joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d910
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x140016c60], rbx
je 0x14000d977
cmp rax, rbx
jne 0x14000d96a
mov ebx, 1
mov esi, ebx
jmp 0x14000d97c
mov ecx, 0x3e8
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
jmp 0x14000d94f
mov ebx, 1
mov eax, dword [0x140016c68]
cmp eax, ebx
jne 0x14000d994
mov edi, 0x1f
mov ecx, edi
call fcn.140134000
jmp 0x14000da00
mov eax, dword [0x140016c68]
test eax, eax
jne 0x14000d9f5
mov dword [0x140016c68], ebx
lea r15, [0x140010bb8]
lea rdi, [0x140010ba0]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x14000d9e7
test eax, eax
jne 0x14000d9eb
cmp qword [rdi], r14
je 0x14000d9dc
mov rax, qword [rdi]
mov rcx, qword [0x140010b58]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x14000d9be
test eax, eax
je 0x14000d9fb
mov eax, 0xff
jmp 0x14000db56
mov dword [0x1400163e4], ebx
mov edi, 0x1f
mov eax, dword [0x140016c68]
cmp eax, ebx
jne 0x14000da27
lea rdx, [0x140010b98]
lea rcx, [0x140010b60]
call sub.msvcrt.dll__initterm
mov dword [0x140016c68], 2
test esi, esi
jne 0x14000da35
mov rax, r14
xchg qword [0x140016c60], rax
cmp qword [0x140016c80], r14
je 0x14000da68
lea rcx, [0x140016c80]
call fcn.14000dfd0
test eax, eax
je 0x14000da68
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140016c80]
mov r9, qword [0x140010b58]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x14000da81
mov eax, 0xff
jmp 0x14000db56
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x14000db07
test ax, ax
je 0x14000da9c
test edx, edx
jne 0x14000db07
sub ax, bx
cmp ax, di
ja 0x14000dab2
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x14000da9c
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.1400019fc
mov dword [0x1400163e0], eax
cmp dword [0x140016400], r14d
jne 0x14000daf0
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x1400163e4], r14d
jne 0x14000db05
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x1400163e0]
jmp 0x14000db56
cmp ax, 0x22
jne 0x14000db1b
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x14000da8a
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.14000e064
add rsp, 0x28
jmp 0x14000d910
Function at 0x140002c24
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002c6e
mov ecx, _cexit
cmp word [rax], cx
jne 0x140002c6e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002c6e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002c6e
cmp dword [rcx + 0x84], 0xe
jbe 0x140002c6e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002c70
xor al, al
add rsp, 0x28
ret
Function at 0x6d9f4d50
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x6da165e4]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x6d9f4ed8
mov rax, qword [0x6da165e8]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x6d9f4d9c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x6d9f4e25
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x6d9f4d80
mov rcx, rbx
call sym.__mingw_GetSectionForAddress
test rax, rax
mov r12, rax
je 0x6d9f4f0d
mov rax, qword [0x6da165e8]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call sym._GetPEImageBase
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x6da165e8]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x6d9f4ef0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x6d9f4e1e
sub eax, 0x40
and eax, 0xffffffbf
jne 0x6d9f4e80
add dword [0x6da165e4], 1
cmp edi, 8
jae 0x6d9f4e53
test dil, 4
jne 0x6d9f4ec4
test edi, edi
je 0x6d9f4e48
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x6d9f4edf
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x6d9f4e48
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x6d9f4e6c
jmp 0x6d9f4e48
add rsi, qword [0x6da165e8]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x6d9f4e1e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call sym.__report_error
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x6d9f4e48
xor esi, esi
jmp 0x6d9f4da7
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x6d9f4e48
mov rax, qword [0x6da165e8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call sym.__report_error
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call sym.__report_error
nop
nop dword [rax]

Function at 0x6d9f5660
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x6da168c0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x6da168a0]
test rbx, rbx
je 0x6d9f56b4
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x6d9f56ab
test rsi, rsi
je 0x6d9f56ab
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x6d9f5690
lea rcx, [0x6da168c0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x6d9f58f0
Capabilities:
Parse pe header

Disassembly:
cmp word [rcx], 0x5a4d
je 0x6d9f5900
xor eax, eax
ret
jmp sym._ValidateImageBase.part.0

Function at 0x6d9f5910
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x6d9f5951
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov r8d, dword [rax + 0xc]
cmp r8, rdx
mov rcx, r8
ja 0x6d9f5948
add ecx, dword [rax + 8]
cmp rcx, rdx
ja 0x6d9f5953
add rax, 0x28
cmp rax, r9
jne 0x6d9f5934
xor eax, eax
ret

Function at 0x6d9f59f0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6da131f0]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x6d9f5a5d
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d9f5a5d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d9f5a5d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d9f5a54
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d9f5a5f
add rax, 0x28
cmp rax, r9
jne 0x6d9f5a40
xor eax, eax
add rsp, 0x28
ret

Function at 0x6d9f5b60
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x6da131f0]
xor eax, eax
cmp word [r8], 0x5a4d
mov rdx, rcx
je 0x6d9f5b80
add rsp, 0x28
ret
mov rcx, r8
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d9f5b78
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x6d9f5bdd
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x6d9f5bd4
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x6d9f5be4
add rax, 0x28
cmp rax, r9
jne 0x6d9f5bc0
xor eax, eax
add rsp, 0x28
ret
mov eax, dword [rax + 0x24]
not eax
shr eax, 0x1f
add rsp, 0x28
ret

Function at 0x6d9f5c00
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r11, qword [0x6da131f0]
cmp word [r11], 0x5a4d
mov r9d, ecx
jne 0x6d9f5c6e
mov rcx, r11
call sym._ValidateImageBase.part.0
test eax, eax
je 0x6d9f5c6e
movsxd rax, dword [r11 + 0x3c]
add rax, r11
mov edx, dword [rax + 0x90]
test edx, edx
je 0x6d9f5c6e
movzx ecx, word [rax + 0x14]
lea rcx, [rax + rcx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x6d9f5c6e
sub eax, 1
lea rax, [rax + rax*4]
lea rax, [rcx + rax*8 + 0x28]
mov r10d, dword [rcx + 0xc]
cmp rdx, r10
mov r8, r10
jb 0x6d9f5c65
add r8d, dword [rcx + 8]
cmp rdx, r8
jb 0x6d9f5c75
add rcx, 0x28
cmp rcx, rax
jne 0x6d9f5c50
xor eax, eax
add rsp, 0x28
ret
add rdx, r11
jne 0x6d9f5c88
jmp 0x6d9f5c6e
sub r9d, 1
add rdx, 0x14
mov ecx, dword [rdx + 4]
test ecx, ecx
jne 0x6d9f5c96
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x6d9f5c6e
test r9d, r9d
jg 0x6d9f5c80
mov eax, dword [rdx + 0xc]
add rax, r11
add rsp, 0x28
ret
Function at 0x6d9f5fd0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call sym.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call sym.__acrt_iob_func
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sym.vfprintf
call sym.abort
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x140001000
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x50
movaps xmmword [rsp + 0x40], xmm6
mov rax, qword [0x140004008]
xor rax, rsp
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movsd xmm6, qword [0x1400022b0]
movabs rsi, 0x311cdad160000
movabs r15, 0x7ffffffa697d0fff
movabs r12, 0x59682f000
movabs r14, 0x7fffffffffffffff
movabs rbp, 0x112e0be826d694b3
nop dword [rax]
lea rcx, str.taskkill__F__IM_taskmgr.exe__T
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1400010ab
imul rax, rax, 0x64
jmp 0x1400010c9
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
lea rdi, [rax + r12]
cmp rax, r15
jl 0x1400010d5
mov rdi, r14
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1400010f3
imul rbx, rax, 0x64
jmp 0x140001114
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
mov rbx, rax
imul rax, rcx, 0x3b9aca00
add rbx, rax
cmp rbx, rdi
jge 0x140001080
call qword [sym.imp.MSVCP140.dll__Xtime_get_ticks]
imul rcx, rax, 0x64
xorps xmm0, xmm0
mov rax, rdi
sub rax, rbx
lea r8, [rcx + rsi]
cvtsi2sd xmm0, rax
comisd xmm0, xmm6
seta r9b
test r9b, r9b
jne 0x14000114a
lea r8, [rcx + rax]
add rax, rcx
lea rdx, [rcx + rsi]
test r9b, r9b
lea rcx, [rsp + 0x20]
cmove rdx, rax
mov rax, rbp
imul rdx
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
mov qword [rsp + 0x20], rdx
sub r8d, eax
mov dword [rsp + 0x28], r8d
call qword [sym.imp.MSVCP140.dll__Thrd_sleep]
jmp 0x1400010d5

Function at 0x140001a7c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001ac6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001ac6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001ac6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001ac6
cmp dword [rcx + 0x84], 0xe
jbe 0x140001ac6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001ac8
xor al, al
add rsp, 0x28
ret
Function at 0x14000f110
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rax
mov rbp, rsp
push r10
push r9
push r8
push rdx
push rax
push rcx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x10]
movabs rcx, 0xf0f0
mov qword [rbp], rcx
mov rcx, qword [rbp]
mov r8, qword [rcx + rax + 8]
mov rdx, qword [rcx + rax + 0x10]
mov qword [rcx + rax + 0x10], 0
lea r9, [rax + rdx]
add r9, r8
add r9, 0xfffffffffffffffc
add r8, rax
cmp r8, r9
jae 0x14000f18f
add rdx, rax
add rdx, 0xfffffffffffffffc
nop word [rax + rax]
mov r9d, dword [rcx + rax + 0x18]
xor dword [r8], r9d
mov r9, r8
add r9, 4
mov r10, qword [rcx + rax + 8]
add r10, rdx
mov r8, r9
cmp r9, r10
jb 0x14000f170
mov edx, dword [rcx + rax + 0x18]
mov rcx, qword [rcx + rax]
mov dword [rcx + rax], edx
pop rcx
pop rax
pop rdx
pop r8
pop r9
pop r10
add rsp, 8
pop rbp
ret

Function at 0x14000f3e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rax
mov rbp, rsp
push r10
push r9
push r8
push rdx
push rax
push rcx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x10]
movabs rcx, 0xf3c0
mov qword [rbp], rcx
mov rcx, qword [rbp]
mov r8, qword [rcx + rax + 8]
mov rdx, qword [rcx + rax + 0x10]
mov qword [rcx + rax + 0x10], 0
lea r9, [rax + rdx]
add r9, r8
add r9, 0xfffffffffffffffc
add r8, rax
cmp r8, r9
jae 0x14000f45f
add rdx, rax
add rdx, 0xfffffffffffffffc
nop word [rax + rax]
mov r9d, dword [rcx + rax + 0x18]
xor dword [r8], r9d
mov r9, r8
add r9, 4
mov r10, qword [rcx + rax + 8]
add r10, rdx
mov r8, r9
cmp r9, r10
jb 0x14000f440
mov edx, dword [rcx + rax + 0x18]
mov rcx, qword [rcx + rax]
mov dword [rcx + rax], edx
pop rcx
pop rax
pop rdx
pop r8
pop r9
pop r10
add rsp, 8
pop rbp
ret

Function at 0x14000f5c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rax
mov rbp, rsp
push r10
push r9
push r8
push rdx
push rax
push rcx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x10]
movabs rcx, 0xf5a0
mov qword [rbp], rcx
mov rcx, qword [rbp]
mov r8, qword [rcx + rax + 8]
mov rdx, qword [rcx + rax + 0x10]
mov qword [rcx + rax + 0x10], 0
lea r9, [rax + rdx]
add r9, r8
add r9, 0xfffffffffffffffc
add r8, rax
cmp r8, r9
jae 0x14000f63f
add rdx, rax
add rdx, 0xfffffffffffffffc
nop word [rax + rax]
mov r9d, dword [rcx + rax + 0x18]
xor dword [r8], r9d
mov r9, r8
add r9, 4
mov r10, qword [rcx + rax + 8]
add r10, rdx
mov r8, r9
cmp r9, r10
jb 0x14000f620
mov edx, dword [rcx + rax + 0x18]
mov rcx, qword [rcx + rax]
mov dword [rcx + rax], edx
pop rcx
pop rax
pop rdx
pop r8
pop r9
pop r10
add rsp, 8
pop rbp
ret
Function at 0x14000fa70
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rax
mov rbp, rsp
push r10
push r9
push r8
push rdx
push rax
push rcx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x10]
movabs rcx, 0xfa50
mov qword [rbp], rcx
mov rcx, qword [rbp]
mov r8, qword [rcx + rax + 8]
mov rdx, qword [rcx + rax + 0x10]
mov qword [rcx + rax + 0x10], 0
lea r9, [rax + rdx]
add r9, r8
add r9, 0xfffffffffffffffc
add r8, rax
cmp r8, r9
jae 0x14000faef
add rdx, rax
add rdx, 0xfffffffffffffffc
nop word [rax + rax]
mov r9d, dword [rcx + rax + 0x18]
xor dword [r8], r9d
mov r9, r8
add r9, 4
mov r10, qword [rcx + rax + 8]
add r10, rdx
mov r8, r9
cmp r9, r10
jb 0x14000fad0
mov edx, dword [rcx + rax + 0x18]
mov rcx, qword [rcx + rax]
mov dword [rcx + rax], edx
pop rcx
pop rax
pop rdx
pop r8
pop r9
pop r10
add rsp, 8
pop rbp
ret

Function at 0x14000fd40
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rax
mov rbp, rsp
push r10
push r9
push r8
push rdx
push rax
push rcx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x10]
movabs rcx, 0xfd20
mov qword [rbp], rcx
mov rcx, qword [rbp]
mov r8, qword [rcx + rax + 8]
mov rdx, qword [rcx + rax + 0x10]
mov qword [rcx + rax + 0x10], 0
lea r9, [rax + rdx]
add r9, r8
add r9, 0xfffffffffffffffc
add r8, rax
cmp r8, r9
jae 0x14000fdbf
add rdx, rax
add rdx, 0xfffffffffffffffc
nop word [rax + rax]
mov r9d, dword [rcx + rax + 0x18]
xor dword [r8], r9d
mov r9, r8
add r9, 4
mov r10, qword [rcx + rax + 8]
add r10, rdx
mov r8, r9
cmp r9, r10
jb 0x14000fda0
mov edx, dword [rcx + rax + 0x18]
mov rcx, qword [rcx + rax]
mov dword [rcx + rax], edx
pop rcx
pop rax
pop rdx
pop r8
pop r9
pop r10
add rsp, 8
pop rbp
ret

Function at 0x14000ff20
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rax
mov rbp, rsp
push r10
push r9
push r8
push rdx
push rax
push rcx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x10]
movabs rcx, 0xff00
mov qword [rbp], rcx
mov rcx, qword [rbp]
mov r8, qword [rcx + rax + 8]
mov rdx, qword [rcx + rax + 0x10]
mov qword [rcx + rax + 0x10], 0
lea r9, [rax + rdx]
add r9, r8
add r9, 0xfffffffffffffffc
add r8, rax
cmp r8, r9
jae 0x14000ff9f
add rdx, rax
add rdx, 0xfffffffffffffffc
nop word [rax + rax]
mov r9d, dword [rcx + rax + 0x18]
xor dword [r8], r9d
mov r9, r8
add r9, 4
mov r10, qword [rcx + rax + 8]
add r10, rdx
mov r8, r9
cmp r9, r10
jb 0x14000ff80
mov edx, dword [rcx + rax + 0x18]
mov rcx, qword [rcx + rax]
mov dword [rcx + rax], edx
pop rcx
pop rax
pop rdx
pop r8
pop r9
pop r10
add rsp, 8
pop rbp
ret
Function at 0x140010010
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rax
mov rbp, rsp
push r10
push r9
push r8
push rdx
push rax
push rcx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x10]
movabs rcx, 0xfff0
mov qword [rbp], rcx
mov rcx, qword [rbp]
mov r8, qword [rcx + rax + 8]
mov rdx, qword [rcx + rax + 0x10]
mov qword [rcx + rax + 0x10], 0
lea r9, [rax + rdx]
add r9, r8
add r9, 0xfffffffffffffffc
add r8, rax
cmp r8, r9
jae 0x14001008f
add rdx, rax
add rdx, 0xfffffffffffffffc
nop word [rax + rax]
mov r9d, dword [rcx + rax + 0x18]
xor dword [r8], r9d
mov r9, r8
add r9, 4
mov r10, qword [rcx + rax + 8]
add r10, rdx
mov r8, r9
cmp r9, r10
jb 0x140010070
mov edx, dword [rcx + rax + 0x18]
mov rcx, qword [rcx + rax]
mov dword [rcx + rax], edx
pop rcx
pop rax
pop rdx
pop r8
pop r9
pop r10
add rsp, 8
pop rbp
ret

Function at 0x1400103d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rax
mov rbp, rsp
push r10
push r9
push r8
push rdx
push rax
push rcx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x10]
movabs rcx, 0x103b0
mov qword [rbp], rcx
mov rcx, qword [rbp]
mov r8, qword [rcx + rax + 8]
mov rdx, qword [rcx + rax + 0x10]
mov qword [rcx + rax + 0x10], 0
lea r9, [rax + rdx]
add r9, r8
add r9, 0xfffffffffffffffc
add r8, rax
cmp r8, r9
jae 0x14001044f
add rdx, rax
add rdx, 0xfffffffffffffffc
nop word [rax + rax]
mov r9d, dword [rcx + rax + 0x18]
xor dword [r8], r9d
mov r9, r8
add r9, 4
mov r10, qword [rcx + rax + 8]
add r10, rdx
mov r8, r9
cmp r9, r10
jb 0x140010430
mov edx, dword [rcx + rax + 0x18]
mov rcx, qword [rcx + rax]
mov dword [rcx + rax], edx
pop rcx
pop rax
pop rdx
pop r8
pop r9
pop r10
add rsp, 8
pop rbp
ret

Function at 0x140010970
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rax
mov rbp, rsp
push r10
push r9
push r8
push rdx
push rax
push rcx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x10]
movabs rcx, 0x10950
mov qword [rbp], rcx
mov rcx, qword [rbp]
mov r8, qword [rcx + rax + 8]
mov rdx, qword [rcx + rax + 0x10]
mov qword [rcx + rax + 0x10], 0
lea r9, [rax + rdx]
add r9, r8
add r9, 0xfffffffffffffffc
add r8, rax
cmp r8, r9
jae 0x1400109ef
add rdx, rax
add rdx, 0xfffffffffffffffc
nop word [rax + rax]
mov r9d, dword [rcx + rax + 0x18]
xor dword [r8], r9d
mov r9, r8
add r9, 4
mov r10, qword [rcx + rax + 8]
add r10, rdx
mov r8, r9
cmp r9, r10
jb 0x1400109d0
mov edx, dword [rcx + rax + 0x18]
mov rcx, qword [rcx + rax]
mov dword [rcx + rax], edx
pop rcx
pop rax
pop rdx
pop r8
pop r9
pop r10
add rsp, 8
pop rbp
ret
Function at 0x140010b50
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rax
mov rbp, rsp
push r10
push r9
push r8
push rdx
push rax
push rcx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x10]
movabs rcx, 0x10b30
mov qword [rbp], rcx
mov rcx, qword [rbp]
mov r8, qword [rcx + rax + 8]
mov rdx, qword [rcx + rax + 0x10]
mov qword [rcx + rax + 0x10], 0
lea r9, [rax + rdx]
add r9, r8
add r9, 0xfffffffffffffffc
add r8, rax
cmp r8, r9
jae 0x140010bcf
add rdx, rax
add rdx, 0xfffffffffffffffc
nop word [rax + rax]
mov r9d, dword [rcx + rax + 0x18]
xor dword [r8], r9d
mov r9, r8
add r9, 4
mov r10, qword [rcx + rax + 8]
add r10, rdx
mov r8, r9
cmp r9, r10
jb 0x140010bb0
mov edx, dword [rcx + rax + 0x18]
mov rcx, qword [rcx + rax]
mov dword [rcx + rax], edx
pop rcx
pop rax
pop rdx
pop r8
pop r9
pop r10
add rsp, 8
pop rbp
ret

Function at 0x140010c40
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rax
mov rbp, rsp
push r10
push r9
push r8
push rdx
push rax
push rcx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x10]
movabs rcx, 0x10c20
mov qword [rbp], rcx
mov rcx, qword [rbp]
mov r8, qword [rcx + rax + 8]
mov rdx, qword [rcx + rax + 0x10]
mov qword [rcx + rax + 0x10], 0
lea r9, [rax + rdx]
add r9, r8
add r9, 0xfffffffffffffffc
add r8, rax
cmp r8, r9
jae 0x140010cbf
add rdx, rax
add rdx, 0xfffffffffffffffc
nop word [rax + rax]
mov r9d, dword [rcx + rax + 0x18]
xor dword [r8], r9d
mov r9, r8
add r9, 4
mov r10, qword [rcx + rax + 8]
add r10, rdx
mov r8, r9
cmp r9, r10
jb 0x140010ca0
mov edx, dword [rcx + rax + 0x18]
mov rcx, qword [rcx + rax]
mov dword [rcx + rax], edx
pop rcx
pop rax
pop rdx
pop r8
pop r9
pop r10
add rsp, 8
pop rbp
ret

Function at 0x140010f10
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rax
mov rbp, rsp
push r10
push r9
push r8
push rdx
push rax
push rcx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x10]
movabs rcx, 0x10ef0
mov qword [rbp], rcx
mov rcx, qword [rbp]
mov r8, qword [rcx + rax + 8]
mov rdx, qword [rcx + rax + 0x10]
mov qword [rcx + rax + 0x10], 0
lea r9, [rax + rdx]
add r9, r8
add r9, 0xfffffffffffffffc
add r8, rax
cmp r8, r9
jae 0x140010f8f
add rdx, rax
add rdx, 0xfffffffffffffffc
nop word [rax + rax]
mov r9d, dword [rcx + rax + 0x18]
xor dword [r8], r9d
mov r9, r8
add r9, 4
mov r10, qword [rcx + rax + 8]
add r10, rdx
mov r8, r9
cmp r9, r10
jb 0x140010f70
mov edx, dword [rcx + rax + 0x18]
mov rcx, qword [rcx + rax]
mov dword [rcx + rax], edx
pop rcx
pop rax
pop rdx
pop r8
pop r9
pop r10
add rsp, 8
pop rbp
ret