joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140026630
Capabilities:
Write file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
cmp byte [0x1400ccf60], 0
jne 0x140026733
mov byte [0x1400ccf60], 1
call sym.__cxa_current_exception_type
test rax, rax
je 0x140026708
mov rbx, qword [rax + 8]
xor eax, eax
lea r9, [rsp + 0x2c]
cmp byte [rbx], 0x2a
mov dword [rsp + 0x2c], 0xffffffff
sete al
xor r8d, r8d
xor edx, edx
add rbx, rax
mov rcx, rbx
call sym.__cxa_demangle
mov ecx, 2
mov rsi, qword [sym.__acrt_iob_func]
mov rdi, rax
call rsi
mov edx, 1
lea rcx, str.terminate_called_after_throwing_an_instance_of_
mov r8d, 0x30
mov r9, rax
call sym.fwrite
mov edx, dword [rsp + 0x2c]
mov ecx, 2
test edx, edx
je 0x1400266f9
call rsi
mov rcx, rbx
mov rdx, rax
call sym.fputs
mov ecx, 2
call rsi
mov r8d, 2
mov edx, 1
lea rcx, [0x1400cd3b1]
mov r9, rax
call sym.fwrite
mov eax, dword [rsp + 0x2c]
test eax, eax
jne 0x1400c8057
jmp 0x1400c804f
call rsi
mov rcx, rdi
mov rdx, rax
call sym.fputs
jmp 0x1400266c7
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov r8d, 0x2d
mov edx, 1
lea rcx, str.terminate_called_without_an_active_exception_n
mov r9, rax
call sym.fwrite
nop
jmp 0x1400c804a
mov ecx, 2
call qword [sym.__acrt_iob_func]
mov r8d, 0x1d
mov edx, 1
lea rcx, str.terminate_called_recursively_n
mov r9, rax
call sym.fwrite
call sym.abort
nop
nop
nop

Function at 0x14008eb40
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sym.fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sym.read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x14008eb88
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x14008eb5a
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x1400a1540
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x1400a1570
mov rcx, qword [rcx]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x1400a15b8
cdqe
add rsi, rax
sub rbx, rax
jne 0x1400a1588
mov eax, dword [rsp + 0x2c]
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
cmp eax, 0xffffffff
jne 0x1400a15d8
call rbp
mov r12, rbp
cmp dword [rax], 4
je 0x1400a1588
call r12
lea rdx, str.random_device_could_not_be_read
mov ecx, dword [rax]
call method.std._anonymous_namespace_::__throw_syserr_int__char_const_
mov r12, qword [sym.imp.msvcrt.dll__errno]
jmp 0x1400a15c7
Function at 0x1400c7fe0
Capabilities:
Write file on windows

Disassembly:
nop
mov rcx, rax
mov rax, rdx
sub rax, 1
jne 0x1400c805c
call sym.__cxa_begin_catch
mov rcx, rax
mov rax, qword [rax]
call qword [rax + 0x10]
mov ecx, 2
mov rbx, rax
call rsi
mov r9, rax
mov r8d, 0xb
mov edx, 1
lea rcx, str.__what__:
call sym.fwrite
mov ecx, 2
call rsi
mov rdx, rax
mov rcx, rbx
call sym.fputs
mov ecx, 2
call rsi
mov rdx, rax
mov ecx, 0xa
call sym.fputc
call sym.__cxa_end_catch
call sym.abort
mov rcx, rdi
call sym.free
call sym.__cxa_rethrow
call sym.__cxa_begin_catch
call sym.__cxa_end_catch
jmp 0x1400c804a

Function at 0x1400c8a80
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
xor edx, edx
lea rcx, [0x1400cb7e0]
movabs rsi, 0x2e78786362696c67
movabs r12, 0x6c6f6f705f68652e
call sym.pthread_mutex_init
pxor xmm0, xmm0
lea rcx, str.GLIBCXX_TUNABLES
mov qword [0x1400cb7f8], 0
movups xmmword [0x1400cb7e8], xmm0
call sym.getenv
mov dword [rsp + 0x40], 0
mov rbx, rax
lea rax, str.obj_size
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], rax
lea rax, str.obj_count
mov qword [rsp + 0x48], 9
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], 0x100
test rbx, rbx
jne 0x1400c8b35
jmp 0x1400c8bdf
mov rcx, rbx
mov edx, 0x3a
call sym.strchr
mov rbx, rax
test rax, rax
je 0x1400c8b90
xor eax, eax
cmp byte [rbx], 0x3a
sete al
add rbx, rax
cmp qword [rbx], rsi
jne 0x1400c8b20
cmp qword [rbx + 7], r12
jne 0x1400c8b20
cmp byte [rbx + 0xf], 0x2e
jne 0x1400c8b20
add rbx, 0x10
lea rdi, [rsp + 0x30]
lea r13, [rsp + 0x60]
mov rbp, qword [rdi]
test rbp, rbp
je 0x1400c8b7a
mov rcx, qword [rdi + 8]
mov r8, rbp
mov rdx, rbx
call sym.memcmp
test eax, eax
jne 0x1400c8b84
cmp byte [rbx + rbp], 0x3d
je 0x1400c8c15
add rdi, 0x18
cmp r13, rdi
jne 0x1400c8b5f
jmp 0x1400c8b20
mov eax, dword [rsp + 0x58]
mov edx, 0x1000
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [rsp + 0x40]
test eax, eax
cmove eax, ecx
movsxd rbx, eax
movsxd rax, edx
add rbx, 0x26
imul rbx, rax
shl rbx, 3
mov qword [0x1400cb7f8], rbx
jne 0x1400c8bef
lea rcx, [sym.__tcf_0_1]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.atexit
mov qword [0x1400cb7f8], 0x16000
mov ebx, 0x16000
mov rcx, rbx
call sym.malloc
mov qword [0x1400cb7f0], rax
test rax, rax
je 0x1400c8c4c
xor edx, edx
mov qword [0x1400cb7e8], rax
mov qword [rax], rbx
mov qword [rax + 8], rdx
jmp 0x1400c8bc7
lea rdx, [rsp + 0x28]
lea rcx, [rbx + rbp + 1]
xor r8d, r8d
call sym.strtoul
mov rbx, qword [rsp + 0x28]
movzx edx, byte [rbx]
cmp dl, 0x3a
je 0x1400c8c3c
test dl, dl
jne 0x1400c8b20
test eax, eax
js 0x1400c8b20
mov dword [rdi + 0x10], eax
jmp 0x1400c8b20
xor ecx, ecx
mov qword [0x1400cb7f8], rcx
jmp 0x1400c8bc7
Function at 0x1401fd380
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov r11d, 0x9e3779b9
cmp rdx, 3
jae 0x1401fd39c
mov eax, 0x9e3779b9
mov r10, rdx
jmp 0x1401fd438
mov r9d, 2
mov r10, rdx
mov eax, 0x9e3779b9
movzx ebx, byte [rcx]
add ebx, eax
movzx eax, byte [rcx + 1]
add eax, r11d
movzx edi, byte [rcx + 2]
add edi, r8d
sub ebx, eax
sub ebx, edi
mov esi, edi
shr esi, 0xd
xor esi, ebx
sub eax, edi
sub eax, esi
mov ebx, esi
shl ebx, 8
xor ebx, eax
sub edi, esi
sub edi, ebx
mov eax, ebx
shr eax, 0xd
xor eax, edi
sub esi, ebx
sub esi, eax
mov edi, eax
shr edi, 0xc
xor edi, esi
sub ebx, eax
sub ebx, edi
mov esi, edi
shl esi, 0x10
xor esi, ebx
sub eax, edi
sub eax, esi
mov ebx, esi
shr ebx, 5
xor ebx, eax
sub edi, esi
sub edi, ebx
mov eax, ebx
shr eax, 3
xor eax, edi
sub esi, ebx
sub esi, eax
mov r11d, eax
shl r11d, 0xa
xor r11d, esi
sub ebx, eax
sub ebx, r11d
mov r8d, r11d
shr r8d, 0xf
xor r8d, ebx
add rcx, 3
add r10, 0xfffffffffffffffd
cmp r10, r9
ja 0x1401fd3aa
add edx, r8d
cmp r10, 1
je 0x1401fd44e
cmp r10, 2
jne 0x1401fd453
movzx ebx, byte [rcx + 1]
add r11d, ebx
movzx ecx, byte [rcx]
add eax, ecx
sub eax, edx
sub eax, r11d
mov ecx, edx
shr ecx, 0xd
xor ecx, eax
sub r11d, edx
sub r11d, ecx
mov eax, ecx
shl eax, 8
xor eax, r11d
sub edx, ecx
sub edx, eax
mov ebx, eax
shr ebx, 0xd
xor ebx, edx
sub ecx, eax
sub ecx, ebx
mov edx, ebx
shr edx, 0xc
xor edx, ecx
sub eax, ebx
sub eax, edx
mov edi, edx
shl edi, 0x10
xor edi, eax
sub ebx, edx
sub ebx, edi
mov ecx, edi
shr ecx, 5
xor ecx, ebx
sub edx, edi
sub edx, ecx
mov eax, ecx
shr eax, 3
xor eax, edx
sub edi, ecx
sub edi, eax
sub ecx, eax
shl eax, 0xa
xor eax, edi
sub ecx, eax
shr eax, 0xf
xor eax, ecx
pop rbx
pop rdi
pop rsi
ret

Function at 0x1401fd720
Capabilities:
Get common file path

Disassembly:
push rsi
push rdi
sub rsp, 0x128
mov rsi, rcx
lea rcx, [0x140659898]
lea rdx, [0x140620323]
call fcn.1401fd500
test eax, eax
jne 0x1401fd7af
lea rcx, [rsp + 0x20]
mov edx, 0x104
call sub.KERNEL32.dll_GetSystemDirectoryA
test eax, eax
jne 0x1401fd75a
xor eax, eax
jmp 0x1401fd7a4
mov edi, eax
mov rcx, rsi
call fcn.1401ebfb0
lea ecx, [rdi + 1]
add rcx, rax
add rcx, 1
cmp rcx, 0x104
ja 0x1401fd756
inc rax
mov ecx, edi
add rcx, rsp
add rcx, 0x21
mov byte [rcx - 1], 0x5c
mov rdx, rsi
mov r8, rax
call fcn.1401fba80
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 8
call sub.KERNEL32.dll_LoadLibraryExA
nop
add rsp, 0x128
pop rdi
pop rsi
ret
mov rcx, rsi
xor edx, edx
mov r8d, 0x800
add rsp, 0x128
pop rdi
pop rsi
jmp sub.KERNEL32.dll_LoadLibraryExA
Function at 0x14023bd20
Capabilities:
Print debug messages
Terminate process

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rcx
call sub.KERNEL32.dll_OutputDebugStringA
lea rcx, [0x1406220cc]
call fcn.1401fd720
test rax, rax
je 0x14023bdfa
mov rdi, rax
lea rdx, [0x1406220d9]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
mov rbx, rax
lea rdx, [0x1406220ee]
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
mov r15, rax
lea rdx, [0x1406220fb]
mov rcx, rdi
call sub.KERNEL32.dll_GetProcAddress
test rbx, rbx
je 0x14023bdf2
test r15, r15
je 0x14023bdf2
mov r14, rax
test rax, rax
je 0x14023bdf2
lea rax, [0x140622111]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rsi
lea rdx, [0x14062211f]
xor ecx, ecx
call rbx
test rax, rax
je 0x14023bdf2
mov rbx, rax
xor eax, eax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0
mov word [rsp + 0x28], 2
mov rcx, rbx
mov dx, 1
xor r8d, r8d
mov r9d, 0xc0070003
call r15
mov rcx, rbx
call r14
mov rcx, rdi
call sub.KERNEL32.dll_FreeLibrary
lea rcx, [0x140622127]
call fcn.1401fd720
test rax, rax
je 0x14023be3e
mov rdi, rax
lea rdx, [0x140622132]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
test rax, rax
je 0x14023be36
lea r8, [0x14062213e]
xor ecx, ecx
mov rdx, rsi
mov r9d, 0x10
call rax
mov rcx, rdi
call sub.KERNEL32.dll_FreeLibrary
call sub.KERNEL32.dll_GetCurrentProcess
mov rcx, rax
mov edx, 1
call sub.KERNEL32.dll_TerminateProcess
nop
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1403380f0
Capabilities:
Create directory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x848
mov rsi, rcx
lea rdi, [rsp + 0x38]
mov qword [rdi], rcx
lea rax, [rsp + 0x40]
lea rbx, [rsp + 0x30]
mov qword [rbx], rax
lea r14, [rsp + 0x840]
call fcn.1401ebfb0
lea rdx, [rsi + rax]
add rdx, 1
mov dword [rsp + 0x20], 0
mov rcx, rdi
mov r8, rbx
mov r9, r14
call fcn.1401fbce0
mov ecx, eax
mov eax, 0xffffffff
test ecx, ecx
jne 0x14033815b
lea rcx, [rsp + 0x40]
xor edx, edx
call sub.KERNEL32.dll_CreateDirectoryW
cmp eax, 1
sbb eax, eax
add rsp, 0x848
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x140338ef0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
call fcn.140452c80
lea rbx, [rsp + 0x2c]
mov dword [rbx], 0xffffffff
mov qword [rsp + 0x20], 0
mov rcx, rax
mov rdx, rdi
mov r8d, esi
mov r9, rbx
call sub.KERNEL32.dll_WriteFile
mov edx, dword [rbx]
xor ecx, ecx
cmp eax, 1
sbb rcx, rcx
or rcx, rdx
mov rax, rcx
add rsp, 0x30
pop rbx
pop rdi
pop rsi
ret

Function at 0x140366fa0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov eax, 0xfffffffb
test rcx, rcx
je 0x140367118
mov r13, rdx
test rdx, rdx
je 0x140367118
cmp byte [r13], 1
je 0x140367118
mov rsi, r8
xor eax, eax
test r8, r8
je 0x140367118
mov r14d, r9d
test r9d, r9d
jle 0x140367118
mov rbx, rcx
mov rbp, qword [rsp + 0xa0]
mov edi, r14d
shr edi, 4
mov cl, byte [rcx + 0x14]
cmp cl, 2
je 0x14036707f
mov eax, 0xfffffffb
cmp cl, 1
jne 0x140367118
test edi, edi
je 0x14036703c
lea rbx, [r13 + 0x54]
mov r9d, dword [r13 + 0x4c]
mov rcx, rsi
mov rdx, rbp
mov r8, rbx
call fcn.140482080
add rsi, 0x10
add rbp, 0x10
dec edi
jg 0x14036701e
mov r8d, r14d
and r8d, 0xf
mov ebx, 0x10
sub ebx, r8d
lea r15, [rsp + 0x20]
mov rcx, r15
mov rdx, rsi
call fcn.1405bc590
mov rcx, r15
sub rcx, rbx
add rcx, 0x10
mov edx, ebx
mov r8, rbx
call fcn.1405bc9f0
mov r9d, dword [r13 + 0x4c]
add r13, 0x54
mov rcx, r15
jmp 0x140367102
test edi, edi
je 0x1403670c1
lea r15, [r13 + 0x54]
lea r12, [rsp + 0x20]
mov rax, rbx
mov rbx, rbp
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rax]
xorps xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
mov r9d, dword [r13 + 0x4c]
mov rcx, r12
mov rdx, rbp
mov r8, r15
call fcn.140482080
add rsi, 0x10
lea rbp, [rbp + 0x10]
mov rax, rbx
dec edi
jg 0x14036708f
mov eax, r14d
and eax, 0xf
je 0x1403670df
mov edi, eax
xor edx, edx
mov cl, byte [rbx + rdx]
xor cl, byte [rsi + rdx]
mov byte [rsp + rdx + 0x20], cl
inc rdx
cmp rdx, rdi
jne 0x1403670cd
mov cl, 0x10
sub cl, al
mov dl, byte [rbx + rax]
xor dl, cl
mov byte [rsp + rax + 0x20], dl
inc rax
cmp rax, 0x10
jne 0x1403670e3
mov r9d, dword [r13 + 0x4c]
add r13, 0x54
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov r8, r13
call fcn.140482080
add r14d, 0x10
and r14d, 0xfffffff0
mov eax, r14d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1403670c4
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov eax, 0xfffffffb
test rcx, rcx
je 0x140367118
mov r13, rdx
test rdx, rdx
je 0x140367118
cmp byte [r13], 1
je 0x140367118
mov rsi, r8
xor eax, eax
test r8, r8
je 0x140367118
mov r14d, r9d
test r9d, r9d
jle 0x140367118
mov rbx, rcx
mov rbp, qword [rsp + 0xa0]
mov edi, r14d
shr edi, 4
mov cl, byte [rcx + 0x14]
cmp cl, 2
je 0x14036707f
mov eax, 0xfffffffb
cmp cl, 1
jne 0x140367118
test edi, edi
je 0x14036703c
lea rbx, [r13 + 0x54]
mov r9d, dword [r13 + 0x4c]
mov rcx, rsi
mov rdx, rbp
mov r8, rbx
call fcn.140482080
add rsi, 0x10
add rbp, 0x10
dec edi
jg 0x14036701e
mov r8d, r14d
and r8d, 0xf
mov ebx, 0x10
sub ebx, r8d
lea r15, [rsp + 0x20]
mov rcx, r15
mov rdx, rsi
call fcn.1405bc590
mov rcx, r15
sub rcx, rbx
add rcx, 0x10
mov edx, ebx
mov r8, rbx
call fcn.1405bc9f0
mov r9d, dword [r13 + 0x4c]
add r13, 0x54
mov rcx, r15
jmp 0x140367102
test edi, edi
je 0x1403670c1
lea r15, [r13 + 0x54]
lea r12, [rsp + 0x20]
mov rax, rbx
mov rbx, rbp
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rax]
xorps xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
mov r9d, dword [r13 + 0x4c]
mov rcx, r12
mov rdx, rbp
mov r8, r15
call fcn.140482080
add rsi, 0x10
lea rbp, [rbp + 0x10]
mov rax, rbx
dec edi
jg 0x14036708f
mov eax, r14d
and eax, 0xf
je 0x1403670df
mov edi, eax
xor edx, edx
mov cl, byte [rbx + rdx]
xor cl, byte [rsi + rdx]
mov byte [rsp + rdx + 0x20], cl
inc rdx
cmp rdx, rdi
jne 0x1403670cd
mov cl, 0x10
sub cl, al
mov dl, byte [rbx + rax]
xor dl, cl
mov byte [rsp + rax + 0x20], dl
inc rax
cmp rax, 0x10
jne 0x1403670e3
mov r9d, dword [r13 + 0x4c]
add r13, 0x54
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov r8, r13
call fcn.140482080
add r14d, 0x10
and r14d, 0xfffffff0
mov eax, r14d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14036e550
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push rsi
sub rsp, 0x20
mov esi, ecx
mov ecx, dword [0x1406368b4]
cmp ecx, 0xffffffff
jne 0x14036e56f
call sub.KERNEL32.dll_TlsAlloc
mov ecx, eax
mov dword [0x1406368b4], eax
movsxd rdx, esi
add rsp, 0x20
pop rsi
jmp sub.KERNEL32.dll_TlsSetValue
Function at 0x1403d2620
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
mov r10, rdx
lea rax, [rdx + 2]
movabs rsi, 0xaaaaaaaaaaaaaaab
mul rsi
movabs rax, 0x7ffffffffffffffe
and rax, rdx
lea rdx, [rax + rax]
add rdx, 1
mov eax, 0x54
cmp qword [r9], rdx
jb 0x1403d2743
mov rax, r10
mul rsi
shr rdx, 1
lea r11, [rdx + rdx*2]
xor eax, eax
test r11, r11
jne 0x1403d2673
mov rdx, r8
jmp 0x1403d26db
lea rsi, [0x1405f2004]
mov rdx, r8
movzx edi, byte [rcx]
shr rdi, 2
mov bl, byte [rdi + rsi]
mov byte [rdx], bl
movzx edi, byte [rcx]
shl rdi, 4
movzx ebx, byte [rcx + 1]
shr rbx, 4
and edi, 0x30
or rdi, rbx
mov bl, byte [rsi + rdi]
mov byte [rdx + 1], bl
movzx edi, byte [rcx + 1]
movzx ebx, byte [rcx + 2]
shr rbx, 6
and edi, 0xf
lea rdi, [rbx + rdi*4]
mov bl, byte [rsi + rdi]
mov byte [rdx + 2], bl
movzx edi, byte [rcx + 2]
and edi, 0x3f
mov bl, byte [rdi + rsi]
mov byte [rdx + 3], bl
add rdx, 4
add rcx, 3
add rax, 3
cmp rax, r11
jb 0x1403d267d
cmp rax, r10
jae 0x1403d273b
movzx esi, byte [rcx]
inc rax
xor r11d, r11d
cmp rax, r10
jae 0x1403d26f3
movzx r11d, byte [rcx + 1]
mov rdi, rsi
shr rdi, 2
shl rsi, 4
mov ecx, r11d
shr rcx, 4
and esi, 0x30
or rsi, rcx
lea rcx, [0x1405f2004]
mov bl, byte [rdi + rcx]
mov byte [rdx], bl
mov bl, byte [rcx + rsi]
mov byte [rdx + 1], bl
mov bl, 0x3d
cmp rax, r10
jae 0x1403d2730
shl r11d, 2
and r11d, 0x3c
mov bl, byte [r11 + rcx]
mov byte [rdx + 2], bl
mov byte [rdx + 3], 0x3d
add rdx, 4
mov byte [rdx], 0
sub edx, r8d
xor eax, eax
mov qword [r9], rdx
pop rbx
pop rdi
pop rsi
ret
Function at 0x14048200f
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
cmp edx, 2
jl 0x140482073
mov r8d, edx
mov edx, 1
lea r9, [0x140643a20]
lea r10, [0x140643e20]
lea r11, [0x140644220]
lea r14, [0x140644620]
mov rsi, rdx
shl rsi, 4
movzx edi, byte [rcx + rsi]
movzx ebx, byte [rcx + rsi + 1]
mov ebx, dword [r10 + rbx*4]
xor ebx, dword [r9 + rdi*4]
movzx edi, byte [rcx + rsi + 2]
movzx eax, byte [rcx + rsi + 3]
xor ebx, dword [r11 + rdi*4]
xor ebx, dword [r14 + rax*4]
mov dword [rcx + rsi], ebx
movzx eax, byte [rcx + rsi + 4]
movzx edi, byte [rcx + rsi + 5]
mov edi, dword [r10 + rdi*4]
xor edi, dword [r9 + rax*4]
movzx eax, byte [rcx + rsi + 6]
movzx ebx, byte [rcx + rsi + 7]
xor edi, dword [r11 + rax*4]
xor edi, dword [r14 + rbx*4]
mov dword [rcx + rsi + 4], edi
movzx eax, byte [rcx + rsi + 8]
movzx edi, byte [rcx + rsi + 9]
mov edi, dword [r10 + rdi*4]
xor edi, dword [r9 + rax*4]
movzx eax, byte [rcx + rsi + 0xa]
movzx ebx, byte [rcx + rsi + 0xb]
xor edi, dword [r11 + rax*4]
xor edi, dword [r14 + rbx*4]
mov dword [rcx + rsi + 8], edi
movzx eax, byte [rcx + rsi + 0xc]
movzx edi, byte [rcx + rsi + 0xd]
mov edi, dword [r10 + rdi*4]
xor edi, dword [r9 + rax*4]
movzx eax, byte [rcx + rsi + 0xe]
xor edi, dword [r11 + rax*4]
movzx eax, byte [rcx + rsi + 0xf]
xor edi, dword [r14 + rax*4]
mov dword [rcx + rsi + 0xc], edi
inc rdx
cmp rdx, r8
jne 0x140481fc2
xor eax, eax
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1404a2800
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov edi, r9d
mov rbx, r8
mov ebp, edx
mov rsi, rcx
mov ecx, edx
call fcn.140389860
test eax, eax
jne 0x1404a2927
mov dword [rsi + 0x110], ebp
test edi, edi
jne 0x1404a2841
mov eax, 0x20001
jmp 0x1404a2927
movsxd rax, ebp
imul r14, rax, 0x78
lea r15, [0x1406ab1d0]
mov r13d, dword [r14 + r15 + 0xc]
mov eax, 0x16
cmp r13d, 0x80
ja 0x1404a2927
lea r12, [r14 + r15]
add r12, 0x10
mov eax, dword [r12]
cmp eax, edi
jae 0x1404a28b7
lea rcx, [rsp + 0x2c]
mov dword [rcx], eax
lea r9, [rsi + 0x228]
mov qword [rsp + 0x20], rcx
mov ecx, ebp
mov rdx, rbx
mov r8d, edi
call fcn.14036e5c0
test eax, eax
jne 0x1404a2927
mov edx, dword [r12]
cmp edx, r13d
jbe 0x1404a28ec
sub edx, r13d
lea rcx, [rsi + r13]
add rcx, 0x228
jmp 0x1404a28e3
mov ebp, edi
lea rcx, [rsi + 0x228]
mov rdx, rbx
mov r8, rbp
call fcn.1401fba80
mov edx, dword [r12]
mov eax, edx
sub eax, edi
jbe 0x1404a28ec
lea rcx, [rsi + rbp]
add rcx, 0x228
mov rdx, rax
call fcn.1401fd370
mov edx, dword [r12]
test edx, edx
je 0x1404a290a
mov eax, edx
xor ecx, ecx
mov dl, byte [rsi + rcx + 0x228]
xor dl, 0x36
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, rax
jb 0x1404a28f4
mov rcx, rsi
call qword [r14 + r15 + 0x58]
test eax, eax
jne 0x1404a2927
mov r8d, dword [r12]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [r14 + r15 + 0x60]
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1404a29a0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x128
mov r15, r8
mov rdi, rdx
mov rbx, rcx
mov ebp, dword [rcx + 0x110]
mov ecx, ebp
call fcn.140389860
test eax, eax
jne 0x1404a2a9f
movsxd rax, ebp
imul rbp, rax, 0x78
lea rsi, [0x1406ab1d0]
mov r14d, dword [rbp + rsi + 0xc]
lea rdx, [rsp + 0xa0]
mov rcx, rbx
call qword [rbp + rsi + 0x68]
test eax, eax
jne 0x1404a2a9f
mov eax, dword [rbp + rsi + 0x10]
test rax, rax
je 0x1404a2a18
xor ecx, ecx
mov dl, byte [rbx + rcx + 0x228]
xor dl, 0x5c
mov byte [rsp + rcx + 0x20], dl
inc rcx
cmp rcx, rax
jb 0x1404a2a02
mov rcx, rbx
call qword [rbp + rsi + 0x58]
test eax, eax
jne 0x1404a2a9f
lea rax, [rsi + rbp]
add rax, 0x10
mov r8d, dword [rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [rax + 0x50]
test eax, eax
jne 0x1404a2a9f
lea rax, [rsi + rbp]
add rax, 0x60
lea rdx, [rsp + 0xa0]
mov rcx, rbx
mov r8d, r14d
call qword [rax]
test eax, eax
jne 0x1404a2a9f
lea rax, [rsi + rbp]
add rax, 0x68
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [rax]
test eax, eax
jne 0x1404a2a9f
xor eax, eax
mov ecx, 0
test r14d, r14d
je 0x1404a2a9c
xor edx, edx
xor ecx, ecx
mov ebp, dword [r15]
cmp rdx, rbp
jae 0x1404a2a9a
mov bl, byte [rsp + rdx + 0x20]
mov byte [rdi + rdx], bl
inc rdx
inc ecx
cmp rdx, r14
jb 0x1404a2a7f
jmp 0x1404a2a9c
mov ecx, edx
mov dword [r15], ecx
add rsp, 0x128
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1404bda90
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
mov r10d, dword [rsp + 0x50]
mov ebp, dword [rsp + 0x48]
mov r11d, r10d
neg r11d
mov esi, ebp
neg esi
cmp r8, 0xc
jb 0x1404bdb5e
add esi, r11d
add esi, r9d
mov eax, r10d
shr eax, 0xd
xor eax, esi
add ebp, r11d
sub ebp, eax
mov esi, eax
shl esi, 8
xor esi, ebp
sub r10d, eax
sub r10d, esi
mov edi, esi
shr edi, 0xd
xor edi, r10d
sub eax, esi
sub eax, edi
mov r9d, edi
shr r9d, 0xc
xor r9d, eax
sub esi, edi
sub esi, r9d
mov eax, r9d
shl eax, 0x10
xor eax, esi
sub edi, r9d
sub edi, eax
mov esi, eax
shr esi, 5
xor esi, edi
sub r9d, eax
sub r9d, esi
mov ebx, esi
shr ebx, 3
xor ebx, r9d
sub eax, esi
sub eax, ebx
mov edi, ebx
shl edi, 0xa
xor edi, eax
sub esi, ebx
sub esi, edi
mov eax, edi
shr eax, 0xf
xor eax, esi
mov r9d, dword [rdx]
mov ebp, dword [rdx + 4]
mov r10d, dword [rdx + 8]
xor ebx, r9d
xor edi, ebp
xor eax, r10d
mov dword [rcx], ebx
mov dword [rcx + 4], edi
mov dword [rcx + 8], eax
add rdx, 0xc
add rcx, 0xc
add r8, 0xfffffffffffffff4
mov r11d, r10d
neg r11d
mov esi, ebp
neg esi
cmp r8, 0xb
ja 0x1404bdab1
test r8, r8
je case.default.0x1404bdbf5
dec r8
cmp r8, 0xa
ja case.default.0x1404bdbf5
add esi, r11d
add esi, r9d
mov eax, r10d
shr eax, 0xd
xor eax, esi
add ebp, r11d
sub ebp, eax
mov ebx, eax
shl ebx, 8
xor ebx, ebp
sub r10d, eax
sub r10d, ebx
mov ebp, ebx
shr ebp, 0xd
xor ebp, r10d
sub eax, ebx
sub eax, ebp
mov edi, ebp
shr edi, 0xc
xor edi, eax
sub ebx, ebp
sub ebx, edi
mov esi, edi
shl esi, 0x10
xor esi, ebx
sub ebp, edi
sub ebp, esi
mov eax, esi
shr eax, 5
xor eax, ebp
sub edi, esi
sub edi, eax
mov r9d, eax
shr r9d, 3
xor r9d, edi
sub esi, eax
sub esi, r9d
mov ebp, r9d
shl ebp, 0xa
xor ebp, esi
sub eax, r9d
sub eax, ebp
mov r10d, ebp
shr r10d, 0xf
xor r10d, eax
lea rax, [0x1404bdc70]
movsxd rbx, dword [rax + r8*4]
add rbx, rax
jmp rbx
mov eax, r10d
shr eax, 0x10
xor al, byte [rdx + 0xa]
mov byte [rcx + 0xa], al
mov eax, r10d
shr eax, 8
xor al, byte [rdx + 9]
mov byte [rcx + 9], al
xor r10b, byte [rdx + 8]
mov byte [rcx + 8], r10b
mov eax, ebp
shr eax, 0x18
xor al, byte [rdx + 7]
mov byte [rcx + 7], al
mov eax, ebp
shr eax, 0x10
xor al, byte [rdx + 6]
mov byte [rcx + 6], al
shr ebp, 8
xor bpl, byte [rdx + 5]
mov byte [rcx + 5], bpl
xor sil, byte [rdx + 4]
mov byte [rcx + 4], sil
mov eax, r9d
shr eax, 0x18
xor al, byte [rdx + 3]
mov byte [rcx + 3], al
mov eax, r9d
shr eax, 0x10
xor al, byte [rdx + 2]
mov byte [rcx + 2], al
mov eax, r9d
shr eax, 8
xor al, byte [rdx + 1]
mov byte [rcx + 1], al
xor r9b, byte [rdx]
mov byte [rcx], r9b
pop rbx
pop rbp
pop rdi
pop rsi
ret