joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400233e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx]
lea rdi, [rcx + 0x3c]
mov esi, 0x7fff
mov r14, rcx
mov r8d, esi
mov rdx, rdi
mov rax, qword [rax]
mov r9, qword [rax + 0x68]
lea rax, [r8 + 0x7fff7fff]
test rax, rax
je 0x14002343a
movzx eax, word [r9]
test ax, ax
je 0x14002343a
mov word [rdx], ax
add r9, 2
add rdx, 2
sub r8, 1
jne 0x140023414
test r8, r8
lea rax, [rdx - 2]
cmovne rax, rdx
xor r15d, r15d
mov word [rax], r15w
test rdi, rdi
je 0x140023476
mov rdx, rsi
mov rax, rdi
cmp word [rax], r15w
je 0x140023467
add rax, 2
sub rdx, 1
jne 0x140023457
mov eax, esi
mov ecx, r15d
sub eax, edx
test rdx, rdx
cmovne ecx, eax
jne 0x140023479
mov ecx, r15d
movsxd rax, ecx
test ecx, ecx
jle 0x140023491
cmp word [rdi + rax*2], 0x5c
je 0x140023491
dec ecx
dec rax
test rax, rax
jg 0x140023480
lea eax, [rcx + 1]
test ecx, ecx
mov r8d, esi
mov rdx, rdi
cmove eax, ecx
mov rcx, rdi
cdqe
mov word [rdi + rax*2], r15w
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov rax, qword [r14]
mov ebp, 1
mov rbx, qword [rax]
cmp rbx, rax
je 0x1400234de
nop
mov rdx, qword [rbx + 0x68]
mov rcx, rdi
call fcn.14001e880
mov rbx, qword [rbx]
test eax, eax
cmove ebp, r15d
cmp rbx, qword [r14]
jne 0x1400234c0
test ebp, ebp
je 0x1400234f0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400234f0
test al, 0x10
jne 0x140023531
lea rcx, [0x140058480]
sub rcx, rdi
nop word [rax + rax]
lea rax, [rsi + 0x7fff7fff]
test rax, rax
je 0x140023522
movzx eax, word [rcx + rdi]
test ax, ax
je 0x140023522
mov word [rdi], ax
add rdi, 2
sub rsi, 1
jne 0x140023500
test rsi, rsi
lea rax, [rdi - 2]
cmovne rax, rdi
mov word [rax], r15w
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x140023550
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1400235c5
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400235c5
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400235b5
nop
cmp rbx, rcx
jae 0x1400235c5
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1400235a0
cmp rbx, rcx
jae 0x1400235c5
cmp word [rbx], 0
je 0x1400235c5
mov rax, rbx
jmp 0x1400235c7
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140024dd0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
cmp dword [0x1400815f4], 0
mov rbx, rcx
je 0x140024e42
mov eax, dword [0x140081804]
test eax, eax
je 0x140024e06
cmp eax, 2
je 0x140024df6
xor r8d, r8d
jmp 0x140024e14
mov dword [rsp + 0x48], 0xbfbbef
mov r8d, 3
jmp 0x140024e14
mov dword [rsp + 0x48], 0xfeff
mov r8d, 2
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], 0
lea rdx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140024e42
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x30
pop rbx
ret
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x1400250f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
mov eax, 0x281a0
call fcn.1400417b0
sub rsp, rax
mov rax, qword [0x1400681b8]
xor rax, rsp
mov qword [rsp + 0x28190], rax
mov rbp, rcx
lea rsi, [rsp + 0x180c0]
lea rcx, [rsp + 0x80c0]
mov edi, r9d
mov rbx, r8
call fcn.140022f90
test eax, eax
mov eax, dword [0x1400815f0]
jne 0x140025165
test eax, eax
je 0x140025165
mov r9d, 0x2f
lea rcx, [rsp + 0x80c0]
mov edx, 0x7fff
lea r8d, [r9 + 0x2d]
call fcn.14001ee20
mov eax, dword [0x1400815f0]
lea rdx, [0x140058800]
lea rcx, [0x140058804]
test edi, edi
je 0x140025181
lea r9, [rsp + 0x80c0]
jmp 0x14002518c
mov r9, rbx
lea rbx, [rsp + 0x80c0]
test eax, eax
lea r8, [0x1400588f0]
lea rax, str._s__s_s
cmovne rcx, rdx
test edi, edi
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x180c0]
mov qword [rsp + 0x20], rbx
cmove r8, rax
mov ebx, 0x8063
mov edx, ebx
call fcn.14000a100
mov edx, 0x4031
lea rax, [rsp + 0x180c0]
mov ecx, edx
cmp word [rax], 0
je 0x1400251e3
add rax, 2
sub rcx, 1
jne 0x1400251d3
sub rdx, rcx
xor edi, edi
test rcx, rcx
mov r8d, edi
cmovne r8, rdx
je 0x1400251f9
add r8, r8
jmp 0x1400251fc
mov r8, rdi
cmp dword [0x1400815f4], edi
jne 0x140025266
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x180c0]
mov dword [rsp + 0x28], 0x1fffc
mov r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x140025247
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1400252fd
mov rcx, rbx
lea rax, [rsp + 0x50]
nop
cmp byte [rax], dil
je 0x14002525e
inc rax
sub rcx, 1
jne 0x140025250
sub rbx, rcx
test rcx, rcx
jmp 0x1400252ca
mov eax, dword [0x140081804]
dec eax
cmp eax, 1
ja 0x1400252dd
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x180c0]
mov dword [rsp + 0x28], 0x1fffc
mov r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x14002523c
mov rdx, rbx
lea rax, [rsp + 0x50]
cmp byte [rax], dil
je 0x1400252c4
inc rax
sub rdx, 1
jne 0x1400252b6
sub rbx, rdx
test rdx, rdx
mov rax, rdi
lea rsi, [rsp + 0x50]
cmovne rax, rbx
mov r8, rdi
cmovne r8, rax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rdi
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14002523c
xor eax, eax
mov rcx, qword [rsp + 0x28190]
xor rcx, rsp
call fcn.140041820
mov rbx, qword [rsp + 0x281d8]
add rsp, 0x281a0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140025320
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x181a0
call fcn.1400417b0
sub rsp, rax
mov rax, qword [0x1400681b8]
xor rax, rsp
mov qword [rsp + 0x18190], rax
cmp dword [0x1400815f0], 0
lea rax, [0x140058800]
mov rsi, rcx
lea r9, [0x140058804]
cmovne r9, rax
lea r8, str.__Generated_by_WIN_SFV32_v1__compatible__RapidCRC_http:__rapidcrc.sourceforge.net_unicode_file_mod_by_OV2__s__s
mov ebx, 0x8063
mov qword [rsp + 0x20], r9
mov edx, ebx
lea rcx, [rsp + 0x80c0]
lea rdi, [rsp + 0x80c0]
call fcn.140024d10
mov edx, 0x4031
lea rax, [rsp + 0x80c0]
mov ecx, edx
nop dword [rax]
cmp word [rax], 0
je 0x1400253b0
add rax, 2
sub rcx, 1
jne 0x1400253a0
sub rdx, rcx
xor eax, eax
test rcx, rcx
cmovne rax, rdx
je 0x1400253c4
lea rcx, [rax + rax]
jmp 0x1400253c6
xor ecx, ecx
cmp dword [0x1400815f4], 0
je 0x1400253dc
mov eax, dword [0x140081804]
dec eax
cmp eax, 1
ja 0x140025458
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], 0
lea r8, [rsp + 0x80c0]
mov dword [rsp + 0x28], 0x1fffc
mov r9d, 0xffffffff
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x140025424
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14002547b
mov rdx, rbx
lea rax, [rsp + 0x50]
nop dword [rax]
cmp byte [rax], 0
je 0x14002543e
inc rax
sub rdx, 1
jne 0x140025430
sub rbx, rdx
lea rdi, [rsp + 0x50]
xor eax, eax
test rdx, rdx
cmovne rax, rbx
xor ecx, ecx
test rdx, rdx
cmovne rcx, rax
mov r8d, ecx
mov qword [rsp + 0x20], 0
mov rcx, rsi
lea r9, [rsp + 0x40]
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14002541c
xor eax, eax
mov rcx, qword [rsp + 0x18190]
xor rcx, rsp
call fcn.140041820
lea r11, [rsp + 0x181a0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14002be80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor eax, eax
mov qword [rsp + 0x10], rbx
mov ebx, r8d
mov r10, rdx
mov r11, rcx
cmp r8d, 8
jb 0x14002bf24
mov qword [rsp], rdi
mov edi, 2
nop word [rax + rax]
mov r8, qword [r10 + rax*8]
lea ecx, [rdi - 1]
xor qword [r11 + rax*8], r8
add eax, 8
mov edx, ecx
mov rcx, qword [r10 + rcx*8]
xor qword [r11 + rdx*8], rcx
mov ecx, edi
lea rdx, [r11 + rcx*8]
mov rcx, qword [r10 + rcx*8]
xor qword [rdx], rcx
lea ecx, [rdi + 1]
mov edx, ecx
mov rcx, qword [r10 + rcx*8]
xor qword [r11 + rdx*8], rcx
lea ecx, [rdi + 2]
mov edx, ecx
mov rcx, qword [r10 + rcx*8]
xor qword [r11 + rdx*8], rcx
lea ecx, [rdi + 3]
mov edx, ecx
mov rcx, qword [r10 + rcx*8]
xor qword [r11 + rdx*8], rcx
lea ecx, [rdi + 4]
mov edx, ecx
mov rcx, qword [r10 + rcx*8]
xor qword [r11 + rdx*8], rcx
lea ecx, [rdi + 5]
mov edx, ecx
add edi, 8
mov rcx, qword [r10 + rcx*8]
xor qword [r11 + rdx*8], rcx
lea ecx, [rdi + 6]
cmp ecx, ebx
jbe 0x14002beb0
mov rdi, qword [rsp]
lea ecx, [rax + 4]
cmp ecx, ebx
ja 0x14002bf71
lea r8d, [rax + 2]
nop
mov rcx, qword [r10 + rax*8]
lea rdx, [r11 + rax*8]
xor qword [rdx], rcx
add eax, 4
lea ecx, [r8 - 1]
mov edx, ecx
mov rcx, qword [r10 + rcx*8]
xor qword [r11 + rdx*8], rcx
lea rdx, [r11 + r8*8]
mov rcx, qword [r10 + r8*8]
xor qword [rdx], rcx
lea ecx, [r8 + 1]
mov edx, ecx
lea r8d, [r8 + 4]
mov rcx, qword [r10 + rcx*8]
xor qword [r11 + rdx*8], rcx
lea ecx, [r8 + 2]
cmp ecx, ebx
jbe 0x14002bf30
lea r8d, [rax + 2]
cmp r8d, ebx
ja 0x14002bfa5
nop word [rax + rax]
mov rcx, qword [r10 + rax*8]
lea rdx, [r11 + rax*8]
xor qword [rdx], rcx
add eax, 2
lea ecx, [r8 - 1]
add r8d, 2
mov edx, ecx
mov rcx, qword [r10 + rcx*8]
xor qword [r11 + rdx*8], rcx
cmp r8d, ebx
jbe 0x14002bf80
cmp eax, ebx
mov rbx, qword [rsp + 0x10]
jae 0x14002bfb8
mov ecx, eax
mov rax, qword [r10 + rax*8]
xor qword [r11 + rcx*8], rax
add rsp, 8
ret

Function at 0x140033750
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, rdx
mov ecx, 0x10
call fcn.140040dc4
lea rcx, [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x140033820]
xor ecx, ecx
mov dword [rsp + 0x20], 0
xor edx, edx
mov qword [rax], rbx
mov qword [rax + 8], rdi
call fcn.140048cf8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1400337b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rsi, r8
mov ecx, 0x18
mov rdi, rdx
call fcn.140040dc4
lea rcx, [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea r8, [0x140034400]
xor ecx, ecx
mov dword [rsp + 0x20], 0
xor edx, edx
mov qword [rax], rbx
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rsi
call fcn.140048cf8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140034c10
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov edx, 1
mov qword [0x1400813c0], rcx
mov ebx, r9d
lea ecx, [rdx + 4]
call fcn.14001e1b0
xor edx, edx
mov dword [0x1400813c8], eax
lea ecx, [rdx + 6]
call fcn.14001e1b0
lea rcx, [0x140083368]
mov dword [0x1400813cc], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r8, str.LocalRapidCRCUMutex
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rsi, rax
test rax, rax
je 0x140034cc5
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.14001e960
lea rcx, [rsp + 0x60]
call fcn.1400346b0
mov rdi, rax
test rax, rax
je 0x140034cc5
call fcn.14001a980
mov ecx, ebx
call fcn.140019e50
mov rbx, rax
test rax, rax
jne 0x140034cd7
lea r9d, [rax + 0x10]
xor ecx, ecx
lea r8, str.Error
lea rdx, str.Program_uses_Unicode_and_requires_Windows_NT_or_higher
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
xor r9d, r9d
mov rcx, rbx
cmp dword [rsp + 0x60], r9d
je 0x140034d0a
mov r8d, dword [rdi + 0x30]
mov edx, 0x408
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, rdi
call fcn.140034640
mov edx, 0x10040
mov rcx, rdi
call fcn.140040e00
jmp 0x140034d18
mov r8, rdi
mov edx, 0x409
call qword [sym.imp.USER32.dll_PostMessageW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140034d7f
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x140034d68
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rsp + 0x20]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x140034d40
lea rcx, [0x140083368]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [rsp + 0x30]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x1400495dc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140049340
Function at 0x1400013b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
mov ecx, 0x18
call fcn.14000fb9c
xor esi, esi
mov rbx, rax
mov qword [rax], rsi
lea ecx, [rsi + 5]
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
call fcn.14000fb9c
mov qword [rbx], rax
lea r9d, [rsi + 2]
mov r11d, 1
lea r8, [rdi + 2]
mov r14d, r9d
lea r12, [0x140049420]
lea rcx, [rax + 5]
mov r10, rdi
mov qword [rbx + 0x10], rcx
sub r11, rdi
xor ecx, ecx
sub r14, rdi
mov dword [rax], ecx
mov r15, 0xfffffffffffffffe
mov byte [rax + 4], cl
not r10
add rax, 5
movabs rbp, 0x91f5bcb8bb02d9cd
mov qword [rbx + 8], rax
sub r15, rdi
nop word [rax + rax]
lea rcx, [r15 + r8]
mov rax, rbp
mul rsi
shr rdx, 8
imul rax, rdx, 0x1c1
movzx edx, byte [r8 - 2]
sub rsi, rax
mov rax, qword [rbx]
xor dl, byte [rsi + r12]
mov byte [rcx + rax], dl
mov rax, rbp
movsxd rcx, r9d
dec rcx
mul rcx
shr rdx, 8
imul rax, rdx, 0x1c1
movzx edx, byte [r8 - 1]
sub rcx, rax
mov rax, qword [rbx]
xor dl, byte [rcx + r12]
lea rcx, [r10 + r8]
mov byte [rcx + rax], dl
mov rax, rbp
movsxd rcx, r9d
mul rcx
shr rdx, 8
imul rax, rdx, 0x1c1
movzx edx, byte [r8]
sub rcx, rax
mov rax, qword [rbx]
xor dl, byte [rcx + r12]
mov rcx, r8
sub rcx, rdi
mov byte [rcx + rax], dl
mov rax, rbp
movsxd rcx, r9d
inc rcx
mul rcx
shr rdx, 8
imul rax, rdx, 0x1c1
movzx edx, byte [r8 + 1]
sub rcx, rax
mov rax, qword [rbx]
xor dl, byte [rcx + r12]
lea rcx, [r11 + r8]
mov byte [rcx + rax], dl
mov rax, rbp
movsxd rcx, r9d
add r9d, 5
add rcx, 2
mul rcx
shr rdx, 8
imul rax, rdx, 0x1c1
movzx edx, byte [r8 + 2]
sub rcx, rax
mov rax, qword [rbx]
xor dl, byte [rcx + r12]
lea rcx, [r14 + r8]
mov byte [rcx + rax], dl
add r8, 5
lea eax, [r9 - 2]
movsxd rsi, eax
cmp rsi, 5
jb 0x140001450
mov rbp, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x140001570
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000fb9c
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 4]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000fb9c
mov qword [rbx], rax
lea r10, [0x140049420]
mov r8d, edi
movabs r9, 0x91f5bcb8bb02d9cd
lea rcx, [rax + 4]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov dword [rax], ecx
add rax, 4
mov qword [rbx + 8], rax
nop
mov rax, r9
lea r8, [r8 + 4]
mul rcx
shr rdx, 8
imul rax, rdx, 0x1c1
sub rcx, rax
movzx eax, byte [r8 + rsi - 4]
xor al, byte [rcx + r10]
movsx ecx, al
mov rax, qword [rbx]
mov word [r8 + rax - 4], cx
mov rax, r9
movsxd rcx, edi
add edi, 2
inc rcx
mul rcx
shr rdx, 8
imul rax, rdx, 0x1c1
sub rcx, rax
movzx eax, byte [r8 + rsi - 2]
xor al, byte [rcx + r10]
movsx ecx, al
mov rax, qword [rbx]
mov word [r8 + rax - 2], cx
movsxd rcx, edi
cmp rcx, 2
jb 0x1400015d0
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140001c30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000fb9c
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 2]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000fb9c
mov qword [rbx], rax
lea r11, [0x140049420]
mov r9d, edi
mov r8d, edi
movabs r10, 0x91f5bcb8bb02d9cd
lea rcx, [rax + 2]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov word [rax], cx
add rax, 2
mov qword [rbx + 8], rax
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r9 + rsi]
lea r9, [r9 + 2]
mov rax, r10
mul r8
shr rdx, 8
imul rax, rdx, 0x1c1
sub r8, rax
mov rax, qword [rbx]
xor cl, byte [r8 + r11]
mov byte [r9 + rax - 2], cl
mov rax, r10
movzx ecx, byte [r9 + rsi - 1]
movsxd r8, edi
add edi, 2
inc r8
mul r8
shr rdx, 8
imul rax, rdx, 0x1c1
sub r8, rax
mov rax, qword [rbx]
xor cl, byte [r8 + r11]
movsxd r8, edi
mov byte [rax + r9 - 1], cl
cmp r8, 2
jb 0x140001ca0
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140002930
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000fb9c
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 8]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000fb9c
mov qword [rbx], rax
lea r9, [rsi + 4]
mov r10d, 2
lea r15, [0x1400495f0]
mov r11d, r10d
mov r14, 0xfffffffffffffffc
lea rcx, [rax + 8]
sub r11, rsi
mov qword [rbx + 0x10], rcx
movabs rbp, 0x91f5bcb8bb02d9cd
xor ecx, ecx
mov qword [rax], rcx
add rax, 8
mov qword [rbx + 8], rax
sub r14, rsi
lea r8, [r14 + r9]
mov rax, rbp
mul rdi
shr rdx, 8
imul rax, rdx, 0x1c1
sub rdi, rax
movzx eax, byte [r9 - 4]
xor al, byte [rdi + r15]
movsx ecx, al
mov rax, qword [rbx]
mov word [r8 + rax], cx
mov rax, rbp
movsxd rcx, r10d
dec rcx
mul rcx
shr rdx, 8
imul rax, rdx, 0x1c1
sub rcx, rax
movzx eax, byte [r9 - 2]
xor al, byte [rcx + r15]
movsx ecx, al
mov rax, qword [rbx]
mov word [r8 + rax + 2], cx
mov rax, rbp
movsxd rcx, r10d
mul rcx
shr rdx, 8
imul rax, rdx, 0x1c1
sub rcx, rax
movzx eax, byte [r9]
xor al, byte [rcx + r15]
mov rcx, r9
movsx edx, al
sub rcx, rsi
mov rax, qword [rbx]
mov word [rcx + rax], dx
mov rax, rbp
movsxd rcx, r10d
add r10d, 4
inc rcx
mul rcx
shr rdx, 8
imul rax, rdx, 0x1c1
sub rcx, rax
movzx eax, byte [r9 + 2]
xor al, byte [rcx + r15]
lea rcx, [r11 + r9]
movsx edx, al
add r9, 8
mov rax, qword [rbx]
mov word [rcx + rax], dx
lea eax, [r10 - 2]
movsxd rdi, eax
cmp rdi, 4
jb 0x1400029b0
mov rbp, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140004100
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
mov ecx, 0x18
call fcn.14000fb9c
xor esi, esi
mov rbx, rax
mov qword [rax], rsi
lea ecx, [rsi + 0x10]
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
call fcn.14000fb9c
mov qword [rbx], rax
lea r8, [rdi + 4]
xorps xmm0, xmm0
mov r9d, 2
mov r10, 0xfffffffffffffffe
mov r11d, r9d
lea rcx, [rax + 0x10]
mov r14d, 4
mov qword [rbx + 0x10], rcx
mov r15d, 6
movups xmmword [rax], xmm0
add rax, 0x10
lea rcx, [0x1400497c0]
mov r12d, 8
mov qword [rbx + 8], rax
mov ebp, 0xa
sub r10, rdi
sub r11, rdi
sub r14, rdi
sub r15, rdi
sub r12, rdi
sub rbp, rdi
mov r13, 0xfffffffffffffffc
movabs rax, 0x91f5bcb8bb02d9cd
sub r13, rdi
mul rsi
shr rdx, 8
imul rax, rdx, 0x1c1
sub rsi, rax
movzx eax, byte [r8 - 4]
xor al, byte [rsi + rcx]
movabs rsi, 0x91f5bcb8bb02d9cd
mov rcx, qword [rbx]
movsx edx, al
add rcx, r13
mov rax, rsi
mov word [rcx + r8], dx
movsxd rcx, r9d
dec rcx
mul rcx
shr rdx, 8
imul rax, rdx, 0x1c1
lea rdx, [0x1400497c0]
sub rcx, rax
movzx eax, byte [r8 - 2]
xor al, byte [rcx + rdx]
mov rcx, qword [rbx]
movsx edx, al
add rcx, r10
mov rax, rsi
mov word [rcx + r8], dx
movsxd rcx, r9d
mul rcx
shr rdx, 8
imul rax, rdx, 0x1c1
lea rdx, [0x1400497c0]
sub rcx, rax
movzx eax, byte [r8]
xor al, byte [rcx + rdx]
movsx ecx, al
mov rax, qword [rbx]
sub rax, rdi
mov word [rax + r8], cx
mov rax, rsi
movsxd rcx, r9d
inc rcx
mul rcx
shr rdx, 8
imul rax, rdx, 0x1c1
lea rdx, [0x1400497c0]
sub rcx, rax
movzx eax, byte [r8 + 2]
xor al, byte [rcx + rdx]
mov rcx, qword [rbx]
add rcx, r11
movsx edx, al
mov rax, rsi
mov word [rcx + r8], dx
movsxd rcx, r9d
add rcx, 2
mul rcx
shr rdx, 8
imul rax, rdx, 0x1c1
lea rdx, [0x1400497c0]
sub rcx, rax
movzx eax, byte [r8 + 4]
xor al, byte [rcx + rdx]
mov rcx, qword [rbx]
add rcx, r14
movsx edx, al
mov rax, rsi
mov word [rcx + r8], dx
movsxd rcx, r9d
add rcx, 3
mul rcx
shr rdx, 8
imul rax, rdx, 0x1c1
lea rdx, [0x1400497c0]
sub rcx, rax
movzx eax, byte [r8 + 6]
xor al, byte [rcx + rdx]
mov rcx, qword [rbx]
add rcx, r15
movsx edx, al
mov word [rcx + r8], dx
movsxd rcx, r9d
add rcx, 4
lea r8, [r8 + 0x10]
mov rax, rsi
mul rcx
shr rdx, 8
imul rax, rdx, 0x1c1
lea rdx, [0x1400497c0]
sub rcx, rax
movzx eax, byte [r8 - 8]
xor al, byte [rcx + rdx]
mov rcx, qword [rbx]
add rcx, r12
movsx edx, al
mov rax, rsi
mov word [rcx + r8 - 0x10], dx
movsxd rcx, r9d
add r9d, 8
add rcx, 5
mul rcx
shr rdx, 8
imul rax, rdx, 0x1c1
lea rdx, [0x1400497c0]
sub rcx, rax
movzx eax, byte [r8 - 6]
xor al, byte [rcx + rdx]
mov rcx, qword [rbx]
add rcx, rbp
movsx edx, al
lea eax, [r9 - 2]
movsxd rsi, eax
movabs rax, 0x91f5bcb8bb02d9cd
mov word [rcx + r8 - 0x10], dx
lea rcx, [0x1400497c0]
cmp rsi, 8
jb 0x1400041b2
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret