joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006770
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x140102080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400ee000]
movdqu xmmword [rbp - 0x11], xmm0
movdqa xmm1, xmmword [0x1400ee270]
movdqu xmmword [rbp - 1], xmm1
movdqa xmm0, xmmword [0x1400ee1d0]
movdqu xmmword [rbp + 0xf], xmm0
mov dword [rbp + 0x1f], 0x26424026
mov word [rbp + 0x23], 0x3040
xor eax, eax
mov byte [rbp + 0x25], al
xor ebx, ebx
mov ecx, ebx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp - 0x11]
xor byte [rbp + rcx - 0x10], al
inc rcx
cmp rcx, 0x35
jb 0x1400067e0
mov byte [rbp + 0x25], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x10]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140006811
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x27]
call fcn.140004180
nop
movdqa xmm0, xmmword [0x1400ee9a0]
movdqu xmmword [rbp - 0x49], xmm0
movdqa xmm1, xmmword [0x1400eeb90]
movdqu xmmword [rbp - 0x39], xmm1
movdqa xmm0, xmmword [0x1400eeb10]
movdqu xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x19], 0x6e0a086e
mov word [rbp - 0x15], 0x7808
xor eax, eax
mov byte [rbp - 0x13], al
movzx eax, byte [rbp - 0x49]
xor byte [rbp + rbx - 0x48], al
inc rbx
cmp rbx, 0x35
jb 0x140006861
mov byte [rbp - 0x13], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 1], xmm1
lea rax, [rbp - 0x48]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140006890
mov r8, rdi
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x11]
call fcn.140004180
nop
cmp byte [0x1401034e7], 0
je 0x1400068e5
lea r8, [0x140103d78]
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 0x27]
call fcn.140005050
mov byte [0x1401034db], 0
mov byte [0x1401034da], 0
mov byte [0x1401034dd], 0
mov byte [0x1401034b1], 0
jmp 0x1400068f6
lea rdx, [rbp + 0x27]
lea rcx, [0x140103d78]
call fcn.140005910
nop
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x140006935
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000692f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000692f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ca088
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140006973
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000696e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000696e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ca088
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400ca060
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400069a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x140102080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400ee8c0]
movdqu xmmword [rbp - 0x11], xmm0
movdqa xmm1, xmmword [0x1400eeab0]
movdqu xmmword [rbp - 1], xmm1
movdqa xmm0, xmmword [0x1400eeb70]
movdqu xmmword [rbp + 0xf], xmm0
mov dword [rbp + 0x1f], 0x680c0e68
mov word [rbp + 0x23], 0x7e0e
xor eax, eax
mov byte [rbp + 0x25], al
xor ebx, ebx
mov ecx, ebx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbp - 0x11]
xor byte [rbp + rcx - 0x10], al
inc rcx
cmp rcx, 0x35
jb 0x140006a10
mov byte [rbp + 0x25], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x10]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140006a41
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x27]
call fcn.140004180
nop
movdqa xmm0, xmmword [0x1400ee660]
movdqu xmmword [rbp - 0x49], xmm0
movdqa xmm1, xmmword [0x1400ee4a0]
movdqu xmmword [rbp - 0x39], xmm1
movdqa xmm0, xmmword [0x1400ee3d0]
movdqu xmmword [rbp - 0x29], xmm0
mov dword [rbp - 0x19], 0x54303254
mov word [rbp - 0x15], 0x4232
xor eax, eax
mov byte [rbp - 0x13], al
movzx eax, byte [rbp - 0x49]
xor byte [rbp + rbx - 0x48], al
inc rbx
cmp rbx, 0x35
jb 0x140006a91
mov byte [rbp - 0x13], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x11], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 1], xmm1
lea rax, [rbp - 0x48]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140006ac0
mov r8, rdi
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x11]
call fcn.140004180
nop
cmp byte [0x1401034b1], 0
je 0x140006b15
lea r8, [0x140103d78]
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 0x27]
call fcn.140005050
mov byte [0x1401034db], 0
mov byte [0x1401034da], 0
mov byte [0x1401034dd], 0
mov byte [0x1401034e7], 0
jmp 0x140006b26
lea rdx, [rbp + 0x27]
lea rcx, [0x140103d78]
call fcn.140005910
nop
mov rdx, qword [rbp + 7]
cmp rdx, 0x10
jb 0x140006b65
inc rdx
mov rcx, qword [rbp - 0x11]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006b5f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ca088
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140006ba3
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006b9e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ca088
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400ca060
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140006bd0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x140102080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400eea30]
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x1400ee8b0]
movdqu xmmword [rbp - 9], xmm1
movdqa xmm0, xmmword [str.dtddt]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x74676d74
mov dword [rbp + 0x1b], 0x62746416
mov dword [rbp + 0x1f], 0x62607417
xor eax, eax
mov byte [rbp + 0x23], al
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rbp - 0x19]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0x3b
jb 0x140006c40
mov byte [rbp + 0x23], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x18]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140006c71
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x27]
call fcn.140004180
nop
movdqa xmm0, xmmword [0x1400ee5d0]
movdqu xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x1400ee3f0]
movdqu xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [0x1400ee280]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x51424851
mov dword [rbp - 0x25], 0x47514133
mov dword [rbp - 0x21], 0x47455132
xor eax, eax
mov byte [rbp - 0x1d], al
nop dword [rax]
movzx eax, byte [rbp - 0x59]
xor byte [rbp + rbx - 0x58], al
inc rbx
cmp rbx, 0x3b
jb 0x140006cd0
mov byte [rbp - 0x1d], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
lea rax, [rbp - 0x58]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140006d00
mov r8, rdi
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x19]
call fcn.140004180
nop
cmp byte [0x1401034e5], 0
je 0x140006d40
lea r8, [0x140103ca0]
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x27]
call fcn.140005050
mov byte [0x1401034b2], 0
jmp 0x140006d51
lea rdx, [rbp + 0x27]
lea rcx, [0x140103ca0]
call fcn.140005910
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x140006d90
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006d8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006d8a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ca088
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140006dce
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006dc9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006dc9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ca088
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400ca060
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140006df0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x140102080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400edeb0]
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x1400edd40]
movdqu xmmword [rbp - 9], xmm1
movdqa xmm0, xmmword [0x1400eeb20]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x1c0f051c
mov dword [rbp + 0x1b], 0xa1c0c7e
mov dword [rbp + 0x1f], 0xa081c7f
xor eax, eax
mov byte [rbp + 0x23], al
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rbp - 0x19]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0x3b
jb 0x140006e60
mov byte [rbp + 0x23], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x18]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140006e91
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x27]
call fcn.140004180
nop
movdqa xmm0, xmmword [0x1400eea10]
movdqu xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x1400ee840]
movdqu xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [str.csccs]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x73606a73
mov dword [rbp - 0x25], 0x65736311
mov dword [rbp - 0x21], 0x65677310
xor eax, eax
mov byte [rbp - 0x1d], al
nop dword [rax]
movzx eax, byte [rbp - 0x59]
xor byte [rbp + rbx - 0x58], al
inc rbx
cmp rbx, 0x3b
jb 0x140006ef0
mov byte [rbp - 0x1d], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
lea rax, [rbp - 0x58]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140006f20
mov r8, rdi
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x19]
call fcn.140004180
nop
cmp byte [0x1401034b2], 0
je 0x140006f60
lea r8, [0x140103ca0]
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x27]
call fcn.140005050
mov byte [0x1401034e5], 0
jmp 0x140006f71
lea rdx, [rbp + 0x27]
lea rcx, [0x140103ca0]
call fcn.140005910
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x140006fb0
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006faa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006faa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ca088
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140006fee
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006fe9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006fe9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ca088
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400ca060
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140007380
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x140102080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400edf40]
movdqa xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x1400ee260]
movdqa xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [0x1400ee250]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [0x1400edf30]
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm0, xmmword [0x1400ee2a0]
movdqa xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x31442147
xor eax, eax
mov byte [rbp - 5], al
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rbp - 0x59]
xor byte [rbp + rcx - 0x58], al
inc rcx
cmp rcx, 0x53
jb 0x140007400
mov byte [rbp - 5], bl
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x58]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140007431
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 7]
call fcn.140004180
nop
movdqa xmm0, xmmword [0x1400ee420]
movdqa xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x1400ee680]
movdqa xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [0x1400ee650]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [0x1400ee3e0]
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm0, xmmword [0x1400ee6d0]
movdqa xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x51244127
xor eax, eax
mov byte [rbp - 5], al
nop word [rax + rax]
movzx eax, byte [rbp - 0x59]
xor byte [rbp + rbx - 0x58], al
inc rbx
cmp rbx, 0x53
jb 0x1400074a0
mov byte [rbp - 5], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x58]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400074d0
mov r8, rdi
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x27]
call fcn.140004180
nop
cmp byte [0x1401034e3], 0
je 0x140007509
lea r8, [0x140103c88]
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 7]
call fcn.140005050
jmp 0x14000751a
lea rdx, [rbp + 7]
lea rcx, [0x140103c88]
call fcn.140005910
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140007559
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007553
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007553
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ca088
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x140007597
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007592
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007592
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ca088
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400ca060
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140007c00
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x140102080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400ee540]
movdqu xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x1400ee0f0]
movdqu xmmword [rbp - 9], xmm1
movdqa xmm0, xmmword [0x1400ee6c0]
movdqu xmmword [rbp + 7], xmm0
mov dword [rbp + 0x17], 0x4a2f594a
mov dword [rbp + 0x1b], 0x5a4a5a5a
mov dword [rbp + 0x1f], 0x2b5a4a5a
xor eax, eax
mov byte [rbp + 0x23], al
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rbp - 0x19]
xor byte [rbp + rcx - 0x18], al
inc rcx
cmp rcx, 0x3b
jb 0x140007c70
mov byte [rbp + 0x23], bl
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x18]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140007ca1
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x27]
call fcn.140004180
nop
movdqa xmm0, xmmword [0x1400ee1e0]
movdqu xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x1400ee6a0]
movdqu xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [str.R3V3333V__11_51__1_D0_10_]
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rbp - 0x29], 0x33562033
mov dword [rbp - 0x25], 0x23332323
mov dword [rbp - 0x21], 0x52233323
xor eax, eax
mov byte [rbp - 0x1d], al
nop dword [rax]
movzx eax, byte [rbp - 0x59]
xor byte [rbp + rbx - 0x58], al
inc rbx
cmp rbx, 0x3b
jb 0x140007d00
mov byte [rbp - 0x1d], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 9], xmm1
lea rax, [rbp - 0x58]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140007d30
mov r8, rdi
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x19]
call fcn.140004180
nop
cmp byte [0x1401034df], 0
je 0x140007d69
lea r8, [0x140103c28]
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x27]
call fcn.140005050
jmp 0x140007d7a
lea rdx, [rbp + 0x27]
lea rcx, [0x140103c28]
call fcn.140005910
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0x10
jb 0x140007db9
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007db3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007db3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ca088
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140007df7
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007df2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007df2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ca088
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400ca060
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x140007e20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x140102080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400edd90]
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmm1, xmmword [0x1400edd00]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm0, xmmword [0x1400edcb0]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1400eddb0]
movdqa xmmword [rbp - 0x19], xmm1
mov dword [rbp - 9], 0x2120202
mov dword [rbp - 5], 0x73031202
xor eax, eax
mov byte [rbp - 1], al
xor ebx, ebx
mov ecx, ebx
movzx eax, byte [rbp - 0x49]
xor byte [rbp + rcx - 0x48], al
inc rcx
cmp rcx, 0x47
jb 0x140007e90
mov byte [rbp - 1], bl
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x48]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140007ec1
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 7]
call fcn.140004180
nop
movdqa xmm0, xmmword [0x1400eeb30]
movdqa xmmword [rbp - 0x49], xmm0
movdqa xmm1, xmmword [0x1400ee870]
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmm0, xmmword [0x1400ee990]
movdqa xmmword [rbp - 0x29], xmm0
movdqa xmm1, xmmword [0x1400eeb40]
movdqa xmmword [rbp - 0x19], xmm1
mov dword [rbp - 9], 0x6b7b6b6b
mov dword [rbp - 5], 0x1a6a7b6b
xor eax, eax
mov byte [rbp - 1], al
nop
movzx eax, byte [rbp - 0x49]
xor byte [rbp + rbx - 0x48], al
inc rbx
cmp rbx, 0x47
jb 0x140007f20
mov byte [rbp - 1], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x48]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140007f50
mov r8, rdi
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x27]
call fcn.140004180
nop
cmp byte [0x1401034ce], 0
je 0x140007f89
lea r8, [0x140103d18]
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 7]
call fcn.140005050
jmp 0x140007f9a
lea rdx, [rbp + 7]
lea rcx, [0x140103d18]
call fcn.140005910
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x140007fd9
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007fd3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007fd3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ca088
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x140008017
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008012
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008012
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ca088
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400ca060
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x1400083f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xd0
mov rax, qword [0x140102080]
xor rax, rsp
mov qword [rbp + 0x47], rax
movdqa xmm0, xmmword [0x1400ee2e0]
movdqa xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x1400ee780]
movdqa xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [0x1400ee0e0]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [0x1400ee2d0]
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm0, xmmword [0x1400ee0a0]
movdqa xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x2f593c2c
xor eax, eax
mov byte [rbp - 5], al
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rbp - 0x59]
xor byte [rbp + rcx - 0x58], al
inc rcx
cmp rcx, 0x53
jb 0x140008470
mov byte [rbp - 5], bl
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x17], xmm1
lea rax, [rbp - 0x58]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x1400084a1
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 7]
call fcn.140004180
nop
movdqa xmm0, xmmword [0x1400ee230]
movdqa xmmword [rbp - 0x59], xmm0
movdqa xmm1, xmmword [0x1400ee5f0]
movdqa xmmword [rbp - 0x49], xmm1
movdqa xmm0, xmmword [0x1400edf80]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [0x1400ee1f0]
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm0, xmmword [0x1400edff0]
movdqa xmmword [rbp - 0x19], xmm0
mov dword [rbp - 9], 0x20563323
xor eax, eax
mov byte [rbp - 5], al
nop word [rax + rax]
movzx eax, byte [rbp - 0x59]
xor byte [rbp + rbx - 0x58], al
inc rbx
cmp rbx, 0x53
jb 0x140008510
mov byte [rbp - 5], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x27], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x37], xmm1
lea rax, [rbp - 0x58]
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140008540
mov r8, rdi
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x27]
call fcn.140004180
nop
cmp byte [0x1401034b0], 0
je 0x140008579
lea r8, [0x140103da8]
lea rdx, [rbp + 0x27]
lea rcx, [rbp + 7]
call fcn.140005050
jmp 0x14000858a
lea rdx, [rbp + 7]
lea rcx, [0x140103da8]
call fcn.140005910
nop
mov rdx, qword [rbp + 0x3f]
cmp rdx, 0x10
jb 0x1400085c9
inc rdx
mov rcx, qword [rbp + 0x27]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400085c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400085c3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ca088
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x140008607
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008602
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008602
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400ca088
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400ca060
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret