joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400f96e0
Capabilities:
Encrypt data using curve25519

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x88
xor r12d, r12d
lea rbp, [rsp + 0x40]
mov ebx, r9d
mov rsi, rcx
mov rdi, rdx
mov qword [rsp + 0xe0], r8
mov rcx, rbp
call fcn.1401179a0
and ebx, 0x20
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
sete r12b
xor ecx, ecx
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
add r12d, 1
call fcn.140121db0
xor ecx, ecx
mov r13, rax
call fcn.140121da0
xor ecx, ecx
mov qword [rsp + 0x38], rax
call fcn.140121da0
mov ecx, 0x40
mov r15, rax
call fcn.1400eb9f0
test rax, rax
mov rbx, rax
je 0x1400f9960
mov edx, r12d
mov ecx, 0x20
call fcn.140116400
lea r9, [rsp + 0x60]
xor edx, edx
mov dword [rsp + 0x20], 1
mov r8, rbx
mov ecx, 0xa
mov r14, rax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], 0x20
call fcn.1400fd3a0
test eax, eax
mov r12d, eax
je 0x1400f9800
mov rcx, rbp
call fcn.140117a00
mov rcx, r13
call fcn.140121dc0
mov rcx, qword [rsp + 0x38]
call fcn.140121dc0
mov rcx, r15
call fcn.140121dc0
mov rcx, rbx
call fcn.1400ebb20
mov eax, r12d
add rsp, 0x88
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rdx, r14
mov r8d, 0x100
xor ecx, ecx
call fcn.140121580
lea r9, [rbx + 0xf]
mov qword [rsi + 0x68], rax
lea rax, [rbx + 0x1f]
mov rdx, rbx
nop
movzx ecx, byte [rdx]
movzx r8d, byte [rax]
sub rax, 1
add rdx, 1
mov byte [rdx - 1], r8b
mov byte [rax + 1], cl
cmp rax, r9
jne 0x1400f9820
movzx eax, byte [rbx]
and byte [rbx + 0x1f], 0xf8
xor r9d, r9d
mov r8d, 0x20
mov rdx, rbx
mov rcx, r13
and eax, 0x3f
or eax, 0x40
mov byte [rbx], al
call fcn.14011e0c0
mov rcx, rbx
call fcn.1400ebb20
mov r9, qword [rsp + 0xe0]
lea r8, [rdi + 0x20]
mov rdx, r13
mov rcx, rbp
call fcn.140119070
mov ecx, 1
call fcn.1400ec010
test eax, eax
jne 0x1400f9944
mov eax, dword [rdi]
mov rcx, qword [rdi + 8]
xor ebx, ebx
mov dword [rsi], eax
mov eax, dword [rdi + 4]
mov dword [rsi + 4], eax
call fcn.140121790
mov rcx, qword [rdi + 0x10]
mov qword [rsi + 8], rax
call fcn.140121790
mov rcx, qword [rdi + 0x18]
mov qword [rsi + 0x10], rax
call fcn.140121790
lea rcx, [rsi + 0x20]
mov qword [rsi + 0x18], rax
call fcn.1401179a0
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rsi + 0x20]
call fcn.140121a50
mov rdx, qword [rdi + 0x28]
mov rcx, qword [rsi + 0x28]
call fcn.140121a50
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rsi + 0x30]
call fcn.140121a50
mov rcx, qword [rdi + 0x38]
call fcn.140121790
mov rcx, qword [rdi + 0x40]
mov qword [rsi + 0x38], rax
call fcn.140121790
lea rcx, [rsi + 0x50]
mov qword [rsi + 0x40], rax
call fcn.1401179a0
mov rcx, qword [rsi + 0x50]
mov rdx, qword [rsp + 0x40]
call fcn.140121a50
mov rcx, qword [rsi + 0x58]
mov rdx, qword [rsp + 0x48]
call fcn.140121a50
mov rcx, qword [rsi + 0x60]
mov rdx, qword [rsp + 0x50]
call fcn.140121a50
jmp 0x1400f97ba
mov r8, qword [rsp + 0xe0]
lea rcx, str.ecgen______pk
mov rdx, rbp
call fcn.1401181d0
jmp 0x1400f988f
call fcn.14014d590
mov r12d, eax
jmp 0x1400f97ba
Function at 0x1400fc050
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [rcx]
mov rdi, rcx
mov r12, rdx
mov rbp, r8
mov r9, qword [rax + 0x10]
test r9, r9
je 0x1400fc07e
movsxd rdx, dword [rcx + 8]
test edx, edx
jne 0x1400fc0e0
test rbp, rbp
jne 0x1400fc0fd
mov rbx, qword [rax + 0x20]
lea r13, [rdi + 0x10]
test rbx, rbx
jne 0x1400fc0a8
jmp 0x1400fc0c3
mov rax, qword [rbx]
mov r8, rbp
mov rdx, r12
mov rcx, rsi
call qword [rax + 0x38]
mov rbx, qword [rbx + 8]
test rbx, rbx
je 0x1400fc0c3
movsxd r8, dword [rdi + 8]
lea rsi, [rbx + 0x18]
test r8d, r8d
je 0x1400fc090
mov rax, qword [rbx]
mov rdx, r13
mov rcx, rsi
call qword [rax + 0x38]
jmp 0x1400fc090
mov dword [rdi + 8], 0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rcx, [rcx + 0x10]
mov r8d, 1
call sub.msvcrt.dll_fwrite
cmp rax, 1
jne 0x1400fc120
test rbp, rbp
mov rax, qword [rdi]
je 0x1400fc07e
mov r9, qword [rax + 0x10]
mov r8d, 1
mov rdx, rbp
mov rcx, r12
call sub.msvcrt.dll_fwrite
cmp rax, 1
jne 0x1400fc138
mov rax, qword [rdi]
jmp 0x1400fc07e
lea r8, str.md_write
lea rcx, str.md.c
mov edx, 0x258
call fcn.1400ea340
lea r8, str.md_write
lea rcx, str.md.c
mov edx, 0x25a
call fcn.1400ea340
nop
nop dword [rax + rax]
nop word cs:[rax + rax]
Function at 0x140107bd0
Capabilities:
Hash data using sha1

Disassembly:
push rsi
push rbx
sub rsp, 0xe8
lea rax, [0x140107a20]
lea rsi, [rsp + 0x20]
mov rbx, rcx
mov dword [rsp + 0xc8], 0x67452301
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0xcc], 0xefcdab89
mov rcx, rsi
mov dword [rsp + 0xd0], 0x98badcfe
mov dword [rsp + 0xd4], 0x10325476
mov dword [rsp + 0xd8], 0xc3d2e1f0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov dword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0x40
call fcn.140133710
mov rcx, rsi
call fcn.140107a60
mov rax, qword [rsp + 0x20]
mov qword [rbx], rax
mov rax, qword [rsp + 0x28]
mov qword [rbx + 8], rax
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x10], eax
add rsp, 0xe8
pop rbx
pop rsi
ret
Function at 0x14010cd40
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1400ef530
mov edx, eax
lea rcx, [fcn.14010cf10]
mov dword [rbx + 0xa8], 0x67452301
shr edx, 7
mov dword [rbx + 0xac], 0xefcdab89
mov dword [rbx + 0xb0], 0x98badcfe
mov r8d, edx
movzx edx, byte [rbx + 0xbc]
mov qword [rbx + 0xa0], rcx
mov ecx, eax
and r8d, 1
mov dword [rbx + 0xb4], 0x10325476
and ecx, 0x1020
mov dword [rbx + 0xb8], 0xc3d2e1f0
mov qword [rbx + 0x80], 0
mov qword [rbx + 0x88], 0
mov dword [rbx + 0x90], 0
and edx, 0xfffffffc
cmp ecx, 0x1020
mov qword [rbx + 0x98], 0x40
sete cl
or edx, r8d
and eax, 0x1040
add ecx, ecx
or edx, ecx
cmp eax, 0x1040
sete al
lea ecx, [rax*4]
mov eax, edx
and eax, 0xfffffffb
or eax, ecx
mov byte [rbx + 0xbc], al
add rsp, 0x20
pop rbx
ret
Function at 0x140116740
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rsi, rcx
lea rcx, str.GCRYPT_RNDW32_NOPERF
mov edi, edx
call sub.msvcrt.dll_getenv
test rax, rax
je 0x1401167b0
mov eax, dword [0x1402a4f78]
test eax, eax
je 0x140116790
mov rcx, 0xffffffff80000004
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, str.note:_get_performance_data_has_been_disabled_n
mov dword [0x1402a4f78], 1
call fcn.1400ea3a0
jmp 0x140116770
movsxd rcx, dword [0x140170160]
lea r14, [rsp + 0x3c]
lea r12, str.Global
mov ebx, 0xa
mov rbp, 0xffffffff80000004
call fcn.1400ebd00
mov r13, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r15, rax
nop
mov eax, dword [0x140170160]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov rdx, r12
mov rcx, rbp
mov dword [rsp + 0x3c], eax
call r13
test eax, eax
je 0x140116840
cmp eax, 0xea
jne 0x140116870
mov eax, dword [0x140170160]
mov rcx, r15
lea edx, [rax + 0x4000]
mov dword [0x140170160], edx
movsxd rdx, edx
call fcn.1400ebd80
sub ebx, 1
mov r15, rax
jne 0x1401167e0
mov rcx, r15
call fcn.1400ebb20
jmp 0x140116770
lea rdx, str.PERF
mov r8d, 8
mov rcx, r15
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x14011688e
mov edx, dword [rsp + 0x3c]
mov r8d, edi
mov rcx, r15
call rsi
jmp 0x140116833
cmp eax, dword [0x1402a4f74]
je 0x140116833
lea rcx, str.rndw32:_get_performance_data_problem:_ec_ld_n
mov edx, eax
mov dword [0x1402a4f74], eax
call fcn.1400ea490
jmp 0x140116833
lea rcx, str.rndw32:_no_PERF_signature_n
call fcn.1400ea490
jmp 0x140116833
Function at 0x140117340
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbx, qword [rsp + 0xa0]
mov rsi, rcx
mov ecx, dword [0x1402a5000]
mov ebp, edx
test ecx, ecx
je 0x140117410
cmp r8d, 1
mov dword [rsi], ebp
mov dword [rsi + 4], r8d
mov dword [rsi + 8], r9d
je 0x140117400
mov rcx, rbx
call fcn.14011a670
mov dword [rsi + 0xc], eax
mov rcx, rbx
call fcn.140121790
mov rcx, qword [rsp + 0xa8]
mov qword [rsi + 0x10], rax
call fcn.140121790
mov rcx, qword [rsp + 0xb0]
mov qword [rsi + 0x18], rax
call fcn.140121790
mov edx, dword [0x1402a5000]
mov qword [rsi + 0x20], rax
xor eax, eax
test edx, edx
jle 0x1401173c7
mov rcx, qword [rsi + 0x10]
xor edx, edx
call fcn.14011bdd0
and byte [rsi + 0x50], 0xfc
cmp ebp, 1
mov qword [rsi + 0x60], rax
lea rbx, [rsi + 0x68]
lea rdi, [rsi + 0xc0]
je 0x140117450
nop
mov rcx, qword [rsi + 0x10]
add rbx, 8
call fcn.1401218f0
mov qword [rbx - 8], rax
cmp rbx, rdi
jne 0x1401173e0
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov dword [rsi + 0xc], 0x100
jmp 0x140117382
lea rcx, str.GCRYPT_BARRETT
mov dword [rsp + 0x3c], r9d
mov dword [rsp + 0x38], r8d
call sub.msvcrt.dll_getenv
test rax, rax
mov r9d, dword [rsp + 0x3c]
mov r8d, dword [rsp + 0x38]
sete al
movzx eax, al
neg eax
or eax, 1
mov dword [0x1402a5000], eax
jmp 0x140117363
lea r8, str.0x0000000000000000000000000000000000000000000000000000000000000000
lea rbp, [rsp + 0x48]
lea rdi, str.0x0000000000000000000000000000000000000000000000000000000000000000
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x20], 0
mov edx, 4
mov rcx, rbp
call fcn.14011e220
test eax, eax
jne 0x14011749e
mov rax, qword [rsp + 0x48]
mov qword [rsi + rbx + 0x68], rax
add rbx, 8
mov r8, qword [rdi + rbx]
test r8, r8
jne 0x140117465
jmp 0x1401173f6
mov ecx, eax
call fcn.14014d540
lea rcx, str.scanning_ECC_parameter_failed:__s_n
mov rdx, rax
call fcn.1400ea430
nop
nop
nop word cs:[rax + rax]

Function at 0x140121b40
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, dword [rdx]
neg r8d
cmp esi, dword [rcx]
mov rax, rcx
jne 0x140121bad
test esi, esi
jle 0x140121b80
mov rbx, qword [rcx + 0x10]
mov rdi, qword [rdx + 0x10]
xor r9d, r9d
mov r11d, dword [rbx + r9*4]
mov r10d, dword [rdi + r9*4]
xor r10d, r11d
and r10d, r8d
xor r10d, r11d
mov dword [rbx + r9*4], r10d
add r9, 1
cmp esi, r9d
jg 0x140121b62
mov r9d, dword [rax + 4]
mov ecx, dword [rdx + 4]
mov edi, dword [rdx + 8]
xor ecx, r9d
and ecx, r8d
xor ecx, r9d
mov dword [rax + 4], ecx
mov ecx, dword [rax + 8]
xor edi, ecx
and r8d, edi
xor r8d, ecx
mov dword [rax + 8], r8d
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
lea rcx, str.mpi_set_cond:_different_sizes_n
call fcn.1400ea460
nop
nop word [rax + rax]
Function at 0x140121d00
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, dword [rdx]
mov r9d, dword [rcx + 4]
neg r8d
cmp dword [rcx], esi
cmovle esi, dword [rcx]
cmp r9d, esi
jg 0x140121d87
mov eax, dword [rdx + 4]
cmp eax, esi
jg 0x140121d87
test esi, esi
jle 0x140121d58
mov rbx, qword [rcx + 0x10]
mov r11, qword [rdx + 0x10]
xor eax, eax
nop
mov r10d, dword [rbx + rax*4]
mov r9d, dword [r11 + rax*4]
xor r9d, r10d
and r9d, r8d
xor r10d, r9d
mov dword [rbx + rax*4], r10d
xor dword [r11 + rax*4], r9d
add rax, 1
cmp esi, eax
jg 0x140121d30
mov r9d, dword [rcx + 4]
mov eax, dword [rdx + 4]
xor eax, r9d
and eax, r8d
xor r9d, eax
mov dword [rcx + 4], r9d
mov r9d, dword [rcx + 8]
xor dword [rdx + 4], eax
mov eax, dword [rdx + 8]
xor eax, r9d
and r8d, eax
xor r9d, r8d
mov dword [rcx + 8], r9d
xor dword [rdx + 8], r8d
add rsp, 0x28
pop rbx
pop rsi
ret
lea rcx, str.mpi_swap_cond:_different_sizes_n
call fcn.1400ea460
nop
nop
nop word cs:[rax + rax]
Function at 0x140122100
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x168
mov eax, dword [rcx]
lea r8, [rsp + 0x20]
mov dword [rsp], eax
mov eax, dword [rcx + 4]
lea r10, [r8 + 0x40]
mov dword [rsp + 4], eax
mov eax, dword [rcx + 8]
mov dword [rsp + 8], eax
mov eax, dword [rcx + 0xc]
mov dword [rsp + 0xc], eax
mov eax, dword [rcx + 0x10]
mov dword [rsp + 0x10], eax
mov eax, dword [rcx + 0x14]
mov dword [rsp + 0x14], eax
mov eax, dword [rcx + 0x18]
mov dword [rsp + 0x18], eax
mov eax, dword [rcx + 0x1c]
mov dword [rsp + 0x1c], eax
mov rax, r8
movzx r9d, byte [rdx]
add rdx, 4
add rax, 4
mov byte [rax - 1], r9b
movzx r9d, byte [rdx - 3]
mov byte [rax - 2], r9b
movzx r9d, byte [rdx - 2]
mov byte [rax - 3], r9b
movzx r9d, byte [rdx - 1]
mov byte [rax - 4], r9b
cmp rax, r10
jne 0x140122155
lea r13, [rsp + 0x60]
xor eax, eax
nop dword [rax]
mov edx, dword [r8 + rax]
mov dword [r13 + rax], edx
add rax, 4
cmp rax, 0x40
jne 0x140122190
lea r10, [r13 + 0xc0]
mov r9, r13
nop dword [rax]
mov eax, dword [r9 + 0x38]
mov r8d, dword [r9 + 4]
add r9, 4
mov edx, eax
mov r11d, eax
shr eax, 0xa
rol r11d, 0xd
rol edx, 0xf
xor edx, r11d
mov r11d, r8d
xor edx, eax
mov eax, dword [r9 - 4]
add eax, dword [r9 + 0x20]
rol r11d, 0xe
add edx, eax
mov eax, r8d
shr r8d, 3
ror eax, 7
xor eax, r11d
xor eax, r8d
add eax, edx
mov dword [r9 + 0x3c], eax
cmp r10, r9
jne 0x1401221b0
mov edx, dword [rsp + 0x1c]
mov ebx, dword [rsp + 0x18]
xor r11d, r11d
mov edi, dword [rsp + 0x14]
mov r10d, dword [rsp + 0x10]
mov r8d, 0x428a2f98
mov r12d, dword [rsp + 0xc]
mov ebp, dword [rsp + 8]
lea r14, [0x14027df20]
mov esi, dword [rsp + 4]
mov r9d, dword [rsp]
jmp 0x140122249
mov r8d, dword [r14 + r11]
mov r12d, ebp
mov edx, ebx
mov ebp, esi
mov ebx, edi
mov esi, r9d
mov edi, r10d
mov r9d, eax
mov r10d, r15d
mov eax, r10d
mov r15d, r10d
ror r15d, 0xb
ror eax, 6
xor eax, r15d
mov r15d, r10d
rol r15d, 7
xor r15d, eax
mov eax, edi
xor eax, ebx
and eax, r10d
xor eax, ebx
add eax, r15d
add eax, dword [r13 + r11]
mov r15d, r9d
and r15d, esi
add r11, 4
add eax, edx
mov edx, r9d
add eax, r8d
mov r8d, r9d
ror edx, 2
ror r8d, 0xd
xor edx, r8d
mov r8d, r9d
rol r8d, 0xa
xor edx, r8d
mov r8d, r9d
or r8d, esi
and r8d, ebp
or r8d, r15d
lea r15d, [rax + r12]
add edx, r8d
add eax, edx
cmp r11, 0x100
jne 0x140122230
add eax, dword [rsp]
add r9d, dword [rsp + 4]
add esi, dword [rsp + 8]
add ebp, dword [rsp + 0xc]
add r15d, dword [rsp + 0x10]
add r10d, dword [rsp + 0x14]
add edi, dword [rsp + 0x18]
add ebx, dword [rsp + 0x1c]
mov dword [rcx], eax
mov dword [rcx + 4], r9d
mov dword [rcx + 8], esi
mov dword [rcx + 0xc], ebp
mov dword [rcx + 0x10], r15d
mov dword [rcx + 0x14], r10d
mov dword [rcx + 0x18], edi
mov dword [rcx + 0x1c], ebx
add rsp, 0x168
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140122710
Capabilities:
Authenticate hmac
Encode data using xor
Hash data using sha256

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
mov rbp, rcx
mov ecx, 0xac
mov r12, rdx
call sub.msvcrt.dll_malloc
test rax, rax
mov rsi, rax
je 0x140122891
and byte [rax + 0x28], 0xfc
test rbp, rbp
mov dword [rax], 0x6a09e667
mov dword [rax + 4], 0xbb67ae85
mov dword [rax + 8], 0x3c6ef372
mov dword [rax + 0xc], 0xa54ff53a
mov dword [rax + 0x10], 0x510e527f
mov dword [rax + 0x14], 0x9b05688c
mov dword [rax + 0x18], 0x1f83d9ab
mov dword [rax + 0x1c], 0x5be0cd19
mov dword [rax + 0x20], 0
mov dword [rax + 0x24], 0
je 0x140122891
lea rbx, [rsp + 0x20]
xor eax, eax
mov ecx, 8
lea r13, [rsi + 0x69]
mov rdi, rbx
rep stosq qword [rdi], rax
lea rdi, [rsi + 0x71]
mov rcx, r13
mov qword [rsi + 0x69], 0
mov qword [rsi + 0xa1], 0
and rdi, 0xfffffffffffffff8
sub rcx, rdi
add ecx, 0x40
shr ecx, 3
cmp r12, 0x40
rep stosq qword [rdi], rax
jbe 0x1401228a1
xor edx, edx
xor ecx, ecx
call fcn.140122710
test rax, rax
mov rdi, rax
je 0x1401228cc
mov r8, r12
mov rdx, rbp
mov rcx, rax
call fcn.140122350
test byte [rdi + 0x28], 1
je 0x1401228bf
mov rdx, qword [rdi + 0x29]
mov rcx, rdi
mov qword [rsp + 0x20], rdx
mov rdx, qword [rdi + 0x31]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rdi + 0x39]
mov qword [rsp + 0x30], rdx
mov rdx, qword [rdi + 0x41]
mov qword [rsp + 0x38], rdx
mov rdx, qword [rdi + 0x29]
mov qword [r13], rdx
mov rdx, qword [rdi + 0x31]
mov qword [r13 + 8], rdx
mov rdx, qword [rdi + 0x39]
mov qword [r13 + 0x10], rdx
mov rax, qword [rdi + 0x41]
mov qword [r13 + 0x18], rax
call fcn.140122310
xor eax, eax
nop
xor byte [rbx + rax], 0x36
xor byte [rsi + rax + 0x69], 0x5c
add rax, 1
cmp rax, 0x40
jne 0x140122850
or byte [rsi + 0x28], 2
mov r8d, 0x40
mov rdx, rbx
mov rcx, rsi
call fcn.140122350
mov rax, rbx
nop dword [rax + rax]
lea rdi, [rsp + 0x60]
mov byte [rax], 0
add rax, 1
cmp rax, rdi
jne 0x140122880
mov rax, rsi
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov r8, r12
mov rdx, rbp
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov r8, r12
mov rdx, rbp
mov rcx, r13
call sub.msvcrt.dll_memcpy
jmp 0x14012284d
mov rcx, rdi
call fcn.1401224e0
jmp 0x140122801
mov rcx, rsi
xor esi, esi
call fcn.14016b6d8
jmp 0x140122891
Function at 0x140123910
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
test r8, r8
mov rdi, rdx
mov r14, rcx
mov rsi, r8
mov dword [rsp + 0xc8], r9d
mov edx, dword [rcx + 0xd4]
jne 0x14012394d
test edx, edx
je 0x140123a5c
test r9d, r9d
je 0x140123a5c
mov rax, qword [r14 + 0x18]
lea rbx, [r14 + 0x70]
lea rbp, [r14 + 0x280]
xor r15d, r15d
mov r12, qword [rax + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x40], rax
nop dword [rax]
mov ecx, edx
lea rax, [rcx + rsi]
cmp rax, 0xf
jbe 0x140123a70
test edx, edx
jne 0x140123a70
test rsi, rsi
jne 0x1401239de
mov ecx, dword [rsp + 0xc8]
test ecx, ecx
je 0x140123a45
xor eax, eax
nop
mov edx, eax
add eax, 1
cmp eax, 0x10
mov byte [r14 + rdx + 0xc4], 0
jne 0x1401239a0
xor esi, esi
mov rax, qword [r14 + 0xc4]
xor qword [r14 + 0x70], rax
mov r8, rbx
mov rax, qword [r14 + 0xcc]
xor qword [r14 + 0x78], rax
mov rdx, rbx
mov rcx, rbp
call r12
cmp r15d, eax
cmovb r15d, eax
mov r13, qword [r14 + 0x38]
test r13, r13
je 0x140123ad0
mov rax, rsi
mov r9, rdi
mov dword [rsp + 0x28], 1
shr rax, 4
mov r8, qword [rsp + 0x40]
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov rcx, rbp
call r13
mov rax, rsi
mov qword [rsp + 0x50], 0
and esi, 0xf
and rax, 0xfffffffffffffff0
mov qword [rsp + 0x58], 0
add rdi, rax
xor edx, edx
test rsi, rsi
jne 0x140123970
mov dword [rsp + 0xc8], 0
mov eax, dword [rsp + 0xc8]
test r15d, r15d
mov dword [r14 + 0xd4], eax
lea eax, [r15 + 0x20]
jne 0x140123a5e
xor eax, eax
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test rsi, rsi
je 0x140123b38
cmp edx, 0xf
jbe 0x140123a8a
jmp 0x140123b38
cmp eax, 0xf
ja 0x140123aa5
mov ecx, eax
add rdi, 1
lea eax, [rdx + 1]
sub rsi, 1
movzx edx, byte [rdi - 1]
mov byte [r14 + rcx + 0xc4], dl
mov edx, eax
jne 0x140123a83
test rsi, rsi
jne 0x1401239b5
mov edx, dword [rsp + 0xc8]
test edx, edx
je 0x140123b50
cmp eax, 0xf
jbe 0x1401239a0
jmp 0x1401239b3
cmp rsi, 0xf
jbe 0x140123a2f
lea rax, [rsi - 0x10]
mov r13, rdi
mov qword [rsp + 0x48], rax
and rax, 0xfffffffffffffff0
lea rax, [rdi + rax + 0x10]
mov qword [rsp + 0x38], rax
mov rax, qword [r13]
xor qword [r14 + 0x70], rax
mov r8, rbx
mov rax, qword [r13 + 8]
xor qword [r14 + 0x78], rax
mov rdx, rbx
mov rcx, rbp
call r12
cmp r15d, eax
cmovb r15d, eax
add r13, 0x10
cmp qword [rsp + 0x38], r13
jne 0x140123af4
mov rax, qword [rsp + 0x48]
and esi, 0xf
and rax, 0xfffffffffffffff0
lea rdi, [rdi + rax + 0x10]
jmp 0x140123a2f
test rsi, rsi
je 0x140123b5c
test edx, edx
je 0x1401239de
jmp 0x1401239b5
mov dword [rsp + 0xc8], eax
jmp 0x140123a45
mov eax, edx
jmp 0x140123aae
Function at 0x140124bf0
Capabilities:
Encode data using xor

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x18]
mov rbx, rcx
mov ecx, dword [rcx + 0xa0]
lea rdi, [rbx + 0xb1]
mov r10, qword [rax + 0x20]
cmp r10d, ecx
je 0x140124c5c
lea eax, [rcx + 1]
mov edx, ecx
lea rdi, [rbx + 0xc1]
mov byte [rbx + rdx + 0x90], pe_nt_image_headers64
cmp r10d, eax
jbe 0x140124c5c
mov esi, r10d
mov edx, eax
sub esi, ecx
lea rax, [rbx + rdx + 0x90]
mov ecx, esi
sub ecx, 2
lea rcx, [rdx + rcx + 0x91]
add rcx, rbx
nop dword [rax]
mov byte [rax], 0
add rax, 1
cmp rax, rcx
jne 0x140124c50
mov r9d, r10d
lea rcx, [rbx + 0x90]
cmp r9, 7
jbe 0x140124d88
lea rsi, [r9 - 8]
mov r8, rdi
mov rax, rsi
shr rax, 3
lea rdx, [rcx + rax*8 + 8]
mov rax, rcx
nop word cs:[rax + rax]
add rax, 8
add r8, 8
mov r11, qword [r8 - 8]
xor qword [rax - 8], r11
cmp rax, rdx
jne 0x140124c90
mov rdx, rsi
mov r11, r10
and rdx, 0xfffffffffffffff8
add rdx, 8
lea rax, [rcx + rdx]
add rdx, rdi
and r11d, 7
je 0x140124da6
add r11, rax
nop word [rax + rax]
add rdx, 1
add rax, 1
movzx r8d, byte [rdx - 1]
xor byte [rax - 1], r8b
cmp r11, rax
jne 0x140124cd0
cmp r9, 7
lea rdx, [rbx + 0x70]
jbe 0x140124da1
lea rsi, [r9 - 8]
mov rax, rsi
mov r8, rcx
shr rax, 3
lea r11, [rdx + rax*8 + 8]
mov rax, rdx
nop word [rax + rax]
add rax, 8
add r8, 8
mov r9, qword [r8 - 8]
xor qword [rax - 8], r9
cmp rax, r11
jne 0x140124d10
and rsi, 0xfffffffffffffff8
and r10d, 7
add rsi, 8
mov r9, r10
lea rax, [rdx + rsi]
add rcx, rsi
test r9, r9
je 0x140124d59
add r9, rax
add rcx, 1
add rax, 1
movzx r8d, byte [rcx - 1]
xor byte [rax - 1], r8b
cmp rax, r9
jne 0x140124d43
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x280]
mov r8, rdx
call qword [rax + 0x40]
test eax, eax
je 0x140124d76
lea ecx, [rax + 0x20]
call fcn.1400eac80
mov dword [rbx + 0xa0], 0
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
test r9, r9
jne 0x140124d93
lea rdx, [rbx + 0x70]
jmp 0x140124d59
mov rdx, rdi
mov rax, rcx
mov r11, r9
jmp 0x140124cc4
mov rax, rdx
jmp 0x140124d3b
lea rdx, [rbx + 0x70]
jmp 0x140124cf8
Function at 0x140126450
Capabilities:
Encode data using xor

Disassembly:
push rbx
cmp r9, 7
jbe 0x14012649a
lea rbx, [r9 - 8]
mov rax, rbx
shr rax, 3
lea r11, [rax*8 + 8]
xor eax, eax
nop dword [rax]
mov r10, qword [rdx + rax]
xor r10, qword [r8 + rax]
mov qword [rcx + rax], r10
add rax, 8
cmp rax, r11
jne 0x140126470
and rbx, 0xfffffffffffffff8
and r9d, 7
lea rax, [rbx + 8]
add r8, rax
add rdx, rax
add rcx, rax
xor eax, eax
test r9, r9
je 0x1401264b7
movzx r10d, byte [rdx + rax]
xor r10b, byte [r8 + rax]
mov byte [rcx + rax], r10b
add rax, 1
cmp r9, rax
jne 0x1401264a1
pop rbx
ret

Function at 0x1401266b0
Capabilities:
Encode data using xor

Disassembly:
test r8d, r8d
je 0x1401266e0
je 0x1401267a2
tzcnt r8d, r8d
cmp r8d, 0xf
jg 0x1401267ad
movsxd r8, r8d
lea rdx, [r8 + 0xd]
shl rdx, 4
lea rax, [rcx + rdx]
ret
shr r8, 0x20
xor r11d, r11d
mov eax, 0x30
tzcnt r11d, r8d
add r11d, 0x10
test r8, r8
cmove r11d, eax
lea rax, [rcx + 0x1c0]
cmp rdx, rax
je 0x14012671d
mov r9, qword [rcx + 0x1c0]
mov r10, qword [rcx + 0x1c8]
mov qword [rdx], r9
mov qword [rdx + 8], r10
mov r9, qword [rdx]
mov rax, qword [rdx + 8]
bswap r9
bswap rax
lea r10, [r9 + r9]
mov rcx, rax
sar r9, 0x3f
lea r8, [rax + rax]
shr rcx, 0x3f
and r9d, 0x87
xor r10, rcx
xor r9, r8
bswap r10
test r11d, r11d
bswap r9
mov qword [rdx], r10
mov qword [rdx + 8], r9
je 0x14012679e
nop dword [rax]
bswap r10
bswap r9
mov r8, r10
mov rax, r9
lea r10, [r10 + r10]
sar r8, 0x3f
add r9, r9
shr rax, 0x3f
and r8d, 0x87
xor r10, rax
xor r8, r9
sub r11d, 1
bswap r10
mov r9, r8
bswap r9
jne 0x140126760
mov qword [rdx], r10
mov qword [rdx + 8], r9
mov rax, rdx
ret
mov r11d, 0x10
jmp 0x1401266fc
lea r11d, [r8 - 0x10]
jmp 0x1401266fc