joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c97c4
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x1030
call fcn.140120c90
sub rsp, rax
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x1020], rax
xor r14d, r14d
mov rdi, rdx
mov rsi, rcx
cmp word [rcx], r14w
je 0x1400c9a0e
or rbx, 0xffffffffffffffff
mov rbp, rbx
inc rbp
cmp word [rcx + rbp*2], r14w
jne 0x1400c980b
call fcn.1400c972c
test al, al
je 0x1400c98dd
call fcn.1400c9190
test al, al
je 0x1400c985f
lea rax, [rbp + 4]
mov r10d, 0x800
cmp rax, r10
jae 0x1400c9a0e
mov r8d, r10d
lea rdx, [0x1401444b8]
mov rcx, rdi
call fcn.1400c8ae0
inc rbx
cmp word [rdi + rbx*2], r14w
jne 0x1400c9850
jmp 0x1400c99f3
cmp word [rcx], 0x5c
jne 0x1400c9a0e
cmp word [rcx + 2], 0x5c
jne 0x1400c9a0e
lea rax, [rbp + 6]
mov r10d, 0x800
cmp rax, r10
jae 0x1400c9a0e
mov r8d, r10d
lea rdx, [0x1401444b8]
mov rcx, rdi
call fcn.1400c8ae0
mov rax, rbx
inc rax
cmp word [rdi + rax*2], r14w
jne 0x1400c989c
cmp rax, r10
jae 0x1400c98c1
mov r8, r10
lea rcx, [rdi + rax*2]
sub r8, rax
lea rdx, [0x1401497c0]
call fcn.1400c8ae0
inc rbx
cmp word [rdi + rbx*2], r14w
jne 0x1400c98c1
cmp rbx, r10
jae 0x1400c9a0a
lea rdx, [rsi + 2]
jmp 0x1400c99fb
lea rdx, [rsp + 0x20]
mov ecx, 0x7ff
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x7fe
ja 0x1400c9a0e
cmp word [rsi], 0x5c
je 0x1400c999c
cmp word [rsi], 0x2f
je 0x1400c999c
lea rcx, [rsp + 0x20]
call fcn.1400c91c0
mov rax, rbx
lea rcx, [rsp + 0x20]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1400c9920
add rax, 4
mov r10d, 0x800
add rax, rbp
cmp rax, r10
jae 0x1400c9a0e
mov r8d, r10d
lea rdx, [0x1401444b8]
mov rcx, rdi
call fcn.1400c8ae0
mov rax, rbx
inc rax
cmp word [rdi + rax*2], r14w
jne 0x1400c9955
cmp rax, r10
jae 0x1400c9978
mov r8, r10
lea rcx, [rdi + rax*2]
sub r8, rax
lea rdx, [rsp + 0x20]
call fcn.1400c8ae0
cmp word [rsi], 0x2e
jne 0x1400c9990
cmp word [rsi + 2], 0x5c
je 0x1400c998c
cmp word [rsi + 2], 0x2f
jne 0x1400c9990
add rsi, 4
inc rbx
cmp word [rdi + rbx*2], r14w
jne 0x1400c9990
jmp 0x1400c99f3
lea rax, [rbp + 6]
mov r10d, 0x800
cmp rax, r10
jae 0x1400c9a0e
mov r8d, r10d
lea rdx, [0x1401444b8]
mov rcx, rdi
call fcn.1400c8ae0
mov rax, rbx
mov word [rsp + 0x24], r14w
inc rax
cmp word [rdi + rax*2], r14w
jne 0x1400c99c6
cmp rax, r10
jae 0x1400c99e9
mov r8, r10
lea rcx, [rdi + rax*2]
sub r8, rax
lea rdx, [rsp + 0x20]
call fcn.1400c8ae0
inc rbx
cmp word [rdi + rbx*2], r14w
jne 0x1400c99e9
cmp rbx, r10
jae 0x1400c9a0a
mov rdx, rsi
sub r10, rbx
lea rcx, [rdi + rbx*2]
mov r8, r10
call fcn.1400c8ae0
mov al, 1
jmp 0x1400c9a10
xor al, al
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1400eb9c0
lea r11, [rsp + 0x1030]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400ca668
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [rcx + 0x1b60], 0
lea rax, [0x140149818]
mov qword [rcx], rax
mov rbx, rcx
je 0x1400ca6a9
mov rdi, qword [rcx + 0x1b68]
test rdi, rdi
je 0x1400ca6a9
mov rcx, rdi
call fcn.1400c4c78
mov edx, 0xc808
mov rcx, rdi
call fcn.1400eb9e8
mov rcx, qword [rbx + 0x5a58]
test rcx, rcx
je 0x1400ca6ba
call fcn.1400feb88
mov rcx, qword [rbx + 0x36f8]
test rcx, rcx
je 0x1400ca6cb
call fcn.1400feb88
lea rcx, [rbx + 0x2670]
call fcn.1400c8894
lea rcx, [rbx + 0x1b88]
call fcn.1400dfda8
lea rcx, [rbx + 0x1a20]
call fcn.1400d281c
lea rcx, [rbx + 0x1048]
call fcn.1400c63dc
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400d1060
Function at 0x1400cf560
Capabilities:
Get token membership

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rbp - 8], rax
xor ebx, ebx
mov word [rbp - 0xc], 0x500
lea rax, [rbp - 0x18]
mov dword [rbp - 0x10], ebx
mov qword [rsp + 0x50], rax
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [rbp - 0x20], eax
test eax, eax
je 0x1400cf5ed
mov rdx, qword [rbp - 0x18]
lea r8, [rbp - 0x20]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1400cf5de
mov dword [rbp - 0x20], ebx
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [rbp - 0x20]
test eax, eax
setne al
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400eb9c0
mov rbx, qword [rsp + 0x90]
add rsp, 0x80
pop rbp
ret
Function at 0x1400d1060
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 8], 0xffffffffffffffff
lea rax, [0x140149968]
mov qword [rcx], rax
je 0x1400d108f
cmp byte [rcx + 0x19], 0
jne 0x1400d108f
cmp byte [rcx + 0x20], 0
je 0x1400d108a
add rsp, 0x28
jmp fcn.1400d141c
call fcn.1400d13bc
add rsp, 0x28
ret

Function at 0x1400d141c
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x14], 0
mov rbx, rcx
jne 0x1400d144c
cmp qword [rcx + 8], 0xffffffffffffffff
je 0x1400d1438
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp byte [rbx + 0x21], 0
je 0x1400d144c
lea rcx, [rbx + 0x3a]
add rsp, 0x20
pop rbx
jmp fcn.1400d2214
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400d1454
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x30
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
test r8, r8
jne 0x1400d1481
mov al, 1
jmp 0x1400d1529
cmp dword [rcx + 0x14], 1
lea rsi, [rcx + 8]
jne 0x1400d1499
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsi], rax
and dword [rsp + 0x60], 0
xor cl, cl
cmp dword [rbx + 0x14], 0
je 0x1400d14f3
xor r14d, r14d
test rdi, rdi
je 0x1400d1517
mov r12d, 0x4000
mov eax, edi
lea rdx, [r14 + rbp]
sub eax, r14d
lea r9, [rsp + 0x60]
mov r8d, r12d
mov rcx, rdi
sub rcx, r14
cmp rcx, r12
mov rcx, qword [rsi]
cmovb r8d, eax
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete cl
jne 0x1400d1513
add r14, r12
cmp r14, rdi
jb 0x1400d14b4
jmp 0x1400d1513
mov rcx, qword [rsi]
lea r9, [rsp + 0x60]
and qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete cl
test cl, cl
jne 0x1400d1523
cmp byte [rbx + 0x22], 0
je 0x1400d1523
cmp dword [rbx + 0x14], 0
je 0x1400d1542
mov byte [rbx + 0x10], 1
mov al, cl
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r12
pop rdi
ret
call fcn.1400ced14
int3
Function at 0x1400d16a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x14], 1
lea rdi, [rcx + 8]
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jne 0x1400d16d5
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rdi], rax
mov rcx, qword [rdi]
lea r9, [rsp + 0x40]
and qword [rsp + 0x20], 0
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400d175c
cmp qword [rdi], 0xffffffffffffffff
je 0x1400d1722
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileType]
add eax, 0xfffffffe
cmp eax, 1
ja 0x1400d1722
mov r8d, 0x4e20
cmp rsi, r8
jbe 0x1400d1722
mov rdx, rbp
mov rcx, rbx
call fcn.1400d16a0
jmp 0x1400d1760
cmp dword [rbx + 0x14], 1
jne 0x1400d1737
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x1400d1737
xor eax, eax
jmp 0x1400d1760
cmp dword [rbx + 0x14], 0
jne 0x1400d1757
mov edi, 0x8000
cmp rsi, rdi
jbe 0x1400d1757
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x1400d1757
mov r8d, edi
jmp 0x1400d1715
or eax, 0xffffffff
jmp 0x1400d1760
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x1400d1adc
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x1030
call fcn.140120c90
sub rsp, rax
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov ebp, r8d
mov sil, dl
or r8, 0xffffffffffffffff
mov rdi, rcx
xor ebx, ebx
inc r8
cmp word [rcx + r8*2], bx
jne 0x1400d1b12
lea rax, [rcx - 2]
test r8, r8
lea rax, [rax + r8*2]
cmovne rcx, rax
cmp word [rcx], 0x2e
je 0x1400d1b46
cmp word [rcx], 0x20
je 0x1400d1b46
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400d1b75
mov rcx, rdi
call fcn.1400d1ee4
cmp eax, 0xffffffff
jne 0x1400d1b88
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400c97c4
test al, al
je 0x1400d1b88
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x1400d1b88
test sil, sil
je 0x1400d1b84
mov edx, ebp
mov rcx, rdi
call fcn.1400d1f5c
xor eax, eax
jmp 0x1400d1ba3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400d1b9e
cmp eax, 3
sete bl
lea eax, [rbx + 1]
jmp 0x1400d1ba3
mov eax, 2
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1400eb9c0
mov rbx, qword [rsp + 0x1058]
add rsp, 0x1030
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400d1ee4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1030
call fcn.140120c90
sub rsp, rax
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400d1f37
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400c97c4
test al, al
je 0x1400d1f37
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1400eb9c0
mov rbx, qword [rsp + 0x1048]
add rsp, 0x1030
pop rdi
ret

Function at 0x1400d1f5c
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1030
call fcn.140120c90
sub rsp, rax
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov esi, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
test eax, eax
jne 0x1400d1fbd
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400c97c4
test al, al
je 0x1400d1fbd
mov edx, esi
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
mov al, bl
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1400eb9c0
lea r11, [rsp + 0x1030]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400d2170
Capabilities:
Move file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2030
call fcn.140120c90
sub rsp, rax
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x2020], rax
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
test eax, eax
jne 0x1400d21ec
lea rdx, [rsp + 0x1020]
mov rcx, rdi
call fcn.1400c97c4
test al, al
je 0x1400d21ec
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.1400c97c4
test al, al
je 0x1400d21ec
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x1020]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
setne bl
mov al, bl
mov rcx, qword [rsp + 0x2020]
xor rcx, rsp
call fcn.1400eb9c0
lea r11, [rsp + 0x2030]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1400d2214
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1030
call fcn.140120c90
sub rsp, rax
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
test eax, eax
jne 0x1400d226c
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400c97c4
test al, al
je 0x1400d226c
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov al, bl
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1400eb9c0
mov rbx, qword [rsp + 0x1048]
add rsp, 0x1030
pop rdi
ret
Function at 0x1400d2290
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1030
call fcn.140120c90
sub rsp, rax
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x1400d22e8
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1400c97c4
test al, al
je 0x1400d22e8
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
mov al, bl
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.1400eb9c0
mov rbx, qword [rsp + 0x1048]
add rsp, 0x1030
pop rdi
ret
Function at 0x1400dccd4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x28
cmp edx, 0xf
je 0x1400dcd42
cmp edx, 0x14
je 0x1400dcd2d
cmp edx, 0x1a
je 0x1400dcd2d
cmp edx, 0x1d
je 0x1400dcd18
cmp edx, 0x32
jne 0x1400dcd53
cmp dword [rcx + 0x30], 1
jbe 0x1400dcd0c
cmp byte [rcx + 0x4d98], 0
jne 0x1400dcd0c
mov dl, r8b
add rsp, 0x28
jmp fcn.1400d4984
mov dl, r8b
add rsp, 0x28
jmp fcn.1400daa8c
cmp byte [rcx + 0x4d98], 0
jne 0x1400dcd53
mov dl, r8b
add rsp, 0x28
jmp fcn.1400d8924
cmp byte [rcx + 0x4d98], 0
jne 0x1400dcd53
mov dl, r8b
add rsp, 0x28
jmp fcn.1400d7820
cmp byte [rcx + 0x4d98], 0
jne 0x1400dcd53
mov dl, r8b
call fcn.1400d6840
add rsp, 0x28
ret
Function at 0x1400dd640
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r8d, dword [rcx + 0x9b8]
add rdx, 2
mov r9d, dword [rcx + 0x9bc]
mov ebx, 4
mov r10d, dword [rcx + 0x9c0]
mov r11d, dword [rcx + 0x9c4]
movzx eax, byte [rdx - 2]
xor r8d, dword [rcx + rax*4 + 0x4b8]
mov dword [rcx + 0x9b8], r8d
movzx eax, byte [rdx - 1]
xor r9d, dword [rcx + rax*4 + 0x4b8]
mov dword [rcx + 0x9bc], r9d
movzx eax, byte [rdx]
lea rdx, [rdx + 4]
xor r10d, dword [rcx + rax*4 + 0x4b8]
mov dword [rcx + 0x9c0], r10d
movzx eax, byte [rdx - 3]
xor r11d, dword [rcx + rax*4 + 0x4b8]
mov dword [rcx + 0x9c4], r11d
sub rbx, 1
jne 0x1400dd66a
mov rbx, qword [rsp + 8]
ret
Function at 0x1400de01c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rbp + 0x120], rax
movups xmm0, xmmword [r8]
mov rdi, qword [rbp + 0x190]
lea rax, [rbp + 0x68]
mov rbx, qword [rbp + 0x198]
lea r8, [rbp + 0xd0]
mov rsi, qword [rbp + 0x1a0]
xor r14d, r14d
mov qword [rsp + 0x40], r14
mov r12, rdx
mov qword [rsp + 0x38], r14
mov r15, rcx
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea r9d, [r14 + 0x14]
mov qword [rsp + 0x20], rax
movdqu xmmword [rbp + 0xd0], xmm0
mov dword [rbp + 0xe0], 0x1000000
call fcn.1400ddc5c
movups xmm0, xmmword [rbp + 0x68]
mov eax, dword [rbp + 0x1a8]
movups xmm1, xmmword [rbp + 0x78]
mov byte [rsp + 0x51], r14b
dec eax
mov byte [rsp + 0x50], r14b
mov r14d, 3
mov qword [rbp + 0x58], rbx
lea rbx, [rbp + 0x40]
mov qword [rbp + 0x60], rsi
lea rsi, [rbp + 0x50]
movups xmmword [rbp + 0x88], xmm0
lea r13d, [r14 + 0x1d]
mov dword [rbp + 0x40], eax
movups xmmword [rbp + 0x98], xmm1
mov dword [rbp + 0x44], 0x10
mov dword [rbp + 0x48], 0x10
mov qword [rbp + 0x50], rdi
cmp dword [rbx], 0
jbe 0x1400de1a9
mov edi, dword [rbx]
lea rax, [rsp + 0x50]
mov r9, r13
mov qword [rsp + 0x40], rax
lea r8, [rbp + 0x68]
lea rax, [rsp + 0x60]
mov rdx, r12
mov qword [rsp + 0x38], rax
mov rcx, r15
lea rax, [rsp + 0x51]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x20], rax
call fcn.1400ddc5c
movups xmm0, xmmword [rbp + 0xa8]
xor eax, eax
movups xmm1, xmmword [rbp + 0xb8]
movups xmmword [rbp + 0x68], xmm0
lea ecx, [rax + 2]
movups xmmword [rbp + 0x78], xmm1
movdqu xmm0, xmmword [rbp + rax + 0x88]
movdqu xmm1, xmmword [rbp + rax + 0x68]
lea rax, [rax + 0x10]
xorps xmm1, xmm0
movdqu xmmword [rbp + rax + 0x78], xmm1
sub rcx, 1
jne 0x1400de16f
sub rdi, 1
jne 0x1400de10f
movups xmm1, xmmword [rbp + 0x98]
movups xmm0, xmmword [rbp + 0x88]
mov rax, qword [rsi]
add rbx, 4
add rsi, 8
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm1
sub r14, 1
jne 0x1400de104
xor eax, eax
lea rdi, [rbp + 0xd0]
lea ecx, [rax + 0x44]
rep stosb byte [rdi], al
lea rdi, [rbp + 0x88]
mov rcx, r13
rep stosb byte [rdi], al
lea rdi, [rbp + 0x68]
mov rcx, r13
rep stosb byte [rdi], al
lea rdi, [rbp + 0xa8]
mov rcx, r13
rep stosb byte [rdi], al
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.1400eb9c0
mov rbx, qword [rsp + 0x288]
add rsp, 0x230
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400de5dc
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x78], rax
cmp dword [rcx], 2
lea rbx, [rcx + 4]
mov rsi, rdx
mov rdi, rcx
mov r14d, 0x20
jne 0x1400de671
and qword [r11 - 0x58], 0
lea r9d, [r14 - 0x1c]
and qword [r11 - 0x60], 0
lea r8, [r11 - 0x48]
mov eax, dword [rbx]
mov edx, r14d
and qword [r11 - 0x68], 0
mov rcx, rsi
and qword [r11 - 0x70], 0
mov dword [rsp + 0x50], eax
lea rax, [r11 - 0x40]
mov qword [r11 - 0x78], rax
call fcn.1400ddc5c
xor r8d, r8d
lea r9, [rsp + 0x58]
xor edx, edx
movzx eax, byte [r9]
mov ecx, r8d
and ecx, 3
inc r8d
shl ecx, 3
inc r9
shl eax, cl
xor eax, edx
mov edx, eax
cmp r8d, r14d
jb 0x1400de651
mov dword [rbx], eax
cmp dword [rdi], 3
jne 0x1400de6ba
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
and qword [rsp + 0x38], 0
mov r9, r14
and qword [rsp + 0x30], 0
mov r8, rbx
and qword [rsp + 0x28], 0
mov rdx, r14
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.1400ddc5c
movups xmm0, xmmword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400eb9c0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop r14
pop rdi
pop rsi
ret
Function at 0x1400de784
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov r10, r8
mov ecx, dword [rcx + 0x3ac]
mov rdi, rdx
sub ecx, 1
je 0x1400dea01
sub ecx, 1
je 0x1400de96b
sub ecx, 1
je 0x1400de7ef
sub ecx, 1
je 0x1400de7db
cmp ecx, 1
jne 0x1400dea2f
lea rcx, [rbx + 0x3b0]
mov r9, rdx
call fcn.1400e36cc
jmp 0x1400dea2f
test r8, r8
je 0x1400dea2f
lea rsi, [r8 - 1]
shr rsi, 4
inc rsi
mov r11d, dword [rbx + 0x9b8]
mov r12d, 0x1f
mov r10d, dword [rdi + 4]
mov r9d, r11d
mov ebp, dword [rbx + 0x9c0]
mov r13d, r12d
movups xmm0, xmmword [rdi]
xor r9d, dword [rdi]
xor r10d, dword [rbx + 0x9bc]
xor ebp, dword [rdi + 8]
mov r14d, dword [rdi + 0xc]
xor r14d, dword [rbx + 0x9c4]
movdqu xmmword [rsp + 0x20], xmm0
mov rax, r13
mov edx, r14d
and eax, 3
ror edx, 0x15
add edx, ebp
dec r13
mov r8d, dword [rbx + rax*4 + 0x9b8]
xor edx, r8d
mov eax, edx
shr rax, 0x10
movzx eax, al
movzx r15d, byte [rax + rbx + 0x8b8]
mov eax, edx
shr rax, 0x18
movzx ecx, byte [rax + rbx + 0x8b8]
mov eax, edx
shr rax, 8
movzx eax, al
shl ecx, 8
or r15d, ecx
shl r15d, 8
movzx ecx, byte [rax + rbx + 0x8b8]
or r15d, ecx
movzx ecx, dl
shl r15d, 8
mov edx, ebp
ror edx, 0xf
xor edx, r14d
movzx eax, byte [rcx + rbx + 0x8b8]
add edx, r8d
or r15d, eax
mov eax, edx
shr rax, 0x10
xor r15d, r9d
movzx eax, al
mov r9d, ebp
mov ebp, r15d
movzx r8d, byte [rax + rbx + 0x8b8]
mov eax, edx
shr rax, 0x18
movzx ecx, byte [rax + rbx + 0x8b8]
mov eax, edx
shl ecx, 8
or r8d, ecx
shr rax, 8
shl r8d, 8
movzx eax, al
movzx ecx, byte [rax + rbx + 0x8b8]
or r8d, ecx
movzx ecx, dl
shl r8d, 8
movzx eax, byte [rcx + rbx + 0x8b8]
or r8d, eax
xor r8d, r10d
mov r10d, r14d
sub r12d, 1
mov r14d, r8d
jns 0x1400de841
xor r11d, r15d
lea rdx, [rsp + 0x20]
mov dword [rdi], r11d
mov rcx, rbx
xor r8d, dword [rbx + 0x9bc]
mov dword [rdi + 4], r8d
xor r9d, dword [rbx + 0x9c0]
mov dword [rdi + 8], r9d
xor r10d, dword [rbx + 0x9c4]
mov dword [rdi + 0xc], r10d
call fcn.1400dd640
add rdi, 0x10
sub rsi, 1
jne 0x1400de803
jmp 0x1400dea2f
test r8, r8
je 0x1400dea2f
mov ecx, 0x1234
add cx, word [rbx + 0x9cc]
mov word [rbx + 0x9cc], cx
movzx r8d, cx
mov eax, r8d
shr rax, 1
movzx ecx, al
movzx eax, word [rbx + rcx*4 + 0x4b8]
xor word [rbx + 0x9ce], ax
movzx eax, word [rbx + rcx*4 + 0x4ba]
sub word [rbx + 0x9d0], ax
movzx eax, word [rbx + 0x9d2]
movzx edx, word [rbx + 0x9d0]
ror ax, 1
xor dx, r8w
xor ax, word [rbx + 0x9ce]
movzx ecx, ax
shr ax, 1
shl cx, 0xf
or cx, ax
xor dx, cx
mov word [rbx + 0x9d2], cx
mov word [rbx + 0x9cc], dx
shr dx, 8
xor byte [rdi], dl
inc rdi
sub r10, 1
jne 0x1400de974
jmp 0x1400dea2f
test r8, r8
je 0x1400dea2f
mov al, byte [rbx + 0x9ca]
add byte [rbx + 0x9c9], al
mov al, byte [rbx + 0x9c9]
add byte [rbx + 0x9c8], al
mov al, byte [rbx + 0x9c8]
sub byte [rdi], al
inc rdi
sub r10, 1
jne 0x1400dea06
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400eb9c0
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400dea54
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x570]
sub rsp, 0x670
mov rax, qword [0x14015e020]
xor rax, rsp
mov qword [rbp + 0x560], rax
mov rax, qword [rbp + 0x5f0]
mov rsi, r9
mov r15, qword [rbp + 0x5d0]
mov ebx, r8d
mov r12, qword [rbp + 0x5d8]
mov r14b, dl
mov r13, qword [rbp + 0x5e8]
mov rdi, rcx
mov qword [rsp + 0x50], rax
xor eax, eax
test r8d, r8d
je 0x1400dec9d
cmp byte [r9 + 0x18], al
je 0x1400dec9d
mov dword [rcx + 0x3ac], ebx
lea rdx, [rbp + 0x160]
mov rcx, r9
call fcn.1400c5b74
xor eax, eax
lea rdx, [rsp + 0x60]
mov r8d, 0x200
mov word [rbp + 0x25e], ax
lea rcx, [rbp + 0x160]
call fcn.1400c5fec
xor ecx, ecx
mov byte [rbp - 0x21], cl
sub ebx, 1
je 0x1400dec2e
sub ebx, 1
je 0x1400deb93
sub ebx, 1
je 0x1400deb81
sub ebx, 1
je 0x1400deb62
cmp ebx, 1
jne 0x1400dec7f
mov rax, qword [rsp + 0x50]
lea r9, [rbp + 0x160]
mov qword [rsp + 0x40], rax
mov r8, rsi
mov eax, dword [rbp + 0x5e0]
mov dl, r14b
mov qword [rsp + 0x38], r13
mov rcx, rdi
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
call fcn.1400de220
jmp 0x1400dec7f
lea r9, [rbp + 0x160]
mov qword [rsp + 0x20], r15
mov r8, rsi
mov dl, r14b
mov rcx, rdi
call fcn.1400dd6c8
jmp 0x1400dec7f
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.1400dd2b4
jmp 0x1400dec7f
lea rcx, [rdi + 0x4b8]
call fcn.1400dfb08
or r8, 0xffffffffffffffff
lea rax, [rsp + 0x60]
xor ebx, ebx
inc r8
cmp byte [rax + r8], bl
jne 0x1400debaa
lea rdx, [rsp + 0x60]
or ecx, 0xffffffff
call fcn.1400dfb50
mov word [rdi + 0x9cc], ax
shr eax, 0x10
mov word [rdi + 0x9ce], ax
mov al, byte [rsp + 0x60]
mov dword [rdi + 0x9d0], ebx
test al, al
je 0x1400dec7f
movzx r8d, bx
lea r9, [rsp + 0x60]
movzx r10d, bx
movzx ecx, al
inc r9
movzx edx, al
xor r8w, dx
xor r8w, word [rdi + rcx*4 + 0x4b8]
mov al, byte [r9]
mov word [rdi + 0x9d0], r8w
add dx, word [rdi + rcx*4 + 0x4ba]
add dx, r10w
mov word [rdi + 0x9d2], dx
movzx r10d, dx
test al, al
jne 0x1400debf0
jmp 0x1400dec7f
mov al, byte [rsp + 0x60]
mov word [rdi + 0x9c9], cx
mov byte [rdi + 0x9c8], cl
test al, al
je 0x1400dec7f
mov r8b, cl
lea r10, [rsp + 0x60]
mov r9b, cl
mov dl, cl
add dl, al
add r8b, al
xor r9b, al
inc r10
mov al, dl
shr dl, 7
add al, al
or dl, al
mov al, byte [r10]
test al, al
jne 0x1400dec50
mov byte [rdi + 0x9ca], dl
mov byte [rdi + 0x9c9], r9b
mov byte [rdi + 0x9c8], r8b
xor eax, eax
lea rdi, [rsp + 0x60]
mov ecx, 0x200
rep stosb byte [rdi], al
lea rdi, [rbp + 0x160]
mov ecx, 0x400
rep stosb byte [rdi], al
mov al, 1
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.1400eb9c0
mov rbx, qword [rsp + 0x6b8]
add rsp, 0x670
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret