joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140043c60
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140043c78
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x140043c80
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140043c90
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x140043cdd
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x140043cd4
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x140043cdf
add rax, 0x28
cmp rax, r9
jne 0x140043cc0
xor eax, eax
ret

Function at 0x140043ce0
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x140043d70
mov rdx, qword [0x1400bb530]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x140043d5e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x140043d5e
cmp word [rax + 0x18], 0x20b
jne 0x140043d5e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x140043d70
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x140043d49
add rbx, 0x28
cmp rbx, rdi
je 0x140043d70
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x140043d40
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x140043d80
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400bb530]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140043da0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140043da8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140043da0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x140043dfd
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140043df4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x140043da0
add rax, 0x28
cmp rax, r9
jne 0x140043de0
xor eax, eax
ret

Function at 0x140043e00
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400bb530]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x140043e1f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140043e28
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x140043e1f
movzx ecx, word [rax + 6]
mov eax, ecx
ret
Function at 0x140043e40
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x1400bb530]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x140043e60
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x140043e68
ret
cmp word [rdx + 0x18], 0x20b
jne 0x140043e60
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x140043eb0
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x140043ea7
test rcx, rcx
je 0x140043e60
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x140043e98
xor eax, eax
ret

Function at 0x140043ec0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1400bb530]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x140043edf
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140043ee8
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140043f00
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1400bb530]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140043f20
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140043f28
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140043f20
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x140043f20
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x140043f74
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x140043f80
add rdx, 0x28
cmp rdx, r9
jne 0x140043f60
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x140043f90
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x1400bb530]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x140043fb2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140043fc0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140043fb2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x140043fb2
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x140043fb2
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x140044015
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140044028
add rdx, 0x28
cmp r10, rdx
jne 0x140044000
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140044037
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140044047
mov edx, dword [rax + 0xc]
test edx, edx
je 0x14004401e
test ecx, ecx
jg 0x140044030
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140003570
Capabilities:
Get socket status

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [rcx]
lea rdi, [r11 + 0x18]
mov qword [rsp + 0x68], rax
lea rsi, [rsp + 0x60]
mov r9d, edx
mov dword [rsp + 0x60], 1
mov ecx, r8d
lea rbp, [rsp + 0x60]
movabs rax, 0x20c49ba5e353f7cf
imul r8
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3e8
mov dword [r11 + 0x18], edx
sub ecx, eax
imul eax, ecx, 0x3e8
mov dword [r11 + 0x1c], eax
xor eax, eax
test r8, r8
cmovs rdi, rax
cmp r9d, 1
mov qword [rsp + 0x20], rdi
cmovne rsi, rax
test r9d, r9d
mov r8, rsi
cmovne rbp, rax
xor r9d, r9d
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14000363b
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
jne 0x140003641
xor r9d, r9d
mov qword [rsp + 0x20], rdi
mov r8, rsi
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
mov ebx, eax
cmp eax, 0xffffffff
je 0x140003611
test ebx, ebx
je 0x140003661
jmp 0x140003648
cmp ebx, 0xffffffff
je 0x140003684
jmp 0x14000363b
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
lea rdx, str.Request_timed_out
lea rcx, [rsp + 0x30]
call fcn.1400036d0
lea rdx, [0x14009e468]
lea rcx, [rsp + 0x30]
call fcn.1400479a8
int3
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edx, eax
lea r9, str.Failed_to_select_socket
lea r8, [0x1400a0f28]
lea rcx, [rsp + 0x30]
call fcn.140001b60
lea rdx, [0x14009e098]
lea rcx, [rsp + 0x30]
call fcn.1400479a8
int3
Function at 0x140009040
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r14
lea rbp, [rsp - 0x4f]
sub rsp, 0x88
movdqa xmm1, xmmword [str.Z_t5_.____]
mov r8b, 0x29
movd ecx, xmm1
movzx r9d, r8b
movdqa xmm2, xmmword [0x140090170]
movdqa xmm0, xmm1
movdqu xmmword [rbp + 0x13], xmm2
xor byte [rbp + 0x14], cl
xor r8b, cl
xor byte [rbp + 0x15], cl
xor r9b, cl
xor byte [rbp + 0x16], cl
mov dl, 0x3f
xor byte [rbp + 0x17], cl
xor dl, cl
xor byte [rbp + 0x18], cl
xor byte [rbp + 0x19], cl
xor byte [rbp + 0x1a], cl
xor byte [rbp + 0x1b], cl
xor byte [rbp + 0x1c], cl
xor byte [rbp + 0x1d], cl
xor byte [rbp + 0x1e], cl
xor byte [rbp + 0x1f], cl
xor byte [rbp + 0x20], cl
xor byte [rbp + 0x21], cl
xor byte [rbp + 0x22], cl
movdqu xmmword [rbp + 3], xmm1
xor byte [rbp + 5], cl
xor byte [rbp + 6], cl
xor byte [rbp + 7], cl
xor byte [rbp + 8], cl
xor byte [rbp + 9], cl
xor byte [rbp + 0xa], cl
xor byte [rbp + 0xb], cl
xor byte [rbp + 0xc], cl
xor byte [rbp + 0xd], cl
xor byte [rbp + 0xe], cl
xor byte [rbp + 0xf], cl
xor byte [rbp + 0x10], cl
xor byte [rbp + 0x11], cl
xor byte [rbp + 0x12], cl
psrldq xmm0, 1
movd eax, xmm0
mov byte [rbp + 0x23], dl
lea rdx, [rbp + 4]
mov byte [rbp + 0x24], r8b
xor r8d, r8d
xor al, cl
mov byte [rbp + 0x25], r9b
mov byte [rbp + 4], al
mov r9d, 0xf003f
movd eax, xmm2
mov byte [rbp + 0x26], 0
xor al, cl
mov rcx, 0xffffffff80000001
mov byte [rbp + 0x13], al
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140009228
mov qword [rsp + 0x80], rbx
mov r10b, 0x55
mov qword [rsp + 0x78], rsi
mov al, 0x71
xor al, 0x30
mov qword [rsp + 0x70], rdi
mov byte [rbp - 8], al
movzx edi, r10b
mov cl, 0x53
mov qword [rsp + 0x68], r15
xor cl, 0x30
mov dword [rbp + 0x77], 4
mov dl, 0x44
mov byte [rbp - 7], cl
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp + 0x6f]
xor dl, 0x30
mov qword [rsp + 0x28], rax
mov r8b, 0x59
mov byte [rbp - 6], dl
xor r8b, 0x30
mov dword [rbp + 0x6f], 4
mov r9b, 0x46
mov byte [rbp - 5], r8b
xor r9b, 0x30
mov byte [rbp - 9], 0x30
mov r11b, 0x65
mov byte [rbp - 4], r9b
lea rax, [rbp + 0x67]
xor r14d, r14d
xor r10b, 0x30
mov qword [rsp + 0x20], rax
xor r11b, 0x30
mov dword [rbp + 0x67], r14d
mov bl, 0x43
mov byte [rbp - 3], r10b
mov sil, 0x42
mov byte [rbp - 2], r11b
xor bl, 0x30
mov byte [rbp + 2], r14b
xor dil, 0x30
mov byte [rbp - 1], bl
xor sil, 0x30
mov byte [rbp], dil
lea r9, [rbp + 0x77]
mov byte [rbp + 1], sil
xor r8d, r8d
lea rdx, [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r15, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
test eax, eax
jne 0x140009228
mov eax, dword [rbp + 0x67]
test eax, eax
je 0x14000921a
mov r14d, eax
movabs rax, 0x110000100000000
add r14, rax
mov rax, r14
add rsp, 0x88
pop r14
pop rbp
ret
xor eax, eax
add rsp, 0x88
pop r14
pop rbp
ret
Function at 0x140009240
Capabilities:
Get storage device properties

Disassembly:
mov byte [rsp + 8], cl
mov r11, rsp
push rbx
push rbp
push rsi
sub rsp, 0xe0
mov rsi, rdx
test rdx, rdx
je 0x14000934b
xorps xmm1, xmm1
lea rcx, [r11 - 0x78]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdx], xmm0
xor r8d, r8d
movups xmmword [rdx + 0x10], xmm0
mov qword [rdx + 0x20], rax
lea rdx, str..PhysicalDrive_d
movups xmmword [r11 - 0x78], xmm1
movups xmmword [r11 - 0x68], xmm1
movups xmmword [r11 - 0x58], xmm1
movups xmmword [r11 - 0x48], xmm1
movups xmmword [r11 - 0x38], xmm1
movups xmmword [r11 - 0x28], xmm1
call fcn.140017e70
xor ebx, ebx
lea rcx, [rsp + 0x80]
mov qword [rsp + 0x30], rbx
xor r9d, r9d
mov dword [rsp + 0x28], 0x40
mov edx, 0x80000000
mov r8d, 1
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x14000934b
xor eax, eax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x70], rax
lea r8, [rsp + 0x40]
xorps xmm0, xmm0
mov qword [rsp + 0x44], rbx
lea rax, [rsp + 0x100]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x30], rax
mov r9d, recv
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 0x28
mov edx, 0x2d1400
mov qword [rsp + 0x20], rax
mov rcx, rbp
mov dword [rsp + 0x100], ebx
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140009358
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0xe0
pop rsi
pop rbp
pop rbx
ret
mov ecx, dword [rsp + 0x54]
mov qword [rsp + 0x108], rdi
mov qword [rsp + 0x110], r14
call fcn.140045b18
mov ecx, dword [rsp + 0x54]
lea r8, [rsp + 0x40]
mov rdi, rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x100]
mov r9d, recv
mov qword [rsp + 0x30], rax
mov edx, 0x2d1400
mov dword [rsp + 0x28], ecx
mov rcx, rbp
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov r14d, eax
test eax, eax
jne 0x1400093c8
mov rcx, rdi
call fcn.140045884
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140009437
mov eax, dword [rdi + 0xc]
mov edx, dword [rdi + 0x10]
mov r9d, dword [rdi + 0x14]
mov r8d, dword [rdi + 0x18]
mov ecx, dword [rsp + 0x54]
test eax, eax
je 0x1400093e7
cmp eax, ecx
jae 0x1400093e7
add rax, rdi
jmp 0x1400093ea
mov rax, rbx
mov qword [rsi], rax
test edx, edx
je 0x1400093f9
lea rax, [rdi + rdx]
cmp edx, ecx
jb 0x1400093fc
mov rax, rbx
mov qword [rsi + 8], rax
test r9d, r9d
je 0x14000940e
lea rax, [rdi + r9]
cmp r9d, ecx
jb 0x140009411
mov rax, rbx
mov qword [rsi + 0x10], rax
test r8d, r8d
je 0x140009423
cmp r8d, ecx
jae 0x140009423
lea rbx, [rdi + r8]
mov rcx, rbp
mov qword [rsi + 0x18], rbx
mov qword [rsi + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r14d
mov rdi, qword [rsp + 0x108]
mov r14, qword [rsp + 0x110]
add rsp, 0xe0
pop rsi
pop rbp
pop rbx
ret
Function at 0x14000b410
Capabilities:
Capture screenshot

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
mov r13, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rcx, rax
mov edx, 3
mov r12, rax
call qword [sym.imp.GDI32.dll_SetStretchBltMode]
mov ecx, 0x4c
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x4d
mov ebp, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x4e
mov edi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov ecx, 0x4f
mov esi, eax
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edx, esi
mov rcx, r13
mov r8d, eax
mov r14d, eax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, r14d
mov dword [rsp + 0x60], 0x28
neg ecx
mov dword [rsp + 0x64], esi
mov r15, rax
mov dword [rsp + 0x68], ecx
xor eax, eax
mov qword [rsp + 0x6c], 0x200001
mov rcx, r12
mov qword [rsp + 0x74], rax
mov rdx, r15
mov qword [rsp + 0x7c], rax
mov dword [rsp + 0x84], eax
call qword [sym.imp.GDI32.dll_SelectObject]
movzx eax, word [rsp + 0x6e]
mov ecx, 0x42
imul eax, esi
add eax, 0x1f
cdq
and edx, 0x1f
add edx, eax
sar edx, 5
imul edx, r14d
shl edx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [rsp + 0x50], 0xcc0020
mov r9d, esi
mov dword [rsp + 0x48], r14d
xor r8d, r8d
mov dword [rsp + 0x40], esi
xor edx, edx
mov dword [rsp + 0x38], edi
mov rcx, r12
mov dword [rsp + 0x30], ebp
mov rbx, rax
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r14d
call qword [sym.imp.GDI32.dll_StretchBlt]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov r9d, r14d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, r15
mov rcx, r12
call qword [sym.imp.GDI32.dll_GetDIBits]
mov rcx, r12
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, qword [rsp + 0xc0]
mov rdx, r13
call qword [sym.imp.USER32.dll_ReleaseDC]
lea r11, [rsp + 0x90]
mov rax, r15
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140029400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rbx, r9
mov r14, r8
mov r12d, edx
mov r15, rcx
mov dword [rsp + 0x70], 0x78563412
cmp dword [rcx + 0x58], 1
jbe 0x140029613
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
xor ebp, ebp
mov qword [rsp + 0x30], rbp
movzx eax, byte [rcx + 0x5c]
neg al
sbb rsi, rsi
and esi, 4
mov eax, ebp
mov ecx, 2
cmp r8, 0x7e
cmovae eax, ecx
add rsi, rax
mov eax, 8
cmp r8, 0x10000
cmovae ecx, eax
add rsi, rcx
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.14001c490
mov r8, rsi
xor edx, edx
mov rdi, qword [rsp + 0x20]
mov rcx, rdi
call fcn.140076ff0
lea r9, [rdi + rsi]
mov qword [rsp + 0x28], r9
or r12b, 0x80
mov byte [rdi], r12b
movzx edx, byte [r15 + 0x5c]
cmp r14, 0x7e
jae 0x1400294cf
neg dl
sbb al, al
and al, 0x80
or al, r14b
mov byte [rdi + 1], al
cmp byte [r15 + 0x5c], bpl
je 0x14002956f
mov dword [rdi + 2], 0x78563412
jmp 0x14002956f
mov rcx, r14
shr rcx, 8
cmp r14, 0x10000
jae 0x14002950a
mov eax, 0x7e
mov r8d, 0xfe
test dl, dl
cmovne eax, r8d
mov byte [rdi + 1], al
mov byte [rdi + 2], cl
mov byte [rdi + 3], r14b
cmp byte [r15 + 0x5c], 0
je 0x14002956f
mov dword [rdi + 4], 0x78563412
jmp 0x14002956f
mov eax, 0x7f
mov r8d, 0xff
test dl, dl
cmovne eax, r8d
mov byte [rdi + 1], al
mov rax, r14
shr rax, 0x38
mov byte [rdi + 2], al
mov rax, r14
shr rax, 0x30
mov byte [rdi + 3], al
mov rax, r14
shr rax, 0x28
mov byte [rdi + 4], al
mov rax, r14
shr rax, 0x20
mov byte [rdi + 5], al
mov rax, r14
shr rax, 0x18
mov byte [rdi + 6], al
mov rax, r14
shr rax, 0x10
mov byte [rdi + 7], al
mov byte [rdi + 8], cl
mov byte [rdi + 9], r14b
cmp byte [r15 + 0x5c], 0
je 0x14002956f
mov dword [rdi + 0xa], 0x78563412
sub r9, rdi
mov rdx, qword [r15 + 0x28]
mov r8, rdi
lea rcx, [r15 + 0x20]
call fcn.14001e5e0
mov r9, qword [rsp + 0x90]
sub r9, rbx
mov rdx, qword [r15 + 0x28]
mov r8, rbx
lea rcx, [r15 + 0x20]
call fcn.14001e5e0
cmp byte [r15 + 0x5c], 0
je 0x1400295e2
mov r8, qword [r15 + 0x28]
sub r8, qword [r15 + 0x20]
sub r8, r14
test r14, r14
je 0x1400295e2
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [r15 + 0x20]
add rdx, rbp
movzx ecx, byte [rdx + r8]
mov rax, rbp
and eax, 3
xor cl, byte [rsp + rax + 0x70]
mov byte [rdx + r8], cl
inc rbp
cmp rbp, r14
jne 0x1400295c0
mov rdx, qword [rsp + 0x30]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x14002960b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002962d
mov rcx, rdi
call fcn.140045884
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.14005e594
int3
Function at 0x140029640
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov dword [rax + 0x10], edx
push rdi
push r14
push r15
sub rsp, 0x40
mov rbx, r9
mov r14, r8
mov r15, rcx
mov dword [rax + 0x10], 0x78563412
cmp dword [rcx + 0x58], 1
jbe 0x140029843
xorps xmm0, xmm0
movdqu xmmword [rax - 0x38], xmm0
xor ebp, ebp
mov qword [rax - 0x28], rbp
movzx eax, byte [rcx + 0x5c]
neg al
sbb rsi, rsi
and esi, 4
mov eax, ebp
mov ecx, 2
cmp r8, 0x7e
cmovae eax, ecx
add rsi, rax
mov eax, 8
cmp r8, 0x10000
cmovae ecx, eax
add rsi, rcx
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.14001c490
mov r8, rsi
xor edx, edx
mov rdi, qword [rsp + 0x20]
mov rcx, rdi
call fcn.140076ff0
lea r9, [rdi + rsi]
mov qword [rsp + 0x28], r9
mov byte [rdi], 0x82
movzx edx, byte [r15 + 0x5c]
cmp r14, 0x7e
jae 0x14002970a
neg dl
sbb al, al
and al, 0x80
or al, r14b
mov byte [rdi + 1], al
cmp byte [r15 + 0x5c], bpl
je 0x1400297aa
mov dword [rdi + 2], 0x78563412
jmp 0x1400297aa
mov rcx, r14
shr rcx, 8
cmp r14, 0x10000
jae 0x140029745
mov eax, 0x7e
mov r8d, 0xfe
test dl, dl
cmovne eax, r8d
mov byte [rdi + 1], al
mov byte [rdi + 2], cl
mov byte [rdi + 3], r14b
cmp byte [r15 + 0x5c], 0
je 0x1400297aa
mov dword [rdi + 4], 0x78563412
jmp 0x1400297aa
mov eax, 0x7f
mov r8d, 0xff
test dl, dl
cmovne eax, r8d
mov byte [rdi + 1], al
mov rax, r14
shr rax, 0x38
mov byte [rdi + 2], al
mov rax, r14
shr rax, 0x30
mov byte [rdi + 3], al
mov rax, r14
shr rax, 0x28
mov byte [rdi + 4], al
mov rax, r14
shr rax, 0x20
mov byte [rdi + 5], al
mov rax, r14
shr rax, 0x18
mov byte [rdi + 6], al
mov rax, r14
shr rax, 0x10
mov byte [rdi + 7], al
mov byte [rdi + 8], cl
mov byte [rdi + 9], r14b
cmp byte [r15 + 0x5c], 0
je 0x1400297aa
mov dword [rdi + 0xa], 0x78563412
sub r9, rdi
mov rdx, qword [r15 + 0x28]
mov r8, rdi
lea rcx, [r15 + 0x20]
call fcn.14001e5e0
mov r9, qword [rsp + 0x80]
sub r9, rbx
mov rdx, qword [r15 + 0x28]
mov r8, rbx
lea rcx, [r15 + 0x20]
call fcn.14001e5e0
cmp byte [r15 + 0x5c], 0
je 0x140029812
mov r8, qword [r15 + 0x28]
sub r8, qword [r15 + 0x20]
sub r8, r14
test r14, r14
je 0x140029812
nop
mov rdx, qword [r15 + 0x20]
add rdx, rbp
movzx ecx, byte [rdx + r8]
mov rax, rbp
and eax, 3
xor cl, byte [rsp + rax + 0x68]
mov byte [rdx + r8], cl
inc rbp
cmp rbp, r14
jne 0x1400297f0
mov rdx, qword [rsp + 0x30]
sub rdx, rdi
mov rax, rdi
cmp rdx, 0x1000
jb 0x14002983b
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002985c
mov rcx, rdi
call fcn.140045884
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
call fcn.14005e594
int3
Function at 0x1400402d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor ebx, ebx
mov r11, rdx
mov r9, rcx
mov r10d, ebx
cmp r8, 8
jb 0x140040317
mov rcx, r8
shr rcx, 3
imul rax, rcx, 0xfffffffffffffff8
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [r9]
add r9, 8
xor rax, qword [r11]
add r11, 8
or r10, rax
sub rcx, 1
jne 0x140040300
mov rdx, r10
shr rdx, 0x20
or edx, r10d
mov eax, edx
mov ecx, edx
shr eax, 8
or eax, edx
shr ecx, 0x10
and eax, 0xff00
or eax, ecx
movzx ecx, dl
shr eax, 8
or eax, ecx
test r8, r8
je 0x140040417
cmp r8, 8
jb 0x1400403f3
mov rdx, r8
lea r10, [r11 + 4]
and rdx, 0xfffffffffffffff8
mov rcx, r9
sub rcx, r11
xorps xmm4, xmm4
xorps xmm3, xmm3
nop word [rax + rax]
movd xmm2, dword [rcx + r10 - 4]
xorps xmm0, xmm0
movd xmm1, dword [r10 - 4]
lea r10, [r10 + 8]
punpcklbw xmm2, xmm0
add rbx, 8
punpcklwd xmm2, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
movd xmm1, dword [r10 - 8]
punpcklbw xmm1, xmm0
por xmm4, xmm2
movd xmm2, dword [rcx + r10 - 8]
punpcklbw xmm2, xmm0
punpcklwd xmm2, xmm0
punpcklwd xmm1, xmm0
pxor xmm2, xmm1
por xmm3, xmm2
cmp rbx, rdx
jb 0x140040370
por xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movd ecx, xmm3
or eax, ecx
cmp rbx, r8
jae 0x140040417
sub r9, r11
lea r10, [rbx + r11]
sub r8, rbx
nop dword [rax]
movzx edx, byte [r10 + r9]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
xor edx, ecx
or eax, edx
sub r8, 1
jne 0x140040400
mov rbx, qword [rsp + 8]
test eax, eax
sete al
ret
Function at 0x140040430
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, rdx
test r9, r9
je 0x140040584
cmp r9, 4
jb 0x14004047a
mov rdx, r9
shr rdx, 2
imul rax, rdx, 0xfffffffffffffffc
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, dword [r10]
add r10, 4
xor eax, dword [r8]
add r8, 4
mov dword [rcx], eax
add rcx, 4
sub rdx, 1
jne 0x140040460
xor r11d, r11d
test r9, r9
je 0x140040584
cmp r9, 0x40
jb 0x140040563
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r9
add rax, r9
cmp rcx, rax
ja 0x1400404ac
cmp rdx, r8
jae 0x140040563
lea rax, [r10 - 1]
add rax, r9
cmp rcx, rax
ja 0x1400404c1
cmp rdx, r10
jae 0x140040563
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp], rdi
mov rdi, r9
and rdi, 0xffffffffffffffc0
mov rdx, r10
lea rax, [r8 + 0x10]
sub rdx, r8
mov rbx, rcx
sub rbx, r8
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r11, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rbx + rax - 0x50], xmm1
pxor xmm2, xmm0
movdqu xmm0, xmmword [rax - 0x30]
movdqu xmm1, xmmword [rdx + rax - 0x30]
movdqu xmmword [rbx + rax - 0x40], xmm2
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm2, xmmword [rdx + rax - 0x20]
movdqu xmmword [rbx + rax - 0x30], xmm1
pxor xmm2, xmm0
movdqu xmmword [rbx + rax - 0x20], xmm2
cmp r11, rdi
jb 0x1400404f0
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
cmp r11, r9
jae 0x140040584
sub r10, r8
lea rdx, [r11 + r8]
sub rcx, r8
sub r9, r11
movzx eax, byte [rdx + r10]
xor al, byte [rdx]
mov byte [rdx + rcx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x140040570
add rsp, 8
ret