joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140049d7c
Capabilities:
Get file size
Read file on windows

Disassembly:
xor r8d, r8d
jmp 0x140049d7c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, rdx
xor ebx, ebx
mov r14, rcx
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140049e3f
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [0x14015d920]
xor edx, edx
mov r8d, eax
mov edi, eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x140049e36
lea r9, [rsp + 0x78]
mov r8d, edi
mov rdx, rax
mov rcx, rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140049e24
cmp dword [rsp + 0x78], edi
jne 0x140049e24
mov r8d, edi
mov rdx, rsi
mov rcx, r14
call fcn.1400498e4
mov rbx, rax
mov rcx, qword [0x14015d920]
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x140050490
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov esi, 0x40
mov ecx, esi
call fcn.1400529e0
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.1400eeabc
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], 0
jne 0x1400504c0
sub esi, edx
mov ecx, esi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140052b20

Function at 0x1400509c0
Capabilities:
Get thread local storage value

Disassembly:
push rbx
push rbp
push rsi
push r14
sub rsp, 0x28
mov ebp, r9d
mov r14, r8
mov ebx, edx
mov rsi, rcx
test r8, r8
je 0x140050aad
cmp word [r8], 0
je 0x140050aad
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r13
xor r13d, r13d
test edx, edx
mov qword [rsp + 0x20], r15
cmovs ebx, r13d
test rcx, rcx
je 0x140050a2d
cmp word [rcx], r13w
je 0x140050a2d
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rcx + rdi*2], r13w
jne 0x140050a15
cmp edi, ebx
cmovg edi, ebx
sub ebx, edi
jns 0x140050a30
mov ebx, r13d
jmp 0x140050a30
mov edi, r13d
call fcn.140053090
movzx r12d, word [r14]
lea ecx, [rdi + rbx]
mov edx, ebp
mov r15d, eax
call fcn.1400529e0
mov r14, rax
test r15d, r15d
je 0x140050a59
mov ecx, r15d
call fcn.140053100
mov rsi, rax
mov r15, qword [rsp + 0x20]
test edi, edi
jle 0x140050a73
movsxd r8, edi
mov rdx, rsi
mov rcx, r14
add r8, r8
call sub.msvcrt.dll_memmove
movsxd rax, edi
lea r8, [r14 + rax*2]
test ebx, ebx
je 0x140050a90
mov rdi, r8
mov edx, ebx
movzx eax, r12w
mov ecx, ebx
lea r8, [r8 + rdx*2]
rep stosw word [rdi], ax
mov r12, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
mov word [r8], r13w
mov r13, qword [rsp + 0x60]
add rsp, 0x28
pop r14
pop rsi
pop rbp
pop rbx
ret
mov ecx, r9d
add rsp, 0x28
pop r14
pop rsi
pop rbp
pop rbx
jmp fcn.140052e40

Function at 0x14005170c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x14015f2f8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, rax
test rax, rax
jne 0x14005178d
mov r8, qword [0x14015f2f0]
mov rcx, qword [0x14015d920]
lea edx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x14015f2f8]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [0x14015f2e8]
jmp 0x140051779
mov rdx, qword [rbx + 0x18]
test rdx, rdx
je 0x140051776
mov rcx, qword [rbx + 0x10]
add rcx, rdi
call rdx
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140051764
lea rcx, [0x140051670]
mov rdx, rdi
call fcn.1400eec5c
mov rbx, qword [rsp + 0x30]
lea rax, [rdi + rsi]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400517a4
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, ecx
mov rbp, r8
mov rdi, rdx
and ecx, 7
je 0x1400517ce
mov eax, 8
sub eax, ecx
add ebx, eax
mov rcx, qword [0x14015f2f0]
test rcx, rcx
jne 0x140051811
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, qword [0x14015d920]
movsxd r8, ebx
mov edx, 8
mov dword [0x14015f2f8], eax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x14015f2f8]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x14015f2f0]
mov rsi, rcx
movsxd rax, ebx
add rcx, rax
mov qword [0x14015f2f0], rcx
mov ecx, dword [0x14015f2f8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r9, qword [0x14015f2f0]
mov rcx, qword [0x14015d920]
mov r8, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ecx, dword [0x14015f2f8]
mov rdx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test rdi, rdi
jne 0x140051865
test rbp, rbp
je 0x14005188c
lea rcx, [0x14015f2e8]
mov edx, 0x28
call fcn.140052378
mov qword [rax], rsi
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rbp
test rdi, rdi
je 0x14005188c
lea rcx, [rbx + rsi]
call rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rax, rsi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140052410
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
xor r8d, r8d
mov edx, 0x1000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [0x14015fcb0], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x14015a834], eax
call fcn.1400534a0
add rsp, 0x28
ret

Function at 0x140052480
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov ecx, dword [0x14015a834]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x30], rax
mov ecx, dword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x1400524d0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, dword [0x14015a834]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x40]
cmp qword [rax], 0
jne 0x140052536
movsxd rax, dword [rsp + 0x20]
add rax, 0xa
mov r8, rax
xor edx, edx
mov rcx, qword [0x14015fcb0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
jmp 0x140052561
movsxd rax, dword [rsp + 0x20]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x40]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x14015fcb0]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x20]
xor edx, edx
mov ecx, 2
div rcx
movsxd rcx, dword [rsp + 0x48]
mov rdx, qword [rsp + 0x28]
add rcx, qword [rdx]
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax]
call fcn.140053570
movsxd rax, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x140052770
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x14015a834]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
add rsp, 0x38
ret

Function at 0x1400527a0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x14015a834]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
add rsp, 0x38
ret

Function at 0x1400527d0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x14015a834]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x10]
add rax, 2
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x140052800
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x14015a834]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rsp, 0x38
ret
Function at 0x1400528a0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
cmp dword [0x14015a834], 0xffffffff
jne 0x1400528cf
call fcn.140052410
mov ecx, dword [0x14015a834]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x140052850]
call fcn.1400eec5c
jmp 0x140052900
mov ecx, dword [0x14015a834]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
jne 0x140052900
call fcn.1400534a0
mov ecx, dword [0x14015a834]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdx, rax
lea rcx, [0x140052850]
call fcn.1400eec5c
add rsp, 0x28
ret

Function at 0x1400529b0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x38
mov ecx, dword [0x14015a834]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
add rsp, 0x38
ret

Function at 0x1400529e0
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov ecx, dword [0x14015a834]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x28], rax
cmp dword [rsp + 0x58], 0xffffffff
jne 0x140052a10
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x10]
mov dword [rsp + 0x58], eax
movsxd rax, dword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x10]
lea rax, [rcx + rax*2]
mov dword [rsp + 0x20], eax
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 8]
sub rcx, 4
cmp rax, rcx
jl 0x140052a82
mov eax, dword [rsp + 0x20]
add eax, 0x4000
cdqe
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x14015fcb0]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
jmp 0x140052ae0
mov rax, qword [rsp + 0x28]
cmp qword [rax + 8], 0x100000
jle 0x140052ae0
cmp dword [rsp + 0x20], 0x100000
jge 0x140052aa3
mov dword [rsp + 0x20], 0x100000
movsxd rax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 8], rax
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 8]
add rax, 0xa
mov r9, rax
mov rax, qword [rsp + 0x28]
mov r8, qword [rax]
xor edx, edx
mov rcx, qword [0x14015fcb0]
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov rcx, qword [rsp + 0x28]
mov qword [rcx], rax
movsxd rax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x28]
add rax, qword [rcx]
mov qword [rsp + 0x30], rax
movsxd rax, dword [rsp + 0x58]
movsxd rcx, dword [rsp + 0x50]
lea rax, [rax + rcx*2]
mov rcx, qword [rsp + 0x28]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x30]
add rsp, 0x48
ret

Function at 0x140052b20
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x14015a834]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x40]
shl eax, 1
cdqe
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret
Function at 0x140052e40
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x14015a834]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
xor edx, edx
mov word [rcx + rax], dx
add rsp, 0x38
ret

Function at 0x140053090
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov ecx, dword [0x14015a834]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
cmp qword [rsp + 0x40], rax
jb 0x1400530eb
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x20]
add rax, qword [rcx + 0x10]
cmp qword [rsp + 0x40], rax
ja 0x1400530eb
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
inc rax
jmp 0x1400530ed
xor eax, eax
add rsp, 0x38
ret

Function at 0x140053100
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x14015a834]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
lea rax, [rcx + rax - 1]
add rsp, 0x38
ret

Function at 0x1400534a0
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov r8d, 0x18
xor edx, edx
mov rcx, qword [0x14015fcb0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x20], rax
mov r8d, 0x10
xor edx, edx
mov rcx, qword [0x14015fcb0]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], 0x10
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x10], 0
mov rdx, qword [rsp + 0x20]
mov ecx, dword [0x14015a834]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret
Function at 0x140058140
Capabilities:
Generate random numbers via rtlgenrandom
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
xor edi, edi
mov ebx, edi
nop
lea rcx, [rsp + 0x48]
mov edx, 4
mov dword [rsp + 0x48], edi
call sub.ADVAPI32.DLL_SystemFunction036
test al, al
je 0x1400581d9
mov edx, dword [rsp + 0x48]
mov rcx, rdi
nop
cmp rbx, 4
jae 0x140058191
mov eax, edx
inc rbx
shr eax, cl
add rcx, 8
mov byte [rsp + rbx + 0x4f], al
cmp rcx, 0x20
jb 0x140058170
cmp rbx, 4
jb 0x140058150
lea rcx, str.EXPAT_ENTROPY_DEBUG
call qword [sym.imp.msvcrt.dll_getenv]
mov ebx, dword [rsp + 0x50]
test rax, rax
je 0x140058253
movzx ecx, byte [rax]
cmp cl, byte [0x14011df2c]
jne 0x140058253
movzx eax, byte [rax + 1]
cmp al, byte [0x14011df2d]
jne 0x140058253
call qword [sym.imp.msvcrt.dll___iob_func]
lea r8, str.rand_s
jmp 0x140058230
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov ebx, dword [rsp + 0x48]
xor ebx, dword [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, str.EXPAT_ENTROPY_DEBUG
xor eax, ebx
imul ebx, eax, 0x7fffffff
call qword [sym.imp.msvcrt.dll_getenv]
test rax, rax
je 0x140058253
movzx ecx, byte [rax]
cmp cl, byte [0x14011df2c]
jne 0x140058253
movzx eax, byte [rax + 1]
cmp al, byte [0x14011df2d]
jne 0x140058253
call qword [sym.imp.msvcrt.dll___iob_func]
lea r8, str.fallback_4_
lea rdx, str.Entropy:__s_____0x_0lx___lu_bytes__n
lea rcx, [rax + 0x60]
mov r9d, 8
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], ebx
call qword [sym.imp.msvcrt.dll_fprintf]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14005c990
Capabilities:
Encode data using xor

Disassembly:
movzx edx, byte [rcx + 0x28]
mov r9, qword [rcx + 0x30]
mov r8, rcx
sub dl, cl
sub dl, 0x20
movsx rax, dl
add r9, rax
movsx eax, dl
shl r9, 0x38
dec eax
cmp eax, 6
ja case.default.0x14005c9c8
lea rdx, [0x140000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x5cae0]
add rcx, rdx
jmp rcx
movzx eax, byte [r8 + 0x26]
shl rax, 0x30
or r9, rax
movzx eax, byte [r8 + 0x25]
shl rax, 0x28
or r9, rax
movzx eax, byte [r8 + 0x24]
shl rax, 0x20
or r9, rax
movzx eax, byte [r8 + 0x23]
shl rax, 0x18
or r9, rax
movzx eax, byte [r8 + 0x22]
shl rax, 0x10
or r9, rax
movzx eax, byte [r8 + 0x21]
shl rax, 8
or r9, rax
movzx eax, byte [r8 + 0x20]
or r9, rax
xor qword [r8 + 0x18], r9
mov r10, qword [r8]
mov rcx, qword [r8 + 8]
mov rax, qword [r8 + 0x18]
mov rdx, qword [r8 + 0x10]
mov r11d, 2
add r10, rcx
add rdx, rax
rol rcx, 0xd
xor rcx, r10
rol rax, 0x10
xor rax, rdx
add rdx, rcx
rol r10, 0x20
add r10, rax
mov qword [r8], r10
rol rcx, 0x11
xor rcx, rdx
rol rax, 0x15
xor rax, r10
rol rdx, 0x20
dec r11
jne 0x14005ca33
xor qword [r8], r9
mov r9, qword [r8]
xor rdx, 0xff
mov qword [r8 + 0x10], rdx
mov qword [r8 + 0x18], rax
mov qword [r8 + 8], rcx
lea r10d, [r11 + 4]
nop dword [rax + rax]
add r9, rcx
add rdx, rax
rol rcx, 0xd
xor rcx, r9
rol rax, 0x10
xor rax, rdx
add rdx, rcx
rol r9, 0x20
add r9, rax
mov qword [r8], r9
rol rcx, 0x11
xor rcx, rdx
rol rax, 0x15
xor rax, r9
rol rdx, 0x20
dec r10
jne 0x14005ca90
mov qword [r8 + 0x18], rax
xor rax, rdx
mov qword [r8 + 8], rcx
xor rax, rcx
mov qword [r8 + 0x10], rdx
xor rax, r9
ret

Function at 0x14005cb70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
lea rbx, [rdx + r8]
mov qword [rsp + 0x10], rbp
mov r11, rcx
lea rax, [rcx + 0x28]
mov qword [rsp + 0x18], rdi
cmp rdx, rbx
jae 0x14005cba9
mov r8, qword [rax]
cmp r8, rax
jae 0x14005cbb2
movzx ecx, byte [rdx]
inc rdx
mov byte [r8], cl
inc qword [rax]
cmp rdx, rbx
jb 0x14005cb90
cmp qword [rax], rax
jb 0x14005cc88
movzx ecx, byte [r11 + 0x26]
movzx edi, byte [r11 + 0x27]
mov r10, qword [r11]
mov r8, qword [r11 + 8]
mov r9, qword [r11 + 0x10]
shl rdi, 8
or rdi, rcx
movzx ecx, byte [r11 + 0x25]
lea rbp, [r11 + 0x20]
shl rdi, 8
mov esi, 2
or rdi, rcx
movzx ecx, byte [r11 + 0x24]
shl rdi, 8
or rdi, rcx
movzx ecx, byte [r11 + 0x23]
shl rdi, 8
or rdi, rcx
movzx ecx, byte [r11 + 0x22]
shl rdi, 8
or rdi, rcx
movzx ecx, byte [r11 + 0x21]
shl rdi, 8
or rdi, rcx
movzx ecx, byte [rbp]
shl rdi, 8
or rdi, rcx
xor qword [r11 + 0x18], rdi
mov rcx, qword [r11 + 0x18]
nop word [rax + rax]
add r10, r8
add r9, rcx
rol r8, 0xd
xor r8, r10
rol rcx, 0x10
xor rcx, r9
add r9, r8
rol r10, 0x20
add r10, rcx
mov qword [r11], r10
rol r8, 0x11
xor r8, r9
rol rcx, 0x15
xor rcx, r10
rol r9, 0x20
dec rsi
jne 0x14005cc30
xor qword [r11], rdi
add qword [r11 + 0x30], 8
mov qword [r11 + 0x18], rcx
mov qword [r11 + 8], r8
mov qword [r11 + 0x10], r9
mov qword [rax], rbp
cmp rdx, rbx
jb 0x14005cb90
mov rdi, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x20]
mov rax, r11
pop rsi
ret
Function at 0x140088740
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x24], 0xca
mov rbx, rcx
jne 0x140088773
call fcn.140088a00
cmp byte [rbx + 0x58], 0
je 0x14008876c
mov dword [rbx + 0x24], 0xcf
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
mov eax, dword [rbx + 0x24]
cmp eax, 0xcb
jne 0x140088805
mov rax, qword [rbx + 0x240]
cmp byte [rax + 0x20], 0
je 0x1400887ec
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14008879e
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x240]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x1400887e4
cmp eax, 2
je 0x1400887ec
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140088790
dec eax
test eax, 0xfffffffd
jne 0x140088790
inc dword [rcx + 8]
mov rdx, qword [rbx + 0x10]
mov r8d, dword [rdx + 0xc]
cmp dword [rcx + 8], r8d
jl 0x140088790
mov ecx, dword [rbx + 0x190]
add ecx, r8d
mov dword [rdx + 0xc], ecx
jmp 0x140088790
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x9c]
mov rcx, rbx
mov dword [rbx + 0xa4], eax
add rsp, 0x20
pop rbx
jmp 0x1400888c0
cmp eax, 0xcc
je 0x140088827
mov rax, qword [rbx]
mov dword [rax + 0x28], 0x15
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400888c0
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
xor ebp, ebp
cmp dword [rcx + 0x24], 0xcc
mov rbx, rcx
je 0x1400888ee
mov rax, qword [rcx + 0x220]
call qword [rax]
mov dword [rbx + 0x98], ebp
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x220]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
cmp byte [rax + 0x10], bpl
je 0x14008899d
nop dword [rax]
mov eax, dword [rbx + 0x98]
cmp eax, dword [rbx + 0x78]
jae 0x14008896d
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14008893f
mov dword [rcx + 8], eax
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0xc], eax
mov rax, qword [rbx + 0x10]
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x228]
mov edi, dword [rbx + 0x98]
lea r8, [rbx + 0x98]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call qword [rax + 8]
mov eax, dword [rbx + 0x98]
cmp eax, edi
je 0x1400889c5
cmp eax, dword [rbx + 0x78]
jb 0x140088920
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax + 8]
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax]
mov dword [rbx + 0x98], ebp
mov rax, qword [rbx + 0x220]
cmp byte [rax + 0x10], bpl
jne 0x140088910
cmp byte [rbx + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rbx + 0x24], ebp
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
xor al, al
jmp 0x1400889b0
Function at 0x1400888c0
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x24], 0xca
mov rbx, rcx
jne 0x140088773
call fcn.140088a00
cmp byte [rbx + 0x58], 0
je 0x14008876c
mov dword [rbx + 0x24], 0xcf
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
mov eax, dword [rbx + 0x24]
cmp eax, 0xcb
jne 0x140088805
mov rax, qword [rbx + 0x240]
cmp byte [rax + 0x20], 0
je 0x1400887ec
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14008879e
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x240]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x1400887e4
cmp eax, 2
je 0x1400887ec
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140088790
dec eax
test eax, 0xfffffffd
jne 0x140088790
inc dword [rcx + 8]
mov rdx, qword [rbx + 0x10]
mov r8d, dword [rdx + 0xc]
cmp dword [rcx + 8], r8d
jl 0x140088790
mov ecx, dword [rbx + 0x190]
add ecx, r8d
mov dword [rdx + 0xc], ecx
jmp 0x140088790
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x9c]
mov rcx, rbx
mov dword [rbx + 0xa4], eax
add rsp, 0x20
pop rbx
jmp 0x1400888c0
cmp eax, 0xcc
je 0x140088827
mov rax, qword [rbx]
mov dword [rax + 0x28], 0x15
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400888c0
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
xor ebp, ebp
cmp dword [rcx + 0x24], 0xcc
mov rbx, rcx
je 0x1400888ee
mov rax, qword [rcx + 0x220]
call qword [rax]
mov dword [rbx + 0x98], ebp
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x220]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
cmp byte [rax + 0x10], bpl
je 0x14008899d
nop dword [rax]
mov eax, dword [rbx + 0x98]
cmp eax, dword [rbx + 0x78]
jae 0x14008896d
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14008893f
mov dword [rcx + 8], eax
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0xc], eax
mov rax, qword [rbx + 0x10]
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x228]
mov edi, dword [rbx + 0x98]
lea r8, [rbx + 0x98]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call qword [rax + 8]
mov eax, dword [rbx + 0x98]
cmp eax, edi
je 0x1400889c5
cmp eax, dword [rbx + 0x78]
jb 0x140088920
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax + 8]
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax]
mov dword [rbx + 0x98], ebp
mov rax, qword [rbx + 0x220]
cmp byte [rax + 0x10], bpl
jne 0x140088910
cmp byte [rbx + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rbx + 0x24], ebp
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
xor al, al
jmp 0x1400889b0