joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140055290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x30
movsxd rax, edx
mov rdi, rcx
dec rax
mov qword [r11 + 0x18], rbp
mov rbp, r9
xor r9d, r9d
lea rax, [rcx + rax*2]
mov qword [rsp + 8], rax
cmp rcx, rax
jae 0x1400554b9
mov qword [r11 + 0x20], rsi
lea rsi, [0x140000000]
mov qword [r11 + 0x10], rbx
mov qword [r11 - 0x10], r12
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
mov qword [rsp], r8
test rbp, rbp
je 0x1400552f2
cmp r8, rbp
jae 0x140055496
movzx edx, byte [r8]
test dl, dl
je 0x140055496
mov eax, edx
mov rcx, rbp
shr rax, 3
movsx r9, byte [rax + rsi + 0x113670]
xor eax, eax
test r9d, r9d
mov ebx, eax
sete bl
add ebx, r9d
test rbp, rbp
jne 0x140055328
movsxd rcx, ebx
add rcx, r8
cmp r8, rcx
mov r14d, edx
cmovae r14d, eax
lea rax, [r8 + 1]
cmp rax, rcx
jae 0x140055341
movzx r13d, byte [rax]
jmp 0x140055344
xor r13b, r13b
lea rax, [r8 + 2]
cmp rax, rcx
jae 0x140055353
movzx r12d, byte [rax]
jmp 0x140055356
xor r12b, r12b
lea rax, [r8 + 3]
cmp rax, rcx
jae 0x140055365
movzx r15d, byte [rax]
jmp 0x140055368
xor r15b, r15b
lea r10, [r9*4]
movzx eax, r14b
mov esi, dword [r10 + rsi + 0x113690]
and esi, eax
movzx r9d, r13b
shl esi, 6
mov eax, r9d
and eax, 0x3f
movzx edx, r12b
or esi, eax
movzx r11d, r15b
shl esi, 6
and r9d, 0xc0
mov eax, edx
and edx, 0xc0
and eax, 0x3f
or esi, eax
mov eax, r11d
shr r11d, 2
and eax, 0x3f
or r11d, edx
shl esi, 6
or esi, eax
shr r11d, 2
or r11d, r9d
lea rax, [0x140000000]
mov ecx, dword [r10 + rax + 0x1136c0]
shr r11d, 2
shr esi, cl
mov ecx, 0x100
cmp esi, dword [r10 + rax + 0x1136a8]
sbb eax, eax
xor r9d, r9d
and eax, 0x40
mov edx, r9d
or r11d, eax
mov eax, esi
and eax, 0xfffff800
cmp eax, 0xd800
mov eax, 0x80
cmove edx, eax
mov eax, r9d
or r11d, edx
cmp esi, 0xffff
cmova eax, ecx
lea rcx, [0x140000000]
mov ecx, dword [r10 + rcx + 0x1136d8]
or r11d, eax
xor r11d, 0x2a
sar r11d, cl
test r11d, r11d
je 0x140055473
test r14b, r14b
mov eax, r9d
mov ecx, r9d
mov esi, 0xfffd
setne cl
test r15b, r15b
setne al
add ecx, eax
mov eax, r9d
test r12b, r12b
setne al
add ecx, eax
mov eax, r9d
test r13b, r13b
setne al
add ecx, eax
cmp ebx, ecx
cmovl ecx, ebx
movsxd r8, ecx
add r8, qword [rsp]
jmp 0x14005547d
movsxd rax, ebx
add r8, rax
test esi, esi
je 0x140055496
mov word [rdi], si
add rdi, 2
lea rsi, [0x140000000]
cmp rdi, qword [rsp + 8]
jb 0x1400552e0
mov rcx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x10]
mov r14, qword [rsp + 0x18]
mov r13, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x48]
mov rax, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x50]
mov word [rdi], r9w
test rax, rax
je 0x1400554cf
mov qword [rax], r8
sub rdi, rcx
sar rdi, 1
mov eax, edi
add rsp, 0x30
pop rdi
ret
Function at 0x140056990
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3260], 0
lea rbx, [rcx + 0x3268]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140056a37
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x1400569ea
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140064c60
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400645e0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x3260]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x3270]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14016b568]
cmovne rcx, rax
call qword [sym.imp.ucrtbase.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x140056a3f
mov rcx, rbx
call fcn.1400645e0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14005f460
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x14016b560]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x31fc], ecx
test rbx, rbx
je 0x14005f4cf
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.14005f4e0
lea rdx, [0x140113888]
mov rcx, rbx
mov rdi, rax
call fcn.140054ab0
mov rbx, rax
test rax, rax
je 0x14005f4ca
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.ucrtbase.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.ucrtbase.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret

Function at 0x140062670
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rbx, qword [0x14016b560]
cmp byte [rbx + 0x31f8], 0
jne 0x1400627cb
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400627c4
lea rdx, [0x140113884]
mov qword [rsp + 0x38], rdi
call fcn.140054ab0
mov rdi, rax
test rax, rax
je 0x1400627bf
mov qword [rsp + 0x40], r14
mov rcx, rax
mov qword [rsp + 0x30], rbp
call qword [sym.imp.ucrtbase.dll_ftell]
mov r14d, eax
cmp eax, 0xffffffff
je 0x1400627ac
xor edx, edx
mov r8d, 2
mov rcx, rdi
call qword [sym.imp.ucrtbase.dll_fseek]
test eax, eax
jne 0x1400627ac
mov rcx, rdi
call qword [sym.imp.ucrtbase.dll_ftell]
movsxd rbp, eax
cmp ebp, 0xffffffff
je 0x1400627ac
xor r8d, r8d
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.ucrtbase.dll_fseek]
test eax, eax
jne 0x1400627ac
mov r14, rbp
cmp rbp, 0xffffffffffffffff
je 0x1400627ac
mov rax, qword [0x14016b560]
test rax, rax
je 0x14006273b
inc dword [rax + 0x3b0]
mov rdx, qword [0x14016b570]
mov rcx, r14
call qword [section._________1]
mov rbp, rax
test rax, rax
je 0x1400627ac
mov r9, rdi
mov r8, r14
mov edx, 1
mov rcx, rax
call qword [sym.imp.ucrtbase.dll_fread]
mov rcx, rdi
cmp rax, r14
je 0x140062777
call qword [sym.imp.ucrtbase.dll_fclose]
jmp 0x140062788
call qword [sym.imp.ucrtbase.dll_fclose]
mov rdx, r14
mov rcx, rbp
call fcn.1400563d0
mov rax, qword [0x14016b560]
test rax, rax
je 0x14006279a
dec dword [rax + 0x3b0]
mov rdx, qword [0x14016b570]
mov rcx, rbp
call qword [0x14015c008]
jmp 0x1400627b5
mov rcx, rdi
call qword [sym.imp.ucrtbase.dll_fclose]
mov rbp, qword [rsp + 0x30]
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov byte [rbx + 0x31f8], 1
movss xmm0, dword [rbx + 0x31fc]
xorps xmm1, xmm1
comiss xmm0, xmm1
jbe 0x14006280e
subss xmm0, dword [rbx + 0x18]
comiss xmm1, xmm0
movss dword [rbx + 0x31fc], xmm0
jb 0x14006280e
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400627fd
call fcn.14005f460
jmp 0x140062804
mov byte [rbx + 0x398], 1
mov dword [rbx + 0x31fc], 0
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x140079150
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14016b560]
mov r9, qword [rax + 0x2178]
mov r10, qword [rax + 0x1d18]
movsxd rax, dword [r9 + 0x74]
movups xmm0, xmmword [r9 + 0x18c]
movss xmm4, dword [r9 + 0x18c]
movss xmm3, dword [r9 + 0x190]
movss xmm2, dword [r9 + 0x194]
movss xmm1, dword [r9 + 0x198]
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
imul r8, rax, 0x68
mov rax, qword [r10 + 0x2f8]
add r8, qword [r9 + 0x10]
movups xmmword [r10 + 0x290], xmm0
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x2f8]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
movzx r8d, byte [r8 + 0x57]
lea rcx, [r9 + 0x1e8]
mov rdx, qword [r10 + 0x2f8]
add rsp, 0x38
jmp fcn.14006d700

Function at 0x140079220
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14016b560]
mov r9, qword [rax + 0x2178]
mov r10, qword [rax + 0x1d18]
movups xmm0, xmmword [r10 + 0x290]
movups xmmword [r9 + 0x18c], xmm0
mov rax, qword [r10 + 0x2f8]
movups xmm0, xmmword [r9 + 0x14c]
movss xmm4, dword [r9 + 0x14c]
movss xmm3, dword [r9 + 0x150]
movss xmm2, dword [r9 + 0x154]
movss xmm1, dword [r9 + 0x158]
movups xmmword [r10 + 0x290], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x2f8]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
movzx r8d, byte [r9 + 0x247]
lea rcx, [r9 + 0x1e8]
mov rdx, qword [r10 + 0x2f8]
add rsp, 0x38
jmp fcn.14006d700
Function at 0x140088da0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140164240]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140088e73
cmp byte [rcx + 0x71], 0
je 0x140088e73
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140088e6f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.msvcp140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140088e34
sub eax, 1
je 0x140088e38
cmp eax, 2
jne 0x140088e6f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14010c660
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140088e66
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.ucrtbase.dll_fwrite]
cmp rdi, rax
jne 0x140088e6f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140088e1c
xor al, al
jmp 0x140088e1c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14010c660
add rsp, 0x60
pop rbx
ret
Function at 0x140099870
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x140099935
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x140099935
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x14009994e
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx + 0x10]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx]
cmp rcx, rax
je 0x140099925
cmp byte [rcx], 0x5c
jne 0x14009991e
lea rdx, [rcx + 1]
cmp rdx, rax
je 0x14009991e
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x14009990c
movzx eax, byte [rdx]
sub al, 0x28
cmp al, 1
jbe 0x14009991b
test r8b, 0x10
jne 0x14009991e
movzx eax, byte [rdx]
sub al, 0x7b
test al, 0xfd
jne 0x14009991e
mov rcx, rdx
lea rax, [rcx + 1]
mov qword [rbx], rax
mov rcx, rbx
call fcn.14009c470
test edi, edi
jne 0x140099890
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.14009ade0
int3
Function at 0x14009d880
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14009d8e1
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14009d8a0
mov ecx, dword [r9]
jmp 0x14009d9cb
cmp ecx, 0x4e0
jb 0x14009d9cb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14009d900
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x14009d950
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14009df40
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x13d0
call fcn.14010c690
sub rsp, rax
mov rax, qword [0x140164240]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
mov edi, edx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
mov dword [rsp + 0x20], esi
call sub.msvcp140.dll_unsigned_int___cdecl_std::_Random_device_void_
mov r8d, eax
mov dword [rsp + 0x13b4], 0xffffffff
mov dword [rsp + 0x34], eax
mov ecx, 1
nop word [rax + rax]
mov eax, r8d
shr eax, 0x1e
xor eax, r8d
imul r8d, eax, 0x6c078965
add r8d, ecx
mov dword [rsp + rcx*4 + 0x34], r8d
inc rcx
cmp rcx, 0x270
jb 0x14009dfa0
mov dword [rsp + 0x30], 0x270
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], sil
mov dword [rsp + 0x20], 1
test edi, edi
jle 0x14009e066
nop dword [rax]
lea rcx, [rsp + 0x30]
call fcn.14009d880
mov ecx, eax
imul r9, rcx, 0x1a
cmp r9d, 0x15
ja 0x14009e01c
lea rcx, [rsp + 0x30]
call fcn.14009d880
mov ecx, eax
imul r9, rcx, 0x1a
cmp r9d, 0x16
jb 0x14009e006
shr r9, 0x20
add r9b, 0x61
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x14009e050
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x14009e045
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x14009e060
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call fcn.140086770
sub rdi, 1
jne 0x14009dff0
mov rax, rbx
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.14010c660
lea r11, [rsp + 0x13d0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14009f8a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x14009f8d4
mov eax, esi
lea ecx, [rax - 0x15]
xor byte [r8 + rax], cl
inc rax
cmp rax, 5
jb 0x14009f8c0
mov byte [r8 + 6], sil
add r8, 5
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14009eca0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14009f8f9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400b25f0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14009f973
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009f96e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009f96e
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010c1ec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14009f980
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x14009f9b4
mov eax, esi
lea ecx, [rax - 0x15]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x14009f9a0
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14009eca0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14009f9d9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400b25f0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14009fa53
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009fa4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009fa4e
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010c1ec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14009fa60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 8], sil
je 0x14009fa94
mov eax, esi
lea ecx, [rax - 0x15]
xor byte [r8 + rax], cl
inc rax
cmp rax, 7
jb 0x14009fa80
mov byte [r8 + 8], sil
add r8, 7
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14009eca0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14009fab9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400b25f0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14009fb33
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009fb2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009fb2e
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010c1ec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14009fb40
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r10, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor ebx, ebx
cmp byte [r8 + 9], bl
je 0x14009fb74
mov ecx, ebx
lea eax, [rcx - 0x15]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x14009fb60
mov byte [r8 + 9], bl
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x50]
call fcn.14009eca0
nop
cmp byte [rdi + 9], 0
je 0x14009fba4
lea eax, [rbx - 0x15]
xor byte [rdi + rbx], al
inc rbx
cmp rbx, 8
jb 0x14009fb91
mov byte [rdi + 9], 0
lea r8, [rdi + 8]
lea r9, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.14009eca0
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
movzx edx, byte [rsp + 0x20]
mov rcx, rsi
call fcn.1400a6bf0
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14009fc14
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009fc0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009fc0e
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010c1ec
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14009fc54
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009fc4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009fc4f
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010c1ec
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret

Function at 0x14009fc60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x14009fc94
mov eax, esi
lea ecx, [rax - 0x15]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x14009fc80
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14009eca0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14009fcb9
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400b25f0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14009fd33
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009fd2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009fd2e
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010c1ec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x14009fd40
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x14009fd74
mov eax, esi
lea ecx, [rax - 0x15]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x14009fd60
mov byte [r8 + 0xa], sil
add r8, 9
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14009eca0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14009fd99
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400b25f0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14009fe13
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009fe0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009fe0e
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010c1ec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x14009fe20
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 0x31], sil
je 0x14009fe54
mov eax, esi
lea ecx, [rax - 0x15]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0x30
jb 0x14009fe40
mov byte [r8 + 0x31], sil
add r8, 0x30
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.14009eca0
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14009fe79
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.1400b25f0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14009fef3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14009feee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14009feee
call qword [sym.imp.ucrtbase.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010c1ec
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret