joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400172b0
Capabilities:
Get system information on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x14004b008]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edi, edi
mov rsi, rcx
cmp qword [rcx + 0x18], 8
mov qword [rcx + 0x10], rdi
jb 0x1400172e9
mov rax, qword [rcx]
jmp 0x1400172ec
mov rax, rsi
lea rcx, [rsp + 0x40]
mov word [rax], di
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
movzx eax, word [rsp + 0x40]
cmp ax, 9
je 0x140017313
cmp ax, 6
je 0x140017313
mov ebx, dword [0x14004bbc8]
jmp 0x14001731e
mov ebx, 0xf013f
mov dword [0x14004bbc8], ebx
xor edx, edx
lea rcx, [rsp + 0x70]
mov r8d, 0x208
call fcn.14001c790
mov rcx, qword [0x14004bbd0]
lea rax, [rsp + 0x38]
mov r9d, ebx
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x30], 0x104
lea rdx, str.SOFTWAREAtherosVistaAddOn
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400173e1
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.InstallDir
lea rax, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1400173e1
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x1400173e1
cmp word [rsp + 0x70], di
je 0x1400173ca
lea rax, [rsp + 0x70]
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1400173c0
mov r8, rdi
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.14000c490
mov eax, 1
jmp 0x1400173e3
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140019260
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140018690
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x50
mov rax, qword [0x14004b008]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
lea rcx, [0x14004bde8]
xor r8d, r8d
xor edx, edx
lea r9d, [rbp + 0x10]
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsW]
mov rsi, rax
test rax, rax
je 0x1400187cb
xor eax, eax
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x28]
xor edx, edx
mov dword [rsp + 0x28], 0x20
mov rcx, rsi
mov qword [rsp + 0x30], rax
mov edi, ebp
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
je 0x1400187bb
mov qword [rsp + 0x60], rbx
nop
mov r8d, dword [rsp + 0x3c]
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov dword [rsp + 0x24], 0xff
lea rcx, [rsp + 0x24]
mov dword [rsp + 0x20], 0xff
call qword [sym.imp.CFGMGR32.dll_CM_Get_DevNode_Status]
mov edx, eax
lea rcx, str.The_status_of_uResult_is__d__n
mov ebx, eax
call fcn.14000db40
mov edx, dword [rsp + 0x20]
lea rcx, str.The_status_of_uProblem_is__d__n
call fcn.14000db40
test ebx, ebx
je 0x1400187a4
xor eax, eax
lea rcx, str.The_MemberIndex_of_SetupDiEnumDeviceInfo_is__d__n
mov qword [rsp + 0x28], rax
inc edi
mov edx, edi
mov dword [rsp + 0x28], 0x20
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
call fcn.14000db40
lea r8, [rsp + 0x28]
mov edx, edi
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x140018710
jmp 0x1400187b6
lea rcx, str.This_device_is_3002_UART_dongle._n
mov ebp, 1
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rbx, qword [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov rdi, qword [rsp + 0x68]
mov eax, ebp
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140019260
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rsi
ret

Function at 0x1400187f0
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x14004b008]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.14001c790
xor ecx, ecx
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x14001889f
mov r8d, 0x208
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rsp + 0x20]
lea rcx, str.The_cServPath_is__s__n
call fcn.14000db40
lea rdx, str.system32
lea rcx, [rsp + 0x20]
call fcn.14001a3e8
test rax, rax
jne 0x140018884
lea rdx, str.System32
lea rcx, [rsp + 0x20]
call fcn.14001a3e8
test rax, rax
je 0x140018896
lea rcx, str.This_adminservice_is_for_MSFT_WU_or_3002_Intel._n
mov ebx, 1
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140019260
mov rbx, qword [rsp + 0x250]
add rsp, 0x240
pop rdi
ret
Function at 0x140018d20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
mov eax, 0x10118
call fcn.140030a00
sub rsp, rax
mov rax, qword [0x14004b008]
xor rax, rsp
mov qword [rsp + 0x100d0], rax
mov eax, dword [0x14004be00]
test eax, eax
je 0x140018f6f
cmp ecx, eax
jg 0x140018f6f
test ecx, eax
je 0x140018f6f
mov qword [rsp + 0x10110], rbx
mov qword [rsp + 0x10108], rbp
mov qword [rsp + 0x100e8], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x14004be04], eax
mov ebx, eax
je 0x140018dc5
nop dword [rax]
nop dword [rax + rax]
xor eax, eax
lock cmpxchg dword [0x14004be04], ebx
cmp dword [0x14004be04], ebx
je 0x140018dc5
mov ecx, 0x19
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x14004be04], ebx
jne 0x140018da0
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
mov rbp, qword [0x14004bdf8]
or rbx, 0xffffffffffffffff
cmp rbp, rbx
jne 0x140018df1
lea rcx, [0x14004bdf8]
call fcn.140018b60
mov rbp, rax
jmp 0x140018e3d
movzx eax, word [0x14004be10]
cmp word [rsp + 0x50], ax
jne 0x140018e1b
movzx eax, word [0x14004be12]
cmp word [rsp + 0x52], ax
jne 0x140018e1b
movzx eax, word [0x14004be16]
cmp word [rsp + 0x56], ax
je 0x140018e3d
cmp rbp, 0xffffffffffffffff
je 0x140018e2a
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x14004bdf8]
mov qword [0x14004bdf8], rbx
call fcn.140018b60
xor r15d, r15d
test rbp, rbp
je 0x140018f48
movzx ecx, word [rsp + 0x5e]
movzx edx, word [rsp + 0x5c]
mov eax, dword [0x14004be04]
movzx r9d, word [rsp + 0x5a]
movzx r8d, word [rsp + 0x58]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x20], edx
lea rdx, str._02d:_02d:_02d__03d__X:
mov qword [rsp + 0x10100], rsi
mov qword [rsp + 0x100f8], rdi
mov qword [rsp + 0x100f0], r14
call fcn.140009110
movsxd rsi, eax
lea r14, [rsp + 0x10130]
lea rdi, [rsp + 0x60]
mov qword [rsp + 0x48], r14
lea rdi, [rdi + rsi*2]
call fcn.140001030
mov r9, qword [rsp + 0x10128]
mov r8d, 0x8000
mov qword [rsp + 0x28], r14
mov rdx, rdi
mov qword [rsp + 0x20], r15
mov rcx, qword [rax]
or rcx, 1
call fcn.140020cf8
test eax, eax
lea rcx, [rsp + 0x60]
lea rdx, [0x14004485c]
cmovs eax, ebx
add eax, esi
cdqe
lea rcx, [rcx + rax*2]
call fcn.140009110
mov r14, qword [rsp + 0x100f0]
lea rax, [rsp + 0x60]
mov rdi, qword [rsp + 0x100f8]
mov rsi, qword [rsp + 0x10100]
nop word [rax + rax]
cmp word [rax + rbx*2 + 2], r15w
lea rbx, [rbx + 1]
jne 0x140018f20
lea r8d, [rbx + rbx]
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x40]
mov rcx, rbp
lea rdx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rbp, qword [rsp + 0x10108]
mov rbx, qword [rsp + 0x10110]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lock cmpxchg dword [0x14004be04], r15d
mov r15, qword [rsp + 0x100e8]
mov rcx, qword [rsp + 0x100d0]
xor rcx, rsp
call fcn.140019260
add rsp, 0x10118
ret
Function at 0x14001123f
Capabilities:
Terminate process

Disassembly:
jmp 0x140013ad0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112da
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014e20
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014e40
xor al, al
jmp 0x140014ec1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014e53
xor al, al
jmp 0x140014ec1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014e7d
xor al, al
jmp 0x140014ec1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014e91
xor al, al
jmp 0x140014ec1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014ea3
xor al, al
jmp 0x140014ec1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014ebf
xor al, al
jmp 0x140014ec1
mov al, 1
add rsp, 0x38
ret
Function at 0x140005afc
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x140052630], 2
mov edi, r8d
mov esi, edx
mov rbx, rcx
jl 0x140005b5c
movdqa xmm0, xmmword [0x140038a40]
movdqa xmm1, xmmword [0x140038a30]
movdqa xmmword [0x1400493a0], xmm0
movdqa xmm0, xmmword [0x140038a10]
movdqa xmmword [0x1400493b0], xmm1
movdqa xmm1, xmmword [0x140038a20]
movdqa xmmword [0x1400493c0], xmm0
movdqa xmmword [0x1400493d0], xmm1
xor edx, edx
mov r8d, 0xf0
call fcn.140024600
xor edx, edx
mov qword [rbx + 0x110], rdx
mov byte [rbx + 0x118], dl
mov rcx, qword [rbx + 0xf8]
lea rax, [0x1400389f0]
mov eax, dword [rdx + rax]
mov dword [rdx + rcx], eax
add rdx, 4
cmp rdx, 0x20
jl 0x140005b78
mov rax, qword [rbx + 0xf8]
bts edi, 0xd
shl edi, 0x10
xor dword [rax], 0x2080020
mov rax, qword [rbx + 0xf8]
xor dword [rax + 8], esi
mov rax, qword [rbx + 0xf8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor dword [rax + 0xc], edi
add rsp, 0x20
pop rdi
ret

Function at 0x140006380
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400063a6
movzx r9d, byte [rdx]
inc rdx
movzx eax, cl
xor r9, rax
shr ecx, 8
lea rax, [0x1400493e0]
xor ecx, dword [rax + r9*4]
sub r8, 1
jne 0x140006385
mov eax, ecx
ret

Function at 0x14000dd0c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov edi, r8d
mov rsi, r9
mov r10b, bl
cmp r8d, 1
jbe 0x14000dd40
lea rcx, [rdx + 1]
lea r8d, [rdi - 1]
xor r10b, byte [rcx]
inc rcx
sub r8, 1
jne 0x14000dd34
cmp r10b, byte [rdx]
jne 0x14000dd7c
mov r8, rdi
or ecx, 0xffffffff
call fcn.140006380
lea rdx, [0x140048060]
not eax
mov rcx, rdx
cmp dword [rcx + 4], eax
jne 0x14000dd65
cmp dword [rcx], edi
je 0x14000dd72
inc ebx
add rcx, 0xc
cmp ebx, 6
jae 0x14000dd7c
jmp 0x14000dd5c
lea rcx, [rbx + rbx*2]
mov eax, dword [rdx + rcx*4 + 8]
mov dword [rsi], eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140010bcc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rsp + 0x50]
mov rax, r8
cmp rax, rbx
mov rdi, rcx
mov r8, rbx
mov rcx, r9
cmovb r8, rax
mov rsi, r9
add r8, r8
call fcn.140024930
mov r9b, byte [rdi + 0x101]
lea rdx, [rbx + rbx]
mov r8b, byte [rsp + 0x58]
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140010bcc
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov r10, qword [0x140052620]
xor ebx, ebx
movzx ebp, r9b
mov r14b, r8b
mov rdi, rdx
mov rsi, rcx
test r10, r10
jne 0x140010c6b
cmp byte [0x140052618], bl
jne 0x140010c6b
lea rcx, str.Crypt32.dll
call fcn.140012320
mov qword [0x140052610], rax
test rax, rax
je 0x140010c54
lea rdx, str.CryptProtectMemory
mov rcx, rax
call qword [0x140038118]
mov rcx, qword [0x140052610]
lea rdx, str.CryptUnprotectMemory
mov qword [0x140052620], rax
call qword [0x140038118]
mov qword [0x140052628], rax
jmp 0x140010c5b
mov rax, qword [0x140052628]
mov r10, qword [0x140052620]
mov byte [0x140052618], 1
jmp 0x140010c72
mov rax, qword [0x140052628]
mov rcx, rdi
mov r8d, ebp
and rcx, 0xfffffffffffffff0
test r14b, r14b
je 0x140010cc5
test r10, r10
je 0x140010ce2
mov edx, ecx
mov rax, r10
mov rcx, rsi
call qword [0x1400384e0]
test eax, eax
jne 0x140010cfd
lea rdx, str.CryptProtectMemory_failed
lea rbx, [0x14004b4d0]
mov rcx, rbx
call fcn.140007660
mov rcx, rbx
call fcn.1400078cc
mov edx, 2
mov rcx, rbx
call fcn.140007658
jmp 0x140010cfd
test rax, rax
je 0x140010ce2
mov edx, ecx
mov rcx, rsi
call qword [0x1400384e0]
test eax, eax
jne 0x140010cfd
lea rdx, str.CryptUnprotectMemory_failed
jmp 0x140010c9f
call qword [0x140038120]
test rdi, rdi
je 0x140010cfd
lea ecx, [rax + 0x4b]
add cl, bl
xor byte [rbx + rsi], cl
inc rbx
cmp rbx, rdi
jb 0x140010ced
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140011894
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov r8d, dword [rcx + 0x20]
mov edi, 0x38
mov rsi, qword [rcx + 0x20]
and r8d, 0x3f
shl rsi, 3
mov r14, rdx
mov rbx, rcx
mov byte [r8 + rcx + 0x28], 0x80
inc r8d
cmp r8d, edi
je 0x140011915
jbe 0x1400118fe
lea edx, [rdi + 8]
cmp r8d, edx
jae 0x1400118f3
sub edx, r8d
mov eax, r8d
add rcx, 0x28
mov r8d, edx
xor edx, edx
add rcx, rax
call fcn.140024600
mov rcx, rbx
call fcn.140011ab8
xor r8d, r8d
mov eax, r8d
lea rcx, [rbx + 0x28]
sub edi, r8d
add rcx, rax
mov r8d, edi
xor edx, edx
call fcn.140024600
mov rcx, rsi
shr rcx, 0x20
call fcn.14002b314
mov ecx, esi
mov dword [rbx + 0x60], eax
call fcn.14002b314
mov rcx, rbx
mov dword [rbx + 0x64], eax
call fcn.140011ab8
mov ecx, dword [rbx]
call fcn.14002b314
mov dword [r14], eax
mov ecx, dword [rbx + 4]
call fcn.14002b314
mov dword [r14 + 4], eax
mov ecx, dword [rbx + 8]
call fcn.14002b314
mov dword [r14 + 8], eax
mov ecx, dword [rbx + 0xc]
call fcn.14002b314
mov dword [r14 + 0xc], eax
mov ecx, dword [rbx + 0x10]
call fcn.14002b314
mov dword [r14 + 0x10], eax
mov ecx, dword [rbx + 0x14]
call fcn.14002b314
mov dword [r14 + 0x14], eax
mov ecx, dword [rbx + 0x18]
call fcn.14002b314
mov dword [r14 + 0x18], eax
mov ecx, dword [rbx + 0x1c]
call fcn.14002b314
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov dword [r14 + 0x1c], eax
and qword [rbx + 0x20], 0
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x2001869a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov rsi, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov r15, qword [rsp + 0xe0]
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x2c], 0
mov rcx, qword [r15]
call fcn.2001d1f20
test rbx, rbx
je 0x200186b7a
movzx r13d, al
jmp 0x200186a0d
inc byte [rsp + 0x2f]
sub rbx, r12
je 0x200186b7a
cmp rbx, r13
mov r12, r13
cmovb r12, rbx
mov rcx, r15
call fcn.200187fa0
test eax, eax
jne 0x200186b7e
mov rcx, r15
mov rdx, rdi
mov r8, rsi
call fcn.2001c4fb0
test eax, eax
jne 0x200186b7e
mov r8d, 4
mov rcx, r15
lea rdx, [rsp + 0x2c]
call fcn.2001c4fb0
test eax, eax
jne 0x200186b7e
mov rcx, r15
lea rdx, [rsp + 0x30]
call fcn.2001ef910
test eax, eax
jne 0x200186b7e
test r12, r12
je 0x200186a00
cmp r12, 0x20
jb 0x200186aa0
lea rax, [r14 + r12]
lea rcx, [rsp + r12]
add rcx, 0x30
lea rdx, [rsp + 0x30]
cmp rdx, rax
setb al
cmp r14, rcx
jae 0x200186b2b
test al, al
je 0x200186b2b
xor eax, eax
mov rcx, rax
not rcx
add rcx, r12
mov rdx, r12
and rdx, 3
je 0x200186ad4
nop word cs:[rax + rax]
movzx r8d, byte [rsp + rax + 0x30]
xor byte [r14], r8b
inc r14
inc rax
dec rdx
jne 0x200186ac0
cmp rcx, 3
jb 0x200186a00
mov rcx, r12
sub rcx, rax
lea rdx, [rsp + 0x33]
add rax, rdx
xor edx, edx
nop
movzx r8d, byte [rax + rdx - 3]
xor byte [r14 + rdx], r8b
movzx r8d, byte [rax + rdx - 2]
xor byte [r14 + rdx + 1], r8b
movzx r8d, byte [rax + rdx - 1]
xor byte [r14 + rdx + 2], r8b
movzx r8d, byte [rax + rdx]
xor byte [r14 + rdx + 3], r8b
add rdx, 4
cmp rcx, rdx
jne 0x200186af0
add r14, rdx
jmp 0x200186a00
mov eax, r12d
and eax, 0xe0
xor ecx, ecx
nop word cs:[rax + rax]
movups xmm0, xmmword [r14 + rcx]
movups xmm1, xmmword [r14 + rcx + 0x10]
xorps xmm0, xmmword [rsp + rcx + 0x30]
xorps xmm1, xmmword [rsp + rcx + 0x40]
movups xmmword [r14 + rcx], xmm0
movups xmmword [r14 + rcx + 0x10], xmm1
add rcx, 0x20
cmp rax, rcx
jne 0x200186b40
add r14, rax
cmp r12, rax
je 0x200186a00
jmp 0x200186aa2
xor ebp, ebp
jmp 0x200186b80
mov ebp, eax
lea rcx, [rsp + 0x30]
mov edx, 0x40
call fcn.200146a30
mov eax, ebp
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x200199270
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x348
mov eax, 0xffffffc8
cmp r8, 0x180
ja 0x20019951c
mov rbx, r8
mov r14, rdx
mov rsi, rcx
lea rdi, [rsp + 0x80]
mov r8d, 0x1a0
mov rcx, rdi
xor edx, edx
call fcn.2001bcb60
lea r15, [rsp + 0x228]
mov rcx, r15
call fcn.20019c560
mov word [rsp + 0x90], 0
mov byte [rsp + 0x92], bh
mov byte [rsp + 0x93], bl
lea rcx, [rsp + 0x98]
mov byte [rsp + 0x97], 0x30
mov rdx, r14
mov r8, rbx
call fcn.200199550
mov byte [rsp + rbx + 0x98], 0x80
movaps xmm0, xmmword [0x200004240]
movaps xmmword [rsp + 0x60], xmm0
movaps xmm0, xmmword [0x200106390]
movaps xmmword [rsp + 0x70], xmm0
add rbx, 0x19
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.200187ca0
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea r14, [rsp + 0x20]
mov r12, rbx
test r12, r12
je 0x200199371
nop
movups xmm0, xmmword [rdi]
xorps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
add rdi, 0x10
sub r12, 0x10
mov eax, 0
cmovb r12, rax
mov rcx, r15
mov rdx, r14
mov r8, r14
call fcn.2001df780
test r12, r12
jne 0x200199340
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x30], xmm0
movzx r15d, byte [rsp + 0x83]
lea eax, [r15 + 1]
mov byte [rsp + 0x83], al
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea r12, [rsp + 0x80]
xor r13d, r13d
lea rdi, [rsp + 0x228]
lea r14, [rsp + 0x20]
mov rbp, rbx
test rbp, rbp
je 0x2001993ee
nop word [rax + rax]
movups xmm0, xmmword [r12]
xorps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
add r12, 0x10
sub rbp, 0x10
cmovb rbp, r13
mov rcx, rdi
mov rdx, r14
mov r8, r14
call fcn.2001df780
test rbp, rbp
jne 0x2001993c0
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x40], xmm0
lea eax, [r15 + 2]
mov byte [rsp + 0x83], al
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
lea r12, [rsp + 0x80]
xor r13d, r13d
lea rdi, [rsp + 0x228]
lea r14, [rsp + 0x20]
test rbx, rbx
je 0x20019945e
nop dword [rax + rax]
movups xmm0, xmmword [r12]
xorps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x20], xmm0
add r12, 0x10
sub rbx, 0x10
cmovb rbx, r13
mov rcx, rdi
mov rdx, r14
mov r8, r14
call fcn.2001df780
test rbx, rbx
jne 0x200199430
lea rbx, [rsp + 0x50]
movaps xmm0, xmmword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm0
add r15b, 3
mov byte [rsp + 0x83], r15b
lea r14, [rsp + 0x228]
lea rdi, [rsp + 0x30]
mov rcx, r14
mov rdx, rdi
call fcn.200187ca0
mov rcx, r14
mov rdx, rbx
mov r8, rbx
call fcn.2001df780
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi], xmm0
mov rcx, r14
mov rdx, rbx
mov r8, rbx
call fcn.2001df780
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x10], xmm0
mov rcx, r14
mov rdx, rbx
mov r8, rbx
call fcn.2001df780
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rsi + 0x20], xmm0
mov rcx, r14
call fcn.200146a20
lea rcx, [rsp + 0x80]
mov edx, 0x1a0
call fcn.200146a30
mov edx, 0x30
mov rcx, rdi
call fcn.200146a30
lea rcx, [rsp + 0x60]
mov edx, 0x20
call fcn.200146a30
lea rcx, [rsp + 0x20]
mov edx, 0x10
call fcn.200146a30
xor eax, eax
add rsp, 0x348
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x2001bcef0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rbx, r9
mov ebp, r8d
mov rsi, rdx
mov rdi, rcx
lea r8, [rdx + 1]
xor edx, edx
call fcn.2001bcb60
test rsi, rsi
je 0x2001bcfc3
movzx r12d, bpl
xor r13d, r13d
nop word [rax + rax]
movzx ebp, byte [rdi + r13]
mov r14, r13
xor r15d, r15d
nop dword [rax + rax]
mov rcx, rbx
mov rdx, r14
call fcn.2001bb0a0
mov ecx, r15d
shl eax, cl
or bpl, al
mov byte [rdi + r13], bpl
inc r15
add r14, rsi
cmp r12, r15
jne 0x2001bcf40
inc r13
cmp r13, rsi
jne 0x2001bcf30
movzx edx, byte [rdi]
xor ecx, ecx
xor r8d, r8d
nop word cs:[rax + rax]
movzx r9d, byte [rdi + rcx + 1]
mov r10d, r9d
and r10b, r8b
xor r9b, r8b
mov r11d, r9d
not r11b
mov eax, r11d
and al, 1
mul dl
mov r8d, eax
and r8b, r9b
or r8b, r10b
xor r9b, al
mov byte [rdi + rcx + 1], r9b
shl r11b, 7
or r11b, dl
mov byte [rdi + rcx], r11b
inc rcx
mov edx, r9d
cmp rsi, rcx
jne 0x2001bcf80
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x2001ce2b0
Capabilities:
Encode data using xor

Disassembly:
push rax
mov byte [rsp + 7], 0
test r8, r8
je 0x2001ce313
cmp r8, 1
jne 0x2001ce2c5
xor eax, eax
jmp 0x2001ce305
mov r9, r8
and r9, 0xfffffffffffffffe
xor eax, eax
nop
movzx r10d, byte [rcx + rax]
movzx r11d, byte [rdx + rax]
xor r11b, r10b
or byte [rsp + 7], r11b
movzx r10d, byte [rcx + rax + 1]
movzx r11d, byte [rdx + rax + 1]
xor r11b, r10b
or byte [rsp + 7], r11b
add rax, 2
cmp r9, rax
jne 0x2001ce2d0
test r8b, 1
je 0x2001ce313
movzx ecx, byte [rcx + rax]
movzx eax, byte [rdx + rax]
xor al, cl
or byte [rsp + 7], al
movzx eax, byte [rsp + 7]
movzx eax, al
pop rcx
ret

Function at 0x2001ce3a0
Capabilities:
Execute syscall

Disassembly:
mov eax, 0x4baa5804
xor eax, dword [0x2003a7cb0]
rol eax, 7
add eax, 0x49b27e65
mov r10, 0xffffffffffffffff
mov rdx, 0xfffffffffffffffe
syscall
ret