joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002060
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
push r15
mov eax, dword [rcx + 0x48]
lea rbx, [rcx + 0x28]
mov rdi, qword [rcx]
lea r11, [rcx + 0x28]
add rbx, rax
mov r9, rcx
movabs rbp, 0xc2b2ae3d27d4eb4f
movabs rsi, 0x9e3779b185ebca87
movabs r14, 0x27d4eb2f165667c5
movabs r15, 0x7a1435883d4d519d
cmp rdi, 0x20
jb 0x140002159
mov r8, qword [r9 + 0x18]
mov rdx, qword [rcx + 8]
mov rax, r8
mov r9, qword [r9 + 0x20]
mov rcx, qword [rcx + 0x10]
mov r10, r9
rol r10, 0x12
rol rax, 0xc
add r10, rax
mov rax, rcx
rol rax, 7
add r10, rax
mov rax, rdx
rol rax, 1
add r10, rax
movabs rax, 0x85ebca77c2b2ae63
imul rdx, rbp
imul rcx, rbp
imul r8, rbp
imul r9, rbp
rol rdx, 0x1f
imul rdx, rsi
rol rcx, 0x1f
xor r10, rdx
rol r8, 0x1f
imul r10, rsi
imul rcx, rsi
imul r8, rsi
sub r10, r15
rol r9, 0x1f
xor r10, rcx
imul r10, rsi
imul r9, rsi
sub r10, r15
xor r10, r8
imul r10, rsi
sub r10, r15
xor r10, r9
imul r10, rsi
add rax, r10
add rax, rdi
jmp 0x140002161
lea rax, [rdi + r14]
add rax, qword [rcx + 0x18]
lea rdx, [r11 + 8]
cmp rdx, rbx
ja 0x14000219a
nop word [rax + rax]
mov rcx, qword [r11]
add rdx, 8
imul rcx, rbp
add r11, 8
rol rcx, 0x1f
imul rcx, rsi
xor rax, rcx
rol rax, 0x1b
imul rax, rsi
sub rax, r15
cmp rdx, rbx
jbe 0x140002170
lea rdx, [r11 + 4]
movabs r8, 0x165667b19e3779f9
cmp rdx, rbx
ja 0x1400021c5
mov ecx, dword [r11]
mov r11, rdx
imul rcx, rsi
xor rax, rcx
rol rax, 0x17
imul rax, rbp
add rax, r8
cmp r11, rbx
jae 0x1400021eb
nop word [rax + rax]
movzx ecx, byte [r11]
inc r11
imul rcx, r14
xor rax, rcx
rol rax, 0xb
imul rax, rsi
cmp r11, rbx
jb 0x1400021d0
mov rbx, qword [rsp + 0x18]
mov rcx, rax
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
shr rcx, 0x21
xor rcx, rax
imul rcx, rbp
mov rbp, qword [rsp + 0x20]
mov rdx, rcx
shr rdx, 0x1d
xor rdx, rcx
imul rdx, r8
mov rax, rdx
shr rax, 0x20
xor rax, rdx
pop r15
pop r14
ret

Function at 0x14000a500
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor eax, eax
lea rbx, [rsp + 0x30]
mov rbp, rdx
mov word [rsp + 0x30], ax
movzx edx, byte [rcx]
mov rsi, rcx
mov edi, 0x28
test dl, dl
je 0x14000a5a5
nop
cmp word [rbx], 0
mov rcx, rdi
mov rax, rbx
je 0x14000a55d
nop dword [rax]
add rax, 2
dec rcx
cmp word [rax], 0
jne 0x14000a550
cmp rcx, 1
jb 0x14000a5d6
mov byte [rsp + 0x20], dl
mov rcx, 0xffffffffffffffff
mov byte [rsp + 0x21], 0
cmp word [rax + rcx*2 + 2], 0
lea rcx, [rcx + 1]
jne 0x14000a573
lea rcx, [rax + rcx*2]
mov r8d, 2
lea rdx, [rsp + 0x20]
call fcn.14000fff0
movzx edx, byte [rsi + 1]
inc rsi
add rbx, 2
dec rdi
test dl, dl
jne 0x14000a540
mov rdx, rbp
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14000c500
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
call fcn.14000fcb4
int3
Function at 0x14000a660
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x250
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rdi, r8
lea rax, [rsp + 0x30]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
xor r9d, r9d
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
je 0x14000a6a5
xor al, al
jmp 0x14000a6f2
cmp word [rbx], 0
je 0x14000a6bd
nop dword [rax + rax]
add rbx, 2
dec rdi
cmp word [rbx], 0
jne 0x14000a6b0
cmp word [rsp + 0x30], 0
je 0x14000a6eb
lea rcx, [rsp + 0x30]
sub rcx, rbx
nop dword [rax]
cmp rdi, 1
jb 0x14000a713
movzx eax, word [rcx + rbx]
dec rdi
mov word [rbx], ax
add rbx, 2
cmp word [rcx + rbx], 0
jne 0x14000a6d0
xor eax, eax
mov word [rbx], ax
mov al, 1
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14000c500
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rdi
ret
call fcn.14000fcb4
int3
Function at 0x14000b7e0
Capabilities:
Check if file exists
Delete file
Get file attributes
Terminate process

Disassembly:
sub rsp, 0x68
mov rcx, qword [0x14002fdd8]
test rcx, rcx
je 0x14000b81b
mov edx, 0x1388
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000b80e
mov rcx, qword [0x14002fdd8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [0x14002fdd8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [0x14002fde8], 0
je 0x14000b90e
mov qword [rsp + 0x70], rbx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x78], rbp
lea rbp, [0x140029970]
mov qword [rsp + 0x80], rsi
lea rsi, [0x140030610]
mov qword [rsp + 0x88], rdi
xor edi, edi
mov qword [rsp + 0x60], r14
mov r14d, 0x414
mov word [rsp + 0x40], r14w
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ebx, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000b8ef
test al, 0x10
je 0x14000b8ef
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rbp
mov word [rsp + 0x40], r14w
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rbp
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
inc ebx
cmp ebx, 0x14
jl 0x14000b895
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x60]
add rsp, 0x68
ret
Function at 0x14000cdf4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000ce3e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000ce3e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000ce3e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000ce3e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000ce3e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000ce40
xor al, al
add rsp, 0x28
ret

Function at 0x14000faa4
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000fb13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fb13
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fb13
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000fb13
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fb13
cmp dword [rcx + 0x84], 0xe
jbe 0x14000fb13
cmp dword [rcx + 0xf8], 0
je 0x14000fb13
mov ecx, ebx
call fcn.14000fbc4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000f9a0
nop
cmp dword [rbp + 0x20], 0
je 0x14000fb61
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000fb6c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000faa4

Function at 0x14000fca8
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000fb13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000fb13
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000fb13
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000fb13
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000fb13
cmp dword [rcx + 0x84], 0xe
jbe 0x14000fb13
cmp dword [rcx + 0xf8], 0
je 0x14000fb13
mov ecx, ebx
call fcn.14000fbc4
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000f9a0
nop
cmp dword [rbp + 0x20], 0
je 0x14000fb61
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000fb6c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000faa4
Function at 0x140001000
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
xorps xmm0, xmm0
movaps xmmword [rsp + 0x10], xmm0
mov dword [rsp + 0x20], 0
cmp dword [0x1400c7550], 0xa
mov eax, dword [0x1400c7554]
setl bl
lea edx, [rax + 1]
imul edx, eax
test dl, 1
sete al
mov edx, ebx
and dl, al
mov ecx, ebx
xor cl, al
or bl, al
mov byte [rsp + 0xd], bl
xor cl, 1
mov byte [rsp + 0xe], cl
xor dl, 1
mov byte [rsp + 0xf], dl
xor eax, eax
lea rcx, [0x140050b54]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x10], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x140001058
mov eax, dword [0x1400c7558]
lea ecx, [rax + 1]
imul ecx, eax
test cl, 1
mov ecx, 0x36d3
mov eax, 0x6995
cmove eax, ecx
cmp dword [0x1400c755c], 0xa
cmovl eax, ecx
mov edx, 0x2e15
mov r11b, 1
xor r10d, r10d
mov r8d, 0x601c
lea rcx, [0x140050b48]
mov r9d, 0x603a
mov esi, dword [rsp + 0x20]
xor esi, r8d
mov edi, dword [rsp + 0x18]
xor edi, eax
mov ebx, dword [rsp + 0x1c]
cmp edx, 0x7793
jg 0x1400010e1
cmp edx, 0x28d2
je 0x140001167
cmp edx, 0x2e15
jne 0x1400010c3
jmp 0x140001126
cmp edx, 0x7794
je 0x140001114
cmp edx, 0x7e1d
jne 0x1400010c3
mov rdx, qword gs:[0x60]
mov qword [rsp + 0x28], rdx
mov edx, ebx
xor edx, 0x52f6
test r10b, r10b
cmove ebx, edx
mov r10b, 1
mov edx, edi
jmp 0x1400010c3
mov rdx, qword gs:[0x60]
mov qword [rsp + 0x28], rdx
mov edx, esi
jmp 0x1400010c3
mov dword [rsp + 0x1c], ebx
mov dl, byte [rsp + 0xe]
mov dl, byte [rsp + 0xf]
test r11b, 1
je 0x14000114d
xor edx, edx
movsxd rbx, dword [rdx + rcx]
xor byte [rsp + rbx*4 + 0x10], 0x26
add rdx, 4
cmp rdx, 0xc
jne 0x14000113a
cmp byte [rsp + 0xd], 0
mov edx, 0x69b3
cmovne edx, r9d
xor edx, dword [rsp + 0x10]
xor r11d, r11d
jmp 0x1400010b2
mov dword [rsp + 0x1c], ebx
mov rax, qword [rsp + 0x28]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret
Function at 0x140001178
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0
mov eax, dword [0x1400c7560]
cmp dword [0x1400c7564], 0xa
setl cl
mov edx, 1
sub edx, eax
imul edx, eax
test dl, 1
sete al
mov edx, ecx
and dl, al
mov byte [rsp + 0x2e], dl
xor cl, al
mov byte [rsp + 0x2f], cl
xor eax, eax
lea rcx, [0x140050b54]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x1400011cf
mov eax, 0x2e15
mov sil, 1
xor r13d, r13d
mov r15d, 0x601c
lea rdi, [0x140050b48]
mov r12d, 0x36d3
mov ebp, dword [rsp + 0x40]
xor ebp, r15d
mov r14d, dword [rsp + 0x38]
mov ebx, dword [rsp + 0x3c]
cmp eax, 0x7793
jg 0x14000122e
cmp eax, 0x28d2
je 0x1400012d8
cmp eax, 0x2e15
jne 0x140001213
jmp 0x140001297
cmp eax, 0x7794
je 0x140001282
cmp eax, 0x7e1d
jne 0x140001213
call section..text
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x50], rax
mov eax, dword [0x1400c7568]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, ebx
xor eax, 0x52f6
test r13b, r13b
cmove ebx, eax
test cl, 1
mov eax, 0x6995
cmove eax, r12d
cmp dword [0x1400c756c], 0xa
cmovl eax, r12d
xor eax, r14d
mov r13b, 1
jmp 0x140001213
call section..text
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x50], rax
mov eax, ebp
jmp 0x140001213
mov dword [rsp + 0x3c], ebx
mov al, byte [rsp + 0x2e]
or al, byte [rsp + 0x2f]
test sil, 1
je 0x1400012be
xor ecx, ecx
movsxd rdx, dword [rcx + rdi]
xor byte [rsp + rdx*4 + 0x30], 0x26
add rcx, 4
cmp rcx, 0xc
jne 0x1400012ab
test al, 1
mov eax, 0x69b3
mov ecx, 0x603a
cmovne eax, ecx
xor eax, dword [rsp + 0x30]
xor esi, esi
jmp 0x140001203
mov dword [rsp + 0x3c], ebx
mov rax, qword [rsp + 0x50]
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400012f2
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov r13, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0
cmp dword [0x1400c7570], 0xa
mov eax, dword [0x1400c7574]
setl cl
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
mov edx, ecx
and dl, al
mov byte [rsp + 0x2e], dl
xor cl, al
mov byte [rsp + 0x2f], cl
xor eax, eax
lea rcx, [0x140050b54]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x140001348
mov eax, 0x2e15
mov sil, 1
xor ebp, ebp
mov ecx, 0x601c
lea rbx, [0x140050b48]
mov r14d, dword [rsp + 0x40]
xor r14d, ecx
mov r12d, dword [rsp + 0x38]
mov r15d, dword [rsp + 0x3c]
cmp eax, 0x7793
jg 0x1400013a4
cmp eax, 0x28d2
je 0x140001499
cmp eax, 0x2e15
jne 0x140001386
jmp 0x140001452
cmp eax, 0x7794
je 0x14000141e
cmp eax, 0x7e1d
jne 0x140001386
call fcn.140022d73
mov rcx, rax
mov edx, 0xb192b48
call fcn.1400271d0
mov rdi, rax
call fcn.140001178
mov rcx, rax
mov edx, 8
mov r8, r13
call rdi
mov qword [rsp + 0x50], rax
mov eax, dword [0x1400c7578]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, r15d
xor eax, 0x52f6
test bpl, bpl
cmove r15d, eax
test cl, 1
mov eax, 0x6995
mov ecx, 0x36d3
cmove eax, ecx
cmp dword [0x1400c757c], 0xa
cmovl eax, ecx
xor eax, r12d
mov bpl, 1
jmp 0x140001386
call fcn.140022d73
mov rcx, rax
mov edx, 0xb192b48
call fcn.1400271d0
mov rdi, rax
call fcn.140001178
mov rcx, rax
mov edx, 8
mov r8, r13
call rdi
mov qword [rsp + 0x50], rax
mov eax, r14d
jmp 0x140001386
mov dword [rsp + 0x3c], r15d
mov al, byte [rsp + 0x2e]
or al, byte [rsp + 0x2f]
test sil, 1
je 0x14000147a
xor ecx, ecx
movsxd rdx, dword [rcx + rbx]
xor byte [rsp + rdx*4 + 0x30], 0x26
add rcx, 4
cmp rcx, 0xc
jne 0x140001467
test al, 1
mov eax, 0x69b3
mov ecx, 0x603a
cmovne eax, ecx
xor eax, dword [rsp + 0x30]
xor esi, esi
mov ecx, 0x601c
jmp 0x140001374
mov dword [rsp + 0x3c], r15d
mov rax, qword [rsp + 0x50]
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400014b4
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r13, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0
cmp dword [0x1400c7580], 0xa
mov eax, dword [0x1400c7584]
setl cl
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
mov edx, ecx
and dl, al
mov byte [rsp + 0x2a], dl
xor cl, al
mov byte [rsp + 0x2b], cl
xor eax, eax
lea rcx, [0x140050b54]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x14000150a
mov eax, 0x2e15
mov sil, 1
xor ebp, ebp
mov ecx, 0x601c
lea rbx, [0x140050b48]
mov r14d, dword [rsp + 0x40]
xor r14d, ecx
mov r12d, dword [rsp + 0x38]
mov r15d, dword [rsp + 0x3c]
cmp eax, 0x7793
jg 0x140001566
cmp eax, 0x28d2
je 0x14000165c
cmp eax, 0x2e15
jne 0x140001548
jmp 0x140001615
cmp eax, 0x7794
je 0x1400015e5
cmp eax, 0x7e1d
jne 0x140001548
call fcn.140022d73
mov rcx, rax
mov edx, 0xd1f05c5
call fcn.1400271d0
mov rdi, rax
call fcn.140001178
mov rcx, rax
xor edx, edx
mov r8, r13
call rdi
mov dword [rsp + 0x2c], eax
mov eax, dword [0x1400c7588]
mov ecx, eax
not ecx
lea edx, [rax + rax]
add ecx, edx
add ecx, 2
imul ecx, eax
mov eax, r15d
xor eax, 0x52f6
test bpl, bpl
cmove r15d, eax
test cl, 1
mov eax, 0x6995
mov ecx, 0x36d3
cmove eax, ecx
cmp dword [0x1400c758c], 0xa
cmovl eax, ecx
xor eax, r12d
mov bpl, 1
jmp 0x140001548
call fcn.140022d73
mov rcx, rax
mov edx, 0xd1f05c5
call fcn.1400271d0
mov rdi, rax
call fcn.140001178
mov rcx, rax
xor edx, edx
mov r8, r13
call rdi
mov dword [rsp + 0x2c], eax
mov eax, r14d
jmp 0x140001548
mov dword [rsp + 0x3c], r15d
mov al, byte [rsp + 0x2a]
or al, byte [rsp + 0x2b]
test sil, 1
je 0x14000163d
xor ecx, ecx
movsxd rdx, dword [rcx + rbx]
xor byte [rsp + rdx*4 + 0x30], 0x26
add rcx, 4
cmp rcx, 0xc
jne 0x14000162a
test al, 1
mov eax, 0x69b3
mov ecx, 0x603a
cmovne eax, ecx
xor eax, dword [rsp + 0x30]
xor esi, esi
mov ecx, 0x601c
jmp 0x140001536
mov dword [rsp + 0x3c], r15d
mov eax, dword [rsp + 0x2c]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14000d6e4
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
xorps xmm0, xmm0
movaps xmmword [rsp + 0x10], xmm0
mov dword [rsp + 0x20], 0
mov eax, dword [0x1400c7c70]
cmp dword [0x1400c7c74], 9
setg dl
lea ebp, [rax + 1]
imul ebp, eax
and bpl, dl
mov byte [rsp + 0xb], bpl
mov al, byte [rsp + 0xb]
xor eax, eax
lea rdx, [0x140052f58]
movsxd rbp, dword [rax + rdx]
xor dword [rsp + rbp*4 + 0x10], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x14000d727
xor ecx, 0x52535455
mov eax, dword [0x1400c7c78]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
mov edx, 0x36d3
mov eax, 0x6995
cmove eax, edx
cmp dword [0x1400c7c7c], 0xa
cmovl eax, edx
mov esi, 0x2e15
mov r11b, 1
xor r9d, r9d
mov r8d, 0x601c
lea rdx, [0x140052f4c]
mov r10d, 0x69b3
mov edi, dword [rsp + 0x20]
xor edi, r8d
mov ebx, dword [rsp + 0x18]
xor ebx, eax
mov ebp, dword [rsp + 0x1c]
cmp esi, 0x7793
jg 0x14000d7b2
cmp esi, 0x28d2
je 0x14000d81f
cmp esi, 0x2e15
jne 0x14000d798
jmp 0x14000d7e3
cmp esi, 0x7794
je 0x14000d7db
cmp esi, 0x7e1d
jne 0x14000d798
mov dword [rsp + 0xc], ecx
mov esi, ebp
xor esi, 0x52f6
test r9b, r9b
cmove ebp, esi
mov r9b, 1
mov esi, ebx
jmp 0x14000d798
mov dword [rsp + 0xc], ecx
mov esi, edi
jmp 0x14000d798
mov dword [rsp + 0x1c], ebp
mov bl, byte [rsp + 0xb]
test r11b, 1
je 0x14000d807
xor ebp, ebp
movsxd rdi, dword [rbp + rdx]
xor byte [rsp + rdi*4 + 0x10], 0x26
add rbp, 4
cmp rbp, 0xc
jne 0x14000d7f3
test bl, 1
mov esi, 0x603a
cmovne esi, r10d
xor esi, dword [rsp + 0x10]
xor r11d, r11d
jmp 0x14000d787
mov dword [rsp + 0x1c], ebp
mov eax, dword [rsp + 0xc]
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x14003c56a
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0
cmp dword [0x1400c85ec], 9
mov ebp, dword [0x1400c85e8]
setg cl
lea edx, [rbp - 0x2e6c32c1]
and edx, 1
mov eax, ebp
and eax, 1
add eax, ebp
add eax, 0xd193cd3f
add eax, edx
mov edx, eax
not edx
add eax, eax
add eax, edx
add eax, 0x5cd86582
imul eax, ebp
and al, cl
mov byte [rsp + 0x2e], al
mov byte [rsp + 0x2f], 1
xor eax, eax
lea rcx, [0x140057804]
movsxd rdx, dword [rax + rcx]
xor dword [rsp + rdx*4 + 0x30], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x14003c5d5
mov eax, 0x2e15
mov sil, 1
xor r13d, r13d
mov r15d, 0x601c
lea rdi, [0x1400577f8]
mov r12d, 0x36d3
mov ebp, dword [rsp + 0x40]
xor ebp, r15d
mov r14d, dword [rsp + 0x38]
mov ebx, dword [rsp + 0x3c]
cmp eax, 0x7793
jg 0x14003c634
cmp eax, 0x28d2
je 0x14003c6cd
cmp eax, 0x2e15
jne 0x14003c619
jmp 0x14003c68c
cmp eax, 0x7794
je 0x14003c681
cmp eax, 0x7e1d
jne 0x14003c619
xor ecx, ecx
call fcn.14000b2ef
mov eax, dword [0x1400c85f0]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, ebx
xor eax, 0x52f6
test r13b, r13b
cmove ebx, eax
test cl, 1
mov eax, 0x6995
cmove eax, r12d
cmp dword [0x1400c85f4], 0xa
cmovl eax, r12d
xor eax, r14d
mov r13b, 1
jmp 0x14003c619
xor ecx, ecx
call fcn.14000b2ef
mov eax, ebp
jmp 0x14003c619
mov dword [rsp + 0x3c], ebx
mov al, byte [rsp + 0x2e]
xor al, byte [rsp + 0x2f]
test sil, 1
je 0x14003c6b3
xor ecx, ecx
movsxd rdx, dword [rcx + rdi]
xor byte [rsp + rdx*4 + 0x30], 0x26
add rcx, 4
cmp rcx, 0xc
jne 0x14003c6a0
test al, 1
mov eax, 0x69b3
mov ecx, 0x603a
cmovne eax, ecx
xor eax, dword [rsp + 0x30]
xor esi, esi
jmp 0x14003c609
mov dword [rsp + 0x3c], ebx
xor eax, eax
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14004032a
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
movaps xmmword [rbp - 0x10], xmm6
xorps xmm0, xmm0
movaps xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0
mov eax, dword [0x1400c7ffc]
mov ecx, dword [0x1400c7ff8]
cmp ecx, 9
setg dl
cmp ecx, 0xa
setl cl
lea ebx, [rax + 1]
imul ebx, eax
test bl, 1
sete al
mov ebx, ecx
or bl, al
mov byte [rbp - 0x11], bl
and dl, al
xor dl, bl
and cl, al
xor cl, al
xor cl, dl
mov byte [rbp - 0x12], cl
xor eax, eax
lea rcx, [0x140058580]
movsxd rdx, dword [rax + rcx]
xor dword [rbp + rdx*4 - 0x30], 0x1e27
add rax, 4
cmp rax, 0x10
jne 0x140040392
mov eax, 0x2e15
mov r15b, 1
xor esi, esi
mov ecx, 0x601c
lea rbx, [0x140058574]
xorps xmm6, xmm6
mov r14d, dword [rbp - 0x20]
xor r14d, ecx
mov r13d, dword [rbp - 0x28]
mov r12d, dword [rbp - 0x24]
cmp eax, 0x7793
jg 0x1400403ee
cmp eax, 0x28d2
je 0x140040541
cmp eax, 0x2e15
jne 0x1400403d0
jmp 0x1400404fe
cmp eax, 0x7794
je 0x14004049b
cmp eax, 0x7e1d
jne 0x1400403d0
mov eax, 0x30
call fcn.14004f010
sub rsp, rax
mov rdi, rsp
sub rsp, 0x20
call fcn.140020f9c
mov rcx, rax
mov edx, 0x59b8ecc
call fcn.1400271d0
add rsp, 0x20
movups xmmword [rdi], xmm6
movups xmmword [rdi + 0x10], xmm6
mov dword [rdi + 0x20], 0
sub rsp, 0x20
mov rcx, rax
lea rdx, [0x14003ec8a]
mov r8d, 2
mov r9, rdi
call fcn.14003d0ab
add rsp, 0x20
mov dword [rbp - 0x18], eax
mov eax, dword [0x1400c7fa0]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, r12d
xor eax, 0x52f6
test sil, sil
cmove r12d, eax
test cl, 1
mov eax, 0x6995
mov ecx, 0x36d3
cmove eax, ecx
cmp dword [0x1400c7fa4], 0xa
cmovl eax, ecx
xor eax, r13d
mov sil, 1
jmp 0x1400403d0
mov eax, 0x30
call fcn.14004f010
sub rsp, rax
mov rdi, rsp
sub rsp, 0x20
call fcn.140020f9c
mov rcx, rax
mov edx, 0x59b8ecc
call fcn.1400271d0
add rsp, 0x20
movups xmmword [rdi], xmm6
movups xmmword [rdi + 0x10], xmm6
mov dword [rdi + 0x20], 0
sub rsp, 0x20
mov rcx, rax
lea rdx, [0x14003ec8a]
mov r8d, 2
mov r9, rdi
call fcn.14003d0ab
add rsp, 0x20
mov dword [rbp - 0x18], eax
mov eax, r14d
jmp 0x1400403d0
mov dword [rbp - 0x24], r12d
mov al, byte [rbp - 0x12]
test r15b, 1
je 0x140040520
xor eax, eax
movsxd rcx, dword [rax + rbx]
xor byte [rbp + rcx*4 - 0x30], 0x26
add rax, 4
cmp rax, 0xc
jne 0x14004050d
cmp byte [rbp - 0x11], 0
mov eax, 0x69b3
mov ecx, 0x603a
cmovne eax, ecx
xor eax, dword [rbp - 0x30]
xor r15d, r15d
mov ecx, 0x601c
jmp 0x1400403c1
mov dword [rbp - 0x24], r12d
mov eax, dword [rbp - 0x18]
movaps xmm6, xmmword [rbp - 0x10]
lea rsp, [rbp + 8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret