joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff7ed430f78
Capabilities:
Get system firmware table

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x7ff7ed868f18]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rdi, rcx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x52534d42
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov esi, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8d, esi
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x7ff7ed430fd7
xor al, al
jmp 0x7ff7ed431083
mov r9d, esi
mov r8, rbx
xor edx, edx
mov ecx, 0x52534d42
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
cmp eax, esi
je 0x7ff7ed431004
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x7ff7ed430fd0
movzx ecx, byte [rbx + 1]
shl ecx, 0x10
movzx eax, byte [rbx + 2]
shl eax, 8
add ecx, eax
movzx eax, byte [rbx + 3]
add ecx, eax
mov dword [rdi + 0x5c], ecx
mov eax, dword [rbx + 4]
mov dword [rdi + 0x58], eax
and qword [rsp + 0x68], 0
lea rcx, [rsp + 0x20]
call fcn.7ff7ed3c0f8c
test al, al
je 0x7ff7ed431052
lea rax, vtable.std::_Func_impl_no_alloc_class__lambda_b1841b2b3d7edfd58a8a013d8118f4e5___void___.0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x68], rax
lea rdx, [rbx + 8]
lea r8, [rsp + 0x30]
mov rcx, rdi
call fcn.7ff7ed430b3c
mov bl, al
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x7ff7ed431081
mov r8, qword [rcx]
lea rax, [rsp + 0x30]
cmp rcx, rax
setne dl
call qword [r8 + 0x20]
mov al, bl
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.7ff7ed6b54e0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x7ff7ed432708
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov rax, qword [rdx + 0x28]
cmp byte [rax], 0x22
je 0x7ff7ed432747
cmp byte [rax], 0x5b
je 0x7ff7ed432742
cmp byte [rax], 0x66
je 0x7ff7ed43273d
cmp byte [rax], 0x6e
je 0x7ff7ed432738
cmp byte [rax], 0x74
je 0x7ff7ed432733
cmp byte [rax], 0x7b
jne fcn.7ff7ed4318f0
jmp fcn.7ff7ed4320f0
jmp fcn.7ff7ed432658
jmp fcn.7ff7ed431844
jmp fcn.7ff7ed4316ec
jmp fcn.7ff7ed431548
xor r9d, r9d
jmp fcn.7ff7ed4323dc

Function at 0x7ff7ed43412c
Capabilities:
Manipulate user privileges

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
xor edi, edi
mov esi, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x28]
lea edx, [rdi + 8]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x7ff7ed434235
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x20]
lea ebx, [rdi + 1]
mov dword [rbp + 0x20], edi
mov edx, ebx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov r9d, dword [rbp + 0x20]
test r9d, r9d
je 0x7ff7ed43419d
mov edx, r9d
lea ecx, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov r9d, dword [rbp + 0x20]
mov rsi, rax
mov rcx, qword [rbp + 0x28]
lea rax, [rbp + 0x20]
mov r8, rsi
mov qword [rsp + 0x20], rax
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x7ff7ed434235
xor edx, edx
lea rcx, [rbp - 0x30]
lea r8d, [rdx + 0x30]
call fcn.7ff7ed6b7250
lea r9, [rbp + 0x30]
mov r8d, 0xf0fff
lea rdx, [rbp - 0x30]
xor ecx, ecx
call sub.ADVAPI32.dll_LsaOpenPolicy
test eax, eax
jne 0x7ff7ed434228
lea rdx, str.SeLockMemoryPrivilege
lea rcx, [rbp - 0x40]
call fcn.7ff7ed4342fc
mov rdx, qword [rsi]
lea r8, [rbp - 0x50]
mov rcx, qword [rbp + 0x30]
mov r9d, ebx
movups xmm0, xmmword [rax]
movdqu xmmword [rbp - 0x50], xmm0
call sub.ADVAPI32.dll_LsaAddAccountRights
mov rcx, qword [rbp + 0x30]
mov ebx, eax
call sub.ADVAPI32.dll_LsaClose
test ebx, ebx
sete dil
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
jmp 0x7ff7ed434237
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret

Function at 0x7ff7ed43436c
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test dl, dl
je 0x7ff7ed4343a2
lea rdx, [rcx - 1]
mov r8d, 0x20003000
xor ecx, ecx
and rdx, 0xffffffffffe00000
add rdx, 0x200000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x7ff7ed4343b9
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add rsp, 0x20
pop rbx
ret

Function at 0x7ff7ed4344a4
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x28
lea r9, [rsp + 0x40]
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x7ff7ed434e14
Capabilities:
Hash data using sha256

Disassembly:
xor eax, eax
mov dword [rcx], 0x6a09e667
mov qword [rcx + 0x38], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x28], rax
mov dword [rcx + 0x24], eax
mov dword [rcx + 4], 0xbb67ae85
mov dword [rcx + 8], 0x3c6ef372
mov dword [rcx + 0xc], 0xa54ff53a
mov dword [rcx + 0x10], 0x510e527f
mov dword [rcx + 0x14], 0x9b05688c
mov dword [rcx + 0x18], 0x1f83d9ab
mov qword [rcx + 0x1c], 0x5be0cd19
ret

Function at 0x7ff7ed434f6c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x7ff7ed868f18]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov r8, rdx
lea rax, [rsp + 0x20]
sub r8, rax
mov r9, rcx
lea rax, [rsp + 0x20]
mov rdi, rcx
sub r9, rax
xor ebx, ebx
mov edx, ebx
lea r10d, [rbx + 0x10]
lea rcx, [rsp + 0x20]
add rcx, rdx
mov eax, dword [r8 + rcx]
mov dword [rcx], eax
xor eax, dword [rcx + r9]
mov dword [rbp + rdx - 0x60], eax
add rdx, 4
sub r10, 1
jne 0x7ff7ed434fb2
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.7ff7ed435f30
mov r8d, 0x1000000
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.7ff7ed435f30
mov r8d, 0x2000000
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.7ff7ed435f30
mov r8d, 0x3000000
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.7ff7ed435f30
mov r8d, 0x4000000
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.7ff7ed435f30
mov r8d, 0x5000000
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.7ff7ed435f30
mov r8d, 0x6000000
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.7ff7ed435f30
mov r8d, 0x7000000
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.7ff7ed435f30
mov r8d, 0x8000000
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.7ff7ed435f30
mov r8d, 0x9000000
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x60]
call fcn.7ff7ed435f30
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x60]
call fcn.7ff7ed4354c4
mov r8d, 1
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.7ff7ed4354c4
mov r8d, 2
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.7ff7ed4354c4
mov r8d, 3
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.7ff7ed4354c4
mov r8d, 4
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.7ff7ed4354c4
mov r8d, 5
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.7ff7ed4354c4
mov r8d, 6
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.7ff7ed4354c4
mov r8d, 7
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.7ff7ed4354c4
mov r8d, 8
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x20]
call fcn.7ff7ed4354c4
mov r8d, 9
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.7ff7ed4354c4
mov eax, dword [rbp + rbx - 0x20]
xor eax, dword [rbp + rbx - 0x60]
xor dword [rbx + rdi], eax
add rbx, 4
cmp rbx, 0x40
jl 0x7ff7ed43516d
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.7ff7ed6b54e0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x7ff7ed435350
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x7ff7ed868f18]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rax, [rcx + 0x3c]
mov rbx, rcx
lea rcx, [rbp - 0x39]
mov edi, 0x10
cmp rcx, rax
ja 0x7ff7ed4353b3
xor r9d, r9d
lea rax, [rbp + 3]
cmp rax, rbx
jb 0x7ff7ed4353b3
mov r8d, edi
lea rcx, [rbp - 0x39]
sub r8, r9
lea rcx, [rcx + r9*4]
shl r8, 2
lea rdx, [rbx + r9*4]
call fcn.7ff7ed6b67f0
jmp 0x7ff7ed4353d2
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movaps xmmword [rbp - 0x39], xmm0
movups xmm0, xmmword [rbx + 0x20]
movaps xmmword [rbp - 0x29], xmm1
movups xmm1, xmmword [rbx + 0x30]
movaps xmmword [rbp - 0x19], xmm0
movaps xmmword [rbp - 9], xmm1
xor r8d, r8d
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x39]
call fcn.7ff7ed4354c4
mov r8d, 1
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x79]
call fcn.7ff7ed4354c4
mov r8d, 2
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 7]
call fcn.7ff7ed4354c4
mov r8d, 3
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x79]
call fcn.7ff7ed4354c4
mov r8d, 4
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 7]
call fcn.7ff7ed4354c4
mov r8d, 5
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x79]
call fcn.7ff7ed4354c4
mov r8d, 6
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 7]
call fcn.7ff7ed4354c4
mov r8d, 7
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x79]
call fcn.7ff7ed4354c4
mov r8d, 8
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 7]
call fcn.7ff7ed4354c4
mov r8d, 9
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x79]
call fcn.7ff7ed4354c4
lea rcx, [rbp - 0x39]
sub rcx, rbx
mov eax, dword [rcx + rbx]
xor dword [rbx], eax
lea rbx, [rbx + 4]
sub rdi, 1
jne 0x7ff7ed435494
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.7ff7ed6b54e0
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x7ff7ed437954
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, [rcx + 0x20]
mov ecx, 8
mov rax, qword [rdx + 0x80]
xor qword [rdx], rax
lea rdx, [rdx + 8]
sub rcx, 1
jne 0x7ff7ed437966
mov rcx, rbx
call fcn.7ff7ed436b94
lea rcx, [rbx + 0x60]
mov edx, 8
mov rax, qword [rcx + 0x40]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x7ff7ed43798b
add rsp, 0x20
pop rbx
ret
Function at 0x7ff7ed439604
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm0, xmmword [rcx]
mov rax, qword [rsp + 0x28]
movdqa xmm2, xmm0
movdqu xmmword [rdx], xmm0
pslldq xmm2, 4
movdqa xmm1, xmm2
movdqu xmmword [r8], xmm3
xorps xmm1, xmm0
pslldq xmm2, 4
movdqa xmm4, xmm2
pslldq xmm2, 4
xorps xmm4, xmm1
xorps xmm4, xmm2
aeskeygenassist xmm0, xmm3, 1
pshufd xmm1, xmm0, 0xff
xorps xmm4, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [r9], xmm4
pslldq xmm1, 4
xorps xmm0, xmm3
movdqa xmm2, xmm1
pslldq xmm1, 4
xorps xmm2, xmm0
xorps xmm2, xmm1
aeskeygenassist xmm0, xmm4, 0
pshufd xmm1, xmm0, 0xaa
xorps xmm2, xmm1
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rax], xmm2
mov rax, qword [rsp + 0x30]
xorps xmm0, xmm4
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm0
xorps xmm3, xmm1
aeskeygenassist xmm0, xmm2, 2
pshufd xmm1, xmm0, 0xff
xorps xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rax], xmm3
mov rax, qword [rsp + 0x38]
xorps xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
xorps xmm2, xmm0
xorps xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
xorps xmm2, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rax], xmm2
xorps xmm0, xmm3
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm0
xorps xmm3, xmm1
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
xorps xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
xorps xmm0, xmm2
movdqa xmm2, xmm1
xorps xmm2, xmm0
pslldq xmm1, 4
xorps xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
mov rax, qword [rsp + 0x40]
pshufd xmm1, xmm0, 0xaa
xorps xmm2, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqu xmmword [rax], xmm3
movdqa xmm0, xmm1
mov rax, qword [rsp + 0x48]
xorps xmm0, xmm3
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
xorps xmm3, xmm0
movdqu xmmword [rax], xmm2
xorps xmm3, xmm1
mov rax, qword [rsp + 0x50]
aeskeygenassist xmm0, xmm2, 8
pshufd xmm1, xmm0, 0xff
xorps xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rax], xmm3
mov rax, qword [rsp + 0x58]
xorps xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
xorps xmm2, xmm0
xorps xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
xorps xmm2, xmm1
movdqu xmmword [rax], xmm2
ret
Function at 0x7ff7ed43f584
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x100
mov rax, qword [0x7ff7ed868f18]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov rbx, qword [rcx + 0xe0]
mov rdi, rcx
xor esi, esi
mov ebp, 0xb0
mov r8d, 0xc8
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.7ff7ed6b67f0
xor qword [rsp + 0x20], rsi
lea rcx, [rsp + 0x20]
mov edx, 0x18
call fcn.7ff7ed3918b8
mov r8d, 0xa0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.7ff7ed6b67f0
mov edx, 0x18
lea rcx, [rsp + 0x20]
add rbx, 0xa0
call fcn.7ff7ed3918b8
mov r8, rbp
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.7ff7ed6b67f0
mov edx, 0x18
lea rcx, [rsp + 0x20]
add rbx, rbp
call fcn.7ff7ed3918b8
mov r8, rbp
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.7ff7ed6b67f0
add rbx, rbp
inc rsi
cmp rsi, 0x1000
jb 0x7ff7ed43f5be
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.7ff7ed6b54e0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x7ff7ed4a2b5c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rsi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x7ff7ed4a2b9f
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call fcn.7ff7ed6b7250
jmp 0x7ff7ed4a2d8d
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.7ff7ed391778
mov r8, qword [rbx + 8]
lea r15, [r14 + rsi]
mov rcx, r15
mov r9d, r12d
mov edx, esi
call fcn.7ff7ed391778
lea rdi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rdi]
lea r13, [r14 + rsi*2]
mov rcx, r13
mov edx, esi
call fcn.7ff7ed391778
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rsi*2]
add rcx, rsi
mov r9d, r12d
mov edx, esi
call fcn.7ff7ed391778
cmp byte [0x7ff7ed8703d1], 0
mov r12d, 0x40000
mov rcx, qword [rbx]
je 0x7ff7ed4a2c27
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8d, r12d
call fcn.7ff7ed4cd120
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8d, r12d
call fcn.7ff7ed4cd120
jmp 0x7ff7ed4a2c46
call fcn.7ff7ed43af3c
mov rcx, qword [rbx + 8]
call fcn.7ff7ed43af3c
mov rcx, qword [rdi]
call fcn.7ff7ed43af3c
mov rcx, qword [rbx + 0x18]
call fcn.7ff7ed43af3c
mov r9, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rdi
mov r10d, 2
mov rax, qword [r9 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r9 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rsi
mov qword [rcx + 0xf0], rax
sub r10, 1
jne 0x7ff7ed4a2c7e
lea rax, [0x7ff7ed74b440]
mov rcx, rbx
mov qword [r9 + 0xe8], rax
call qword [0x7ff7ed8703c0]
cmp byte [0x7ff7ed8703d1], 0
mov rcx, qword [rbx]
je 0x7ff7ed4a2ce5
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8, r12
call fcn.7ff7ed4cda94
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8, r12
call fcn.7ff7ed4cda94
jmp 0x7ff7ed4a2d04
call fcn.7ff7ed44047c
mov rcx, qword [rbx + 8]
call fcn.7ff7ed44047c
mov rcx, qword [rdi]
call fcn.7ff7ed44047c
mov rcx, qword [rbx + 0x18]
call fcn.7ff7ed44047c
mov rcx, qword [rbx]
mov esi, 0x18
mov edx, esi
call fcn.7ff7ed3918b8
mov rcx, qword [rbx + 8]
mov edx, esi
call fcn.7ff7ed3918b8
mov rcx, qword [rdi]
mov edx, esi
call fcn.7ff7ed3918b8
mov rcx, qword [rbx + 0x18]
mov edx, esi
call fcn.7ff7ed3918b8
mov rcx, qword [rbx]
lea rsi, [0x7ff7ed74c940]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rdi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x7ff7ed4a2dac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rdi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x7ff7ed4a2def
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call fcn.7ff7ed6b7250
jmp 0x7ff7ed4a2ff3
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.7ff7ed391778
mov r8, qword [rbx + 8]
lea r15, [r14 + rdi]
mov rcx, r15
mov r9d, r12d
mov edx, edi
call fcn.7ff7ed391778
lea rsi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rsi]
lea r13, [r14 + rdi*2]
mov rcx, r13
mov edx, edi
call fcn.7ff7ed391778
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rdi*2]
add rcx, rdi
mov r9d, r12d
mov edx, edi
call fcn.7ff7ed391778
xor ecx, ecx
mov rax, qword [rbx + rcx*8]
inc rcx
mov byte [rax + 0x1b0], 1
cmp rcx, 4
jl 0x7ff7ed4a2e44
cmp byte [0x7ff7ed8703d1], 0
mov r12d, 0x40000
mov rcx, qword [rbx]
je 0x7ff7ed4a2e8d
mov rdx, qword [rbx + 8]
mov r9b, 1
mov r8d, r12d
call fcn.7ff7ed4cd120
mov rdx, qword [rbx + 0x18]
mov r9b, 1
mov rcx, qword [rsi]
mov r8d, r12d
call fcn.7ff7ed4cd120
jmp 0x7ff7ed4a2eac
call fcn.7ff7ed43b858
mov rcx, qword [rbx + 8]
call fcn.7ff7ed43b858
mov rcx, qword [rsi]
call fcn.7ff7ed43b858
mov rcx, qword [rbx + 0x18]
call fcn.7ff7ed43b858
mov r10, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rsi
mov r9d, 2
mov rax, qword [r10 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r10 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rdi
mov qword [rcx + 0xf0], rax
sub r9, 1
jne 0x7ff7ed4a2ee4
lea rax, [0x7ff7ed74b440]
mov rcx, rbx
mov qword [r10 + 0xe8], rax
call qword [0x7ff7ed8703c8]
cmp byte [0x7ff7ed8703d1], 0
mov rcx, qword [rbx]
je 0x7ff7ed4a2f4b
mov rdx, qword [rbx + 8]
mov r9b, 1
mov r8, r12
call fcn.7ff7ed4cda94
mov rdx, qword [rbx + 0x18]
mov r9b, 1
mov rcx, qword [rsi]
mov r8, r12
call fcn.7ff7ed4cda94
jmp 0x7ff7ed4a2f6a
call fcn.7ff7ed440e18
mov rcx, qword [rbx + 8]
call fcn.7ff7ed440e18
mov rcx, qword [rsi]
call fcn.7ff7ed440e18
mov rcx, qword [rbx + 0x18]
call fcn.7ff7ed440e18
mov rcx, qword [rbx]
mov edi, 0x18
mov edx, edi
call fcn.7ff7ed3918b8
mov rcx, qword [rbx + 8]
mov edx, edi
call fcn.7ff7ed3918b8
mov rcx, qword [rsi]
mov edx, edi
call fcn.7ff7ed3918b8
mov rcx, qword [rbx + 0x18]
mov edx, edi
call fcn.7ff7ed3918b8
mov rcx, qword [rbx]
lea rdi, [0x7ff7ed74c940]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rsi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rdi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x7ff7ed4a3010
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, r9
mov rbp, r8
mov rsi, rdx
mov r14, rcx
cmp rdx, 0x2b
jae 0x7ff7ed4a3053
xor edx, edx
mov r8d, 0x80
mov rcx, rbp
call fcn.7ff7ed6b7250
jmp 0x7ff7ed4a3241
mov r8, qword [rbx]
mov r12d, 0xc8
mov r9d, r12d
call fcn.7ff7ed391778
mov r8, qword [rbx + 8]
lea r15, [r14 + rsi]
mov rcx, r15
mov r9d, r12d
mov edx, esi
call fcn.7ff7ed391778
lea rdi, [rbx + 0x10]
mov r9d, r12d
mov r8, qword [rdi]
lea r13, [r14 + rsi*2]
mov rcx, r13
mov edx, esi
call fcn.7ff7ed391778
mov r8, qword [rbx + 0x18]
lea rcx, [r14 + rsi*2]
add rcx, rsi
mov r9d, r12d
mov edx, esi
call fcn.7ff7ed391778
cmp byte [0x7ff7ed8703d1], 0
mov r12d, 0x80000
mov rcx, qword [rbx]
je 0x7ff7ed4a30db
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8d, r12d
call fcn.7ff7ed4cd120
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8d, r12d
call fcn.7ff7ed4cd120
jmp 0x7ff7ed4a30fa
call fcn.7ff7ed43c164
mov rcx, qword [rbx + 8]
call fcn.7ff7ed43c164
mov rcx, qword [rdi]
call fcn.7ff7ed43c164
mov rcx, qword [rbx + 0x18]
call fcn.7ff7ed43c164
mov r9, qword [rbx]
lea r8, [r13 + 0x23]
mov rcx, qword [rbx + 8]
mov rdx, rdi
mov r10d, 2
mov rax, qword [r9 + 0xc0]
xor rax, qword [r14 + 0x23]
mov qword [r9 + 0xf0], rax
mov rax, qword [rcx + 0xc0]
xor rax, qword [r15 + 0x23]
mov qword [rcx + 0xf0], rax
mov rcx, qword [rdx]
lea rdx, [rdx + 8]
mov rax, qword [rcx + 0xc0]
xor rax, qword [r8]
add r8, rsi
mov qword [rcx + 0xf0], rax
sub r10, 1
jne 0x7ff7ed4a3132
lea rax, [0x7ff7ed74b440]
mov rcx, rbx
mov qword [r9 + 0xe8], rax
call qword [0x7ff7ed8703a0]
cmp byte [0x7ff7ed8703d1], 0
mov rcx, qword [rbx]
je 0x7ff7ed4a3199
mov rdx, qword [rbx + 8]
xor r9d, r9d
mov r8, r12
call fcn.7ff7ed4cda94
mov rdx, qword [rbx + 0x18]
xor r9d, r9d
mov rcx, qword [rdi]
mov r8, r12
call fcn.7ff7ed4cda94
jmp 0x7ff7ed4a31b8
call fcn.7ff7ed441764
mov rcx, qword [rbx + 8]
call fcn.7ff7ed441764
mov rcx, qword [rdi]
call fcn.7ff7ed441764
mov rcx, qword [rbx + 0x18]
call fcn.7ff7ed441764
mov rcx, qword [rbx]
mov esi, 0x18
mov edx, esi
call fcn.7ff7ed3918b8
mov rcx, qword [rbx + 8]
mov edx, esi
call fcn.7ff7ed3918b8
mov rcx, qword [rdi]
mov edx, esi
call fcn.7ff7ed3918b8
mov rcx, qword [rbx + 0x18]
mov edx, esi
call fcn.7ff7ed3918b8
mov rcx, qword [rbx]
lea rsi, [0x7ff7ed74c940]
mov r14d, 0xc8
mov r8, rbp
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 8]
lea r8, [rbp + 0x20]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rdi]
lea r8, [rbp + 0x40]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rcx, qword [rbx + 0x18]
lea r8, [rbp + 0x60]
mov edx, r14d
movzx eax, byte [rcx]
and eax, 3
call qword [rsi + rax*8]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret