joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140098174
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x30
call fcn.14024eae0
sub rsp, rax
mov rax, qword [rsp + 0xa0]
mov rsi, r8
mov r15, rdx
mov rbp, rcx
mov edi, dword [rax]
mov dword [rsp + 0x80], edi
test edi, edi
je 0x1400981e3
mov rdx, qword [rsp + 0x98]
test rsi, rsi
je 0x1400981dc
mov eax, edi
dec rsi
mov cl, byte [rax + rdx]
xor cl, byte [rbp]
inc rbp
mov byte [r15], cl
inc r15
inc edi
and edi, 0xf
jne 0x1400981bc
mov dword [rsp + 0x80], edi
mov r13, qword [rsp + 0x90]
movzx eax, byte [r13 + 0xd]
lea r14, [r13 + 0xc]
movzx ebx, byte [r14]
shl ebx, 8
or ebx, eax
movzx eax, byte [r13 + 0xe]
shl ebx, 8
or ebx, eax
movzx eax, byte [r13 + 0xf]
shl ebx, 8
or ebx, eax
cmp rsi, 0x10
jb 0x1400982ca
mov edi, 0x10000000
mov rdx, rsi
mov qword [rsp + 0x20], r13
shr rdx, 4
cmp rdx, rdi
cmova rdx, rdi
add ebx, edx
mov r12, rdx
mov eax, ebx
mov ecx, ebx
sub r12, rax
cmp rax, rdx
cmovae r12, rdx
xor ebx, ebx
cmp rax, rdx
mov r8, r12
mov rax, qword [rsp + 0xa8]
mov rdx, r15
cmovae ebx, ecx
mov rcx, rbp
call qword [case.0x14004a846.0]
mov eax, ebx
mov byte [r13 + 0xf], bl
shr eax, 0x18
mov byte [r14], al
mov eax, ebx
shr eax, 0x10
mov byte [r13 + 0xd], al
mov eax, ebx
shr eax, 8
mov byte [r13 + 0xe], al
test ebx, ebx
jne 0x1400982a4
lea ecx, [rbx + 1]
mov rdx, r14
lea r8d, [rbx + 0xc]
dec rdx
movzx eax, byte [rdx]
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
add r8d, 0xffffffff
jne 0x140098291
mov r9, qword [rsp + 0x88]
shl r12, 4
sub rsi, r12
add r15, r12
add rbp, r12
cmp rsi, 0x10
jae 0x140098220
mov edi, dword [rsp + 0x80]
test rsi, rsi
je 0x140098355
mov r12, qword [rsp + 0x98]
xorps xmm0, xmm0
mov rax, qword [rsp + 0xa8]
mov r8d, 1
mov rdx, r12
mov qword [rsp + 0x20], r13
mov rcx, r12
movups xmmword [r12], xmm0
call qword [case.0x14004a846.0]
inc ebx
mov eax, ebx
mov byte [r13 + 0xf], bl
shr eax, 0x18
mov byte [r14], al
mov eax, ebx
shr eax, 0x10
mov byte [r13 + 0xd], al
mov eax, ebx
shr eax, 8
mov byte [r13 + 0xe], al
test ebx, ebx
jne 0x140098340
lea ecx, [rbx + 1]
lea edx, [rbx + 0xc]
dec r14
movzx eax, byte [r14]
add ecx, eax
mov byte [r14], cl
shr ecx, 8
add edx, 0xffffffff
jne 0x14009832c
mov ecx, edi
inc edi
mov al, byte [rcx + rbp]
xor al, byte [rcx + r12]
mov byte [rcx + r15], al
sub rsi, 1
jne 0x140098340
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0x70]
mov dword [rax], edi
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140098374
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x20
call fcn.14024eae0
sub rsp, rax
cmp dword [rsp + 0x90], 0
mov r13, r9
mov rbp, qword [rsp + 0x88]
mov rdi, r8
mov rsi, qword [rsp + 0x80]
mov r14, rdx
mov r15, rcx
mov ebx, dword [rbp]
je 0x1400984c9
test ebx, ebx
je 0x1400983ea
test rdi, rdi
je 0x1400983ea
mov al, byte [r15]
dec rdi
mov ecx, ebx
inc r15
xor byte [rcx + rsi], al
mov al, byte [rcx + rsi]
mov byte [r14], al
inc r14
inc ebx
and ebx, 0xf
jne 0x1400983c7
cmp rdi, 0x10
jb 0x14009848c
mov r12, r14
mov r13, rdi
shr r13, 4
mov rbp, r15
imul rax, r13, 0xfffffffffffffff0
sub r12, rsi
sub rbp, rsi
add rdi, rax
mov rax, r13
shl rax, 4
add r14, rax
mov qword [rsp + 0x68], r14
add r15, rax
mov r14, qword [rsp + 0x78]
mov rax, qword [rsp + 0x98]
mov r8, r14
mov rdx, rsi
mov rcx, rsi
call qword [case.0x14004a846.0]
cmp ebx, 0x10
jae 0x14009846a
mov edx, 0xf
mov ecx, ebx
sub edx, ebx
add rcx, rsi
shr edx, 3
inc edx
mov rax, qword [rcx + rbp]
xor qword [rcx], rax
mov rax, qword [rcx]
mov qword [r12 + rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x140098452
add r12, 0x10
add rbp, 0x10
xor ebx, ebx
sub r13, 1
jne 0x140098425
mov r14, qword [rsp + 0x68]
mov r13, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x88]
test rdi, rdi
je 0x1400985b8
mov rax, qword [rsp + 0x98]
mov r8, r13
mov rdx, rsi
mov rcx, rsi
call qword [case.0x14004a846.0]
mov ecx, ebx
inc ebx
mov al, byte [rcx + r15]
xor byte [rcx + rsi], al
mov al, byte [rcx + rsi]
mov byte [rcx + r14], al
sub rdi, 1
jne 0x1400984ac
jmp 0x1400985b8
test ebx, ebx
je 0x1400984f2
test rdi, rdi
je 0x1400984f2
mov dl, byte [r15]
dec rdi
mov ecx, ebx
inc r15
mov al, dl
xor al, byte [rcx + rsi]
mov byte [r14], al
inc r14
inc ebx
mov byte [rcx + rsi], dl
and ebx, 0xf
jne 0x1400984cd
cmp rdi, 0x10
jb 0x140098582
mov rbp, rdi
mov r12, r14
shr rbp, 4
sub r12, rsi
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
mov rax, qword [rsp + 0x98]
mov r8, r13
mov rdx, rsi
mov rcx, rsi
call qword [case.0x14004a846.0]
cmp ebx, 0x10
jae 0x140098566
mov r10d, 0xf
mov r8d, ebx
sub r10d, ebx
mov r9, r15
shr r10d, 3
add r8, rsi
sub r9, r14
inc r10d
lea rcx, [r8 + r12]
mov rdx, qword [r9 + rcx]
mov rax, rdx
xor rax, qword [r8]
mov qword [rcx], rax
mov qword [r8], rdx
lea r8, [r8 + 8]
sub r10, 1
jne 0x140098548
add r14, 0x10
add r12, 0x10
add r15, 0x10
xor ebx, ebx
sub rbp, 1
jne 0x140098510
mov rbp, qword [rsp + 0x88]
test rdi, rdi
je 0x1400985b8
mov rax, qword [rsp + 0x98]
mov r8, r13
mov rdx, rsi
mov rcx, rsi
call qword [case.0x14004a846.0]
mov edx, ebx
inc ebx
mov cl, byte [rdx + r15]
mov al, cl
xor al, byte [rdx + rsi]
mov byte [rdx + r14], al
mov byte [rdx + rsi], cl
sub rdi, 1
jne 0x14009859e
mov dword [rbp], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400985d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
mov eax, 0x50
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0x90]
mov ebp, r8d
mov rax, qword [rsp + 0xa0]
mov rsi, rdx
mov rbx, rcx
mov r8, r9
mov rdx, rdi
mov rcx, rdi
movups xmm0, xmmword [rdi]
movdqu xmmword [rsp + 0x20], xmm0
call qword [case.0x14004a846.0]
lea eax, [rbp + 7]
cdq
and edx, 7
add eax, edx
sar eax, 3
movsxd rdx, eax
test eax, eax
jle 0x140098690
cmp dword [rsp + 0x98], 0
je 0x14009866a
lea r8, [rsp + 0x30]
sub rbx, rdi
sub r8, rdi
mov rcx, rdi
sub rsi, rdi
mov al, byte [rbx + rcx]
xor al, byte [rcx]
mov byte [r8 + rcx], al
mov byte [rsi + rcx], al
inc rcx
sub rdx, 1
jne 0x140098653
jmp 0x140098690
lea rcx, [rsp + 0x30]
mov r8, rdi
sub rcx, rbx
sub r8, rbx
sub rsi, rbx
mov al, byte [rbx]
mov byte [rcx + rbx], al
xor al, byte [r8 + rbx]
mov byte [rsi + rbx], al
inc rbx
sub rdx, 1
jne 0x14009867b
mov r8d, ebp
and r8d, 0x80000007
jge 0x1400986a6
dec r8d
or r8d, 0xfffffff8
inc r8d
mov eax, ebp
lea r9, [rsp + 0x20]
cdq
and edx, 7
add eax, edx
sar eax, 3
movsxd rcx, eax
add r9, rcx
test r8d, r8d
jne 0x1400986cb
movups xmm0, xmmword [r9]
movdqu xmmword [rdi], xmm0
jmp 0x14009870b
mov r10b, byte [r9]
lea rax, [rsp + 0x20]
mov r11d, 8
sub rdi, rcx
sub r11b, r8b
mov ebx, 0x10
sub rdi, rax
lea rdx, [r9 + 1]
mov cl, r11b
mov al, byte [rdx]
shr al, cl
mov ecx, r8d
shl r10b, cl
or al, r10b
mov r10b, byte [rdx]
mov byte [r9 + rdi], al
lea r9, [rdx]
sub rbx, 1
jne 0x1400986e7
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14024c6d0
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400988cc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x20
call fcn.14024eae0
sub rsp, rax
mov r15, qword [rsp + 0x88]
mov rdi, r8
mov rsi, qword [rsp + 0x80]
mov r14, rdx
mov rbp, rcx
mov ebx, dword [r15]
test ebx, ebx
je 0x14009892e
test rdi, rdi
je 0x14009892e
mov eax, ebx
dec rdi
mov cl, byte [rax + rsi]
xor cl, byte [rbp]
inc rbp
mov byte [r14], cl
inc r14
inc ebx
and ebx, 0xf
jne 0x14009890e
cmp rdi, 0x10
jb 0x1400989cd
mov r15, r14
mov r13, rdi
shr r13, 4
mov r12, rbp
imul rax, r13, 0xfffffffffffffff0
sub r15, rsi
sub r12, rsi
add rdi, rax
mov rax, r13
shl rax, 4
add r14, rax
mov qword [rsp + 0x68], r14
add rbp, rax
mov r14, qword [rsp + 0x78]
mov rax, qword [rsp + 0x90]
mov r8, r14
mov rdx, rsi
mov rcx, rsi
call qword [case.0x14004a846.0]
cmp ebx, 0x10
jae 0x1400989ab
mov edx, 0xf
mov ecx, ebx
sub edx, ebx
add rcx, rsi
shr edx, 3
inc edx
mov rax, qword [r12 + rcx]
xor rax, qword [rcx]
mov qword [r15 + rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x140098996
add r15, 0x10
add r12, 0x10
xor ebx, ebx
sub r13, 1
jne 0x140098969
mov r14, qword [rsp + 0x68]
mov r15, qword [rsp + 0x88]
mov r9, qword [rsp + 0x78]
test rdi, rdi
je 0x1400989fd
mov rax, qword [rsp + 0x90]
mov r8, r9
mov rdx, rsi
mov rcx, rsi
call qword [case.0x14004a846.0]
mov ecx, ebx
inc ebx
mov al, byte [rcx + rbp]
xor al, byte [rcx + rsi]
mov byte [rcx + r14], al
sub rdi, 1
jne 0x1400989e9
mov dword [r15], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140098c24
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movzx eax, byte [rcx + 0xf]
lea rsi, [0x1402a5400]
mov r9d, eax
mov rdi, rdx
and eax, 0xf
and r9, 0xfffffffffffffff0
add rax, rax
mov r10, rcx
mov r8, qword [rdx + rax*8]
mov rbx, qword [rdx + rax*8 + 8]
mov r11, r8
mov rax, rbx
shr r11, 4
and eax, 0xf
shr rbx, 4
shl r8, 0x3c
or rbx, r8
xor r11, qword [rsi + rax*8]
xor r11, qword [r9 + rdx]
xor rbx, qword [r9 + rdx + 8]
mov r9d, reloc.Cabinet.dll_FCIDestroy
movzx ecx, byte [r9 + r10]
mov rax, rbx
mov rdx, r11
shr rbx, 4
shl r11, 0x3c
mov r8d, ecx
or r11, rbx
shr rdx, 4
and ecx, 0xf
and eax, 0xf
add rcx, rcx
and r8, 0xfffffffffffffff0
xor rdx, qword [rsi + rax*8]
xor r11, qword [rdi + rcx*8 + 8]
xor rdx, qword [rdi + rcx*8]
mov rax, r11
mov rcx, r11
and eax, 0xf
shr rcx, 4
mov r11, rdx
shr r11, 4
mov rbx, rdx
shl rbx, 0x3c
xor r11, qword [rsi + rax*8]
or rbx, rcx
xor r11, qword [r8 + rdi]
xor rbx, qword [r8 + rdi + 8]
sub r9, 1
jns 0x140098c85
mov rsi, qword [rsp + 0x10]
mov rcx, r11
mov rdi, qword [rsp + 0x18]
shr rcx, 0x20
mov eax, ecx
mov byte [r10 + 3], cl
shr eax, 0x18
mov byte [r10], al
mov eax, ecx
shr eax, 0x10
mov byte [r10 + 1], al
mov eax, ecx
shr eax, 8
mov rcx, rbx
mov byte [r10 + 2], al
mov eax, r11d
shr eax, 0x18
mov byte [r10 + 4], al
mov eax, r11d
shr eax, 0x10
mov byte [r10 + 5], al
mov eax, r11d
shr eax, 8
mov byte [r10 + 6], al
shr rcx, 0x20
mov eax, ecx
mov byte [r10 + 0xf], bl
shr eax, 0x18
mov byte [r10 + 8], al
mov eax, ecx
shr eax, 0x10
mov byte [r10 + 9], al
mov eax, ecx
shr eax, 8
mov byte [r10 + 0xa], al
mov eax, ebx
shr eax, 0x18
mov byte [r10 + 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [r10 + 0xd], al
mov eax, ebx
mov rbx, qword [rsp + 8]
shr eax, 8
mov byte [r10 + 0xe], al
mov byte [r10 + 7], r11b
mov byte [r10 + 0xb], cl
ret
Function at 0x140098d8c
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
push r15
mov rbx, rcx
lea rsi, [r8 + 0xe]
sub rbx, r8
lea r13, [0x1402a5400]
mov rbp, r9
mov rdi, rdx
mov r10, rcx
movzx eax, byte [r10 + 0xf]
mov r14, rsi
movzx ecx, byte [rsi + 1]
mov r15d, 0xf
xor rcx, rax
mov r8, rcx
and ecx, 0xf
add rcx, rcx
and r8, 0xfffffffffffffff0
mov r9, qword [rdi + rcx*8 + 8]
mov rdx, qword [rdi + rcx*8]
mov rax, r9
and eax, 0xf
shr r9, 4
mov r11, rdx
shl rdx, 0x3c
shr r11, 4
or r9, rdx
xor r11, qword [r13 + rax*8]
xor r11, qword [r8 + rdi]
xor r9, qword [r8 + rdi + 8]
movzx eax, byte [r14]
mov rdx, r11
movzx ecx, byte [rbx + r14]
dec r14
xor rcx, rax
shl r11, 0x3c
mov rax, r9
shr rdx, 4
shr r9, 4
mov r8, rcx
or r11, r9
and ecx, 0xf
add rcx, rcx
and eax, 0xf
and r8, 0xfffffffffffffff0
xor r11, qword [rdi + rcx*8 + 8]
xor rdx, qword [r13 + rax*8]
mov rax, r11
xor rdx, qword [rdi + rcx*8]
and eax, 0xf
mov rcx, r11
mov r9, rdx
shl r9, 0x3c
mov r11, rdx
shr r11, 4
xor r11, qword [r13 + rax*8]
xor r11, qword [r8 + rdi]
shr rcx, 4
or r9, rcx
xor r9, qword [r8 + rdi + 8]
sub r15, 1
jne 0x140098e10
mov rcx, r11
mov byte [r10 + 7], r11b
shr rcx, 0x20
add rsi, 0x10
mov eax, ecx
mov byte [r10 + 3], cl
shr eax, 0x18
sub rbx, 0x10
mov byte [r10], al
mov eax, ecx
shr eax, 0x10
mov byte [r10 + 1], al
mov eax, ecx
shr eax, 8
mov rcx, r9
mov byte [r10 + 2], al
mov eax, r11d
shr eax, 0x18
mov byte [r10 + 4], al
mov eax, r11d
shr eax, 0x10
mov byte [r10 + 5], al
mov eax, r11d
shr eax, 8
mov byte [r10 + 6], al
shr rcx, 0x20
mov eax, ecx
mov byte [r10 + 0xb], cl
shr eax, 0x18
mov byte [r10 + 8], al
mov eax, ecx
shr eax, 0x10
mov byte [r10 + 9], al
mov eax, ecx
shr eax, 8
mov byte [r10 + 0xa], al
mov eax, r9d
shr eax, 0x18
mov byte [r10 + 0xc], al
mov eax, r9d
shr eax, 0x10
mov byte [r10 + 0xd], al
mov eax, r9d
shr eax, 8
mov byte [r10 + 0xe], al
mov byte [r10 + 0xf], r9b
sub rbp, 0x10
jne 0x140098dbf
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r13
ret
Function at 0x140099058
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
mov eax, 0x20
call fcn.14024eae0
sub rsp, rax
xorps xmm0, xmm0
xorps xmm1, xmm1
movups xmmword [rcx], xmm0
mov rdi, r8
mov rsi, rdx
movups xmmword [rcx + 0x40], xmm1
mov rbx, rcx
movups xmmword [rcx + 0x30], xmm0
and dword [rcx + 0x174], 0
and dword [rcx + 0x170], 0
cmp r8, 0xc
jne 0x1400990c7
movsd xmm0, qword [rdx]
lea edi, [r8 - 0xb]
movsd qword [rcx], xmm0
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
mov byte [rcx + 0xf], 1
jmp 0x1400991ba
lea r15, [rcx + 0x60]
mov r12, rdi
cmp rdi, 0x10
jb 0x14009911e
mov rbp, rdi
mov r14, rsi
shr rbp, 4
sub r14, rbx
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
mov rax, rbp
shl rax, 4
add rsi, rax
mov rcx, rbx
mov edx, 0x10
mov al, byte [r14 + rcx]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1400990fa
mov rdx, r15
mov rcx, rbx
call fcn.140098c24
add r14, 0x10
sub rbp, 1
jne 0x1400990f2
test rdi, rdi
je 0x140099142
mov rcx, rbx
sub rsi, rbx
mov al, byte [rcx + rsi]
xor byte [rcx], al
inc rcx
sub rdi, 1
jne 0x140099129
mov rdx, r15
mov rcx, rbx
call fcn.140098c24
shl r12, 3
mov rdx, r15
xor byte [rbx + 0xf], r12b
mov rax, r12
shr rax, 0x38
mov rcx, rbx
xor byte [rbx + 8], al
mov rax, r12
shr rax, 0x30
xor byte [rbx + 9], al
mov rax, r12
shr rax, 0x28
xor byte [rbx + 0xa], al
mov rax, r12
shr rax, 0x20
xor byte [rbx + 0xb], al
mov rax, r12
shr rax, 0x18
xor byte [rbx + 0xc], al
mov rax, r12
shr rax, 0x10
xor byte [rbx + 0xd], al
mov rax, r12
shr rax, 8
xor byte [rbx + 0xe], al
call fcn.140098c24
movzx eax, byte [rbx + 0xd]
movzx edi, byte [rbx + 0xc]
shl edi, 8
or edi, eax
movzx eax, byte [rbx + 0xe]
shl edi, 8
or edi, eax
movzx eax, byte [rbx + 0xf]
shl edi, 8
or edi, eax
mov r8, qword [rbx + 0x180]
lea rdx, [rbx + 0x20]
mov rax, qword [rbx + 0x178]
mov rcx, rbx
call qword [case.0x14004a846.0]
mov rbp, qword [rsp + 0x48]
inc edi
mov rsi, qword [rsp + 0x50]
mov eax, edi
shr eax, 0x18
mov byte [rbx + 0xc], al
mov eax, edi
shr eax, 0x10
mov byte [rbx + 0xd], al
mov eax, edi
mov byte [rbx + 0xf], dil
mov rdi, qword [rsp + 0x58]
shr eax, 8
mov byte [rbx + 0xe], al
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140099214
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
mov eax, 0x20
call fcn.14024eae0
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov rdi, r8
mov r14, rdx
mov rbx, rcx
je 0x140099254
mov eax, 0xfffffffe
jmp 0x140099309
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, r8
cmp rcx, rax
ja 0x140099306
cmp rcx, r8
jb 0x140099306
mov esi, dword [rbx + 0x174]
mov qword [rbx + 0x30], rcx
test esi, esi
je 0x1400992b9
test rdi, rdi
je 0x1400992a0
mov al, byte [r14]
dec rdi
mov ecx, esi
inc r14
xor byte [rcx + rbx + 0x40], al
inc esi
and esi, 0xf
jne 0x140099285
test esi, esi
jne 0x1400992fc
lea r12, [rbx + 0x60]
lea rbp, [rbx + 0x40]
mov rdx, r12
mov rcx, rbp
call fcn.140098c24
jmp 0x1400992c1
lea r12, [rbx + 0x60]
lea rbp, [rbx + 0x40]
mov r15, rdi
and r15, 0xfffffffffffffff0
je 0x1400992e1
mov r9, r15
mov r8, r14
mov rdx, r12
mov rcx, rbp
call fcn.140098d8c
add r14, r15
sub rdi, r15
test rdi, rdi
je 0x1400992fc
mov esi, edi
sub r14, rbx
mov al, byte [r14 + rbp - 0x40]
xor byte [rbp], al
inc rbp
sub rdi, 1
jne 0x1400992eb
mov dword [rbx + 0x174], esi
xor eax, eax
jmp 0x140099309
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140099f20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x20
call fcn.14024eae0
sub rsp, rax
mov r12, qword [rcx + 0x30]
xor esi, esi
mov r13, qword [rcx + 0x38]
mov rbp, r8
shl r12, 3
mov r14, rdx
shl r13, 3
mov rbx, rcx
cmp dword [rcx + 0x170], esi
jne 0x140099f7a
cmp dword [rcx + 0x174], esi
jne 0x140099f7a
lea r15, [rcx + 0x60]
lea rdi, [rcx + 0x40]
jmp 0x140099f8d
lea r15, [rcx + 0x60]
lea rdi, [rcx + 0x40]
mov rdx, r15
mov rcx, rdi
call fcn.140098c24
mov qword [rbx + 0x30], r12
mov rdx, r15
mov qword [rbx + 0x38], r13
movzx r8d, byte [rbx + 0x31]
movzx eax, r12b
shl rax, 8
or r8, rax
movzx ecx, r13b
movzx eax, byte [rbx + 0x32]
shl rcx, 8
shl r8, 8
or r8, rax
movzx eax, byte [rbx + 0x33]
shl r8, 8
or r8, rax
movzx eax, byte [rbx + 0x34]
shl r8, 8
or r8, rax
movzx eax, byte [rbx + 0x35]
shl r8, 8
or r8, rax
movzx eax, byte [rbx + 0x36]
shl r8, 8
or r8, rax
movzx eax, byte [rbx + 0x37]
shl r8, 8
or r8, rax
movzx eax, byte [rbx + 0x39]
or rcx, rax
movzx eax, byte [rbx + 0x3a]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 0x3b]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 0x3c]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 0x3d]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 0x3e]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx + 0x3f]
xor qword [rdi], r8
shl rcx, 8
or rcx, rax
xor qword [rbx + 0x48], rcx
mov rcx, rdi
call fcn.140098c24
mov rcx, rdi
mov edx, 2
mov rax, qword [rcx - 0x20]
xor qword [rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x14009a052
test r14, r14
je 0x14009a090
cmp rbp, 0x10
ja 0x14009a090
test rbp, rbp
je 0x14009a08a
sub r14, rdi
mov cl, byte [r14 + rdi]
mov al, byte [rdi]
inc rdi
xor cl, al
or sil, cl
sub rbp, 1
jne 0x14009a076
movzx eax, sil
jmp 0x14009a093
or eax, 0xffffffff
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14009a5b8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, WSACleanup
call fcn.14024eae0
sub rsp, rax
mov rax, qword [0x14035d028]
xor rax, rsp
mov qword [rsp + 0x68], rax
movzx esi, byte [rcx]
lea rdi, [rcx + 0x10]
mov r12, qword [rcx + 0x28]
mov rbp, r9
mov r13, qword [rcx + 0x30]
mov rbx, rcx
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x38], rdx
mov byte [rsp + 0x20], sil
mov qword [rsp + 0x40], rdi
test sil, 0x40
jne 0x14009a624
mov r8, r13
mov rdx, rdi
mov rax, r12
call qword [case.0x14004a846.0]
jmp 0x14009a629
mov qword [rsp + 0x40], rdi
mov r8d, esi
xor esi, esi
and r8d, 7
mov ecx, esi
mov byte [rbx], r8b
lea r15d, [rsi + 0xf]
sub r15d, r8d
mov dword [rsp + 0x30], r15d
cmp r15d, 0xf
jae 0x14009a668
mov edx, r15d
add rdx, rbx
mov r9d, r8d
movzx eax, byte [rdx]
or rcx, rax
mov byte [rdx], sil
shl rcx, 8
inc rdx
sub r9, 1
jne 0x14009a652
movzx eax, byte [rbx + 0xf]
or rcx, rax
mov byte [rbx + 0xf], 1
cmp rcx, rbp
je 0x14009a680
or eax, 0xffffffff
jmp 0x14009a7dc
mov r14d, 0x10
cmp rbp, r14
jb 0x14009a734
mov rax, rbp
lea rdi, [rbx + 0x10]
shr rax, 4
mov qword [rsp + 0x48], rax
mov r15, qword [rsp + 0x48]
imul rax, rax, 0xfffffffffffffff0
add rbp, rax
mov qword [rsp + 0x50], rbp
mov rbp, qword [rsp + 0x38]
mov r8, r13
lea rdx, [rsp + 0x58]
mov rcx, rbx
mov rax, r12
call qword [case.0x14004a846.0]
mov edx, 8
dec edx
add byte [rdx + rbx + 8], 1
jne 0x14009a6db
test edx, edx
jne 0x14009a6ce
mov r8, qword [rsp + 0x28]
mov rdx, rdi
mov rax, qword [rsp + 0x58]
mov rcx, rdi
xor rax, qword [rbp]
mov qword [r8], rax
xor qword [rdi], rax
mov rax, qword [rsp + 0x60]
xor rax, qword [rbp + 8]
mov qword [r8 + 8], rax
mov r8, r13
xor qword [rbx + 0x18], rax
mov rax, r12
call qword [case.0x14004a846.0]
add qword [rsp + 0x28], r14
add rbp, r14
sub r15, 1
jne 0x14009a6b5
mov rdi, qword [rsp + 0x40]
mov r15d, dword [rsp + 0x30]
mov qword [rsp + 0x38], rbp
mov rbp, qword [rsp + 0x50]
test rbp, rbp
je 0x14009a789
mov r8, r13
lea rdx, [rsp + 0x58]
mov rcx, rbx
mov rax, r12
call qword [case.0x14004a846.0]
test rbp, rbp
je 0x14009a777
mov rdx, qword [rsp + 0x38]
mov rcx, rsi
mov r8, qword [rsp + 0x28]
mov al, byte [rcx + rdx]
inc esi
xor al, byte [rsp + rcx + 0x58]
mov byte [r8 + rcx], al
xor byte [rcx + rbx + 0x10], al
mov ecx, esi
cmp rcx, rbp
jb 0x14009a75f
mov r8, r13
mov rdx, rdi
mov rcx, rdi
mov rax, r12
call qword [case.0x14004a846.0]
cmp r15d, r14d
jae 0x14009a7a1
sub r14d, r15d
mov ecx, r15d
mov r8d, r14d
add rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r8, r13
lea rdx, [rsp + 0x58]
mov rcx, rbx
mov rax, r12
call qword [case.0x14004a846.0]
lea rcx, [rsp + 0x58]
mov edx, 2
sub rcx, rbx
mov rax, qword [rcx + rdi - 0x10]
xor qword [rdi], rax
lea rdi, [rdi + 8]
sub rdx, 1
jne 0x14009a7c2
mov al, byte [rsp + 0x20]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.14024c6d0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret