joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14004e370
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x14004e528
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
xor ebx, ebx
mov eax, dword [rdx + rcx]
cmp dword [0x1400978a0], eax
jle 0x14004e45b
lea rcx, [0x1400978a0]
call fcn.14006cc00
cmp dword [0x1400978a0], 0xffffffff
jne 0x14004e45b
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x37], rbx
mov qword [rbp + 0x3f], recv
mov byte [rbp + 0x27], bl
lea r8d, [rbx + 0xa]
lea rdx, str.ExFreePool
lea rcx, [rbp + 0x27]
call fcn.140054980
nop
lea r8, [rbp + 0x27]
mov rdx, qword [0x140094078]
mov rcx, rsi
call fcn.14004e550
mov qword [0x140097870], rax
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x14004e44f
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004e449
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004e449
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ca00
nop
lea rcx, [0x1400978a0]
call fcn.14006cba0
mov r8, qword [0x140097870]
test r8, r8
jne 0x14004e52c
mov dword [rbp - 0x29], 0xc24dc230
mov dword [rbp - 0x25], 0xc24ec230
mov dword [rbp - 0x21], 0xc211c229
mov dword [rbp - 0x1d], 0xc21ec218
mov dword [rbp - 0x19], 0xc210c216
mov dword [rbp - 0x15], 0xc202c255
mov dword [rbp - 0x11], 0xc258c218
mov dword [rbp - 0xd], 0xc213c21f
mov dword [rbp - 9], 0xc218c215
mov dword [rbp - 5], 0xc23bc25d
mov dword [rbp - 1], 0xc2c1c207
mov dword [rbp + 3], 0xc2eec2ed
mov dword [rbp + 7], 0xc2e7c2ec
mov dword [rbp + 0xb], 0xc2f2c2e4
mov dword [rbp + 0xf], 0xc2d8c2e2
mov dword [rbp + 0x13], 0xc2e5c2e6
mov dword [rbp + 0x17], 0xc2e7
mov byte [rbp + 0x1b], 1
mov ecx, 0x3d95
nop dword [rax + rax]
movzx eax, bx
sub ax, cx
xor word [rbp + rbx*2 - 0x29], ax
inc rbx
cmp rbx, 0x21
jb 0x14004e4f0
mov byte [rbp + 0x1b], 0
lea rdx, [rbp - 0x29]
mov rcx, qword [0x140070250]
call fcn.140054b30
lea rdx, [0x140054d10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x14004e539
mov r9, rdi
xor edx, edx
mov rcx, rsi
call fcn.140056f90
mov rbx, qword [rsp + 0xc0]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004efc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x14004f1b9
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
xor ebx, ebx
mov eax, dword [rdx + rcx]
cmp dword [0x1400978d8], eax
jle 0x14004f0b9
lea rcx, [0x1400978d8]
call fcn.14006cc00
cmp dword [0x1400978d8], 0xffffffff
jne 0x14004f0b9
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x2f], recv
mov byte [rbp + 0x17], bl
lea r8d, [rbx + 0x1e]
lea rdx, str.ExAcquireResourceExclusiveLite
lea rcx, [rbp + 0x17]
call fcn.140054980
nop
lea r8, [rbp + 0x17]
mov rdx, qword [0x140094078]
mov rcx, rsi
call fcn.14004e550
mov qword [0x1400978e0], rax
mov rdx, qword [rbp + 0x2f]
cmp rdx, 0x10
jb 0x14004f0ad
inc rdx
mov rcx, qword [rbp + 0x17]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f0a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004f0a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ca00
nop
lea rcx, [0x1400978d8]
call fcn.14006cba0
mov r8, qword [0x1400978e0]
test r8, r8
jne 0x14004f1da
mov dword [rbp - 0x59], 0xc24dc230
mov dword [rbp - 0x55], 0xc24ec230
mov dword [rbp - 0x51], 0xc211c229
mov dword [rbp - 0x4d], 0xc21ec218
mov dword [rbp - 0x49], 0xc210c216
mov dword [rbp - 0x45], 0xc202c255
mov dword [rbp - 0x41], 0xc258c218
mov dword [rbp - 0x3d], 0xc213c21f
mov dword [rbp - 0x39], 0xc218c215
mov dword [rbp - 0x35], 0xc23bc25d
mov dword [rbp - 0x31], 0xc2c1c207
mov dword [rbp - 0x2d], 0xc2f3c2e2
mov dword [rbp - 0x29], 0xc2edc2f6
mov dword [rbp - 0x25], 0xc2e3c2f7
mov dword [rbp - 0x21], 0xc2edc2d5
mov dword [rbp - 0x1d], 0xc2e5c2fa
mov dword [rbp - 0x19], 0xc2fec2fe
mov dword [rbp - 0x15], 0xc2ebc2ee
mov dword [rbp - 0x11], 0xc2e8c2ca
mov dword [rbp - 0xd], 0xc2fec2f2
mov dword [rbp - 9], 0xc2e7c2e6
mov dword [rbp - 5], 0xc2e0c2fc
mov dword [rbp - 1], 0xc2d4c2f2
mov dword [rbp + 3], 0xc2eec2f0
mov dword [rbp + 7], 0xc2fe
mov byte [rbp + 0xb], 1
mov ecx, 0x3d95
movzx eax, bx
sub ax, cx
xor word [rbp + rbx*2 - 0x59], ax
inc rbx
cmp rbx, 0x31
jb 0x14004f181
mov byte [rbp + 0xb], 0
lea rdx, [rbp - 0x59]
mov rcx, qword [0x140070250]
call fcn.140054b30
lea rdx, [0x140054d10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.14006c910
mov rbx, qword [rsp + 0x100]
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
mov byte [rsp + 0x20], 1
mov r9, rdi
lea rdx, [rbp + 0x37]
mov rcx, rsi
call fcn.140057640
test al, al
je 0x14004f1b9
cmp byte [rbp + 0x37], 0
je 0x14004f1b9
mov al, 1
jmp 0x14004f1bb
Function at 0x14004f200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x14004f3d8
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
xor ebx, ebx
mov eax, dword [rdx + rcx]
cmp dword [0x1400978b8], eax
jle 0x14004f2eb
lea rcx, [0x1400978b8]
call fcn.14006cc00
cmp dword [0x1400978b8], 0xffffffff
jne 0x14004f2eb
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x37], rbx
mov qword [rbp + 0x3f], recv
mov byte [rbp + 0x27], bl
lea r8d, [rbx + 0x15]
lea rdx, str.ExReleaseResourceLite
lea rcx, [rbp + 0x27]
call fcn.140054980
nop
lea r8, [rbp + 0x27]
mov rdx, qword [0x140094078]
mov rcx, rsi
call fcn.14004e550
mov qword [0x140097848], rax
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x14004f2df
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f2d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004f2d9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ca00
nop
lea rcx, [0x1400978b8]
call fcn.14006cba0
mov r8, qword [0x140097848]
test r8, r8
jne 0x14004f3dc
mov dword [rbp - 0x39], 0xc24dc230
mov dword [rbp - 0x35], 0xc24ec230
mov dword [rbp - 0x31], 0xc211c229
mov dword [rbp - 0x2d], 0xc21ec218
mov dword [rbp - 0x29], 0xc210c216
mov dword [rbp - 0x25], 0xc202c255
mov dword [rbp - 0x21], 0xc258c218
mov dword [rbp - 0x1d], 0xc213c21f
mov dword [rbp - 0x19], 0xc218c215
mov dword [rbp - 0x15], 0xc23bc25d
mov dword [rbp - 0x11], 0xc2d2c207
mov dword [rbp - 0xd], 0xc2eec2e4
mov dword [rbp - 9], 0xc2e5c2e6
mov dword [rbp - 5], 0xc2e3c2f6
mov dword [rbp - 1], 0xc2edc2d5
mov dword [rbp + 3], 0xc2e5c2fa
mov dword [rbp + 7], 0xc2fec2fe
mov dword [rbp + 0xb], 0xc2ebc2ee
mov dword [rbp + 0xf], 0xc2f9c2c3
mov dword [rbp + 0x13], 0xc2f7c2e5
mov word [rbp + 0x17], bx
mov byte [rbp + 0x19], 1
mov ecx, 0x3d95
nop dword [rax]
nop dword [rax + rax]
movzx eax, bx
sub ax, cx
xor word [rbp + rbx*2 - 0x39], ax
inc rbx
cmp rbx, 0x28
jb 0x14004f3a0
mov byte [rbp + 0x19], 0
lea rdx, [rbp - 0x39]
mov rcx, qword [0x140070250]
call fcn.140054b30
lea rdx, [0x140054d10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor al, al
jmp 0x14004f3e9
mov r9, rdi
xor edx, edx
mov rcx, rsi
call fcn.140057d00
mov rbx, qword [rsp + 0xd0]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x14004f650
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r14, r8
mov rdi, rdx
mov rsi, rcx
test rdx, rdx
je 0x14004f858
mov edx, 4
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
xor ebx, ebx
mov eax, dword [rdx + rcx]
cmp dword [0x1400978cc], eax
jle 0x14004f74b
lea rcx, [0x1400978cc]
call fcn.14006cc00
cmp dword [0x1400978cc], 0xffffffff
jne 0x14004f74b
mov qword [rbp + 7], rbx
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x1f], recv
mov byte [rbp + 7], bl
lea r8d, [rbx + 0x1f]
lea rdx, str.RtlLookupElementGenericTableAvl
lea rcx, [rbp + 7]
call fcn.140054980
nop
lea r8, [rbp + 7]
mov rdx, qword [0x140094078]
mov rcx, rsi
call fcn.14004e550
mov qword [0x140097860], rax
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x14004f73f
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004f739
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004f739
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006ca00
nop
lea rcx, [0x1400978cc]
call fcn.14006cba0
mov r8, qword [0x140097860]
test r8, r8
jne 0x14004f874
mov dword [rbp - 0x69], 0xc24dc230
mov dword [rbp - 0x65], 0xc24ec230
mov dword [rbp - 0x61], 0xc211c229
mov dword [rbp - 0x5d], 0xc21ec218
mov dword [rbp - 0x59], 0xc210c216
mov dword [rbp - 0x55], 0xc202c255
mov dword [rbp - 0x51], 0xc258c218
mov dword [rbp - 0x4d], 0xc213c21f
mov dword [rbp - 0x49], 0xc218c215
mov dword [rbp - 0x45], 0xc22cc25d
mov dword [rbp - 0x41], 0xc2ecc20b
mov dword [rbp - 0x3d], 0xc2edc2cd
mov dword [rbp - 0x39], 0xc2efc2ec
mov dword [rbp - 0x35], 0xc2f6c2f0
mov dword [rbp - 0x31], 0xc2e4c2c2
mov dword [rbp - 0x2d], 0xc2e7c2ec
mov dword [rbp - 0x29], 0xc2e2c2ee
mov dword [rbp - 0x25], 0xc2c9c2f9
mov dword [rbp - 0x21], 0xc2fec2ea
mov dword [rbp - 0x1d], 0xc2e0c2f4
mov dword [rbp - 0x19], 0xc2f7c2fa
mov dword [rbp - 0x15], 0xc2f7c2c1
mov dword [rbp - 0x11], 0xc2f4c2f5
mov dword [rbp - 0xd], 0xc2dbc2fc
mov dword [rbp - 9], 0xc2f0c2ed
mov word [rbp - 5], bx
mov byte [rbp - 3], 1
mov ecx, 0x3d95
nop word [rax + rax]
movzx eax, bx
sub ax, cx
xor word [rbp + rbx*2 - 0x69], ax
inc rbx
cmp rbx, 0x32
jb 0x14004f820
mov byte [rbp - 3], 0
lea rdx, [rbp - 0x69]
mov rcx, qword [0x140070250]
call fcn.140054b30
lea rdx, [0x140054d10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.14006c910
add rsp, 0xd0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rsp + 0x20], r14
mov r9, rdi
lea rdx, [rbp + 0x27]
mov rcx, rsi
call fcn.140058a90
test al, al
je 0x14004f858
mov rax, qword [rbp + 0x27]
jmp 0x14004f85a
Function at 0x1400509c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0xf70]
mov eax, 0x1070
call fcn.14006dd40
sub rsp, rax
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rbp + 0xf60], rax
mov rdi, r9
mov rbx, r8
test r8, r8
je 0x140050bdb
mov r9d, 0x1000
lea rdx, [rsp + 0x60]
call fcn.14004d3a0
xor edx, edx
test al, al
jne 0x140050ac4
mov dword [rsp + 0x20], 0xc241c230
mov r8d, 0x3d95
mov dword [rsp + 0x24], 0xc24ec230
mov dword [rsp + 0x28], 0xc211c22c
mov dword [rsp + 0x2c], 0xc255c21f
mov dword [rsp + 0x30], 0xc254c207
mov dword [rsp + 0x34], 0xc213c207
mov dword [rsp + 0x38], 0xc21cc216
mov dword [rsp + 0x3c], 0xc217c259
mov dword [rsp + 0x40], 0xc218c214
mov dword [rsp + 0x44], 0xc212c208
mov dword [rsp + 0x48], 0xc2a0c21a
mov dword [rsp + 0x4c], 0xc2e7c2e9
mov dword [rsp + 0x50], 0xc2e0c2e2
mov dword [rsp + 0x54], 0xc2f4c2e0
mov dword [rsp + 0x58], 0xc2f4
mov byte [rsp + 0x5c], 1
nop word [rax + rax]
movzx eax, dx
sub ax, r8w
xor word [rsp + rdx*2 + 0x20], ax
inc rdx
cmp rdx, 0x1d
jb 0x140050aa0
mov byte [rsp + 0x5c], 0
lea rdx, [rsp + 0x20]
jmp 0x140050bbf
movsxd rax, dword [rbp - 0x64]
lea rcx, [rsp + 0x60]
add rcx, rax
mov r9d, edx
movzx eax, word [rcx + 0x14]
lea r11, [rcx + 0x18]
movzx r10d, word [rcx + 6]
add r11, rax
test r10d, r10d
je 0x140050b2b
nop dword [rax + rax]
mov eax, r9d
lea rcx, [rax + rax*4]
cmp dword [r11 + rcx*8], 0x45474150
lea r8, [r11 + rcx*8]
jne 0x140050b23
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [r8 + rax], dl
jne 0x140050b10
cmp rax, 4
je 0x140050bf7
inc r9d
cmp r9d, r10d
jb 0x140050af0
mov dword [rsp + 0x20], 0xc241c230
mov r8d, 0x3d95
mov dword [rsp + 0x24], 0xc24ec230
mov dword [rsp + 0x28], 0xc211c22c
mov dword [rsp + 0x2c], 0xc255c21f
mov dword [rsp + 0x30], 0xc254c207
mov dword [rsp + 0x34], 0xc21fc213
mov dword [rsp + 0x38], 0xc21cc219
mov dword [rsp + 0x3c], 0xc209c259
mov dword [rsp + 0x40], 0xc21fc21e
mov dword [rsp + 0x44], 0xc217c209
mov dword [rsp + 0x48], 0xc2eec210
mov word [rsp + 0x4c], dx
mov byte [rsp + 0x4e], 1
nop dword [rax]
nop word [rax + rax]
movzx eax, dx
sub ax, r8w
xor word [rsp + rdx*2 + 0x20], ax
inc rdx
cmp rdx, 0x16
jb 0x140050ba0
mov byte [rsp + 0x4e], 0
lea rdx, [rsp + 0x20]
mov rcx, qword [0x140070250]
call fcn.140054b30
lea rdx, [0x140054d10]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
xor eax, eax
mov rcx, qword [rbp + 0xf60]
xor rcx, rsp
call fcn.14006c910
add rsp, 0x1070
pop rdi
pop rbx
pop rbp
ret
mov eax, dword [r8 + 0xc]
test eax, eax
je 0x140050b2b
mov ecx, dword [r8 + 8]
lea r8, [rsp + 0x60]
add r8, rax
je 0x140050b2b
test ecx, ecx
je 0x140050b2b
test rdi, rdi
je 0x140050c24
mov dword [rdi], ecx
lea rax, [rsp + 0x60]
sub rbx, rax
lea rax, [r8 + rbx]
jmp 0x140050bdd
Function at 0x140053260
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x76], 0
je 0x140053288
xor eax, eax
mov r8d, 0x3d95
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x3a
jb 0x140053270
mov byte [rcx + 0x76], 0
ret

Function at 0x140053290
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6c], 0
je 0x1400532b8
xor eax, eax
mov r8d, 0x3d95
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x35
jb 0x1400532a0
mov byte [rcx + 0x6c], 0
ret

Function at 0x1400532c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x74], 0
je 0x1400532e8
xor eax, eax
mov r8d, 0x3d95
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x39
jb 0x1400532d0
mov byte [rcx + 0x74], 0
ret

Function at 0x1400532f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x6e], 0
je 0x140053318
xor eax, eax
mov r8d, 0x3d95
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x36
jb 0x140053300
mov byte [rcx + 0x6e], 0
ret

Function at 0x140053320
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x48], 0
je 0x140053348
xor eax, eax
mov r8d, 0x3d95
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x23
jb 0x140053330
mov byte [rcx + 0x48], 0
ret

Function at 0x140053350
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x66], 0
je 0x140053378
xor eax, eax
mov r8d, 0x3d95
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x32
jb 0x140053360
mov byte [rcx + 0x66], 0
ret

Function at 0x140053670
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x1400536a7
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x1400536c8
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400536ca
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140053723
test ecx, ecx
jle 0x140053703
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140053723
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140053723
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140053750
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140053772
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140053788
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400537a4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400537a6
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x1400537e0
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140053887
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x14005381b
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x140053861
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x1400538a0
cmp rbx, rax
ja 0x140053830
mov r8, rdi
test rdi, rdi
je 0x140053887
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x14005388a
Function at 0x140053ca0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140093010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140053ccd
xor eax, eax
jmp 0x140053e22
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140053cf8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140053cf8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x140053e22
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140053e15
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x140053d3b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140053d66
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140053e1a
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140053dd5
sub eax, 1
je 0x140053dd5
cmp eax, 2
jne 0x140053e15
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140053e1a
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140053e03
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140053e15
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x140053e1a
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14006c910
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x140053ff0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4a], 0
je 0x140054018
xor eax, eax
mov r8d, 0x3d95
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x24
jb 0x140054000
mov byte [rcx + 0x4a], 0
ret

Function at 0x140054020
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x50], 0
je 0x140054048
xor eax, eax
mov r8d, 0x3d95
nop
movzx edx, ax
sub dx, r8w
xor word [rcx + rax*2], dx
inc rax
cmp rax, 0x27
jb 0x140054030
mov byte [rcx + 0x50], 0
ret