joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140276aec
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140276b1c
xor eax, eax
jmp 0x140276bdf
mov rbp, rbx
cmp word [rax], si
je 0x140276b41
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x140276b28
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140276b24
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.140273b98
movsxd r14, eax
test eax, eax
jne 0x140276b7f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140276b15
mov rcx, r14
call fcn.14027120c
mov rdi, rax
test rax, rax
jne 0x140276b98
xor ecx, ecx
call fcn.14026dbe4
jmp 0x140276b74
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.140273b98
test eax, eax
jne 0x140276bc9
mov rcx, rdi
call fcn.14026dbe4
jmp 0x140276bd3
xor ecx, ecx
call fcn.14026dbe4
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret

Function at 0x140276bfc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140276c83
mov rsi, rbx
cmp word [rax], bp
je 0x140276c42
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x140276c2c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140276c28
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14027120c
mov rdi, rax
test rax, rax
je 0x140276c70
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14024aa30
mov rbp, rdi
xor ecx, ecx
call fcn.14026dbe4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140279f3c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.14026bd54
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x140279fdd
cmp ebx, dword [rsp + 0x30]
je 0x140279fd6
test esi, esi
je 0x140279fd6
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x140279fb1
sub r8w, 0x61
cmp r8w, 0x19
ja 0x140279fbe
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x140279f9b
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x140279fc2
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x140279fdf
mov eax, 1
jmp 0x140279fdf
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14027dcbc
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xa0
xor r15d, r15d
mov r14, rdx
mov rsi, rcx
mov qword [rbp + 0x17], r15
xor edx, edx
mov qword [rbp + 0x1f], r15
lea rcx, [rbp - 0x39]
mov qword [rbp + 0x27], r15
mov qword [rbp + 0x2f], r15
mov edi, r15d
mov qword [rbp + 0x37], r15
mov byte [rbp + 0x3f], r15b
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov byte [rbp + 0xf], r15b
call fcn.140253ce4
mov rax, qword [rbp - 0x31]
mov ebx, 0xfde9
cmp dword [rax + 0xc], ebx
jne 0x14027dd46
cmp byte [rbp - 0x21], r15b
je 0x14027dd41
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, ebx
jmp 0x14027dd7c
call fcn.14026e148
test eax, eax
jne 0x14027dd68
cmp byte [rbp - 0x21], r15b
je 0x14027dd60
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, 1
jmp 0x14027dd7c
cmp byte [rbp - 0x21], r15b
je 0x14027dd79
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov r9d, r15d
lea r8, [rbp + 0x77]
mov rcx, rsi
lea rdx, [rbp + 0x17]
call fcn.140263594
test eax, eax
jne 0x14027de1c
xor edx, edx
lea rcx, [rbp - 0x39]
call fcn.140253ce4
mov rax, qword [rbp - 0x31]
cmp dword [rax + 0xc], ebx
jne 0x14027ddbb
cmp byte [rbp - 0x21], r15b
je 0x14027ddf0
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x14027ddf0
call fcn.14026e148
test eax, eax
jne 0x14027dddc
cmp byte [rbp - 0x21], r15b
je 0x14027ddd5
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, 1
jmp 0x14027ddf0
cmp byte [rbp - 0x21], r15b
je 0x14027dded
mov rax, qword [rbp - 0x39]
and dword [rax + 0x3a8], 0xfffffffd
mov ebx, r15d
mov r9d, ebx
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
mov rcx, r14
call fcn.140263594
mov rdi, qword [rbp - 9]
test eax, eax
jne 0x14027de1c
mov rcx, qword [rbp + 0x27]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ebx, eax
jmp 0x14027de1f
mov ebx, r15d
cmp byte [rbp + 0xf], r15b
je 0x14027de2d
mov rcx, rdi
call fcn.14026dbe4
cmp byte [rbp + 0x3f], r15b
je 0x14027de3c
mov rcx, qword [rbp + 0x27]
call fcn.14026dbe4
lea r11, [rsp + 0xa0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14027eae0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140270fa8
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140270fa8
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14027ec30
cmp rax, 0xffffffffffffffff
je 0x14027ec30
xor edi, edi
test rbp, rbp
jle 0x14027ebdb
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.14026db6c
mov rbx, rax
test rax, rax
jne 0x14027eb68
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14027ebd1
mov edx, 0x8000
mov ecx, r14d
call fcn.1402692e8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14026fc90
cmp eax, 0xffffffff
je 0x14027ebb1
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14027eb78
mov edx, r15d
mov ecx, r14d
call fcn.1402692e8
jmp 0x14027ebd1
cmp byte [rsi + 0x38], dil
je 0x14027ebc8
cmp dword [rsi + 0x34], 5
jne 0x14027ebc8
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14027ebd1
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14026dbe4
jmp 0x14027ec44
jns 0x14027ec44
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140270fa8
cmp rax, 0xffffffffffffffff
jne 0x14027ebfc
cmp byte [rsi + 0x30], dil
je 0x14027ec44
mov edi, dword [rsi + 0x2c]
jmp 0x14027ec44
mov ecx, r14d
call fcn.1402779e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14027ec44
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14027ec44
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14027ec3d
mov eax, dword [rsi + 0x2c]
jmp 0x14027ec42
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140270fa8
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14027f7c0
Capabilities:
Check for time delay via queryperformancecounter
Check os version

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov edx, dword [0x1404161d0]
mov rax, qword gs:[0x58]
mov esi, 0x48
mov rbx, qword [rax + rdx*8]
mov eax, dword [rbx + rsi]
cmp dword [0x140417450], eax
jg 0x14027f8c0
mov eax, dword [rbx + rsi]
cmp dword [0x140417458], eax
jg 0x14027f913
cmp byte [0x140417454], 0
je 0x14027f844
mov eax, dword [rbx + rsi]
cmp dword [0x140417468], eax
jg 0x14027f881
lea rdx, [0x140417460]
lea rcx, [rsp + 0x38]
call fcn.14027f560
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea rcx, [rsp + 0x38]
call fcn.14027f580
jmp 0x14027f84f
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x30]
mulsd xmm0, qword [0x140417448]
cvttsd2si rdx, xmm0
mov rcx, rdi
call fcn.14027f600
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
lea rcx, [0x140417468]
call fcn.140249f98
cmp dword [0x140417468], 0xffffffff
jne 0x14027f81c
lea rcx, [0x140417460]
call fcn.14027f4d0
lea rcx, [0x140294520]
call fcn.140249ed8
nop
lea rcx, [0x140417468]
call fcn.140249f2c
jmp 0x14027f81c
lea rcx, [0x140417450]
call fcn.140249f98
cmp dword [0x140417450], 0xffffffff
jne 0x14027f7f9
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xorps xmm0, xmm0
cvtsi2sd xmm0, qword [rsp + 0x38]
movsd xmm1, qword [0x1403b5ce0]
divsd xmm1, xmm0
movsd qword [0x140417448], xmm1
lea rcx, [0x140417450]
call fcn.140249f2c
jmp 0x14027f7f9
lea rcx, [0x140417458]
call fcn.140249f98
cmp dword [0x140417458], 0xffffffff
jne 0x14027f808
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
setb byte [0x140417454]
lea rcx, [0x140417458]
call fcn.140249f2c
jmp 0x14027f808

Function at 0x14027ff40
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
call fcn.140076070
mov ecx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
shr eax, 0xf
and al, 1
add rsp, 0x28
ret
jmp 0x140075f90
Function at 0x14027ff80
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
jmp 0x1402800f0
push rbx
sub rsp, 0x50
mov rax, qword [0x140400788]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x140280142
lea rdx, str.Failed_to_open_the_Win32_clipboard.
lea rcx, [0x140417480]
call fcn.140004d50
mov rcx, rax
call fcn.14000d7d4
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1402499e0
add rsp, 0x50
pop rbx
ret
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x14028017a
lea rdx, str.Failed_to_empty_the_Win32_clipboard.
lea rcx, [0x140417480]
call fcn.140004d50
mov rcx, rax
call fcn.14000d7d4
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1402499e0
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 0x68], rsi
mov rcx, rbx
mov qword [rsp + 0x70], rdi
call fcn.140042460
mov ecx, 2
lea rsi, [rax*2 + 2]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
test rax, rax
je 0x140280234
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140042b80
mov rbx, rax
cmp qword [rax + 0x18], 8
jb 0x1402801c8
mov rbx, qword [rax]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14024aa30
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14028021d
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140280218
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140280257
call fcn.140249860
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rdi
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1402499e0
add rsp, 0x50
pop rbx
ret
call fcn.140250d14
int3
Function at 0x14027ff90
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140400788]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 1
call fcn.14000fed0
nop
mov dword [rsp + 0x20], 1
mov ecx, 0xd
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x14027fff6
lea rdx, str.Failed_to_get_the_clipboard_data_in_Unicode_format.
lea rcx, [0x140417480]
call fcn.140004d50
mov rcx, rax
call fcn.14000d7d4
jmp 0x1402800c3
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x140280022
lea rdx, str.Failed_to_open_the_Win32_clipboard.
lea rcx, [0x140417480]
call fcn.140004d50
mov rcx, rax
call fcn.14000d7d4
jmp 0x1402800c3
mov ecx, 0xd
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rdi, rax
test rax, rax
jne 0x140280052
lea rdx, str.Failed_to_get_Win32_handle_for_clipboard_content.
lea rcx, [0x140417480]
call fcn.140004d50
mov rcx, rax
call fcn.14000d7d4
jmp 0x1402800bc
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140041a00
nop
mov rdx, rax
mov rcx, rbx
call fcn.140041b00
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 4
jb 0x1402800b3
lea rdx, [rdx*4 + 4]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1402800ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1402800de
call fcn.140249860
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
mov rax, rbx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1402499e0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
call fcn.140250d14
nop
int3
Function at 0x1400013b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
mov ecx, 0x18
call fcn.14000cf9c
xor esi, esi
mov rbx, rax
mov qword [rax], rsi
lea ecx, [rsi + 5]
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
call fcn.14000cf9c
mov qword [rbx], rax
lea r9d, [rsi + 2]
mov r11d, 1
lea r8, [rdi + 2]
mov r14d, r9d
lea r12, [0x140046570]
lea rcx, [rax + 5]
mov r10, rdi
mov qword [rbx + 0x10], rcx
sub r11, rdi
xor ecx, ecx
sub r14, rdi
mov dword [rax], ecx
mov r15, 0xfffffffffffffffe
mov byte [rax + 4], cl
not r10
add rax, 5
movabs rbp, 0x3e88cb3c9484e2b
mov qword [rbx + 8], rax
sub r15, rdi
nop word [rax + rax]
lea rcx, [r15 + r8]
mov rax, rbp
mul rsi
shr rdx, 2
imul rax, rdx, 0x106
movzx edx, byte [r8 - 2]
sub rsi, rax
mov rax, qword [rbx]
xor dl, byte [rsi + r12]
mov byte [rcx + rax], dl
mov rax, rbp
movsxd rcx, r9d
dec rcx
mul rcx
shr rdx, 2
imul rax, rdx, 0x106
movzx edx, byte [r8 - 1]
sub rcx, rax
mov rax, qword [rbx]
xor dl, byte [rcx + r12]
lea rcx, [r10 + r8]
mov byte [rcx + rax], dl
mov rax, rbp
movsxd rcx, r9d
mul rcx
shr rdx, 2
imul rax, rdx, 0x106
movzx edx, byte [r8]
sub rcx, rax
mov rax, qword [rbx]
xor dl, byte [rcx + r12]
mov rcx, r8
sub rcx, rdi
mov byte [rcx + rax], dl
mov rax, rbp
movsxd rcx, r9d
inc rcx
mul rcx
shr rdx, 2
imul rax, rdx, 0x106
movzx edx, byte [r8 + 1]
sub rcx, rax
mov rax, qword [rbx]
xor dl, byte [rcx + r12]
lea rcx, [r11 + r8]
mov byte [rcx + rax], dl
mov rax, rbp
movsxd rcx, r9d
add r9d, 5
add rcx, 2
mul rcx
shr rdx, 2
imul rax, rdx, 0x106
movzx edx, byte [r8 + 2]
sub rcx, rax
mov rax, qword [rbx]
xor dl, byte [rcx + r12]
lea rcx, [r14 + r8]
mov byte [rcx + rax], dl
add r8, 5
lea eax, [r9 - 2]
movsxd rsi, eax
cmp rsi, 5
jb 0x140001450
mov rbp, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140001a70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000cf9c
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 2]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000cf9c
mov qword [rbx], rax
lea r11, [0x140046570]
mov r9d, edi
mov r8d, edi
movabs r10, 0x3e88cb3c9484e2b
lea rcx, [rax + 2]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov word [rax], cx
add rax, 2
mov qword [rbx + 8], rax
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r9 + rsi]
lea r9, [r9 + 2]
mov rax, r10
mul r8
shr rdx, 2
imul rax, rdx, 0x106
sub r8, rax
mov rax, qword [rbx]
xor cl, byte [r8 + r11]
mov byte [r9 + rax - 2], cl
mov rax, r10
movzx ecx, byte [r9 + rsi - 1]
movsxd r8, edi
add edi, 2
inc r8
mul r8
shr rdx, 2
imul rax, rdx, 0x106
sub r8, rax
mov rax, qword [rbx]
xor cl, byte [r8 + r11]
movsxd r8, edi
mov byte [rax + r9 - 1], cl
cmp r8, 2
jb 0x140001ae0
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140003130
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
mov ecx, 0x18
call fcn.14000cf9c
xor esi, esi
mov rbx, rax
mov qword [rax], rsi
lea ecx, [rsi + 0xc]
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
call fcn.14000cf9c
mov qword [rbx], rax
lea r8, [rdi + 4]
mov r9d, 2
lea r13, [0x140046680]
mov r10, 0xfffffffffffffffe
mov r11d, r9d
lea rcx, [rax + 0xc]
mov r14d, 4
mov qword [rbx + 0x10], rcx
mov r15d, 6
xor ecx, ecx
sub r10, rdi
mov qword [rax], rcx
sub r11, rdi
mov dword [rax + 8], ecx
sub r14, rdi
add rax, 0xc
sub r15, rdi
mov r12, 0xfffffffffffffffc
mov qword [rbx + 8], rax
sub r12, rdi
movabs rbp, 0x3e88cb3c9484e2b
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbx]
lea r8, [r8 + 0xc]
add rcx, r12
mov rax, rbp
mul rsi
shr rdx, 2
imul rax, rdx, 0x106
sub rsi, rax
movzx eax, byte [r8 - 0x10]
xor al, byte [rsi + r13]
movsx edx, al
mov rax, rbp
mov word [rcx + r8 - 0xc], dx
movsxd rcx, r9d
dec rcx
mul rcx
shr rdx, 2
imul rax, rdx, 0x106
sub rcx, rax
movzx eax, byte [r8 - 0xe]
xor al, byte [rcx + r13]
mov rcx, qword [rbx]
movsx edx, al
add rcx, r10
mov rax, rbp
mov word [rcx + r8 - 0xc], dx
movsxd rcx, r9d
mul rcx
shr rdx, 2
imul rax, rdx, 0x106
sub rcx, rax
movzx eax, byte [r8 - 0xc]
xor al, byte [rcx + r13]
movsx ecx, al
mov rax, qword [rbx]
sub rax, rdi
mov word [rax + r8 - 0xc], cx
mov rax, rbp
movsxd rcx, r9d
inc rcx
mul rcx
shr rdx, 2
imul rax, rdx, 0x106
sub rcx, rax
movzx eax, byte [r8 - 0xa]
xor al, byte [rcx + r13]
mov rcx, qword [rbx]
add rcx, r11
movsx edx, al
mov rax, rbp
mov word [rcx + r8 - 0xc], dx
movsxd rcx, r9d
add rcx, 2
mul rcx
shr rdx, 2
imul rax, rdx, 0x106
sub rcx, rax
movzx eax, byte [r8 - 8]
xor al, byte [rcx + r13]
mov rcx, qword [rbx]
add rcx, r14
movsx edx, al
mov rax, rbp
mov word [rcx + r8 - 0xc], dx
movsxd rcx, r9d
add r9d, 6
add rcx, 3
mul rcx
shr rdx, 2
imul rax, rdx, 0x106
sub rcx, rax
movzx eax, byte [r8 - 6]
xor al, byte [rcx + r13]
mov rcx, qword [rbx]
add rcx, r15
movsx edx, al
lea eax, [r9 - 2]
movsxd rsi, eax
mov word [rcx + r8 - 0xc], dx
cmp rsi, 6
jb 0x1400031e0
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140003340
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
mov ecx, 0x18
call fcn.14000cf9c
xor esi, esi
mov rbx, rax
mov qword [rax], rsi
lea ecx, [rsi + 0x10]
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
call fcn.14000cf9c
mov qword [rbx], rax
lea r8, [rdi + 4]
xorps xmm0, xmm0
mov r9d, 2
mov r10, 0xfffffffffffffffe
mov r11d, r9d
lea rcx, [rax + 0x10]
mov r14d, 4
mov qword [rbx + 0x10], rcx
mov r15d, 6
movups xmmword [rax], xmm0
add rax, 0x10
lea rcx, [0x140046680]
mov r12d, 8
mov qword [rbx + 8], rax
mov ebp, 0xa
sub r10, rdi
sub r11, rdi
sub r14, rdi
sub r15, rdi
sub r12, rdi
sub rbp, rdi
mov r13, 0xfffffffffffffffc
movabs rax, 0x3e88cb3c9484e2b
sub r13, rdi
mul rsi
shr rdx, 2
imul rax, rdx, 0x106
sub rsi, rax
movzx eax, byte [r8 - 4]
xor al, byte [rsi + rcx]
movabs rsi, 0x3e88cb3c9484e2b
mov rcx, qword [rbx]
movsx edx, al
add rcx, r13
mov rax, rsi
mov word [rcx + r8], dx
movsxd rcx, r9d
dec rcx
mul rcx
shr rdx, 2
imul rax, rdx, 0x106
lea rdx, [0x140046680]
sub rcx, rax
movzx eax, byte [r8 - 2]
xor al, byte [rcx + rdx]
mov rcx, qword [rbx]
movsx edx, al
add rcx, r10
mov rax, rsi
mov word [rcx + r8], dx
movsxd rcx, r9d
mul rcx
shr rdx, 2
imul rax, rdx, 0x106
lea rdx, [0x140046680]
sub rcx, rax
movzx eax, byte [r8]
xor al, byte [rcx + rdx]
movsx ecx, al
mov rax, qword [rbx]
sub rax, rdi
mov word [rax + r8], cx
mov rax, rsi
movsxd rcx, r9d
inc rcx
mul rcx
shr rdx, 2
imul rax, rdx, 0x106
lea rdx, [0x140046680]
sub rcx, rax
movzx eax, byte [r8 + 2]
xor al, byte [rcx + rdx]
mov rcx, qword [rbx]
add rcx, r11
movsx edx, al
mov rax, rsi
mov word [rcx + r8], dx
movsxd rcx, r9d
add rcx, 2
mul rcx
shr rdx, 2
imul rax, rdx, 0x106
lea rdx, [0x140046680]
sub rcx, rax
movzx eax, byte [r8 + 4]
xor al, byte [rcx + rdx]
mov rcx, qword [rbx]
add rcx, r14
movsx edx, al
mov rax, rsi
mov word [rcx + r8], dx
movsxd rcx, r9d
add rcx, 3
mul rcx
shr rdx, 2
imul rax, rdx, 0x106
lea rdx, [0x140046680]
sub rcx, rax
movzx eax, byte [r8 + 6]
xor al, byte [rcx + rdx]
mov rcx, qword [rbx]
add rcx, r15
movsx edx, al
mov word [rcx + r8], dx
movsxd rcx, r9d
add rcx, 4
lea r8, [r8 + 0x10]
mov rax, rsi
mul rcx
shr rdx, 2
imul rax, rdx, 0x106
lea rdx, [0x140046680]
sub rcx, rax
movzx eax, byte [r8 - 8]
xor al, byte [rcx + rdx]
mov rcx, qword [rbx]
add rcx, r12
movsx edx, al
mov rax, rsi
mov word [rcx + r8 - 0x10], dx
movsxd rcx, r9d
add r9d, 8
add rcx, 5
mul rcx
shr rdx, 2
imul rax, rdx, 0x106
lea rdx, [0x140046680]
sub rcx, rax
movzx eax, byte [r8 - 6]
xor al, byte [rcx + rdx]
mov rcx, qword [rbx]
add rcx, rbp
movsx edx, al
lea eax, [r9 - 2]
movsxd rsi, eax
movabs rax, 0x3e88cb3c9484e2b
mov word [rcx + r8 - 0x10], dx
lea rcx, [0x140046680]
cmp rsi, 8
jb 0x1400033f2
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret