joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140052450
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14006a040]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [0x14006b910], 0
movsx edi, dx
movsx ebx, cx
ja 0x140052483
mov eax, 0xffffdcd8
jmp 0x14005258e
inc dword [0x14006b0c8]
mov dword [0x14006b0cc], 0xaede7345
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movups xmm1, xmmword [0x14006b098]
mov rcx, qword [0x14006b910]
lea rdx, [0x14006b0c0]
mov dword [0x14006b08c], ebx
xor r9d, r9d
mov dword [0x14006b090], edi
mov r8d, 0x48
movups xmm0, xmmword [0x14006b088]
mov dword [0x14006b0c4], eax
lea rax, [0x14006b900]
movaps xmmword [0x14006b0e0], xmm1
movsd xmm1, qword [0x14006b0b8]
movaps xmmword [0x14006b0d0], xmm0
movups xmm0, xmmword [0x14006b0a8]
mov dword [rsp + 0x28], sendto
movsd qword [0x14006b100], xmm1
movaps xmmword [0x14006b0f0], xmm0
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
mov rcx, qword [0x14006b910]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x14006b4e0]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], sendto
xor ebx, ebx
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov qword [0x14006b08c], rbx
mov r8d, 0x400
call qword [sym.imp.WS2_32.dll_recvfrom]
test eax, eax
jns 0x140052563
mov eax, 0xffffdcdb
jmp 0x14005258e
mov eax, dword [0x14006b0cc]
cmp dword [0x14006b4ec], eax
je 0x140052578
mov ebx, 0xffffdcdc
jmp 0x14005258c
mov ecx, dword [0x14006b0c8]
mov eax, 0xffffdcdd
cmp dword [0x14006b4e8], ecx
cmovne ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140052730
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400525b0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
sub rsp, 0x58
mov rax, qword [0x14006a040]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp qword [0x14006b910], 0
ja 0x1400525e4
mov eax, 0xffffdcd8
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140052730
add rsp, 0x58
ret
inc dword [0x14006b0c8]
mov dword [0x14006b0cc], 0x9823ae8d
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
movups xmm1, xmmword [0x14006b098]
and dword [0x14006b088], 0xfffffffe
lea rdx, [0x14006b0c0]
movups xmm0, xmmword [0x14006b088]
mov rcx, qword [0x14006b910]
xor r9d, r9d
mov dword [0x14006b0c4], eax
mov r8d, 0x48
movaps xmmword [0x14006b0d0], xmm0
lea rax, [0x14006b900]
movups xmm0, xmmword [0x14006b0a8]
mov dword [rsp + 0x28], sendto
movaps xmmword [0x14006b0e0], xmm1
movsd xmm1, qword [0x14006b0b8]
movaps xmmword [0x14006b0f0], xmm0
movsd qword [0x14006b100], xmm1
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
mov rcx, qword [0x14006b910]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [0x14006b4e0]
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], sendto
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8d, 0x400
call qword [sym.imp.WS2_32.dll_recvfrom]
test eax, eax
jns 0x1400526c6
mov eax, 0xffffdcdb
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140052730
add rsp, 0x58
ret
mov eax, dword [0x14006b0cc]
cmp dword [0x14006b4ec], eax
je 0x1400526eb
mov eax, 0xffffdcdc
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140052730
add rsp, 0x58
ret
mov ecx, dword [0x14006b0c8]
xor eax, eax
cmp dword [0x14006b4e8], ecx
mov edx, 0xffffdcdd
cmovne eax, edx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140052730
add rsp, 0x58
ret

Function at 0x14005350c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140053556
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140053556
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140053556
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140053556
cmp dword [rcx + 0x84], 0xe
jbe 0x140053556
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140053558
xor al, al
add rsp, 0x28
ret

Function at 0x140053814
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14005384e
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x140053853
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14005389c
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140056ba0]
cmp byte [rcx + rax], 0
je 0x14005389c
dec r8
sub rdx, 1
jne 0x140053882
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140053e8c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.1400538b4
mov ebx, eax
test eax, eax
jne 0x140053ebc
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x140053f1f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140053f16
test al, 0x10
je 0x140053f16
bt eax, 0xa
jae 0x140053f0f
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.140053f30
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x140053f0b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140053f0b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
test edi, edi
jne 0x140053f16
and dword [rsp + 0x3c], 0
jmp 0x140053f1b
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14000fb40
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x140033040]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0x238
mov ecx, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000fbe3
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000fbda
cmp qword [rbx + 0x18], 7
mov r8, rbx
jbe 0x14000fb9f
mov r8, qword [rbx]
lea rax, [rsp + 0x4c]
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14000fbc4
add rax, 2
test ecx, ecx
jne 0x14000fbb0
mov rcx, rdi
test edx, edx
je 0x14000fc06
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000fb92
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140025930
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x14000fbe5
Function at 0x14000fca0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x140033040]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rdi, rcx
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000fcdf
xor al, al
jmp 0x14000fe06
mov qword [rsp + 0x2a0], rbx
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov qword [rsp + 0x2a8], rbp
mov dword [rsp + 0x40], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000fdeb
xor ebp, ebp
nop
xorps xmm0, xmm0
mov qword [rsp + 0x30], rbp
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x6c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], bp
jne 0x14000fd30
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.14001f0e0
cmp qword [rdi + 0x18], 7
mov rax, rdi
jbe 0x14000fd56
mov rax, qword [rdi]
mov r10, qword [rsp + 0x38]
lea r8, [rsp + 0x20]
mov r9, qword [rsp + 0x20]
cmp r10, 7
mov rdx, qword [rsp + 0x30]
cmova r8, r9
cmp rdx, qword [rdi + 0x10]
jne 0x14000fd98
test rdx, rdx
je 0x14000fd94
sub r8, rax
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x14000fd98
add rax, 2
sub rdx, 1
jne 0x14000fd80
mov bl, 1
jmp 0x14000fd9a
xor bl, bl
cmp r10, 7
jbe 0x14000fdd1
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x14000fdc9
mov r9, qword [r9 - 8]
add rdx, 0x27
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000fe27
mov rcx, r9
call fcn.14002598c
mov rcx, rsi
test bl, bl
jne 0x14000fe2e
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000fd10
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rbx, qword [rsp + 0x2a0]
mov rbp, qword [rsp + 0x2a8]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140025930
mov rsi, qword [rsp + 0x2b0]
add rsp, 0x290
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x14000fdf6
Function at 0x140018d90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3e], 0
mov rdx, rcx
je 0x140018ed8
movdqa xmm3, xmmword [0x14002cb20]
lea r8, [rcx + 8]
movdqa xmm4, xmmword [0x14002cb50]
xor eax, eax
mov r9d, 0xe1b8
nop dword [rax]
movd xmm1, dword [r8 - 8]
lea rcx, [r9 - 5]
xorps xmm0, xmm0
lea r8, [r8 + 0x10]
punpcklwd xmm1, xmm0
movq xmm2, rax
punpckldq xmm1, xmm0
add rax, 8
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 3]
movd dword [r8 - 0x18], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x14]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 1]
movd dword [r8 - 0x14], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x10]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r9
movd dword [r8 - 0x10], xmm1
add r9, 8
movd xmm1, dword [r8 - 0xc]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 - 0xc], xmm1
cmp r9, 0xe1d0
jb 0x140018dc0
cmp rax, 0x1e
jae 0x140018ed4
mov r8d, 0x1e4f
nop word [rax + rax]
movzx ecx, ax
sub cx, r8w
xor word [rdx + rax*2], cx
inc rax
cmp rax, 0x1e
jb 0x140018ec0
mov byte [rdx + 0x3e], 0
mov rax, rdx
ret

Function at 0x140018ee0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4c], 0
mov rdx, rcx
je 0x140019028
movdqa xmm3, xmmword [0x14002cb20]
lea r8, [rcx + 8]
movdqa xmm4, xmmword [0x14002cb50]
xor eax, eax
mov r9d, 0xe1b8
nop dword [rax]
movd xmm1, dword [r8 - 8]
lea rcx, [r9 - 5]
xorps xmm0, xmm0
lea r8, [r8 + 0x10]
punpcklwd xmm1, xmm0
movq xmm2, rax
punpckldq xmm1, xmm0
add rax, 8
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 3]
movd dword [r8 - 0x18], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x14]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 1]
movd dword [r8 - 0x14], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x10]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r9
movd dword [r8 - 0x10], xmm1
add r9, 8
movd xmm1, dword [r8 - 0xc]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 - 0xc], xmm1
cmp r9, 0xe1d8
jb 0x140018f10
cmp rax, 0x25
jae 0x140019024
mov r8d, 0x1e4f
nop word [rax + rax]
movzx ecx, ax
sub cx, r8w
xor word [rdx + rax*2], cx
inc rax
cmp rax, 0x25
jb 0x140019010
mov byte [rdx + 0x4c], 0
mov rax, rdx
ret
Function at 0x1400190d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [0x140033040]
xor rax, rsp
mov qword [rbp + 0x410], rax
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x4d0
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x70], 0x100010
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140019197
cmp qword [rbp - 0x78], 0
jne 0x140019140
cmp qword [rbp - 0x70], 0
jne 0x140019140
cmp qword [rbp - 0x68], 0
jne 0x140019140
cmp qword [rbp - 0x60], 0
je 0x140019197
movdqa xmm0, xmmword [0x14002cbf0]
lea rdx, [rsp + 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x3a], 0x216465
mov dword [rsp + 0x30], 0x20746e69
mov dword [rsp + 0x34], 0x65746564
mov word [rsp + 0x38], 0x7463
mov byte [rsp + 0x3e], 0
call fcn.14001e020
lea rdx, [0x14001e1f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov al, 1
jmp 0x140019199
xor al, al
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.140025930
add rsp, 0x520
pop rbp
ret
Function at 0x14001b470
Capabilities:
Delete registry key

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140033040]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftInternet_ExplorerLowRegistryAudioPolicyConfigPropertyStore
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rdx, [0x14002b24c]
mov ebx, eax
test eax, eax
jne 0x14001b52b
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
mov ebx, eax
test eax, eax
jne 0x14001b4df
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, str.Registry_key_deleted_successfully.
call fcn.14001e600
jmp 0x14001b4fd
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
lea rdx, [0x14002b24c]
call fcn.14001e600
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
lea rdx, [0x14001e7d0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140025930
add rsp, 0x40
pop rbx
ret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.14001e600
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int____ptr64]
mov rcx, rax
lea rdx, [0x14001e7d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140025930
add rsp, 0x40
pop rbx
ret
Function at 0x14001bbc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [0x140033149], 0
je 0x14001bc3d
xor eax, eax
lea rdx, [0x1400330f0]
nop dword [rax]
nop word [rax + rax]
lea ecx, [rax - 0x4f]
xor byte [rax + rdx], cl
lea ecx, [rax - 0x4e]
xor byte [rax + rdx + 1], cl
lea ecx, [rax - 0x4d]
xor byte [rax + rdx + 2], cl
lea ecx, [rax - 0x4c]
xor byte [rax + rdx + 3], cl
lea ecx, [rax - 0x4b]
xor byte [rax + rdx + 4], cl
lea ecx, [rax - 0x4a]
xor byte [rax + rdx + 5], cl
lea ecx, [rax - 0x49]
xor byte [rax + rdx + 6], cl
lea ecx, [rax - 0x48]
xor byte [rax + rdx + 7], cl
lea ecx, [rax - 0x47]
xor byte [rax + rdx + 8], cl
lea ecx, [rax - 0x46]
xor byte [rax + rdx + 9], cl
lea ecx, [rax - 0x45]
xor byte [rax + rdx + 0xa], cl
add rax, 0xb
cmp rax, 0x58
jb 0x14001bbe0
mov byte [0x140033149], 0
ret

Function at 0x14001bd40
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
lea r8, [rcx + 0xa]
je 0x14001bda4
mov edx, 0xe1b2
mov r9d, 2
nop word [rax + rax]
movd xmm1, dword [rcx]
lea rax, [rdx - 1]
movq xmm0, rdx
lea rcx, [rcx + 4]
movq xmm2, rax
add rdx, 2
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rcx - 4], xmm1
sub r9, 1
jne 0x14001bd60
mov byte [r8], r9b
ret

Function at 0x14001bdf0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
lea r8, [rcx + 0xe]
je 0x14001be54
mov edx, 0xe1b2
mov r9d, 3
nop word [rax + rax]
movd xmm1, dword [rcx]
lea rax, [rdx - 1]
movq xmm0, rdx
lea rcx, [rcx + 4]
movq xmm2, rax
add rdx, 2
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rcx - 4], xmm1
sub r9, 1
jne 0x14001be10
mov byte [r8], r9b
ret
Function at 0x14001be60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x4c], 0
mov rdx, rcx
je 0x14001bfa8
movdqa xmm3, xmmword [0x14002cb20]
lea r8, [rcx + 8]
movdqa xmm4, xmmword [0x14002cb50]
xor eax, eax
mov r9d, 0xe1b8
nop dword [rax]
movd xmm1, dword [r8 - 8]
lea rcx, [r9 - 5]
xorps xmm0, xmm0
lea r8, [r8 + 0x10]
punpcklwd xmm1, xmm0
movq xmm2, rax
punpckldq xmm1, xmm0
add rax, 8
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 3]
movd dword [r8 - 0x18], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x14]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 1]
movd dword [r8 - 0x14], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x10]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r9
movd dword [r8 - 0x10], xmm1
add r9, 8
movd xmm1, dword [r8 - 0xc]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 - 0xc], xmm1
cmp r9, 0xe1d8
jb 0x14001be90
cmp rax, 0x25
jae 0x14001bfa4
mov r8d, 0x1e4f
nop word [rax + rax]
movzx ecx, ax
sub cx, r8w
xor word [rdx + rax*2], cx
inc rax
cmp rax, 0x25
jb 0x14001bf90
mov byte [rdx + 0x4c], 0
ret

Function at 0x14001bfb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x3e], 0
mov rdx, rcx
je 0x14001c0f8
movdqa xmm3, xmmword [0x14002cb20]
lea r8, [rcx + 8]
movdqa xmm4, xmmword [0x14002cb50]
xor eax, eax
mov r9d, 0xe1b8
nop dword [rax]
movd xmm1, dword [r8 - 8]
lea rcx, [r9 - 5]
xorps xmm0, xmm0
lea r8, [r8 + 0x10]
punpcklwd xmm1, xmm0
movq xmm2, rax
punpckldq xmm1, xmm0
add rax, 8
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 3]
movd dword [r8 - 0x18], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x14]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 1]
movd dword [r8 - 0x14], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x10]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r9
movd dword [r8 - 0x10], xmm1
add r9, 8
movd xmm1, dword [r8 - 0xc]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 - 0xc], xmm1
cmp r9, 0xe1d0
jb 0x14001bfe0
cmp rax, 0x1e
jae 0x14001c0f4
mov r8d, 0x1e4f
nop word [rax + rax]
movzx ecx, ax
sub cx, r8w
xor word [rdx + rax*2], cx
inc rax
cmp rax, 0x1e
jb 0x14001c0e0
mov byte [rdx + 0x3e], 0
ret
Function at 0x14001c100
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x34], 0
mov rdx, rcx
je 0x14001c248
movdqa xmm3, xmmword [0x14002cb20]
lea r8, [rcx + 8]
movdqa xmm4, xmmword [0x14002cb50]
xor eax, eax
mov r9d, 0xe1b8
nop dword [rax]
movd xmm1, dword [r8 - 8]
lea rcx, [r9 - 5]
xorps xmm0, xmm0
lea r8, [r8 + 0x10]
punpcklwd xmm1, xmm0
movq xmm2, rax
punpckldq xmm1, xmm0
add rax, 8
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 3]
movd dword [r8 - 0x18], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x14]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 1]
movd dword [r8 - 0x14], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x10]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r9
movd dword [r8 - 0x10], xmm1
add r9, 8
movd xmm1, dword [r8 - 0xc]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 - 0xc], xmm1
cmp r9, 0xe1d0
jb 0x14001c130
cmp rax, 0x19
jae 0x14001c244
mov r8d, 0x1e4f
nop word [rax + rax]
movzx ecx, ax
sub cx, r8w
xor word [rdx + rax*2], cx
inc rax
cmp rax, 0x19
jb 0x14001c230
mov byte [rdx + 0x34], 0
ret

Function at 0x14001c250
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x30], 0
mov rdx, rcx
je 0x14001c398
movdqa xmm3, xmmword [0x14002cb20]
lea r8, [rcx + 8]
movdqa xmm4, xmmword [0x14002cb50]
xor eax, eax
mov r9d, 0xe1b8
nop dword [rax]
movd xmm1, dword [r8 - 8]
lea rcx, [r9 - 5]
xorps xmm0, xmm0
lea r8, [r8 + 0x10]
punpcklwd xmm1, xmm0
movq xmm2, rax
punpckldq xmm1, xmm0
add rax, 8
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 3]
movd dword [r8 - 0x18], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x14]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 1]
movd dword [r8 - 0x14], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x10]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r9
movd dword [r8 - 0x10], xmm1
add r9, 8
movd xmm1, dword [r8 - 0xc]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 - 0xc], xmm1
cmp r9, 0xe1c8
jb 0x14001c280
cmp rax, 0x17
jae 0x14001c394
mov r8d, 0x1e4f
nop word [rax + rax]
movzx ecx, ax
sub cx, r8w
xor word [rdx + rax*2], cx
inc rax
cmp rax, 0x17
jb 0x14001c380
mov byte [rdx + 0x30], 0
ret