joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140005d54
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x158]
sub rsp, 0x240
mov rsi, rcx
call fcn.140005b10
test eax, eax
je 0x140005e0f
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x200
call fcn.140015a00
mov r9, qword [0x1400478b8]
lea rcx, [rsp + 0x40]
mov r8d, 0x12
lea r12d, [r8 - 0x11]
mov edx, r12d
call fcn.14001a2f0
cmp rax, 0x12
jne 0x140005e32
lea rax, [rsp + 0x40]
mov qword [0x1400460f0], rax
call fcn.14000207c
mov r15d, eax
call fcn.14000207c
mov r14d, eax
call fcn.14000207c
call fcn.14000207c
call fcn.1400020d4
mov ebx, eax
call fcn.1400020d4
mov edi, eax
call fcn.14000207c
mov edx, eax
cmp rsi, rbx
jl 0x140005e3a
cmp rsi, rdi
jl 0x140005e3a
test r15d, r15d
jne 0x140005e0f
test r14d, r14d
je 0x140005e3a
xor eax, eax
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov edx, dword [rsp + 0x38]
mov edi, dword [rsp + 0x34]
cmp edi, 0xffffffff
jne 0x140005f60
mov rcx, qword [0x1400478b8]
mov eax, 0xffffffd6
sub eax, edx
mov r8d, r12d
movsxd rdx, eax
call fcn.14001a670
mov r9, qword [0x1400478b8]
lea rcx, [rsp + 0x40]
mov r8d, 0x14
mov rdx, r12
call fcn.14001a2f0
cmp byte [rsp + 0x40], 0x50
jne 0x140005f42
cmp byte [rsp + 0x41], 0x4b
jne 0x140005f42
mov bl, 6
cmp byte [rsp + 0x42], bl
jne 0x140005f42
cmp byte [rsp + 0x43], 7
jne 0x140005f42
lea rax, [rsp + 0x48]
mov qword [0x1400460f0], rax
call fcn.140002128
mov rcx, qword [0x1400478b8]
xor r8d, r8d
mov rdx, rax
mov qword [0x140047898], rax
call fcn.14001a670
mov r9, qword [0x1400478b8]
lea rcx, [rsp + 0x40]
mov r8d, 4
mov rdx, r12
call fcn.14001a2f0
cmp byte [rsp + 0x40], 0x50
jne 0x140005f69
cmp byte [rsp + 0x41], 0x4b
jne 0x140005f69
cmp byte [rsp + 0x42], bl
jne 0x140005f69
cmp byte [rsp + 0x43], bl
jne 0x140005f69
mov r9, qword [0x1400478b8]
lea rcx, [rsp + 0x40]
mov r8d, 0x34
mov rdx, r12
call fcn.14001a2f0
cmp rax, 0x34
jne 0x140005f39
lea rax, [rsp + 0x6c]
mov qword [0x1400460f0], rax
call fcn.140002128
mov qword [0x140047898], rax
mov dword [0x1400478a0], r12d
jmp 0x140005f69
and qword [0x140047898], 0
xor r8d, r8d
mov rcx, qword [0x1400478b8]
xor edx, edx
call fcn.14001a670
jmp 0x140005e0f
mov eax, edi
mov qword [0x140047898], rax
mov rcx, qword [0x1400478b8]
xor r8d, r8d
xor edx, edx
call fcn.14001a670
mov rax, qword [0x140047898]
jmp 0x140005e11
Function at 0x140006f24
Capabilities:
Hash data with crc32

Disassembly:
xor r8d, r8d
lea r9, [0x1400478d0]
mov r10d, r8d
mov r11d, 8
mov edx, r10d
mov ecx, r10d
shr edx, 1
mov eax, edx
mov r10d, edx
xor eax, 0xedb88320
and cl, 1
cmovne r10d, eax
add r11d, 0xffffffff
jne 0x140006f37
mov dword [r9], r10d
inc r8d
add r9, 4
cmp r8d, 0x100
jne 0x140006f2e
ret

Function at 0x140006f6c
Capabilities:
Encode data using xor

Disassembly:
mov r9, rdx
not ecx
test r8d, r8d
je 0x140006f98
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
inc r9
lea rdx, [0x1400478d0]
xor ecx, dword [rdx + rax*4]
sub r8d, 1
jne 0x140006f76
not ecx
mov eax, ecx
ret

Function at 0x140006fc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x820
mov r13, rcx
mov rdi, rdx
mov rcx, qword [0x1400478b8]
call fcn.14001b5e4
mov ebx, 0x400
xor edx, edx
mov r8d, ebx
mov rcx, rdi
mov rbp, rax
call fcn.140015a00
mov r8, qword [r13 + 0x48]
xor r15d, r15d
mov byte [r8], r15b
lea r12d, [r15 + 1]
mov r8, qword [r13 + 0x50]
mov word [r8], r15w
mov r9, qword [0x1400478b8]
mov r8, rbx
mov rdx, r12
mov rcx, rdi
call fcn.14001a2f0
test eax, eax
je 0x140007113
cmp eax, 0x14
jbe 0x140007113
lea r14d, [rax - 0x14]
test r14d, r14d
je 0x1400070d7
add rbp, 4
mov ebx, 2
mov rsi, rdi
cmp byte [rsi], 0x50
jne 0x1400070be
lea eax, [rbx - 1]
cmp byte [rax + rdi], 0x4b
jne 0x1400070be
mov eax, ebx
cmp byte [rax + rdi], 3
jne 0x1400070be
lea eax, [rbx + 1]
cmp byte [rax + rdi], 4
jne 0x1400070be
mov rcx, qword [0x1400478b8]
call fcn.14001b5e4
mov rcx, qword [0x1400478b8]
xor r8d, r8d
mov rdx, rbp
mov r15, rax
call fcn.14001a670
lea rdx, [rsp + 0x20]
mov rcx, r13
call fcn.140008288
test eax, eax
jne 0x14000710e
mov rcx, qword [0x1400478b8]
xor r8d, r8d
mov rdx, r15
call fcn.14001a670
add ebx, r12d
add rbp, r12
add rsi, r12
lea eax, [rbx - 2]
cmp eax, r14d
jb 0x14000705b
xor r15d, r15d
mov ebx, 0x400
mov rcx, qword [0x1400478b8]
mov r8d, r12d
mov rdx, 0xffffffffffffffec
call fcn.14001a670
mov rcx, qword [0x1400478b8]
call fcn.14001b5e4
mov r8, rbx
xor edx, edx
mov rcx, rdi
mov rbp, rax
call fcn.140015a00
jmp 0x14000701c
mov rax, r12
jmp 0x140007115
xor eax, eax
lea r11, [rsp + 0x820]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140008288
Capabilities:
Enumerate pe sections
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x120
mov r9, qword [0x1400478b8]
mov rsi, rdx
mov ebp, 1
mov rdi, rcx
mov edx, ebp
mov rcx, rsi
lea r8d, [rbp + 0x19]
call fcn.14001a2f0
cmp rax, 0x1a
jne 0x140008496
movzx eax, byte [rsi]
xor r14d, r14d
movzx r8d, byte [rsi + 1]
shl r8w, 8
or r8w, ax
mov word [rdi], r8w
movzx ecx, byte [rsi + 3]
movzx eax, byte [rsi + 2]
shl cx, 8
or cx, ax
mov word [rdi + 2], cx
movzx ecx, byte [rsi + 5]
movzx eax, byte [rsi + 4]
shl cx, 8
or cx, ax
mov word [rdi + 4], cx
movzx ecx, byte [rsi + 7]
movzx eax, byte [rsi + 6]
shl cx, 8
or cx, ax
mov word [rdi + 6], cx
movzx ecx, byte [rsi + 9]
movzx eax, byte [rsi + 8]
shl cx, 8
or cx, ax
mov word [rdi + 8], cx
movzx eax, byte [rsi + 0xc]
movzx ecx, byte [rsi + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsi + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsi + 0xa]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0xc], ecx
movzx eax, byte [rsi + 0x10]
movzx ecx, byte [rsi + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsi + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsi + 0xe]
shl ecx, 8
movsxd rcx, ecx
or rcx, rax
mov qword [rdi + 0x10], rcx
movzx eax, byte [rsi + 0x14]
movzx ecx, byte [rsi + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsi + 0x13]
shl ecx, 8
or ecx, eax
movzx eax, byte [rsi + 0x12]
shl ecx, 8
movsxd rcx, ecx
or rcx, rax
mov qword [rdi + 0x18], rcx
movzx eax, byte [rsi + 0x16]
movzx edx, byte [rsi + 0x17]
shl dx, 8
or dx, ax
mov word [rdi + 0x20], dx
movzx eax, byte [rsi + 0x18]
movzx ecx, byte [rsi + 0x19]
shl cx, 8
or cx, ax
mov dword [rdi + 0x58], r14d
mov eax, 0x208
mov word [rdi + 0x22], cx
cmp dx, ax
jae 0x140008496
mov r9, qword [0x1400478b8]
mov rcx, qword [rdi + 0x48]
movzx ebx, dx
movzx r8d, dx
mov edx, ebp
call fcn.14001a2f0
cmp rbx, rax
jne 0x140008496
mov rax, qword [rdi + 0x48]
mov byte [rbx + rax], r14b
movzx ebx, word [rdi + 0x22]
test bx, bx
je 0x1400084b6
mov r9, qword [0x1400478b8]
mov r8d, ebx
mov edx, ebp
mov rcx, rsi
call fcn.14001a2f0
movzx ecx, word [rdi + 0x22]
cmp rcx, rax
jne 0x140008496
mov r8d, ebx
mov r9d, ebp
mov rdx, rsi
mov rcx, rdi
call fcn.140005f88
movzx eax, word [rdi + 2]
test ax, ax
je 0x1400084b6
test al, 0x40
je 0x1400084b6
mov ecx, 0xff00
and ax, cx
mov ecx, 0x3300
cmp ax, cx
jne 0x1400084b6
mov rcx, qword [0x140045cc0]
lea r9d, [rbp + 0x7f]
lea r8, [rsp + 0x20]
lea edx, [rbp + 0xc]
call qword [sym.imp.USER32.dll_LoadStringW]
lea r9d, [rbp + 0xf]
xor ecx, ecx
lea r8, str.ZIP_SFX
lea rdx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_MessageBoxW]
or dword [0x140045ccc], 0xffffffff
xor eax, eax
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
mov rcx, qword [0x1400478b8]
call fcn.14001b5e4
mov rdx, rsi
mov rcx, rdi
mov rbx, rax
call fcn.140006ae8
mov dword [rdi + 0x28], eax
xor r8d, r8d
mov rcx, qword [0x1400478b8]
mov rdx, rbx
call fcn.14001a670
mov eax, ebp
jmp 0x140008498
Function at 0x1400084ec
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov qword [rsp + 8], rbp
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x440
xor r14d, r14d
mov rdi, rdx
mov qword [0x140047890], r14
mov rsi, rcx
test rcx, rcx
jne 0x14000852a
mov dword [0x1400478b4], r14d
mov eax, 1
jmp 0x140008695
cmp byte [rcx], r14b
jne 0x140008536
xor eax, eax
jmp 0x140008695
mov rcx, qword [0x1400478b8]
mov dword [0x1400478b4], 1
call fcn.14001b5e4
mov r9d, dword [rdi + 0x58]
mov rbp, rax
test r9d, r9d
je 0x1400085a5
mov r8, qword [rdi + 0x10]
test r8, r8
jne 0x140008567
mov dword [rdi + 0x58], r14d
jmp 0x140008520
mov rcx, qword [0x1400478b8]
mov rdx, rsi
mov dword [rsp + 0x20], r14d
call fcn.140008cc8
cmp rax, 0xffffffffffffffff
jne 0x140008595
mov rcx, qword [0x1400478b8]
xor r8d, r8d
mov rdx, rbp
call fcn.14001a670
jmp 0x14000852f
mov qword [0x140047890], rax
mov qword [rdi + 0x10], rax
jmp 0x140008520
mov dword [0x1400478a8], 0x12345678
mov dword [0x1400478ac], 0x23456789
mov dword [0x1400478b0], 0x34567890
jmp 0x1400085d0
movsx ecx, al
call fcn.1400086b0
inc rsi
mov al, byte [rsi]
test al, al
jne 0x1400085c5
mov r8d, 0x400
lea rdx, [0x1400478d0]
lea rcx, [rsp + 0x40]
call fcn.140015f10
mov r9, qword [0x1400478b8]
lea rcx, [rsp + 0x30]
mov edx, 1
mov esi, r14d
lea r8d, [rdx + 0xb]
call fcn.14001a2f0
cmp rax, 0xc
jne 0x14000867f
mov r10, r14
call fcn.140006fa0
xor byte [rsp + r10 + 0x30], al
movzx ecx, byte [rsp + r10 + 0x30]
call fcn.1400086b0
inc r10
cmp r10, 0xc
jne 0x140008613
test byte [0x140047cdc], 8
movzx eax, byte [0x140047ce1]
movzx edx, byte [0x140047ce7]
cmovne edx, eax
movzx eax, byte [rsp + 0x3b]
cmp eax, edx
je 0x14000867a
cmp dword [rdi + 0xc], r14d
je 0x14000867a
cmp qword [rdi + 0x10], r14
je 0x14000867a
mov r8d, 0x400
lea rdx, [rsp + 0x40]
lea rcx, [0x1400478d0]
call fcn.140015f10
jmp 0x140008581
mov esi, 1
mov rcx, qword [rdi + 0x10]
mov eax, esi
cmp rcx, 0xc
lea rdx, [rcx - 0xc]
cmovle rdx, r14
mov qword [rdi + 0x10], rdx
lea r11, [rsp + 0x440]
mov rbp, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret

Function at 0x1400086b0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov rdx, qword [0x1400478a8]
lea r9, [0x1400478d0]
mov eax, ecx
mov r8d, ecx
xor rdx, rax
movzx eax, dl
mov edx, dword [0x1400478a8]
shr edx, 8
xor edx, dword [r9 + rax*4]
movzx eax, dl
add eax, dword [0x1400478ac]
imul eax, eax, 0x8088405
mov dword [0x1400478a8], edx
inc eax
mov ecx, eax
mov dword [0x1400478ac], eax
movzx eax, byte [0x1400478b0]
shr rcx, 0x18
xor rcx, rax
mov eax, dword [0x1400478b0]
shr eax, 8
xor eax, dword [r9 + rcx*4]
mov dword [0x1400478b0], eax
mov eax, r8d
ret
Function at 0x140008724
Capabilities:
Encode data using xor
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r9, qword [0x1400478b8]
mov rbx, rcx
movsxd r8, edx
mov edx, 1
call fcn.14001a2f0
cmp dword [0x1400478b4], 0
mov rdi, rax
je 0x140008786
cmp qword [0x140047890], 0
je 0x140008767
mov edx, edi
mov rcx, rbx
call fcn.140008ddc
jmp 0x140008786
movsxd r10, edi
test edi, edi
jle 0x140008786
call fcn.140006fa0
xor byte [rbx], al
movzx ecx, byte [rbx]
call fcn.1400086b0
inc rbx
sub r10, 1
jne 0x14000876e
mov rbx, qword [rsp + 0x30]
mov eax, edi
add rsp, 0x20
pop rdi
ret

Function at 0x140008834
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov r8, rcx
lea rax, [rsp]
mov r9, r8
lea rcx, [rsp]
sub r9, rax
mov r10d, InitCommonControls
mov eax, dword [r9 + rcx + 0x1c]
mov edx, eax
ror edx, 8
rol eax, 8
and edx, 0xff00ff00
and eax, 0xff00ff
or edx, eax
mov dword [rcx], edx
lea rcx, [rcx + 4]
sub r10, 1
jne 0x14000886a
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 8]
lea r9d, [r10 + 0x40]
mov eax, dword [rcx + 0x2c]
xor eax, dword [rcx + 0x18]
xor eax, dword [rcx - 8]
xor eax, dword [rcx]
lea rcx, [rcx + 4]
rol eax, 1
mov dword [rdx], eax
lea rdx, [rdx + 4]
sub r9, 1
jne 0x14000889e
mov r15d, dword [r8 + 8]
lea rbp, [rsp]
mov r12d, dword [r8 + 0xc]
mov ebx, 0x14
mov r13d, dword [r8 + 0x10]
mov r14d, ebx
mov r11d, dword [r8 + 0x14]
mov r9d, r15d
mov esi, dword [r8 + 0x18]
mov edi, r12d
mov r10d, r13d
mov edx, r9d
mov eax, r10d
rol r9d, 5
and eax, edi
add esi, 0x5a827999
mov ecx, edi
not ecx
and ecx, r11d
xor ecx, eax
add r9d, ecx
add r9d, dword [rbp]
lea rbp, [rbp + 4]
add r9d, esi
mov esi, r11d
mov r11d, r10d
mov r10d, edi
ror r10d, 2
mov edi, edx
sub r14, 1
jne 0x1400088e4
lea r14, [rsp + 0x50]
mov rbp, rbx
mov edx, r9d
mov ecx, r11d
rol r9d, 5
xor ecx, r10d
xor ecx, edi
lea eax, [rsi + r9]
mov r9d, dword [r14]
add r9d, 0x6ed9eba1
lea r14, [r14 + 4]
add ecx, eax
mov esi, r11d
mov r11d, r10d
add r9d, ecx
mov r10d, edi
mov edi, edx
ror r10d, 2
sub rbp, 1
jne 0x14000892a
lea rbp, [rsp + 0xa0]
mov r14, rbx
mov edx, r9d
mov ecx, r10d
xor ecx, edi
rol r9d, 5
and ecx, r11d
mov eax, r10d
add esi, 0x8f1bbcdc
and eax, edi
add r9d, esi
xor ecx, eax
add ecx, dword [rbp]
mov esi, r11d
mov r11d, r10d
lea rbp, [rbp + 4]
mov r10d, edi
add r9d, ecx
ror r10d, 2
mov edi, edx
sub r14, 1
jne 0x140008970
lea rcx, [rsp + 0xf0]
mov edx, r9d
add esi, 0xca62c1d6
rol r9d, 5
mov eax, r11d
xor eax, r10d
add r9d, esi
xor eax, edi
mov esi, r11d
add eax, dword [rcx]
mov r11d, r10d
mov r10d, edi
lea rcx, [rcx + 4]
add r9d, eax
ror r10d, 2
mov edi, edx
sub rbx, 1
jne 0x1400089b6
add dword [r8 + 0x14], r11d
lea eax, [r15 + r9]
add dword [r8 + 0x18], esi
lea r11, [rsp + 0x140]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov dword [r8 + 8], eax
lea eax, [r12 + rdx]
mov dword [r8 + 0xc], eax
lea eax, [r10 + r13]
mov dword [r8 + 0x10], eax
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140008a34
Capabilities:
Hash data using sha1

Disassembly:
and dword [rcx + 4], 0
and dword [rcx], 0
mov dword [rcx + 8], 0x67452301
mov dword [rcx + 0xc], 0xefcdab89
mov dword [rcx + 0x10], 0x98badcfe
mov dword [rcx + 0x14], 0x10325476
mov dword [rcx + 0x18], 0xc3d2e1f0
ret

Function at 0x140008cc8
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r15
sub rsp, 0x30
movzx esi, r9b
mov rdi, r8
mov r8d, esi
mov dword [0x140047f18], 0x8000
and r8d, 3
mov byte [0x140047f14], sil
mov rbx, rdx
mov rbp, rcx
mov r9, rcx
mov edx, 1
lea rcx, [0x140047f40]
lea r8, [r8*4 + 4]
call fcn.14001a2f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movzx ecx, byte [0x140047f14]
lea r15, [0x140047f30]
mov r8d, eax
lea r9, [0x140047f40]
lea rax, [0x140047d40]
mov rdx, rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
call fcn.14000acd8
test eax, eax
jne 0x140008db4
lea ebx, [rax + 2]
mov r9, rbp
mov r8d, ebx
lea edx, [rax + 1]
lea rcx, [0x140047f20]
call fcn.14001a2f0
mov eax, esi
lea rcx, [0x140047f20]
and eax, 3
mov r8d, ebx
shl rax, 2
mov rdx, r15
sub rdi, rax
sub rdi, 6
call fcn.1400165a0
test eax, eax
jne 0x140008db4
cmp dword [rsp + 0x60], eax
jne 0x140008daf
call fcn.140008cbc
movsxd rcx, eax
sub rdi, rcx
mov rax, rdi
jmp 0x140008db8
or rax, 0xffffffffffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret

Function at 0x140008df0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r8d, dword [0x140047f18]
mov rdi, rdx
mov rbx, rcx
cmp r8d, 0x8000
jne 0x140008e7a
lea rdx, [0x140047d40]
lea rcx, [0x140047f30]
call fcn.14000ae8c
lea edx, [rdi - 0xa]
xor r8d, r8d
mov rcx, rbx
call fcn.14001a708
mov r9, rbx
lea rcx, [0x140047f20]
mov ebx, 0xa
mov r8d, ebx
lea edx, [rbx - 9]
call fcn.14001a2f0
mov r8d, ebx
lea rdx, [0x140047f30]
lea rcx, [0x140047f20]
call fcn.1400165a0
xor r8d, r8d
test eax, eax
je 0x140008e73
lea eax, [rbx - 3]
mov dword [0x140047f18], eax
jmp 0x140008e7d
mov dword [0x140047f18], r8d
mov eax, r8d
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000afd4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r9d, dword [r8 + 0x9c]
mov rbx, r8
mov esi, edx
mov rbp, rcx
cmp r9d, 0xffffffff
je 0x14000b079
cmp r9d, 0x40
jbe 0x14000b01c
lea rdx, [r8 + 0x40]
mov rcx, rbx
call fcn.140008b10
mov r9d, 0x14
mov dword [rbx + 0x9c], r9d
mov r8d, 0x40
mov ecx, r9d
sub r8d, r9d
add rcx, rbx
xor edx, edx
call fcn.140015a00
mov rax, rbx
mov ecx, 4
movdqu xmm0, xmmword [rax]
pxor xmm0, xmmword [str.6666666666666666jjjjjjjjjjjjjjjj]
movdqu xmmword [rax], xmm0
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x14000b03a
lea rdi, [rbx + 0x40]
mov rcx, rdi
call fcn.140008a34
mov r8, rdi
mov edx, 0x40
mov rcx, rbx
call fcn.140008a68
or dword [rbx + 0x9c], 0xffffffff
jmp 0x14000b07d
lea rdi, [r8 + 0x40]
test esi, esi
je 0x14000b08e
mov r8, rdi
mov edx, esi
mov rcx, rbp
call fcn.140008a68
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b0ac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp dword [r8 + 0x9c], 0xffffffff
mov rbx, r8
mov esi, edx
mov rbp, rcx
je 0x14000b0db
xor edx, edx
xor ecx, ecx
call fcn.14000afd4
lea rdi, [rbx + 0x40]
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140008b10
mov rax, rbx
mov ecx, 4
movdqu xmm0, xmmword [rax]
pxor xmm0, xmmword [0x140034dd0]
movdqu xmmword [rax], xmm0
lea rax, [rax + 0x10]
sub rcx, 1
jne 0x14000b0f4
mov rcx, rdi
call fcn.140008a34
mov r8, rdi
mov edx, 0x40
mov rcx, rbx
call fcn.140008a68
mov r8, rdi
lea rcx, [rsp + 0x20]
mov edx, 0x14
call fcn.140008a68
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140008b10
test esi, esi
je 0x14000b159
mov r8, rsi
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.140015f10
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14000b3c8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rbp, [rcx + 0x104]
mov rbx, rcx
mov rdx, rcx
mov edi, 0x104
mov r8d, edi
mov rcx, rbp
xor esi, esi
call fcn.140015f10
mov edx, edi
mov ecx, esi
sub edx, esi
add rcx, rbx
call qword [rbx + 0x210]
add esi, eax
cmp esi, edi
jb 0x14000b3fb
mov rdx, rbx
mov al, byte [rdx + 0x104]
not al
xor byte [rdx], al
inc rdx
sub rdi, 1
jne 0x14000b413
mov rcx, rbx
call fcn.14000b2f4
mov rcx, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.14000b2f4
Function at 0x14000b44c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x158]
sub rsp, 0x230
mov rdi, rcx
mov esi, r9d
lea rcx, [rsp + 0x50]
mov r14, r8
mov ebx, edx
call fcn.14000af28
lea r8, [rsp + 0x50]
mov edx, ebx
mov rcx, rdi
call fcn.14000af3c
mov r8d, 0xa0
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x90]
call fcn.140015f10
lea r8, [rbp + 0x90]
mov edx, esi
mov rcx, r14
call fcn.14000afd4
mov esi, dword [rbp + 0x190]
mov eax, 0xcccccccd
mov ebx, 0
lea ecx, [rsi - 1]
mul ecx
mov r13d, edx
shr r13d, 4
add r13d, 1
je 0x14000b5db
mov r12, qword [rbp + 0x188]
mov r14d, dword [rbp + 0x180]
xor edx, edx
lea rcx, [rsp + 0x38]
lea r8d, [rdx + 0x14]
call fcn.140015a00
mov r8d, 0xa0
lea rdx, [rbp + 0x90]
lea rcx, [rbp - 0x10]
call fcn.140015f10
lea edi, [rbx + 1]
mov r15d, 4
mov eax, edi
shr eax, 0x18
mov byte [rsp + 0x20], al
mov eax, edi
shr eax, 0x10
mov byte [rsp + 0x21], al
mov eax, edi
shr eax, 8
mov byte [rsp + 0x22], al
lea eax, [rbx + 1]
mov byte [rsp + 0x23], al
test r14d, r14d
je 0x14000b5a9
mov rsi, r14
lea r8, [rbp - 0x10]
mov edx, r15d
lea rcx, [rsp + 0x20]
call fcn.14000afd4
mov r15d, 0x14
lea r8, [rbp - 0x10]
mov edx, r15d
lea rcx, [rsp + 0x20]
call fcn.14000b0ac
xor ecx, ecx
mov edx, r15d
mov al, byte [rsp + rcx + 0x20]
xor byte [rsp + rcx + 0x38], al
inc rcx
sub rdx, 1
jne 0x14000b578
mov r8d, 0xa0
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.140015f10
sub rsi, 1
jne 0x14000b54b
mov esi, dword [rbp + 0x190]
lea edx, [rbx + rbx*4]
shl edx, 2
lea r9, [rsp + 0x38]
xor r8d, r8d
cmp edx, esi
jae 0x14000b5d0
mov al, byte [r9]
inc r8d
mov byte [rdx + r12], al
inc r9
inc edx
cmp r8d, 0x14
jb 0x14000b5b7
mov ebx, edi
cmp edi, r13d
jb 0x14000b4f2
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14000b9f0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, r8d
jmp 0x14000b9f0
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r11, r8
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x14000ba19
xor eax, eax
jmp 0x14000bc9e
lea r15, [0x140000000]
not r9d
cmp r8, 0x17
jb 0x14000bc2f
test r10b, 3
je 0x14000ba55
movzx ecx, byte [r10]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc r10
xor r9d, dword [r15 + rax*4 + 0x34de0]
sub r11, 1
jne 0x14000ba2d
movabs rax, 0xcccccccccccccccd
xor edi, edi
mul r11
xor esi, esi
xor ebp, ebp
mov rbx, rdx
xor r14d, r14d
shr rbx, 4
lea rax, [rbx + rbx*4]
shl rax, 2
sub r11, rax
sub rbx, 1
mov qword [rsp + 0x80], r11
mov qword [rsp + 0x88], rbx
je 0x14000bbe8
xor r9d, dword [r10]
lea rdx, [0x140000000]
xor edi, dword [r10 + 4]
mov r12d, 1
xor esi, dword [r10 + 8]
xor ebp, dword [r10 + 0xc]
xor r14d, dword [r10 + 0x10]
movzx eax, r9b
add r10, 0x14
mov r13d, r9d
mov r11d, edi
mov ebx, esi
mov r9d, dword [r15 + rax*4 + 0x351e0]
movzx eax, dil
mov qword [rsp + 0x78], r10
mov edi, dword [r15 + rax*4 + 0x351e0]
movzx eax, sil
mov esi, dword [r15 + rax*4 + 0x351e0]
mov eax, ebp
mov qword [rsp + 0x20], rax
mov r10, qword [rsp + 0x20]
movzx eax, bpl
mov ebp, dword [r15 + rax*4 + 0x351e0]
mov eax, r14d
mov qword [rsp + 0x28], rax
movzx eax, r14b
mov r14d, dword [r15 + rax*4 + 0x351e0]
mov r15d, 0x100
lea eax, [r12*8]
inc r12d
movsxd r8, eax
mov rax, r13
mov rcx, r8
shr rax, cl
movzx ecx, al
mov rax, r11
add rcx, r15
xor r9d, dword [rdx + rcx*4 + 0x351e0]
mov rcx, r8
shr rax, cl
movzx ecx, al
mov rax, rbx
add rcx, r15
xor edi, dword [rdx + rcx*4 + 0x351e0]
mov rcx, r8
shr rax, cl
movzx edx, al
lea rax, [0x140000000]
add rdx, r15
xor esi, dword [rax + rdx*4 + 0x351e0]
mov rax, r10
shr rax, cl
movzx edx, al
lea rax, [0x140000000]
add rdx, r15
xor ebp, dword [rax + rdx*4 + 0x351e0]
lea rdx, [0x140000000]
mov rax, qword [rsp + 0x28]
shr rax, cl
movzx ecx, al
add rcx, r15
add r15, 0x100
xor r14d, dword [rdx + rcx*4 + 0x351e0]
cmp r12d, 4
jl 0x14000bb1e
sub qword [rsp + 0x88], 1
lea r15, [0x140000000]
mov r10, qword [rsp + 0x78]
jne 0x14000ba97
mov r11, qword [rsp + 0x80]
lea r15, [0x140000000]
xor r9d, dword [r10]
mov ecx, r9d
call fcn.14000bd50
xor eax, dword [r10 + 4]
xor eax, edi
mov ecx, eax
call fcn.14000bd50
xor eax, dword [r10 + 8]
xor eax, esi
mov ecx, eax
call fcn.14000bd50
xor eax, dword [r10 + 0xc]
xor eax, ebp
mov ecx, eax
call fcn.14000bd50
xor eax, dword [r10 + 0x10]
xor eax, r14d
mov ecx, eax
call fcn.14000bd50
mov r9d, eax
add r10, 0x14
cmp r11, 8
jb 0x14000bc71
mov rdx, r11
shr rdx, 3
imul rcx, rdx, 0xfffffffffffffff8
add r11, rcx
mov r8d, 8
movzx ecx, byte [r10]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc r10
xor r9d, dword [r15 + rax*4 + 0x34de0]
sub r8, 1
jne 0x14000bc49
sub rdx, 1
jne 0x14000bc43
test r11, r11
je 0x14000bc98
movzx ecx, byte [r10]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc r10
xor r9d, dword [r15 + rax*4 + 0x34de0]
sub r11, 1
jne 0x14000bc76
not r9d
mov eax, r9d
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret