joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400963b8
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
and dword [rax - 0x38], 0
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
and qword [rcx + 0x10], 0
and qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 0xf
mov byte [rcx], 0
mov dword [rax - 0x38], 1
lea r15, [rdx + 0x10]
cmp qword [r15], 0xf
jbe 0x14009641e
xor r8d, r8d
mov rdx, qword [r15]
call fcn.140084dc4
and qword [rbx + 0x10], 0
xor esi, esi
lea r14d, [rsi - 6]
cmp qword [rdi + 0x18], 0x10
jb 0x140096436
mov rbp, qword [rdi]
mov rcx, rbp
mov rdi, rbp
jmp 0x14009643c
mov rbp, rdi
mov rcx, rdi
mov r12, qword [r15]
add r12, rcx
cmp rdi, r12
je 0x14009655d
lea r8, [0x1403c8800]
shl esi, 8
movzx eax, byte [rbp]
add esi, eax
add r14d, 8
js 0x1400964d8
movsxd r13, esi
movsxd rdi, r14d
lea ecx, [r14 + 6]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 2
mov r15d, edx
imul eax, edx, 0xfffffffa
add r14d, eax
mov rax, r13
mov rcx, rdi
sar rax, cl
and eax, 0x3f
mov r9b, byte [rax + r8]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x1400964b8
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400964ad
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400964ce
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.14001ada0
lea r8, [0x1403c8800]
sub rdi, 6
sub r15, 1
jne 0x14009647e
inc rbp
cmp rbp, r12
jne 0x140096452
cmp r14d, 0xfffffffa
jle 0x14009655d
lea ecx, [r14 + 8]
shl esi, 8
movsxd rax, esi
sar rax, cl
and eax, 0x3f
mov r9b, byte [rax + r8]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x14009654e
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14009651d
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14009655d
cmp rcx, qword [rbx + 0x18]
jae 0x14009654b
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140096543
mov rax, qword [rbx]
mov word [rax + rcx], 0x3d
jmp 0x14009655d
mov r9b, 0x3d
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.14001ada0
mov rcx, qword [rbx + 0x10]
test cl, 3
jne 0x140096528
mov rax, rbx
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14009b3d4
Capabilities:
Resolve dns

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x460
mov rax, qword [0x1404e8f18]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov r14d, 2
mov rsi, r9
mov rdi, r8
mov ebp, edx
mov rbx, rcx
cmp word [rcx], r14w
je 0x14009b415
cmp word [rcx], 0x17
jne 0x14009b4b7
movzx ecx, word [rcx + 2]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
xor edx, edx
mov dword [rsi], eax
lea rcx, [rsp + 0x40]
mov esi, 0x401
mov r8d, esi
call fcn.140337660
mov dword [rsp + 0x30], r14d
lea r8, [rsp + 0x40]
xor r14d, r14d
mov r9d, esi
mov dword [rsp + 0x28], r14d
mov edx, ebp
mov rcx, rbx
mov qword [rsp + 0x20], r14
call qword [sym.imp.WS2_32.dll_getnameinfo]
test eax, eax
jne 0x14009b4b7
lea rax, [rsp + 0x40]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r14b
jne 0x14009b46a
cmp rbx, qword [rdi + 0x18]
ja 0x14009b4a0
cmp qword [rdi + 0x18], 0x10
mov rsi, rdi
jb 0x14009b486
mov rsi, qword [rdi]
mov r8, rbx
mov qword [rdi + 0x10], rbx
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.140336c00
mov byte [rsi + rbx], r14b
jmp 0x14009b4b3
lea r9, [rsp + 0x40]
mov r8b, r14b
mov rdx, rbx
mov rcx, rdi
call fcn.1400139c4
mov al, 1
jmp 0x14009b4b9
xor al, al
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1403358f0
add rsp, 0x460
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x14009b4d8
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x14009b4e4
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x1404e8f18]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, r8
mov dword [rsp + 0x20], 0x80
mov rbx, rdx
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x14009b539
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r9, rdi
mov r8, rbx
call fcn.14009b3d4
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1403358f0
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
ret

Function at 0x14009b4e4
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rcx, qword [rcx + 8]
jmp 0x14009b4e4
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x1404e8f18]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rdi, r8
mov dword [rsp + 0x20], 0x80
mov rbx, rdx
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x14009b539
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r9, rdi
mov r8, rbx
call fcn.14009b3d4
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1403358f0
mov rbx, qword [rsp + 0xe8]
add rsp, 0xc0
pop rdi
ret
Function at 0x1400a3fc0
Capabilities:
Convert ip address from string

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x1404e8f18]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov qword [rsp + 0x30], rcx
lea rdi, [rcx + 8]
mov rsi, rdx
cmp qword [rdi + 0x18], 0x10
mov r15d, ebx
mov rdx, rdi
lea r12d, [rbx + 2]
mov ebp, r12d
jb 0x1400a4008
mov rdx, qword [rdi]
lea r8, [rsp + 0x38]
mov ecx, 0x17
call qword [sym.imp.WS2_32.dll_inet_pton]
mov r14d, 7
test eax, eax
je 0x1400a4028
lea r15d, [r14 + 9]
jmp 0x1400a404d
cmp qword [rdi + 0x18], 0x10
jb 0x1400a4032
mov rdi, qword [rdi]
lea r8, [rsp + 0x20]
mov rdx, rdi
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
je 0x1400a4050
mov r15d, 4
mov ebp, r14d
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
lea edx, [r9 + 0x55]
call fcn.1401c6c40
mov rdi, rax
test rax, rax
je 0x1400a4124
mov rcx, rax
mov r14b, bl
mov r12b, bl
call fcn.1401c2580
mov dword [rsp + 0x24], eax
mov esi, ebx
test eax, eax
jle 0x1400a4124
test r14b, r14b
jne 0x1400a4122
mov edx, esi
mov rcx, rdi
call fcn.1401c27b0
mov r13, rax
cmp dword [rax], ebp
jne 0x1400a410c
mov rcx, qword [rax + 8]
call fcn.1400182a0
mov rcx, qword [r13 + 8]
mov qword [rsp + 0x28], rax
call fcn.140181c70
movsxd r8, eax
cmp ebp, 2
je 0x1400a40fa
cmp ebp, 7
jne 0x1400a410c
mov r13, qword [rsp + 0x28]
lea rcx, [rsp + 0x38]
mov rdx, r13
mov r8, r15
call fcn.140337560
test eax, eax
je 0x1400a40f5
mov r8, r15
lea rcx, [rsp + 0x20]
mov rdx, r13
call fcn.140337560
test eax, eax
jne 0x1400a410c
mov r12b, 1
jmp 0x1400a410c
mov rdx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
call fcn.140096588
mov r14b, al
inc esi
cmp esi, dword [rsp + 0x24]
jl 0x1400a408a
test r14b, r14b
jne 0x1400a4122
test r12b, r12b
je 0x1400a4124
mov bl, 1
mov rcx, rdi
call fcn.1401c6c90
mov al, bl
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1403358f0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400aed48
Capabilities:
Compare security identifiers

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x1404e8f18]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor edi, edi
cmp byte [0x1404f0261], dil
je 0x1400aed80
mov al, byte [0x1404f0260]
jmp 0x1400aedd6
mov dword [rbp - 0x25], edi
mov word [rbp - 0x21], 0x500
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x39]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400aedd4
mov rcx, qword [rbp - 0x39]
lea rax, [rbp - 0x29]
mov r9d, 0x54
mov qword [rsp + 0x20], rax
lea r8, [rbp - 0x19]
lea edx, [r9 - 0x53]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rbp - 0x39]
test eax, eax
jne 0x1400aedf7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1403358f0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp - 0x31]
xor r9d, r9d
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x25]
mov dword [rsp + 0x48], edi
mov dl, 1
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x38], edi
lea r8d, [r9 + 0x12]
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x1400aedd4
mov rdx, qword [rbp - 0x31]
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_EqualSid]
mov rcx, qword [rbp - 0x31]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp byte [0x1404f0261], dil
jne 0x1400aee5f
mov byte [0x1404f0261], 1
test ebx, ebx
setne al
mov byte [0x1404f0260], al
jmp 0x1400aedd6
Function at 0x1400b2040
Capabilities:
Get system firmware table

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1404e8f18]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x52534d42
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, esi
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x1400b209f
xor al, al
jmp 0x1400b214b
mov r9d, esi
mov r8, rbx
xor edx, edx
mov ecx, 0x52534d42
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
cmp eax, esi
je 0x1400b20cc
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400b2098
movzx ecx, byte [rbx + 1]
shl ecx, 0x10
movzx eax, byte [rbx + 2]
shl eax, 8
add ecx, eax
movzx eax, byte [rbx + 3]
add ecx, eax
mov dword [rdi + 0x5c], ecx
mov eax, dword [rbx + 4]
mov dword [rdi + 0x58], eax
and qword [rsp + 0x68], 0
lea rcx, [rsp + 0x20]
call fcn.140040f8c
test al, al
je 0x1400b211a
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_b1841b2b3d7edfd58a8a013d8118f4e5___void___.0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x68], rax
lea rdx, [rbx + 8]
lea r8, [rsp + 0x30]
mov rcx, rdi
call fcn.1400b1c04
mov bl, al
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400b2149
mov r8, qword [rcx]
lea rax, [rsp + 0x30]
cmp rcx, rax
setne dl
call qword [r8 + 0x20]
mov al, bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1403358f0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400b37d0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov rax, qword [rdx + 0x28]
cmp byte [rax], 0x22
je 0x1400b380f
cmp byte [rax], 0x5b
je 0x1400b380a
cmp byte [rax], 0x66
je 0x1400b3805
cmp byte [rax], 0x6e
je 0x1400b3800
cmp byte [rax], 0x74
je 0x1400b37fb
cmp byte [rax], 0x7b
jne fcn.1400b29b8
jmp fcn.1400b31b8
jmp fcn.1400b3720
jmp fcn.1400b290c
jmp fcn.1400b27b4
jmp fcn.1400b2610
xor r9d, r9d
jmp fcn.1400b34a4

Function at 0x1400b4ff4
Capabilities:
Manipulate user privileges

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
xor edi, edi
mov esi, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x28]
lea edx, [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400b50fd
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x20]
lea ebx, [rdi + 1]
mov dword [rbp + 0x20], edi
mov edx, ebx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov r9d, dword [rbp + 0x20]
test r9d, r9d
je 0x1400b5065
mov edx, r9d
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r9d, dword [rbp + 0x20]
mov rsi, rax
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x20]
mov r8, rsi
mov qword [rsp + 0x20], rax
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x1400b50fd
xor edx, edx
lea rcx, [rbp - 0x30]
lea r8d, [rdx + 0x30]
call fcn.140337660
lea r9, [rbp + 0x30]
mov r8d, 0xf0fff
lea rdx, [rbp - 0x30]
xor ecx, ecx
call sub.ADVAPI32.dll_LsaOpenPolicy
test eax, eax
jne 0x1400b50f0
lea rdx, str.SeLockMemoryPrivilege
lea rcx, [rbp - 0x40]
call fcn.1400b51c4
mov rdx, qword [rsi]
lea r8, [rbp - 0x50]
mov rcx, qword [rbp + 0x30]
mov r9d, ebx
movups xmm0, xmmword [rax]
movdqu xmmword [rbp - 0x50], xmm0
call sub.ADVAPI32.dll_LsaAddAccountRights
mov rcx, qword [rbp + 0x30]
mov ebx, eax
call sub.ADVAPI32.dll_LsaClose
test ebx, ebx
sete dil
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
jmp 0x1400b50ff
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret

Function at 0x1400b5234
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test dl, dl
je 0x1400b526a
lea rdx, [rcx - 1]
mov r8d, 0x20003000
xor ecx, ecx
and rdx, 0xffffffffffe00000
add rdx, 0x200000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x1400b5281
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rsp, 0x20
pop rbx
ret

Function at 0x1400b536c
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x1400b5cdc
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [rcx], 0x6a09e667
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x28], rax
mov dword [rcx + 0x24], eax
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov qword [rcx + 0x1c], 0x5be0cd19
ret

Function at 0x1400b5e34
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1404e8f18]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov r8, rdx
lea rax, [rsp + 0x20]
sub r8, rax
mov r9, rcx
lea rax, [rsp + 0x20]
mov rdi, rcx
sub r9, rax
xor ebx, ebx
mov edx, ebx
lea r10d, [rbx + 0x10]
lea rcx, [rsp + 0x20]
add rcx, rdx
mov eax, dword [r8 + rcx]
mov dword [rcx], eax
xor eax, dword [rcx + r9]
mov dword [rbp + rdx - 0x60], eax
add rdx, 4
sub r10, 1
jne 0x1400b5e7a
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.1400b6df8
mov r8d, 0x1000000
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400b6df8
mov r8d, 0x2000000
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.1400b6df8
mov r8d, 0x3000000
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400b6df8
mov r8d, 0x4000000
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.1400b6df8
mov r8d, 0x5000000
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400b6df8
mov r8d, 0x6000000
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.1400b6df8
mov r8d, 0x7000000
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400b6df8
mov r8d, 0x8000000
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.1400b6df8
mov r8d, 0x9000000
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400b6df8
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.1400b638c
mov r8d, 1
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400b638c
mov r8d, 2
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.1400b638c
mov r8d, 3
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400b638c
mov r8d, 4
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.1400b638c
mov r8d, 5
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400b638c
mov r8d, 6
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.1400b638c
mov r8d, 7
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.1400b638c
mov r8d, 8
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.1400b638c
mov r8d, 9
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.1400b638c
mov eax, dword [rbp + rbx - 0x20]
xor eax, dword [rbp + rbx - 0x60]
xor dword [rbx + rdi], eax
add rbx, 4
cmp rbx, 0x40
jl 0x1400b6035
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1403358f0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400b6218
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x1404e8f18]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rax, [rcx + 0x3c]
mov rbx, rcx
lea rcx, [rbp - 0x39]
mov edi, 0x10
cmp rcx, rax
ja 0x1400b627b
xor r9d, r9d
lea rax, [rbp + 3]
cmp rax, rbx
jb 0x1400b627b
mov r8d, edi
lea rcx, [rbp - 0x39]
sub r8, r9
lea rcx, [rcx + r9*4]
shl r8, 2
lea rdx, [rbx + r9*4]
call fcn.140336c00
jmp 0x1400b629a
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movaps xmmword [rbp - 0x39], xmm0
movups xmm0, xmmword [rbx + 0x20]
movaps xmmword [rbp - 0x29], xmm1
movups xmm1, xmmword [rbx + 0x30]
movaps xmmword [rbp - 0x19], xmm0
movaps xmmword [rbp - 9], xmm1
xor r8d, r8d
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x39]
call fcn.1400b638c
mov r8d, 1
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x79]
call fcn.1400b638c
mov r8d, 2
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 7]
call fcn.1400b638c
mov r8d, 3
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x79]
call fcn.1400b638c
mov r8d, 4
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 7]
call fcn.1400b638c
mov r8d, 5
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x79]
call fcn.1400b638c
mov r8d, 6
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 7]
call fcn.1400b638c
mov r8d, 7
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x79]
call fcn.1400b638c
mov r8d, 8
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 7]
call fcn.1400b638c
mov r8d, 9
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x79]
call fcn.1400b638c
lea rcx, [rbp - 0x39]
sub rcx, rbx
mov eax, dword [rcx + rbx]
xor dword [rbx], eax
lea rbx, [rbx + 4]
sub rdi, 1
jne 0x1400b635c
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1403358f0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x1400b881c
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, [rcx + 0x20]
mov ecx, 8
mov rax, qword [rdx + 0x80]
xor qword [rdx], rax
lea rdx, [rdx + 8]
sub rcx, 1
jne 0x1400b882e
mov rcx, rbx
call fcn.1400b7a5c
lea rcx, [rbx + 0x60]
mov edx, 8
mov rax, qword [rcx + 0x40]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x1400b8853
add rsp, 0x20
pop rbx
ret
Function at 0x1400ba4cc
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm0, xmmword [rcx]
mov rax, qword [rsp + 0x28]
movdqa xmm2, xmm0
movdqu xmmword [rdx], xmm0
pslldq xmm2, 4
movdqa xmm1, xmm2
movdqu xmmword [r8], xmm3
xorps xmm1, xmm0
pslldq xmm2, 4
movdqa xmm4, xmm2
pslldq xmm2, 4
xorps xmm4, xmm1
xorps xmm4, xmm2
aeskeygenassist xmm0, xmm3, 1
pshufd xmm1, xmm0, 0xff
xorps xmm4, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [r9], xmm4
pslldq xmm1, 4
xorps xmm0, xmm3
movdqa xmm2, xmm1
pslldq xmm1, 4
xorps xmm2, xmm0
xorps xmm2, xmm1
aeskeygenassist xmm0, xmm4, 0
pshufd xmm1, xmm0, 0xaa
xorps xmm2, xmm1
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rax], xmm2
mov rax, qword [rsp + 0x30]
xorps xmm0, xmm4
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm0
xorps xmm3, xmm1
aeskeygenassist xmm0, xmm2, 2
pshufd xmm1, xmm0, 0xff
xorps xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rax], xmm3
mov rax, qword [rsp + 0x38]
xorps xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
xorps xmm2, xmm0
xorps xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
xorps xmm2, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rax], xmm2
xorps xmm0, xmm3
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm0
xorps xmm3, xmm1
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
xorps xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
xorps xmm0, xmm2
movdqa xmm2, xmm1
xorps xmm2, xmm0
pslldq xmm1, 4
xorps xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
mov rax, qword [rsp + 0x40]
pshufd xmm1, xmm0, 0xaa
xorps xmm2, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqu xmmword [rax], xmm3
movdqa xmm0, xmm1
mov rax, qword [rsp + 0x48]
xorps xmm0, xmm3
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm0
movdqu xmmword [rax], xmm2
xorps xmm3, xmm1
mov rax, qword [rsp + 0x50]
aeskeygenassist xmm0, xmm2, 8
pshufd xmm1, xmm0, 0xff
xorps xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rax], xmm3
mov rax, qword [rsp + 0x58]
xorps xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
xorps xmm2, xmm0
xorps xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
xorps xmm2, xmm1
movdqu xmmword [rax], xmm2
ret
Function at 0x1400c044c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x100
mov rax, qword [0x1404e8f18]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, qword [rcx + 0xe0]
mov rdi, rcx
xor esi, esi
mov ebp, 0xb0
mov r8d, 0xc8
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.140336c00
xor qword [rsp + 0x20], rsi
lea rcx, [rsp + 0x20]
mov edx, 0x18
call fcn.1400118b8
mov r8d, 0xa0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140336c00
mov edx, 0x18
lea rcx, [rsp + 0x20]
add rbx, 0xa0
call fcn.1400118b8
mov r8, rbp
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140336c00
mov edx, 0x18
lea rcx, [rsp + 0x20]
add rbx, rbp
call fcn.1400118b8
mov r8, rbp
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140336c00
add rbx, rbp
inc rsi
cmp rsi, 0x1000
jb 0x1400c0486
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1403358f0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret