joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140051c10
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
mov r10, rdx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140051d7f
lea rax, [r10 + 0xe]
lea rdx, [rcx + 0xe]
cmp rcx, rax
ja 0x140051c39
cmp rdx, r10
jae 0x140051d7f
movdqa xmm5, xmmword [0x1400cd5c0]
mov r8d, listen
movdqa xmm2, xmmword [0x1400ca520]
movdqa xmm3, xmmword [0x1400cd520]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x1400cd5a0]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.6666]
psubd xmm2, xmm0
movd xmm0, dword [r10]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.4444444444444444]
xorps xmm2, xmm0
movd dword [rcx], xmm2
movdqa xmm2, xmmword [0x1400cd510]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
pmulld xmm0, xmmword [str.6666]
psubd xmm2, xmm0
punpckldq xmm1, xmm3
movd xmm0, dword [r10 + 4]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.4444444444444444]
xorps xmm2, xmm0
pmuldq xmm1, xmm5
movdqa xmm0, xmm3
movd dword [rcx + 4], xmm2
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.6666]
psubd xmm3, xmm0
movd xmm0, dword [r10 + 8]
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
paddb xmm3, xmmword [str.4444444444444444]
xorps xmm3, xmm0
movd dword [rcx + 8], xmm3
mov r9d, r8d
add r9, rcx
sub r10, rcx
nop dword [rax + rax]
mov eax, 0x4bda12f7
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x34
xor al, byte [r9 + r10 - 1]
mov byte [r9 - 1], al
cmp r8d, 0xf
jl 0x140051d90
ret
Function at 0x140059990
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x14012e580]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov edi, r8d
mov rsi, rdx
xor ebx, ebx
mov qword [rsp + 0x30], rbx
cmp ecx, 0x7b
ja 0x1400599d8
lea r8, [rsp + 0x30]
mov edx, ecx
lea rcx, [0x14012dfb0]
call fcn.14004a710
mov rbx, qword [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140046190
nop
lea rcx, [rsp + 0x40]
test rbx, rbx
lea rdx, str.Select_any_key
je 0x1400599f7
mov rdx, rbx
call fcn.1400484e0
cmp edi, 1
jne 0x140059a12
lea rdx, [0x1400c41c8]
lea rcx, [rsp + 0x40]
call fcn.1400484e0
lea rcx, [rsp + 0x40]
call fcn.1400162e0
mov rdx, rax
movss xmm0, dword [0x1400c441c]
movss dword [rsp + 0x20], xmm0
xor r9d, r9d
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.140007d00
movss xmm1, dword [rsp + 0x38]
addss xmm1, dword [0x1400c4500]
xorps xmm2, xmm2
lea rcx, [rsp + 0x30]
call fcn.140003b60
mov rbx, rax
lea rcx, [rsp + 0x40]
call fcn.1400162e0
mov rdx, rbx
mov rcx, rax
call fcn.14002ba60
test al, al
je 0x140059a96
test edi, edi
jne 0x140059a96
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8, rsi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
lea rcx, [rsp + 0x40]
call fcn.140015c90
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400be900
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14005bb60
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x14012e580]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov ebp, edx
mov rdi, rcx
call fcn.140057760
mov edx, ebp
mov ecx, eax
mov esi, eax
call fcn.140057780
test al, al
je 0x14005bb9f
mov ecx, ebp
call fcn.14005b850
jmp 0x14005bcd6
mov rcx, rdi
mov qword [rsp + 0xb0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x14005bbeb
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x14005bbeb
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov ecx, ebp
mov rbx, rax
call fcn.140044e10
mov byte [rbx], al
mov eax, ebp
jmp 0x14005bcce
cmp qword [rdi + 0x80], 0
je 0x14005bccc
mov rcx, rdi
call fcn.14004c9a0
mov rbx, qword [rdi + 0x68]
mov ecx, ebp
call fcn.140044e10
test rbx, rbx
jne 0x14005bc27
mov rdx, qword [rdi + 0x80]
movzx ecx, al
call fcn.14003daa0
test al, al
jmp 0x14005bcc9
mov byte [rsp + 0x50], al
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x40]
mov rcx, rbx
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14005bc8d
sub eax, 1
je 0x14005bc8d
cmp eax, 2
jne 0x14005bccc
mov rdx, qword [rdi + 0x80]
movzx ecx, byte [rsp + 0x50]
call fcn.14003daa0
test al, al
jmp 0x14005bcc9
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x14005bcbb
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14005bccc
lea rax, [rsp + 0x50]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x48], rax
cmovne esi, ebp
mov eax, esi
mov rbx, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400be900
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x140063550
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x14012e580]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
test r8, r8
jg 0x14006357c
xor eax, eax
jmp 0x14006367a
cmp qword [rcx + 0x68], 0
je 0x14006358e
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x14006367a
mov qword [rsp + 0x20], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x28], rax
test rax, rax
je 0x1400635e9
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x78], rbx
lea rcx, [rsp + 0x20]
call fcn.140015ad0
mov rcx, rsi
mov rbx, qword [rax]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rbx
mov rcx, rbp
mov rdx, rax
call fcn.1400162f0
sub qword [rsp + 0x20], rbx
mov edx, ebx
mov rcx, rsi
add rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rbx, qword [rsp + 0x78]
cmp qword [rsi + 0x80], 0
je 0x14006366f
mov rcx, rsi
call fcn.14004c9a0
mov rcx, qword [rsp + 0x20]
cmp rcx, 0xfff
jbe 0x140063648
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, qword [rsp + 0x20]
add rbp, rax
sub rcx, rax
mov qword [rsp + 0x20], rcx
cmp rax, 0xfff
jne 0x140063674
cmp rcx, rax
ja 0x140063610
test rcx, rcx
je 0x140063674
mov r9, qword [rsi + 0x80]
mov r8, rcx
mov rcx, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, qword [rsp + 0x20]
sub rcx, rax
jmp 0x140063674
mov rcx, qword [rsp + 0x20]
sub rdi, rcx
mov rax, rdi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400be900
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140063690
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x1400636b8
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x14006372c
test rax, rax
jle 0x14006370c
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call fcn.1400162f0
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x14006372c
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14006372c
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x1400642d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140064304
mov eax, esi
lea ecx, [rax + 0x4b]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x1400642f0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400375d0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140064329
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140059b10
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400643a3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006439e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006439e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bea60
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x1400643b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x1400643e4
mov eax, esi
lea ecx, [rax + 0x4b]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x1400643d0
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400375d0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140064409
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140059b10
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140064483
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006447e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006447e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bea60
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x140064490
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x1400644c4
mov eax, esi
lea ecx, [rax + 0x4b]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x1400644b0
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400375d0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400644e9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140059b10
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140064563
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006455e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006455e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bea60
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140064570
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x1400645a4
mov eax, esi
lea ecx, [rax + 0x4b]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x140064590
mov byte [r8 + 0xc], sil
add r8, 0xb
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.1400375d0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1400645c9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140059b10
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140064643
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006463e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006463e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bea60
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140067670
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x140067693
lea edx, [rax + 0x4b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140067680
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.1400375d0
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1400676b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0x10], al
je 0x1400676d3
lea edx, [rax + 0x4b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x1400676c0
mov byte [rcx + 0x10], 0
lea r8, [rcx + 0xf]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.1400375d0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400676f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 0xb], al
je 0x140067713
lea edx, [rax + 0x4b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x140067700
mov byte [rcx + 0xb], 0
lea r8, [rcx + 0xa]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.1400375d0
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400678d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x1400678f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x4b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x1400678e0
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x140067900
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1b], 0
je 0x140067923
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x4b]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1a
jb 0x140067910
mov byte [rcx + 0x1b], 0
mov rax, rcx
ret
Function at 0x140068030
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rcx
mov ecx, r9d
test r8, r8
je 0x140068117
sub r10, rdx
cmp r8, 8
jb 0x1400680f3
mov rax, r8
lea r9, [rdx + 4]
and rax, 0xfffffffffffffff8
xorps xmm3, xmm3
xorps xmm2, xmm2
movd xmm1, dword [r10 + r9 - 4]
add rcx, 8
movd xmm0, dword [r9 - 4]
lea r9, [r9 + 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklbw xmm0, xmm0
psrad xmm1, 0x18
punpcklwd xmm0, xmm0
psrad xmm0, 0x18
pxor xmm1, xmm0
movd xmm0, dword [r9 - 8]
punpcklbw xmm0, xmm0
por xmm3, xmm1
movd xmm1, dword [r10 + r9 - 8]
punpcklbw xmm1, xmm1
punpcklwd xmm1, xmm1
punpcklwd xmm0, xmm0
psrad xmm1, 0x18
psrad xmm0, 0x18
pxor xmm1, xmm0
por xmm2, xmm1
cmp rcx, rax
jb 0x140068060
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd r9d, xmm2
cmp rcx, r8
jae 0x140068117
lea rax, [rcx + rdx]
sub r8, rcx
nop word [rax + rax]
movsx edx, byte [r10 + rax]
movsx ecx, byte [rax]
lea rax, [rax + 1]
xor edx, ecx
or r9d, edx
sub r8, 1
jne 0x140068100
test r9d, r9d
sete al
ret
Function at 0x14006b970
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14012e580]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rbp - 0x18], rdx
xor edi, edi
mov dword [rbp - 0x50], 0x2d2e3938
mov dword [rbp - 0x4c], 0x22232a
mov byte [rbp - 0x48], 1
mov ecx, edi
nop dword [rax]
lea eax, [rcx + 0x4b]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 7
jb 0x14006b9b0
mov byte [rbp - 0x48], 0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x38]
call fcn.1400375d0
nop
cmp byte [rbx], 0
jne 0x14006b9eb
mov byte [rbx], 1
call fcn.140040a30
mov qword [rbx + 8], rax
cmp byte [rbx], 1
jne 0x14006ba02
lea rdx, [rbp - 0x38]
mov rcx, qword [rbx + 8]
call fcn.140048af0
mov rcx, rax
jmp 0x14006ba06
mov rcx, qword [rbp - 0x18]
lea rax, [rcx + 8]
cmp byte [rcx], 4
cmovne rax, rdi
movzx eax, byte [rax]
mov byte [rsi + 0x210], al
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14006ba58
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006ba53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006ba53
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bea60
mov dword [rbp - 0x50], 0x3d3e2926
mov dword [rbp - 0x4c], 0x34372e
mov byte [rbp - 0x48], 1
mov rcx, rdi
nop dword [rax]
lea eax, [rcx + 0x4b]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 7
jb 0x14006ba70
mov byte [rbp - 0x48], 0
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x49]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x38]
call fcn.1400375d0
nop
cmp byte [rbx], 0
jne 0x14006baab
mov byte [rbx], 1
call fcn.140040a30
mov qword [rbx + 8], rax
cmp byte [rbx], 1
jne 0x14006babf
lea rdx, [rbp - 0x38]
mov rcx, qword [rbx + 8]
call fcn.140048af0
jmp 0x14006bac3
mov rax, qword [rbp - 0x18]
cmp byte [rax], 3
jne 0x14006bacc
mov rdi, qword [rax + 8]
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14006bad9
mov rdx, qword [rdi]
lea rcx, [rsi + 0x218]
mov r8, qword [rdi + 0x10]
call fcn.14004ffb0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14006bb29
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006bb23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14006bb23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bea60
nop
lea rcx, [rbx + 8]
movzx edx, byte [rbx]
call fcn.140052630
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1400be900
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400741a0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret
Function at 0x140085990
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x1400859ee
mov dl, 1
call fcn.1400764a0
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.1400764a0
mov eax, ebx
jmp 0x140085a32
cmp ebx, 2
ja 0x140085a30
mov r9, qword [rdi + 0x668]
lea rdx, [0x1400d0a28]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140085a50
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x14012e580]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
jne 0x140085a93
cmp qword [rcx + 0x678], 0
je 0x140085b70
mov r8, rdx
mov qword [rsp + 0x158], rbx
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.1400745a0
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140085ac1
mov rcx, qword [rdi + 0x678]
test rcx, rcx
je 0x140085b08
cmp byte [rdi + 0x1597], 0
jne 0x140085b08
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140085af0
mov byte [rdi + 0x1597], 1
cmp byte [rdi + 0xf1e], 0
je 0x140085b68
mov byte [rsp + rbx + 0x30], 0xa
inc rbx
cmp rbx, 0x102
jae 0x140085bc3
cmp qword [rdi + 0x718], 0
mov byte [rsp + rbx + 0x30], 0
je 0x140085b89
mov dl, 1
mov rcx, rdi
call fcn.1400764a0
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.1400764a0
mov rbx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400be900
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x668]
lea rcx, [0x1400d0a28]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x140085b68
call fcn.1400bf5b0
int3