebx
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r11d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, ebx
or ecx, r11d
shr eax, 8
xor edx, ecx
shl ebx, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, ebx
xor edx, ecx
mov dword [rdi], edx
add rdi, r14
test ebp, ebp
jg 0x14019dc41
mov r14, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x30]
pop rdi
pop rsi
ret
mov r8, rcx
nop dword [rax + rax]
mov rcx, qword [rsi + 8]
mov eax, r9d
cdq
inc r9d
dec ebp
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rdx, eax
add rdx, qword [rsi + 0x28]
movzx eax, word [rdx]
movzx ecx, byte [rdx + 2]
shl ecx, 8
mov word [rsp + 0x18], ax
movzx eax, byte [rsp + 0x19]
or ecx, eax
movzx eax, byte [rsp + 0x18]
shl ecx, 8
or ecx, eax
or ecx, 0xff000000
mov dword [rdi], ecx
add rdi, r8
test ebp, ebp
jg 0x14019dd50
mov rbp, qword [rsp + 0x30]
pop rdi
pop rsi
ret
Function at 0x14019ddb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
mov rax, qword [rcx]
mov rdi, rcx
mov r10d, edx
mov esi, r8d
movsxd rcx, dword [rax + 0x10]
mov ebp, dword [rdi + 0x10]
mov eax, ecx
sub r10d, dword [rdi + 0x14]
imul eax, edx
imul ebp, r9d
movsxd rbx, eax
add rbx, qword [rdi + 0x20]
sar ebp, 8
cmp ebp, 0xfe
jge 0x14019df10
mov qword [rsp + 0x20], r14
mov r14, rcx
nop word [rax + rax]
mov rcx, qword [rdi + 8]
mov eax, r10d
mov r8d, dword [rbx]
cdq
inc r10d
dec esi
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
mov edx, 0x100
movsxd rcx, eax
add rcx, qword [rdi + 0x28]
movzx r11d, byte [rcx + 1]
movzx r9d, byte [rcx + 2]
or r11d, 0xff0000
shl r9d, 0x10
imul r11d, ebp
shr r11d, 8
and r11d, 0xff00ff
mov eax, r11d
shr eax, 0x10
sub edx, eax
movzx eax, byte [rcx]
or r9d, eax
mov ecx, 0x100
mov eax, r8d
imul r9d, ebp
and eax, 0xff00ff
shr r8d, 8
imul eax, edx
and r8d, 0xff00ff
imul r8d, edx
mov edx, 0x100
shr r9d, 8
and r9d, 0xff00ff
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r11d, r8d
mov eax, r11d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r11d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r11d
or ecx, r9d
shr eax, 8
xor edx, ecx
shl r11d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r11d
xor edx, ecx
mov dword [rbx], edx
add rbx, r14
test esi, esi
jg 0x14019de00
mov r14, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
pop rdi
pop rsi
ret
mov r8, rcx
mov rcx, qword [rdi + 8]
mov eax, r10d
cdq
inc r10d
dec esi
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rdx, eax
add rdx, qword [rdi + 0x28]
movzx eax, word [rdx]
movzx ecx, byte [rdx + 2]
shl ecx, 8
mov word [rsp + 0x18], ax
movzx eax, byte [rsp + 0x19]
or ecx, eax
movzx eax, byte [rsp + 0x18]
shl ecx, 8
or ecx, eax
or ecx, 0xff000000
mov dword [rbx], ecx
add rbx, r8
test esi, esi
jg 0x14019df13
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
pop rdi
pop rsi
ret
Function at 0x14019df70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov rax, qword [rcx]
mov rbx, rcx
mov edi, edx
mov esi, r8d
movsxd rcx, dword [rax + 0x10]
sub edi, dword [rbx + 0x14]
mov eax, ecx
imul eax, edx
movsxd r11, eax
add r11, qword [rbx + 0x20]
cmp dword [rbx + 0x10], 0xfe
jge 0x14019e0b8
mov qword [rsp + 0x10], rbp
mov rbp, rcx
nop
mov rcx, qword [rbx + 8]
mov eax, edi
cdq
inc edi
dec esi
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
mov edx, dword [r11]
movsxd rcx, eax
mov rax, qword [rbx + 0x28]
mov r9d, dword [rcx + rax]
mov r10d, r9d
shr r10d, 8
and r9d, 0xff00ff
imul r9d, dword [rbx + 0x10]
and r10d, 0xff00ff
imul r10d, dword [rbx + 0x10]
mov ecx, 0x100
shr r9d, 8
shr r10d, 8
and r9d, 0xff00ff
and r10d, 0xff00ff
mov eax, r10d
shr eax, 0x10
sub ecx, eax
mov eax, edx
and eax, 0xff00ff
shr edx, 8
imul eax, ecx
and edx, 0xff00ff
imul edx, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr edx, 8
add r9d, eax
and edx, 0xff00ff
add r10d, edx
mov edx, 0x100
mov eax, r10d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r10d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r10d
or ecx, r9d
shr eax, 8
xor edx, ecx
shl r10d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r10d
xor edx, ecx
mov dword [r11], edx
add r11, rbp
test esi, esi
jg 0x14019dfb0
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
ret
mov r10, rcx
nop dword [rax + rax]
mov rcx, qword [rbx + 8]
mov eax, edi
cdq
inc edi
dec esi
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rcx, eax
mov rax, qword [rbx + 0x28]
mov edx, dword [rcx + rax]
mov r9d, edx
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
mov ecx, 0x100
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r11]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r11], edx
add r11, r10
test esi, esi
jg 0x14019e0c0
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
ret
Function at 0x14019e1b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov rax, qword [rcx]
mov rbx, rcx
mov r11d, edx
mov esi, r8d
movsxd rcx, dword [rax + 0x10]
mov edi, dword [rbx + 0x10]
mov eax, ecx
sub r11d, dword [rbx + 0x14]
imul eax, edx
imul edi, r9d
movsxd r10, eax
add r10, qword [rbx + 0x20]
sar edi, 8
cmp edi, 0xfe
jge 0x14019e308
mov qword [rsp + 0x10], rbp
mov rbp, rcx
nop dword [rax]
mov rcx, qword [rbx + 8]
mov eax, r11d
cdq
inc r11d
dec esi
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rcx, eax
mov rax, qword [rbx + 0x28]
mov edx, dword [rcx + rax]
mov r9d, edx
and edx, 0xff00ff
shr r9d, 8
imul edx, edi
and r9d, 0xff00ff
imul r9d, edi
mov ecx, 0x100
shr edx, 8
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rbp
test esi, esi
jg 0x14019e200
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
ret
mov rdi, rcx
nop dword [rax + rax]
mov rcx, qword [rbx + 8]
mov eax, r11d
cdq
inc r11d
dec esi
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rcx, eax
mov rax, qword [rbx + 0x28]
mov edx, dword [rcx + rax]
mov r9d, edx
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
mov ecx, 0x100
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rdi
test esi, esi
jg 0x14019e310
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
ret
Function at 0x14019e520
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movsxd rsi, r8d
mov r14d, r9d
mov ebp, edx
mov rdi, rcx
cmp esi, dword [rcx + 0x80]
jle 0x14019e570
mov qword [rcx + 0x80], rsi
mov rcx, qword [rcx + 0x78]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsi*4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rdi + 0x78], rax
mov rbx, qword [rdi + 0x78]
mov r9d, esi
mov rdx, rbx
mov r8d, ebp
mov rcx, rdi
call fcn.1401873e0
mov rax, qword [rdi + 0x48]
mov r11d, dword [rdi + 0x58]
imul r11d, r14d
movsxd rcx, dword [rax + 0x10]
mov eax, ecx
imul eax, ebp
sar r11d, 8
movsxd r10, eax
add r10, qword [rdi + 0x70]
cmp r11d, 0xfe
jge 0x14019e6a5
mov rdi, rcx
nop word [rax + rax]
mov edx, dword [rbx]
lea rbx, [rbx + 4]
mov r9d, edx
mov ecx, 0x100
and edx, 0xff00ff
shr r9d, 8
imul edx, r11d
and r9d, 0xff00ff
imul r9d, r11d
dec esi
shr edx, 8
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rdi
test esi, esi
jg 0x14019e5c0
jmp 0x14019e774
mov r11, rcx
nop dword [rax + rax]
mov edx, dword [rbx]
lea rbx, [rbx + 4]
mov r9d, edx
mov ecx, 0x100
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
dec esi
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, r11
test esi, esi
jg 0x14019e6b0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14019e790
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov r9, qword [rcx]
mov ebp, edx
mov esi, r8d
mov rdi, rcx
movsxd rdx, dword [r9 + 0x10]
mov eax, edx
imul eax, ebp
sub ebp, dword [rcx + 0x14]
movsxd rbx, eax
add rbx, qword [rcx + 0x20]
cmp dword [rcx + 0x10], 0xfe
jge 0x14019e8e0
mov qword [rsp + 0x30], r14
mov r14, rdx
nop word [rax + rax]
mov rax, qword [rdi + 8]
mov edx, ebp
inc ebp
dec esi
mov ecx, dword [rax + 0x10]
mov rax, qword [rdi + 0x28]
imul ecx, edx
movsxd rdx, ecx
mov ecx, 0x100
mov r8d, dword [rdx + rax]
mov r11d, r8d
shr r11d, 8
and r8d, 0xff00ff
imul r8d, dword [rdi + 0x10]
and r11d, 0xff00ff
imul r11d, dword [rdi + 0x10]
mov edx, 0x100
shr r8d, 8
shr r11d, 8
and r8d, 0xff00ff
and r11d, 0xff00ff
mov eax, r11d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r10d, eax
shr eax, 8
and eax, 0xff00ff
and r10d, 0xff00ff
imul eax, ecx
imul r10d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r10d, 8
add r11d, eax
and r10d, 0xff00ff
add r10d, r8d
mov eax, r11d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r11d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r10d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r11d
or ecx, r10d
shr eax, 8
xor edx, ecx
shl r11d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r11d
xor edx, ecx
mov dword [rbx], edx
add rbx, r14
test esi, esi
jg 0x14019e7e0
mov r14, qword [rsp + 0x30]
jmp 0x14019e9e4
mov r8, qword [rcx + 8]
movsxd rcx, dword [r8 + 0x10]
mov eax, ecx
imul eax, ebp
movsxd r10, eax
add r10, qword [rdi + 0x28]
cmp edx, ecx
jne 0x14019e91c
cmp dword [r8 + 8], 1
jne 0x14019e91c
cmp dword [r9 + 8], 1
jne 0x14019e91c
imul ecx, esi
mov rdx, r10
movsxd r8, ecx
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14019e9e4
mov r11, rdx
mov rdi, rcx
mov edx, dword [r10]
mov ecx, 0x100
mov r9d, edx
add r10, rdi
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
dec esi
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, r11
test esi, esi
jg 0x14019e922
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret