joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff6989cdee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x7ff698a89560]
mov r9, qword [rax + 0x2178]
mov r10, qword [rax + 0x1d18]
movsxd rax, dword [r9 + 0x74]
movups xmm0, xmmword [r9 + 0x18c]
movss xmm4, dword [r9 + 0x18c]
movss xmm3, dword [r9 + 0x190]
movss xmm2, dword [r9 + 0x194]
movss xmm1, dword [r9 + 0x198]
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
imul r8, rax, 0x68
mov rax, qword [r10 + 0x2f8]
add r8, qword [r9 + 0x10]
movups xmmword [r10 + 0x290], xmm0
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x2f8]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
movzx r8d, byte [r8 + 0x57]
lea rcx, [r9 + 0x1e8]
mov rdx, qword [r10 + 0x2f8]
add rsp, 0x38
jmp fcn.7ff6989c1150

Function at 0x7ff6989cdfb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x7ff698a89560]
mov r9, qword [rax + 0x2178]
mov r10, qword [rax + 0x1d18]
movups xmm0, xmmword [r10 + 0x290]
movups xmmword [r9 + 0x18c], xmm0
mov rax, qword [r10 + 0x2f8]
movups xmm0, xmmword [r9 + 0x14c]
movss xmm4, dword [r9 + 0x14c]
movss xmm3, dword [r9 + 0x150]
movss xmm2, dword [r9 + 0x154]
movss xmm1, dword [r9 + 0x158]
movups xmmword [r10 + 0x290], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x2f8]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
movzx r8d, byte [r9 + 0x247]
lea rcx, [r9 + 0x1e8]
mov rdx, qword [r10 + 0x2f8]
add rsp, 0x38
jmp fcn.7ff6989c1150
Function at 0x7ff6989d09e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x7ff698a89018]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x7ff6989d0a26
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x7ff6989d0a16
cmp byte [rax], cl
jne 0x7ff6989d0a26
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x7ff6989d0a07
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x7ff6989d0b8a
cmp byte [r8 + 1], dl
je 0x7ff6989d0b8a
lea r11, [rsp + 0x20]
mov r9, r8
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x7ff6989d0a62
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x7ff6989d0a8a
sub dl, 0x61
cmp dl, 0x19
ja 0x7ff6989d0a7c
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x7ff6989d0a8a
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x7ff6989d0a45
jmp 0x7ff6989d0a8d
inc r9
cmp r8, r9
jae 0x7ff6989d0abf
movabs rdx, 0x800000000000009
nop dword [rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x7ff6989d0ab4
bt rdx, rax
jb 0x7ff6989d0aba
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x7ff6989d0aa0
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.7ff6989a6660
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x7ff6989d0af8
nop
inc rcx
cmp byte [rcx], 0x20
je 0x7ff6989d0af0
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x7ff6989d0b78
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x7ff6989d0b13
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x7ff6989d0b29
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x7ff6989d0b66
movss xmm2, dword [0x7ff698a61c7c]
cmp al, 0x39
ja 0x7ff6989d0b66
movzx eax, al
inc rcx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x7ff6989d0b40
cmp r9b, 0x2d
jne 0x7ff6989d0b85
xorps xmm1, xmmword [0x7ff698a61d00]
movaps xmm0, xmm1
jmp 0x7ff6989d0b8d
call qword [sym.imp.ucrtbase.dll_atof]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x7ff6989d0b8d
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.7ff698a5be00
add rsp, 0x90
pop rbx
ret
Function at 0x7ff6989d0bb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x7ff698a89018]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r8, rcx
mov ebx, edx
movzx ecx, byte [rcx]
test cl, cl
je 0x7ff6989d0bf6
lea rax, [r8 + 1]
cmp cl, 0x25
jne 0x7ff6989d0be6
cmp byte [rax], cl
jne 0x7ff6989d0bf6
cmp cl, cl
cmovne rax, r8
movzx ecx, byte [rax + 1]
lea r8, [rax + 1]
test cl, cl
jne 0x7ff6989d0bd7
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x7ff6989d0d54
cmp byte [r8 + 1], dl
je 0x7ff6989d0d54
lea r11, [rsp + 0x20]
mov r9, r8
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x7ff6989d0c32
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x7ff6989d0c5a
sub dl, 0x61
cmp dl, 0x19
ja 0x7ff6989d0c4c
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x7ff6989d0c5a
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x7ff6989d0c15
jmp 0x7ff6989d0c5d
inc r9
cmp r8, r9
jae 0x7ff6989d0c8f
movabs rdx, 0x800000000000009
nop dword [rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x7ff6989d0c84
bt rdx, rax
jb 0x7ff6989d0c8a
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x7ff6989d0c70
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.7ff6989a6660
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x7ff6989d0cc8
nop dword [rax + rax]
inc rcx
cmp byte [rcx], 0x20
je 0x7ff6989d0cc0
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x7ff6989d0d46
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x7ff6989d0ce3
movzx r8d, byte [rcx + 1]
lea rdx, [rcx + 1]
movzx eax, r8b
cmovne rdx, rcx
cmp r8b, 0x2b
jne 0x7ff6989d0cf9
movzx eax, byte [rdx + 1]
lea rcx, [rdx + 1]
xorps xmm1, xmm1
cmovne rcx, rdx
cmp al, 0x30
jl 0x7ff6989d0d34
movsd xmm2, qword [0x7ff698a660e0]
cmp al, 0x39
ja 0x7ff6989d0d34
movzx eax, al
inc rcx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rcx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x7ff6989d0d10
cmp r9b, 0x2d
jne 0x7ff6989d0d4f
xorps xmm1, xmmword [0x7ff698a66180]
movaps xmm0, xmm1
jmp 0x7ff6989d0d57
call qword [sym.imp.ucrtbase.dll_atof]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x7ff6989d0d57
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.7ff698a5be00
add rsp, 0x90
pop rbx
ret
Function at 0x7ff6989ecf20
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x98
movaps xmmword [rsp + 0x80], xmm6
mov rax, qword [0x7ff698a89018]
xor rax, rsp
mov qword [rsp + 0x78], rax
xorps xmm6, xmm6
mov rbp, rdx
cvtss2sd xmm6, xmm2
mov rsi, rcx
mov rdi, r9
lea rcx, [0x7ff698a65c94]
movaps xmm1, xmm6
movq rdx, xmm6
call fcn.7ff6989f7520
movsxd rbx, eax
lea rcx, [rsp + 0x38]
mov rdx, rbx
xor r8d, r8d
call fcn.7ff6989e98a0
cmp qword [rsp + 0x50], 0x10
lea rcx, [rsp + 0x38]
lea rdx, [rbx + 1]
movaps xmm3, xmm6
cmovae rcx, qword [rsp + 0x38]
lea r8, [0x7ff698a65c94]
movq r9, xmm6
call fcn.7ff6989f7e40
cmp qword [rsp + 0x50], 0x10
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x58]
cmovae r8, qword [rsp + 0x38]
mov rdx, rbp
mov rcx, rsi
mov dword [rsp + 0x20], 0x20
call qword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x7ff6989ed012
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6989ed00d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff6989ed00d
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff698a5b9ac
lea rcx, [rsp + 0x58]
call qword [sym.imp.ucrtbase.dll_atof]
cvtsd2ss xmm0, xmm0
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.7ff698a5be00
movaps xmm6, xmmword [rsp + 0x80]
add rsp, 0x98
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x7ff6989f2820
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x7ff6989f2881
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x7ff6989f2840
mov ecx, dword [r9]
jmp 0x7ff6989f2968
cmp ecx, 0x4e0
jb 0x7ff6989f2968
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x7ff6989f28a0
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x7ff6989f28f0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
add rsp, 8
ret
Function at 0x7ff6989f29b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov ebp, r9d
mov r15, r8
mov r14, rdx
mov rsi, rcx
call fcn.7ff6989f2820
mov rdi, rax
add ebp, 0xffffffff
je 0x7ff6989f2b8a
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r12
xor r12d, r12d
nop word [rax + rax]
mov r9, qword [rsi]
shl rdi, 0x20
mov ecx, dword [r9]
cmp ecx, 0x270
jne 0x7ff6989f2a54
lea rax, [r9 + 8]
mov r10d, ecx
nop dword [rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r10, 1
jne 0x7ff6989f2a10
mov ecx, dword [r9]
jmp 0x7ff6989f2b33
cmp ecx, 0x4e0
jb 0x7ff6989f2b33
lea r10, [r9 + 0x9c4]
mov r11d, 0xe3
mov ebx, dword [r10]
mov eax, ebx
mov ebx, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, ebx
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub r11, 1
jne 0x7ff6989f2a70
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov ebx, dword [r10]
nop word [rax + rax]
mov eax, ebx
mov ebx, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, ebx
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub r11, 1
jne 0x7ff6989f2ac0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
mov ecx, r12d
mov dword [r9], r12d
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov ecx, edx
mov dword [r9], eax
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
xor rdx, rax
mov rcx, rdx
shr rcx, 0x12
xor rcx, rdx
or rdi, rcx
add ebp, 0xffffffff
jne 0x7ff6989f29f0
mov r12, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rax, r15
mul rdi
mov qword [r14], rax
mov rax, r14
mov qword [r14 + 8], rdx
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x7ff6989f5240
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1400
call fcn.7ff698a5be30
sub rsp, rax
mov rax, qword [0x7ff698a89018]
xor rax, rsp
mov qword [rsp + 0x13f0], rax
mov edi, edx
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
lea edx, [rbp + 0x40]
lea rcx, [rsp + 0x38]
call fcn.7ff6989f3780
mov rsi, rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], 0x3e
mov qword [rsp + 0x50], 0x3f
movups xmm0, xmmword [0x7ff698a674a8]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x7ff698a674b8]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x7ff698a674c8]
movups xmmword [rax + 0x20], xmm0
movsd xmm0, qword [0x7ff698a674d8]
movsd qword [rax + 0x30], xmm0
mov eax, dword [0x7ff698a674e0]
mov dword [rsi + 0x38], eax
movzx eax, word [0x7ff698a674e4]
mov word [rsi + 0x3c], ax
mov byte [rsi + 0x3e], bpl
call sub.msvcp140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov edx, eax
mov dword [rsp + 0x13e4], 0xffffffff
mov dword [rsp + 0x64], eax
lea eax, [rbp + 1]
nop dword [rax]
mov ecx, edx
shr ecx, 0x1e
xor ecx, edx
imul edx, ecx, 0x6c078965
add edx, eax
mov dword [rsp + rax*4 + 0x64], edx
inc rax
cmp rax, 0x270
jb 0x7ff6989f5310
mov dword [rsp + 0x60], 0x270
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov dword [rsp + 0x20], 1
test edi, edi
jle 0x7ff6989f53bf
nop word [rax + rax]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov edx, 0x3e
lea rcx, [rsp + 0x28]
call fcn.7ff6989eab50
movzx r9d, byte [rax + rsi]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x7ff6989f53aa
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x7ff6989f539f
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x7ff6989f53b9
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.7ff6989e8c00
sub rdi, 1
jne 0x7ff6989f5360
mov edx, 0x40
mov rcx, rsi
call fcn.7ff698a5b9ac
mov rax, rbx
mov rcx, qword [rsp + 0x13f0]
xor rcx, rsp
call fcn.7ff698a5be00
lea r11, [rsp + 0x1400]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x7ff6989f9170
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x7ff6989f91a4
mov eax, esi
lea ecx, [rax + 0xf]
xor byte [r8 + rax], cl
inc rax
cmp rax, 5
jb 0x7ff6989f9190
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x7ff6989f91d9
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.7ff6989f38e0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x7ff6989f91e7
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.7ff698a05810
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x7ff6989f925e
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6989f9259
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff6989f9259
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff698a5b9ac
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x7ff6989f9270
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x7ff6989f92a4
mov eax, esi
lea ecx, [rax + 0xf]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x7ff6989f9290
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x7ff6989f92d9
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.7ff6989f38e0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x7ff6989f92e7
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.7ff698a05810
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x7ff6989f935e
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6989f9359
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff6989f9359
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff698a5b9ac
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x7ff6989f9370
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 8], sil
je 0x7ff6989f93a4
mov eax, esi
lea ecx, [rax + 0xf]
xor byte [r8 + rax], cl
inc rax
cmp rax, 7
jb 0x7ff6989f9390
mov byte [r8 + 8], sil
lea rax, [r8 + 7]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x7ff6989f93d9
mov r8d, 7
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.7ff6989f38e0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x7ff6989f93e7
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.7ff698a05810
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x7ff6989f945e
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6989f9459
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff6989f9459
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff698a5b9ac
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x7ff6989f9470
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x7ff6989f94a4
mov eax, esi
lea ecx, [rax + 0xf]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x7ff6989f9490
mov byte [r8 + 9], sil
lea rax, [r8 + 8]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x7ff6989f94d9
mov r8d, 8
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.7ff6989f38e0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x7ff6989f94e7
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.7ff698a05810
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x7ff6989f955e
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6989f9559
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff6989f9559
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff698a5b9ac
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x7ff6989f9570
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x7ff6989f95a4
mov ecx, esi
lea eax, [rcx + 0xf]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x7ff6989f9590
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], 0xf
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x7ff6989f95d9
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.7ff6989f38e0
nop
cmp byte [rbx + 0xa], 0
je 0x7ff6989f9603
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0xf]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 9
jb 0x7ff6989f95f0
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x7ff6989f9638
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.7ff6989f38e0
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.7ff6989e95c0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x7ff6989f9691
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6989f968b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff6989f968b
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff698a5b9ac
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x7ff6989f96d1
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6989f96cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff6989f96cc
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff698a5b9ac
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x7ff6989f96e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x7ff6989f9714
mov eax, esi
lea ecx, [rax + 0xf]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x7ff6989f9700
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], 0xf
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x7ff6989f9749
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.7ff6989f38e0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x7ff6989f9757
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.7ff698a05810
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x7ff6989f97ce
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x7ff6989f97c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x7ff6989f97c9
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.7ff698a5b9ac
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret