joyce8/EMBER2024-capa huggingface dataset:
Function at 0x201946f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
lea rdi, [rcx + 0x10]
mov rcx, rdi
call fcn.20196570
mov rcx, qword [rsi]
mov r15, qword [rcx]
movzx eax, byte [0x204a2278]
movsxd rbx, dword [0x20376f10]
mov r14d, dword [0x20376ef8]
cmp r15, rcx
sete cl
or al, cl
test al, 1
je 0x201947b7
mov rcx, qword [rsi + 0xa8]
test rcx, rcx
je 0x20194771
lea rax, [rsi + 0x70]
cmp rcx, rax
setne dl
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x200fc05d.0]
mov qword [rsi + 0xa8], 0
lea rcx, [rsi + 0x40]
call fcn.200f2930
mov rcx, rdi
call fcn.20195d20
mov rax, qword [rsi]
mov r8, qword [rax + 8]
mov rcx, rsi
mov rdx, rsi
call fcn.20195260
mov rcx, qword [rsi]
mov edx, 0x30
mov r8d, 0x17f6bbd2
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
jmp fcn.200807c0
lea rax, [0x20376f10]
add rbx, rax
jmp 0x201947dc
mov rax, r15
nop word cs:[rax + rax]
mov r15, rax
cmp rax, qword [rsi]
je 0x20194743
mov rcx, qword [r15 + 0x28]
test rcx, rcx
je 0x201947f6
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [case.0x200fc05d.0]
mov rcx, qword [r15 + 0x10]
cmp byte [rcx + 0x19], 0
je 0x20194900
mov rax, qword [r15 + 8]
movzx r9d, byte [rax + 0x19]
mov edx, dword [0x2045c870]
lea ecx, [rdx + 1]
mov dword [0x2045c870], ecx
mov r8d, edx
not r8d
xor edx, ecx
not ecx
and ecx, r8d
or ecx, edx
xor ecx, 0xffffffff
mov edx, 0
mov r8d, 0
jne 0x20194880
mov edx, 0
mov r8d, 0
test r14d, r14d
jle 0x20194880
xor r10d, r10d
xor edx, edx
xor r8d, r8d
nop word cs:[rax + rax]
movsxd r11, r10d
add r11, rbx
xor rdx, qword [r11]
xor r8, qword [r11 + 8]
add r10d, 0x10
cmp r10d, r14d
jl 0x20194860
nop word cs:[rax + rax]
test r9b, r9b
jne 0x201947d0
mov r9, r15
mov r15, rax
cmp r9, qword [rax + 0x10]
jne 0x201947c3
mov rax, qword [r15 + 8]
movzx r9d, byte [rax + 0x19]
mov r11, qword [0x20376ef0]
xor r10d, r10d
test ecx, ecx
setne r10b
add r10, 0xffffffffffffffff
mov r12d, 0
adc r12, 0xffffffffffffffff
mov r13, qword [0x20376ee8]
sub r13, rdx
sbb r11, r8
xor r10, r13
xor r12, r11
not r12
not r10
and r10, r13
and r12, r11
or r12, r10
setne r10b
or r10b, byte [0x204a224b]
and r10b, 1
mov byte [0x204a224b], r10b
jmp 0x20194880
mov rax, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
sete r8b
movzx r9d, byte [0x204a224b]
mov edx, r9d
xor dl, r8b
test r9b, r8b
jne 0x20194900
test dl, dl
jne 0x20194900
jmp 0x201947d0
Function at 0x20194d60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
movsxd rbx, dword [0x20376f48]
mov edi, dword [0x20376ee0]
add rcx, 0x40
xorps xmm0, xmm0
movaps xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x28], rcx
call fcn.200f29d0
cmp byte [0x204a2278], 0
jne 0x20194f41
mov r14, qword [rsi]
mov r15, qword [r14]
cmp r15, r14
je 0x20194f41
lea rax, [0x20376f48]
add rbx, rax
mov eax, dword [0x204a23e8]
mov ecx, eax
not ecx
mov edx, ecx
neg edx
mov dword [0x204a23e8], edx
lea r12d, [rcx - 1]
xor eax, edx
and r12d, ecx
or r12d, eax
not r12d
mov r8d, edi
xor r13d, r13d
mov edi, 0
test r12d, r12d
jne 0x20194e3a
xor eax, eax
mov r13d, 0
mov edi, 0
test r8d, r8d
jle 0x20194e3a
xor r13d, r13d
xor edi, edi
nop dword [rax]
movsxd rcx, eax
mov rdx, qword [rbx + rcx]
mov rcx, qword [rbx + rcx + 8]
xor r13, rdx
xor rdi, rcx
add eax, 0x10
cmp eax, r8d
jl 0x20194e20
lea rbx, [rbp - 0x20]
jmp 0x20194e5c
mov rax, r15
nop word cs:[rax + rax]
mov r15, rax
cmp rax, r14
je 0x20194f41
movups xmm0, xmmword [r15 + 0x20]
movaps xmmword [rbp - 0x40], xmm0
mov rcx, qword [rbp - 0x38]
call fcn.20195db0
xor ecx, ecx
test r12d, r12d
setne cl
mov rdx, qword [0x20376f08]
add rcx, 0xffffffffffffffff
mov r8d, 0
adc r8, 0xffffffffffffffff
mov r9, qword [0x20376f00]
sub r9, r13
sbb rdx, rdi
mov r10, r9
not r10
mov r11, rdx
not r11
xor r9, rcx
not rcx
and rcx, r10
xor rdx, r8
not r8
and r8, r11
or r8, rdx
or rcx, r9
and rcx, r8
cmp rcx, 0xffffffffffffffff
setne cl
or cl, byte [0x204a2278]
and cl, 1
mov byte [0x204a2278], cl
test al, al
jne 0x20194f00
mov rdx, qword [rbp - 0x18]
cmp rdx, qword [rbp - 0x10]
je 0x20194ef1
mov rax, qword [rbp - 0x38]
mov qword [rdx], rax
add qword [rbp - 0x18], 8
jmp 0x20194f00
mov rcx, rbx
lea r8, [rbp - 0x38]
call fcn.201952c0
nop dword [rax]
mov rcx, qword [r15 + 0x10]
cmp byte [rcx + 0x19], 0
je 0x20194f30
nop word [rax + rax]
mov rax, qword [r15 + 8]
cmp byte [rax + 0x19], 0
jne 0x20194e50
mov rcx, r15
mov r15, rax
cmp rcx, qword [rax + 0x10]
je 0x20194f10
jmp 0x20194e40
mov rax, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x20194f30
jmp 0x20194e50
mov rcx, qword [rbp - 0x28]
call fcn.200f2a70
mov rdi, qword [rbp - 0x20]
mov rbx, qword [rbp - 0x18]
cmp rdi, rbx
je 0x20194f85
nop word [rax + rax]
mov rcx, qword [rsi + 0xa8]
test rcx, rcx
je 0x20194fd3
mov rdx, qword [rdi]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x200fc05d.0]
add rdi, 8
cmp rdi, rbx
jne 0x20194f60
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x20194fc1
mov rdx, qword [rbp - 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x20194fb6
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x20194fd8
add rdx, 0x27
mov rcx, rax
mov r8d, 0x17f6bbd2
call fcn.200807c0
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.2032da94
call fcn.2030c4cc
int3
Function at 0x201961b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
mov rbx, qword [rcx]
movsxd rax, dword [0x20377248]
mov ecx, dword [0x20377228]
cmp rbx, rdx
je 0x2019632f
test rbx, rbx
je 0x2019632f
lea rdx, [0x20377248]
add rax, rdx
mov r14d, dword [0x2045ca60]
lea r15d, [r14 - 0x2e3ee109]
add r15d, 0x2e3ee10a
mov dword [0x2045ca60], r15d
xor r14d, r15d
not r14d
xor r12d, r12d
mov r13d, 0
test r14d, r15d
jne 0x2019626a
xor edx, edx
mov r12d, 0
mov r13d, 0
test ecx, ecx
jle 0x2019626a
xor r12d, r12d
xor r13d, r13d
nop word [rax + rax]
movsxd r8, edx
add r8, rax
mov r9, qword [r8]
mov r8, qword [r8 + 8]
xor r12, r9
xor r13, r8
add edx, 0x10
cmp edx, ecx
jl 0x20196250
mov rcx, rbx
call fcn.20182cd0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x20196322
mov rdx, qword [rbx + 0x18]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x20196317
mov rax, qword [rcx - 8]
cmp byte [0x204a1e04], 0
jne 0x201962b1
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x20196343
mov rcx, rdx
xor rcx, 0x27
and edx, 0x27
lea rdx, [rcx + rdx*2]
mov r8, qword [0x20377238]
xor ecx, ecx
test r14d, r15d
setne cl
xor r9d, r9d
add rcx, 0xffffffffffffffff
adc r9, 0xffffffffffffffff
mov r10, qword [0x20377230]
sub r10, r12
sbb r8, r13
xor r9, r8
xor rcx, r10
not rcx
not r9
movzx r11d, byte [0x204a1e04]
and rcx, r10
and r9, r8
or r9, rcx
setne cl
or r11b, cl
and r11b, 1
mov byte [0x204a1e04], r11b
mov rcx, rax
mov r8d, 0x5f7fcac0
call fcn.200807c0
mov rcx, rbx
mov edx, 0xe68c159e
call fcn.200807d0
mov qword [rdi], rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.2030c4cc
int3

Function at 0x20196400
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
lea rsi, [rcx + 8]
mov rax, qword [0x2045cb08]
movsxd rbx, dword [rax]
add rbx, rax
neg rbx
mov rdi, rcx
mov r13d, dword [0x203772d8]
mov rcx, rsi
call fcn.200f2f20
mov r15d, dword [0x2045cb00]
lea r14d, [r15 + 1]
mov dword [0x2045cb00], r14d
xor r14d, r15d
not r14d
test r14d, r15d
jne 0x20196469
test r13d, r13d
jg 0x201964f9
xor r12d, r12d
test al, al
je 0x201964d2
mov byte [rdi + 0x2c], 0
lea rbx, [rdi + 0x20]
mov rcx, rbx
call fcn.20182750
mov rcx, rsi
mov edx, 0x3e8
call fcn.200f3860
movzx ecx, byte [0x203772d0]
and r14d, r15d
xor edx, edx
cmp r14d, 1
sbb edx, edx
sub cl, r12b
and cl, dl
setne cl
or cl, byte [0x204a1d01]
and cl, 1
mov byte [0x204a1d01], cl
test al, al
jne 0x201964c2
mov rcx, rsi
call fcn.200f2f40
mov rcx, rsi
call fcn.200f3030
mov rcx, rbx
call fcn.201826a0
add rdi, 0x20
mov rcx, rdi
call fcn.201826a0
lea rax, [0x2036fb60]
mov qword [rsi], rax
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
neg rbx
xor ecx, ecx
xor r12d, r12d
nop word cs:[rax + rax]
xor r12b, byte [rbx + rcx]
inc rcx
cmp ecx, r13d
jl 0x20196510
jmp 0x2019646c
Function at 0x201968d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r9
mov rdi, rcx
mov qword [rbp - 0x50], rdx
mov dword [rbp - 0x48], r8d
lea rdx, [rbp - 0x50]
mov r8d, 0xd9ab4414
call fcn.20196d10
movsxd r12, dword [0x203775cc]
mov r13d, dword [0x203775d4]
lea rax, [rdi + 0x38]
mov qword [rbp - 0x10], rax
lea rax, [0x20377558]
mov qword [rdi + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rdi + 0x60], xmm0
mov qword [rdi + 0x70], 0
mov qword [rbp - 8], rdi
lea rcx, [rdi + 0x78]
mov qword [rbp - 0x20], rcx
mov edx, 0x2710
call fcn.201945e0
mov rax, qword [rbp - 8]
lea rcx, [rax + 0x128]
mov qword [rbp - 0x18], rcx
call fcn.20198190
mov rcx, qword [rbp - 8]
call fcn.20196d60
mov rcx, qword [rbp - 8]
mov r15, qword [rbp + 0x70]
lea rax, [0x203775cc]
add r12, rax
mov edi, dword [0x2045cc90]
lea ebx, [rdi + 1]
mov dword [0x2045cc90], ebx
xor r14d, r14d
test edi, ebx
jne 0x201969cf
test r13d, r13d
jle 0x201969cf
xor eax, eax
xor r14d, r14d
nop word cs:[rax + rax]
movsxd rdx, eax
add rdx, r12
mov r8d, dword [rdx]
mov edx, r8d
xor edx, r8d
not edx
and r14d, edx
xor r14d, r8d
add eax, 4
cmp eax, r13d
jl 0x201969b0
mov r12, qword [0x204a23f0]
add r12, qword [rcx + 0x20]
sub r12, qword [rcx + 0x18]
call fcn.201970c0
mov r13d, dword [rax]
mov rcx, qword [rbp - 8]
call fcn.201970c0
shr r12, 3
imul ecx, r12d, 0xba2e8ba3
movzx eax, word [rax + 4]
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
mov dword [rbp - 0x30], r13d
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], ecx
mov dword [rbp - 0x24], 0
lea rdx, [rbp - 0x40]
mov rcx, qword [rbp - 0x10]
call fcn.20199690
mov qword [rsp + 0x20], rsi
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x10]
mov r9, qword [rbp - 8]
call fcn.20197c30
and edi, ebx
mov eax, dword [0x203775d0]
xor ecx, ecx
cmp edi, 1
sbb ecx, ecx
sub eax, r14d
and eax, ecx
add qword [0x204a23f0], rax
mov rax, qword [rbp - 8]
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x20197150
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
mov rax, qword [0x2045cce0]
movsxd rcx, dword [rax]
add rcx, rax
mov r8d, dword [0x203775f8]
movabs rax, 0x2e8ba2e8ba2e8ba
cmp rdx, rax
ja 0x20197329
mov r9, qword [rsi]
mov qword [rbp - 8], r9
mov rbx, qword [rsi + 8]
mov r13d, dword [0x2045ccd0]
lea r12d, [r13 - 0x26dcdb60]
add r12d, 0x26dcdb61
mov dword [0x2045ccd0], r12d
xor r12d, r13d
not r12d
test r12d, r13d
je 0x201971ce
xor r14d, r14d
jmp 0x201971f5
xor r9d, r9d
mov r14d, 0
test r8d, r8d
jle 0x201971f5
xor r14d, r14d
nop
movsxd r10, r9d
add r10, rcx
movzx r10d, byte [r10]
xor r14b, r10b
inc r9d
cmp r9d, r8d
jl 0x201971e0
imul r15, rdx, 0x58
mov rcx, qword [0x204a2190]
add rcx, r15
cmp rdx, 0x2e
jbe 0x2019723b
cmp rdx, rax
jae 0x20197329
add rcx, 0x27
mov edx, 0xfc2693ae
call fcn.200810a0
lea rcx, [rax + 0x27]
mov edi, ecx
not edi
xor rcx, 0xffffffffffffffe0
and edi, 0x1f
or rdi, rcx
not rdi
mov qword [rdi - 8], rax
jmp 0x20197251
test rdx, rdx
je 0x2019724f
mov edx, 0xfc2693ae
call fcn.200810a0
mov rdi, rax
jmp 0x20197251
xor edi, edi
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
cmp rcx, rax
je 0x2019729e
mov rdx, rdi
mov r8, qword [rcx + 0x50]
mov qword [rdx + 0x50], r8
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmm2, xmmword [rcx + 0x20]
movups xmm3, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm3
movups xmmword [rdx + 0x20], xmm2
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx], xmm0
add rdx, 0x58
add rcx, 0x58
cmp rcx, rax
jne 0x20197260
mov rcx, qword [rsi]
test rcx, rcx
je 0x20197303
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x201972f8
movzx eax, byte [0x203775e4]
and r12d, r13d
xor r8d, r8d
cmp r12d, 1
sbb r8d, r8d
sub al, r14b
test al, r8b
setne al
or al, byte [0x204a224b]
and al, 1
mov byte [0x204a224b], al
mov rax, qword [rcx - 8]
jne 0x201972f1
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x2019732e
add rdx, 0x27
mov rcx, rax
mov r8d, 0x75be7394
call fcn.200807c0
sub rbx, qword [rbp - 8]
add rbx, rdi
mov qword [rsi], rdi
mov qword [rsi + 8], rbx
add r15, rdi
mov qword [rsi + 0x10], r15
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.2006d860
call fcn.2030c4cc
int3
Function at 0x20197de0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rax, qword [rcx + 0x10]
mov r12, qword [0x2045ce28]
mov rsi, rcx
movsxd r14, dword [r12]
mov r15d, dword [0x2037774c]
mov rcx, qword [rax + 0x20]
sub rcx, qword [rax + 0x18]
shr rcx, 3
imul eax, ecx, 0xba2e8ba3
test eax, eax
je 0x20197f6b
mov rdi, r8
mov rbx, rdx
mov rcx, qword [rsi + 8]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x200fc05d.0]
test al, al
je 0x20197f76
add r14, r12
mov rax, qword [rsi + 0x10]
mov r12d, dword [0x2045ce24]
lea r13d, [r12 + 1]
mov dword [0x2045ce24], r13d
xor ebp, ebp
test r12d, r13d
jne 0x20197e7f
test r15d, r15d
jle 0x20197e7f
xor ecx, ecx
xor ebp, ebp
nop dword [rax]
movsxd rcx, ecx
xor ebp, dword [r14 + rcx]
add ecx, 4
cmp ecx, r15d
jl 0x20197e70
lea rcx, [rsi + 0x78]
mov r8, qword [rax + 0x20]
sub r8, qword [rax + 0x18]
sar r8, 3
movabs rdx, 0x2e8ba2e8ba2e8ba3
imul rdx, r8
mov rax, qword [rsi + 0x78]
mov r14, qword [rsi + 0x80]
mov r8, r14
sub r8, rax
sar r8, 4
mov r15, rdx
sub r15, r8
jae 0x20197eca
shl rdx, 4
add rax, rdx
mov qword [rsi + 0x80], rax
jmp 0x20197f06
jbe 0x20197f06
mov r8, qword [rsi + 0x88]
sub r8, rax
sar r8, 4
cmp r8, rdx
jae 0x20197eeb
lea r8, [rsp + 0x20]
call fcn.201982d0
jmp 0x20197f06
shl r15, 4
mov rcx, r14
xor edx, edx
mov r8, r15
call fcn.20354420
add r15, r14
mov qword [rsi + 0x80], r15
mov rax, qword [rsi + 0x78]
mov rcx, qword [rsi + 0x80]
and r12d, r13d
mov edx, dword [0x20377744]
xor r8d, r8d
cmp r12d, 1
sbb r8d, r8d
sub edx, ebp
xor edx, r8d
not edx
and edx, r8d
add dword [0x204a202c], edx
cmp rax, rcx
je 0x20197f4c
movups xmm0, xmmword [0x20377730]
movups xmmword [rax], xmm0
add rax, 0x10
cmp rax, rcx
jne 0x20197f40
mov rax, qword [rsi + 0x78]
mov qword [rbx], rax
mov rcx, qword [rsi]
mov edx, 0x17142259
call fcn.201984a0
test al, al
je 0x20197f76
mov qword [0x204a23f8], rdi
mov byte [rsi + 0x98], 1
mov al, 1
jmp 0x20197f78
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x20198b20
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x20198b35
mov byte [rax + 0x18], 0
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x20198b43
call fcn.200807d0
add rsi, 0x20
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.20195f40
Function at 0x201996c0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, rcx
lea rax, [0x20377558]
mov qword [rcx], rax
lea rbx, [rcx + 0x28]
mov rsi, qword [rcx + 0x28]
cmp rsi, qword [rcx + 0x30]
je 0x2019973c
add rsi, 8
nop word cs:[rax + rax]
mov rcx, qword [rsi - 8]
test rcx, rcx
je 0x2019971a
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [case.0x200fc05d.0]
cmp byte [0x204a1eec], 0
jne 0x20199739
test byte [0x204a21a1], 1
jne 0x20199739
lea rax, [rsi + 8]
cmp rsi, qword [rdi + 0x30]
mov rsi, rax
jne 0x20199700
mov rsi, qword [rbx]
movsxd r8, dword [0x20377a10]
mov r9d, dword [0x20377a00]
test rsi, rsi
je 0x20199814
lea rax, [0x20377a10]
add r8, rax
mov rdx, qword [rdi + 0x38]
mov eax, dword [0x2045d050]
lea r10d, [rax + 1]
mov dword [0x2045d050], r10d
xor ecx, ecx
test eax, r10d
jne 0x201997aa
test r9d, r9d
jle 0x201997aa
xor r11d, r11d
xor ecx, ecx
nop word cs:[rax + rax]
movsxd r11, r11d
xor ecx, dword [r8 + r11]
add r11d, 0x684fe3ab
add r11d, 0x97b01c59
cmp r11d, r9d
jl 0x20199790
sub rdx, rsi
cmp rdx, 0xfff
jbe 0x201997f8
and eax, r10d
mov r8, qword [rsi - 8]
add rsi, 0xfffffffffffffff8
sub rsi, r8
mov r9d, dword [0x20377a0c]
xor r10d, r10d
cmp eax, 1
sbb r10d, r10d
sub r9d, ecx
and r9d, r10d
setne al
or al, byte [0x204a1eec]
and al, 1
mov byte [0x204a1eec], al
cmp rsi, 0x20
jae 0x2019981d
add rdx, 0x27
mov rsi, r8
mov rcx, rsi
mov r8d, 0x1499f3b8
call fcn.200807c0
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop rbp
ret
call fcn.2030c4cc
int3
Function at 0x2019bec0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x10], rcx
call fcn.2019c5c0
mov rsi, qword [rbp - 0x10]
lea rax, [rsi + 0x168]
mov qword [rbp - 0x18], rax
mov rcx, qword [rsi + 0x168]
mov rax, qword [rsi + 0x170]
mov qword [rbp - 0x30], rax
lea rax, [rsi + 0xe8]
mov qword [rbp - 0x20], rax
jmp 0x2019bf2c
mov rcx, qword [rbp - 0x28]
add rcx, 2
mov rsi, qword [rbp - 0x10]
cmp rcx, qword [rbp - 0x30]
je 0x2019bf56
mov qword [rbp - 0x28], rcx
cmp byte [0x204a19d0], 0
jne 0x2019bf20
mov rax, qword [rbp - 0x28]
movzx edx, word [rax]
test dx, dx
je 0x2019bf20
mov rcx, qword [rbp - 0x20]
call fcn.201a1620
jmp 0x2019bf20
lea rcx, [rbp - 0x38]
call fcn.2019c200
mov rax, qword [rbp - 0x18]
mov rcx, qword [rax]
movsxd r8, dword [0x20378000]
mov r10d, dword [0x20377fe8]
test rcx, rcx
je 0x2019c0a0
mov rdx, qword [rsi + 0x178]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x2019c083
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
mov r9d, dword [0x2045d5c4]
lea esi, [r9 + 1]
mov dword [0x2045d5c4], esi
xor r11d, r11d
mov edi, 0
test r9d, esi
jne 0x2019c01d
xor ebx, ebx
mov r11d, 0
mov edi, 0
test r10d, r10d
jle 0x2019c01d
lea r11, [0x20378000]
add r8, r11
xor r11d, r11d
xor edi, edi
nop dword [rax + rax]
movsxd r14, ebx
mov r15, qword [r8 + r14]
mov r14, qword [r8 + r14 + 8]
mov r12, r14
xor r12, r14
mov r13, r15
xor r13, r15
not r13
and r11, r13
xor r11, r15
not r12
and rdi, r12
xor rdi, r14
mov r14d, ebx
xor r14d, 0x10
and ebx, 0x10
lea ebx, [r14 + rbx*2]
cmp ebx, r10d
jl 0x2019bfe0
sub rcx, rax
cmp rcx, 0x20
jae 0x2019c0d8
add rdx, 0x27
mov r8, qword [0x20377ff8]
mov r10, qword [0x20377ff0]
xor ecx, ecx
test r9d, esi
setne cl
xor r9d, r9d
add rcx, 0xffffffffffffffff
adc r9, 0xffffffffffffffff
mov rsi, qword [rbp - 0x10]
sub r10, r11
sbb r8, rdi
not rcx
not r9
xor r9, r8
xor rcx, r10
and rcx, r10
and r9, r8
or r9, rcx
setne cl
or cl, byte [0x204a19d0]
and cl, 1
mov byte [0x204a19d0], cl
mov rcx, rax
mov r8d, 0x6fce26bd
call fcn.200807c0
xorps xmm0, xmm0
mov rax, qword [rbp - 0x18]
movups xmmword [rax], xmm0
mov qword [rax + 0x10], 0
mov rcx, qword [rbp - 0x20]
call fcn.2019cbe0
lea rcx, [rsi + 0x98]
call fcn.20333698
lea rcx, [rsi + 0x50]
call fcn.20333698
mov rcx, rsi
call fcn.2032d164
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.2030c4cc
int3
Function at 0x2019c2d0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov edi, edx
mov rsi, rcx
call fcn.2019c720
mov qword [rbp - 0x20], rdi
mov edx, edi
mov rax, qword [rsi + 0x168]
mov rcx, qword [rsi + 0x170]
sub rcx, rax
sar rcx, 1
cmp rcx, rdx
mov qword [rbp - 0x28], rdx
jbe 0x2019c32a
movzx r12d, word [rax + rdx*2]
test r12w, r12w
je 0x2019c32a
xor r14d, r14d
jmp 0x2019c330
mov r14b, 1
xor r12d, r12d
lea rax, [rsi + 0x168]
mov qword [rbp - 0x10], rax
lea rax, [0x20377fe4]
movsxd rdi, dword [0x20377fe4]
mov r15, rdi
xor r15, rax
and rdi, rax
add rdi, rdi
mov ebx, dword [0x20377fe0]
mov rcx, rsi
call fcn.2019c810
mov dword [rbp - 4], r12d
add r15, rdi
mov r12d, dword [0x2045d5c0]
lea r13d, [r12 + 1]
mov dword [0x2045d5c0], r13d
test r12d, r13d
je 0x2019c386
xor edi, edi
jmp 0x2019c3bc
xor eax, eax
mov edi, 0
test ebx, ebx
jle 0x2019c3bc
xor ecx, ecx
nop word cs:[rax + rax]
movsxd rdx, eax
add rdx, r15
movzx edx, word [rdx]
mov edi, edx
xor edi, edx
not edi
and edi, ecx
xor edi, edx
add eax, 2
mov ecx, edi
cmp eax, ebx
jl 0x2019c3a0
test r14b, r14b
mov rbx, qword [rbp - 0x28]
je 0x2019c4d4
mov qword [rbp - 0x18], rsi
mov rcx, rsi
call fcn.2019c5c0
mov rcx, qword [rsi + 0x168]
mov r14, qword [rsi + 0x170]
mov rax, r14
sub rax, rcx
sar rax, 1
cmp rax, rbx
seta dl
movzx r8d, byte [0x204a224b]
test r8b, dl
jne 0x2019c422
xor r8b, dl
jne 0x2019c422
mov word [rbp - 6], 0
mov rdx, qword [rbp - 0x20]
inc edx
cmp rax, rdx
jbe 0x2019c434
lea rax, [rcx + rdx*2]
mov qword [rsi + 0x170], rax
jmp 0x2019c47e
movzx eax, word [rcx + rbx*2]
mov dword [rbp - 4], eax
test ax, ax
jne 0x2019c4cb
jmp 0x2019c47e
jae 0x2019c47e
cmp byte [0x204a19d0], 0
jne 0x2019c471
mov r8, rdx
mov rdx, qword [rsi + 0x178]
sub rdx, rcx
sar rdx, 1
cmp rdx, r8
mov rdx, r8
jb 0x2019c471
sub rdx, rax
lea r8, [rdx + rdx]
mov rcx, r14
mov r15, rdx
xor edx, edx
call fcn.20354420
lea rax, [r14 + r15*2]
jmp 0x2019c419
lea r8, [rbp - 6]
mov rcx, qword [rbp - 0x10]
call fcn.2019c910
and r12d, r13d
movzx eax, word [0x20377fec]
xor ecx, ecx
cmp r12d, 1
sbb ecx, ecx
sub eax, edi
mov edx, eax
xor edx, ecx
not edx
test dx, ax
setne al
or al, byte [0x204a224b]
and al, 1
mov byte [0x204a224b], al
add rsi, 0xe8
mov rcx, rsi
call fcn.201a0940
mov ecx, eax
mov rax, qword [rbp - 0x10]
mov rax, qword [rax]
mov dword [rbp - 4], ecx
mov word [rax + rbx*2], cx
lea rcx, [rbp - 0x18]
call fcn.2019c200
mov eax, dword [rbp - 4]
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret