joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140198590
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push r13
push r14
sub rsp, 0x28
mov rax, qword [rcx]
mov r14, rdx
mov r11, rcx
mov r13, qword [rax]
movsxd rax, dword [rax + 0x10]
shl rax, 4
add rax, r13
mov qword [rsp + 0x58], rax
cmp r13, rax
je 0x1401987be
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 8], r12
mov qword [rsp], r15
nop
mov ecx, dword [r11 + 8]
mov edx, dword [r13]
mov r10d, edx
mov r8d, dword [r11 + 0xc]
cmp edx, ecx
mov r9d, dword [r13 + 4]
mov edi, r9d
mov ebp, dword [r13 + 8]
cmovl r10d, ecx
mov r12d, dword [r13 + 0xc]
cmp r9d, r8d
mov dword [rsp + 0x50], r10d
cmovl edi, r8d
add ecx, dword [r11 + 0x10]
add ebp, edx
cmp ecx, ebp
cmovl ebp, ecx
mov ecx, dword [r11 + 0x14]
add ecx, r8d
add r12d, r9d
cmp ecx, r12d
cmovl r12d, ecx
mov eax, r12d
sub eax, edi
sub ebp, r10d
js 0x140198792
test eax, eax
js 0x140198792
test ebp, ebp
jle 0x140198792
test eax, eax
jle 0x140198792
cmp edi, r12d
jge 0x140198792
nop dword [rax + rax]
mov r8, qword [r14]
mov eax, dword [r8 + 0xc]
imul eax, edi
movsxd rdx, eax
add rdx, qword [r8]
mov qword [r14 + 8], rdx
movsxd r9, dword [r8 + 0x10]
mov eax, r9d
imul eax, r10d
movsxd rcx, eax
mov eax, dword [r14 + 0x10]
add rcx, rdx
cmp byte [r14 + 0x13], 0xff
jb 0x1401986a2
mov edx, ebp
mov dword [rcx], eax
dec edx
add rcx, r9
test edx, edx
jg 0x140198692
jmp 0x140198782
mov ebx, eax
mov esi, ebp
shr ebx, 8
mov r15, r9
and ebx, 0xff00ff
and eax, 0xff00ff
nop word [rax + rax]
mov edx, ebx
mov r8d, 0x100
shr edx, 0x10
mov r9d, 0x100
sub r8d, edx
dec esi
mov edx, dword [rcx]
mov r10d, edx
shr edx, 8
and r10d, 0xff00ff
and edx, 0xff00ff
imul r10d, r8d
imul edx, r8d
mov r8d, 0x100
shr r10d, 8
shr edx, 8
and r10d, 0xff00ff
and edx, 0xff00ff
add r10d, eax
lea r11d, [rdx + rbx]
mov edx, r11d
shr edx, 8
and edx, 0xff00ff
sub r9d, edx
mov edx, r11d
shl edx, 8
shl r9d, 8
or r9d, edx
mov edx, r10d
shr edx, 8
and edx, 0xff00ff
sub r8d, edx
mov edx, r11d
or r8d, r10d
shr edx, 8
xor r9d, r8d
shl r11d, 8
and edx, 0xff00ff
and r9d, 0xff00ff
mov r8d, 0x100
sub r8d, edx
shl r8d, 8
or r8d, r11d
xor r9d, r8d
mov dword [rcx], r9d
add rcx, r15
test esi, esi
jg 0x1401986c0
mov r10d, dword [rsp + 0x50]
inc edi
cmp edi, r12d
jl 0x140198660
mov r11, qword [rsp + 0x40]
add r13, 0x10
cmp r13, qword [rsp + 0x58]
jne 0x1401985e0
mov r15, qword [rsp]
mov r12, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop r14
pop r13
ret
Function at 0x14019b160
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movsxd rsi, r8d
mov r14d, r9d
mov ebp, edx
mov rdi, rcx
cmp esi, dword [rcx + 0x80]
jle 0x14019b1ab
mov qword [rcx + 0x80], rsi
mov rcx, qword [rcx + 0x78]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rdi + 0x78], rax
mov rbx, qword [rdi + 0x78]
mov r9d, esi
mov rdx, rbx
mov r8d, ebp
mov rcx, rdi
call fcn.140187060
mov rax, qword [rdi + 0x48]
mov r11d, dword [rdi + 0x58]
imul r11d, r14d
movsxd rcx, dword [rax + 0x10]
mov eax, ecx
imul eax, ebp
sar r11d, 8
movsxd r10, eax
add r10, qword [rdi + 0x70]
cmp r11d, 0xfe
jge 0x14019b2bf
mov rdi, rcx
movzx ecx, byte [rbx]
lea rbx, [rbx + 1]
mov r9d, ecx
mov edx, 0x100
shl r9d, 0x10
dec esi
or r9d, ecx
mov ecx, 0x100
imul r9d, r11d
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rdi
test esi, esi
jg 0x14019b1f0
jmp 0x14019b38b
mov r11, rcx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rbx]
lea rbx, [rbx + 1]
mov r9d, ecx
mov edx, 0x100
shl r9d, 0x10
dec esi
or r9d, ecx
mov ecx, 0x100
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, r11
test esi, esi
jg 0x14019b2d0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14019b3b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movsxd rsi, r8d
mov r14d, r9d
mov ebp, edx
mov rdi, rcx
cmp esi, dword [rcx + 0x80]
jle 0x14019b3fb
mov qword [rcx + 0x80], rsi
mov rcx, qword [rcx + 0x78]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rdi + 0x78], rax
mov rbx, qword [rdi + 0x78]
mov r9d, esi
mov rdx, rbx
mov r8d, ebp
mov rcx, rdi
call fcn.14019ee00
mov rax, qword [rdi + 0x48]
mov r11d, dword [rdi + 0x58]
imul r11d, r14d
movsxd rcx, dword [rax + 0x10]
mov eax, ecx
imul eax, ebp
sar r11d, 8
movsxd r10, eax
add r10, qword [rdi + 0x70]
cmp r11d, 0xfe
jge 0x14019b50f
mov rdi, rcx
movzx ecx, byte [rbx]
lea rbx, [rbx + 1]
mov r9d, ecx
mov edx, 0x100
shl r9d, 0x10
dec esi
or r9d, ecx
mov ecx, 0x100
imul r9d, r11d
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rdi
test esi, esi
jg 0x14019b440
jmp 0x14019b5db
mov r11, rcx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rbx]
lea rbx, [rbx + 1]
mov r9d, ecx
mov edx, 0x100
shl r9d, 0x10
dec esi
or r9d, ecx
mov ecx, 0x100
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, r11
test esi, esi
jg 0x14019b520
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14019b600
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
movsxd rbx, r8d
mov r14d, r9d
mov ebp, edx
mov rsi, rcx
cmp ebx, dword [rcx + 0x80]
jle 0x14019b644
mov qword [rcx + 0x80], rbx
mov rcx, qword [rcx + 0x78]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbx + rbx*2]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsi + 0x78], rax
mov rdi, qword [rsi + 0x78]
mov r9d, ebx
mov rdx, rdi
mov r8d, ebp
mov rcx, rsi
call fcn.14019f0d0
mov rax, qword [rsi + 0x48]
movsxd rcx, dword [rax + 0x10]
mov eax, ecx
imul eax, ebp
movsxd r11, eax
add r11, qword [rsi + 0x70]
mov esi, dword [rsi + 0x58]
imul esi, r14d
sar esi, 8
cmp esi, 0xfe
jge 0x14019b77d
mov rbp, rcx
nop word [rax + rax]
mov r8d, dword [r11]
mov rcx, rdi
mov edx, 0x100
add rdi, 3
dec ebx
movzx r10d, byte [rcx + 1]
movzx r9d, byte [rcx + 2]
or r10d, 0xff0000
shl r9d, 0x10
imul r10d, esi
shr r10d, 8
and r10d, 0xff00ff
mov eax, r10d
shr eax, 0x10
sub edx, eax
movzx eax, byte [rcx]
or r9d, eax
mov ecx, 0x100
mov eax, r8d
imul r9d, esi
and eax, 0xff00ff
shr r8d, 8
imul eax, edx
and r8d, 0xff00ff
imul r8d, edx
mov edx, 0x100
shr r9d, 8
and r9d, 0xff00ff
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r10d, r8d
mov eax, r10d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r10d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r10d
or ecx, r9d
shr eax, 8
xor edx, ecx
shl r10d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r10d
xor edx, ecx
mov dword [r11], edx
add r11, rbp
test ebx, ebx
jg 0x14019b690
jmp 0x14019b7b9
mov r8, rcx
mov rcx, rdi
dec ebx
add rdi, 3
movzx eax, word [rcx]
movzx edx, byte [rcx + 2]
shl edx, 8
mov word [rsp + 0x50], ax
movzx eax, byte [rsp + 0x51]
or edx, eax
movzx eax, byte [rsp + 0x50]
shl edx, 8
or edx, eax
or edx, 0xff000000
mov dword [r11], edx
add r11, r8
test ebx, ebx
jg 0x14019b780
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14019b7d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
movsxd rbx, r8d
mov r14d, r9d
mov ebp, edx
mov rsi, rcx
cmp ebx, dword [rcx + 0x80]
jle 0x14019b814
mov qword [rcx + 0x80], rbx
mov rcx, qword [rcx + 0x78]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rbx + rbx*2]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsi + 0x78], rax
mov rdi, qword [rsi + 0x78]
mov r9d, ebx
mov rdx, rdi
mov r8d, ebp
mov rcx, rsi
call fcn.14019f640
mov rax, qword [rsi + 0x48]
movsxd rcx, dword [rax + 0x10]
mov eax, ecx
imul eax, ebp
movsxd r11, eax
add r11, qword [rsi + 0x70]
mov esi, dword [rsi + 0x58]
imul esi, r14d
sar esi, 8
cmp esi, 0xfe
jge 0x14019b94d
mov rbp, rcx
nop word [rax + rax]
mov r8d, dword [r11]
mov rcx, rdi
mov edx, 0x100
add rdi, 3
dec ebx
movzx r10d, byte [rcx + 1]
movzx r9d, byte [rcx + 2]
or r10d, 0xff0000
shl r9d, 0x10
imul r10d, esi
shr r10d, 8
and r10d, 0xff00ff
mov eax, r10d
shr eax, 0x10
sub edx, eax
movzx eax, byte [rcx]
or r9d, eax
mov ecx, 0x100
mov eax, r8d
imul r9d, esi
and eax, 0xff00ff
shr r8d, 8
imul eax, edx
and r8d, 0xff00ff
imul r8d, edx
mov edx, 0x100
shr r9d, 8
and r9d, 0xff00ff
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r10d, r8d
mov eax, r10d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r10d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r10d
or ecx, r9d
shr eax, 8
xor edx, ecx
shl r10d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r10d
xor edx, ecx
mov dword [r11], edx
add r11, rbp
test ebx, ebx
jg 0x14019b860
jmp 0x14019b989
mov r8, rcx
mov rcx, rdi
dec ebx
add rdi, 3
movzx eax, word [rcx]
movzx edx, byte [rcx + 2]
shl edx, 8
mov word [rsp + 0x50], ax
movzx eax, byte [rsp + 0x51]
or edx, eax
movzx eax, byte [rsp + 0x50]
shl edx, 8
or edx, eax
or edx, 0xff000000
mov dword [r11], edx
add r11, r8
test ebx, ebx
jg 0x14019b950
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14019b9a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movsxd rsi, r8d
mov r14d, r9d
mov ebp, edx
mov rdi, rcx
cmp esi, dword [rcx + 0x80]
jle 0x14019b9f0
mov qword [rcx + 0x80], rsi
mov rcx, qword [rcx + 0x78]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rcx, [rsi*4]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rdi + 0x78], rax
mov rbx, qword [rdi + 0x78]
mov r9d, esi
mov rdx, rbx
mov r8d, ebp
mov rcx, rdi
call fcn.14019f9e0
mov rax, qword [rdi + 0x48]
mov r11d, dword [rdi + 0x58]
imul r11d, r14d
movsxd rcx, dword [rax + 0x10]
mov eax, ecx
imul eax, ebp
sar r11d, 8
movsxd r10, eax
add r10, qword [rdi + 0x70]
cmp r11d, 0xfe
jge 0x14019bb25
mov rdi, rcx
nop word [rax + rax]
mov edx, dword [rbx]
lea rbx, [rbx + 4]
mov r9d, edx
mov ecx, 0x100
and edx, 0xff00ff
shr r9d, 8
imul edx, r11d
and r9d, 0xff00ff
imul r9d, r11d
dec esi
shr edx, 8
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rdi
test esi, esi
jg 0x14019ba40
jmp 0x14019bbf4
mov r11, rcx
nop dword [rax + rax]
mov edx, dword [rbx]
lea rbx, [rbx + 4]
mov r9d, edx
mov ecx, 0x100
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
dec esi
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, r11
test esi, esi
jg 0x14019bb30
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14019cf20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov r9, qword [rcx]
mov ebx, edx
mov edi, r8d
mov r11, rcx
movsxd rdx, dword [r9 + 0x10]
mov eax, edx
imul eax, ebx
sub ebx, dword [rcx + 0x14]
movsxd r10, eax
add r10, qword [rcx + 0x20]
cmp dword [rcx + 0x10], 0xfe
jge 0x14019d049
mov rsi, rdx
nop dword [rax]
mov rax, qword [r11 + 8]
mov edx, ebx
inc ebx
dec edi
mov ecx, dword [rax + 0x10]
mov rax, qword [r11 + 0x28]
imul ecx, edx
movsxd rdx, ecx
movzx ecx, byte [rdx + rax]
mov edx, 0x100
mov r9d, ecx
shl r9d, 0x10
or r9d, ecx
mov ecx, 0x100
imul r9d, dword [r11 + 0x10]
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rsi
test edi, edi
jg 0x14019cf60
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
pop rdi
ret
mov r8, qword [rcx + 8]
movsxd rcx, dword [r8 + 0x10]
mov eax, ecx
imul eax, ebx
movsxd rbx, eax
add rbx, qword [r11 + 0x28]
cmp edx, ecx
jne 0x14019d08b
cmp dword [r8 + 8], 1
jne 0x14019d08b
cmp dword [r9 + 8], 1
jne 0x14019d08b
imul ecx, edi
mov rdx, rbx
movsxd r8, ecx
mov rcx, r10
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
pop rdi
jmp sub.VCRUNTIME140.dll_memcpy
mov r11, rdx
mov rsi, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx]
mov ecx, 0x100
mov r9d, eax
mov edx, 0x100
shl r9d, 0x10
add rbx, rsi
or r9d, eax
dec edi
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, r11
test edi, edi
jg 0x14019d0a0
mov rbx, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
pop rdi
ret
Function at 0x14019d170
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx]
mov esi, edx
mov r11d, dword [rcx + 0x10]
mov edi, r8d
imul r11d, r9d
mov rbx, rcx
movsxd rdx, dword [rbp + 0x10]
mov eax, edx
imul eax, esi
sub esi, dword [rcx + 0x14]
sar r11d, 8
movsxd r10, eax
add r10, qword [rcx + 0x20]
cmp r11d, 0xfe
jge 0x14019d2a1
mov rbp, rdx
nop
mov rax, qword [rbx + 8]
mov edx, esi
inc esi
dec edi
mov ecx, dword [rax + 0x10]
mov rax, qword [rbx + 0x28]
imul ecx, edx
movsxd rdx, ecx
movzx ecx, byte [rdx + rax]
mov edx, 0x100
mov r9d, ecx
shl r9d, 0x10
or r9d, ecx
mov ecx, 0x100
imul r9d, r11d
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rbp
test edi, edi
jg 0x14019d1c0
jmp 0x14019d39d
mov r8, qword [rcx + 8]
movsxd rcx, dword [r8 + 0x10]
mov eax, ecx
imul eax, esi
movsxd r11, eax
add r11, qword [rbx + 0x28]
cmp edx, ecx
jne 0x14019d2dc
cmp dword [r8 + 8], 1
jne 0x14019d2dc
cmp dword [rbp + 8], 1
jne 0x14019d2dc
imul ecx, edi
mov rdx, r11
movsxd r8, ecx
mov rcx, r10
call sub.VCRUNTIME140.dll_memcpy
jmp 0x14019d39d
mov rbx, rdx
mov rsi, rcx
movzx eax, byte [r11]
mov ecx, 0x100
mov r9d, eax
mov edx, 0x100
shl r9d, 0x10
add r11, rsi
or r9d, eax
dec edi
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rbx
test edi, edi
jg 0x14019d2e2
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14019d3c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rax, qword [rcx]
mov r10, rcx
mov r11d, edx
mov edi, r8d
movsxd rcx, dword [rax + 0x10]
sub r11d, dword [r10 + 0x14]
mov eax, ecx
imul eax, edx
mov rsi, rcx
movsxd rbx, eax
add rbx, qword [r10 + 0x20]
cmp dword [r10 + 0x10], 0xfe
jge 0x14019d4f1
mov rcx, qword [r10 + 8]
mov eax, r11d
cdq
inc r11d
dec edi
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rcx, eax
mov rax, qword [r10 + 0x28]
movzx edx, byte [rcx + rax]
mov ecx, 0x100
mov r9d, edx
shl r9d, 0x10
or r9d, edx
mov edx, 0x100
imul r9d, dword [r10 + 0x10]
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, rsi
test edi, edi
jg 0x14019d400
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rcx, qword [r10 + 8]
mov eax, r11d
cdq
inc r11d
dec edi
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rcx, eax
mov rax, qword [r10 + 0x28]
movzx edx, byte [rcx + rax]
mov ecx, 0x100
mov r9d, edx
shl r9d, 0x10
or r9d, edx
mov edx, 0x100
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, rsi
test edi, edi
jg 0x14019d4f1
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret