joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e1e0
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x98]
xor edi, edi
test rcx, rcx
je 0x14000e24b
mov edx, 0x1388
mov dword [rbx + 0x18], 1
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x14000e237
mov rcx, qword [rbx + 0x98]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov edx, dword [rsp + 0x30]
mov rcx, qword [rbx + 0x98]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x98]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x98], rdi
mov rcx, qword [rbx + 0x88]
test rcx, rcx
je 0x14000e263
call fcn.14000f48c
mov qword [rbx + 0x88], rdi
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x14000e276
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbx + 0x78], rdi
mov rcx, qword [rbx + 0x80]
test rcx, rcx
je 0x14000e28f
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov qword [rbx + 0x80], rdi
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x14000e29e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x14000e2ad
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000e2bc
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14000e2cb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14002dc30
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp - 0x38]
movsxd rax, r9d
test rax, rax
jle 0x14002dd91
cmp r9d, 6
jle 0x14002dd75
cmp r8, rdx
jbe 0x14002dc5b
mov r10, r8
sub r10, rdx
cmp rax, r10
jle 0x14002dc73
cmp rdx, r8
jbe 0x14002dd75
mov r10, rdx
sub r10, r8
cmp rax, r10
jg 0x14002dd75
cmp r8, rcx
jbe 0x14002dc83
mov r10, r8
sub r10, rcx
cmp rax, r10
jle 0x14002dc9b
cmp rcx, r8
jbe 0x14002dd75
mov r10, rcx
sub r10, r8
cmp rax, r10
jg 0x14002dd75
mov r10, r8
and r10, 0xf
mov r11, r10
neg r11
add r11, 0x10
test r10, r10
cmovne r10, r11
mov r11, r10
add r11, 0x10
cmp rax, r11
jl 0x14002dd97
mov r11d, r10d
neg r11d
add r11d, r9d
and r11d, 0xf
sub r9d, r11d
xor r11d, r11d
movsxd r9, r9d
test r10, r10
jbe 0x14002dd0a
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
movzx esi, byte [r11 + rcx]
movzx ebx, byte [r11 + rdx]
xor esi, ebx
mov byte [r11 + r8], sil
inc r11
cmp r11, r10
jb 0x14002dce8
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
mov r11, r10
add r11, rdx
test r11, 0xf
je 0x14002dd3a
movdqu xmm1, xmmword [r10 + rcx]
lddqu xmm0, xmmword [r10 + rdx]
pxor xmm1, xmm0
movdqa xmmword [r10 + r8], xmm1
add r10, 0x10
cmp r10, r9
jb 0x14002dd19
jmp 0x14002dd55
movdqu xmm0, xmmword [r10 + rcx]
pxor xmm0, xmmword [r10 + rdx]
movdqa xmmword [r10 + r8], xmm0
add r10, 0x10
cmp r10, r9
jb 0x14002dd3a
cmp r9, rax
jae 0x14002dd91
movzx r11d, byte [r9 + rcx]
movzx r10d, byte [r9 + rdx]
xor r11d, r10d
mov byte [r9 + r8], r11b
inc r9
cmp r9, rax
jb 0x14002dd5a
jmp 0x14002dd91
xor r9d, r9d
movzx r11d, byte [r9 + rcx]
movzx r10d, byte [r9 + rdx]
xor r11d, r10d
mov byte [r9 + r8], r11b
inc r9
cmp r9, rax
jb 0x14002dd78
lea rsp, [rsp + 0x38]
ret
xor r9d, r9d
jmp 0x14002dd55
Function at 0x14002dcde
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp - 0x38]
movsxd rax, r9d
test rax, rax
jle 0x14002dd91
cmp r9d, 6
jle 0x14002dd75
cmp r8, rdx
jbe 0x14002dc5b
mov r10, r8
sub r10, rdx
cmp rax, r10
jle 0x14002dc73
cmp rdx, r8
jbe 0x14002dd75
mov r10, rdx
sub r10, r8
cmp rax, r10
jg 0x14002dd75
cmp r8, rcx
jbe 0x14002dc83
mov r10, r8
sub r10, rcx
cmp rax, r10
jle 0x14002dc9b
cmp rcx, r8
jbe 0x14002dd75
mov r10, rcx
sub r10, r8
cmp rax, r10
jg 0x14002dd75
mov r10, r8
and r10, 0xf
mov r11, r10
neg r11
add r11, 0x10
test r10, r10
cmovne r10, r11
mov r11, r10
add r11, 0x10
cmp rax, r11
jl 0x14002dd97
mov r11d, r10d
neg r11d
add r11d, r9d
and r11d, 0xf
sub r9d, r11d
xor r11d, r11d
movsxd r9, r9d
test r10, r10
jbe 0x14002dd0a
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
movzx esi, byte [r11 + rcx]
movzx ebx, byte [r11 + rdx]
xor esi, ebx
mov byte [r11 + r8], sil
inc r11
cmp r11, r10
jb 0x14002dce8
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
mov r11, r10
add r11, rdx
test r11, 0xf
je 0x14002dd3a
movdqu xmm1, xmmword [r10 + rcx]
lddqu xmm0, xmmword [r10 + rdx]
pxor xmm1, xmm0
movdqa xmmword [r10 + r8], xmm1
add r10, 0x10
cmp r10, r9
jb 0x14002dd19
jmp 0x14002dd55
movdqu xmm0, xmmword [r10 + rcx]
pxor xmm0, xmmword [r10 + rdx]
movdqa xmmword [r10 + r8], xmm0
add r10, 0x10
cmp r10, r9
jb 0x14002dd3a
cmp r9, rax
jae 0x14002dd91
movzx r11d, byte [r9 + rcx]
movzx r10d, byte [r9 + rdx]
xor r11d, r10d
mov byte [r9 + r8], r11b
inc r9
cmp r9, rax
jb 0x14002dd5a
jmp 0x14002dd91
xor r9d, r9d
movzx r11d, byte [r9 + rcx]
movzx r10d, byte [r9 + rdx]
xor r11d, r10d
mov byte [r9 + r8], r11b
inc r9
cmp r9, rax
jb 0x14002dd78
lea rsp, [rsp + 0x38]
ret
xor r9d, r9d
jmp 0x14002dd55
Function at 0x14002dd0a
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp - 0x38]
movsxd rax, r9d
test rax, rax
jle 0x14002dd91
cmp r9d, 6
jle 0x14002dd75
cmp r8, rdx
jbe 0x14002dc5b
mov r10, r8
sub r10, rdx
cmp rax, r10
jle 0x14002dc73
cmp rdx, r8
jbe 0x14002dd75
mov r10, rdx
sub r10, r8
cmp rax, r10
jg 0x14002dd75
cmp r8, rcx
jbe 0x14002dc83
mov r10, r8
sub r10, rcx
cmp rax, r10
jle 0x14002dc9b
cmp rcx, r8
jbe 0x14002dd75
mov r10, rcx
sub r10, r8
cmp rax, r10
jg 0x14002dd75
mov r10, r8
and r10, 0xf
mov r11, r10
neg r11
add r11, 0x10
test r10, r10
cmovne r10, r11
mov r11, r10
add r11, 0x10
cmp rax, r11
jl 0x14002dd97
mov r11d, r10d
neg r11d
add r11d, r9d
and r11d, 0xf
sub r9d, r11d
xor r11d, r11d
movsxd r9, r9d
test r10, r10
jbe 0x14002dd0a
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
movzx esi, byte [r11 + rcx]
movzx ebx, byte [r11 + rdx]
xor esi, ebx
mov byte [r11 + r8], sil
inc r11
cmp r11, r10
jb 0x14002dce8
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
mov r11, r10
add r11, rdx
test r11, 0xf
je 0x14002dd3a
movdqu xmm1, xmmword [r10 + rcx]
lddqu xmm0, xmmword [r10 + rdx]
pxor xmm1, xmm0
movdqa xmmword [r10 + r8], xmm1
add r10, 0x10
cmp r10, r9
jb 0x14002dd19
jmp 0x14002dd55
movdqu xmm0, xmmword [r10 + rcx]
pxor xmm0, xmmword [r10 + rdx]
movdqa xmmword [r10 + r8], xmm0
add r10, 0x10
cmp r10, r9
jb 0x14002dd3a
cmp r9, rax
jae 0x14002dd91
movzx r11d, byte [r9 + rcx]
movzx r10d, byte [r9 + rdx]
xor r11d, r10d
mov byte [r9 + r8], r11b
inc r9
cmp r9, rax
jb 0x14002dd5a
jmp 0x14002dd91
xor r9d, r9d
movzx r11d, byte [r9 + rcx]
movzx r10d, byte [r9 + rdx]
xor r11d, r10d
mov byte [r9 + r8], r11b
inc r9
cmp r9, rax
jb 0x14002dd78
lea rsp, [rsp + 0x38]
ret
xor r9d, r9d
jmp 0x14002dd55
Function at 0x14002e0b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
movsxd rax, r9d
test rax, rax
jle 0x14002e20b
cmp r9d, 6
jle 0x14002e1ef
cmp r8, rdx
jbe 0x14002e0da
mov r10, r8
sub r10, rdx
cmp rax, r10
jle 0x14002e0f2
cmp rdx, r8
jbe 0x14002e1ef
mov r10, rdx
sub r10, r8
cmp rax, r10
jg 0x14002e1ef
cmp r8, rcx
jbe 0x14002e102
mov r10, r8
sub r10, rcx
cmp rax, r10
jle 0x14002e11a
cmp rcx, r8
jbe 0x14002e1ef
mov r10, rcx
sub r10, r8
cmp rax, r10
jg 0x14002e1ef
mov r10, r8
and r10, 0xf
mov r11, r10
neg r11
add r11, 0x10
test r10, r10
cmovne r10, r11
lea r11, [r10 + 0x10]
cmp rax, r11
jl 0x14002e210
mov r11d, r10d
neg r11d
add r11d, r9d
and r11d, 0xf
sub r9d, r11d
xor r11d, r11d
movsxd r9, r9d
test r10, r10
jbe 0x14002e186
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
movzx esi, byte [r11 + rcx]
movzx ebx, byte [r11 + rdx]
xor esi, ebx
mov byte [r11 + r8], sil
inc r11
cmp r11, r10
jb 0x14002e164
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
lea r11, [r10 + rdx]
test r11, 0xf
je 0x14002e1b4
movdqu xmm1, xmmword [r10 + rcx]
lddqu xmm0, xmmword [r10 + rdx]
pxor xmm1, xmm0
movdqa xmmword [r10 + r8], xmm1
add r10, 0x10
cmp r10, r9
jb 0x14002e193
jmp 0x14002e1cf
movdqu xmm0, xmmword [r10 + rcx]
pxor xmm0, xmmword [r10 + rdx]
movdqa xmmword [r10 + r8], xmm0
add r10, 0x10
cmp r10, r9
jb 0x14002e1b4
cmp r9, rax
jae 0x14002e20b
movzx r11d, byte [r9 + rcx]
movzx r10d, byte [r9 + rdx]
xor r11d, r10d
mov byte [r9 + r8], r11b
inc r9
cmp r9, rax
jb 0x14002e1d4
jmp 0x14002e20b
xor r9d, r9d
movzx r11d, byte [r9 + rcx]
movzx r10d, byte [r9 + rdx]
xor r11d, r10d
mov byte [r9 + r8], r11b
inc r9
cmp r9, rax
jb 0x14002e1f2
add rsp, 0x38
ret
xor r9d, r9d
jmp 0x14002e1cf
Function at 0x14002e15a
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
movsxd rax, r9d
test rax, rax
jle 0x14002e20b
cmp r9d, 6
jle 0x14002e1ef
cmp r8, rdx
jbe 0x14002e0da
mov r10, r8
sub r10, rdx
cmp rax, r10
jle 0x14002e0f2
cmp rdx, r8
jbe 0x14002e1ef
mov r10, rdx
sub r10, r8
cmp rax, r10
jg 0x14002e1ef
cmp r8, rcx
jbe 0x14002e102
mov r10, r8
sub r10, rcx
cmp rax, r10
jle 0x14002e11a
cmp rcx, r8
jbe 0x14002e1ef
mov r10, rcx
sub r10, r8
cmp rax, r10
jg 0x14002e1ef
mov r10, r8
and r10, 0xf
mov r11, r10
neg r11
add r11, 0x10
test r10, r10
cmovne r10, r11
lea r11, [r10 + 0x10]
cmp rax, r11
jl 0x14002e210
mov r11d, r10d
neg r11d
add r11d, r9d
and r11d, 0xf
sub r9d, r11d
xor r11d, r11d
movsxd r9, r9d
test r10, r10
jbe 0x14002e186
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
movzx esi, byte [r11 + rcx]
movzx ebx, byte [r11 + rdx]
xor esi, ebx
mov byte [r11 + r8], sil
inc r11
cmp r11, r10
jb 0x14002e164
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
lea r11, [r10 + rdx]
test r11, 0xf
je 0x14002e1b4
movdqu xmm1, xmmword [r10 + rcx]
lddqu xmm0, xmmword [r10 + rdx]
pxor xmm1, xmm0
movdqa xmmword [r10 + r8], xmm1
add r10, 0x10
cmp r10, r9
jb 0x14002e193
jmp 0x14002e1cf
movdqu xmm0, xmmword [r10 + rcx]
pxor xmm0, xmmword [r10 + rdx]
movdqa xmmword [r10 + r8], xmm0
add r10, 0x10
cmp r10, r9
jb 0x14002e1b4
cmp r9, rax
jae 0x14002e20b
movzx r11d, byte [r9 + rcx]
movzx r10d, byte [r9 + rdx]
xor r11d, r10d
mov byte [r9 + r8], r11b
inc r9
cmp r9, rax
jb 0x14002e1d4
jmp 0x14002e20b
xor r9d, r9d
movzx r11d, byte [r9 + rcx]
movzx r10d, byte [r9 + rdx]
xor r11d, r10d
mov byte [r9 + r8], r11b
inc r9
cmp r9, rax
jb 0x14002e1f2
add rsp, 0x38
ret
xor r9d, r9d
jmp 0x14002e1cf
Function at 0x14002e186
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
movsxd rax, r9d
test rax, rax
jle 0x14002e20b
cmp r9d, 6
jle 0x14002e1ef
cmp r8, rdx
jbe 0x14002e0da
mov r10, r8
sub r10, rdx
cmp rax, r10
jle 0x14002e0f2
cmp rdx, r8
jbe 0x14002e1ef
mov r10, rdx
sub r10, r8
cmp rax, r10
jg 0x14002e1ef
cmp r8, rcx
jbe 0x14002e102
mov r10, r8
sub r10, rcx
cmp rax, r10
jle 0x14002e11a
cmp rcx, r8
jbe 0x14002e1ef
mov r10, rcx
sub r10, r8
cmp rax, r10
jg 0x14002e1ef
mov r10, r8
and r10, 0xf
mov r11, r10
neg r11
add r11, 0x10
test r10, r10
cmovne r10, r11
lea r11, [r10 + 0x10]
cmp rax, r11
jl 0x14002e210
mov r11d, r10d
neg r11d
add r11d, r9d
and r11d, 0xf
sub r9d, r11d
xor r11d, r11d
movsxd r9, r9d
test r10, r10
jbe 0x14002e186
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
movzx esi, byte [r11 + rcx]
movzx ebx, byte [r11 + rdx]
xor esi, ebx
mov byte [r11 + r8], sil
inc r11
cmp r11, r10
jb 0x14002e164
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
lea r11, [r10 + rdx]
test r11, 0xf
je 0x14002e1b4
movdqu xmm1, xmmword [r10 + rcx]
lddqu xmm0, xmmword [r10 + rdx]
pxor xmm1, xmm0
movdqa xmmword [r10 + r8], xmm1
add r10, 0x10
cmp r10, r9
jb 0x14002e193
jmp 0x14002e1cf
movdqu xmm0, xmmword [r10 + rcx]
pxor xmm0, xmmword [r10 + rdx]
movdqa xmmword [r10 + r8], xmm0
add r10, 0x10
cmp r10, r9
jb 0x14002e1b4
cmp r9, rax
jae 0x14002e20b
movzx r11d, byte [r9 + rcx]
movzx r10d, byte [r9 + rdx]
xor r11d, r10d
mov byte [r9 + r8], r11b
inc r9
cmp r9, rax
jb 0x14002e1d4
jmp 0x14002e20b
xor r9d, r9d
movzx r11d, byte [r9 + rcx]
movzx r10d, byte [r9 + rdx]
xor r11d, r10d
mov byte [r9 + r8], r11b
inc r9
cmp r9, rax
jb 0x14002e1f2
add rsp, 0x38
ret
xor r9d, r9d
jmp 0x14002e1cf
Function at 0x14002e520
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
movsxd rax, r9d
test rax, rax
jle 0x14002e64d
cmp r9d, 6
jle 0x14002e631
cmp r8, rdx
jbe 0x14002e54a
mov r10, r8
sub r10, rdx
cmp rax, r10
jle 0x14002e562
cmp rdx, r8
jbe 0x14002e631
mov r10, rdx
sub r10, r8
cmp rax, r10
jg 0x14002e631
cmp r8, rcx
jbe 0x14002e572
mov r10, r8
sub r10, rcx
cmp rax, r10
jle 0x14002e58a
cmp rcx, r8
jbe 0x14002e631
mov r10, rcx
sub r10, r8
cmp rax, r10
jg 0x14002e631
mov r10, r8
and r10, 0x1f
mov r11, r10
neg r11
add r11, 0x20
test r10, r10
cmovne r10, r11
lea r11, [r10 + 0x10]
cmp rax, r11
jl 0x14002e652
mov r11d, r10d
neg r11d
add r11d, r9d
and r11d, 0xf
sub r9d, r11d
xor r11d, r11d
movsxd r9, r9d
test r10, r10
jbe 0x14002e5f6
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
movzx esi, byte [r11 + rcx]
movzx ebx, byte [r11 + rdx]
xor esi, ebx
mov byte [r11 + r8], sil
inc r11
cmp r11, r10
jb 0x14002e5d4
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
vmovdqu xmm0, xmmword [r10 + rcx]
vpxor xmm1, xmm0, xmmword [r10 + rdx]
vmovdqu xmmword [r10 + r8], xmm1
add r10, 0x10
cmp r10, r9
jb 0x14002e5f6
cmp r9, rax
jae 0x14002e64d
movzx r11d, byte [r9 + rcx]
movzx r10d, byte [r9 + rdx]
xor r11d, r10d
mov byte [r9 + r8], r11b
inc r9
cmp r9, rax
jb 0x14002e616
jmp 0x14002e64d
xor r9d, r9d
movzx r11d, byte [r9 + rcx]
movzx r10d, byte [r9 + rdx]
xor r11d, r10d
mov byte [r9 + r8], r11b
inc r9
cmp r9, rax
jb 0x14002e634
add rsp, 0x38
ret
xor r9d, r9d
jmp 0x14002e611

Function at 0x14002e5ca
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
movsxd rax, r9d
test rax, rax
jle 0x14002e64d
cmp r9d, 6
jle 0x14002e631
cmp r8, rdx
jbe 0x14002e54a
mov r10, r8
sub r10, rdx
cmp rax, r10
jle 0x14002e562
cmp rdx, r8
jbe 0x14002e631
mov r10, rdx
sub r10, r8
cmp rax, r10
jg 0x14002e631
cmp r8, rcx
jbe 0x14002e572
mov r10, r8
sub r10, rcx
cmp rax, r10
jle 0x14002e58a
cmp rcx, r8
jbe 0x14002e631
mov r10, rcx
sub r10, r8
cmp rax, r10
jg 0x14002e631
mov r10, r8
and r10, 0x1f
mov r11, r10
neg r11
add r11, 0x20
test r10, r10
cmovne r10, r11
lea r11, [r10 + 0x10]
cmp rax, r11
jl 0x14002e652
mov r11d, r10d
neg r11d
add r11d, r9d
and r11d, 0xf
sub r9d, r11d
xor r11d, r11d
movsxd r9, r9d
test r10, r10
jbe 0x14002e5f6
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
movzx esi, byte [r11 + rcx]
movzx ebx, byte [r11 + rdx]
xor esi, ebx
mov byte [r11 + r8], sil
inc r11
cmp r11, r10
jb 0x14002e5d4
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
vmovdqu xmm0, xmmword [r10 + rcx]
vpxor xmm1, xmm0, xmmword [r10 + rdx]
vmovdqu xmmword [r10 + r8], xmm1
add r10, 0x10
cmp r10, r9
jb 0x14002e5f6
cmp r9, rax
jae 0x14002e64d
movzx r11d, byte [r9 + rcx]
movzx r10d, byte [r9 + rdx]
xor r11d, r10d
mov byte [r9 + r8], r11b
inc r9
cmp r9, rax
jb 0x14002e616
jmp 0x14002e64d
xor r9d, r9d
movzx r11d, byte [r9 + rcx]
movzx r10d, byte [r9 + rdx]
xor r11d, r10d
mov byte [r9 + r8], r11b
inc r9
cmp r9, rax
jb 0x14002e634
add rsp, 0x38
ret
xor r9d, r9d
jmp 0x14002e611
Function at 0x14002e5f6
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
movsxd rax, r9d
test rax, rax
jle 0x14002e64d
cmp r9d, 6
jle 0x14002e631
cmp r8, rdx
jbe 0x14002e54a
mov r10, r8
sub r10, rdx
cmp rax, r10
jle 0x14002e562
cmp rdx, r8
jbe 0x14002e631
mov r10, rdx
sub r10, r8
cmp rax, r10
jg 0x14002e631
cmp r8, rcx
jbe 0x14002e572
mov r10, r8
sub r10, rcx
cmp rax, r10
jle 0x14002e58a
cmp rcx, r8
jbe 0x14002e631
mov r10, rcx
sub r10, r8
cmp rax, r10
jg 0x14002e631
mov r10, r8
and r10, 0x1f
mov r11, r10
neg r11
add r11, 0x20
test r10, r10
cmovne r10, r11
lea r11, [r10 + 0x10]
cmp rax, r11
jl 0x14002e652
mov r11d, r10d
neg r11d
add r11d, r9d
and r11d, 0xf
sub r9d, r11d
xor r11d, r11d
movsxd r9, r9d
test r10, r10
jbe 0x14002e5f6
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
movzx esi, byte [r11 + rcx]
movzx ebx, byte [r11 + rdx]
xor esi, ebx
mov byte [r11 + r8], sil
inc r11
cmp r11, r10
jb 0x14002e5d4
mov rbx, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
vmovdqu xmm0, xmmword [r10 + rcx]
vpxor xmm1, xmm0, xmmword [r10 + rdx]
vmovdqu xmmword [r10 + r8], xmm1
add r10, 0x10
cmp r10, r9
jb 0x14002e5f6
cmp r9, rax
jae 0x14002e64d
movzx r11d, byte [r9 + rcx]
movzx r10d, byte [r9 + rdx]
xor r11d, r10d
mov byte [r9 + r8], r11b
inc r9
cmp r9, rax
jb 0x14002e616
jmp 0x14002e64d
xor r9d, r9d
movzx r11d, byte [r9 + rcx]
movzx r10d, byte [r9 + rdx]
xor r11d, r10d
mov byte [r9 + r8], r11b
inc r9
cmp r9, rax
jb 0x14002e634
add rsp, 0x38
ret
xor r9d, r9d
jmp 0x14002e611
Function at 0x140006000
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140006042
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x14000604a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14000605b
jmp 0x140006072
xor r10d, r10d
jmp 0x1400060fd
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140006072
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140006089
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x1400060a9
add r11, r8
jmp 0x1400061da
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140006172
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140006120
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x140006190
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x1400061a2
jmp 0x1400061bc
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x1400061bc
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x1400061d6
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14002eed0
Capabilities:
Encode data using base64
Encode data using xor
Encrypt data using chaskey
Hash data using fnv

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4f8
movdqa xmmword [rsp + 0x4e0], xmm11
movdqa xmmword [rsp + 0x4d0], xmm10
movdqa xmmword [rsp + 0x4c0], xmm9
movaps xmmword [rsp + 0x4b0], xmm8
movaps xmmword [rsp + 0x4a0], xmm7
movaps xmmword [rsp + 0x490], xmm6
mov rbx, r9
mov qword [rsp + 0x60], r8
mov rsi, rdx
mov qword [rsp + 0xa0], rcx
mov rax, qword [rdx + 0x10]
mov rcx, qword [rax + 0xc8]
test rcx, rcx
mov qword [rsp + 0x48], rdx
je 0x14002ef59
mov rdx, qword [rax + 0xb8]
cmp rcx, 4
jae 0x14002ef60
xor ebp, ebp
xor r8d, r8d
jmp 0x14002f012
xor ebp, ebp
jmp 0x14002f046
mov r8, rcx
and r8, 0xfffffffffffffffc
lea r9, [rdx + 0x98]
pxor xmm0, xmm0
movdqa xmm2, xmmword [0x1401687f0]
movdqa xmm3, xmmword [0x1401687a0]
mov r10, r8
pxor xmm1, xmm1
nop dword [rax]
movzx r11d, byte [r9 - 0x78]
mov esi, dword [r9 - 0x50]
mov edi, dword [r9]
shl esi, 8
or esi, r11d
movd xmm4, esi
movzx r11d, byte [r9 - 0x28]
shl edi, 8
or edi, r11d
movd xmm5, edi
pcmpeqb xmm4, xmm2
punpcklbw xmm4, xmm4
pshuflw xmm4, xmm4, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm0, xmm4
pcmpeqb xmm5, xmm2
punpcklbw xmm5, xmm5
pshuflw xmm4, xmm5, 0xd4
pshufd xmm4, xmm4, 0xd4
pand xmm4, xmm3
paddq xmm1, xmm4
add r9, 0xa0
add r10, 0xfffffffffffffffc
jne 0x14002ef90
paddq xmm1, xmm0
pshufd xmm0, xmm1, 0xee
paddq xmm0, xmm1
movq rbp, xmm0
cmp rcx, r8
mov rsi, qword [rsp + 0x48]
je 0x14002f046
sub rcx, r8
lea r8, [r8 + r8*4]
lea rdx, [rdx + r8*8]
add rdx, 0x20
nop word cs:[rax + rax]
xor r8d, r8d
cmp byte [rdx], 4
sete r8b
add rbp, r8
add rdx, 0x28
dec rcx
jne 0x14002f030
mov rcx, qword [rax + 0xa0]
mov rax, qword [rax + 0xb0]
shl rax, 7
lea rax, [rax + rax*4]
nop dword [rax]
mov rdx, rax
test rax, rax
je 0x14002f07f
test byte [rcx + 0x279], 0x40
lea rcx, [rcx + 0x280]
lea rax, [rdx - 0x280]
je 0x14002f060
mov qword [rsp + 0x2e8], rdx
mov rcx, qword [rsp + 0x60]
lea rax, [rcx + 0x50]
mov qword [rsp + 0x2d0], rax
lea rax, [rcx + 0x58]
mov qword [rsp + 0x2c8], rax
mov r14d, 1
movdqa xmm6, xmmword [str.uespemosarenegylmodnarodsetybdet]
movdqa xmm7, xmmword [0x140168640]
xorps xmm8, xmm8
pcmpeqd xmm9, xmm9
xor eax, eax
mov qword [rsp + 0x68], rax
xor eax, eax
mov qword [rsp + 0x78], rax
mov dword [rsp + 0xa8], 0
mov qword [rsp + 0x88], rbx
Function at 0x14005e4b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rax, rdx
mov rsi, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov ebx, ecx
shr ebx, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov r15, rax
movzx r14d, byte [rax + 1]
add rax, 2
lea r10, [r11 + r14]
cmp byte [r15], bl
jne 0x14005e540
cmp r11, r10
ja 0x14005e5b6
cmp r10, rdx
ja 0x14005e5ca
add r11, r9
xor r15d, r15d
nop word cs:[rax + rax]
cmp r14, r15
je 0x14005e542
lea r12, [r15 + 1]
cmp byte [r11 + r15], cl
mov r15, r12
jne 0x14005e520
jmp 0x14005e5a4
ja 0x14005e54a
mov r11, r10
cmp rax, r8
jne 0x14005e4e4
add rsi, rdi
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r8, [rdi + 1]
movzx edx, byte [rdi]
test dl, dl
js 0x14005e580
mov rdi, r8
sub ecx, edx
jns 0x14005e59b
jmp 0x14005e5a6
cmp r8, rsi
je 0x14005e5db
movzx r8d, byte [rdi + 1]
add rdi, 2
and edx, 0x7f
shl edx, 8
or edx, r8d
sub ecx, edx
js 0x14005e5a6
xor al, 1
cmp rdi, rsi
jne 0x14005e560
jmp 0x14005e5a6
xor eax, eax
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140161190
ud2
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.140160f40
ud2
lea rcx, str.called__Option::unwrap____on_a__None__value_rustc_cc66ad468955717ab92600c770da8c1601a4ff33librarycore_src_strpattern.rs
lea r8, str.librarycore_srcunicodeprintable.rs
mov edx, 0x2b
call fcn.140160fb0
ud2

Function at 0x14006e510
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x14006e5a6
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
invalid
invalid
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x14006e746
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x14006e7c8
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x14006e753
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x14006e610
cmp r9, 8
jae 0x14006e75c
jmp 0x14006e7c8
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x14006e7c8
mov r8, rcx
cmp r9, 8
jb 0x14006e7c8
add rcx, r9
nop