joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140183eb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp], rax
lea rax, [r8 - 3]
mov rbx, rdx
cmp rax, 0xfc
jbe 0x140183ee8
mov rax, r8
mov rcx, qword [rsp]
xor rcx, rsp
call fcn.140359070
add rsp, 0x60
pop rbx
ret
movzx eax, byte [rdx + r8 - 1]
mov r10, r8
sub r10, rax
mov qword [rsp + 0x78], rdi
mov r11, r10
lea rdi, [r8 - 1]
xor r11, r8
mov rcx, r8
or rcx, r11
xor edx, edx
xor rcx, r8
movq xmm5, r10
shr rcx, 0x3f
neg rcx
punpcklqdq xmm5, xmm5
test rdi, rdi
je 0x140184111
mov qword [rsp + 0x70], rsi
cmp rdi, 4
jb 0x1401840c0
movaps xmmword [rsp + 0x50], xmm6
mov eax, 0x3f
movaps xmmword [rsp + 0x40], xmm7
mov r8, rdi
movaps xmmword [rsp + 0x30], xmm8
and r8, 0xfffffffffffffffc
movdqa xmm8, xmmword [0x14060b000]
mov r9d, 2
movaps xmmword [rsp + 0x20], xmm9
movq xmm7, rax
movdqa xmm9, xmmword [0x14060af10]
xorps xmm6, xmm6
movaps xmmword [rsp + 0x10], xmm10
xorps xmm4, xmm4
movdqa xmm10, xmm8
mov rsi, rbx
sub r9, rbx
nop dword [rax]
movzx eax, word [rsi]
xorps xmm0, xmm0
movq xmm1, rdx
add rdx, 4
punpcklqdq xmm1, xmm1
paddq xmm1, xmm9
movd xmm3, eax
movdqa xmm2, xmm1
movzx eax, word [rsi + 2]
psubq xmm2, xmm5
punpcklbw xmm3, xmm0
pxor xmm2, xmm1
punpcklwd xmm3, xmm0
punpckldq xmm3, xmm0
movdqa xmm0, xmm1
pxor xmm0, xmm5
por xmm2, xmm0
movdqa xmm0, xmm3
pxor xmm2, xmm1
paddq xmm0, xmm8
pandn xmm3, xmm10
psrlq xmm0, xmm7
psrlq xmm2, xmm7
psrlq xmm3, xmm7
paddq xmm2, xmm8
pand xmm0, xmm3
movd xmm3, eax
lea rax, [r9 + rsi]
paddq xmm0, xmm8
lea rsi, [rsi + 4]
pand xmm2, xmm0
xorps xmm0, xmm0
por xmm6, xmm2
punpcklbw xmm3, xmm0
movq xmm1, rax
punpcklwd xmm3, xmm0
punpckldq xmm3, xmm0
punpcklqdq xmm1, xmm1
paddq xmm1, xmm9
movdqa xmm2, xmm1
movdqa xmm0, xmm1
psubq xmm2, xmm5
pxor xmm0, xmm5
pxor xmm2, xmm1
por xmm2, xmm0
movdqa xmm0, xmm3
paddq xmm0, xmm8
pxor xmm2, xmm1
pandn xmm3, xmm10
psrlq xmm0, xmm7
psrlq xmm2, xmm7
psrlq xmm3, xmm7
paddq xmm2, xmm8
pand xmm0, xmm3
paddq xmm0, xmm8
pand xmm2, xmm0
por xmm4, xmm2
cmp rdx, r8
jne 0x140183f90
movaps xmm10, xmmword [rsp + 0x10]
por xmm4, xmm6
movaps xmm9, xmmword [rsp + 0x20]
movdqa xmm0, xmm4
movaps xmm8, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm6, xmmword [rsp + 0x50]
psrldq xmm0, 8
por xmm4, xmm0
movq rax, xmm4
or rcx, rax
cmp rdx, rdi
je 0x14018410c
lea rsi, [r10 + rbx]
nop dword [rax]
nop dword [rax + rax]
lea r8, [rdx + rbx]
mov rax, rdx
mov r9, r8
xor rax, r10
movzx r8d, byte [r8]
sub r9, rsi
xor r9, rdx
dec r8
or r9, rax
shr r8, 0x3f
xor r9, rdx
dec r8
shr r9, 0x3f
inc rdx
dec r9
and r9, r8
or rcx, r9
cmp rdx, rdi
jne 0x1401840d0
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
and r11, rcx
xor r11, r10
mov rax, r11
mov rcx, qword [rsp]
xor rcx, rsp
call fcn.140359070
add rsp, 0x60
pop rbx
ret
Function at 0x140184140
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov r14, rdx
movzx eax, r9b
sub al, r8b
mov rcx, r14
movzx ebx, al
mov rdi, r9
mov edx, ebx
sub rdx, qword [r14]
add rdx, qword [r14 + 8]
call fcn.1401c4050
mov rsi, qword [r14 + 8]
mov rbp, rsi
sub rsi, qword [r14]
sub rbp, qword [r14]
sub rsi, rbx
mov r11, rbp
sub r11, rdi
cmp r11, rbp
je 0x1401841f7
mov rbx, rsi
shr rbx, 0x3f
nop dword [rax]
mov r10, qword [r14]
mov rdx, r11
xor rdx, rsi
mov rax, r11
shr rax, 0x3f
mov r9, rsi
sub r9, r11
xor al, bl
shr r9, 0x3f
xor r9b, bl
lea rcx, [rdx - 1]
or r9b, al
shr rcx, 0x3f
movzx eax, byte [r10 + r11]
xor r9b, bl
xor al, 0x80
dec r9b
not rdx
shr rdx, 0x3f
and cl, dl
neg cl
and cl, al
xor cl, byte [r10 + r11]
and r9b, cl
mov byte [r10 + r11], r9b
inc r11
cmp r11, rbp
jne 0x1401841a0
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.140359070
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140184210
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp], rax
mov r10, r8
lfence
cmp r8, 2
ja 0x140184242
mov rax, r8
mov rcx, qword [rsp]
xor rcx, rsp
call fcn.140359070
add rsp, 0x18
ret
mov qword [rsp + 0x20], rbx
lea r11, [r8 - 1]
xor cl, cl
mov qword [rsp + 0x10], rdi
xor al, al
lea rdi, [rdx - 1]
mov rbx, r10
nop dword [rax + rax]
movzx r9d, byte [rdi + rbx]
movzx r8d, r9b
xor r8b, 0x80
lea edx, [r8 - 1]
not r8b
shr dl, 7
shr r8b, 7
and dl, r8b
neg dl
or al, dl
movzx edx, al
not dl
movzx r8d, dl
mov edx, r8d
and edx, 1
sub r11, rdx
lea edx, [r9 - 1]
shr dl, 7
not r9b
shr r9b, 7
and dl, r9b
dec dl
and dl, r8b
or cl, dl
sub rbx, 1
jne 0x140184260
mov rdi, qword [rsp + 0x10]
not al
mov rbx, qword [rsp + 0x20]
movzx eax, al
movzx edx, cl
mov rcx, r11
or rax, rdx
xor rcx, r10
dec rax
shr rax, 0x3f
dec rax
and rax, rcx
xor rax, r11
mov rcx, qword [rsp]
xor rcx, rsp
call fcn.140359070
add rsp, 0x18
ret

Function at 0x1401842f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x20], rax
mov rsi, rdx
movzx eax, r9b
sub al, r8b
mov rcx, rsi
movzx ebx, al
mov rdi, r9
mov edx, ebx
sub rdx, qword [rsi]
add rdx, qword [rsi + 8]
call fcn.1401c4050
mov rcx, qword [rsi + 8]
mov r11b, 1
mov rbp, rcx
sub rcx, qword [rsi]
sub rbp, qword [rsi]
sub rcx, rbx
mov rax, rbp
sub rax, rdi
cmp rax, rbp
je 0x1401843a9
mov rbx, rcx
mov r10, rax
shr rbx, 0x3f
sub r10, rcx
nop word [rax + rax]
mov r8, qword [rsi]
mov rdx, rax
shr rdx, 0x3f
mov r9, r10
movzx ecx, dl
shr r9, 0x3f
xor r9b, dl
xor cl, bl
or r9b, cl
inc r10
xor r9b, dl
lea ecx, [r11 + 1]
movzx edx, byte [r8 + rax]
dec r9b
xor dl, r11b
xor cl, r11b
and dl, r9b
and cl, r9b
xor byte [r8 + rax], dl
xor r11b, cl
inc rax
cmp rax, rbp
jne 0x140184360
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401843d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp], rax
lea rax, [r8 - 3]
mov r10, rdx
cmp rax, 0xfc
jbe 0x140184405
mov rax, r8
mov rcx, qword [rsp]
xor rcx, rsp
call fcn.140359070
add rsp, 0x18
ret
movzx edx, byte [rdx + r8 - 1]
mov qword [rsp + 0x10], rbx
movzx ebx, r8b
movzx eax, bl
sub al, dl
movzx r11d, al
movzx eax, dl
xor al, bl
movzx ecx, r11b
xor cl, bl
or cl, al
lea eax, [rdx - 1]
xor cl, bl
shr al, 7
shr cl, 7
not dl
shr dl, 7
neg cl
and al, dl
neg al
or cl, al
mov eax, ebx
sub rax, 1
je 0x140184493
nop word [rax + rax]
movzx r8d, byte [rax + r10]
mov rdx, rax
shr rdx, 0x3f
dec r8b
xor r8b, byte [rax + r10 - 1]
mov r9, r11
sub r9, rax
shr r9, 0x3f
or r9b, dl
lea edx, [r8 - 1]
neg r9b
shr dl, 7
not r8b
shr r8b, 7
and dl, r8b
dec dl
and r9b, dl
or cl, r9b
sub rax, 1
jne 0x140184450
mov rax, rbx
movzx edx, cl
mov rbx, qword [rsp + 0x10]
xor rax, r11
and rax, rdx
xor rax, r11
mov rcx, qword [rsp]
xor rcx, rsp
call fcn.140359070
add rsp, 0x18
ret
Function at 0x1401b8ac0
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
mov r8, qword [rbx + 0x20]
sub r8, rcx
je 0x1401b8add
xor edx, edx
call fcn.14035c350
xor eax, eax
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x10], rax
mov rcx, qword [rbx + 0x50]
mov r8, qword [rbx + 0x58]
sub r8, rcx
and r8, 0xfffffffffffffffc
je 0x1401b8aff
xor edx, edx
call fcn.14035c350
mov rax, qword [rbx + 0x38]
mov dword [rax], 0x67452301
mov rax, qword [rbx + 0x38]
mov dword [rax + 4], 0xefcdab89
mov rax, qword [rbx + 0x38]
mov dword [rax + 8], 0x98badcfe
mov rax, qword [rbx + 0x38]
mov dword [rax + 0xc], 0x10325476
mov rax, qword [rbx + 0x38]
mov dword [rax + 0x10], 0xc3d2e1f0
add rsp, 0x20
pop rbx
ret
Function at 0x1401bb3b0
Capabilities:
Hash data using sha224

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
mov r8, qword [rbx + 0x20]
sub r8, rcx
je 0x1401bb3cd
xor edx, edx
call fcn.14035c350
xor eax, eax
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x10], rax
mov rax, qword [rbx + 0x38]
mov dword [rax], 0xc1059ed8
mov rax, qword [rbx + 0x38]
mov dword [rax + 4], 0x367cd507
mov rax, qword [rbx + 0x38]
mov dword [rax + 8], 0x3070dd17
mov rax, qword [rbx + 0x38]
mov dword [rax + 0xc], 0xf70e5939
mov rax, qword [rbx + 0x38]
mov dword [rax + 0x10], 0xffc00b31
mov rax, qword [rbx + 0x38]
mov dword [rax + 0x14], 0x68581511
mov rax, qword [rbx + 0x38]
mov dword [rax + 0x18], 0x64f98fa7
mov rax, qword [rbx + 0x38]
mov dword [rax + 0x1c], 0xbefa4fa4
add rsp, 0x20
pop rbx
ret

Function at 0x1401bb470
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
mov r8, qword [rbx + 0x20]
sub r8, rcx
je 0x1401bb48d
xor edx, edx
call fcn.14035c350
xor eax, eax
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x10], rax
mov rax, qword [rbx + 0x38]
mov dword [rax], 0x6a09e667
mov rax, qword [rbx + 0x38]
mov dword [rax + 4], 0xbb67ae85
mov rax, qword [rbx + 0x38]
mov dword [rax + 8], 0x3c6ef372
mov rax, qword [rbx + 0x38]
mov dword [rax + 0xc], 0xa54ff53a
mov rax, qword [rbx + 0x38]
mov dword [rax + 0x10], 0x510e527f
mov rax, qword [rbx + 0x38]
mov dword [rax + 0x14], 0x9b05688c
mov rax, qword [rbx + 0x38]
mov dword [rax + 0x18], 0x1f83d9ab
mov rax, qword [rbx + 0x38]
mov dword [rax + 0x1c], 0x5be0cd19
add rsp, 0x20
pop rbx
ret
Function at 0x1401bf550
Capabilities:
Hash data using sha384

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
mov r8, qword [rbx + 0x20]
sub r8, rcx
je 0x1401bf56d
xor edx, edx
call fcn.14035c350
xor eax, eax
movabs rcx, 0xcbbb9d5dc1059ed8
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x10], rax
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
movabs rcx, 0x629a292a367cd507
mov rax, qword [rbx + 0x38]
mov qword [rax + 8], rcx
movabs rcx, 0x9159015a3070dd17
mov rax, qword [rbx + 0x38]
mov qword [rax + 0x10], rcx
movabs rcx, 0x152fecd8f70e5939
mov rax, qword [rbx + 0x38]
mov qword [rax + 0x18], rcx
movabs rcx, 0x67332667ffc00b31
mov rax, qword [rbx + 0x38]
mov qword [rax + 0x20], rcx
movabs rcx, 0x8eb44a8768581511
mov rax, qword [rbx + 0x38]
mov qword [rax + 0x28], rcx
movabs rcx, 0xdb0c2e0d64f98fa7
mov rax, qword [rbx + 0x38]
mov qword [rax + 0x30], rcx
movabs rcx, 0x47b5481dbefa4fa4
mov rax, qword [rbx + 0x38]
mov qword [rax + 0x38], rcx
add rsp, 0x20
pop rbx
ret

Function at 0x1401bf610
Capabilities:
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
mov r8, qword [rbx + 0x20]
sub r8, rcx
je 0x1401bf62d
xor edx, edx
call fcn.14035c350
xor eax, eax
movabs rcx, 0x6a09e667f3bcc908
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x10], rax
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
movabs rcx, 0xbb67ae8584caa73b
mov rax, qword [rbx + 0x38]
mov qword [rax + 8], rcx
movabs rcx, 0x3c6ef372fe94f82b
mov rax, qword [rbx + 0x38]
mov qword [rax + 0x10], rcx
movabs rcx, 0xa54ff53a5f1d36f1
mov rax, qword [rbx + 0x38]
mov qword [rax + 0x18], rcx
movabs rcx, 0x510e527fade682d1
mov rax, qword [rbx + 0x38]
mov qword [rax + 0x20], rcx
movabs rcx, 0x9b05688c2b3e6c1f
mov rax, qword [rbx + 0x38]
mov qword [rax + 0x28], rcx
movabs rcx, 0x1f83d9abfb41bd6b
mov rax, qword [rbx + 0x38]
mov qword [rax + 0x30], rcx
movabs rcx, 0x5be0cd19137e2179
mov rax, qword [rbx + 0x38]
mov qword [rax + 0x38], rcx
add rsp, 0x20
pop rbx
ret
Function at 0x1401bf6d0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [rbp - 0x79]
mov qword [rbp - 0x79], rax
lea rax, [0x14068aa10]
mov qword [rbp - 0x79], rax
lea rax, vtable.System_RNG_Impl.0
mov qword [0x14068aa10], rax
xor r12d, r12d
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], r12b
lea r8d, [r12 + 0xc]
lea rdx, [0x140605228]
lea rcx, [rsp + 0x20]
call fcn.140073120
nop
lea r13, [0x14068aa18]
mov qword [rbp - 0x71], r13
mov qword [0x14068aa18], r12
mov qword [0x14068aa28], r12
mov qword [0x14068aa30], r12
lea r14, [rsp + 0x20]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x38]
cmp rsi, 0x10
cmovae r14, rbx
mov r15, qword [rsp + 0x30]
cmp r15, 0x10
jae 0x1401bf79b
movups xmm0, xmmword [r14]
movups xmmword [0x14068aa18], xmm0
lea edi, [r12 + 0xf]
jmp 0x1401bf7d3
mov rdi, r15
or rdi, 0xf
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
call fcn.140073800
mov qword [0x14068aa18], rax
lea r8, [r15 + 1]
mov rdx, r14
mov rcx, rax
call fcn.14035bc80
nop
mov qword [0x14068aa28], r15
mov qword [0x14068aa30], rdi
mov qword [0x14068aa38], r12
mov rcx, r13
cmp rdi, 0x10
cmovae rcx, qword [0x14068aa18]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14068aa38], rax
test rax, rax
je 0x1401bf90a
cmp rsi, 0x10
jb 0x1401bf844
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1401bf83c
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401bf91a
mov rcx, rbx
call fcn.140359090
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov r8d, 0x11
lea rdx, str.SystemFunction036
lea rcx, [rsp + 0x20]
call fcn.140073120
nop
lea rdx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0x10
cmovae rdx, qword [rsp + 0x20]
mov rcx, qword [0x14068aa38]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1401bf920
mov qword [0x14068aa40], rax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x1401bf8dc
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401bf8d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1401bf904
call fcn.140359090
nop
lea rax, [0x14068aa10]
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140368068
nop
lea rdx, str.LoadLibrary_failed
mov rcx, r13
call fcn.14017cb60
nop
call fcn.140368068
nop
lea r8, [rsp + 0x20]
lea rdx, str.Failed_to_resolve_symbol
lea rcx, [rbp - 0x31]
call fcn.1400b6540
nop
lea r8, str._in
mov rdx, rax
lea rcx, [rbp - 0x11]
call fcn.1400b8130
nop
lea r8, [0x14068aa18]
mov rdx, rax
lea rcx, [rbp + 0xf]
call fcn.1400b54f0
nop
mov rdx, rax
lea rcx, [rbp - 0x69]
call fcn.1401c04a0
lea rdx, [0x1406695a0]
lea rcx, [rbp - 0x69]
call fcn.14035c4f0
int3
Function at 0x1401bfdb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, r9
mov r12, r8
movzx ebx, dl
mov r14, rcx
mov qword [rsp + 0x20], rcx
xor ebp, ebp
test r9, r9
jne 0x1401bfdfb
mov qword [rcx], rbp
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
jmp 0x1401bff68
mov r15, rsi
xor r15, qword [rsp + 0xc0]
mov rax, rsi
sub rax, qword [rsp + 0xc0]
xor rax, rsi
or rax, r15
xor rax, rsi
shr rax, 0x3f
neg rax
not rax
and r15, rax
xor r15, rsi
mov r13, rsi
sub r13, r15
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
mov qword [rsp + 0x50], rbp
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
ja 0x1401bffac
lfence
mov edx, 1
mov rcx, rsi
call fcn.140371340
test rax, rax
je 0x1401bff90
mov qword [rsp + 0x40], rax
lea rdi, [rsi + rax]
mov qword [rsp + 0x50], rdi
mov r8, rsi
xor edx, edx
mov rcx, rax
call fcn.14035c350
mov qword [rsp + 0x48], rdi
mov r9, rbp
nop dword [rax]
mov rax, r9
cmp r9, rsi
je 0x1401bfecf
nop dword [rax + rax]
lea rdx, [r9 + r15]
xor rdx, rax
mov r8, qword [rsp + 0x40]
lea rcx, [rdx - 1]
shr rcx, 0x3f
not rdx
shr rdx, 0x3f
and cl, dl
neg cl
and cl, byte [rax + r12]
or byte [r8 + r9], cl
inc rax
cmp rax, rsi
jne 0x1401bfea0
inc r9
cmp r9, rsi
jne 0x1401bfe90
mov r9, qword [rsp + 0x48]
mov rax, r9
mov rcx, qword [rsp + 0x40]
sub rax, rcx
je 0x1401bff05
not bl
nop dword [rax + rax]
and byte [rcx + rbp], bl
inc rbp
cmp rbp, rax
jne 0x1401bfef0
mov r9, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rdx, r9
sub rdx, rcx
cmp r13, rdx
jae 0x1401bff16
lea r9, [rcx + r13]
jmp 0x1401bff58
jbe 0x1401bff58
mov rax, qword [rsp + 0x50]
sub rax, rcx
cmp r13, rax
jbe 0x1401bff3c
lfence
mov rdx, r13
lea rcx, [rsp + 0x40]
call fcn.1401c9860
mov r9, qword [rsp + 0x48]
jmp 0x1401bff53
sub r13, rdx
lea rbx, [r9 + r13]
mov r8, r13
xor edx, edx
mov rcx, r9
call fcn.14035c350
mov r9, rbx
mov rcx, qword [rsp + 0x40]
mov qword [r14], rcx
mov qword [r14 + 8], r9
mov rax, qword [rsp + 0x50]
mov qword [r14 + 0x10], rax
mov rax, r14
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rsp + 0x28]
call fcn.140160250
lea rdx, [0x140669ad8]
lea rcx, [rsp + 0x28]
call fcn.14035c4f0
int3
call fcn.1400710c0
int3
Function at 0x1401c2cd0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x18
mov r9, qword [r8 + 8]
xor al, al
movsx r10d, dl
mov r11, rcx
mov rcx, qword [r8]
mov rdx, r9
sub rdx, rcx
xor r8d, r8d
cmp rcx, r9
movd xmm2, r10d
punpcklbw xmm2, xmm2
cmova rdx, r8
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
test rdx, rdx
je 0x1401c2dc6
cmp rdx, 0x20
jb 0x1401c2dc6
movdqa xmm5, xmmword [0x14060afa0]
and rdx, 0xffffffffffffffe0
movaps xmmword [rsp], xmm6
xorps xmm4, xmm4
movdqa xmm6, xmmword [0x14060b000]
xorps xmm3, xmm3
nop word [rax + rax]
movdqu xmm1, xmmword [rcx]
add r8, 0x20
pxor xmm1, xmm2
movdqa xmm0, xmm1
pandn xmm1, xmm6
psubb xmm0, xmm5
pand xmm0, xmm1
movdqu xmm1, xmmword [rcx + 0x10]
add rcx, 0x20
por xmm4, xmm0
pxor xmm1, xmm2
movdqa xmm0, xmm1
pandn xmm1, xmm6
psubb xmm0, xmm5
pand xmm0, xmm1
por xmm3, xmm0
cmp r8, rdx
jne 0x1401c2d40
movaps xmm6, xmmword [rsp]
por xmm3, xmm4
movdqa xmm0, xmm3
psrldq xmm0, 8
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 4
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 2
por xmm3, xmm0
movdqa xmm0, xmm3
psrldq xmm0, 1
por xmm3, xmm0
movd eax, xmm3
cmp rcx, r9
je 0x1401c2deb
nop dword [rax + rax]
movzx r8d, r10b
xor r8b, byte [rcx]
inc rcx
lea edx, [r8 - 1]
not r8b
and dl, r8b
or al, dl
cmp rcx, r9
jne 0x1401c2dd0
shr al, 7
neg al
mov byte [r11], al
mov rax, r11
add rsp, 0x18
ret
Function at 0x1401c3830
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r10, qword [rsp + 0x30]
mov rbx, rcx
xor ecx, ecx
mov r11, rdx
test r10, r10
je 0x1401c399e
cmp r10, 8
jb 0x1401c396c
movq xmm3, qword [rbx]
lea rax, [r10 - 1]
lea rax, [r8 + rax*8]
punpcklqdq xmm3, xmm3
lea rdx, [r10 - 1]
lea rdx, [r11 + rdx*8]
cmp r11, rax
ja 0x1401c3878
cmp rdx, r8
jae 0x1401c396c
lea rax, [r10 - 1]
lea rax, [r9 + rax*8]
cmp r11, rax
ja 0x1401c388e
cmp rdx, r9
jae 0x1401c396c
cmp r11, rbx
ja 0x1401c389c
cmp rdx, rbx
jae 0x1401c396c
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov rsi, r10
and rsi, 0xfffffffffffffff8
mov qword [rsp + 0x20], rdi
mov rax, r9
lea rdi, [r8 + 0x10]
sub rax, r8
mov rdx, r11
sub rdx, r8
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rax + rdi - 0x10]
add rcx, 8
movdqu xmm2, xmmword [rax + rdi]
movdqu xmm1, xmmword [rdi - 0x10]
lea rdi, [rdi + 0x40]
pxor xmm1, xmm0
pand xmm1, xmm3
pxor xmm1, xmm0
movdqu xmm0, xmmword [rdi - 0x40]
movdqu xmmword [rdx + rdi - 0x50], xmm1
movdqa xmm1, xmm2
pxor xmm1, xmm0
pand xmm1, xmm3
pxor xmm1, xmm2
movdqu xmm0, xmmword [rax + rdi - 0x30]
movdqu xmmword [rdx + rdi - 0x40], xmm1
movdqu xmm1, xmmword [rdi - 0x30]
pxor xmm1, xmm0
pand xmm1, xmm3
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax + rdi - 0x20]
movdqu xmmword [rdx + rdi - 0x30], xmm1
movdqu xmm1, xmmword [rdi - 0x20]
pxor xmm1, xmm0
pand xmm1, xmm3
pxor xmm1, xmm0
movdqu xmmword [rdx + rdi - 0x20], xmm1
cmp rcx, rsi
jne 0x1401c38d0
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x10]
cmp rcx, r10
je 0x1401c399e
sub r9, r8
lea rax, [r8 + rcx*8]
sub r11, r8
sub r10, rcx
nop dword [rax]
mov rdx, qword [r9 + rax]
xor rdx, qword [rax]
lea rax, [rax + 8]
and rdx, qword [rbx]
xor rdx, qword [r9 + rax - 8]
mov qword [r11 + rax - 8], rdx
sub r10, 1
jne 0x1401c3980
pop rbx
ret

Function at 0x1401c3e30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, r9
mov rdi, rcx
shl rsi, 4
mov rdx, rbp
mov r8, rsi
mov rcx, r14
mov rbx, r9
call fcn.1401606d0
mov rax, qword [rdi]
mov r9, rbx
mov r8, r14
mov rdx, r14
mov rcx, rdi
mov rax, qword [rax + 0x40]
call qword [case.0x1401cd220.0]
mov r8, rsi
mov rdx, rbp
mov rcx, r14
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
jmp fcn.1401606d0
Function at 0x1401c4e10
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x40], r8
mov r14, r8
mov r13, rdx
mov r15, rcx
cmp rdx, r8
je 0x1401c4f51
cmp qword [rdx + 0x28], 0x10
lea r8, [rdx + 0x10]
mov r10, qword [rcx + 0x18]
mov qword [rax + 0x10], rbx
mov rbx, rdx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x28], r12
mov rax, qword [rcx + 8]
mov qword [rsp + 0x30], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x48], r10
jb 0x1401c4e75
mov r8, qword [rdx + 0x10]
mov r9, qword [r13 + 0x20]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
movabs r11, 0x100000001b3
test r9, r9
je 0x1401c4eb4
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + r8]
inc rcx
xor rdx, rax
imul rdx, r11
cmp rcx, r9
jb 0x1401c4ea0
mov r12, qword [r15 + 0x30]
and r12, rdx
shl r12, 4
add r12, r10
mov rax, qword [r12]
mov qword [rsp + 0x28], rax
mov rax, qword [r12 + 8]
mov qword [rsp + 0x38], rax
nop word [rax + rax]
mov rsi, rbx
mov rbp, rbx
mov rbx, qword [rbx]
lea rcx, [rsi + 0x30]
call fcn.140073500
lea rcx, [rsi + 0x10]
call fcn.140073500
mov edx, 0x50
mov rcx, rsi
call fcn.140359090
dec qword [r15 + 0x10]
cmp rsi, qword [rsp + 0x38]
je 0x1401c4f5f
cmp rbx, r14
jne 0x1401c4ee0
cmp qword [rsp + 0x28], r13
jne 0x1401c4f23
mov qword [r12], rbx
mov rax, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x98]
mov rbp, qword [rsp + 0x90]
mov r12, qword [rsp + 0x50]
mov qword [rax], rbx
mov qword [rbx + 8], rax
mov rbx, qword [rsp + 0x88]
mov rax, r14
add rsp, 0x60
pop r15
pop r14
pop r13
ret
cmp qword [rsp + 0x28], r13
jne 0x1401c4f71
mov rax, qword [rsp + 0x30]
mov qword [r12], rax
jmp 0x1401c4f76
mov rax, qword [rsp + 0x20]
mov qword [r12 + 8], rax
cmp rbx, r14
je 0x1401c4f23
cmp qword [rbx + 0x28], 0x10
lea r8, [rbx + 0x10]
jb 0x1401c4f8f
mov r8, qword [rbx + 0x10]
mov r9, qword [rbx + 0x20]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
test r9, r9
je 0x1401c4fc9
movabs r14, 0x100000001b3
nop
movzx eax, byte [rdx + r8]
inc rdx
xor rcx, rax
imul rcx, r14
cmp rdx, r9
jb 0x1401c4fb0
mov r14, qword [rsp + 0x40]
mov r12, qword [r15 + 0x30]
and r12, rcx
shl r12, 4
add r12, qword [rsp + 0x48]
mov r13, qword [r12 + 8]
nop
mov rsi, rbx
mov rbp, rbx
mov rbx, qword [rbx]
lea rcx, [rsi + 0x30]
call fcn.140073500
lea rcx, [rsi + 0x10]
call fcn.140073500
mov edx, 0x50
mov rcx, rsi
call fcn.140359090
dec qword [r15 + 0x10]
cmp rsi, r13
je 0x1401c501b
cmp rbx, r14
jne 0x1401c4fe0
jmp 0x1401c4f1f
mov rcx, qword [rsp + 0x30]
mov qword [r12], rcx
mov qword [r12 + 8], rcx
cmp rbx, r14
jne 0x1401c4f80
jmp 0x1401c4f23