joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1403217e0
Capabilities:
Encode data using xor

Disassembly:
mov r8, qword [rcx]
mov rax, qword [rcx + 8]
mov r10, qword [rcx + 0x18]
mov r9, qword [rcx + 0x10]
xor r11d, r11d
add r8, rax
rol rax, 0xd
xor rax, r8
rol r8, 0x20
add r9, r10
rol r10, 0x10
xor r10, r9
add r8, r10
rol r10, 0x15
xor r10, r8
add r9, rax
rol rax, 0x11
xor rax, r9
rol r9, 0x20
inc r11d
cmp r11d, edx
jne 0x1403217f2
mov qword [rcx + 8], rax
mov qword [rcx], r8
mov qword [rcx + 0x18], r10
mov qword [rcx + 0x10], r9
ret
Function at 0x140352ac4
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov eax, 0xfffffffb
test rcx, rcx
je 0x140352b18
mov r13, rdx
test rdx, rdx
je 0x140352b18
cmp byte [r13], 1
je 0x140352b18
mov rsi, r8
xor eax, eax
test r8, r8
je 0x140352b18
mov r14d, r9d
test r9d, r9d
jle 0x140352b18
mov rbx, rcx
mov rbp, qword [rsp + 0xa0]
mov edi, r14d
shr edi, 4
mov cl, byte [rcx + 0x14]
cmp cl, 2
je 0x140352a7f
mov eax, 0xfffffffb
cmp cl, 1
jne 0x140352b18
test edi, edi
je 0x140352a3c
lea rbx, [r13 + 0x54]
mov r9d, dword [r13 + 0x4c]
mov rcx, rsi
mov rdx, rbp
mov r8, rbx
call fcn.14047c190
add rsi, 0x10
add rbp, 0x10
dec edi
jg 0x140352a1e
mov r8d, r14d
and r8d, 0xf
mov ebx, 0x10
sub ebx, r8d
lea r15, [rsp + 0x20]
mov rcx, r15
mov rdx, rsi
call fcn.1405c3a90
mov rcx, r15
sub rcx, rbx
add rcx, 0x10
mov edx, ebx
mov r8, rbx
call fcn.1405c3ef0
mov r9d, dword [r13 + 0x4c]
add r13, 0x54
mov rcx, r15
jmp 0x140352b02
test edi, edi
je 0x140352ac1
lea r15, [r13 + 0x54]
lea r12, [rsp + 0x20]
mov rax, rbx
mov rbx, rbp
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rax]
xorps xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
mov r9d, dword [r13 + 0x4c]
mov rcx, r12
mov rdx, rbp
mov r8, r15
call fcn.14047c190
add rsi, 0x10
lea rbp, [rbp + 0x10]
mov rax, rbx
dec edi
jg 0x140352a8f
mov eax, r14d
and eax, 0xf
je 0x140352adf
mov edi, eax
xor edx, edx
mov cl, byte [rbx + rdx]
xor cl, byte [rsi + rdx]
mov byte [rsp + rdx + 0x20], cl
inc rdx
cmp rdx, rdi
jne 0x140352acd
mov cl, 0x10
sub cl, al
mov dl, byte [rbx + rax]
xor dl, cl
mov byte [rsp + rax + 0x20], dl
inc rax
cmp rax, 0x10
jne 0x140352ae3
mov r9d, dword [r13 + 0x4c]
add r13, 0x54
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov r8, r13
call fcn.14047c190
add r14d, 0x10
and r14d, 0xfffffff0
mov eax, r14d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1403569b0
Capabilities:
Get hostname

Disassembly:
mov r8d, 1
mov r9d, 1
jmp 0x1403569d0
Function at 0x140356ad0
Capabilities:
Get hostname

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x248
mov rdi, rdx
mov rsi, rcx
mov byte [rcx], 0
test r8d, r8d
je 0x140356a93
xor eax, eax
test r9d, r9d
setne al
lea ecx, [rax + rax]
add ecx, 5
lea r8, [rsp + 0x2c]
mov dword [r8], 0x100
lea r14, [rsp + 0x40]
mov rdx, r14
call sub.KERNEL32.dll_GetComputerNameExW
mov ebx, 0xffff
test eax, eax
je 0x140356aa6
lea rcx, [rsp + 0x38]
mov qword [rcx], r14
mov eax, dword [rsp + 0x2c]
inc eax
mov dword [rsp + 0x2c], eax
lea r8, [rsp + 0x30]
mov qword [r8], rsi
add rdi, rsi
lea rdx, [rsp + rax*2]
add rdx, 0x40
mov dword [rsp + 0x20], 0
mov r9, rdi
call fcn.1401fee30
test eax, eax
jne 0x140356aa6
mov cl, byte [rsi]
test cl, cl
je 0x140356aa6
xor eax, eax
mov rdx, rsi
lea ebx, [rcx - 0x41]
cmp bl, 0x19
ja 0x140356a73
add cl, 0x20
mov byte [rdx], cl
lea rdx, [rsi + rax]
add rdx, 1
inc rax
mov cl, byte [rdx]
test cl, cl
jne 0x140356a66
xor eax, eax
cmp byte [rsi], 0
mov ebx, 0xffff
cmovne ebx, eax
jmp 0x140356aa6
mov ecx, 6
test r9d, r9d
jne 0x1403569fc
mov ebx, 0x16
mov eax, ebx
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r14
ret
mov r8d, 1
xor r9d, r9d
jmp 0x1403569d0
Function at 0x14037411d
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov r14, rdx
mov rsi, rcx
lea rdi, [rsp + 0x20]
xor ebx, ebx
mov r8d, 0x30
mov rcx, rdi
xor edx, edx
call fcn.1401ee070
lea r15, [rsi + 0x28]
xor ebp, ebp
mov eax, 0x10
test rax, rax
je 0x140374155
inc byte [rsi + rax - 1]
lea rax, [rax - 1]
je 0x140374146
mov rcx, r15
mov edx, 1
mov r8, rsi
mov r9, rdi
call fcn.14049c230
test eax, eax
je 0x140374171
mov r12d, eax
jmp 0x1403741c6
add rdi, 0x10
add ebp, 0x10
cmp ebp, 0x30
jb 0x140374141
movups xmm0, xmmword [r14 + rbx]
xorps xmm0, xmmword [rsp + rbx + 0x20]
movaps xmmword [rsp + rbx + 0x20], xmm0
add rbx, 0x10
cmp rbx, 0x30
jne 0x14037417d
lea rdx, [rsp + 0x20]
mov rcx, r15
mov r8d, 0x100
call fcn.14049b2a0
mov r12d, eax
test eax, eax
jne 0x1403741c6
lea rdx, [rsp + 0x40]
mov r8d, 0x10
mov rcx, rsi
call fcn.1401fed70
xor r12d, r12d
lea rcx, [rsp + 0x20]
mov edx, 0x30
call fcn.14048a010
mov eax, r12d
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1403bdd80
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
mov r10, rdx
lea rax, [rdx + 2]
movabs rsi, 0xaaaaaaaaaaaaaaab
mul rsi
movabs rax, 0x7ffffffffffffffe
and rax, rdx
lea rdx, [rax + rax]
add rdx, 1
mov eax, 0x54
cmp qword [r9], rdx
jb 0x1403bdea3
mov rax, r10
mul rsi
shr rdx, 1
lea r11, [rdx + rdx*2]
xor eax, eax
test r11, r11
jne 0x1403bddd3
mov rdx, r8
jmp 0x1403bde3b
lea rsi, [0x1405ff9b0]
mov rdx, r8
movzx edi, byte [rcx]
shr rdi, 2
mov bl, byte [rdi + rsi]
mov byte [rdx], bl
movzx edi, byte [rcx]
shl rdi, 4
movzx ebx, byte [rcx + 1]
shr rbx, 4
and edi, 0x30
or rdi, rbx
mov bl, byte [rsi + rdi]
mov byte [rdx + 1], bl
movzx edi, byte [rcx + 1]
movzx ebx, byte [rcx + 2]
shr rbx, 6
and edi, 0xf
lea rdi, [rbx + rdi*4]
mov bl, byte [rsi + rdi]
mov byte [rdx + 2], bl
movzx edi, byte [rcx + 2]
and edi, 0x3f
mov bl, byte [rdi + rsi]
mov byte [rdx + 3], bl
add rdx, 4
add rcx, 3
add rax, 3
cmp rax, r11
jb 0x1403bdddd
cmp rax, r10
jae 0x1403bde9b
movzx esi, byte [rcx]
inc rax
xor r11d, r11d
cmp rax, r10
jae 0x1403bde53
movzx r11d, byte [rcx + 1]
mov rdi, rsi
shr rdi, 2
shl rsi, 4
mov ecx, r11d
shr rcx, 4
and esi, 0x30
or rsi, rcx
lea rcx, [0x1405ff9b0]
mov bl, byte [rdi + rcx]
mov byte [rdx], bl
mov bl, byte [rcx + rsi]
mov byte [rdx + 1], bl
mov bl, 0x3d
cmp rax, r10
jae 0x1403bde90
shl r11d, 2
and r11d, 0x3c
mov bl, byte [r11 + rcx]
mov byte [rdx + 2], bl
mov byte [rdx + 3], 0x3d
add rdx, 4
mov byte [rdx], 0
sub edx, r8d
xor eax, eax
mov qword [r9], rdx
pop rbx
pop rdi
pop rsi
ret

Function at 0x140439dc0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r9
mov r14, r8
mov r15, rdx
mov rdi, rcx
xor ebx, ebx
mov r8d, 0xc
xor edx, edx
call fcn.1401ee070
mov rcx, rdi
mov rdx, r15
mov r8, r14
call fcn.1401fed70
mov al, byte [rsi + rbx]
xor byte [rdi + rbx + 4], al
inc rbx
cmp rbx, 8
jne 0x140439df4
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14047c11f
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
cmp edx, 2
jl 0x14047c183
mov r8d, edx
mov edx, 1
lea r9, [0x140652ef0]
lea r10, [0x1406532f0]
lea r11, [0x1406536f0]
lea r14, [0x140653af0]
mov rsi, rdx
shl rsi, 4
movzx edi, byte [rcx + rsi]
movzx ebx, byte [rcx + rsi + 1]
mov ebx, dword [r10 + rbx*4]
xor ebx, dword [r9 + rdi*4]
movzx edi, byte [rcx + rsi + 2]
movzx eax, byte [rcx + rsi + 3]
xor ebx, dword [r11 + rdi*4]
xor ebx, dword [r14 + rax*4]
mov dword [rcx + rsi], ebx
movzx eax, byte [rcx + rsi + 4]
movzx edi, byte [rcx + rsi + 5]
mov edi, dword [r10 + rdi*4]
xor edi, dword [r9 + rax*4]
movzx eax, byte [rcx + rsi + 6]
movzx ebx, byte [rcx + rsi + 7]
xor edi, dword [r11 + rax*4]
xor edi, dword [r14 + rbx*4]
mov dword [rcx + rsi + 4], edi
movzx eax, byte [rcx + rsi + 8]
movzx edi, byte [rcx + rsi + 9]
mov edi, dword [r10 + rdi*4]
xor edi, dword [r9 + rax*4]
movzx eax, byte [rcx + rsi + 0xa]
movzx ebx, byte [rcx + rsi + 0xb]
xor edi, dword [r11 + rax*4]
xor edi, dword [r14 + rbx*4]
mov dword [rcx + rsi + 8], edi
movzx eax, byte [rcx + rsi + 0xc]
movzx edi, byte [rcx + rsi + 0xd]
mov edi, dword [r10 + rdi*4]
xor edi, dword [r9 + rax*4]
movzx eax, byte [rcx + rsi + 0xe]
xor edi, dword [r11 + rax*4]
movzx eax, byte [rcx + rsi + 0xf]
xor edi, dword [r14 + rax*4]
mov dword [rcx + rsi + 0xc], edi
inc rdx
cmp rdx, r8
jne 0x14047c0d2
xor eax, eax
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14047cf70
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0xc78
xorps xmm0, xmm0
movups xmmword [r8], xmm0
mov dword [r8 + 0x10], 0
mov eax, dword [rdx + 0x10]
mov dword [rsp + 0x10], eax
movups xmm0, xmmword [rdx]
movaps xmmword [rsp], xmm0
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0x20], xmm0
mov eax, dword [rcx + 0x10]
mov dword [rsp + 0x30], eax
mov r10d, 1
mov r9d, 5
lea rax, [r10 - 1]
xor edx, edx
lea rcx, [rax + rax*4]
lea rcx, [rsp + rcx*4]
add rcx, 0x20
mov esi, dword [rcx + rdx*4]
lea r11, [r10 + r10*4]
lea rcx, [rsp + r11*4]
add rcx, 0x20
mov dword [rcx + rdx*4], esi
inc rdx
cmp rdx, r9
jne 0x14047cfb7
mov edx, dword [rsp + r11*4 + 0x30]
and edx, 1
shl edx, 0x1d
xor eax, eax
mov esi, dword [rcx + rax*4]
mov edi, esi
shr edi, 1
or edi, edx
shl esi, 0x1f
mov dword [rcx + rax*4], edi
inc rax
mov edx, esi
cmp rax, r9
jne 0x14047cfea
and byte [rsp + r11*4 + 0x23], 0x3f
inc r10
cmp r10, 0x9e
jne 0x14047cfb1
movsx rcx, word [0x1406cab50]
xor eax, eax
lea rcx, [rcx + rcx*4]
lea rcx, [rsp + rcx*4]
add rcx, 0x20
mov edx, dword [rcx + rax*4]
and edx, dword [rsp + rax*4]
mov dword [r8 + rax*4], edx
inc rax
cmp rax, 5
jne 0x14047d02b
mov r11d, 1
mov r9d, 0x3fffffff
lea r10, [0x1406cab50]
mov ecx, dword [rsp + 0x10]
and ecx, 1
shl ecx, 0x1d
xor eax, eax
mov edx, dword [rsp + rax*4]
mov esi, edx
shr esi, 1
or esi, ecx
shl edx, 0x1f
mov dword [rsp + rax*4], esi
inc rax
mov ecx, edx
cmp rax, 5
jne 0x14047d05d
mov eax, dword [rsp]
and eax, r9d
mov dword [rsp], eax
movsx rcx, word [r10 + r11*2]
movsx rdx, word [r10 + r11*2 + 0x27a]
lea rcx, [rcx + rcx*4]
lea rdx, [rdx + rdx*4]
mov esi, dword [rsp + rdx*4 + 0x20]
xor esi, dword [rsp + rcx*4 + 0x20]
and esi, eax
xor dword [r8], esi
xor eax, eax
lea rsi, [rax*4]
or rsi, 4
movups xmm0, xmmword [rsp + rsi]
lea rdi, [rsp + rcx*4]
add rdi, 0x20
movups xmm1, xmmword [rsi + rdi]
lea rdi, [rsp + rdx*4 + 0x20]
movups xmm2, xmmword [rsi + rdi]
xorps xmm2, xmm1
andps xmm2, xmm0
movups xmm0, xmmword [r8 + rsi]
xorps xmm0, xmm2
movups xmmword [r8 + rsi], xmm0
test rax, rax
lea rax, [rax + 4]
jne 0x14047d0a5
inc r11
cmp r11, 0x9e
jne 0x14047d051
add rsp, 0xc78
pop rdi
pop rsi
ret
Function at 0x14047d100
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov rax, rcx
cmp edx, 0x13d
jne 0x14047d12c
xor ecx, ecx
mov edx, dword [rax + rcx*4]
mov dword [r8 + rcx*4], edx
inc rcx
cmp rcx, 0xa
jne 0x14047d117
jmp 0x14047d239
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x10], xmm0
movaps xmmword [rsp], xmm0
mov dword [rsp + 0x50], 0
mov ecx, edx
shr ecx, 5
movsx r11, cx
mov r10d, 0x14
sub r10, r11
and dx, 0x1f
jne 0x14047d187
mov ecx, 9
mov edx, r10d
mov ebp, dword [rax + rcx*4]
movsx rbx, dx
or dword [rsp + rbx*4], ebp
lea edx, [rdx - 1]
test rcx, rcx
lea rcx, [rcx - 1]
jg 0x14047d16f
jmp 0x14047d1d5
mov ecx, 0x20
sub ecx, edx
movzx r9d, dx
movzx r14d, cx
movsx rcx, r10w
mov ebx, dword [rsp + rcx*4]
mov esi, 9
mov edi, r10d
mov ebp, dword [rax + rsi*4]
mov edx, ebp
mov ecx, r9d
shl edx, cl
or edx, ebx
movsx rbx, di
lea edi, [rdi - 1]
mov ecx, r14d
shr ebp, cl
mov dword [rsp + rbx*4], edx
movsx rcx, di
or ebp, dword [rsp + rcx*4]
mov dword [rsp + rcx*4], ebp
mov ebx, ebp
test rsi, rsi
lea rsi, [rsi - 1]
jg 0x14047d1a5
cmp r11, 0x14
ja 0x14047d215
mov ax, 0x14
mov dx, 0xb
mov ecx, 0x14
movsx rbp, dx
lea edx, [rdx - 1]
mov ebp, dword [rsp + rbp*4]
shr ebp, 0x1d
or ebp, dword [rsp + rcx*4]
mov dword [rsp + rcx*4], ebp
movsx rbx, dx
mov ebx, dword [rsp + rbx*4]
shl ebx, 3
or ebx, ebp
mov dword [rsp + rcx*4], ebx
dec eax
movsx rcx, ax
cmp r10, rcx
jbe 0x14047d1e8
mov eax, dword [rsp + 0x2c]
shl eax, 3
sar eax, 0x1f
xor ecx, ecx
mov edx, dword [rsp + rcx*4 + 0x2c]
xor edx, eax
mov dword [r8 + rcx*4], edx
inc rcx
cmp rcx, 0xa
jne 0x14047d221
and byte [r8 + 3], 0xf
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14048a470
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x60
mov ebp, 0xffffaf00
test rcx, rcx
je 0x14048a578
mov r14, rcx
mov rax, qword [rcx]
test rax, rax
je 0x14048a578
mov rsi, qword [r14 + 0x10]
test rsi, rsi
je 0x14048a578
mov rbx, r8
mov rdi, rdx
movzx r8d, byte [rax + 0xd]
cmp r8, rbx
jae 0x14048a504
mov rcx, r14
call fcn.14048a250
mov ebp, eax
test eax, eax
jne 0x14048a569
mov rcx, r14
mov rdx, rdi
mov r8, rbx
call fcn.14048a2e0
mov ebp, eax
test eax, eax
jne 0x14048a569
lea rdi, [rsp + 0x20]
mov rcx, r14
mov rdx, rdi
call fcn.14048a350
mov ebp, eax
test eax, eax
jne 0x14048a569
mov rax, qword [r14]
mov rsi, qword [r14 + 0x10]
movzx ebx, byte [rax + 0xc]
movzx r8d, byte [rax + 0xd]
lea rbp, [rsi + r8]
mov rcx, rsi
mov edx, 0x36
call fcn.1401ee070
mov rax, qword [r14]
movzx r8d, byte [rax + 0xd]
mov rcx, rbp
mov edx, 0x5c
call fcn.1401ee070
test rbx, rbx
je 0x14048a546
xor eax, eax
mov cl, byte [rdi + rax]
xor byte [rsi + rax], cl
mov cl, byte [rdi + rax]
xor byte [rbp + rax], cl
inc rax
cmp rax, rbx
jne 0x14048a531
mov rcx, r14
call fcn.14048a250
mov ebp, eax
test eax, eax
jne 0x14048a569
mov rax, qword [r14]
movzx r8d, byte [rax + 0xd]
mov rcx, r14
mov rdx, rsi
call fcn.14048a2e0
mov ebp, eax
lea rcx, [rsp + 0x20]
mov edx, 0x40
call fcn.14048a010
mov eax, ebp
add rsp, 0x60
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
Function at 0x14048c170
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
test edx, edx
sete al
movd xmm0, eax
pshufd xmm0, xmm0, 0
pslld xmm0, 0x1f
psrad xmm0, 0x1f
movdqa xmm1, xmm0
pandn xmm1, xmmword [0x1405ff8a0]
movdqa xmm2, xmmword [0x1405ff880]
pand xmm2, xmm0
por xmm2, xmm1
movdqa xmm1, xmm0
pandn xmm1, xmmword [0x1405ff8b0]
mov qword [rcx], 0
pand xmm0, xmmword [0x1405ff890]
por xmm0, xmm1
movdqu xmmword [rcx + 8], xmm2
movdqu xmmword [rcx + 0x18], xmm0
mov dword [rcx + 0x68], edx
xor eax, eax
ret
Function at 0x14048de20
Capabilities:
Encode data using xor

Disassembly:
push rax
mov byte [rsp + 7], 0
test r8, r8
je 0x14048de45
xor r10d, r10d
mov r9b, byte [rcx + r10]
mov al, byte [rdx + r10]
xor al, r9b
or byte [rsp + 7], al
inc r10
cmp r10, r8
jne 0x14048de2e
mov al, byte [rsp + 7]
movzx eax, al
pop rcx
ret

Function at 0x14048dfe0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
mov rbp, qword [rcx + 8]
mov eax, 0xfffffffc
cmp rbp, qword [rdx + 8]
jne 0x14048e0cc
mov r9d, dword [rcx]
shr r9d, 1
mov r10d, dword [rdx]
shr r10d, 1
xor r10d, r9d
and r10d, 1
mov ebx, r10d
and ebx, r9d
mov dword [r8], ebx
mov r11, qword [rcx + 8]
xor eax, eax
test r11, r11
je 0x14048e0cc
movabs r14, 0x8000000000000000
mov r15d, r9d
xor r15d, 1
mov rbp, qword [rcx + 0x10]
mov r12, qword [rbp + r11*8 - 8]
mov rsi, qword [rdx + 0x10]
mov rdi, qword [rsi + r11*8 - 8]
mov rsi, rdi
xor rsi, r12
sub rdi, r12
mov rbp, rsi
xor rbp, r14
and rbp, rdi
and rsi, r12
or rsi, rbp
shr rsi, 0x3f
mov ebp, 1
sub ebp, r10d
and ebp, r9d
and ebp, esi
or ebp, ebx
mov dword [r8], ebp
or r10d, esi
mov rsi, qword [rdx + 0x10]
mov r12, qword [rsi + r11*8 - 8]
mov rdi, qword [rcx + 0x10]
mov rbx, qword [rdi + r11*8 - 8]
lea r11, [r11 - 1]
mov rdi, rbx
xor rdi, r12
sub rbx, r12
mov rsi, rdi
xor rsi, r14
and rsi, rbx
and rdi, r12
or rdi, rsi
shr rdi, 0x3f
mov ebx, 1
sub ebx, r10d
and ebx, r15d
and ebx, edi
or ebx, ebp
mov dword [r8], ebx
or r10d, edi
test r11, r11
jne 0x14048e039
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140499760
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov eax, 0xffffffd2
test rcx, rcx
je 0x140499902
mov rsi, rcx
mov qword [rsp + 0x28], rdx
lea rdi, [0x1406048a0]
lea rax, [0x140654b48]
lea r12, [0x1406050f0]
lea rbx, [0x140605180]
lea r13, [0x1406051d0]
lea r15, [fcn.140499e60]
imul r15d, r15d
and r15d, 3
mov r14d, 1
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rdi
xor r8d, r8d
xor eax, eax
cmp r15d, r14d
seta al
mov ecx, eax
not ecx
and ecx, 0x551
lea edi, [rax + rcx*2]
add edi, 0x47eeea8e
xor edi, dword [r13 + r8*4]
mov ecx, edi
and cl, 7
mov r11d, 1
shl r11d, cl
mov rbp, qword [r12 + r8*8]
movzx eax, cl
xor cl, 7
mov edx, 1
shl edx, cl
mov r10d, dword [rbx + r8*4]
lea esi, [r10 - 1]
movzx ecx, byte [rbp + rsi]
bt ecx, eax
jb 0x1404998ab
mov al, byte [rbp + rsi]
mov ecx, eax
or cl, dl
lock cmpxchg byte [rbp + rsi], cl
jne 0x140499829
movzx eax, al
test edx, eax
je 0x140499848
movzx eax, byte [rbp + rsi]
test r11d, eax
je 0x14049983c
jmp 0x1404998ab
movzx eax, byte [rbp + rsi]
test r11d, eax
jne 0x1404998a5
add r10d, 0xfffffffc
shr r10d, 2
je 0x14049988f
xor eax, eax
mov rbx, rbp
mov r9d, dword [rbx]
xor r9d, edi
mov r12d, edi
mov ecx, eax
shl r12d, cl
and cl, 0x1f
xor cl, 0x1f
shr edi, cl
mov dword [rbx], r9d
or edi, r12d
not r9d
imul edi, r9d
add rbx, 4
inc eax
cmp eax, r10d
jne 0x140499861
or byte [rbp + rsi], r11b
lea rbx, [0x1406050f0]
mov r12, rbx
lea rbx, [0x140605180]
not dl
and byte [rbp + rsi], dl
inc r8
cmp r8, 0x12
jne 0x1404997d0
mov rdi, qword [rsp + 0x40]
mov r8, qword [rdi + 8]
mov rsi, qword [rsp + 0x30]
cmp r8, qword [rsi + 8]
jne 0x1404998de
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rsp + 0x38]
call fcn.1401ff280
test eax, eax
je 0x1404998f6
mov rax, qword [rdi + 0x28]
add rdi, 0x28
test rax, rax
jne 0x1404997c3
mov eax, 0xffffffd2
jmp 0x140499902
mov eax, dword [rdi + 0x20]
mov rcx, qword [rsp + 0x28]
mov dword [rcx], eax
xor eax, eax
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140499cb0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, rcx
xor r12d, r12d
lea r8, [0x140605430]
lea r9, [0x140605570]
lea r10, [0x140605390]
lea r11, [0x14049a1d0]
mov r15d, 3
sub r15d, r11d
xor eax, eax
mov ecx, r15d
xor ecx, r11d
sete al
mov ecx, eax
xor ecx, 0x88e9b659
lea esi, [rcx + rax*2]
add esi, 0x1304
xor esi, dword [r10 + r12*4]
mov ecx, esi
and cl, 7
mov ebp, 1
shl ebp, cl
mov rbx, qword [r8 + r12*8]
movzx eax, cl
xor cl, 7
mov edx, 1
shl edx, cl
mov r13d, dword [r9 + r12*4]
lea edi, [r13 - 1]
movzx ecx, byte [rbx + rdi]
bt ecx, eax
jb 0x140499dbf
mov al, byte [rbx + rdi]
mov ecx, eax
or cl, dl
lock cmpxchg byte [rbx + rdi], cl
jne 0x140499d40
movzx eax, al
test edx, eax
je 0x140499d5c
movzx eax, byte [rbx + rdi]
test ebp, eax
je 0x140499d52
jmp 0x140499dbf
movzx eax, byte [rbx + rdi]
test ebp, eax
jne 0x140499dba
add r13d, 0xfffffffc
shr r13d, 2
je 0x140499da1
xor eax, eax
mov r8, rbx
mov r9d, dword [r8]
xor r9d, esi
mov r10d, esi
mov ecx, eax
shl r10d, cl
and cl, 0x1f
xor cl, 0x1f
shr esi, cl
mov dword [r8], r9d
or esi, r10d
not r9d
imul esi, r9d
add r8, 4
inc eax
cmp eax, r13d
jne 0x140499d73
or byte [rbx + rdi], bpl
lea r8, [0x140605430]
lea r9, [0x140605570]
lea r10, [0x140605390]
not dl
and byte [rbx + rdi], dl
inc r12
cmp r12, 0x27
jne 0x140499ceb
test r14, r14
jne 0x140499dd5
xor edi, edi
jmp 0x140499e0e
lea rsi, [0x140604110]
lea rcx, [0x140654f85]
xor edi, edi
mov r8, qword [rsi + 8]
cmp r8, qword [r14 + 8]
jne 0x140499dfc
mov rdx, qword [r14 + 0x10]
call fcn.1401ff280
test eax, eax
je 0x140499e0b
mov rcx, qword [rsi + 0x28]
add rsi, 0x28
test rcx, rcx
jne 0x140499de5
jmp 0x140499e0e
mov rdi, rsi
mov rax, rdi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140499e60
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov eax, 0xffffffd2
test rcx, rcx
je 0x140499ff5
mov rsi, rcx
mov qword [rsp + 0x28], rdx
lea rbx, [0x140604340]
lea rax, [0x140655378]
lea r12, [0x1406056e0]
lea rdi, [0x140605730]
lea r13, [0x1406056b0]
lea r15, [0x140499920]
imul r15d, r15d
and r15d, 3
mov r14d, 1
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
xor r8d, r8d
xor ebp, ebp
cmp r15d, r14d
seta bpl
or ebp, 0x43d2081c
add ebp, 0xd40
xor ebp, dword [r13 + r8*4]
mov ecx, ebp
and cl, 7
mov r11d, 1
shl r11d, cl
mov rbx, qword [r12 + r8*8]
movzx eax, cl
xor cl, 7
mov edx, 1
shl edx, cl
mov r10d, dword [rdi + r8*4]
lea esi, [r10 - 1]
movzx ecx, byte [rbx + rsi]
bt ecx, eax
jb 0x140499f9e
mov al, byte [rbx + rsi]
mov ecx, eax
or cl, dl
lock cmpxchg byte [rbx + rsi], cl
jne 0x140499f21
movzx eax, al
test edx, eax
je 0x140499f3e
movzx eax, byte [rbx + rsi]
test r11d, eax
je 0x140499f33
jmp 0x140499f9e
movzx eax, byte [rbx + rsi]
test r11d, eax
jne 0x140499f99
add r10d, 0xfffffffc
shr r10d, 2
je 0x140499f84
xor eax, eax
mov rdi, rbx
mov r9d, dword [rdi]
xor r9d, ebp
mov r12d, ebp
mov ecx, eax
shl r12d, cl
and cl, 0x1f
xor cl, 0x1f
shr ebp, cl
mov dword [rdi], r9d
or ebp, r12d
not r9d
imul ebp, r9d
add rdi, 4
inc eax
cmp eax, r10d
jne 0x140499f56
or byte [rbx + rsi], r11b
lea rdi, [0x1406056e0]
mov r12, rdi
lea rdi, [0x140605730]
not dl
and byte [rbx + rsi], dl
inc r8
cmp r8, 9
jne 0x140499ed0
mov rbx, qword [rsp + 0x40]
mov r8, qword [rbx + 8]
mov rsi, qword [rsp + 0x30]
cmp r8, qword [rsi + 8]
jne 0x140499fd1
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rsp + 0x38]
call fcn.1401ff280
test eax, eax
je 0x140499fe9
mov rax, qword [rbx + 0x28]
add rbx, 0x28
test rax, rax
jne 0x140499ec3
mov eax, 0xffffffd2
jmp 0x140499ff5
mov eax, dword [rbx + 0x20]
mov rcx, qword [rsp + 0x28]
mov dword [rcx], eax
xor eax, eax
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14049a010
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov eax, 0xffffffd2
test rcx, rcx
je 0x14049a1b4
mov rsi, rcx
mov qword [rsp + 0x28], rdx
lea rdi, [0x1406043e0]
lea rcx, [0x140655428]
lea r12, [0x1406057b0]
lea rbx, [0x1406057e0]
lea r13, [0x140605790]
lea rax, [0x14049a6a0]
mov r15d, eax
and r15d, 1
xor r15d, eax
mov r14d, 0xffffffff
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdi
xor r8d, r8d
xor eax, eax
cmp r15d, r14d
sete al
mov ecx, eax
not ecx
and ecx, 0x829
lea edi, [rax + rcx*2]
add edi, 0x746e4342
xor edi, dword [r13 + r8*4]
mov ecx, edi
and cl, 7
mov r11d, 1
shl r11d, cl
mov rbp, qword [r12 + r8*8]
movzx eax, cl
xor cl, 7
mov edx, 1
shl edx, cl
mov r10d, dword [rbx + r8*4]
lea esi, [r10 - 1]
movzx ecx, byte [rbp + rsi]
bt ecx, eax
jb 0x14049a15d
mov al, byte [rbp + rsi]
mov ecx, eax
or cl, dl
lock cmpxchg byte [rbp + rsi], cl
jne 0x14049a0db
movzx eax, al
test edx, eax
je 0x14049a0fa
movzx eax, byte [rbp + rsi]
test r11d, eax
je 0x14049a0ee
jmp 0x14049a15d
movzx eax, byte [rbp + rsi]
test r11d, eax
jne 0x14049a157
add r10d, 0xfffffffc
shr r10d, 2
je 0x14049a141
xor eax, eax
mov rbx, rbp
mov r9d, dword [rbx]
xor r9d, edi
mov r12d, edi
mov ecx, eax
shl r12d, cl
and cl, 0x1f
xor cl, 0x1f
shr edi, cl
mov dword [rbx], r9d
or edi, r12d
not r9d
imul edi, r9d
add rbx, 4
inc eax
cmp eax, r10d
jne 0x14049a113
or byte [rbp + rsi], r11b
lea rbx, [0x1406057b0]
mov r12, rbx
lea rbx, [0x1406057e0]
not dl
and byte [rbp + rsi], dl
inc r8
cmp r8, 5
jne 0x14049a082
mov rdi, qword [rsp + 0x40]
mov r8, qword [rdi + 8]
mov rsi, qword [rsp + 0x30]
cmp r8, qword [rsi + 8]
jne 0x14049a190
mov rdx, qword [rsi + 0x10]
mov rcx, qword [rsp + 0x38]
call fcn.1401ff280
test eax, eax
je 0x14049a1a8
mov rcx, qword [rdi + 0x28]
add rdi, 0x28
test rcx, rcx
jne 0x14049a075
mov eax, 0xffffffd2
jmp 0x14049a1b4
mov eax, dword [rdi + 0x20]
mov rcx, qword [rsp + 0x28]
mov dword [rcx], eax
xor eax, eax
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret