joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802c1900
Capabilities:
Read file on windows

Disassembly:
jmp 0x18077a590
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x180ab8a75]
call fcn.1802c256c
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1802c1914
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x18077abb0
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x180ab8a75]
call fcn.1802c256c
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x18084f9b0]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x18077acf5
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x18077ac49
mov dword [rbp + 0x160], 1
jmp 0x18077ac53
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x18077acf0
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x18077acca
cmp qword [rbp + 0x198], 2
jb 0x18077acca
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18077acca
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18077acca
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x18077ac14
jmp 0x18077ad8f
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x18077ad8f
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x18077ad66
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18077ad66
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x18077ad66
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x18077acf5
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1802c227e
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x18077aa90
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x180ab8a75]
call fcn.1802c256c
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x18084f9b0]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x18077ab0f
mov dword [rbp + 0x120], 1
jmp 0x18077ab19
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x18077ab62
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x18077aada
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x180838890
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x1c8]
mov rax, qword [0x180899880]
xor rax, rbp
mov qword [rbp + 0x178], rax
lea rcx, [0x180ab8f69]
call fcn.1802c256c
mov eax, dword [rbp + 0x1a0]
imul rax, rax, 0x38
mov rcx, qword [0x180aaa840]
add rcx, rax
mov rax, rcx
mov qword [rbp + 8], rax
mov qword [rbp + 0x48], 5
mov rax, qword [rbp + 8]
mov rax, qword [rax]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x180838932
mov rax, qword [rbp + 0x68]
sub rax, 5
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x48]
add rax, 2
mov qword [rbp + 0x48], rax
lea r9, [rbp + 0x24]
mov r8d, 0x40
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180838958
mov eax, 0xa
jmp 0x180838a87
cmp dword [rbp + 0x1a8], 0
je 0x1808389cc
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x88]
mov byte [rax], 0xe9
mov rax, qword [rbp + 0x68]
add rax, 5
mov rcx, qword [rbp + 8]
mov rcx, qword [rcx + 8]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rbp + 0x88]
mov dword [rcx + 1], eax
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1808389ca
mov rax, qword [rbp + 8]
mov rax, qword [rax]
mov qword [rbp + 0xa8], rax
mov rax, qword [rbp + 0xa8]
mov byte [rax], 0xeb
mov rax, qword [rbp + 0xa8]
mov byte [rax + 1], 0xf9
jmp 0x180838a13
mov rax, qword [rbp + 8]
movzx eax, byte [rax + 0x20]
and al, 1
movzx eax, al
test eax, eax
je 0x1808389f9
mov rax, qword [rbp + 8]
add rax, 0x18
mov r8d, 7
mov rdx, rax
mov rcx, qword [rbp + 0x68]
call fcn.1802c11bc
jmp 0x180838a13
mov rax, qword [rbp + 8]
add rax, 0x18
mov r8d, 5
mov rdx, rax
mov rcx, qword [rbp + 0x68]
call fcn.1802c11bc
lea r9, [rbp + 0x24]
mov r8d, dword [rbp + 0x24]
mov rdx, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x68]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
movzx eax, byte [rbp + 0x1a8]
and al, 1
shl al, 1
mov rcx, qword [rbp + 8]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfd
or cl, al
movzx eax, cl
mov rcx, qword [rbp + 8]
mov byte [rcx + 0x20], al
movzx eax, byte [rbp + 0x1a8]
and al, 1
shl al, 2
mov rcx, qword [rbp + 8]
movzx ecx, byte [rcx + 0x20]
and cl, 0xfb
or cl, al
movzx eax, cl
mov rcx, qword [rbp + 8]
mov byte [rcx + 0x20], al
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x180880d10]
call fcn.1802c1f31
mov rax, rdi
mov rcx, qword [rbp + 0x178]
xor rcx, rbp
call fcn.1802c11ad
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x180838be0
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x22
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x180899880]
xor rax, rbp
mov qword [rbp + 0x138], rax
lea rcx, [0x180ab8f69]
call fcn.1802c256c
xor edx, edx
mov ecx, 4
call fcn.1802c1149
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x180838daf
mov dword [rbp + 0x28], 0x1c
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call fcn.1802c1707
test eax, eax
je 0x180838da5
mov eax, dword [rbp + 0x28]
cmp rax, 0x10
jb 0x180838d89
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rbp + 0x34], eax
jne 0x180838d89
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rbp + 0x30], eax
je 0x180838d89
mov rax, qword [rbp + 0x160]
cmp qword [rax], 0
jne 0x180838ce4
mov rax, qword [rbp + 0x160]
mov dword [rax + 8], 0x80
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 8]
shl rax, 2
mov r8, rax
xor edx, edx
mov rcx, qword [0x180aaa040]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbp + 0x160]
mov qword [rcx], rax
mov rax, qword [rbp + 0x160]
cmp qword [rax], 0
jne 0x180838ce2
jmp 0x180838da5
jmp 0x180838d59
mov rax, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x160]
mov ecx, dword [rcx + 8]
cmp dword [rax + 0xc], ecx
jb 0x180838d59
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 8]
shl eax, 1
mov eax, eax
shl rax, 2
mov r9, rax
mov rax, qword [rbp + 0x160]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x180aaa040]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x180838d35
jmp 0x180838da5
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 8]
shl eax, 1
mov rcx, qword [rbp + 0x160]
mov dword [rcx + 8], eax
mov rax, qword [rbp + 0x160]
mov rcx, qword [rbp + 0x68]
mov qword [rax], rcx
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 0xc]
mov rcx, qword [rbp + 0x160]
mov rcx, qword [rcx]
mov edx, dword [rbp + 0x30]
mov dword [rcx + rax*4], edx
mov rax, qword [rbp + 0x160]
mov eax, dword [rax + 0xc]
inc eax
mov rcx, qword [rbp + 0x160]
mov dword [rcx + 0xc], eax
mov dword [rbp + 0x28], 0x1c
lea rdx, [rbp + 0x28]
mov rcx, qword [rbp + 8]
call fcn.1802c0442
test eax, eax
jne 0x180838c60
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x20]
lea rdx, [0x180880c90]
call fcn.1802c1f31
mov rcx, qword [rbp + 0x138]
xor rcx, rbp
call fcn.1802c11ad
lea rsp, [rbp + 0x148]
pop rdi
pop rbp
ret
Function at 0x1808390e0
Capabilities:
Suspend thread

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x180ab8f69]
call fcn.1802c256c
mov rax, qword [rbp + 0x120]
mov qword [rax], 0
mov rax, qword [rbp + 0x120]
mov dword [rax + 8], 0
mov rax, qword [rbp + 0x120]
mov dword [rax + 0xc], 0
mov rcx, qword [rbp + 0x120]
call fcn.180838be0
mov rax, qword [rbp + 0x120]
cmp qword [rax], 0
je 0x1808391c0
mov dword [rbp + 4], 0
jmp 0x18083915c
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x120]
mov eax, dword [rax + 0xc]
cmp dword [rbp + 4], eax
jae 0x1808391c0
mov eax, dword [rbp + 4]
mov rcx, qword [rbp + 0x120]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x1808391be
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_SuspendThread]
mov r8d, dword [rbp + 0x130]
mov edx, dword [rbp + 0x128]
mov rcx, qword [rbp + 0x28]
call fcn.180839f30
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x180839154
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x18083a300
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x180ab8f69]
call fcn.1802c256c
mov rax, qword [rbp + 0x120]
cmp qword [rax], 0
je 0x18083a3a4
mov dword [rbp + 4], 0
jmp 0x18083a33d
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x120]
mov eax, dword [rax + 0xc]
cmp dword [rbp + 4], eax
jae 0x18083a38b
mov eax, dword [rbp + 4]
mov rcx, qword [rbp + 0x120]
mov rcx, qword [rcx]
mov r8d, dword [rcx + rax*4]
xor edx, edx
mov ecx, 0x5a
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
je 0x18083a389
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18083a335
mov rax, qword [rbp + 0x120]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x180aaa040]
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret
Function at 0x18083adc0
Capabilities:
Check for software breakpoints

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x180ab902d]
call fcn.1802c256c
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x100]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x18083ae35
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x100]
movzx eax, byte [rcx + rax]
cmp eax, 0x90
je 0x18083ae35
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x100]
movzx eax, byte [rcx + rax]
cmp eax, 0xcc
je 0x18083ae35
xor eax, eax
jmp 0x18083ae82
mov dword [rbp + 4], 1
jmp 0x18083ae46
mov eax, dword [rbp + 4]
inc eax
mov dword [rbp + 4], eax
mov eax, dword [rbp + 0x108]
cmp dword [rbp + 4], eax
jae 0x18083ae7d
mov eax, dword [rbp + 4]
mov rcx, qword [rbp + 0x100]
movzx eax, byte [rcx + rax]
mov ecx, 1
imul rcx, rcx, 0
mov rdx, qword [rbp + 0x100]
movzx ecx, byte [rdx + rcx]
cmp eax, ecx
je 0x18083ae7b
xor eax, eax
jmp 0x18083ae82
jmp 0x18083ae3e
mov eax, 1
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140005940
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r8
mov rdi, rcx
mov rax, qword [rsp + 0xc0]
test rax, rax
je 0x1400059b5
cmp rax, 1
jne 0x1400059f2
test rsi, rsi
je 0x140005a37
js 0x140005b3f
mov r14, rdx
movzx ebp, byte [r9]
movzx eax, byte [0x1400cd141]
mov ebx, 1
mov edx, 1
mov rcx, rsi
call fcn.1400033f0
test rax, rax
je 0x140005b41
cmp rsi, 8
mov rcx, r14
jae 0x140005a5d
xor edx, edx
jmp 0x140005b10
test rsi, rsi
je 0x140005a41
js 0x140005b4c
mov r15, rdx
movzx eax, byte [0x1400cd141]
mov r14d, 1
mov edx, 1
mov rcx, rsi
call fcn.1400033f0
test rax, rax
je 0x140005b4f
mov rbx, rax
mov rdx, r15
jmp 0x140005a46
add rsi, rdx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140005db0
jmp 0x140005b2f
mov eax, 1
jmp 0x140005b24
mov ebx, 1
mov rcx, rbx
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rdi], rsi
mov qword [rdi + 8], rbx
jmp 0x140005b2b
movzx r8d, bpl
cmp rsi, 0x20
jae 0x140005a6b
xor edx, edx
jmp 0x140005ac6
movabs rdx, 0x7fffffffffffffe0
and rdx, rsi
movd xmm0, r8d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
xor r9d, r9d
nop
movdqu xmm1, xmmword [rcx + r9]
movdqu xmm2, xmmword [rcx + r9 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [rax + r9], xmm1
movdqu xmmword [rax + r9 + 0x10], xmm2
add r9, 0x20
cmp rdx, r9
jne 0x140005a90
cmp rdx, rsi
je 0x140005b24
test sil, 0x18
je 0x140005b10
mov r9, rdx
movabs rdx, 0x7ffffffffffffff8
and rdx, rsi
movd xmm0, r8d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
nop word cs:[rax + rax]
movq xmm1, qword [rcx + r9]
pxor xmm1, xmm0
movq qword [rax + r9], xmm1
add r9, 8
cmp rdx, r9
jne 0x140005af0
cmp rdx, rsi
je 0x140005b24
nop
movzx r8d, byte [rcx + rdx]
xor r8b, bpl
mov byte [rax + rdx], r8b
inc rdx
cmp rsi, rdx
jne 0x140005b10
mov qword [rdi], rsi
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rsi
mov rax, rdi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
xor ebx, ebx
mov rcx, rbx
mov rdx, rsi
call fcn.140028600
xor r14d, r14d
mov rcx, r14
mov rdx, rsi
call fcn.140028600
int3
Function at 0x140006460
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r8
mov rdi, rcx
mov rax, qword [rsp + 0xc0]
test rax, rax
je 0x1400064d5
cmp rax, 1
jne 0x140006512
test rsi, rsi
je 0x140006557
js 0x14000665f
mov r14, rdx
movzx ebp, byte [r9]
movzx eax, byte [0x1400cd141]
mov ebx, 1
mov edx, 1
mov rcx, rsi
call fcn.1400033f0
test rax, rax
je 0x140006661
cmp rsi, 8
mov rcx, r14
jae 0x14000657d
xor edx, edx
jmp 0x140006630
test rsi, rsi
je 0x140006561
js 0x14000666c
mov r15, rdx
movzx eax, byte [0x1400cd141]
mov r14d, 1
mov edx, 1
mov rcx, rsi
call fcn.1400033f0
test rax, rax
je 0x14000666f
mov rbx, rax
mov rdx, r15
jmp 0x140006566
add rsi, rdx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140006930
jmp 0x14000664f
mov eax, 1
jmp 0x140006644
mov ebx, 1
mov rcx, rbx
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rdi], rsi
mov qword [rdi + 8], rbx
jmp 0x14000664b
movzx r8d, bpl
cmp rsi, 0x20
jae 0x14000658b
xor edx, edx
jmp 0x1400065e6
movabs rdx, 0x7fffffffffffffe0
and rdx, rsi
movd xmm0, r8d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
xor r9d, r9d
nop
movdqu xmm1, xmmword [rcx + r9]
movdqu xmm2, xmmword [rcx + r9 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [rax + r9], xmm1
movdqu xmmword [rax + r9 + 0x10], xmm2
add r9, 0x20
cmp rdx, r9
jne 0x1400065b0
cmp rdx, rsi
je 0x140006644
test sil, 0x18
je 0x140006630
mov r9, rdx
movabs rdx, 0x7ffffffffffffff8
and rdx, rsi
movd xmm0, r8d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
nop word cs:[rax + rax]
movq xmm1, qword [rcx + r9]
pxor xmm1, xmm0
movq qword [rax + r9], xmm1
add r9, 8
cmp rdx, r9
jne 0x140006610
cmp rdx, rsi
je 0x140006644
nop
movzx r8d, byte [rcx + rdx]
xor r8b, bpl
mov byte [rax + rdx], r8b
inc rdx
cmp rsi, rdx
jne 0x140006630
mov qword [rdi], rsi
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rsi
mov rax, rdi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
xor ebx, ebx
mov rcx, rbx
mov rdx, rsi
call fcn.140028600
xor r14d, r14d
mov rcx, r14
mov rdx, rsi
call fcn.140028600
int3
Function at 0x14000bb80
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14000bbc2
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14000bbca
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14000bbdb
jmp 0x14000bbf2
xor r10d, r10d
jmp 0x14000bc7d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14000bbf2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14000bc09
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14000bc29
add r11, r8
jmp 0x14000bd5b
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14000bcf2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14000bca0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x14000bd10
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14000bd22
jmp 0x14000bd3d
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14000bd3d
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14000bd57
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000c070
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, r8
mov rdi, rcx
mov rax, qword [rsp + 0xc0]
test rax, rax
je 0x14000c0e5
cmp rax, 1
jne 0x14000c122
test rsi, rsi
je 0x14000c167
js 0x14000c26f
mov r14, rdx
movzx ebp, byte [r9]
movzx eax, byte [0x1400cd141]
mov ebx, 1
mov edx, 1
mov rcx, rsi
call fcn.1400033f0
test rax, rax
je 0x14000c271
cmp rsi, 8
mov rcx, r14
jae 0x14000c18d
xor edx, edx
jmp 0x14000c240
test rsi, rsi
je 0x14000c171
js 0x14000c27c
mov r15, rdx
movzx eax, byte [0x1400cd141]
mov r14d, 1
mov edx, 1
mov rcx, rsi
call fcn.1400033f0
test rax, rax
je 0x14000c27f
mov rbx, rax
mov rdx, r15
jmp 0x14000c176
add rsi, rdx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.14000b440
jmp 0x14000c25f
mov eax, 1
jmp 0x14000c254
mov ebx, 1
mov rcx, rbx
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rdi], rsi
mov qword [rdi + 8], rbx
jmp 0x14000c25b
movzx r8d, bpl
cmp rsi, 0x20
jae 0x14000c19b
xor edx, edx
jmp 0x14000c1f6
movabs rdx, 0x7fffffffffffffe0
and rdx, rsi
movd xmm0, r8d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
xor r9d, r9d
nop
movdqu xmm1, xmmword [rcx + r9]
movdqu xmm2, xmmword [rcx + r9 + 0x10]
pxor xmm1, xmm0
pxor xmm2, xmm0
movdqu xmmword [rax + r9], xmm1
movdqu xmmword [rax + r9 + 0x10], xmm2
add r9, 0x20
cmp rdx, r9
jne 0x14000c1c0
cmp rdx, rsi
je 0x14000c254
test sil, 0x18
je 0x14000c240
mov r9, rdx
movabs rdx, 0x7ffffffffffffff8
and rdx, rsi
movd xmm0, r8d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
nop word cs:[rax + rax]
movq xmm1, qword [rcx + r9]
pxor xmm1, xmm0
movq qword [rax + r9], xmm1
add r9, 8
cmp rdx, r9
jne 0x14000c220
cmp rdx, rsi
je 0x14000c254
nop
movzx r8d, byte [rcx + rdx]
xor r8b, bpl
mov byte [rax + rdx], r8b
inc rdx
cmp rsi, rdx
jne 0x14000c240
mov qword [rdi], rsi
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rsi
mov rax, rdi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
xor ebx, ebx
mov rcx, rbx
mov rdx, rsi
call fcn.140028600
xor r14d, r14d
mov rcx, r14
mov rdx, rsi
call fcn.140028600
int3